Re: Consolidated Proposal for Definition of Collect

On Oct 31, 2013, at 17:37 , Lee Tien <tien@eff.org> wrote:

> Two issues:  what's the right word or term; what's the consequence.
> 
> I'd be happy to label it "facilitating collection," just saying that to me the "tracking" seems equivalent from consumer PoV.  
> 
> I know we're in a defining phase for TPE but we're all mindful of  compliance implications, right?

OK, maybe a concrete question.  If I (a first party) write a page that pulls in a third-party resource, this causes clients who visit my page also to contact that third party.  Lee is saying that that constitutes "sharing" by the first party, even though the transaction from client to third party never came actually "through" the first party.  It's sort of an inducement, or the like.

Do we need to define this?  Is it really 'share', and an inducement to share?  Anyway, the first party will not re-write pages for DNT users, I doubt.

> 
> 
> Lee
> 
> Sent from my iPhone
> 
> On Oct 31, 2013, at 7:51 AM, "Dobbs, Brooks" <Brooks.Dobbs@kbmg.com> wrote:
> 
>> Lee,
>> 
>> Without addressing the merits of your larger point, I remain extremely worried about torturing language and taking words so far from their generally understood meaning.  To say I "collected" something when I never received it and did not know what it is, just seems to strain language too far.    
>> 
>> -Brooks
>> 
>> -- 
>> 
>> Brooks Dobbs, CIPP | Chief Privacy Officer | KBM Group | Part of the Wunderman Network
>> (Tel) 678 580 2683 | (Mob) 678 492 1662 | kbmg.com 
>> brooks.dobbs@kbmg.com
>> 
>> <image[160].png>
>> 
>> This email – including attachments – may contain confidential information. If you are not the intended recipient,
>>  do not copy, distribute or act on it. Instead, notify the sender immediately and delete the message.
>> 
>> From: Lee Tien <tien@eff.org>
>> Date: Thursday, October 31, 2013 12:16 AM
>> To: Brooks Dobbs <brooks.dobbs@kbmg.com>
>> Cc: Vinay Goel <vigoel@adobe.com>, "public-tracking@w3.org(public-tracking@w3.org)" <public-tracking@w3.org>, David Singer <singer@apple.com>
>> Subject: Re: Consolidated Proposal for Definition of Collect
>> 
>> Brooks, that's a useful analytical distinction, but I'm not sure it should make a difference here.  
>> 
>> To me, in both cases someone ends up with the data at issue and the first party is the but-for cause.  I assume that the entity that ends up with the data couldn't have gotten it w/o some voluntary act by the first party, like some sort of ad or analytics contract.  (Please correct me if that's wrong.)
>> 
>> Basically I see causation or responsibility as more relevant than actual possession.  
>> 
>> Lee
>> 
>> Sent from my iPhone
>> 
>> On Oct 30, 2013, at 2:34 PM, "Dobbs, Brooks" <Brooks.Dobbs@kbmg.com> wrote:
>> 
>>> Vinay,
>>> 
>>> I think this definition depends on what it is to "share".  My concern with "share" is that I think there are divergent opinions on its meaning which range from:
>>> 	• Taking possession of a thing oneself and then passing/copying it on to another, to
>>> 	• Facilitating another to take possession of a thing without ever possessing the thing yourself
>>> It would seem illogical to me to have a definition of collect that would mean I have collected a thing if I merely facilitated another to collect it but did not get it myself (and for that matter may not know that the other party received it).  True, you may wish that I had not facilitated the other to receive it, but the term just seems unfair if I never received it or had knowledge of the other parties specific receipt .   I am thinking specifically of a website having been deemed to have collected cross site pii merely because it embedded e.g. a social media icon which allowed another party to come into possession of such information.
>>> 
>>> Should we add "share" to the list of definitions in the TPE?
>>> 
>>> -Brooks
>>> -- 
>>> 
>>> Brooks Dobbs, CIPP | Chief Privacy Officer |KBM Group | Part of the Wunderman Network
>>> (Tel) 678 580 2683 | (Mob) 678 492 1662 | kbmg.com
>>> brooks.dobbs@kbmg.com
>>> 
>>> <image[152].png>
>>> 
>>> This email – including attachments – may contain confidential information. If you are not the intended recipient,
>>>  do not copy, distribute or act on it. Instead, notify the sender immediately and delete the message.
>>> 
>>> From: Vinay Goel <vigoel@adobe.com>
>>> Date: Wednesday, October 30, 2013 2:15 PM
>>> To: "public-tracking@w3.org (public-tracking@w3.org)" <public-tracking@w3.org>
>>> Cc: David Singer <singer@apple.com>, Lee Tien <tien@eff.org>
>>> Subject: Consolidated Proposal for Definition of Collect
>>> Resent-From: <public-tracking@w3.org>
>>> Resent-Date: Wednesday, October 30, 2013 2:16 PM
>>> 
>>> Hi Working Group,
>>> 
>>> David S, Lee and I have been trying to consolidate our change proposals over the definition of ‘collect’.  We felt we were initially close with our different proposals, and after a few emails, we are all comfortable with the following language:
>>> 
>>> "A party collects data if it receives data within a network interaction and either shares that data with another party or retains that data after the network interaction is complete."
>>> 
>>> This language is dependent on having a definition of network interaction (Issue-228).  With that, I believe we are all comfortable removing our initial change proposals for collect  I believe this removes David’s change proposal around ‘retain’, but it does not effect Lee’s.  Lee’s change proposal for ‘retains’ is the only alternative text to the Editor’s draft.  I also believe that this encompasses Jonathan’s proposal (but have not verified that with him).  David/Lee — let me know if I got that wrong.
>>> 
>>> I’m going to work with Lee, Amy and Chris P to see if we can combine some of the change proposals around ‘share’.
>>> 
>>> -Vinay

David Singer
Multimedia and Software Standards, Apple Inc.

Received on Friday, 1 November 2013 10:02:40 UTC