RE: Consolidated Proposal for Definition of Collect

Lee, if “sharing” includes simply allowing access to the data then every company will be in violation of this standard.  For instance, a 1st party could have a contract with a 3rd party to serve contextual ads.  In these cases, most companies have contracts that restrict the 3rd party from using any data that is collected for any purpose other than frequency capping, ensuring the ad runs properly and preventing click fraud.  But, the 3rd party could always use the data for another purpose in violation of the contract.  Same scenario for a service provider.

Chris Pedigo
VP, Government Affairs
Online Publishers Association
(202) 744-2967


From: Lee Tien [mailto:tien@eff.org]
Sent: Thursday, October 31, 2013 12:17 AM
To: Dobbs, Brooks
Cc: Vinay Goel; public-tracking@w3.org(public-tracking@w3.org); David Singer
Subject: Re: Consolidated Proposal for Definition of Collect

Brooks, that's a useful analytical distinction, but I'm not sure it should make a difference here.

To me, in both cases someone ends up with the data at issue and the first party is the but-for cause.  I assume that the entity that ends up with the data couldn't have gotten it w/o some voluntary act by the first party, like some sort of ad or analytics contract.  (Please correct me if that's wrong.)


Basically I see causation or responsibility as more relevant than actual possession.


Lee

Sent from my iPhone

On Oct 30, 2013, at 2:34 PM, "Dobbs, Brooks" <Brooks.Dobbs@kbmg.com<mailto:Brooks.Dobbs@kbmg.com>> wrote:
Vinay,

I think this definition depends on what it is to "share".  My concern with "share" is that I think there are divergent opinions on its meaning which range from:

  1.  Taking possession of a thing oneself and then passing/copying it on to another, to
  2.  Facilitating another to take possession of a thing without ever possessing the thing yourself
It would seem illogical to me to have a definition of collect that would mean I have collected a thing if I merely facilitated another to collect it but did not get it myself (and for that matter may not know that the other party received it).  True, you may wish that I had not facilitated the other to receive it, but the term just seems unfair if I never received it or had knowledge of the other parties specific receipt .   I am thinking specifically of a website having been deemed to have collected cross site pii merely because it embedded e.g. a social media icon which allowed another party to come into possession of such information.

Should we add "share" to the list of definitions in the TPE?

-Brooks
--

Brooks Dobbs, CIPP | Chief Privacy Officer | KBM Group | Part of the Wunderman Network
(Tel) 678 580 2683 | (Mob) 678 492 1662 | kbmg.com<http://kbmg.com>
brooks.dobbs@kbmg.com

<image[152].png>

This email – including attachments – may contain confidential information. If you are not the intended recipient,
 do not copy, distribute or act on it. Instead, notify the sender immediately and delete the message.

From: Vinay Goel <vigoel@adobe.com<mailto:vigoel@adobe.com>>
Date: Wednesday, October 30, 2013 2:15 PM
To: "public-tracking@w3.org<mailto:public-tracking@w3.org> (public-tracking@w3.org<mailto:public-tracking@w3.org>)" <public-tracking@w3.org<mailto:public-tracking@w3.org>>
Cc: David Singer <singer@apple.com<mailto:singer@apple.com>>, Lee Tien <tien@eff.org<mailto:tien@eff.org>>
Subject: Consolidated Proposal for Definition of Collect
Resent-From: <public-tracking@w3.org<mailto:public-tracking@w3.org>>
Resent-Date: Wednesday, October 30, 2013 2:16 PM

Hi Working Group,

David S, Lee and I have been trying to consolidate our change proposals over the definition of ‘collect’.  We felt we were initially close with our different proposals, and after a few emails, we are all comfortable with the following language:

"A party collects data if it receives data within a network interaction and either shares that data with another party or retains that data after the network interaction is complete."

This language is dependent on having a definition of network interaction (Issue-228).  With that, I believe we are all comfortable removing our initial change proposals for collect  I believe this removes David’s change proposal around ‘retain’, but it does not effect Lee’s.  Lee’s change proposal for ‘retains’ is the only alternative text to the Editor’s draft.  I also believe that this encompasses Jonathan’s proposal (but have not verified that with him).  David/Lee — let me know if I got that wrong.

I’m going to work with Lee, Amy and Chris P to see if we can combine some of the change proposals around ‘share’.

-Vinay