Re: Consolidated Proposal for Definition of Collect

I am not sure I have the solution, but I don't think that should excuse us moving forward with definitions of Share (and resultantly Collect) that define themselves in terms so far removed from their logical meaning.  I just don't think it is fair to expect implementors to understand that they are collecting a thing or sharing a thing that they don't know the existence of.  If I put two people in a room together, you may argue that I am responsible for the resultant conversation taking place, but not that I shared in the conversation.  Overloading terms IMHO confuses things.

-Brooks



--

Brooks Dobbs, CIPP | Chief Privacy Officer | KBM Group | Part of the Wunderman Network
(Tel) 678 580 2683 | (Mob) 678 492 1662 | kbmg.com
brooks.dobbs@kbmg.com

[cid:6678D4AE-5179-412A-9130-A46ACA6F0D92]

This email – including attachments – may contain confidential information. If you are not the intended recipient,
 do not copy, distribute or act on it. Instead, notify the sender immediately and delete the message.

From: Lee Tien <tien@eff.org<mailto:tien@eff.org>>
Date: Thursday, October 31, 2013 12:37 PM
To: Brooks Dobbs <brooks.dobbs@kbmg.com<mailto:brooks.dobbs@kbmg.com>>
Cc: Vinay Goel <vigoel@adobe.com<mailto:vigoel@adobe.com>>, "public-tracking@w3.org<mailto:public-tracking@w3.org>(public-tracking@w3.org<mailto:public-tracking@w3.org>)" <public-tracking@w3.org<mailto:public-tracking@w3.org>>, David Singer <singer@apple.com<mailto:singer@apple.com>>
Subject: Re: Consolidated Proposal for Definition of Collect

Two issues:  what's the right word or term; what's the consequence.

I'd be happy to label it "facilitating collection," just saying that to me the "tracking" seems equivalent from consumer PoV.

I know we're in a defining phase for TPE but we're all mindful of  compliance implications, right?


Lee

Sent from my iPhone

On Oct 31, 2013, at 7:51 AM, "Dobbs, Brooks" <Brooks.Dobbs@kbmg.com<mailto:Brooks.Dobbs@kbmg.com>> wrote:

Lee,

Without addressing the merits of your larger point, I remain extremely worried about torturing language and taking words so far from their generally understood meaning.  To say I "collected" something when I never received it and did not know what it is, just seems to strain language too far.

-Brooks

--

Brooks Dobbs, CIPP | Chief Privacy Officer |KBM Group | Part of the Wunderman Network
(Tel) 678 580 2683 | (Mob) 678 492 1662 | kbmg.com<http://kbmg.com>
brooks.dobbs@kbmg.com

<image[160].png>

This email – including attachments – may contain confidential information. If you are not the intended recipient,
 do not copy, distribute or act on it. Instead, notify the sender immediately and delete the message.

From: Lee Tien <tien@eff.org<mailto:tien@eff.org>>
Date: Thursday, October 31, 2013 12:16 AM
To: Brooks Dobbs <brooks.dobbs@kbmg.com<mailto:brooks.dobbs@kbmg.com>>
Cc: Vinay Goel <vigoel@adobe.com<mailto:vigoel@adobe.com>>, "public-tracking@w3.org<mailto:public-tracking@w3.org>(public-tracking@w3.org<mailto:public-tracking@w3.org>)" <public-tracking@w3.org<mailto:public-tracking@w3.org>>, David Singer <singer@apple.com<mailto:singer@apple.com>>
Subject: Re: Consolidated Proposal for Definition of Collect

Brooks, that's a useful analytical distinction, but I'm not sure it should make a difference here.

To me, in both cases someone ends up with the data at issue and the first party is the but-for cause.  I assume that the entity that ends up with the data couldn't have gotten it w/o some voluntary act by the first party, like some sort of ad or analytics contract.  (Please correct me if that's wrong.)

Basically I see causation or responsibility as more relevant than actual possession.

Lee

Sent from my iPhone

On Oct 30, 2013, at 2:34 PM, "Dobbs, Brooks" <Brooks.Dobbs@kbmg.com<mailto:Brooks.Dobbs@kbmg.com>> wrote:

Vinay,

I think this definition depends on what it is to "share".  My concern with "share" is that I think there are divergent opinions on its meaning which range from:

  1.  Taking possession of a thing oneself and then passing/copying it on to another, to
  2.  Facilitating another to take possession of a thing without ever possessing the thing yourself

It would seem illogical to me to have a definition of collect that would mean I have collected a thing if I merely facilitated another to collect it but did not get it myself (and for that matter may not know that the other party received it).  True, you may wish that I had not facilitated the other to receive it, but the term just seems unfair if I never received it or had knowledge of the other parties specific receipt .   I am thinking specifically of a website having been deemed to have collected cross site pii merely because it embedded e.g. a social media icon which allowed another party to come into possession of such information.

Should we add "share" to the list of definitions in the TPE?

-Brooks
--

Brooks Dobbs, CIPP | Chief Privacy Officer |KBM Group| Part of the Wunderman Network
(Tel) 678 580 2683 | (Mob) 678 492 1662 | kbmg.com<http://kbmg.com>
brooks.dobbs@kbmg.com

<image[152].png>

This email – including attachments – may contain confidential information. If you are not the intended recipient,
 do not copy, distribute or act on it. Instead, notify the sender immediately and delete the message.

From: Vinay Goel <vigoel@adobe.com<mailto:vigoel@adobe.com>>
Date: Wednesday, October 30, 2013 2:15 PM
To: "public-tracking@w3.org<mailto:public-tracking@w3.org> (public-tracking@w3.org<mailto:public-tracking@w3.org>)" <public-tracking@w3.org<mailto:public-tracking@w3.org>>
Cc: David Singer <singer@apple.com<mailto:singer@apple.com>>, Lee Tien <tien@eff.org<mailto:tien@eff.org>>
Subject: Consolidated Proposal for Definition of Collect
Resent-From: <public-tracking@w3.org<mailto:public-tracking@w3.org>>
Resent-Date: Wednesday, October 30, 2013 2:16 PM

Hi Working Group,

David S, Lee and I have been trying to consolidate our change proposals over the definition of ‘collect’.  We felt we were initially close with our different proposals, and after a few emails, we are all comfortable with the following language:

"A party collects data if it receives data within a network interaction and either shares that data with another party or retains that data after the network interaction is complete."

This language is dependent on having a definition of network interaction (Issue-228).  With that, I believe we are all comfortable removing our initial change proposals for collect  I believe this removes David’s change proposal around ‘retain’, but it does not effect Lee’s.  Lee’s change proposal for ‘retains’ is the only alternative text to the Editor’s draft.  I also believe that this encompasses Jonathan’s proposal (but have not verified that with him).  David/Lee — let me know if I got that wrong.

I’m going to work with Lee, Amy and Chris P to see if we can combine some of the change proposals around ‘share’.

-Vinay