Re: Eprivacy Regulation EP Rapporteurs draft report

I have long thought that particular bit of text is poorly drafted, and it is my own fault for allowing it to be so. I’ve raised this a few times to no avail.

That it is being misread is a strong argument for fixing it. I fear the answer, but is it too late to add non-normative text that explains more clearly? I would be happy to trust the editors to make the intent clearer during a clean up pass.

 Aleecia

> On Jun 15, 2017, at 8:16 AM, Roy T. Fielding <fielding@gbiv.com> wrote:
> 
>> On Jun 15, 2017, at 1:35 AM, Rob van Eijk <rob@blaeu.com <mailto:rob@blaeu.com>> wrote:
>> 
>> Moreover, please note the remarks of the EU lawmaker on DNT (p. 87 of the draft report). I believe that it shows that there is clear support and appreciation for our work.
>> 
>> Article 10 of the proposal refers to options for privacy settings of tools and software used to enable users to prevent other parties from storing information on terminal equipment, or processing information stored on the equipment (Do-Not-Track mechanisms -DNTs-). The rapporteur shares the objective of the proposal but she considers that, in order to reflect the essential core principles of Union data protection law (privacy by design and by default), it must be amended. Indeed, these basic principles are not efficiently integrated in the ePrivacy proposal of the Commission. Therefore it is proposed first, that DNTs are technologically neutral to cover different kinds of technical equipment and software and, second, that DNTs, by default must configure their settings in a manner that prevents other parties from storing information on the terminal equipment or processing information stored on the equipment without the consent of the user, at the same time users should be granted the possibility to change or confirm the default privacy settings options at any moment upon installation. The settings should allow for granulation of consent by the user, taking into account the functionality of cookies and tracking techniques and DNTs should send signals to the other parties informing them of the user’s privacy settings. Compliance with these settings should be legally binding and enforceable against all other parties.
>> 
>> Regards,
>> Rob
> 
> Rob, to me that reads as if the Rapporteur expects user agents to send DNT:1 by default even
> when the user has taken no action to configure a signal be sent. This would be in spite of the fact
> that the TPE default of no signal is defined by regional context, meaning that in the EU sending
> no explicit signal is equivalent to DNT:1 (for the same reasons given above) without wasting
> network traffic.
> 
> Is that the case?
> 
> ....Roy
>