Re: Data Collection Requirements

[Eric Brunner-Williams in Portland Maine <brunner@nic-naa.net>]

> This topic _is_ the existing agenda item that Ed referred to in his call for
> agenda items

Really? Good. I hadn't noticed what the (single) agenda item was in Ed's mail.
Call me clue-deficient.

Folly is a stong word. I know I mentioned this at the San Diego meeting, and
on the (unfortunately collided provreg and whois lists last spring), but the
CPExchange (non-IETF) industry standard literally incorporates the P3P vocab.

Here is the DTD (circa fall 2000, so no Schema) we developed in the privacy
working group dealing with onward transfer (p3p policy presumed at the first
reseller-like web site, maintained and with jurisdictional "record route".
It is followed by the DTD (same date) defining the CPExchange P3P subset.
Similar work last October for the http state management mechanism (cookies)
was incorporated into P3P as "compact representations" at a late moment, and
I understand will be part of the MS IE offering -- that is, in-line DC policy
expressed in XML.

Sorry about the line length, and this is simply an example in a similar
problem domain (onward transfer of data similar to "social data"), not
the only way to incorporate data collection practices metadata with data,
if for no other reason than the CPExchange group was _very_ US-centric.

Eric


<!-- CPEXMLv1PRIVacy Information - Customer Profile Exchange XML Privacy category data
include file. This file depends on:
.........cpexmlv1p3pv1.dtd        CPExchange P3P subset
.........cpexmlv1types.dtd        XML Schema and CPExchange Types
.........cpexmlv1sup.dtd          CPExchange Support category
To use this file, declare this file and the listed files as ENTITYs. Include the listed
files in the order shown, followed by this file.

To incorporate the elements in this file into a higher level document structure, the
root, (or some other) element of the new document should include the CPEXMLv1PRIV
ENTITY that lists the top level elements in this file.

To restrict what elements can appear in a ControlGroup, the "templates" and "instances"
ENTITYs can be redefined before including this file.
-->

<!--  define hierarchies of classes where any class may be used (e.g.used polymorphically) -->
<!ENTITY % anyJurisdictionDeclaration " jurisdictionSpecification | jurisdictionReference">

<!-- the following ENTITY should be included in the document root element, or some other element -->
<!ENTITY % CPEXMLv1PRIV " privacyHeader?, controlGroup*">

<!-- define the individual classes with their properties -->

<!-- The templates and instances entities should be overridden in higher level dtds to restrict the elements that can appear in a ControlGroup -->
<!ENTITY % templates " ANY">
<!ENTITY % instances " ANY">
<!ENTITY % ControlGroup " templates?, instances">
    <!-- properties -->
        <!ELEMENT templates %templates;>
        <!ELEMENT instances %instances;>
<!ELEMENT controlGroup (%ControlGroup;)>

<!ENTITY % PrivacyHeader " sourceExchangePartner,recipientExchangePartner,jurisdictionDeclarations, privacyDeclarations">
    <!-- properties -->
        <!ELEMENT jurisdictionDeclarations ((%anyJurisdictionDeclaration;)*)>
        <!ELEMENT privacyDeclarations (privacyDeclaration*)>
<!ELEMENT privacyHeader (%PrivacyHeader;)>

<!ENTITY % ExchangePartner " identifier, identifierType">
    <!-- properties -->
        <!ELEMENT identifier (%string;)>
        <!ELEMENT identifierType (%OpenEnum;)>
            <!ATTLIST identifierType enumtype (ExchangePartnerIdentityTypeEnum) "ExchangePartnerIdentityTypeEnum">
<!ENTITY % ExchangePartnerAttrs " controllingJurisdictionIdrefs IDREFS #IMPLIED">
<!ELEMENT sourceExchangePartner (%ExchangePartner;)>
        <!ATTLIST sourceExchangePartner %ExchangePartnerAttrs;>
<!ELEMENT recipientExchangePartner (%ExchangePartner;)>
        <!ATTLIST recipientExchangePartner %ExchangePartnerAttrs;>

<!ENTITY % JurisdictionDeclaration "">
<!ENTITY % JurisdictionDeclaractionAttrs " eid ID #REQUIRED">

<!ENTITY % JurisdictionSpecification " %PropertyContainer;, countryCode? ">
    <!-- properties -->
<!ELEMENT jurisdictionSpecification (%JurisdictionSpecification;)>
     <!ATTLIST jurisdictionSpecification %JurisdictionDeclaractionAttrs;>

<!ENTITY % JurisdictionReference " specificationUrl ">
    <!-- properties -->
        <!ELEMENT specificationUrl (%uriReference;)>
<!ELEMENT jurisdictionReference (%JurisdictionReference;)>
     <!ATTLIST jurisdictionReference %JurisdictionDeclaractionAttrs;>

<!ENTITY % PrivacyControl "">
<!ENTITY % PrivacyControlAttrs " eid ID #REQUIRED">

<!ENTITY % PrivacyDeclaration " ACCESS,PURPOSE,RETENTION">
<!ELEMENT privacyDeclaration (%PrivacyDeclaration;)>
    <!ATTLIST privacyDeclaration %PrivacyControlAttrs;>





<!-- CPEXMLv1P3Pv1 Information - Customer Profile Exchange information used from P3P Version 1. This file has no dependencies on other files.
       
To use this file, declare this file as an ENTITY and include it. 

To incorporate the elements in this file into a higher level document structure, the
root, (or some other) element of the new document should include the elements as 
desired. This file imposes no structure on the use of these elements.
-->

<!-- beginning of P3P definitions -->
<!--  *********** ACCESS ***********  -->
<!ELEMENT ACCESS (nonident
    | ident_contact
    | other_ident
    | contact_and_other
    | all
    | none)>
<!ELEMENT nonident EMPTY>
<!ELEMENT ident_contact EMPTY>
<!ELEMENT other_ident EMPTY>
<!ELEMENT contact_and_other EMPTY>
<!ELEMENT all EMPTY>
<!ELEMENT none EMPTY>

<!--  *********** PURPOSE ***********  -->
<!ELEMENT PURPOSE ((current
    | admin
    | develop
    | contact
    | customization
    | tailoring
    | individual-analysis
    | individual-decision
    | pseudo-analysis
    | pseudo-decision
    | historical
    | telemarketing
    | other-purpose)+,
    EXTENSION*)>
<!ELEMENT current EMPTY>
<!ELEMENT admin EMPTY>
<!ELEMENT develop EMPTY>
<!ELEMENT contact EMPTY>
<!ELEMENT customization EMPTY>
<!ELEMENT tailoring EMPTY>
<!ELEMENT individual-analysis EMPTY>
<!ELEMENT individual-decision EMPTY>
<!ELEMENT pseudo-analysis EMPTY>
<!ELEMENT pseudo-decision EMPTY>
<!ELEMENT historical EMPTY>
<!ELEMENT telemarketing EMPTY>
<!ELEMENT other-purpose (#PCDATA)>


<!--  *********** RETENTION ***********  -->
<!ELEMENT RETENTION ((no-retention
    | stated-purpose
    | legal-requirement
    | indefinitely
    | business-practices),
    EXTENSION*)>
<!ELEMENT no-retention EMPTY>
<!ELEMENT stated-purpose EMPTY>
<!ELEMENT legal-requirement EMPTY>
<!ELEMENT indefinitely EMPTY>
<!ELEMENT business-practices EMPTY>

<!--  *********** RECIPIENT ***********  -->
<!ELEMENT RECIPIENT ((ours
    | same
    | other-recipient
    | delivery
    | public
    | unrelated)+,
    EXTENSION*)>
<!ELEMENT ours EMPTY>
<!ELEMENT same EMPTY>
<!ELEMENT other-recipient EMPTY>
<!ELEMENT delivery EMPTY>
<!ELEMENT public EMPTY>
<!ELEMENT unrelated EMPTY>

<!--  *********** EXTENSION ***********  -->
<!ELEMENT EXTENSION (#PCDATA)>
<!ATTLIST EXTENSION
     optional (yes | no) "yes" >


<!-- end of P3P definitions --