Re: [ietf-provreg] where are we with privacy

[Vittorio Bertola <vb@bertola.eu.org>]

On Sun, 19 Jan 2003 21:00:15 -0500, you wrote:

>It's been about a week since we last spent time on privacy.
>
>It seems to me that we've been asked to put in hooks into the base of 
>the protocol to allow for a generic privacy policy to be stated. 
>Here's why I think we haven't gotten anywhere:
>
>1) Although having hooks is desirable in the abstract, there's no 
>concrete understanding of why we should bother defining hooks.
>
>2) Privacy is too undefined to know what "generic privacy" is.
>
>3) We already have a potentially fine mechanism for tailoring privacy 
>considerations in the extensions mechanism.

The purpose of my message was exactly to give my opinion on these
three points: why there is the need to include mechanisms to specify
privacy level in the protocol, why they should be in the base protocol
rather than in extensions, and what a reasonable level of "generic
privacy" is.

Of course that was just my opinion, supported by my personal
experience. But it was an attempt to give you real life requirements
that the service should be able to support. You'll never be sure that
those requirements cover all possible needs for privacy specification,
but you can be sure that at least those ones are necessary for whoever
operates in Europe. (The EU law applies to any data processing
happening in the EU, so it applies both to EU registries and to EU
registrars.)

>4) The proposed "doNotDisclose" mechanism seems to work with some 
>environments, but the wording/name of it is a bit ambiguous.

Then let's find a better wording :-)

>5) We aren't willing to research the privacy topic within this WG.

But, IMHO, you can't write a good technical spec if you're not willing
to research and address all the related topics. I fear we can't pick
just the parts of the job we like.
-- 
vb.                  [Vittorio Bertola - vb [at] bertola.eu.org]<---
-------------------> http://bertola.eu.org/ <-----------------------