[ietf-provreg] legal entity vs individual person

[Eric Brunner-Williams in Portland Maine <brunner@nic-naa.net>]

Off-list yesterday evening a provreg contributor wrote me the following:

>>	... is the distinction between entity and individual actually
>>	important?

I replied (also off-list):

> It is distinguishing the requirement. 95/46/ec has data protection arising
> out of a theory of human rights contained in the Treaty of Europe. In the
> US, the FTC has privacy arising out of a theory of private contract. From
> that, you know that ICANN contract is supreme in the US, and it isn't in
> Europe -- however, 95/46/ec applies only to people, not legal fictions.
> 
> If you say "privacy" in a 95/46/ec jurisdiction, as a North American, they
> will understand you to be trying to say 95/46/ec, and data protection. If
> you then say "for corporations", they'll be confused.
> 
> No corporation in the EU can go to the local data schutz and moan about
> their human rights and data, they have to moan differently. A person on
> the other hand can have the LDS moving to enforce national implementation
> of 95/46/ec, and the Treaty of Europe, and the Dignity of Human Rights by
> a simple complaint against a data collector.

I didn't discuss the OECD set of jurisdictions, which are somewhere between
these two, both in theory and practice. Life is complicated enough.

We had (rreq, now 3375, 8.4)

	The protocol MUST provide services to identify data collection
	policies.

To this we add (IESG fiat)

	The protocol MUST provide client binary 3rd-party disclosure labels.

Since the IESG mechanism is specific -- client control of data publication,
and covertly, via 954, et seq., not via 1034/35, by the server, this is not
a design choice made in a policy vacuum. This is about data that tends to
identify an individual person.

I don't want this:

X. Privacy Considerations

   None.

Y. Client Data Control Considerations

   Redistribution of registrant contact data may be controlled by the
   <mumble> element.

I want this:

X. Privacy Considerations

   Data that may identify individual persons is identified and policied.
   See <mumble>.

Eric