Re: Using P3P technologies to express privacy preferences

[Stephane Bortzmeyer <bortzmeyer@nic.fr>]

On Fri, Aug 16, 2002 at 10:23:00AM +0200,
 Patrick <patrick@gandi.net> wrote 
 a message of 31 lines which said:

> I am not sure that P3P exactly as is will nicely fit in EPP, since
> P3P was designed for websites.

Yes, this is an issue to study. But I believe (although we'll be sure
only when an actual P3P policy file for a registry will be published)
that it does not bend P3P too much to use it for a registry. Besides,
there is no alternative. I'm not in the mood to write an EPP extension
for that.
 
> to fit that in EPP. Since the EPP client is not the final user (the
> one you specify in contact:create) nor run by the final user, 
> what options are there ?

The registrar should relay the preferences of the contact. For
instance, if the registrant uses a Web form, it will be queried for
his choices and they will be translated in APPEL and sent to the
registry in the EPP XML stream. An alternative is to use the APPEL
directly from the browser export system (I'm not aware of any Web
browser which supports it yet). 

> I guess that Registrars will adopt only one behavior with maybe some
> exceptions. 

I'm not sure (IANAL) that it will be legal. The european law seems to
mandate that at least some stuff must be available to an opt-out
choice.