Re: IETF privacy policy - update

[Paul Hoffman <[e-mail]>]

At 3:36 PM +0100 7/15/10, Alissa Cooper wrote:
>If you have specific ideas of other spots where the document over-promises, a list would be appreciated. I can take further clarifications back to the secretariat or whoever the responsible party is.

For me, the biggest over-promise is that someone reading the document might think that there is some remedy if the I* fails to live up to it. The line between principles and promises in your document is quite unclear. Very specifically: I don't want the IETF to adopt your document if it opens up an avenue for an aggrieved participant (which, in the IETF, is anyone who knows how to subscribe to a mailing list, even this one) can cause damage to the IETF if the IETF doesn't meet the promise in that person's eyes.

If you feel that it is valuable to list privacy principles for an organization like the IETF, great. If you want the IETF to promise something that would cost us money or, possibly worse, much lost time from the I*, please don't move this forwards.

There are already many reasons why some people don't participate in the IETF. For some, the IETF is too informal for their comfort; those folks gravitate towards other SDOs who have more formal membership and rules. For some, the inability to rant freely on mailing lists without being barred is too high a bar. For some, If we lose a few people (and it does seem like a very few) for lack of a privacy policy that could be enforced by civil law or threat of civil lawsuits, that may be an acceptable risk.

--Paul Hoffman, Director
--VPN Consortium