Re: IETF privacy policy - update

[John C Klensin <[e-mail]>]

--On Monday, July 05, 2010 5:05 PM +0100 Alissa Cooper
<[e-mail]> wrote:

> A few months ago I drew up a strawman proposal for a
> public-facing IETF privacy policy
> (http://www.ietf.org/id/draft-cooper-privacy-policy-00.txt).
> I've submitted an update based on feedback received:
> http://www.ietf.org/id/draft-cooper-privacy-policy-01.txt
> 
> In discussing the policy with the IAOC and others, it seems
> clear that the RFC model is probably not the best model for
> maintaining and updating a document like this. It is more
> likely to fall within the scope of the IAOC and/or the Trust.
> In order for the IAOC to consider taking this on and devoting
> resources to figuring out what its format should be, they need
> to hear from the community that a public-facing privacy policy
> is something that the community wants. So I have two requests
> for those with any interest in this:
> 
> 1) Respond on this list if you support the idea of the IETF
> having a privacy policy (a simple "+1" will do).
> 
> 2) If you have comments and suggestions about the policy
> itself, send them to this list.

Alissa,

It is hard, and maybe impossible, to argue against the IETF
having an established privacy policy, so I agree with Melinda's
"about time".

However, while administering such a policy (to the degree to
which such a thing is needed) is a reasonable task for the IETF
community to assign to the IAOC (or Trust), those bodies are
quite explicitly not supposed to be represent or determine
community consensus: they are administrative, administrative
only, and part of a structure erected to handle administrative
tasks.  

So, while the RFC process may not be appropriate for handling a
privacy policy (I'm actually not convinced it is not, but that
is another matter), unless we are really going top-down around
here, the responsibility for determining community consensus
about such a policy for the IETF community and setting it has to
stay with the IESG.  I just don't see any way to avoid that.

     john