Re: IETF privacy policy - update

[jean-michel bernier de portzamparc <[e-mail]>]

I tend to agree with Andrew and Marshall.

However, from our own JEDI's (so-labelled "Jefsey's disciples") experience I
would suggest some kind of "ietf privacy netiquette". It could be equivalen
to architectural quotes like "dumb network", "end to end", "protocol on the
wire", "rough consensus", etc. It could be added to the Tao.

This way everyone would know-where he/she comes and can behave equally. This
could concern the so-called "puppets", negative privacy (ad hominem have a
perpetual impact on private reputation), disclosed/non-disclosed
affiliations, who paid for the travel tickets and attendance fees,
architectural perspective, mailing list participations, etc. I think this
could be proactive if the information is not "protected" but "personally and
optionally disclosed". There could be a database where every IETF
participant could document what he/she wants on him/herself. I am sure that
what would not be disclosed would eventually inform more than what is
disclosed and help better debates, avoiding misunderstandings, and focusing
on concepts rathers than on percepts.

Portzamparc

2010/7/8 Marshall Eubanks <[e-mail]>

>
> On Jul 8, 2010, at 11:15 AM, Andrew Sullivan wrote:
>
>  On Thu, Jul 08, 2010 at 11:59:12AM +0300, Yoav Nir wrote:
>>
>>  Without a privacy policy, it's hard to say whether that is
>>> acceptable or not.
>>>
>>
>> I keep seeing arguments of this sort in the current thread, and it
>> seems to me to be backwards.  Surely it is not the privacy _policy_
>> that determines whether something is acceptable.  For instance,
>> imagine a website privacy policy that says, "We take your personal
>> information, including your credit card number, expiry date, and CCD
>> number, and post it on our website."  The existence of that privacy
>> policy would not make the actions somehow better or defensible: it
>> would be a bad policy.  I suppose posting somewhere that you're going
>> to do that would be better than just doing it without any warning, but
>> the action would be unacceptable regardless.
>>
>> If the current no-written-policy arrangement is working, it is
>> presumably because people are making the right choices.  One analysis
>> of that is that there is an implicit policy, that it is acceptable,
>> and that the present effort to write down a policy is just a way of
>> making that implicit policy explicit.  But writing the policy down
>> does not in itself do anything about whether a given activity with a
>> given bit of PII is ok.
>>
>
> I see this as a normal part of an organization growing up. Small, young,
> organizations don't
> typically need much structure, as everyone knows everybody, people trust
> each other,
> and everything tends to be in people's heads. That doesn't scale. Putting
> implicit policies down in writing is an attempt to make sure that the
> organization doesn't
> change in adverse ways as it grows and matures.
>
> Regards
> Marshall
>
>
>
>
>> On the larger topic of whether a privacy policy is actually needed, I
>> am undecided.  On the one hand, it does seem to me to be a good idea
>> to have one place where the IETF states what it is going to do with
>> any PII.  On the other hand, I can easily imagine that such a privacy
>> policy could end up being used as a mechanism to justify bad ideas in
>> the event something comes up: it will be more work to change the
>> policy if it turns out to be inadequate than it will be to accept the
>> inadequacy.  The present arrangement means that, if a bad idea crops
>> up, it can be dealt with on its own (de)merits without dragging in a
>> meta-issue about whether the proposal is consistent with some holy
>> policy document.
>>
>> A
>>
>> --
>> Andrew Sullivan
>> [e-mail]
>> Shinkuro, Inc.
>> _______________________________________________
>> Ietf mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/ietf
>>
>>
> _______________________________________________
> Ietf mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/ietf
>