Re: IETF privacy policy - update

[Andrew Sullivan <[e-mail]>]

On Thu, Jul 08, 2010 at 11:59:12AM +0300, Yoav Nir wrote:
 
> Without a privacy policy, it's hard to say whether that is
> acceptable or not.

I keep seeing arguments of this sort in the current thread, and it
seems to me to be backwards.  Surely it is not the privacy _policy_
that determines whether something is acceptable.  For instance,
imagine a website privacy policy that says, "We take your personal
information, including your credit card number, expiry date, and CCD
number, and post it on our website."  The existence of that privacy
policy would not make the actions somehow better or defensible: it
would be a bad policy.  I suppose posting somewhere that you're going
to do that would be better than just doing it without any warning, but
the action would be unacceptable regardless.

If the current no-written-policy arrangement is working, it is
presumably because people are making the right choices.  One analysis
of that is that there is an implicit policy, that it is acceptable,
and that the present effort to write down a policy is just a way of
making that implicit policy explicit.  But writing the policy down
does not in itself do anything about whether a given activity with a
given bit of PII is ok.

On the larger topic of whether a privacy policy is actually needed, I
am undecided.  On the one hand, it does seem to me to be a good idea
to have one place where the IETF states what it is going to do with
any PII.  On the other hand, I can easily imagine that such a privacy
policy could end up being used as a mechanism to justify bad ideas in
the event something comes up: it will be more work to change the
policy if it turns out to be inadequate than it will be to accept the
inadequacy.  The present arrangement means that, if a bad idea crops
up, it can be dealt with on its own (de)merits without dragging in a
meta-issue about whether the proposal is consistent with some holy
policy document.  

A

-- 
Andrew Sullivan
[e-mail]
Shinkuro, Inc.