Re: Comments on <draft-cooper-privacy-policy-01.txt>

[Martin Rex <[e-mail]>]

Dave CROCKER wrote:
> 
> On 7/9/2010 4:32 AM, Hannes Tschofenig wrote:
> > The Fair Information Practices are a set of principles most of us are quite
> > likely to believe in, such as (copied from the Alissa's draft):
> 
> Likely, yes.  But do any of us know how to translate those principles into
> particular behaviors?  Is it likely that any two of us will make the same
> translation?  What about enough of us to constitute rough consensus?

Exactly.

As I previously mentioned, "acceptable" means different things to
different people.

Some people seem to hope that creation of a "privacy policy" is going
to improve things.  Personally, I don't think so.  Likely it will get
worse, and it may get *much* worse.  While a privacy policy may look
nice, it adds A LOT of wiggle room for lawyers.  Most companies
privacy policies are created for the "cover your ass" (CYA) purpose
by lawyers.


Going back to the Google example (because they made news several times here):

Excerpts from what they've posted:

http://www.google.com/intl/en/privacy.html

  We have 5 privacy principles that describe how we approach privacy
  and user information across all of our products:

   1. Use information to provide our users with valuable products and services.
   2. Develop products that reflect strong privacy standards and practices.
   3. Make the collection of personal information transparent.
   4. Give users meaningful choices to protect their privacy.
   5. Be a responsible steward of the information we hold. 

http://www.google.com/intl/en/privacypolicy.html

  At Google we recognize that privacy is important. This Privacy Policy
  applies to all of the products, services and websites offered by
  Google Inc. or its subsidiaries or affiliated companies except
  DoubleClick (DoubleClick Privacy Policy) and Postini (Postini Privacy
  Policy); collectively, Googles services.


But the reality actually looks like this:

  http://www.spiegel.de/international/zeitgeist/0,1518,626075,00.html
  http://www.spiegel.de/international/germany/0,1518,631149,00.html
  http://www.spiegel.de/international/business/0,1518,695718,00.html
  http://www.spiegel.de/international/germany/0,1518,645581,00.html

i.e. the government must step in to stop them from committing
large scale illegal privacy violations, because their own focus is
much more on their business model than on respect for the privacy of
the people about which they collect data.


I would be OK with consenting to very specific and explicit
PII usage scenarios within the IETF.  But many "privacy policies"
I've come across are simple inacceptable to _me_.  Probably every
"social networking site" out there, or businesses with ridiculous
policies, such as e.g. PayPal.


-Martin