[Model-t] data minimization and previous work on privacy considerations

[Nick Doty <[e-mail]>]

Reading over draft-arkko-iab-data-minimization-principle-02 just prior
to the meeting, so apologies for the short notice, and I'm happy to
discuss this briefly in the meeting today.

Is there a particular reason that this doesn't cite or mention RFC
6973 Privacy Considerations for Internet Protocols?

Work on basic privacy principles and threat model updates is extremely
welcome (we are undergoing some similar updates/codifications at W3C)
and explaining data minimization, why it's important and how to
accomplish it in protocol design is welcome. But RFC 6973 already
includes a section on Data Minimization as a threat mitigation with a
particular focus on minimization of identifiability and several
questions to consider in applying data minimization to protocol
design.

https://datatracker.ietf.org/doc/html/rfc6973#section-6.1
https://datatracker.ietf.org/doc/html/rfc6973#section-7.1

I would expect that a new IAB statement would build on that one. If I
missed something in my quick reading or if there's a particular
reasoning behind starting fresh, please let me know!

RFC 6973 also considers minimization along with other principles,
which I think is pretty significant. I appreciate the shift to
considering threats of the endpoint on minimization as well, but that
suggests also considering user participation and security at the same
time. I would be happy to see some work on -- and I would volunteer to
contribute -- to reviewing and updating 6973 to see whether privacy
considerations for Internet protocols requires some updates (perhaps
considering broader senses of privacy and a more established set of
threats that we've seen over the past 9 years).

Cheers,
Nick

-- 
Nick Doty | https://npdoty.name
Senior Fellow, Internet Architecture
Center for Democracy & Technology | https://cdt.org