Re: [Pearg] Call for adoption: draft-learmonth-pearg-safe-internet-measurement-02.txt

[Vittorio Bertola <[e-mail]>]

Il 27 maggio 2019 17:44 Eric Rescorla <[e-mail]> ha scritto:

On Mon, May 27, 2019 at 8:23 AM Vittorio Bertola < [e-mail]> wrote:

On top of that, the text asking for consent to these cookies should specify that you will not just be shown customized ads, but that personal information about you will be collected.

You may be misunderstanding my point here, as these studies don't really rely on tracking cookies. If you're browsing the Web with JS on, your browser will execute whatever code it gets served. That's just the nature of the Web.

Ok, let's see it from this viewpoint then: the fact that I visit a web page that executes code (client and/or server side) is not a valid authorization for that web page to collect any personal information about me. If it were so, then no consent request for data collection would ever be necessary on the web. Instead, whenever the web page wants to record personal information about me, it needs to ask for explicit and specific consent (again, this is true in the European framework, which is anyway the model for most other privacy regulations).

Privacy protection and consent management works by purpose: if I access a web site with the objective of watching a video, you may imply consent to any data processing activity which is strictly necessary to make me watch the video, but not to other activities such as running your tests (if they gather personal information). That would require another, separate and optional, expression of consent.

All in all, this problem mostly goes away if the data gathered by your tests is anonymized or at least pseudonymized in a way that makes it impossible to associate it back with the actual person (IP address included). This is advice that can be given to testers, and it would be interesting to understand, from your experience, if there is any reason why these tests cannot always be made in anonymized form.

This isn't really the appropriate place to discuss the legal parameters of various methodologies, especially as they vary from jurisdiction to jurisdiction.

True, but if the I*TF wants to provide advice on how to make Internet tests without harming privacy, one would expect it to set the bar at least at the same level of the best privacy protection rules that are currently in force around the world.

Ciao,

--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[e-mail] 
Office @ Via Treviso 12, 10144 Torino, Italy