Re: [sacm] [draft-ietf-sacm-requirements] Do we need a privacy section (#55)

[adammontville <[e-mail]>]

I agree that privacy needs to be covered.  

Still, when we talk about *identity* or *identification* in this working group, we're talking about something different than PII data.  As such, there's this other issue for the information model https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/21, which is seeking to get feedback on what a useful term other than identity might be.  The present candidate seems to be *designate*.  So, instead of "identify an endpoint" we would "designate an endpoint" or "collect AVPs from the designated set of endpoints".  

I also wouldn't go so far as to say that we're performing pervasive monitoring in the sense that mainstream media understands the term.  Our scope has always been single-enterprise, and it remains that way.

Again, privacy is important, but I don't think we're talking about PII as much as might be implied by our choice of terms.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/55#issuecomment-128680469