Re: [siprec] Ben Campbell's No Objection on draft-ietf-siprec-metadata-20: (with COMMENT)

[Paul Kyzivat <[e-mail]>]

The below seems good to me.

	Thanks,
	Paul

On 3/14/16 3:16 PM, Ben Campbell wrote:
> On 9 Mar 2016, at 23:20, Paul Kyzivat wrote:
>
>> Some implementations may have the SRC choose parts of metadata that
>> can be
>>> sent to the SRS.
>>> In other cases, SRCs may send metadata that is not appropriate for
>>> the SRS
>>> to record. Which
>>>   metadata is actually recorded by the SRS must be carefully
>>> considered to
>>> balance privacy
>>> concerns with usability. Implementations MUST control what metadata is
>>> recorded, and MUST NOT
>>>   save metadata sent by the SRC that does not conform to the recording
>>> policy of the SRS.
>>> Metadata in storage needs to be provided with a level of security
>>> that is
>>> comparable to that
>>> of the recording session.
>>
>>
>> How about:
>>
>> An SRC MAY, by policy, choose to limit the parts of the metadata sent to
>> the SRS for recording. And the SRS MAY not need all the metadata it
>> receives or choose, by policy, to limit the metadata it records.
>> Metadata in storage needs to be provided with a level of security that
>> is comparable to that of the recording session.
>
>
> I think that helps, but might need a couple of tweaks:
>
> - The 2nd MAY seems more a statement of fact.
>
> - I think the concept that the SRS MUST NOT record unneeded metatdata
> came from the discussion with Stephen, so I am hesitant to suggest
> removing the 2119 language. How about something like:
>
> "An SRC MAY, by policy, choose to limit the parts of the metadata sent
> to the SRS for recording. And the policy of the SRS might not require
> all the metadata it receives. For the sake of data minimization, the SRS
> MUST not record additional metadata that is not explicitly required by
> local policy. Metadata in storage needs to be provided with a level of
> security that is comparable to that of the recording session."
>
> (But on the other hand, if Stephen has already agreed to the previous
> language, then I would hesitate to change it more than necessary.)
>
> Ben.
>