Subject: Re: Proposed IETF Privacy Policy for Review

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Wed, 16 Mar 2016 18:15:45 +0100

I’m very surprised about this:

Inquiries
If you would like to request information regarding our disclosure of your Personal Data to third parties for direct marketing purposes, please email your request to [email-masked] and we will provide this information free of charge. This information includes a list of the categories of Personal Data that was shared with third parties for direct marketing purposes and the names and addresses of all third parties with which we shared such information in the immediately preceding calendar year.

Unless I’m missing something, I don’t think the IETF must provide any personal data to third parties, so my suggestions is that this sections needs to be rewritten to reflect that.

Regards,
Jordi

-----Mensaje original-----
De: IETF-Announce <[email-masked]> en nombre de IETF Administrative Director <[email-masked]>
Responder a: <[email-masked]>, <[email-masked]>
Fecha: miércoles, 16 de marzo de 2016, 18:02
Para: IETF Announcement List <[email-masked]>
Asunto: Proposed IETF Privacy Policy for Review

>The IAOC would like community input on a proposed IETF Privacy Policy.
>
>We are required by California law (and good net citizenship) to have
>an accurate privacy policy on our websites.  Counsel have reviewed
>this statement for compliance with US and EU privacy regulations.  
>
>The policy discusses the following:
>  1.  General – Most Personal Data Submitted to IETF Will Become Public
>  2.  You Consent to International Transmission of Your Data
>  3.  Exceptions – Information That We Do Not Release to the Public
>  4.  Security
>  5.  Children
>  6.  Inquiries
>  7.  Compliance
>  8.  Other Organizations
>  9.  Consent
>
>The proposed Privacy Policy is located here:
>http://iaoc.ietf.org/documents/IETF-General-Privacy-Statement-2016-02-24-02.htm
>
>The IAOC will consider all comments received by 31 March 2016.
>
>Ray Pelletier
>IETF Administrative Director
>
>

---

From: Scott Bradner <[email-masked]>
Date: Wed, 16 Mar 2016 13:24:51 -0400

the IETF does not provide non-public information to anyone outside of the IETF/ISOC for any marketing
(or other) purpose (but ISOC may contact some people to see if they would be interested in hosting or being
a sponsor of a future meeting) 

but, even if we clearly say “we never do that” we still need to have the section since 
California law says that we need to have such an ability for people to ask  (its also the kind of thing that the EU
wants to see)

Scott

> On Mar 16, 2016, at 1:15 PM, JORDI PALET MARTINEZ <[email-masked]> wrote:
>

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Wed, 16 Mar 2016 18:36:19 +0100

Hi Scott,

I understand that, but I think we must have, for clarity, also a sentence that states that, and not just for non-public, but also public information to third parties. Something like “IETF doesn’t provide to third parties any personal data”.

May be is already somewhere in our actual web sites, if not I think must be included somehow in this privacy policy section.

Regards,
Jordi

---

From: "John Levine" <[email-masked]>
Date: 16 Mar 2016 17:37:01 -0000

>California law says that we need to have such an ability for people to ask  (its also the kind of thing that the EU

Why is California law relevant?  The IETF's legal bits are in Virgina
or maybe D.C., not California.

R's,
John

---

From: "Scott O. Bradner" <[email-masked]>
Date: Wed, 16 Mar 2016 13:59:24 -0400

I agree

Scott

Sent from my iPhone

> On Mar 16, 2016, at 1:36 PM, JORDI PALET MARTINEZ <[email-masked]> wrote:
> 
> Hi Scott,
>

---

From: "Adrian Farrel" <[email-masked]>
Date: Wed, 16 Mar 2016 18:02:30 -0000

Ray,

While you talk about non-public mailing lists and give some examples, I think you need to consider other interactions:
- Direct mails to non-list IETF addresses
   - If I email [email-masked] or [email-masked] etc. is my email private?
     Is that data retained within the IETF? If so, how is it held?
- RFC 7776 requires some retention of data in a confidential way (although
   the ombudsteam still needs to document the details)
- There is the usual stuff about contracts and commercial sensitivity. While that
   might not fit in "things you submit to the IETF" it is surely part of the data 
   retention and confidentiality information
- Registration requires or requests us to submit a number of things that are not
   part of the payment system and are (presumably) held on IETF servers. This 
   includes addresses and phone numbers (that may be personal contact
   details), dietary preference (that may be an indication of religion), and 
  information that may be an indication of gender or other personal characteristics
  (T-shirt size/type, gender) . Your draft text appears to say that this is public
  information: I do not think it should be.

Thanks,
Adrian

> -----Original Message-----
> From: IETF-Announce [mailto:[email-masked]] On Behalf Of
> Sent: 16 March 2016 17:03
> To: IETF Announcement List
> Subject: Proposed IETF Privacy Policy for Review
>

---

From: Adam Roach <[email-masked]>
Date: Wed, 16 Mar 2016 13:14:17 -0500

> The IAOC will consider all comments received by 31 March 2016.

Thanks for soliciting input! I have two brief comments on the proposed 
privacy policy.

> IETF does not currently recognize browsers’ Do Not Track (DNT) 
> requests with respect to our web sites.

I believe (and sincerely hope) that this statement is based on a 
misunderstanding of the meaning of DNT.

If you look at the current specification, DNT is intended to prevent 
tracking user activity /across multiple organizations/. (From 
<https://www.w3.org/TR/tracking-dnt/>: "Tracking is the collection of 
data regarding a particular user's activity across multiple distinct 
contexts and the retention, use, or sharing of data derived from that 
activity outside the context in which it occurred. A context is a set of 
resources that are controlled by the same party or jointly controlled by 
a set of parties.").

This is the kind of tracking behavior that is typically engaged in by 
advertising networks and the websites that display their ads. (For 
example: adweasels.com might serve up advertising to both 
socialtimesink.com and yourbiasednewssource.com. Because of this 
arrangement, when you go to yourbiasednewssource.com, it receives 
information, via adweasels.com, about your activity on socialtimesink.com).

As far as I understand, this is not behavior the IETF does (or should) 
participate in.

I think it would be more accurate to revise this statement in the 
privacy policy to something more along the lines of: "The IETF does not 
engage in Tracking behavior, as that term is defined by the Do Not Track 
(DNT) specification. Consequently, IETF web sites do not alter their 
behavior according to the value of browsers' DNT requests."

> Some areas of the IETF web site and some IETF mailing lists require 
> you to create and enter a password.IETF will store these passwords and 
> does not make them available to the public.
>

I certainly hope that this means to say "IETF will store hashed versions 
of these passwords and does not make them available to the public."

/a

---

From: Martin Vigoureux <[email-masked]>
Date: Wed, 16 Mar 2016 19:36:53 +0100

Hello Ray,

thanks for soliciting feedbacks.

It is not clear what were the conclusions of Counsel with regards to 
compliance with US and EU privacy regulations.
It might be worth mentioning it in the document.

Also what are the plans, if any, to bring this document to the attention 
of people that participate in IETF (for the first time).

Thank you
Martin

---

From: "Scott O. Bradner" <[email-masked]>
Date: Wed, 16 Mar 2016 16:08:16 -0400

IETF Secretariat
c/o Association Management Solutions, LLC (AMS)
48377 Fremont Blvd., Suite 117
Fremont, California 94538

> On Mar 16, 2016, at 1:37 PM, John Levine <[email-masked]> wrote:
>

---

From: "Scott O. Bradner" <[email-masked]>
Date: Wed, 16 Mar 2016 16:12:23 -0400

in addition “it is the right thing to do”

Scott

> On Mar 16, 2016, at 4:08 PM, Scott O. Bradner <[email-masked]> wrote:
> 
> IETF Secretariat

---

From: "Eggert, Lars" <[email-masked]>
Date: Thu, 17 Mar 2016 07:01:24 +0000

Hi Ray,

would this extend to and cover the IRTF as well?

Lars

---

From: "Scott O. Bradner" <[email-masked]>
Date: Thu, 17 Mar 2016 05:13:58 -0400

yes

> On Mar 17, 2016, at 3:01 AM, Eggert, Lars <[email-masked]> wrote:
> 
> Hi Ray,
>

---

From: "Scott O. Bradner" <[email-masked]>
Date: Thu, 17 Mar 2016 06:13:23 -0400

good point - thanks

Scott

> On Mar 17, 2016, at 6:12 AM, Eggert, Lars <[email-masked]> wrote:
> 
> On 2016-03-17, at 10:13, Scott O. Bradner <[email-masked]> wrote:
>> yes
>> 
> It would be good to make that very clear. The text under "Other Organizations" made me believe this was not the case, hence the question.
> 
> (That text is: "For the avoidance of doubt, this Statement relates solely to the activities of IETF, and does not cover any non-IETF activities of the Internet Society or any other organization that may be affiliated with IETF.")
> 
> Lars

---

From: "Eggert, Lars" <[email-masked]>
Date: Thu, 17 Mar 2016 10:12:14 +0000

Lars

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 17 Mar 2016 10:35:50 +0000

Hi Scott,

I agree with the other comments made and echo folks' thanks
for putting this out to review and for being willing to
iterate on it.

In addition:

- Was the concept of a warrant canary [1] or transparency
report [2] considered? Those are good things (tm) and it'd
be good for the IETF to be part of the leading edge on such
things I think. So I'd recommend that we do some such thing
in addition to this.

   [1] https://en.wikipedia.org/wiki/Warrant_canary
   [2] https://en.wikipedia.org/wiki/Transparency_report

- "disclosure of your Personal Data to third parties" I want
to strongly re-iterate that selling (or so-called "monetizing")
IETF participant data is something that should be anathema to
us (and the partners we choose) and I'd hope that the strongest
possible wording is used to say we won't be doing that. If any
current or future partner would have an issue with that, then I
think that needs to be disclosed to all IETF participants, so
it'd be good if this policy said that a public announcement is
required if any partner or service provider is (ab)using our
data in any such manner.

I'd also suggest that whoever is working on the next iteration
of this in response to comments would be wise to pass the text
by some of the folks who've commented in this thread. I think
there are likely some wording nits that might be better fixed
in that way before the next revision is sent to ietf-announce.

Cheers,
S.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 17 Mar 2016 11:40:25 +0100

On Wed, Mar 16, 2016 at 04:12:23PM -0400,
 Scott O. Bradner <[email-masked]> wrote 

> in addition “it is the right thing to do”

No, the right thing to do is to never share personal data with third
parties (and to put it in writing in the policy). That would make this
paragraph useless (even if some local US law requires to keep it).

---

From: Paul Wouters <[email-masked]>
Date: Thu, 17 Mar 2016 08:09:33 -0400

My only issue is that it claims our websites are not for use by children under 13. They most certainly are.

Paul

Sent from my iPhone

> On Mar 17, 2016, at 03:01, Eggert, Lars <[email-masked]> wrote:
> 
> Hi Ray,
>

---

From: Scott Bradner <[email-masked]>
Date: Thu, 17 Mar 2016 08:13:11 -0400

I agree but the law is what the law is 

see https://en.wikipedia.org/wiki/Children's_Online_Privacy_Protection_Act

the wording used says that its fine if the kid has parental OK

Scott

> On Mar 17, 2016, at 8:09 AM, Paul Wouters <[email-masked]> wrote:
>

---

From: Paul Wouters <[email-masked]>
Date: Thu, 17 Mar 2016 08:23:34 -0400

Sent from my iPhone

> On Mar 17, 2016, at 08:13, Scott Bradner <[email-masked]> wrote:
> 

But then there is no need to say our website is not designed for people under 13. They are designed for people of all ages.

Paul

---

From: Scott Bradner <[email-masked]>
Date: Thu, 17 Mar 2016 08:27:13 -0400

the lawyers we consulted said that it was important to say what was said

setting up a web site designed for people under 13 is a major effort (verifying ages of users etc)

this seemed the best way (the first proposal we got was to say that people under 13 could
not use the site)

Scott

> On Mar 17, 2016, at 8:23 AM, Paul Wouters <[email-masked]> wrote:
> 
> 
> 
> Sent from my iPhone
>

---

From: Scott Bradner <[email-masked]>
Date: Thu, 17 Mar 2016 08:29:59 -0400

> On Mar 17, 2016, at 8:27 AM, Scott Bradner <[email-masked]> wrote:
> 

this from the Wikipedia article (and we all know that means it is perfectly correct :-) )

In December 2012, the Federal Trade Commission <https://en.wikipedia.org/wiki/Federal_Trade_Commission> issued revisions effective July 1, 2013, which create additional parental notice and consent requirements, amended definitions and added other obligations, for organizations that (1) operate a website or online service that is “directed to children” under 13 and that collects “personal information” from users or (2) knowingly collects personal information from persons under 13 through a website or online service.[16] <https://en.wikipedia.org/wiki/Children%27s_Online_Privacy_Protection_Act#cite_note-auto-16> After July 1, 2013, operators must:[17] <https://en.wikipedia.org/wiki/Children%27s_Online_Privacy_Protection_Act#cite_note-auto1-17>
Post a clear and comprehensive online privacy policy describing their information practices for personal information collected online from persons under age 13;
Make reasonable efforts (taking into account available technology) to provide direct notice to parents of the operator’s practices with regard to the collection, use, or disclosure of personal information from persons under 13, including notice of any material change to such practices to which the parents has previously consented;
Obtain verifiable parental consent, with limited exceptions, prior to any collection, use, and/or disclosure of personal information from persons under age 13;
Provide a reasonable means for a parent to review the personal information collected from their child and to refuse to permit its further use or maintenance;
Establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of the personal information collected from children under age 13, including by taking reasonable steps to disclose/release such personal information only to parties capable of maintaining its confidentiality and security; and
Retain personal information collected online from a child for only as long as is necessary to fulfill the purpose for which it was collected and delete the information using reasonable measures to protect against its unauthorized access or use.
Operators are prohibited from conditioning a child’s participation in an online activity on the child providing more information than is reasonably necessary to participate in that activity.[18] <https://en.wikipedia.org/wiki/Children%27s_Online_Privacy_Protection_Act#cite_note-18>

---

From: Paul Wouters <[email-masked]>
Date: Thu, 17 Mar 2016 08:49:57 -0400

> On Mar 17, 2016, at 08:27, Scott Bradner <[email-masked]> wrote:
> 

When law requires you to basically lie, the law needs updating. But I agree we shouldn't spend ietf money on that.

Paul

---

From: IETF Administrative Director <[email-masked]>
Date: Wed, 16 Mar 2016 10:02:39 -0700

Ray Pelletier

---

From: "John Levine" <[email-masked]>
Date: 17 Mar 2016 15:03:47 -0000

>My only issue is that it claims our websites are not for use by children under 13. They most certainly are.

No, it says they are not *intended* for children under 13.  Words
matter, particularly in legal documents, and it's important to read them
carefully enough to understand what they mean.

Having written a chapter on COPPA for a legal encyclopedia, I can
report that the law is actually pretty reasonable, as is the section
of our proposed privacy policy.  Intended means what it sounds like,
there's nothing on our web sites aimed at kids, with typical examples
being cartoons and games.

It specifically does not mean that children are forbidden to use our
sites, nor does it mean that we have to take any measures to keep
children out.  (For sites that really are intended for children,
there's a comprehensive set of rules with compliance generally
outsourced to a handful of specialist companies in the marketing and
entertainment industries.)

COPPA discourages collection of PII from children without their
parents' consent, so insofar as we are able, we should avoid doing so.
If it became apparent that a participant on an IETF list (or,
hypothetically an I-D author) were under 13 it would be a good idea to
suspend the child's subscription and tell her to have her parent write
to the list owners, so we could explain what the IETF is, how the
mailing lists work, and ask whether the parent is OK with her
participation.  It would also be a good idea since a 12 year old child
cannot meaningfully agree to the Note Well.

For more info on COPPA, Google is your pal.  You're in Canada, and I
have no idea whether the IETF's contacts with Canada are sufficent
that PIPEDA would apply, although I would guess that our practices
would be fine under PIPEDA.  If anyone cares I have contacts at the
OPC I could ask.

R's,
John

---

From: Adam Roach <[email-masked]>
Date: Thu, 17 Mar 2016 11:31:42 -0500

On 3/17/16 05:34, Stephane Bortzmeyer wrote:
> On Wed, Mar 16, 2016 at 01:14:17PM -0500,
>   Adam Roach <[email-masked]> wrote
>   a message of 149 lines which said:
>
>> I certainly hope that this means to say "IETF will store hashed
>> versions of these passwords and does not make them available to the
>> public."
> I don't think it is a good idea, in a policy document, to be too
> specific about the technical measures we take (because they may change
> often).

Sure, the level of technical detail can probably be scaled back a bit, 
but I think it's relevant for a privacy policy to indicate that password 
information is stored in an obscured form according to industry best 
practices.

/a

---

From: S Moonesamy <[email-masked]>
Date: Fri, 18 Mar 2016 03:28:16 -0700

Hello,
>The IAOC would like community input on a proposed IETF Privacy Policy.

The above says "Privacy Policy" whereas the "IETF Draft 24 Feb. 2016" 
says "Statement Concerning Personal Data".

According to www.ietf.org the "Internet Engineering Task Force (IETF) 
is an organized activity of the Internet Society".  Who is the 
operator of www.ietf.org?

I'll use "personal data" to refer to "personally identifiable 
information" as it might be easier to understand.  The following is 
considered as personal data:

   (a) first and last name
   (b) home address
   (c) e-mail address
   (d) Any other identifier that permits the physical or online contacting
       of a specific individual

IETF online participation requires (a) and (c) [1].  IETF attendance 
requires more personal data, e.g. payment information.  There is also 
the audio and video recordings.  According to the Attorney General, 
California Department of Justice, the United States "Federal Trade 
Commission (FTC) has called for improved data practice transparency,
encouraging privacy policy statements that are 'clearer, shorter, and 
more standardized
to enable better comprehension and comparison of privacy 
practices'.  I suggest having a subdivision so that the participant 
can easily find which personal data he/she has to provide.  There 
would be a separate division for an attendee as other personal data 
may be required. A third division would be for the (web) visitor.

There isn't any information in the draft about data use and 
sharing.  The draft mentions that it is possible "to request 
information regarding our disclosure of your Personal Data to third 
parties for direct marketing purposes".  I suggest explicitly asking 
for consent before sharing personal data with third parties.

   "We believe that we have implemented commercially reasonable precautions
    to prevent the unauthorized use, disclosure and alteration of Non-Public
    Information. However, no data security measures can guarantee complete
    data security, and IETF does not guaranty the confidentiality of anything
    that you submit to IETF."

Does that mean that the IETF will not notify a person affected by a 
data breach?  What is the difference between "commercially reasonable 
precautions" and "reasonable precautions"?

This draft is better than the draft which was posted in February 2015.

Regards,
S. Moonesamy

1. I skipped the exceptions.

---

From: S Moonesamy <[email-masked]>
Date: Mon, 28 Mar 2016 03:36:43 -0700

Hi Tobias,

The IAOC solicited community input about a proposed IETF Privacy 
Policy [1] on 16 March.  I sent an email on 18 March in which I asked 
a few questions [2].  I neither received any answers to those 
questions nor did I find any answers in the [email-masked] mailing 
list archive.  I tried to find out whether there were any answers in 
the IAOC minutes.  I could not find any (published) minutes for 
January or February.

I would appreciate if you could bring those questions to the 
attention of the IAOC and provide the answers.

Regards,
S. Moonesamy

1. http://www.ietf.org/mail-archive/web/ietf/current/msg97181.html
2. http://www.ietf.org/mail-archive/web/ietf/current/msg97207.html

---

From: "Scott O. Bradner" <[email-masked]>
Date: Mon, 28 Mar 2016 07:01:49 -0400

sorry, I was waiting for the end of the comment period to address the comments/questions
in case one person’s questions or comments elicited mailing list discussions

the comment period is ending soon and we will be reviewing the responses to the call for review 
and getting back to the community at that time.

Scott

> On Mar 28, 2016, at 6:36 AM, S Moonesamy <[email-masked]> wrote:
> 
> Hi Tobias,
> 
> The IAOC solicited community input about a proposed IETF Privacy Policy [1] on 16 March.  I sent an email on 18 March in which I asked a few questions [2].  I neither received any answers to those questions nor did I find any answers in the [email-masked] mailing list archive.  I tried to find out whether there were any answers in the IAOC minutes.  I could not find any (published) minutes for January or February.
> 
> I would appreciate if you could bring those questions to the attention of the IAOC and provide the answers.
> 
> Regards,
> S. Moonesamy
>

---

From: "Adrian Farrel" <[email-masked]>
Date: Mon, 28 Mar 2016 12:01:55 +0100

I didn't see a response to mine of 16th March, either.
I assumed that the IAOC would be bunching together the input and then sending a
considered reply.
Adrian

> From: ietf [mailto:[email-masked]] On Behalf Of S Moonesamy
> Sent: 28 March 2016 11:37
> To: Tobias Gondrom
> Cc: [email-masked]
> Subject: Re: Proposed IETF Privacy Policy for Review
> 
> Hi Tobias,
>

---

From: Tobias Gondrom <[email-masked]>
Date: Mon, 28 Mar 2016 19:17:12 +0800

Hello all,

Yes. The comment period is ending soon and we will be reviewing the 
responses to the call for review
and getting back to the community at that time.

Thank you all for your feedback and input. Please be assured, we are of 
course and indeed reading the ietf list and your comments and will be 
including the input together.

Best regards, Tobias (IAOC Chair)

---

From: Alissa Cooper <[email-masked]>
Date: Tue, 29 Mar 2016 10:34:56 -0700

Thanks for putting this together. Having attempted this once before [1], I’m glad to see it getting picked up again. I have a few comments to offer.

1) Non-public information
In addition to Adrian’s point about registration data, people provide details in order to obtain letters of invitation, which includes passport number, date of birth, etc. It’s important for people to know these details will not become public.

If we have data retention policies about the various types of non-public information, those should be stated.

2) Third-party sharing
I agree with Jordi that we need to say something about third-party data sharing and why we do or do not do it. It sounds like we do use a third-party payment processor, so it would not be accurate to say that we do not share any personal data with third parties. In any event I think a dedicated short section about sharing of personal data would be a good addition.

3) Tracking technologies
The policy talks about cookies and DNT (agree with Adam wrt to the DNT language), but many organizations these days are providing more detail about tracking technologies that they do and do not use, including flash cookies, local storage and other browser storage, pixels/beacons. I would suggest that we provide details about these (may be as simple as saying that we do not use them, or that we do and why).

4) Links to third party sites
Many privacy policies give a little information about the implications of clicking on links to third-party sites. I think that would be warranted here. E.g., if people join an IESG telechat using the webex link at http://ietf.org/iesg/ <http://ietf.org/iesg/> then data about them will be collected by Cisco, and not just the audio of the meeting but other data governed by the WebEx privacy statement. I’m assuming this is the same for MeetEcho and other services one might arrive at by navigating from a site hosted at ietf.org. One or two sentences about using third-party tools from the IETF site or in the context of an IETF meeting would be warranted.

5) Other organizations
In addition to Lars’ point about the IRTF, I was wondering about the RFC Editor and rfc-editor.org.

6) Jabber
I think it would be useful to be explicit about whether chats hosted on jabber.ietf.org are covered by this policy.

7) Law enforcement requests
Some organizations are in a position to make stronger statements about how they deal with law enforcement requests than what is included here. I would suggest taking a look at Section 4 of the I-D linked below to see if we’re able to say anything about appropriateness of legal standards or notice to individuals.

Thanks,
Alissa

[1] https://tools.ietf.org/html/draft-cooper-privacy-policy-01 <https://tools.ietf.org/html/draft-cooper-privacy-policy-01>

> On Mar 16, 2016, at 10:02 AM, IETF Administrative Director <[email-masked]> wrote:
>