On Thu, Jul 08, 2010 at 11:59:12AM +0300, Yoav Nir wrote: > Without a privacy policy, it's hard to say whether that is > acceptable or not. I keep seeing arguments of this sort in the current thread, and it seems to me to be backwards. Surely it is not the privacy _policy_ that determines whether something is acceptable. For instance, imagine a website privacy policy that says, "We take your personal information, including your credit card number, expiry date, and CCD number, and post it on our website." The existence of that privacy policy would not make the actions somehow better or defensible: it would be a bad policy. I suppose posting somewhere that you're going to do that would be better than just doing it without any warning, but the action would be unacceptable regardless. If the current no-written-policy arrangement is working, it is presumably because people are making the right choices. One analysis of that is that there is an implicit policy, that it is acceptable, and that the present effort to write down a policy is just a way of making that implicit policy explicit. But writing the policy down does not in itself do anything about whether a given activity with a given bit of PII is ok. On the larger topic of whether a privacy policy is actually needed, I am undecided. On the one hand, it does seem to me to be a good idea to have one place where the IETF states what it is going to do with any PII. On the other hand, I can easily imagine that such a privacy policy could end up being used as a mechanism to justify bad ideas in the event something comes up: it will be more work to change the policy if it turns out to be inadequate than it will be to accept the inadequacy. The present arrangement means that, if a bad idea crops up, it can be dealt with on its own (de)merits without dragging in a meta-issue about whether the proposal is consistent with some holy policy document. A -- Andrew Sullivan ajs@xxxxxxxxxxxx Shinkuro, Inc. _______________________________________________ Ietf mailing list Ietf@xxxxxxxx https://www.ietf.org/mailman/listinfo/ietf