I tend to agree with Andrew and Marshall.
However, from our own JEDI's (so-labelled "Jefsey's disciples") experience I would suggest some kind of "ietf privacy netiquette". It could be equivalen to architectural quotes like "dumb network", "end to end", "protocol on the wire", "rough consensus", etc. It could be added to the Tao.
This way everyone would know-where he/she comes and can behave equally. This could concern the so-called "puppets", negative privacy (ad hominem have a perpetual impact on private reputation), disclosed/non-disclosed affiliations, who paid for the travel tickets and attendance fees, architectural perspective, mailing list participations, etc. I think this could be proactive if the information is not "protected" but "personally and optionally disclosed". There could be a database where every IETF participant could document what he/she wants on him/herself. I am sure that what would not be disclosed would eventually inform more than what is disclosed and help better debates, avoiding misunderstandings, and focusing on concepts rathers than on percepts.
Portzamparc
2010/7/8 Marshall Eubanks <tme@xxxxxxxxxxxxxx>
I see this as a normal part of an organization growing up. Small, young, organizations don't
On Jul 8, 2010, at 11:15 AM, Andrew Sullivan wrote:
On Thu, Jul 08, 2010 at 11:59:12AM +0300, Yoav Nir wrote:
Without a privacy policy, it's hard to say whether that is
acceptable or not.
I keep seeing arguments of this sort in the current thread, and it
seems to me to be backwards. Surely it is not the privacy _policy_
that determines whether something is acceptable. For instance,
imagine a website privacy policy that says, "We take your personal
information, including your credit card number, expiry date, and CCD
number, and post it on our website." The existence of that privacy
policy would not make the actions somehow better or defensible: it
would be a bad policy. I suppose posting somewhere that you're going
to do that would be better than just doing it without any warning, but
the action would be unacceptable regardless.
If the current no-written-policy arrangement is working, it is
presumably because people are making the right choices. One analysis
of that is that there is an implicit policy, that it is acceptable,
and that the present effort to write down a policy is just a way of
making that implicit policy explicit. But writing the policy down
does not in itself do anything about whether a given activity with a
given bit of PII is ok.
typically need much structure, as everyone knows everybody, people trust each other,
and everything tends to be in people's heads. That doesn't scale. Putting
implicit policies down in writing is an attempt to make sure that the organization doesn't
change in adverse ways as it grows and matures.
Regards
Marshall
On the larger topic of whether a privacy policy is actually needed, I
am undecided. On the one hand, it does seem to me to be a good idea
to have one place where the IETF states what it is going to do with
any PII. On the other hand, I can easily imagine that such a privacy
policy could end up being used as a mechanism to justify bad ideas in
the event something comes up: it will be more work to change the
policy if it turns out to be inadequate than it will be to accept the
inadequacy. The present arrangement means that, if a bad idea crops
up, it can be dealt with on its own (de)merits without dragging in a
meta-issue about whether the proposal is consistent with some holy
policy document.
A
--
Andrew Sullivan
ajs@xxxxxxxxxxxx
Shinkuro, Inc.
_______________________________________________
Ietf mailing list
Ietf@xxxxxxxx
https://www.ietf.org/mailman/listinfo/ietf
_______________________________________________
Ietf mailing list
Ietf@xxxxxxxx
https://www.ietf.org/mailman/listinfo/ietf
_______________________________________________ Ietf mailing list Ietf@xxxxxxxx https://www.ietf.org/mailman/listinfo/ietf