Subject: Proposed IETF Statement Concerning Personal Data for Review

From: IETF Administrative Director <[email-masked]>
Date: Thu, 23 Feb 2017 15:27:10 -0800

The IAOC would like community input on a proposed IETF Statement
Concerning Personal Data.

The policy discusses the following:
  1.  General – Most Personal Data Submitted to the Parties Will Become Public
  2.  You Consent to International Transmission of Your Data 
  3.  Exceptions – Information That We Do Not Release to the Public
  4.  Security
  5.  Children
  6.  Inquiries
  7.  Compliance
  8.  Other Organizations
  9.  Links to other sites.
  10.  Consent

The proposed Privacy Policy is located here:
https://iaoc.ietf.org/documents/Privacy-Statement-23Feb17.htm

The previous policy was posted for community review on 24 February
2016. This new version reflects input received during that community
review and a diff file reflecting the changes since that version is
located here:

https://iaoc.ietf.org/documents/Diff-Privacy-2016-02-24-02-Privacy-23Feb17.pdf

The IAOC will consider all comments received by 9 March 2017.

Ray Pelletier
IETF Administrative Director

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 27 Feb 2017 17:43:31 +0000

Some comments:

- "Parties" is a horribly legalistic term (esp. given that
the IETF isn't a legal thing really), I'd much prefer less
legalistic terms be used

- "home address" huh? How do you know where people live?
I think you mean any address supplied, but then in fact we
don't make that public that I recall - what's up there?

- "mailing list managed by the Parties" some WG lists are
not thusly managed still, are all bets off for those?
I've also managed some lists (e.g. TPC lists for IAB
workshops) that'd not clearly fit under here but maybe
should.

- "We do not make such information available to the
public." huh? Shouldn't we be saying something to the
effect that we'll not share that with anyone unless
we're forced to? (Including CF in "forced" as far as
that applies.) Ah, you do say that later, maybe try
a forward reference or align these better.

- "flash cookies, local storage" should be examples as
they'll be (or already are) outmoded (e.g indexeddb is
the new local storage or was last I looked;-)

- "not intended for use by children under 13" - we don't
care, why not say that instead of trying to avoid some
non-existent liability (which is how it looks) - maybe
s/intended for/aimed at/ would be better? (The rest of
the para is fine)

- compliance - can we have a warrant canary? If not, why
not? I think I asked about this before (not 100% sure
if that was public or just chatting with someone)

- I'm also quite surprised there's nothing that has to
be said about CF here - does that mean that they do not
engage in anything that'd violate this practice with
data/traffic related to IETFers? (I may also have asked
about that too:-)

Thanks,
S.

---

From: Ted Hardie <[email-masked]>
Date: Mon, 27 Feb 2017 09:50:18 -0800

> s/intended for/aimed at/ would be better? (The rest of
This looks to me like an effort to define the service so that we do not
need to meet the requirements of COPPA (
https://en.wikipedia.org/wiki/Children's_Online_Privacy_Protection_Act).
To the extent that meeting those requirements can be costly and we have no
known participations under 13, then I think it is probably reasonable to
include.

regards,

Ted

---

From: "Andrew G. Malis" <[email-masked]>
Date: Mon, 27 Feb 2017 12:51:42 -0500

Ray,

Physical address information, especially home address, that’s not
explicitly made public by the individual (for example, in the Author’s
section of a draft or RFC) should be included in the “Information That We
Do Not Release to the Public” section.

Thanks,
Andy

---

From: Rich Kulawiec <[email-masked]>
Date: Mon, 27 Feb 2017 12:54:27 -0500

On Thu, Feb 23, 2017 at 03:27:10PM -0800, IETF Administrative Director wrote:
> Concerning Personal Data. [snip]
>

1. The second paragraph (begins "The parties operate") includes
"(b) home address".  I think it would be better to use "mailing address"
to encompass everyone who uses a business address or other address.

2. Under "Exceptions -- Information That We Do Not Release to the Public",
I think two changes are needed.

	2a) Under "Non-Public Mailing Lists and direct mail to individuals
	at the Parties", I think it would be good to note that the Parties
	cannot control the disclosure of individual messages or entire
	archives of these.  The Parties can certainly request that members
	of those lists keep them private, and can certainly impose sanctions
	if it wishes on those who don't, but it can't stop that disclosure.
	Also worth noting is that security issues -- whether affecting an
	individual on one of those lists or the list mechanism/archive
	itself, could result in full disclosure of their entire contents.

	2b) I think it would be a good idea to stipulate that the Parties
	will not disclose mailing list membership records: email addresses,
	list memberships, date joined, date left, etc.  To put it less
	formally, the Parties won't out the lurkers.  While most of us
	don't have to be overly concerned about such disclosures, there
	are some people for whom it could have negative consequences.

3. Under "Security", I believe there's a typo: "guaranty" should be 
"guarantee".

4. Also under "Security", this phrase: "such release is required by
applicable law, regulation or judicial order" doesn't cover NSLs
or similar instruments, which are none of those.  At the risk of opening
an infinite can of worms, what is the policy w.r.t. NSLs et.al.?

---rsk

---

From: Johnny Wang <[email-masked]>
Date: Mon, 27 Feb 2017 18:31:29 +0000

I think we can just say "children under 13 must obtain consent from their
parents or legal guardians". We should be fine in terms of COPPA if parents
agree with the release of personal information.

Btw, I'm new to the list, so hello everyone!

Regards,
Johnny

On Mon, Feb 27, 2017 at 9:50 AM Ted Hardie <[email-masked]> wrote:

> On Mon, Feb 27, 2017 at 9:43 AM, Stephen Farrell <
> [email-masked]> wrote:
>
>
-- 
Thanks,
Johnny Wang

---

From: S Moonesamy <[email-masked]>
Date: Mon, 27 Feb 2017 10:56:47 -0800

Hi Leslie,
>Concerning Personal Data.

This is the third time that the IAOC has solicited input on a 
proposed statement concerning privacy.  There wasn't any reply to the 
questions which was sent about the second proposed statement.

Could the IAOC please provide a reply to the questions which were 
asked previously?

The proposed statement identifies the Internet Society as a third 
party.  That is at odds with the statement at the bottom of the 
webpage at https://www.ietf.org/

Regards,
S. Moonesamy

---

From: "John Levine" <[email-masked]>
Date: 28 Feb 2017 07:45:19 -0000

>agree with the release of personal information.

We have no process to obtain, verify, or record parental consent.
Unless someone anticipates an influx of middle school kids
to the IETF, please leave the language alone.

Note that children can read IETF stuff all they want -- they just
can't send messages in.

R's,
John

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 28 Feb 2017 08:00:59 +0000

On 28/02/17 07:45, John Levine wrote:
> In article 
> <[email-masked]> 
> you write:
>> I think we can just say "children under 13 must obtain consent
>> from their parents or legal guardians". We should be fine in terms
>> of COPPA if parents agree with the release of personal
>> information.
> 
> Unless someone anticipates an influx of middle school kids to the 
> IETF, please leave the language alone.
> 

Let me try once more. The change I suggest to the IAOC IS:

OLD:

Our websites are not intended for use by children under 13 years old.
We do not knowingly collect personally identifiable information from, or
target our websites to, children under the age of 13.  In accordance
with the United States Children’s Online Privacy Protection Act of 1998,
if we discover that a child under 13 has provided us with personally
identifiable information, without the consent and participation of a
parent or guardian, we will remove it from our systems.

NEW:

Our websites are not aimed at children under 13 years old.
We do not knowingly collect personally identifiable information from, or
target our websites to, children under the age of 13.  In accordance
with the United States Children’s Online Privacy Protection Act of 1998,
if we discover that a child under 13 has provided us with personally
identifiable information, without the consent and participation of a
parent or guardian, we will remove it from our systems.

My reason is that we do in fact intend that our public content
could be used by anyone capable of understanding that content,
independent of age. We just don't specifically include or
exclude or aim to deal with 12 year olds, nor Irish people, nor
any other category.

Perhaps there's a better phrase than "aimed at" but "intended
for" is wrong as I read it. (To save you some time, there's only
that one change in the OLD/NEW above.)

Cheers,
S

> R's, John

---

From: "John R Levine" <[email-masked]>
Date: 28 Feb 2017 08:10:48 -0800

> Let me try once more. The change I suggest to the IAOC IS:

Really, no.

Keep in mind that COPPA is only concerned with PII, so the only thing it 
would affect is whether 12 year olds can join mailing lists and create 
datatracker accounts.  We do not know or care who is looking at the web 
sites and mail archives.

If you say you allow under-13's to sign up at all, COPPA deliberately 
requires all sorts of record keeping that in practice means we'd have to 
hire one of a handful of specialist COPPA compliance firms.  It is not 
adequate to say we asked her mother who said it's OK.

Just leave the boilerplate alone.  It avoids significant legal exposure, 
and in practice limits nothing.

R's,
John