Subject: [Iotsi] Sticky Policy: Attaching privacy policies to data

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 21 Mar 2016 08:58:00 +0000

Hi all,

During the security discussion the idea of attaching privacy policies to data was mentioned and I noted that there has been work in the IETF on that topic.

Here are the relevant pointers: RFC 4119 (see https://www.ietf.org/rfc/rfc4119.txt) specified a way to convey usage-rules along with location data. These usage-rules contain four pieces of information:
- retransmission-allowed
- retention-expires
- ruleset-reference
- note-well

The ruleset-reference contains richer information about what a recipient of location information is allowed to do with that information. RFC 4745 (see http://tools.ietf.org/html/rfc4745) defines the format of those policies and they have been extended for use with application specific domains, such as presence information and geolocation information. The former can be found in https://tools.ietf.org/html/rfc5025 and the latter in http://tools.ietf.org/html/rfc6772

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.