Subject: [Ietf-not43] background reading

From: [email-masked] (Leif Johansson)
Date: Thu, 18 Jul 2002 02:47:39 +0200

I mentioned the NEEDS-project (not by name) at the wg meeting today. The 
NEEDS project
was funded by nordunet2 and can be seen as a cultural decendant to 
TISDAG mentioned by
Leslie. The aim of the project was to build an index-based (as in 
LDAP-referrals) whitepages
directory in the nordic countries. In NEEDS we spent some money on 
lawyers to figure out how
to "get around" the requirements placed on projects like NEEDS by EC 
privacy legislation.

Project URL: http://www.katalog.uninett.no/needs/

One of the deliverables, Privacy Aspects of the NEEDS project 
<http://www.katalog.uninett.no/needs/deliverables/Privacy_Aspects_of_the_NEEDS_project.pdf> 
might be useful reading when
thinking about privacy in the crisp requirements document.

The gist of this document is that one way to deal with privacy is to 
push the requirement on
user notification as far down the index structure as possible and create 
contracts between the
index operators and the indexed organisations where privacy req. are set 
down. That way the
index operators are protected from liability and the indexed org are 
stuck with dealing with
user notification which they have to do anyway.

Remember when reading the document that we had a real lawyer and a EC 
privacy expert
doing this.

How does this relate to protocol requirements? I don't know yet. Maybe 
it means that since there
is a way to solve the privacy issue you may not need protocol support. 
Maybe.

            MVH leifj