Subject: [iucg] Email practices (dis)respectful of European privacy directives

From: JFC Morfin <[email-masked]>
Date: Mon, 02 Nov 2009 12:36:12 +0100

Allessandro,
I went on your http://FixForwarding.org/wiki/standard_behavior. I 
wish to clearly understand your approach. If I am correct you say:

- European Data Protection Directives (you do not document yet) are 
common sense. They are therefore a good starting point for global review.
- SMTP as also being rooted in common sense could support them. There 
is however something architectural to add to it to make it naturally 
enforce these directives.
- you propose to study how to address that addition and suggest a 
possible solution (I must say that not being familiar with SMTP 
intricacies I do not fully understand what to consider)

I started documenting a store and forward/retreive solution a few 
years ago. Why not to create an IUCG Special Interest Group on the 
issue you could lead. The IUCG is just that: a place to debate, 
introduce IETF Drafts, and possibly architecturally ally towards a 
bette user experience of the Internet.

Please look at: http://iucg.org/wiki/Applications_Area  - I can give 
you an SIG Moderator access to the wiki and you will be free to 
build-up a proposition that can be disucssed on this list. Please do 
not object that IUCG is young. It is and it will be what we the lead 
users will build. I can also Moderate the theme until you feel at 
ease or found someone interested.

Best
jfc

>Dear commissioner,
>I am seeking cooperation on working out the specifications for 
>treating email addresses with full respect of privacy rules. 
>According to my analysis, both the (Simple) Mail Transfer Protocol 
>and the European Data Protection Directive (95/46/EC) are rooted in 
>common sense. However, except for some vaguely stated "netiquette" 
>principles, SMTP never made explicit those rules that Directive 
>95/46/EC subsequently formalized. Practices not complying with 
>privacy are illustrated in http://FixForwarding.org/wiki/standard_behavior
>
>The rest of that web site contains the sketch of a possible 
>solution. The aim is to provide a practical solution for companies 
>willing to comply with privacy directives. It should have the form 
>of an open source software add-on, amenable to IETF standardization; 
>not an opaquely operated service.
>
>I am a software developer and freelance IT consultant, and currently 
>have enough spare time to try and tackle this issue. Thus far, I 
>haven't been able to discuss my tentative solution with someone 
>acknowledgeable on privacy directives. Honestly, I'm not even sure 
>I'd be able to properly "launch" that solution once it's completed. 
>Isn't there an European group or association for that? I would like 
>to see an alternative to that American trend, incarnated e.g. by the 
>Messaging Anti-Abuse Working Group (MAAWG.org), that apparently 
>gives an unfair advantage to large operators. They end up 
>considering huge pools of email users who can be targeted with 
>minimal disruption by orchestrating a somewhat questionable behavior 
>among large mailbox providers, marketers, and email service 
>providers a la ReturnPath.net. In Europe, we have better privacy 
>laws and I would hope someone is doing something to put them into 
>effect, rather than letting foreign marketers take advantage from 
>not having to abide by.
>
>Thank you so much for your attention and your time.

---

From: Alessandro Vesely <[email-masked]>
Date: Mon, 02 Nov 2009 18:16:16 +0100

Hi JFC!

(I drop cc [email-masked], as I saw no replies there)

> I went on your http://FixForwarding.org/wiki/standard_behavior. I wish 
> to clearly understand your approach. If I am correct you say:
> 
> - SMTP as also being rooted in common sense could support them. There is 
> however something architectural to add to it to make it naturally 

Your understanding of my point is correct. Thank you for your 
interest. As you know, those EU directives are not exactly law, but 
just, as it goes, "directives". That's not exactly the status of IETF 
standards either, however intriguingly related they may appear. One 
striking difference is that the IETF features no "member states". In 
addition, people discussing protocols usually dodge legal issues; 
that's why the IETF would not have likely come out with definitions 
like those, given e.g. in 
http://www.cdt.org/privacy/eudirective/EU_Directive_.html#HD_NM_28

A user's mail server does not store any registration for subscriptions 
to mailing lists. Would such registration have a value for legal 
inquiries about mail abuse? I see European companies have problems 
complaining with paper-consent statements.

> I started documenting a store and forward/retrieve solution a few years 
> ago. Why not to create an IUCG Special Interest Group on the issue you 
> could lead. The IUCG is just that: a place to debate, introduce IETF 
> Drafts, and possibly architecturally ally towards a better user 
> experience of the Internet.
> 
> Please look at: http://iucg.org/wiki/Applications_Area  - I can give you 
> an SIG Moderator access to the wiki and you will be free to build-up a 
> proposition that can be discussed on this list. Please do not object 
> that IUCG is young. It is and it will be what we the lead users will 
> build. I can also Moderate the theme until you feel at ease or found 
> someone interested.

One problem is that there is a plethora of proposals on anti-spam, to 
the point that there is an anti-anti-spam barrier. I'm not sure how 
this can of worms suits the IUCG, so I just cc the list to see if 
someone says something...

Best
Ale

---

From: jefsey <[email-masked]>
Date: Tue, 03 Nov 2009 00:47:51 +0100

At 18:16 02/11/2009, Alessandro Vesely wrote:
>just, as it goes, "directives". That's not exactly the status of 
>IETF standards either, however intriguingly related they may appear. 
>One striking difference is that the IETF features no "member 
>states". In addition, people discussing protocols usually dodge 
>legal issues; that's why the IETF would not have likely come out 
>with definitions like those, given e.g. in 
>A user's mail server does not store any registration for 
>subscriptions to mailing lists. Would such registration have a value 
>for legal inquiries about mail abuse? I see European companies have 
>problems complaining with paper-consent statements.

May I suggest that we consider the EU Directive as a basis for 
Network Services Technical Specifications, translating it into 
technical specifications and possibly into architectural constraints, 
adding whatever inputs we might get from other similar national or 
international documents and user groups. This could then make an I_D 
we cpould ask Civil Rights organizations, GAC Members, IGF 
participants to review. Then the RFC Editor to publish it as an 
informative user contribution.

This would belong to the 
http://iucg.org/wiki/Translating_Civil_Society_preocupations - I 
entered in the "privacy" section the European Text, it should 
simplified into legal requirements that could be extended. Then we 
could port it into technical requirements.

>One problem is that there is a plethora of proposals on anti-spam, 
>to the point that there is an anti-anti-spam barrier. I'm not sure 
>how this can of worms suits the IUCG, so I just cc the list to see 
>if someone says something...

Your idea is not so much to propose a specific solution, but to open 
a usage/technical debate to define what proposals should actually address.

Best
jfc