Subject: Proposed IETF Websites’ Privacy Policy; Community Input Requested

From: IETF Administrative Director <[email-masked]>
Date: Tue, 03 Feb 2015 07:52:17 -0800

The IAOC would like community input on a proposed IETF websites’ Privacy Policy.

We are required by California law (and good net citizenship) to have an accurate 
privacy policy on our websites.  Counsel have reviewed this statement for compliance 
with US and EU privacy regulations.  

The policy discusses the following:
  a.  Information collected
  b.  What’s done with the information
  c.  Information accessible to the public
  d.  Cookies and other tracking technologies
  e.  Participant database
  f.  Security
  g.  Links
  h.  Discussion groups
  i.  Children
  j.  Compliance
  k.  Consent and changes to this policy

The proposed Privacy Policy is located here:
<https://iaoc.ietf.org/documents/IETF-Website-Privacy-Policy-16Jan15.pdf>

The IAOC will consider all comments received by 17 February 2015.

Thanks.

Scott Bradner
Chair
IAOC Legal Committee

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Tue, 03 Feb 2015 17:52:05 +0100

><https://iaoc.ietf.org/documents/IETF-Website-Privacy-Policy-16Jan15.pdf>

Missing word in "Due to the nature of the, your communications ..."

I think

  Certain visitor characteristics are reflected in our web server logs 
  (such as, operating system, browser version, and Internet Protocol 
  (IP) address). We do not take affirmative steps to link them with the 
  individual visitors to the site, except as may be required to diagnose
  performance issues or to investigate misuse of the site or other
  unlawful or inappropriate activities.

and

  When you interact with the site, we strive to make your experience
  easy and meaningful. We may use cookies and other means to track user 
  activity and collect site data. We may combine these data with the 
  personal information we have collected.

are contradictory, especially considering that the former is in the
"What Information do we collect?" section, which does not mention the
latter.

With

  This site is not intended for use by children under 13 years old. We
  do not knowingly collect personally identifiable information from, or 
  target our site to, children under the age of 13. In accordance with 
  the Children’s Online Privacy Protection Act of 1998, if we discover 
  that a child under 13 has provided us with personally identifiable
  information, we will remove it from our systems immediately.

it seems unclear what this means when an 11 year old person posts e.g. a
Last Call comment. Would the mailing list archives be altered to remove
their name and mail address?
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
D-10243 Berlin · PGP Pub. KeyID: 0xA4357E78 · http://www.bjoernsworld.de
 Available for hire in Berlin (early 2015)  · http://www.websitedev.de/

---

From: "John Levine" <[email-masked]>
Date: 3 Feb 2015 17:08:01 -0000

>We are required by California law ...

Why does California law apply to the IETF? To the extent that the IETF
has a legal existence, it is my understanding that ISOC and CNRI, the
grantors of the IETF trust, live in Virginia.  AMS is in California
but AMS is a contractor.

R's,
John

PS: I'm not opposed to a reasonable privacy policy, but I am opposed
to legal creep.  The next thing you know all the mail will have
footers purporting to be confidential.

---

From: "Joseph Lorenzo Hall" <[email-masked]>
Date: Tue, 03 Feb 2015 10:20:00 -0800 (PST)

Hi, the law in question "applies to
operators of commercial web sites and online services that collect personally identifiable
information about Californians." [1] Like any responsible online commercial entity, the IETF likely has legal counsel that tries to aggregate all of these kinds of legal requirements into a global view of what needs to be affirmatively stated in a privacy policy... 

[1]: https://oag.ca.gov/sites/all/files/agweb/pdfs/cybersecurity/making_your_privacy_practices_public.pdf

--Joseph Lorenzo Hall

Chief Technologist

Center for Democracy & Technology

1634 Eye St., NW

Washington, DC 20006

+1 202-407-8825

https://josephhall.org/

---

From: Tom Taylor <[email-masked]>
Date: Tue, 03 Feb 2015 17:57:16 -0500

The content seems generally OK. I think there should be explicit mention 
of attendance lists under "Certain information will be accessible to the 
public".

Under "What Information do we collect?"the third and fourth paragraphs 
have lost some letters or words:

"your interaction with the site, programs, and services, hat IETF may 
offer to you,"                                           ^

"Due to the nature of the, your communications"

At various places I might have editorial suggestions (e.g., remove 
excess commas), but after a day of doing so for another document I don't 
feel like continuing the work here. Maybe later.

Tom Taylor

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 5 Feb 2015 16:10:51 +1100

Does the IETF have a privacy policy overall?

One of the things that I find frequently frustrating is that an entity will handle sensitive data (and realise that the definition of that is *very* broad these days), only to have a policy that's applicable to its Web site, which only covers a small portion of the interactions that it's involved in.

If we're going to go to the trouble of developing a privacy policy (and I think we should, even as an "open" organisation), it would be worthwhile to include all interactions, not just those that go through a Web browser.

Cheers,

> On 4 Feb 2015, at 2:52 am, IETF Administrative Director <[email-masked]> wrote:
> 

--
Mark Nottingham   https://www.mnot.net/

---

From: "Adrian Farrel" <[email-masked]>
Date: Thu, 5 Feb 2015 10:58:30 -0000

Yeah, I'd agree with that.

Developing a website policy might be a component of that or a stop-gap, but more information about IETF participants is collected and stored electronically, so there should be a wider policy.

Adrian

> One of the things that I find frequently frustrating is that an entity will handle
> sensitive data (and realise that the definition of that is *very* broad these days),
> only to have a policy that's applicable to its Web site, which only covers a small
> portion of the interactions that it's involved in.
> 
> If we're going to go to the trouble of developing a privacy policy (and I think we
> should, even as an "open" organisation), it would be worthwhile to include all
> interactions, not just those that go through a Web browser.

---

From: "John Levine" <[email-masked]>
Date: 5 Feb 2015 17:26:12 -0000

>Yeah, I'd agree with that.

So would I, but given how amorphous the IETF is, it'll be a challenge to
come up with anything realistic.  For example, how would a privacy policy
apply to mailing list hosted other than on the IETF's servers?

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 05 Feb 2015 17:31:20 +0000

> apply to mailing list hosted other than on the IETF's servers?
I thought all BoF/WG mailing list (but one) that were not hosted on IETF 
servers were migrated to @ietf.org.

---

From: t.p. <[email-masked]>
Date: Thu, 5 Feb 2015 18:20:36 +0000

----- Original Message -----
From: "Alexey Melnikov" <[email-masked]>
To: "John Levine" <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, February 05, 2015 5:31 PM

> servers were migrated to @ietf.org.

Alexey

You may recall a recent post to the appsawg list that suggested that the
discussions on uri and iri should take place on
         "http://lists.w3.org/Archives/Public/uri/"
         "http://lists.w3.org/Archives/Public/public-iri/"
while I see (used to?) discussion on
[email-masked]

I think that the higher up the stack you go, the more likely you are to
see discussion of IETF I-Ds taking place on non-IETF lists.

Tom Petch