Subject: RE: "private" Element Attribute

From: "Hollenbeck, Scott" <[email-masked]>
Date: Tue, 22 Oct 2002 12:56:54 -0400

> I suggest instead to rely on a function of EPP: the fact that you can
> include XML elements which are not in the official schema. For
> instance, P3P <URL:http://www.w3.org/TR/P3P/> elements could be added
> in the EPP flow from the registry to the registrar and APPEL elements
> from the registrar to the registry.
> 
> That way, we would build on an existing and documented and recognized
> and quite comprehensive framework (managing its privacy preferences is
> complicated enough that we do not introduce a new framework).

As Eric has already replied, we already have data collection policy elements
in the core protocol.  I'm not familiar with APPEL; could you provide a
pointer?

My biggest concern in reopening this debate is that we don't get bogged down
again in debates about how one jurisdiction's privacy policy has to be
ingrained in the protocol.  I firmly believe that our obligation is to
ensure that the protocol provides functionality that provides flexibility
for the expression of multiple privacy policies and privacy preferences.  I
thought we had that going into the IESG review with the current extension
mechanism (though it might not be explained well (or not at all) in the
current text), but one IESG member initially suggested a need to provide
element-level granularity.  We still have a responsibility to keep the
mechanism as policy-neutral as possible, which is where the proposal I
floated yesterday came from.

-Scott-

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Tue, 22 Oct 2002 13:30:19 -0400

A pointer to APPEL
http://www.w3.org/TR/P3P-preferences/

I agree, the novel (and interesting question) is <dcp> scope.

I agree, that j19n is generally a registry-private policy problem, best
solved by a registry profile. Our problem is a mechanism that allows a
specific policy, as the EPP implementors, and eventually the EPP operators,
see as prudent.

I disagree that a scopeless bivalued semantic is policy neutral, since we
can reasonably forsee that this isn't.

I'm not inclined to "solve" the IETF's problem with ICANN and whois:43.
The right way to do that is to correct the policy-making body that misuses
whois, not poision the protocol with binary toggles.

Eric

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 22 Oct 2002 22:13:20 +0200

On Tue, Oct 22, 2002 at 12:56:54PM -0400,
 Hollenbeck, Scott <[email-masked]> wrote 

> in the core protocol.  I'm not familiar with APPEL; could you provide a

Eric provided one. To summary, APPEL can be seen as the "export
format" of the privacy preferences that you configured in your Web
browser. They could be sent to the registry in an EPP flow. Then, the
registry will have a detailed (much more detailed than a binary
public/private) knowledge of the user's preferences.

> ingrained in the protocol. 

I agree but I do not see the connection with P3P which *is*
policy-neutral. P3P (and APPEL) is a protocol to *express* privacy
policies or requirments, it does not dictate them (unless you think
that no language is neutral, which is also true of EPP).