W3C Workshop on Languages for Privacy Policy Negotiation and Semantics-Driven Enforcement

1
W3C Workshop onLanguages for Privacy Policy
Negotiation and Semantics-Driven Enforcement

• Report
• Hannes Tschofenig
• IETF 67, San Diego, November 2006

2
Workshop Details

• 17 and 18 October 2006 -- Ispra/Italy hosted by
  the Joint Research Center (JRC) of the European
  Commission
• Webpage http//www.w3.org/2006/07/privacy-ws/
• Agenda (including papers and slides)
• http//www.w3.org/2006/07/privacy-ws/agenda
• Participants from W3C, research community (e.g.,
  EU funded research project PRIME), companies
• A few pictures
• http//www.tschofenig.com/workshop/w3c-privacy/

3
Our Contribution to the Workshop
Geopriv/Presence Overview Paper

• Paper Title The IETF Geopriv and Presence
  Architecture Focusing on Location
  Privacyhttp//www.w3.org/2006/07/privacy-ws/pape
  rs/26-tschofening-geopriv
• Slides http//www.w3.org/2006/07/privacy-ws/pres
  entations/26-tschofenig-geopriv.pdf
• Authors
• Hannes Tschofenig, Henning Schulzrinne, Andrew
  Newton, Jon Peterson, Allison Mankin

4
Feedback 1 Intended Recipient Not Explicit

• Without S/MIME the intended recipient of the
  location information is not explicitly specified.
• Already raised during discussions
• http//www1.ietf.org/mail-archive/web/sip/curr
  ent/msg14356.html
• Suggestion Add text to Geopriv using protocols
  (in particular to the SIP Location Conveyance
  draft) to address this aspect.

5
Feedback 2 Sticky Policies only for Loc-Info

• Basic Geopriv privacy policies (stick policies)
  defined only for Location Info
• Travel always with PIDF-LO
• Question Why only available for Location Info?
  Other information is also privacy sensitive.
• For discussion Should we define privacy policies
  also for PIDF object?

Note The term sticky policies is used by the
W3C to refer to policies that travel with the
privacy sensitive data.
6
Feedback 3 Policy Push vs. Policy Pull

• Geopriv Basic Policies are pushed to the
  recipient. Assumption Recipient acts in the
  anticipated way (as expressed in the policies)
• P3P realize a pull principle.
• Perceived problem Privacy policies of recipient
  unknown.
• For further discussion
• Consider a profiled version of P3P policies as an
  extension for SIP
• Use vocabulary and not protocol framework of P3P
• For example Derive usage from P3P compact
  policies http//www.w3.org/TR/P3P/compact_policie
  s

7
Next Steps

• Determine how to process received feedback.
• Establish a closer relationship with W3C.
• Participate in upcoming Policy Frameworks
  Interest Group (PFIG).