Copy-edit the Common Concepts section, except for the Recognition sub-section. #369

jyasskin · 2023-11-09T01:25:10Z

Fixes #317, because I think we've already done a pass over Recognition.

index.html

jyasskin · 2023-11-09T01:28:34Z

index.html

 * their location data,
 * an online identifier such as email or IP addresses,
 * browser fingerprints (based on a combination of
-configuration characteristics), or
-* factors specific to their physical, physiological, genetic, mental,
-economic,
-cultural, social, or behavioral [=identity=],
+  configuration characteristics), or
+* factors specific to their physical, physiological, genetic, mental, economic,
+  cultural, social, or behavioral [=identity=],


I'm not sure these are all actually identifiers. They're ways to identify people, but we've defined an identifier as a thing that got assigned to a person.

As discussed today maybe these are characteristics rather than unique identifiers...

Punting further discussion to #374.

jyasskin · 2023-11-09T01:29:06Z

index.html

@@ -2122,41 +2113,39 @@
 destruction.


Yikes! What parts of this do we actually need to list, and what parts could we simplify?

We looked at this today and agreed we need to re-write.

Left for discussion in #375.

jyasskin · 2023-11-22T17:41:25Z

index.html

+is a [=person=] whose ability to make their own choices can be taken away more
+easily than usual. Among other things, they should


Filed #373 to keep thinking about whether we need this at all.

index.html

torgo · 2023-11-22T17:57:32Z

index.html

-  [=actor=] and solely for the list of explicitly-specified [=purposes=]
-  detailed by the directing [=actor=] or [=data controller=];
+  [=data controller=] and solely for the list of explicitly-specified [=purposes=]
+  detailed by the directing [=data controller=];


@darobin can you review this change? It looked good to us on today's call but wanted your eyes on it as well.

This is also incorrect as it rules out the possibility of being the processor of a processor.

darobin · 2023-11-29T16:02:11Z

index.html


-* is processing the data on behalf of that [=actor=];
+* [=processes=] data on behalf of a [=data controller=];


This is incorrect: you can have a service provider of a service provider, in fact it's very common.

darobin · 2023-11-29T16:03:06Z

index.html

 * may determine implementation details of the data processing in question but
  does not determine the [=purpose=] for which the data is being [=processed=]
  nor the overarching [=means=] through which the [=purpose=] is carried out;
 * has no independent right to use the data other than in a [=de-identified=] form (e.g., for
  monitoring service integrity, load balancing, capacity planning, or billing); and,
-* has a contract in place with the [=actor=] which is consistent with the above limitations.
+* has a contract in place with the [=data controller=] which is consistent with the above limitations.


Same issue.

darobin

This is generally good, but replacing actor with controller in the definition of a processor introduces a bug.

darobin · 2023-11-29T16:07:46Z

index.html

-The <dfn>Vegas Rule</dfn> is a simple implementation of privacy in which "<i>what happens with the
-[=first party=] stays with the [=first party=]</i>." Put differently, the [=Vegas Rule=] is followed
-when the [=first party=] is the only [=data controller=]. While the [=Vegas Rule=] is a good
-guideline, it's neither necessary nor sufficient for [=appropriate=] [=data processing=]. A [=first
-party=] that maintains exclusive access to a person's data can still [=process=] it
-[=inappropriately=], and there are cases where a third party can learn information about a person
-but still treat it [=appropriately=].
-


Can we not revisit decisions we've discussed and made? See:

Remove the Vegas Rule #77

https://github.com/w3ctag/privacy-principles/blob/48f13c9b0110f9422041f8e0929711b27e793469/meetings/2021-11-17-minutes.md

We re-discussed this today and decided to keep the Vegas Rule out.

darobin · 2023-11-29T16:08:53Z

index.html

 ## Acting on Data {#acting-on-data}

 We define <dfn data-lt="data">personal data</dfn> as any information that is directly or
 indirectly related to an identified or identifiable [=person=], such as by reference to an
-[=identifier=] ([[GDPR]], [[OECD-Guidelines]], [[Convention-108]]).
+[=identifier=]. (This matches the [[[GDPR]]], the [[[OECD-Guidelines]]], and the [[[Convention-108]]].)


I worry about "this matches" as that is expressing a legal opinion. Referencing documents that define PD is helpful as it allows folks to explore the space further if they need to, but claiming that our definition matches the exact sense used by three distinct legal documents really worries me.

I've un-done this change.

We agreed in https://github.com/w3ctag/privacy-principles/blob/main/meetings/2023-11-29-minutes.md#369-copy-edit-the-common-concepts-section-except-for-the-recognition-sub-section that my changes after the meeting would be good enough to land this, but I'll still wait for someone to approve to confirm that my changes were the ones we agreed on.

…-section.

Co-authored-by: Wendy Seltzer <[email protected]>

torgo

as agreed in today's TF call

…-section. (#369) SHA: 0be2995 Reason: push, by jyasskin Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

jyasskin commented Nov 9, 2023

View reviewed changes

jyasskin requested a review from darobin November 9, 2023 01:29

jyasskin commented Nov 22, 2023

View reviewed changes

rhiaro reviewed Nov 22, 2023

View reviewed changes

index.html Outdated Show resolved Hide resolved

torgo reviewed Nov 22, 2023

View reviewed changes

darobin reviewed Nov 29, 2023

View reviewed changes

darobin previously requested changes Nov 29, 2023

View reviewed changes

darobin reviewed Nov 29, 2023

View reviewed changes

jyasskin and others added 4 commits December 5, 2023 12:05

Copy-edit the Common Concepts section, except for the Recognition sub…

cd483e4

…-section.

Take Wendy's suggestion to replace "cognitive budget"

7d70cef

Co-authored-by: Wendy Seltzer <[email protected]>

Undo citation change for personal data.

46475a7

Service providers can work for other service providers.

950bcf8

jyasskin force-pushed the copy-edit-common-concepts branch from 12e4079 to 950bcf8 Compare December 5, 2023 20:05

torgo approved these changes Dec 6, 2023

View reviewed changes

jyasskin merged commit 0be2995 into w3ctag:main Dec 6, 2023
1 check passed

jyasskin deleted the copy-edit-common-concepts branch December 6, 2023 17:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Copy-edit the Common Concepts section, except for the Recognition sub-section. #369

Copy-edit the Common Concepts section, except for the Recognition sub-section. #369

jyasskin commented Nov 9, 2023 •

edited by pr-preview bot

Loading

jyasskin Nov 9, 2023

torgo Nov 22, 2023

jyasskin Nov 22, 2023

jyasskin Nov 9, 2023

torgo Nov 22, 2023

jyasskin Nov 22, 2023

jyasskin Nov 22, 2023

torgo Nov 22, 2023

darobin Nov 29, 2023

jyasskin Nov 29, 2023

darobin Nov 29, 2023

jyasskin Nov 29, 2023

darobin Nov 29, 2023

jyasskin Nov 29, 2023

darobin left a comment

darobin Nov 29, 2023

jyasskin Nov 29, 2023

darobin Nov 29, 2023

jyasskin Nov 29, 2023

torgo left a comment

		is a [=person=] whose ability to make their own choices can be taken away more
		easily than usual. Among other things, they should


		* is processing the data on behalf of that [=actor=];
		* [=processes=] data on behalf of a [=data controller=];

Copy-edit the Common Concepts section, except for the Recognition sub-section. #369

Copy-edit the Common Concepts section, except for the Recognition sub-section. #369

Conversation

jyasskin commented Nov 9, 2023 • edited by pr-preview bot Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

darobin left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

torgo left a comment

Choose a reason for hiding this comment

jyasskin commented Nov 9, 2023 •

edited by pr-preview bot

Loading