Re: [alac] WHOIS TF: Brainstorming on privacy.

[Erick Iriarte Ahon <faia@xxxxxxxxxxxxxxxxx>]

At 10:04 a.m. 24/02/2003 +0100, Vittorio Bertola wrote:
> On Mon, 24 Feb 2003 08:18:44 +0100, you wrote:
>
> >The WHOIS Task Force is going to hold a brain-storming session on
> >WHOIS privacy tomorrow afternoon (European time), in preparation of
> >its privacy issues report.  If there are any specific issues you
> >want me to raise there, or any documents the Task Force should be
> >aware of, please let me know.
>
> 1) they should get an interpretation from a skilled European lawyer
> (and perhaps even an official statement from the EU) on requirements
> and applicability to WHOIS of the EU privacy law.

Excuse not ony an european lawyer, need some from roman-law and one from 
common-law application, because this is the difference.


> 2) in the meantime, they should get a quick understanding of it for
> themselves (perhaps we can make a summary?)
>
> 3) as a consequence of 1 and 2, they should understand the principle
> (which is obvious for us in Europe, but I guess not obvious in the US)
> that it is the customer, not the service supplier, who decides which
> personal data can be made public and with which allowed usages, except
> for those data which are strictly necessary to provide the service
> which is the scope of the contract/sale.

Vittorio not only en europe, latin america because the "roman-law" 
influence, have a legislation similar to europe, but with more 
"constitucional principles".

And if you see the LSSICE (new legislation in information society in spain, 
don't be like European "style"....


> 4) someone from the TF should liaise with the IETF because they are
> standardizing the EPP and "WHOIS-2" protocols and any policy won't be
> practically implementable if these protocols don't contain the
> necessary tools. I have been subscribing to these two IETF groups in
> the last weeks, and while the WHOIS-2 group is fine (they even
> accepted my rewriting of a few paragraphs of the RFC to add
> specifications about data protection) there's quite a controversy in
> the EPP group. Basically, the IESG told the EPP group "you need to
> have mechanisms to specify data protection requirements at a granular
> level or we won't approve your draft", and the group (mostly made by
> registry/registrar people) did not react very well, using points such
> as "privacy is something not well defined" and "registries could
> always implement privacy as a non-standard extension to the protocol"
> to refuse to do the job. The latter argument is particularly worrying,
> because it is technically true, but if the protocol does not have a
> standard way of saying "do not disclose this data field for this
> user", most registries won't bother to do the work to add it, or will
> do it in a non-standard non-interoperable way.

Agree

Erick


> --
> vb.                  [Vittorio Bertola - vb [at] bertola.eu.org]<---
> -------------------> http://bertola.eu.org/ <-----------------------