Hullo everyone. I think we are waiting for our host on WebEx?

<gnorcie> hi all, has meeting not started? or maybe I'm fat fingering the meeting #...

<gnorcie> haha crossed streams w/ tara

<gnorcie> thanks for the sanity check!

<LJWatson> I'm in WebEx, but no meeting host yet?

I think it should be live now.

<LJWatson> Oh wait, I'm dialled in now.

<christine> Hi all. We will be starting shortly. Looking for a scribe.

Scribes get valuable prizes, like our undying gratitude.

Introductions

<christine> Tara are you scribing?

<gnorcie> dialing in now

Erik Stephan, US DoE - Pacific Northwest National Lab

(Am filling in on scribe barring any more volunteers)

Leonie (sp?) -- feel free to type your name into IRC

<gnorcie> in!

Tharindi Hapuarachchi, Thomson Reuters

Luke Herbert - Deloitte, mainly in security

Welcome!

HTML 5.1

<christine> https://www.w3.org/TR/html51/

HTML 5.1 has been lot of cleanup/tidy-up rather than new features

Checking for real-world interoperability, ensure robustness

Nothing in 5.1 has made any changes to spec in terms of privacy

<chaals> There are some new features, but we haven't identified anything that affects privacy

Only area that could be worrying is one that is dating from forms in earlier HTML spec -- possibility of spoofing information in forms.

<chaals> (Heads Up. There will be a discussion about the ping attribute for HTML 5.2, but please let's not go there today)

Greg - appreciated that the group used the privacy questionnaire. Will help improve the questionnaire, too!

Many thanks!

christine - for newcomers: there's a questionnaire to assist in the reviews. We'd like to have more eyes on this document; please help us work on this.

Summary will go out on the mailing list; if people have issues, then there can be ongoing discussion of any privacy considerations.

Leonie - please send also to public-html list as well to keep them updated/roped in

Data on the Web Best Practices

<gnorcie> A link to the questions, for those interested in having a look: http://gregnorc.github.io/ping-privacy-questions/

<ericstephan> group https://www.w3.org/2013/dwbp/wiki/Main_Page

Been a very active WG over the past few months

<ericstephan> https://www.w3.org/TR/dwbp/#bestPractices

Data on the Web Best Practices document - close to being on recommendation track

Goal: guidance for publishing open data on the web: discoverable, accessible, protected as necessary

<ericstephan> https://docs.google.com/spreadsheets/d/1Cr6b313LzFa4Y8ImlMJila8zRsN54_ekAZTycK7tchQ/edit?usp=sharing

For privacy - we've been going through the privacy questionnaire. (Thanks, Greg!)

Looking at the Best Practices in terms of the questionnaire - see the spreadsheet.

Coming from open data community -- mostly trying to make information *known*.

But want to do this responsibly, so want to consider privacy aspects.

Have not yet shared these thoughts with the group, so it's initial version.

When considering best practices, every publisher might have different policies they need to apply.

Might not be possible to apply universal policy.

Some privacy questions are going to be in the hands of the data publisher.

Some rely on other standards -- like using provenance.

Want to be able to share how data originated and was shared.

So can look to provenance WG as to how they would answer various questions.

WG meeting tomorrow.

Hoping to complete questionnaire by next week.

<npdoty> it seems like Data on the Web Best Practices is directed towards web sites, users of the web, as opposed to many of the specifications we review

Christine - thanks, and you've done a lot of work here. Glad the questionnaire was helpful.

<npdoty> so it might take some adapting for the questionnaire to work directly

Eric: some of the questions I felt were unique -- giving courtesy to the person who you might be sharing information about; providing timelines about how long data would reside.
... this is useful guideline for those who have information about contributors

Christine: is that following Freedom of Info laws? Also - privacy info is mixed, and notifying Person A might affect privacy of Person B

<npdoty> there might be useful information to draw from open data guidelines, some of which have included privacy as a key topic

Christine: need to be aware of disclosure issues and privacy risk

Eric: from open science perspective...we did some research for which there is a use case - resource discovery for scientists
... vast amount of data on deep web; we found that most scientists have collaborator(s) sharing, might not be in the main web space when sharing

Not as much privacy concern but that's likely because this is about open science context

<gnorcie> +q

Christine: even if not on search engines, it's being transmitted over the network, so there is still disclosure risk

gnorcie: recent OK Cupid data "scraping" incident for research - researchers took this data claiming it was public
... Users did not feel it was public, researchers thought it was. So: what is public?

<tharindi> +q

gnorcie: we may wish to lay down what we mean by public and private

Eric: I agree; needs to be an enhanced discussion. Also fingerprinting: discussed in provenance community about privacy information but not from a formal perspective.
... there are commercial vendors that pass data in the clear (worrisome)

Tharindi: at Thomson Reuters, we look at public records, like gun registries. Is sensitive information, with privacy concerns, but is public record
... Would be interested to hear what's sensitive

Christine: it's personal but public interest in knowing this outweighs private interest of individual. Depends on context.

Eric: we added a best practice for data that wasn't available. Use case: some cities wanted to provide data openly, like utility or land usage.

<gnorcie> going to add myself to back of line

<chaals> [It is one thing to look at data. But to collect and correlate it in ways that enable de-anonymisation seems to bring risk… and so exposing data that allows that carries the risk too]

Eric: other cities did not want to do this; so we had to explain that some data was not available, to clarify that the data you may be analysing is only based on the *available* data (incomplete)
... not uniform in who provides data publicly.

Christine: how do we help you complete the exercise? You are still working through the best practices, while looking at privacy questionnaire.

<gnorcie> (sorry all, still getting hang of the queue system, thanks for bearing with my n00bness)

<gnorcie> thank you!

Eric: I provided the link so PING can see what is advancing. If you have questions, want clarification, email. Will be watching the mailing lists. Will try to batch questions, please do raise any questions you have.

On short timeline for comments; if something is missing (like end to end encryption) please let us know

Q: has anyone on the provenance WG filled out the questionnaire?

Christine: I believe the WG wrapped up work before PING started
... but there was some recognition that there were some privacy considerations

Eric: There is a meeting - "Prov Three Years Later" -- will raise topics at that meeting.

Christine: we can discuss what you might want to raise at that meeting.

Privacy Questionnaire

<gnorcie> is anyone else hearing distortion?

Greg has been working a lot on this document.

<gnorcie> it's gone now

Christine: expects to have a bit more time in the very near future to give comments, bring to other groups (IAB)

<ericstephan> Yes very valuable gnorcie!

Christine: Wants us to push this forward and get it done.

Eric: Really like the questions; if a user is going to take multiple specifications, and we have the questionnaire filled out, would be great to see a composite of what my vulnerabilities might be.
... It's useful to see how problems might compound.

Christine: many privacy issues arise at implementation stage; not much we can do other than give guidance as to what is good or bad.

Greg: idea of this "being done" -- I see it as "living document", might never be done, but would be tweaked.
... questionnaire needs to be good as qualitative instrument - would like it to be more qualitative, so it's not just "yes/no" answers, but more thoughtful responses.
... short answers/explanations, "showing your work" - you might say what type of crypto, not just that you used crypto.

<ericstephan> +1 agreed gnorcie

Christine: yes, I think needs to be a living document. We should get to a stable version for a group note, recognizing that it will evolve into other versions.
... as group note, has more recognition within the W3C and with WGs.

Greg: sounds like good idea although would appreciate more information on what a "group note" is.

<ericstephan> its a technical report that has been publicly reviewed at least in the WGs

Thanks!

This is scribe.perl Revision: 1.144  of Date: 2015/11/17 08:39:34  
Check for newer version at http://dev.w3.org/cvsweb/~checkout~/2002/scribe/

Guessing input format: RRSAgent_Text_Format (score 1.00)

Succeeded: s/Item:/Topic:/G
No ScribeNick specified.  Guessing ScribeNick: tara
Inferring Scribes: tara
Present: ericstephan keiji gnorcie tara tharindi christine LJWatson
Regrets: wseltzer

WARNING: No meeting title found!
You should specify the meeting title like this:
<dbooth> Meeting: Weekly Baking Club Meeting


WARNING: No meeting chair found!
You should specify the meeting chair like this:
<dbooth> Chair: dbooth

Got date from IRC log name: 26 May 2016
Guessing minutes URL: http://www.w3.org/2016/05/26-privacy-minutes.html
People with action items: 

WARNING: Input appears to use implicit continuation lines.
You may need the "-implicitContinuations" option.