The Other P in P3P

Global Policy and the P3P Vocabulary

Joseph Reagle, Policy Analyst
(reagle@w3.org)
World Wide Web Consortium
MIT Lab for Computer Science

P3P is an Exemplar of Global Commerce Issues

Bonn Declaration, Japan Framework, and Magaziner Framework all concerned with commerce, information exchange, and privacy:
- "Commerce on the GII will thrive only if the privacy rights of individuals are balanced with the benefits associated with the free flow of information." -- Magaziner Framework.
Many guidelines (OECD, CSA, ITI, etc.) on privacy, few implementations for the Web.

Vocabulary Harmonization

P3P allows structured privacy statements to be exchanged.
Grammar defines the structuring, vocabulary defines the values.
Specifies a globally uniform vocabulary of data categories, purposes, and qualifiers which are encodable within P3P.
The vocabulary should be simple, inform users and allow sites to accurately reflect their practices.

Vocabulary Description

Data Categories	Purposes	Other Disclosures
Physical Contact Info. Online Contact Info. Unique IDs Financial Account IDs Computer Information Navigational and Click-stream Data Transactional Data Demographic Data Preference Data Content	Completion and Support of Current Activity Web Site and System Administration Customization of Site to Individuals Research & Development Contacting Visitors for Marketing of Services or Products Other Uses	Identifiable Use (yes \| no) Assurance (yes \| no) Required/Optional (yes \| no) Recipients Only ourselves and our agents Organizations following our practices Organizations following different practices Unrelated third parties or public fora Access to Identifiable Info Identifiable Contact Information Other Information Related to an Identifiable Person

Data Categories

Physical Contact Info.
Online Contact Info.
Unique IDs
Financial Account IDs
Computer Information
Navigational and Click-stream Data
Transactional Data
Demographic Data
Preference Data
Content

Purposes

Completion and Support of Current Activity
Web Site and System Administration
Customization of Site to Individuals
Research & Development
Contacting Visitors for Marketing of Services or Products
Other Uses

Other Disclosures

Identifiable Use (yes | no)
Assurance (yes | no)
Required/Optional (yes | no)
Recipients
1. Only ourselves and our agents
2. Organizations following our practices
3. Organizations following different practices
4. Unrelated third parties or public fora
Access to Identifiable Info
1. Identifiable Contact Information
2. Other Information Related to an Identifiable Person

WG Activity

WG membership consisted of 10 active member companies
10 invited experts, 5 were active.
Completed in March.
Public working draft on site.
Promote industry endorsement.
Those concerned with privacy practices can use this vocabulary as a reference.