10:27:41 RRSAgent has joined #dnt 10:27:41 logging to http://www.w3.org/2013/03/11-dnt-irc 10:27:49 zakim, this will be track 10:27:50 I do not see a conference matching that name scheduled within the next hour, rigo 10:28:37 zakim, this will be 87225 10:28:37 I do not see a conference matching that name scheduled within the next hour, rigo 10:29:52 hm, looks like my telco reservation was only for 14:00 10:30:50 good morning rigo 10:54:18 dwainberg has joined #dnt 11:12:09 fwagner has joined #dnt 11:20:47 Joanne has joined #DNT 11:27:45 haakonfb has joined #dnt 11:31:32 I think the telco reservation was for 8am ET, which is 1300 11:31:41 zakim, this will be 87225 11:31:41 ok, tlr; I see T&S_Track(DNT)8:00AM scheduled to start in 29 minutes 11:46:29 bot restarting in 2 minutes to recover bridge state 11:53:38 vinay has joined #dnt 11:53:59 Justin has joined #dnt 11:55:20 justin_ has joined #dnt 11:56:14 justin_ has joined #dnt 11:56:41 brookman has joined #dnt 11:56:49 ninjamarnau has joined #dnt 11:57:11 Weiss_Yahoo has joined #dnt 11:57:14 ionel has joined #dnt 11:59:59 Zakim has joined #dnt 12:00:59 peterswire has joined #dnt 12:08:51 hello everybody. We will start by determining scribes and then do a first presentation 12:09:53 james has joined #dnt 12:13:31 Cordula_Zimmer has joined #dnt 12:13:51 jamesgray_dgconnect has joined #dnt 12:17:37 aleecia has joined #dnt 12:18:15 rvaneijk has joined #dnt 12:21:37 (still administrivia. Will set up bridge once we're done with that.) 12:22:15 tlr - let me know if we need screen sharing capabilities. If so, I can offer my Adobe Connect room. 12:22:55 aleecia has joined #dnt 12:23:07 moneill2 has joined #dnt 12:23:17 test 12:24:39 test has joined #dnt 12:26:40 test 12:26:52 zakim, this will be track 12:26:52 ok, tlr, I see T&S_Track(DNT)8:00AM already started 12:26:56 zakim, who is on the phone? 12:26:56 On the phone I see ??P0, +49.303.3.aabb 12:27:05 zakim, aabb is Berlin 12:27:05 +Berlin; got it 12:27:28 zakim, who is here? 12:27:28 On the phone I see ??P0, Berlin 12:27:28 zakim, ??P0 is probably schunter 12:27:29 On IRC I see test, moneill2, aleecia, rvaneijk, jamesgray_dgconnect, Cordula_Zimmer, peterswire, Zakim, ionel, Weiss_Yahoo, ninjamarnau, brookman, vinay, haakonfb, Joanne, fwagner, 12:27:29 ... RRSAgent, rigo, schunter, Walter, hober, wseltzer, tlr, mischat 12:27:29 +schunter?; got it 12:34:21 I am acting as scribe for this session -- statements by "peterswire" are as scribe and not the comments of the chair 12:34:31 scribenick: peterswire 12:35:51 http://www.w3.org/2011/tracking-protection/130311-gloco.html for agenda 12:36:02 agenda: http://www.w3.org/2011/tracking-protection/130311-gloco.html 12:36:30 http://www.w3.org/Talks/2013/03-RW-GloCo-Berlin.pdf is Rigo's presentation; scribing here only for supplemental questions/comments 12:37:34 Zakim, who is on the phone 12:37:34 I don't understand 'who is on the phone', schunter 12:38:38 who is on the call? 12:38:41 Zakim, who is on the call? 12:38:41 On the phone I see schunter?, Berlin 12:41:13 rvaneijk says that compliance spec can reference the work of global considerations group; rigo responds that he contemplates a document on global considerations rather than have the reference from the compliance spec 12:41:18 q+ 12:41:24 q+ 12:42:08 ack aleecia 12:42:08 ack aleecia 12:42:29 rigo emphasizes distinction between things really required in spec, vs. comments about the spec 12:42:40 ack ale 12:42:50 aleecia suggests cross-references guide at start of the compliance spec, as a way to answer rvaneijk concern 12:43:22 ack Weiss 12:43:30 ack weiss_yahoo 12:43:54 brookman_ has joined #dnt 12:44:27 brookman_ has joined #dnt 12:44:41 rico -- if want must/should, then that goes into TPE or compliance spec 12:44:48 s/rico/rigo/ 12:45:14 q+ 12:45:36 brookman_ has joined #dnt 12:45:45 +[IPcaller] 12:45:53 zakim, ipcaller is Walter 12:45:53 +Walter; got it 12:46:21 q- 12:46:46 Art 5.3 2002/58/EC was ammended by 2009/136/EC 12:46:50 q+ 12:47:00 ack rvaneijk 12:47:14 + +40.72.321.aacc 12:47:22 -Walter 12:47:28 zakim, aacc is Ionel 12:47:28 +Ionel; got it 12:48:04 q+ kimon 12:48:11 rvaneijk emphasizes recital 66 of the 2009 e-privacy directive amendments; mentions browsers and ability to express the consent of the user; the idea of DNT is to use that provision in recital 66 12:48:35 ack kimon 12:49:22 kimon -- agrees mostly with rob; but, says recital 66 applied to existing browser settings as well; wants technology neutrality in the law 12:49:22 vincent has joined #dnt 12:49:23 Thomas_Schauf has joined #DNT 12:49:53 Kimon -- include other applications, beyond the browsers, as ways to indicate consent; e.g., flash not handled in the browser interface and insist that is also included 12:50:05 q+ 12:50:14 +q 12:50:57 (I think Kimon just suggested that now LSOs are part of browser settings, we may already fulfill recital 66 even without DNT. I have not seen that suggested elsewhere. Kimon, is that what you were saying?) 12:51:03 ack jamesgray_dgconnect 12:51:48 aleecia, kimon is not on irc…. 12:51:57 12:52:04 thanks, Frank 12:52:12 James Gray - DG Connect: e-privacy revision 2009; change to require "informed consent"; agrees with Rob that recital 66 a way to authorize role for DNT 12:52:24 james_dgconnect: ack moneill2 12:52:24 q? 12:52:29 ack moneill2 12:52:38 ack moneill2 12:52:39 Mike O'Neill: in 2009 no way to communicate across domains, from 1st party to 3d parties, that consent had been given 12:52:44 ack moneill 12:54:42 q? 12:54:42 text on slide 8 of rigo's presentation is the 2009 text, with the informed consent language 12:56:03 has Recital 66 been transposed in all member states? 12:57:54 Compare and contrast proposed Amendment 108 with existing Article 27 procedure under the DP Act 13:02:50 Rob -- for slide 14, default settings are a fourth bullet; in EU, if want to transpose DNT to EU, then very relevant what the user default settings are 13:03:13 q+ 13:03:33 ack weiss 13:03:57 Justin: question of timing; issue when a user is presented with enough information to make a legally effective choice 13:04:11 s/justin/weiss_yahoo 13:05:31 Rigo: absence of D 13:05:32 +q 13:05:44 s/effective choice/active choice/ 13:06:51 ack moneill 13:07:23 dwainberg has joined #dnt 13:07:30 moneill2: regulation allows pseudonymous data as a category; that's still in process of course; another proposal that pseudonymous should not be re-identified later 13:08:34 + +49.172.147.aadd 13:09:20 Are we really going to revisit the debate about whether the standard applies to first parties? That was settled over a year ago. 13:09:50 q+ 13:09:55 ack vinay 13:10:05 responding to brook man -- my understanding is that EU law simply does not recognize a distinction between 1st and 3d parties 13:10:23 vinay: adobe, how we implement is that we see DNT:1 and will apply that the same globally 13:10:25 brookman_ - I think we need to revisit it as part of where 1st/3rd parties fit into the EU controller/processor system 13:11:53 vinay -- says cheaper to do window shade rather implement DNT different in EU and elsewhere 13:12:03 brookman has joined #dnt 13:12:20 Wolf Osthaus is speaking 13:12:20 This fundamentally changes the purpose of "Do Not Track" 13:13:12 +q 13:13:32 Wolf emphasizes the possibility of a contract or other agreement between a first party and data subject; that agreement may override what is in the DNT standard that applies to both first and third parties; don't know how to eal with that issue 13:14:04 rico -- we will discuss this topic later, when revisit first party issues 13:14:07 q+ 13:14:30 Rigo -- want to use the tool as button to get 90% of the problems out of the way; that will increase its usefulness 13:14:33 ack moneill 13:14:33 q? 13:15:01 moneill2: it's a signaling mechanism to the browser; or could use cookies to signal consent 13:15:18 ack weiss 13:16:21 justin (Weiss_Yahoo): dividing line in EU is maybe not as simple as characterized so far in the discussion; Art 29 has additional categories, where rules apply to some first and some third parties, but not others 13:16:28 q+ 13:17:04 justin: try to address both asymmetries: 1st/3d parties; also Art 29 WG asymmetries, where there are categories 13:18:04 + +1.613.947.aaee 13:18:22 Weiss_Yahoo also pointed out thet the permitted uses of the working group have asymmetries to the permitted uses under the ePrivacy Directive 13:18:44 tara has joined #dnt 13:19:16 brookman: 1st/3d party distinction has been at the center of DNT since 2007; why revisit that now 13:19:30 Rigo: DNT is a signaling mechanism; someone sends 1st party a DNT signal 13:19:39 brook man -- compliance spec says 1st parties are out of scope 13:19:41 +1 to Brookman 13:19:49 q+ 13:19:53 ack brookman 13:20:18 rigo: in EU, everyone subject to legal requirements; not the 1st/3d party distinction in EU 13:20:48 rigo: seeks a 1st party tool for EU, which helps with consent in EU; he wants to reduce the use of window shades 13:20:58 q- 13:21:06 Vinay: for 1st party analytics, will need window shade for that 13:22:03 vinay -- already have a consent mechanism in EU, and it would continue even if have DNT:0, for analytics on first party site 13:22:09 q? 13:22:20 rico -- disagrees; if DNT:0 is consent, why still need window shade? 13:22:28 How will Adobe get the DNT:0 signal? 13:22:34 s/rico/rigo/g 13:23:02 moneill2: DNT:0 or a cookie -- can say OK by user for tracking 13:23:04 q+ 13:23:20 pop-up or window shade (because, almost all users if prompted by the web browsers, in which we have no input in, will select 'tell websites not to track me') 13:25:01 brookman: something has to happen for Adobe to get the DNT signal and have it count as consent 13:25:31 q+ 13:25:31 rigo: if unset or DNT:1, have exception mechanism, and site can look to that in the exception API 13:25:43 q+ 13:27:01 ack weiss 13:27:02 Rigo: if define DNT:0, the messaging can be very small; define the average tracking of DNT:0 in the spec itself; only if go beyond that for additional permissions, then window shade or pop up window for those additional actions 13:27:20 +q 13:27:25 weiss_yahoo: don't focus too much on the tech specifics of the window shade 13:28:44 weiss-yahoo: one thing servers can do is get consent for everything at once; other extreme is granular and regional 13:29:28 rigo: in regulated context, law applies, DNT is a tool that allows things within the regulated framework 13:29:51 Yes, it allows you to globally reject certain processing by third parties! 13:30:07 rigo: DNT can standardize the most common stuff; DNT:0 permits most of what is done, and only get additional consent if do the smaller use cases 13:30:40 rigo: for sensitive data issues (Art. 8), then need something additional beyond DNT:0; would need to see how to do that 13:31:02 q? 13:31:29 ack moneill 13:32:05 moneill: two issues; need a consent mechanism, on 1st party sites, something will appear, that should be our focus; don't confuse that with the implied consent problem 13:34:21 ack vinay 13:35:11 vinay: another concern about changing DNT means is how consumer educated if rely on browsers to manage consent; "tell websites I don't want to be tracked" and haven't had clear messaging from the browsers about different meanings of "tracking" in different markets 13:36:25 vinay: if defaults with many DNT:1 from browsers, then pop-ups from lots and lots of sites 13:37:09 rigo: when have that, window shades seem attractive, but not over time; lots of people delete cookies 13:37:25 aleecia: roughly 50% delete cookies in 6 months, said Comscore 13:37:56 q? 13:38:32 brookman: on global default settings, ok to DNT:0 for analytics that doesn't authorize "everything server wants" 13:39:14 brookman: could do global setting at first run, say no window shades or whatever? 13:39:31 rigo: yes, a tool exists that is domain based at set-up, do that in a fine-grained way 13:39:47 No user is going to set up their browser to whitelist domains for DNT. 13:39:54 Like five users. 13:40:03 rigo: don't preclude innovation in permission management; user can start open and go closed; user can start closed and go open; that's an advantage of DNT at the moment 13:41:04 q+ 13:41:10 ack brookman 13:42:46 ack peterswire 13:43:16 brookman, that's why initially I proposed a content/context based exception mechanism. That something that can be built on top of the exception mechanism 13:43:28 Yianni has joined #DNT 13:43:44 does anyone have the link to comScore's cookie deletion study? 13:45:31 Sensitive data --- another issue we decided not to address as a group over a year ago. 13:46:12 kimon: in EU, advertising is allowed only for over the counter drugs, so no advertising for the prescription, serious medicines; so medical and advertising is a non-issue 13:47:21 For the record, I do not particularly like window shades. 13:47:39 shift to session on "Identification of Issues", scheduled for 14:10 start; Peter Swire continues as scribe -- comments here are in that role and not as statements of chair of the working group 13:48:58 rigo: suggest that we note the issues we just identified 13:50:28 q+ 13:51:13 ack ninja 13:51:58 ninjamarnau: rather than "audience measurement" discuss DNT:1 permitted uses; under e-Privacy Directive have permitted uses list; interested in aligning these two lists of permitted uses 13:52:09 We may be interested in ISSUE-98 PENDING REVIEW Should we consider applicable laws and regulations, such as the Article 5, paragraph 3 ePriv Dir 13:52:35 rvaneijk: if you want house this consent mechanism, then must work on exceptions 13:53:01 break until 10 after the hour 13:54:40 ComScore, The Impact of Cookie Deletion on Site-Server and Ad-Server Metrics in Australia, January 2011 http://www.stir.nl/upload/documenten/impact-of-cookie-deletion-australiajanuary-20111.pdf 13:56:23 Yianni has joined #dnt 13:56:41 Vinay there are other studies but most use self-reported data, which is not so useful for this question, since many users don't know what browser settings / anti-virus software / private browsing they have 13:58:17 -Ionel 14:05:54 rigo has joined #dnt 14:16:11 summary of the issues from the first sessions 14:16:12 Issues 1. Asymmetric Issue bridging gap between DNT which distinguishes first part and third party DNT:0 does not eliminate need for 1st party to provide notice obtain consent (e.g. window shades) and timing question 2. Handling of pseudonymous data (category under EU law) (Article 29 categories asymmetries) and asymmetries with permitted uses) 3. DNT default settings in the EU 4. Compare and contrast proposed Amendment 108 with existing Article 27 proced[CUT] 14:16:32 please clarify as needed 14:17:54 add'l issues 14:17:55 Wolf emphasizes the possibility of a contract or other agreement between a first party and data subject; that agreement may override what is in the DNT standard that applies to both first and third parties; don't know how to eal with that issue (revisit as part of first party discussion) 6. Sensitive data issues (Article 8) - need something beyond DNT:0 to handle (note: main WG decided not to address year ago) 7. discuss DNT:1 permitted uses; under e-Privacy[CUT] 14:18:34 Are you back? Phone seems muted still. 14:18:47 Directive have permitted uses list; interested in aligning these two lists of permitted uses instead of audience measurement 14:18:54 break hasn't ended yet 14:19:34 nic has joined #dnt 14:20:50 Horax has joined #dnt 14:21:04 some of the listed issues from the earlier session may fall under the scope of Issue 98: http://www.w3.org/2011/tracking-protection/track/issues/98 14:21:56 we'll back in a minute 14:26:01 aleecia, do you see this? 14:26:37 aleecia has joined #dnt 14:26:45 scribenick: aleecia 14:27:15 rigo: list of issues in IRC, incomplete 14:27:44 (note: http://www.w3.org/2011/tracking-protection/track/issues?sort=product has many already) 14:28:05 rigo: first party and restrictions, can we simplfy wording? 14:29:08 issue-14? 14:29:08 ISSUE-14 -- How does what we talk about with 1st/3rd party relate to European law about data controller vs data processor? -- pending review 14:29:08 http://www.w3.org/2011/tracking-protection/track/issues/14 14:29:10 +Ionel 14:29:21 http://www.w3.org/2011/tracking-protection/track/products/4 14:30:04 tlr: go with Rigo's issues, reconcile with prior work after 14:30:12 ... clean slate 14:30:42 ... leave tracker alone for now and reconcile later 14:30:42 rigo: agree. 14:31:18 vinay: better way to phrase, exception and 1st parties separated out 14:31:40 ... how does exception mech, implication of contracts, and other relationships affect it? Related but different issues 14:32:21 [note for those on the phone, Rigo is updating slides in real time to capture discussion] 14:33:02 rigo: make a standard, then diff to the user. Your information need to the user is condensed. We have to discuss if this works 14:34:14 ... next issue, becomes a subpart of issue 1 14:35:25 ... do we have an issue on pseudonymous data? New regulation has implications here 14:35:43 Vinay: only need if we discuss the laws 14:35:59 tlr: it's an issue, we're talking about it 14:36:16 kimon: what about anon issue, is that a different issue? 14:36:40 rob: if it's anon, we don't need to worry about it. Only worry about the process of de-identification. 14:36:45 q+ 14:37:06 q? 14:37:09 ack Thomas_Schauf 14:37:18 Thomas: we need to take into account DNT unset 14:37:40 ... need discussion on scope of DNT, defn of anonymous data, and personal information 14:38:00 ... not only as DNT default in EU, if you want a global standard at the end 14:38:33 rigo: in european context we have start up screen as suggested solution to meet consent requirement 14:38:37 q+ 14:38:51 Thomas_Schauf: is that EU only or global? 14:39:10 rigo: ok, doing that as subpoint 14:39:34 q+ 14:39:48 rigo: defaults are Peter's discussion 14:40:49 cross-talk suggesting regional, not just EU 14:40:57 - +49.172.147.aadd 14:41:14 q? 14:41:18 rigo: main defaults question is WG and not task force discussion 14:41:23 ack rva 14:41:56 kj has joined #dnt 14:42:05 rvaneijk: defaults in EU is one scenario that might play out there's no gap between tech standard and becoming compliant. Other use cases will have DNT standard but needs additional things to be legally compliant 14:42:17 ... in most cases there is a gap between DNT spec and legal 14:42:33 ... additional requirements to become legally requirement 14:43:01 ... relevant because if we do not accept starting position to becoming legally requirement via DNT, we should not pursue that use case 14:43:17 -schunter? 14:43:31 ... could be a remark, but "if you claim to be DNT compliant does not mean you are legally compliant" 14:43:43 q? 14:43:55 ack aleecia 14:44:18 kj_ has joined #dnt 14:44:18 q+ 14:46:06 aleecia: we have already figured out that DNT unset means have not consented, do we need it as an issue? 14:47:57 q? 14:47:57 ack peterswire 14:48:07 summary of discussion, no one had changes they proposed 14:48:27 peter: for anon and de-id, main group has done work already 14:48:54 rob: that's the pain point, we have not met the EU standards under Shane's definition 14:49:29 ... the point where we stopped was data retention time. Shane is at 18 months if de-identified. For me, need to look at purpose, 24 hours could be long enough. 14:49:36 If third parties can do behavioral tracking despite DNT:unset in the EU, it will not be because of this document. That will be an interpretation of existing (or future) EU law. 14:49:47 s/this document/any document this group issues 14:49:55 Rigo: put that under pseudonymous discussion 14:50:02 swire: and anon as well? 14:51:07 q? 14:51:26 discussion summary: 14:51:54 if something is pseudonymous enough, do we have to address it? Or does retention time / use still matter? 14:52:32 rigo: if not part of consent mechanism, it's out of scope or permitted use, which has a description of it 14:53:20 rigo: would add article 27 procedure under data protection 14:53:21 -Ionel 14:54:28 ninjamarnau has joined #dnt 14:54:58 rob: fundamental question, if the answer is no, we're doing something completely different with DNT. 14:55:27 ... do we still go for that solution or not? If we find it infeasible to use DNT for consent, we need to feed that back to the big group 14:56:18 rigo: sensitive data issue 14:56:26 ... article 8, medical data 14:56:46 ... in P3P we had issues with double click declaring medical data 14:56:58 ... Kimon says there's no pharma advertising so the issue goes away 14:57:09 ... is there an article 8 issue or can we skip it? 14:57:27 ... if we believe we have to deal with sens data, could have window shade like requirements 14:57:42 ... could need additional consent, and javascript API 14:57:48 ... should we keep or strike? 14:58:11 rob: keep it. More than just pharma ads, not even in art 8 14:58:43 ... fine grained geo-loc, for example 14:58:58 aleecia: already out by the compliance doc 14:59:22 +q 14:59:41 tlr: geo as browser API is orthogonal to this, but inferred other ways (e.g. IP address, or restaurants in small area in search) that could be interesting 14:59:59 ... if I've consented by geoloc API, that's already consented 15:00:13 rigo: if geoloc, isn't it an issue for Compliance and not GC? 15:00:28 tlr: we have text and closed issue 15:00:29 q? 15:00:34 ... not heard request to reopen 15:00:51 Are we really going to tmodulate this document to take into account every country's sector-specific law? 15:00:59 Do we need a section on US video record law? 15:01:07 q+ 15:01:09 peter: maybe Rob could review geoloc 15:01:17 nope, we have "don't break the law" 15:01:31 It was a rhetorical question! :) 15:01:49 frank: geoloc could be an issue, depends on purpose 15:02:01 I thought ISSUE-15 (closed) addressed this, but sadly it only mentions kids . . . 15:02:11 ... geoloc api does not mean consent for all time 15:02:44 rob: pharma ads don't need to deal with, so can we remove art 8 in the whole? Perhaps other categories, but maybe not geoloc. Are there others? 15:03:00 swire: sexual orientation is an example 15:03:26 apple & orange? 15:03:32 political affil? 15:03:48 q? 15:03:51 law > DNT 15:03:55 q- 15:04:19 q- 15:04:29 ack ninja 15:04:31 aleecia: can't kill this as an issue yet, maybe we can with more thought 15:04:39 ninja: (too quiet to hear) 15:05:04 swire: sensitive data not part of compliance 15:05:28 rigo: DNT:1 permitted uses under e-priv directive 15:05:49 sorry, wanted to support what peter said. profiling could lead to information about sexual orientation, religion, origin etc. 15:05:59 rob: can we spell out asymmetry here? 15:06:09 ... justin raised it but 15:06:28 Justin: what would be a permitted use in e-priv, and first v third party 15:06:49 ... US v. EU, permitted use and/or exception could differ 15:08:24 ?: we now refer to e-priv only, is that intended? 15:08:42 ... existing privacy directive, and e-priv is only cookies 15:08:51 ... need current and future too 15:09:18 ... exemptions is not just e-priv directive, more general 15:09:26 ... also national laws 15:09:42 ... example, German law with other exemptions 15:10:02 justin: asymmetry in laws 15:10:16 q? 15:10:19 q+ 15:10:47 s/justin/weiss_yahoo 15:10:54 q? 15:11:07 (thanks, sorry) 15:11:09 q? 15:11:10 ack rvaneijk 15:11:16 dwainber_ has joined #dnt 15:11:19 rob: can we bridge asymmetry? 15:11:25 ... or do we always have a gap? 15:12:10 weiss: what do we *need* it to do to get to compliance. Let's find the delta to the main document. Maybe there is a way to address them, but I want to make sure that all of the exceptions I get the benefit of as an EU company are preserved 15:12:34 ... to the point about reconciling in one signal and one server call is a concern 15:13:44 rigo: permitted uses that are allowed in EU are not missing from compliance list, but should check 15:13:52 weiss: first party analytics 15:13:56 q+ 15:14:24 rob: not the biggest point to worry about. "Audience measurement" more an issue 15:15:09 rob: could not exempt first party analytics but it is what we would have advised 15:15:17 rigo: need to discuss 15:15:44 ... if we put this in and get recognition from Art 29 WP, could work 15:15:52 weiss: is that realistic? 15:16:04 rob: highly legal env, can only go as far as the law says 15:16:07 q? 15:16:31 rigo: amendment 108 discussion but in the mean time, could have tolerance if this is accepted practice 15:16:32 "tolerance" . . . 15:16:43 tlr: would like to hear from Thomas 15:16:47 q? 15:17:02 q+ thomasSchauf 15:17:55 q+ 15:17:58 Horax has joined #dnt 15:18:19 ack aleecia 15:18:21 q? 15:18:30 This discussion somewhat belies that argument that Europe doesn't care about the difference between first and third parties 15:18:39 ack peter 15:18:45 swire: defn of first party not discussed, but has corporate group. Holding company with multiple brands. Does that work in EU? 15:19:02 rob: legal perspective, legal entity 15:19:16 swire: controller is narrower and different in EU 15:19:46 rob: sometimes wider because of data processor, which becomes part of first party 15:20:03 weiss: yes, under 95 directive 15:20:34 rigo: what about wholly owned subsidiary? 15:20:48 ... your company but diff legal entity. One party? 15:21:14 ninja: different controllers in Germany 15:21:15 ionel has joined #dnt 15:21:19 q- 15:21:46 ack thomas 15:21:50