Privacy Considerations

1.) Does this specification have a "Privacy Considerations" section?

We plan to include (the same) "Privacy Considerations" section in both documents as the ODRL Vocabulary document formally defines the "Privacy" Policy Type. (See: https://www.w3.org/TR/odrl-vocab/#term-Privacy). And the ODRL Information Model contains an example of its use. (See Example 23: https://www.w3.org/TR/odrl-model/#duty)

The section could be worded as:

"ODRL Policies that support the Privacy policy type may contain links to potentially sensitive personal information such as the identity of parties and the identity of the existance of assets containing such data related to the parties. Implementations that produce or consume ODRL Privacy policy must take steps to communicate to all relevant users the manner in which the policy is being used, the identity of any other party with whom that policy is being shared, and the reason the policy is being shared with other parties."

2.) Does this specification collect personally derived data?

No.

3.) Does this specification generate personally derived data, and if so how will that data be handled?

No.

4.) Does this specification allow an origin direct access to a user’s location, and if so is that information minimized?

No.

5.) How should this specification work in the context of a user agent’s "incognito" mode?

Not Applicable

6.) Is it possible to spoof/fake the data being generated for privacy purposes?

ODRL Implementations that produce or consume ODRL policies must ensure they trust the parties that are exchanging data with them. This is outside the scope of the WG deliverables.

7.) Does the standard utilize data that is personally-derived, i.e. derived from the interaction of a single person, or their device or address?

No.

8.) Does the data record contain elements that would enable re-correlation when combined with other datasets through the property of intersection (commonly known as "fingerprinting")?

No.

9.) Is the user likely to know if information is being collected?

Not Applicable.

10.) Can the user easily, preferably through an element of the GUI, revoke consent granted to a particular feature?

Not Applicable.

11.) Once consent has been given, is there a mechanism whereby it can be automatically revoked after a reasonable, or user configurable, period?

Not Applicable.

12.) Does this standard utilize strong end to end encryption?

No.

13.)Does this standard use the Respec Linter to check for common privacy issues?

Yes.