+1 to Alissa (perhaps not a surprise)... but for historical
interest, I have pasted below excerpts from three 2003 e-mails in
which Henning and I discussed this same topic.... John
At 11:01 AM -0500 11/11/03, Henning Schulzrinne wrote:
Date: Tue, 11 Nov 2003 11:01:13 -0500
From: Henning Schulzrinne <hgs at cs.columbia.edu>
To: "'geopriv at ietf.org'" <geopriv at ietf.org>
Subject: [Geopriv] Questions on pidf-lo
After another reading and some hallway discussions, a few
questions on PIDF-LO:
<snip>
3) Retention
Normal operating procedure is that databases are backed up. Am I
liable if a location object accidentally makes it onto the backup
tape? (Example: retention is 24 hours; LO arrives at 8 pm; backup
is run at midnight. I can't tell the backup routine to not backup
that entry.)
Worded in its current vagueness, I'm afraid that any large entity
who has any exposure at all would be foolish to accept any object
that in any way restricts retention and distribution.
Henning
At 12:34 PM -0600 11/11/03, John Morris wrote:
Date: Tue, 11 Nov 2003 12:34:32 -0600
To: Henning Schulzrinne <hgs at cs.columbia.edu>
From: John Morris <jmorris at cdt.org>
Subject: Re: [Geopriv] Questions on pidf-lo
Cc: "'geopriv at ietf.org'" <geopriv at ietf.org>
Henning, you won't be happy with how I would answer these
questions. See inline. John
<snip>
3) Retention
Normal operating procedure is that databases are backed up. Am I
liable if a location object accidentally makes it onto the backup
tape? (Example: retention is 24 hours; LO arrives at 8 pm; backup
is run at midnight. I can't tell the backup routine to not backup
that entry.)
Worded in its current vagueness, I'm afraid that any large entity
who has any exposure at all would be foolish to accept any object
that in any way restricts retention and distribution.
My answer is that big entities will have to cope. In the U.S. at
least, we have not yet resolved the train wreck that occurs
between privacy and routine backup tapes. If the info is in a
backup tape, it can be obtained through subpoena, law enforcement
request, etc.
And yes, I do think that companies are moving toward a more
considered backup strategy that takes privacy and other legal
obligations into account. It will be a slow transistion, but I
think it will happen.
So any entity concerned about this type of exposure should decide
that certain information should simply not be retained in
databases that are routinely backed up. I strongly do not think
we should allow geopriv to say "do not retain the info longer than
the rule permits (except routine backups don't count)."
Henning
John
At 2:56 PM -0500 11/11/03, Henning Schulzrinne wrote:
Date: Tue, 11 Nov 2003 14:56:58 -0500
From: Henning Schulzrinne <hgs at cs.columbia.edu>
To: John Morris <jmorris at cdt.org>
Cc: "'geopriv at ietf.org'" <geopriv at ietf.org>
Subject: Re: [Geopriv] Questions on pidf-lo
John Morris wrote:
Henning, you won't be happy with how I would answer these
questions. See inline. John
I'm actually happy with *any* consistent and implementable answer.
I'm mostly concerned that implementors are given insufficient
guidance in the spec.
<snip>
My answer is that big entities will have to cope. In the U.S. at
least, we have not yet resolved the train wreck that occurs
between privacy and routine backup tapes. If the info is in a
backup tape, it can be obtained through subpoena, law enforcement
request, etc.
And yes, I do think that companies are moving toward a more
considered backup strategy that takes privacy and other legal
obligations into account. It will be a slow transistion, but I
think it will happen.
So any entity concerned about this type of exposure should decide
that certain information should simply not be retained in
databases that are routinely backed up. I strongly do not think
we should allow geopriv to say "do not retain the info longer
than the rule permits (except routine backups don't count)."
As long as we say "this includes backup media", I'm fine - I'm
just for clarity. We can't remove every ambiguity, but that's no
excuse not to be precise where we can.
_______________________________________________
Geopriv mailing list
Geopriv at ietf.org
https://www.ietf.org/mailman/listinfo/geopriv
