Request a statement review for W3C Privacy Principles

[plehegar]

(From @torgo)

The TAG requests to put the Privacy Principles document forward for W3C Statement. The TAG has recorded consensus on this here: https://github.com/w3ctag/meetings/blob/gh-pages/2024/telcons/05-20-minutes.md#recorded-consensus-in-privacy-principles-transition-request.

Document title, URLs, estimated publication date

Privacy Principles
https://www.w3.org/TR/2024/DNOTE-privacy-principles-20240511/
May 11

Abstract

See https://www.w3.org/TR/privacy-principles/#abstract

Status

See https://www.w3.org/TR/privacy-principles/#sotd

Link to group's decision to request transition

The TAG Privacy Task Force agreed to issue a transition request to specifically ask the team to to request publication as a W3C statement (this request): https://github.com/w3ctag/privacy-principles/blob/main/meetings/2024-05-08-minutes.md#next-steps The TAG subsequently recorded a consensus decision here https://github.com/w3ctag/meetings/blob/gh-pages/2024/telcons/05-20-minutes.md#recorded-consensus-in-privacy-principles-transition-request to move the document forward for transition to statement.

Wide Review

We presented it at TPAC 2023 and held a special feedback session on this document. Minutes are here: Privacy Principles breakout, TPAC 2023 – 13 September 2023 (w3.org) In particular we received feedback that the document would be more readable if we indicated which audiences were applicable to which principles. We subsequently added “tags” to the document to visually indicate which audiences were applicable to which principles. We also presented this document at the AC meeting in 2024 and had generally good feedback there.

A11Y request: Privacy Principles 2024-02-26 · Issue #74 · w3c/a11y-request (github.com) (positive feedback)

• We considered one of the points of feedback that was non-blocking, and added this to our backlog for a future version of the doc: Add a principle that sites should not be _able_ to retaliate when users say no w3ctag/privacy-principles#418

I18N request Privacy Principles 2024-03-13 > 2024-04-18 · Issue #227 · w3c/i18n-request (github.com) (positive feedback)

This work was constantly in review by PING. PING was a partner in establishing the task force, and PING members were continuously involved in the work.

Was sent to the Improving Web Advertising BG (https://lists.w3.org/Archives/Public/public-web-adv/2023Mar/0001.html) which has strong advertising representation. The document was also brought up in direct discussions with the IAB Tech Lab.

The IAPP, which is the foremost international association of privacy compliance people, wrote about it in detail. https://iapp.org/news/a/standardization-landscape-for-privacy-part-3-w3c-and-ieee/

We reached out to a wide cross-section of civil society and advocacy groups, as well as regulators (though the latter often cannot comment officially). The W3C communicated widely about the principles (https://www.w3.org/blog/2022/privacy-principles/ as well as on social media).

We presented the document in a keynote to the Consent Workshop (https://www.youtube.com/watch?v=xmtjUr0U7b4).

The document has an extensive bibliography that positions it in relation to the wider field.

Dependencies

The TAG Privacy Task Force had direct participation from PING.
See also https://www.w3.org/Privacy/IG/summaries/PING-minutes-20230912

Issues addressed

From Issues · w3ctag/privacy-principles (github.com) you will see that 177 issues were closed and processed. The remaining issues, the group explicitly decided to leave to a future revision (‘backburner’). No commenter has expressed dissatisfaction with the resolutions. We have highlighted significant contributions from commenters in the Acknowledgements section of the document: https://www.w3.org/TR/privacy-principles/#acknowledgements

Formal Objections

No formal objections were received by the task force during the development of this document.

[plehegar]

cc @plinss @ylafon

[plehegar]

As a reminder, there is a formal objection.
We still intend to let the AC review happen before the formal objection gets processed.

[plehegar]

Issues to check the status:

• Data portability threat model, mitigations](Data portability threat model, mitigations w3ctag/privacy-principles#424). Apparently, a citation needs to be added to the specification.
• Add a principle that sites should not be able to retaliate when users say no. @matatk , can you confirm that APA is fine with the document becoming a statement without such principle? (it could be added in a future version of the document, as always).

[plehegar]

@matatk confirmed that APA WG was fine with this moving forward.

We're waiting on w3ctag/privacy-principles#424

[plehegar]

Still waiting on w3ctag/privacy-principles#424

[ylafon]

w3ctag/privacy-principles#424 has been closed, new version of the document available at https://www.w3.org/TR/2024/DNOTE-privacy-principles-20240706/