Subject: Re: ENUM Privacy (was RE: [Enum] User ENUM vs Operator ENUM)

From: "Stastny Richard" <[email-masked]>
Date: Fri, 25 Jun 2004 18:44:40 -0400

The EU Data Protection Law is a typical example
of the law you cannot fulfil. So either everybody is breaking
it or busines is coming to a complete stop. That's why
such types of laws are complete nonsense and dangerous.
 
But this type of rules have tradition in Europe.
One other example is strikes of government workers
or government near enterprises by working to the rules.
 
The Austrian railway is doing a strike nearly every
year by "working to the rules" and then the system comes 
to a complete stop. q.e.d.
 
Richard

	-----UrsprÃngliche Nachricht----- 
	Von: Jim Reid [mailto:jim at rfc1035.com] 
	Gesendet: Fr 25.06.2004 22:37 
	An: james.f.baskin at verizon.com 
	Cc: enum at ietf.org 
	Betreff: Re: ENUM Privacy (was RE: [Enum] User ENUM vs Operator ENUM) 

	>>>>> "james" == james f baskin <james.f.baskin at verizon.com> writes:
	
	Hmm. It seems our American and Austrian readers need a primer on the
	principles of EU Data Protection. Here goes....
	
	    james> Assuming that a string of digits equal to a telephone
	    james> number assigned to an person "identifies a living person"
	    james> and is subject to EU Data Protection legislation, what
	    james> exactly does the legislation allow or disallow regarding
	    james> publishing that string of digits in a publicly accessible
	    james> database?
	
	It doesn't really say anything about that. It does however say a
	number of other things. The entity that stores and manipulates the
	data (the data controller) is supposed to register the fact that they
	are storing personal data and the purposes that it gets used for. ie
	"I'm a telco and I store the names and addresses of my customers so
	they can be sent bills." A data subject -- ie end user -- is entitled
	to ask the data controller for a record of any data that's stored
	about them and what it gets used for. If that data is incorrect, the
	data subject can get it fixed. They can also get compensation when
	personal data is improperly used. The data controller is not allowed
	to use the personal data for unregistered purposes. And they can't
	have that data processed or stored somewhere that doesn't follow EU
	data protection legislation.
	
	Things get easier with individuals who are storing personal data for
	private or hobby purposes. The Information Commissioner's office
	doesn't care that I have a couple of mailing lists on my server and my
	laptop has the names and addresses of friends and colleagues on it.
	They would care if I was providing a UK directory enquiries service
	and hadn't registered that usage with them.
	
	So provided the telco or ISP tells the Information Commissioner's
	office that they'll be publishing the data, that should be enough. But
	some safeguards will have to be in place. Which could mean opt-in will
	be mandatory because the personal data gets published on the internet
	where it could be processed by entities who don't comply with EU data
	protection legislation and are beyond EU jurisdiction. At this point,
	professional advice is needed.
	
	    james> Does the data protection legislation require opt-in by that
	    james> person?
	
	No. Though this is usually implicit whenever someone signs up for
	anything that creates an electronic record. Lots of things like forms
	for opening bank accounts and so on will have small print about the
	data subject's rights and safeguards under the Data Protection laws.
	
	    james> What happens if that string of digits also happens to
	    james> identify some other living person because it happens to
	    james> match that person's public library card number or some
	    james> other identifier?
	
	Nothing. It's not the string of digits that matter. It's the fact
	they're stored on a computer and the uses it then gets put to that
	matters. If I've got a beef with the local library's use of any
	personal data they have about me, I'll take that up with their data
	protection officer. That's another provision of the legislation.
	
	    james> Is British Telecom required to get everyone in its on-line
	    james> telephone directory to explicitly opt-in before listing
	    james> them?
	
	No. But BT is required to register that they maintain that data on a
	computer and to allow data subjects to access their personal data and
	get it corrected if necessary. Which you'd expect a phone company
	would want to do for a telephone directory anyway. This time I'll
	resist the temptation to take a cheap shot at BT.
	
	    james> If you are saying that before publishing any data element
	    james> that identifies a living person one should review the data
	    james> protection rules to be sure the publication complies with
	    james> the rules, that is a reasonable suggestion.
	
	I am. Even so, putting personal data into the DNS could be a data
	protection nightmare.
	
	    james> However, if you are suggesting that publication of
	    james> "sip:123456789 at serviceprovider.com" is prohibited by the
	    james> data protection legislation without prior approval
	    james> (opt-in), that is something else entirely. Are you making
	    james> the latter suggestion?
	
	No.
	
	Though it might be if I'm populating the DNS with personal data about
	zillions of people and haven't told the Information Commissioner that
	I'm doing that. Or whacking that data on to servers outside the EU. Or
	maybe allowing that data to be mined by third parties (spammers
	perhaps) so it can be used for purposes that haven't been registered
	or are outside EU jurisdiction.
	
	Visit www.informationcommissioner.gov.uk if you want more info about
	EU Data Protection and how it's applied in the UK. The same principles
	apply throughout the EU, though the details may be different in EU
	member states.
	
	_______________________________________________
	enum mailing list
	enum at ietf.org
	https://www1.ietf.org/mailman/listinfo/enum

_______________________________________________
enum mailing list
enum at ietf.org
https://www1.ietf.org/mailman/listinfo/enum

---

From: Peter Koch <[email-masked]>
Date: Sat, 26 Jun 2004 05:57:50 -0400

"Stastny Richard" <Richard.Stastny at oefeg.at> wrote:

> VGhlIEVVIERhdGEgUHJvdGVjdGlvbiBMYXcgaXMgYSB0eXBpY2FsIGV4YW1wbGUNCm9mIHRoZSBs
> YXcgeW91IGNhbm5vdCBmdWxmaWwuIFNvIGVpdGhlciBldmVyeWJvZHkgaXMgYnJlYWtpbmcNCml0

I'd rather say 

UGxlYXNlIGRvIG5vdCB1c2UgdGhlIGJhc2U2NCBlbmNvZGluZyBmb3IgdGV4dCBk
YXRhLgo=

-Peter