Subject: Re: ENUM Privacy (was RE: [Enum] User ENUM vs Operator ENUM)

From: "Stastny Richard" <[email-masked]>
Date: Fri, 25 Jun 2004 15:28:13 -0400

Sorry, but I consider this a busllshit or Jim is trying
to pull your leg.
I know that people in the UK are paranoic about
privacy, e.g. 30% are unlisted in the phonebook,
in Austria this 5-10%. But UK is not really Europe.
 
Nevertheless, if this would be true, also a domain
name in ENUM would be not possible in the first place, 
because this would also trespass your privacy.
 
So if you put some information in this domain
which is not disclosing more information as
you already disclosed, this cannot violate
any law.
 
Richard

	-----UrsprÃngliche Nachricht----- 
	Von: Jim Reid [mailto:jim at rfc1035.com] 
	Gesendet: Fr 25.06.2004 20:16 
	An: Mike Hammer 
	Cc: enum at ietf.org 
	Betreff: Re: ENUM Privacy (was RE: [Enum] User ENUM vs Operator ENUM) 

	>>>>> "Mike" == Mike Hammer <mhammer at cisco.com> writes:
	
	    Mike> Jim, Could you explain where the personal information is in
	    Mike> the sip address you cite?
	
	I didn't cite any sip address.
	
	    Mike> It tells you absolutely nothing about who that number is
	    Mike> assigned to, or even if it is assigned to someone at all.
	
	That's true. But if the address does identify a living person, it will
	be subject to EU Data Protection legislation within EU jurisdiction.
	
	    Mike> If this runs afoul of EU legislation, then that legislation
	    Mike> has some serious problems.
	
	Welcome to the real world. :-)
	
	_______________________________________________
	enum mailing list
	enum at ietf.org
	https://www1.ietf.org/mailman/listinfo/enum

_______________________________________________
enum mailing list
enum at ietf.org
https://www1.ietf.org/mailman/listinfo/enum

---

From: Jim Reid <[email-masked]>
Date: Fri, 25 Jun 2004 15:48:35 -0400

>>>>> "Richard" == Stastny Richard <Richard.Stastny at oefeg.at> writes:

    Richard> Sorry, but I consider this a busllshit or Jim is trying
    Richard> to pull your leg.  I know that people in the UK are
    Richard> paranoic about privacy, e.g. 30% are unlisted in the
    Richard> phonebook, in Austria this 5-10%. But UK is not really
    Richard> Europe.

You may consider this bullshit, but you're wrong. You are confusing
privacy with data protection. These are completely different things.
The former is concerned with the disclosure of data. The latter deals
with what happens to that (non-private) data when it is disclosed.

My credit history is confidential. But under the Data Protection
legislation, I'm entitled to find out what data my bank is storing
about me and get that corrected if it's wrong. There are rules about
how the bank can process that information and what use it gets put to.
That's in addition to the non-disclosure protections.

    Richard> So if you put some information in this domain which is
    Richard> not disclosing more information as you already disclosed,
    Richard> this cannot violate any law.

AFAIK, nobody was talking about violating any law. I just pointed out
that ENUM will cause "personal data" to be published in the DNS. In
the context that EU Data Protection law defines that term: ie
something that identifies a living person. If that personal data gets
stored on computers in the EU, the use of that data is subject to the
provisions of EU Data Protection legislation. That, Richard, is not
bullshit. It's a fact.

---

From: "Conroy, Lawrence (SMTP)" <[email-masked]>
Date: Sat, 26 Jun 2004 07:19:54 -0400

Hi Richard, folks,
  actually, it's 40%.
It makes no difference, in my experience - you still get cold called.
Remember, the DPA was brought in originally as the UK was faced
with an EU directive and had to enact a law or all other EU states
would be forced to treat it like other duff countries that have no
acceptable data privacy controls.
Recall the fun with the US deciding in the end that the EU was serious
and allowing the safe haven privacy control self-certifications for
companies?
This strikes me as a p*ss*ng competition between Countries/Blocs,
and as it's still just "You, Me, and the NSA"**, rather pointless.
    ** [and friends - don't forget the mutual assistance laws]
As I understand it, the DPA does not cover personal web sites or data
that I ask to be published; it covers the use of that data by the people
storing it. In the case of a web hosting service, that's the whole point
(i.e. it's what I'm paying them to do).
Now, if you believe that the web hosting service has to find what 
personal
data I've just pushed to my web site, then notify the Government to say 
what
that data is and how they're using it, then we're in LaLa Land.

When the DPA first came in and the DP Registrar was totally overwhelmed 
with
paperwork flying in their direction; notification of personally 
published data
would be an absurdity that WILL be ignored as it would make that look 
like a
very quiet day in the office.

If one expects DNS Providers to do this is, then that random neural 
firing is,
in my opinion, equally bizarre.

In short:
If I want to publish my contacts, then "Get Your Tanks Off My Lawn".
If I want to control who gets to see what contacts, then I'll use
a PUA system, with a "global" entry in ENUM pointing to that.
The IETF and (eventually) IANA and the ITU/IAB have done their job.
I have a mechanism to do at least the global publication.
Now, on the PUA stuff you can bury it in Legal issues until hell 
freezes over.
For the rest, it's my risk, and my choice. I don't live in California.

all the best,
  Lawrence
On 25 Jun 2004, at 20:15, Stastny Richard wrote:
<snip>
<snip>