Subject: RE: [Enum] NITS review of draft-ietf-enum-infrastructure-03

From: "Michael Hammer \(mhammer\)" <[email-masked]>
Date: Tue, 2 Jan 2007 13:44:47 -0500

Clive,

I see no user at all here:

 sip:<e164_phone_number>@provider.example.net

Thus, PII is not an issue.

Mike

> -----Original Message-----
> From: Clive D.W. Feather [mailto:[email-masked]] 
> Sent: Tuesday, January 02, 2007 6:14 AM
> To: Livingood, Jason
> Cc: [email-masked]; [email-masked]
> Subject: Re: [Enum] NITS review of draft-ietf-enum-infrastructure-03
> 
> Livingood, Jason said:
> > Attached is the new -04 draft, which was just submitted to 
> the editor.
> [...]
> 
> > 5. Security and Privacy Considerations
> >     
> >    Since Infrastructure ENUM is also implemented on the 
> public Internet, 
> >    the same security considerations apply as noted in RFC 3761. 
> >      
> >    In addition, since there is no opt-in for end-users, personally-
> >    identifiable information (PII) must not be disclosed for any end-
> >    user.  
> >     
> >    Thus, the information provided in the NAPTR records must 
> not disclose 
> >    any PII about the end-user such as a name in user-info. 
> This can be 
> >    achieved, for example, by entering the information in the format 
> >    sip:<e164_phone_number>@provider.example.net,  
> >    mailto:<e164_phone_number>@provider.example.net or sip:<opaque 
> >    string>@provider.example.net. 
> 
> The UK's Office of the Information Commissioner have stated 
> that the identity of the provider used by a user *is* PII in 
> this context.
> 
> -- 
> Clive D.W. Feather  | Work:  <[email-masked]>   | Tel:    
> +44 20 8495 6138
> Internet Expert     | Home:  <[email-masked]>  | Fax:    
> +44 870 051 9937
> Demon Internet      | WWW: http://www.davros.org | Mobile: 
> +44 7973 377646
> THUS plc            |                            |
> 
> _______________________________________________
> enum mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/enum
> 

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: "Clive D.W. Feather" <[email-masked]>
Date: Thu, 4 Jan 2007 16:43:25 +0000

> Thus, PII is not an issue.

Sorry, that's just not a valid interpretation of the Data Protection Act.
The telephone number is sufficient key to make it "personal".

-- 
Clive D.W. Feather  | Work:  <[email-masked]>   | Tel:    +44 20 8495 6138
Internet Expert     | Home:  <[email-masked]>  | Fax:    +44 870 051 9937
Demon Internet      | WWW: http://www.davros.org | Mobile: +44 7973 377646
THUS plc            |                            |

---

From: Tony Rutkowski <[email-masked]>
Date: Thu, 04 Jan 2007 12:19:14 -0500

Hi Clive,

Have you also considered the effects of the
EU Data Retention Directive?  It kicks into
force this year.  Art. 5, sec. 1.(a)(2)
clearly has significant ENUM implications.
The new U.S. CALEA IP telephony requirements
and their equivalents in other countries also
have ENUM implications.

--tony