Subject: [rtcweb] IP gathering permission

From: "Drage, Keith (Nokia - GB)" <[email-masked]>
Date: Tue, 5 Apr 2016 20:19:07 +0000

The discussion in the WG (Tuesday p.m. session) that I have just listened to causes me concern.

Any system that gathers personal information needs to meet the local regulatory framework. For example, throughout most of Europe that is the privacy directive and its local implementation in various European countries. While I don't expect people to analyse the protocol in terms of each local regulatory framework, I believe we do need to provide the tools to allow these to be met. 

Ultimately, it is not just a matter of whether the user can comprehend what he has been asked, but whether the regulator is also happy that the needs of the local regulation have been met. Many times that will come down to the view of the local regulator as to whether the situation has been made sufficiently clear to the end user.

Certainly we need to avoid any assumption that might be provided by the draft that because information A has been released, that information B is also OK from a privacy consideration.

Maybe we need a statement that says any selection needs to meet the privacy framework imposed on the system, by regulation, by contract, etc.

Regards

Keith