diff --git a/index.html b/index.html index 5c5591ad..2018442e 100644 --- a/index.html +++ b/index.html @@ -761,15 +761,15 @@ "id": "web-without-3p-cookies" } }, - "publishISODate": "2023-10-25T00:00:00.000Z", - "generatedSubtitle": "W3C Editor's Draft 25 October 2023" + "publishISODate": "2023-11-01T00:00:00.000Z", + "generatedSubtitle": "W3C Editor's Draft 01 November 2023" }

Privacy Principles

-

W3C Editor's Draft

+

W3C Editor's Draft

More details about this document
@@ -876,7 +876,7 @@

Privacy Principles

This document is governed by the 12 June 2023 W3C Process Document. -

+

How This Document Fits In

@@ -1255,8 +1255,8 @@

Privacy Principles

-

This is a special case of the more general principle that data should not be used for more -purposes than the data's subjects understood it was being collected for.

+

This is a special case of the more general principle that data should not be used for more +purposes than those specified when the data was collected.

Services sometimes use people's data in order to protect those or other people. A service that does this should explain what data it's using for this purpose. It should also say how it might use or share a person's @@ -1743,7 +1743,7 @@

Privacy Principles

different data sets involving this data; and

  • there exist contractual terms between the first party and third party -describing the limited purpose for which the data is being shared.

    +describing the limited purpose for which the data is being shared.

    • Note that controlled de-identified data, on its own, is not sufficient to make @@ -1996,8 +1996,28 @@

    Privacy Principles

    guardian for access to the help they need.

    -

    2.11 Transparency

    Principle: - When accessing data or requesting permission, sites (and other actors) should provide +

    2.11 Purpose limitation

    +
    Principle: + When accessing personal data or requesting permission, sites and other actors should specify the purpose + for which the data will be used. + + +
    + +
    Principle: + Actors should not use personal data for purposes other than those specified. (Other uses are often called + secondary uses.) + + +
    + +

    Features that are designed-for-purpose facilitate these principles by providing functionality that is only or primarily +useful for a particular purpose. Designed-for-purpose features make it easier to explain the purpose to people, and may +also limit the feasible secondary uses of data.

    +

    Controlled de-identified data may be used for additional purposes in ways that are compatible with the specified +purpose.

    +

    2.12 Transparency

    Principle: + When accessing data or requesting permission, sites (and other actors) should provide people with relevant explanatory information about the use of data, and user agents should help present and consume that information. @@ -2039,7 +2059,7 @@

    Privacy Principles

    processing to identify cases in which it may be harmful.

    Easily accessible, plain language presentation of privacy-relevant practices is necessary for people to be able to make informed decisions in specific cases when they choose to do so. -Sites, user agents, and other actors all may need to present privacy-relevant practices +Sites, user agents, and other actors all may need to present privacy-relevant practices to people in accessible forms.

    Principle: Mechanisms that can be used for recognizing people should be designed so that @@ -2052,8 +2072,8 @@

    Privacy Principles

    user, which undermines user control [UNSANCTIONED-TRACKING]. Designing features that minimize data and make requests for data explicit can enable detectability, a kind of transparency that is an important mitigation for browser fingerprinting.

    -

    2.13 Notifications and Interruptions

    Issue 2

    2.14 Notifications and Interruptions

    Issue 2
    @@ -2149,16 +2169,16 @@

    Privacy Principles

    Permissions should be requested in context.

    -

    2.14 Non-Retaliation

    Principle: - Actors must not retaliate against people who protect their data against +

    2.15 Non-Retaliation

    Principle: + Actors must not retaliate against people who protect their data against non-essential processing or exercise rights over their data.
    -

    Whenever people have the ability to cause an actor to process less of their data or to stop +

    Whenever people have the ability to cause an actor to process less of their data or to stop carrying out some given set of data processing that is not essential to the service, they must be -allowed to do so without the actor retaliating, for instance by artificially removing an +allowed to do so without the actor retaliating, for instance by artificially removing an unrelated feature, by decreasing the quality of the service, or by trying to cajole, badger, or trick the person into opting back into the processing.

    Issue 3
    -

    2.15 Support Choosing Which Information to Present

    Principle: - User agents should support people in choosing which information they provide to actors that +

    2.16 Support Choosing Which Information to Present

    Principle: + User agents should support people in choosing which information they provide to actors that request it, up to and including allowing users to provide arbitrary information.
    -

    Actors can invest time and energy into automating ways of gathering data from people and can +

    Actors can invest time and energy into automating ways of gathering data from people and can design their products in ways that make it a lot easier for people to disclose information than not, whereas people typically have to manually wade through options, repeated prompts, and deceptive patterns. In many cases, the absence of data — when a person refuses to provide some information — can also be identifying @@ -2233,24 +2253,24 @@

    Privacy Principles

    are people in some situations of intellectual or psychological impairment, are refugees, etc.

    A.2 Contexts

    A context is a physical or digital environment in which people interact with other -actors, and which the people understand as distinct from other contexts.

    +actors, and which the people understand as distinct from other contexts.

    A context is not defined in terms of who owns or controls it. Sharing data between different contexts of a single company is -a privacy violation, just as if the same data were shared between unrelated actors.

    +a privacy violation, just as if the same data were shared between unrelated actors.

    A.3 Server-Side Actors

    An actor is an entity that a person can reasonably understand as a single "thing" -they're interacting with. Actors can be people or collective entities like companies, +they're interacting with. Actors can be people or collective entities like companies, associations, or governmental bodies. Uses of this document in a particular domain are expected to -describe how the core concepts of that domain combine into a user-comprehensible actor, and +describe how the core concepts of that domain combine into a user-comprehensible actor, and those refined definitions are likely to differ between domains.

    User agents tend to explain to people which origin or site provided the -web page they're looking at. The actor that controls this origin or site is +web page they're looking at. The actor that controls this origin or site is known as the web page's first party. When a person interacts with a UI element on a web page, the first party of that interaction -is usually the web page's first party. However, if a different actor controls +is usually the web page's first party. However, if a different actor controls how data collected with the UI element is used, and a reasonable person with a realistic cognitive budget would realize -that this other actor has this control, this other -actor is the first party for the interaction instead.

    +that this other actor has this control, this other +actor is the first party for the interaction instead.

    Issue 4

    A.5 Recognition

    Recognition is the act of realising that a given identity corresponds to the same person as another identity which may have been @@ -2463,7 +2483,7 @@

    Privacy Principles

    The inference, evaluation, or prediction of an individual's attributes, interests, or behaviours.
    -
    Secondary Use +
    Secondary Use
    Secondary use is the use of collected information about an individual without the individual’s consent for a purpose different from that for which the @@ -2486,7 +2506,7 @@

    Privacy Principles

    for other purposes, like to grow the service.
  • Principle: A user agent should help its user present the identity they want in each context they are in, and should prevent or support recognition as appropriate. -
  • Principle: Sites, user agents, and other actors +
  • Principle: Sites, user agents, and other actors should minimize the amount of personal data they transfer.
  • Principle: Web APIs should be designed to minimize the amount of data that sites need to request to carry out their users' goals and provide granularity and user controls over personal data that is communicated to sites.
  • Principle: In maintaining duties of protection, discretion and loyalty, user agents should share data only when it either is needed @@ -2500,7 +2520,7 @@

    Privacy Principles

    change over time.
  • Principle: People have certain rights over data that is about themselves, and these rights should - be facilitated by their user agent and the actors that are processing their + be facilitated by their user agent and the actors that are processing their data.
  • Principle: Whenever possible, processors should work with data that has been de-identified. @@ -2526,8 +2546,14 @@

    Privacy Principles

    Specifications, implementations, and sites should allow for graceful degradation of features which may be incompatible with stronger privacy protections. +
  • Principle: + When accessing personal data or requesting permission, sites and other actors should specify the purpose + for which the data will be used. +
  • Principle: + Actors should not use personal data for purposes other than those specified. (Other uses are often called + secondary uses.)
  • Principle: - When accessing data or requesting permission, sites (and other actors) should provide + When accessing data or requesting permission, sites (and other actors) should provide people with relevant explanatory information about the use of data, and user agents should help present and consume that information.
  • Principle: @@ -2537,26 +2563,26 @@

    Privacy Principles

    Mechanisms that can be used for recognizing people should be designed so that their operation is visible and distinguishable, to user agents, researchers and regulators.
  • Principle: - When any actor obtains consent for processing from a person, the + When any actor obtains consent for processing from a person, the actor should design the consent request so as to learn the person's true intent to consent or not, and not to maximize the processing consented to.
  • Principle: - An actor should avoid interrupting a person's use of a site for + An actor should avoid interrupting a person's use of a site for consent requests when an alternative is available.
  • Principle: It should be as easy for a person to check what consent they have given, to withdraw consent, or to opt out or object, as to give consent.
  • Principle: - Actors should provide functionality to access, correct, and remove data about + Actors should provide functionality to access, correct, and remove data about people to those people when that data has been provided by someone else.
  • Principle: A user agent should help users control notifications and other interruptive UI that can be used to manipulate behavior.
  • Principle: Web sites should use notifications only for information that their users have specifically requested.
  • Principle: - Actors must not retaliate against people who protect their data against + Actors must not retaliate against people who protect their data against non-essential processing or exercise rights over their data.
  • Principle: - User agents should support people in choosing which information they provide to actors that + User agents should support people in choosing which information they provide to actors that request it, up to and including allowing users to provide arbitrary information.
  • Principle: APIs should be designed such that data returned through an API does not assert a fact or make a @@ -2760,7 +2786,7 @@

    Privacy Principles

  • § 2.7 Collective Privacy (2) (3)
  • - § 2.13 Notifications and Interruptions (2) + § 2.14 Notifications and Interruptions (2)