Re: Difference between bulk access and individual access (Was: Policy for an Internet registry [EUreg #2656]

Dear Stephane, 

I know this concept as it also applies to the phone directories in
Europe. Access to a specified individual data-set is something different
than getting the whole database. 

The question here is treated by the <Recipient> - Element in P3P[1]. As
we had already many different types of recipients, we haven't thought of
the distinction between public-access and bulk-public-access. While
there might be some difference in the ease of access, it is not too
difficult to read out even restricted public accessible databases with
some perl-script. So we might see a shift on the apreciation of that
distinction between public-access to individual files and public access
(selling) of the bulk-database. 

So within the current vocabulary, you might want to describe the
recipient as <public> full stop. The further distinction could only be
done with an extension to the <Recipient> - Element[2]. Using the
extension mechanism, you'll risk, that a user-agent will be unable to
interpret the semantics correctly. 

Another alternative is to use the longdesc - attribute on <public> to
describe the two different notions of public you mean. 

But this might be an excellent input for the upcoming P3P Workshop in
Dulles. Please see the CfP[3] as it is not only important for registries
of internet-domain-names, but also for phone-companies giving access to
the directory of their customers.

  1. http://www.w3.org/TR/P3P/#RECPNT
  2. http://www.w3.org/TR/P3P/#extension
  3. http://www.w3.org/2002/p3p-ws/cfp-p3p1_1

Best, 
-- 
Rigo Wenning            W3C/INRIA
Policy Analyst          Privacy Activity Lead
mail:[email protected]        2004, Routes des Lucioles
http://www.w3.org/      F-06902 Sophia Antipolis


On Fri, Aug 16, 2002 at 10:05:49AM +0200, Stephane Bortzmeyer wrote:
> According to our lawyer, there is an important legal difference
> between allowing public access to individual data (in the whois
> context, allowing the public to query the contacts of a domain name,
> giving the exact domain name) and bulk access (having the whole
> database at your disposition or a substantial part of it, may be
> through fuzzy search criteria such as the ability the find all domains
> matching a given string).
> 
> In the French registry, at the present time, we therefore have a
> public whois (anyone can retrieve personal information from anywhere)
> but no bulk access at all (the database is not transferred and we
> patched the RIPE-NCC whois server to disallow some privacy-invading
> search features).
> 
> Is there a way to express that in P3P? I plan to have several
> STATEMENT, with different RECIPIENT and expressing in the CONSEQUENCES
> element that one STATEMENT is for bulk access and the other for
> individual access only.