search

w3ctag / privacy-principles

https://w3ctag.github.io/privacy-principles/
Other
44 stars 13 forks source link

Duty of Honesty #401

Open chrisn opened 5 months ago

chrisn commented 5 months ago

In Section 1.4, Honesty is currently qualified with "as long as they can understand it" (i.e., the user). I suggest that honesty should apply regardless: how is the UA to know what the user understands? I would also suggest that "try to give its user information" is a bit too weak, maybe "should give"?

jyasskin commented 5 months ago

Note that "as long as they understand it" qualifies the given information, not the UA's honesty. I do think the "as long as they understand it" is an important part of the concept we're trying to get across here, but like many parts of this document, perhaps it could be worded better.

Specifically, the UA has access to lots of information that might improve the user's autonomy if the user understood it, but it's not a good idea to just dump that information on all users. Think about the details of the current TLS connection: the UA needs to pick and choose from all the available information in order to show the user things they're likely to understand and be able to act on.

darobin commented 4 months ago

@chrisn Do you feel that addresses your point?

chrisn commented 4 months ago

Sorry for the delay....

I think #403 is a good change, and I get the subtleties that @jyasskin describes. But to me, these fall more under "transparency" than "honesty". Transparency is well covered in 2.11, but the text here indicates that "honesty goes well beyond that of transparency" but without clearly explaining the distinction (aside from an example of not hiding behind complex legal notices). I don't have a good suggestion, as it's not clear to me what is the distinction you're looking to make.

My original comment was based on the observation that by saying "as long as they can understand", we're in effect leaving it to discretion for each UA to make its own design choice on the level of transparency/honesty to provide. But maybe that's the best we can do here.

darobin commented 4 months ago

No worries, we're all busy.

Basically, transparency is how the Vogons do it: "It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard." Honesty is taking credible steps to make sure that the person has the information they need and understands it.

If that's not getting across, we're doing it wrong. Maybe we should actually cite H2G2?

jyasskin commented 4 months ago

FWIW, while "transparency" gets used that way by folks who want to get lots of people's data, the point of that bit of the Hitchhiker's Guide is that it's not really transparency. We could try to defend and reclaim the word, instead of fleeing to another word ("honesty") that'll get mis-defined and corrupted in the same way.

darobin commented 2 months ago

We will process this when we split out a UA document, post-Statement.