[gnso-rds-pdp-wg] data fields and purpose (was Re: Notes and action items from today's meeting)

[Andrew Sullivan]

Dear colleagues,

On Tue, Mar 01, 2016 at 05:58:40PM +0000, Marika Konings wrote:

> 4. Review and discuss draft work plan
> 
>   *   Should question first be asked what data is collected and for what purposes? WG needs to further think about this question. EWG struggled with similar question in its deliberations. Difficult to answer what data is collected without purpose / use cases.

My apologies for not making the last meeting and for missing the
meeing this week (I had conflicts both times -- yet another reason why
more work on the mailing list is an advantage).  I wanted to make some
remarks about the above.

It isn't clear to me what sort of "data collection" is being mentioned
above.  One possibility is, "What data is collected due to
registration?"  If that is the question, then I think it is well past
the remit of this group.  We're talking about registration data access
via a registration data service, and I don't believe our charter
extends to revising registration rules (which would affect what data
is collected).  I think therefore we should take as given the data
that is being collected and the terms under which they are being
collected, and instead worry only about what of that data should be
queryable and by what class of querier.

If instead is meant, "What data is being collected by the RDS?" then
there are only a couple possible answers.  One is the IP address of
the query origin; it is impossible not to acquire this data (however
transiently) as part of answering a whois query.  Once RDAP is
deployed, it will be possible also to acquire (some portion of) the
login credentials for the party making the query.  In addition, it
seems to me, operators of RDAP services could collect other data
associated with a given login, in order to provide greater or lesser
access to things.  For instance, an operator might provide some
EULA-accredited large-scale access to the whois data to researchers,
but only to some fields.  I can imagine these kinds of data collection
activities could be part of our effort here, but there's not that much
to it & I think we wouldn't be able to answer these questions before
we've worked out what classes of querying party we imagine and what
they ought to be able to do.

Best regards,

A

-- 
Andrew Sullivan
ajs at anvilwalrusden.com