This document is governed by the 12 June 2023 W3C Process Document. -
+See 2.11.1 Guardians for more detail on how this principle applies to vulnerable people with guardians.
+See 2.10.1 Guardians for more detail on how this principle applies to vulnerable people with guardians.
Computing devices have owners, who have @@ -1832,92 +1832,80 @@
Online harassment is the "pervasive or severe targeting of an individual or group online -through harmful behavior" [PEN-Harassment]. Harassment is a prevalent problem on the Web, -particularly via social media. While harassment may affect any person using the Web, it may be more -severe and its consequences more impactful for LGBTQ people, women, people in racial or ethnic -minorities, people with disabilities, vulnerable people and other marginalized groups.
-Harassment is both a violation of privacy itself and can be magnified or facilitated by other -violations of privacy.
-Abusive online behavior may include: sending unwanted information; directing others to contact -or bother a person ("dogpiling"); disclosing sensitive information about a person; posting false -information about a person; impersonating a person; insults; threats; and hateful or demeaning -speech.
-Disclosure of identifying or contact information (including "doxxing") can be used, including by -additional attackers, to send often persistent unwanted information that amounts to harassment. -Disclosure of location information can be used, including by additional attackers, to intrude on a -person's physical safety or space.
-Mitigations for harassment include but extend beyond mitigations for unwanted information and other -privacy principles. Harassment can include harmful activity with a wider distribution than just the -target of harassment.
+Online harassment is the "pervasive or severe targeting of an individual or group online +through harmful behavior" [PEN-Harassment]. Harassment is a prevalent problem on the web, +particularly via social media. While harassment may affect any person using the web, it may be more +severe and its consequences more impactful for LGBTQ people, women, people in racial or ethnic +minorities, people with disabilities, vulnerable people and other marginalized groups.
+Harassment is both a violation of privacy itself and can be enabled or +exacerbated by other violations of privacy.
+Harassment may include: sending unwanted information; directing others to contact +or bother a person ("dogpiling"); disclosing sensitive information about a person; posting false information about a person; impersonating a person; insults; threats; and hateful or demeaning speech.
+Disclosure of identifying or contact information (including "doxxing") can often be used to cause additional attackers to send persistent unwanted information that amounts to harassment. +Disclosure of location information can be used to intrude on a +person's physical safety or space.
Reporting mechanisms are mitigations, but may not prevent harassment, particularly in cases where -hosts or intermediaries are supportive of or complicit in the abuse.
-Effective reporting is likely to require:
+hosts, moderators, or other intermediaries are supportive of or complicit in the abuse. +Effective reporting is likely to require:
Receiving unsolicited information that either may cause distress or waste the recipient's -time or resources is a violation of privacy.
-Some useful research overviews of online harassment include: [PEW-Harassment], + [Addressing-Cyber-Harassment] and [Internet-of-Garbage].
+Unwanted information covers a broad range of unsolicited communication, from messages that are typically harmless individually but that become a nuisance in aggregate (spam) to the -sending of images that will cause shock or disgust due to their graphic, violent, or explicit nature -(e.g. pictures of one's genitals). While it is impossible, in a communication system involving many -people, to offer perfect protection against all kinds of unwanted information, steps can be -taken to make the sending of such messages more difficult or more costly, and to make the senders -more accountable. Examples of mitigations include:
+sending of explicit, graphic, or violent images. +System designers should take steps to make the sending of unwanted information more difficult +or more costly, and to make the senders more accountable.
+This section is still being refined. We expect additional principles to be added.
Attempts to obtain consent to processing that is not in accordance with the person's true preferences result in imposing unwanted privacy labour on the person, and may result in people erroneously giving consent that they regret later.
-An actor should not prompt a person for consent if the +
An actor should not prompt a person for consent if the person is unlikely to have sufficient information to make an informed decision to consent or not. In considering whether or not a person is sufficiently informed to be asked for consent, actors should be realistic in assessing how much time and effort would be required to understand the processing for which they are asking for consent. Simply providing a link to a complex policy is unlikely to mean that the person is informed.
Relying on a global opt-out signal from the user agent.
Delaying a prompt for consent until a user does something that puts the request in context, +
Delaying a prompt for consent until a user does something that puts the request in context, which will also help them give an informed response.
A person may share data about other people (e.g. a picture with both that person and others). If that person consents to the processing of that data, this does not imply that those other people have consented as well.
+A person may share data about other people (e.g. a picture with both that person and others). If that person consents to the processing of that data, this does not imply that those other people have consented as well.
See Group Privacy and Data Rights for further discussion of privacy of people other than the user.
Whenever people have the ability to cause an actor to process less of their data or to stop +
Whenever people have the ability to cause an actor to process less of their data or to stop carrying out some given set of data processing that is not essential to the service, they must be -allowed to do so without the actor retaliating, for instance by artificially removing an +allowed to do so without the actor retaliating, for instance by artificially removing an unrelated feature, by decreasing the quality of the service, or by trying to cajole, badger, or -trick the person into opting back into the processing.
+trick the person into opting back into the processing.Actors can invest time and energy into automating ways of gathering data from people and can -design their products in ways that make it a lot easier for people to disclose information than not, whereas -people typically have to manually wade through options, repeated prompts, and deceptive patterns. In many -cases, the absence of data — when a person refuses to provide some information — can also be identifying +
Actors can invest time and energy into automating ways of gathering data from people and can +design their products in ways that make it a lot easier for people to disclose information than not, whereas +people typically have to manually wade through options, repeated prompts, and deceptive patterns. In many +cases, the absence of data — when a person refuses to provide some information — can also be identifying or revealing. Additionally, APIs can be defined or implemented in rigid ways that can prevent people from accessing useful functionality. For example, I might want to look for restaurants in a city I will be visiting this weekend, but if my geolocation is forcefully set to match my GPS, a restaurant-finding site might only allow searches in my current location. In other cases, sites do not abide by data minimisation principles and request more information than they require. This principle supports -people in minimising their own data.
-User agents should make it simple for people to present the identity they wish +people in minimising their own data.
+User agents should make it simple for people to present the identity they wish to and to provide information about themselves or their devices in -ways that they control. This helps people to live in obscurity ([Lost-In-Crowd], +ways that they control. This helps people to live in obscurity ([Lost-In-Crowd], [Obscurity-By-Design]), including by obfuscating information about themselves ([Obfuscation]).
Instead, the API could indicate a person's preference, a person's chosen identity, a -person's query or interest, or a person's selected communication style.
+Instead, the API could indicate a person's preference, a person's chosen identity, a +person's query or interest, or a person's selected communication style.
For example, a user agent might support this principle by:
A person (also user or -data subject) is any natural person. Throughout this document, we primarily use person or -people to refer to human beings, as a reminder of their humanity. When we use the term user, -it is to talk about the specific person who happens to be using a given system at that time.
-A vulnerable person is a person who may be unable to
+ A person (also user or
+data subject) is any natural person. Throughout this document, we primarily use person or
+people to refer to human beings, as a reminder of their humanity. When we use the term user,
+it is to talk about the specific person who happens to be using a given system at that time. A vulnerable person is a person who may be unable to
exercise sufficient self-determination in a context. Amongst other things, they should
be treated with greater default privacy protections and may be considered unable to
consent to various interactions with a system.
@@ -2181,25 +2169,25 @@ Privacy Principles
are employees with respect to their employers, are facing a steep asymmetry of power,
are people in some situations of intellectual or psychological impairment, are
refugees, etc.
A context is a physical or digital environment in which people interact with other -actors, and which the people understand as distinct from other contexts.
+A context is a physical or digital environment in which people interact with other +actors, and which the people understand as distinct from other contexts.
A context is not defined in terms of who owns or controls it. Sharing data between different contexts of a single company is -a privacy violation, just as if the same data were shared between unrelated actors.
-An actor is an entity that a person can reasonably understand as a single "thing" -they're interacting with. Actors can be people or collective entities like companies, +a privacy violation, just as if the same data were shared between unrelated actors.
+An actor is an entity that a person can reasonably understand as a single "thing" +they're interacting with. Actors can be people or collective entities like companies, associations, or governmental bodies. Uses of this document in a particular domain are expected to -describe how the core concepts of that domain combine into a user-comprehensible actor, and +describe how the core concepts of that domain combine into a user-comprehensible actor, and those refined definitions are likely to differ between domains.
-User agents tend to explain to people which origin or site provided the -web page they're looking at. The actor that controls this origin or site is -known as the web page's first party. When a person +
User agents tend to explain to people which origin or site provided the +web page they're looking at. The actor that controls this origin or site is +known as the web page's first party. When a person interacts with a UI element on a web page, the first party of that interaction -is usually the web page's first party. However, if a different actor controls +is usually the web page's first party. However, if a different actor controls how data collected with the UI element is used, and a reasonable person with a realistic cognitive budget would realize -that this other actor has this control, this other -actor is the first party for the interaction instead.
+that this other actor has this control, this other +actor is the first party for the interaction instead.Referenced in:
Referenced in:
Referenced in: