From P3P to data licenses

Abstract

P3P provides a standard means for Web sites to disclose their privacy policies when they need users' personal data for processing. A user can then decide whether or not to provide personal data to the sites based on the disclosed policies. The decision process can also be made automatic through an agent or browser via the privacy preferences set by the user. As can be seen, however, this mechanism cannot guarantee that Web sites do act according to their policies once they have obtained user's personal data. In light of this, we proposed a new technical and legal approach, called Online Personal Data Licensing (OPDL). The idea is that the use of a person's data must be authorized by the person through the issue of data licenses. Licenses can then be checked to prevent personal data from being misused. This paper focuses on the implementation of OPDL. As P3P provides a standard format for expressing privacy practices about personal data, we use it here to implement data licenses. © Springer-Verlag Berlin Heidelberg 2003.