Privacy/Reviews/PhonebookAPI: Difference between revisions

← Older edit

Privacy/Reviews/PhonebookAPI (view source)

Revision as of 17:20, 24 October 2012

1,659 bytes added , 24 October 2012

→‎Document Overview

Curtisk

canmove, Confirmed users, Bureaucrats and Sysops emeriti

2,776

edits

@@ Line 8: / Line 8: @@
 |'''Product Champions:''' || Aakash Desai, Jishnu Menon, James Socol
 |-
-|'''Privacy Champions:''' || (the privacy Friend you're working with)
+|'''Privacy Champions:''' || David Dahl
 |-
 |'''Security Contact:''' || Curtis Koenig
 |-
-|'''Document State:''' || <section begin='status'/>{{new|template created}}<section end='status'/>
+|'''Document State:''' || <section begin='status'/>{{ok|Responses and Verification needed}}<section end='status'/>
 |}
@@ Line 85: / Line 85: @@
 |}
-'''Communication with Component Y'''
+'''Communication with Community Site/Tool (ex. Exact Target)'''
+* Vouched Mozillian Authorization
+{| class="wikitable"
+|-
+! Direction
+! Message
+! Data
+! Notes
+|-
+| ''In:''
+| N/A
+| query including e-mail address
+|
+|-
+| ''Out:''
+| N/A
+| is_vouched status of e-mail address
+|
+|}
+* Sharing of Mozillian E-mails
 {| class="wikitable"
@@ Line 96: / Line 118: @@
 | ''In:''
 | message 1
-| types of data received from component Y with the message
+| query including specified group(s), skills or country/region/city
 |
 |-
 | ''Out:''
 | message 2
-| types of data sent to component Y with the message
+| Blob of e-mail addresses corresponding to message
+|
+|}
+* Sharing Mozillian profile data
+{| class="wikitable"
+|-
+! Direction
+! Message
+! Data
+! Notes
+|-
+| ''In:''
+| message 1
+| query including specified e-mail address
+|
+|-
+| ''Out:''
+| message 2
+| Blob of Mozillian profile data: display_name, ircname, country/region/city, groups, skills, website
 |
 |}
@@ Line 116: / Line 158: @@
 ====Principle: Transparency / No Surprises====
-(How the feature addresses this)
+Contributors give explicit consent by opting-in for profile sharing when they register for the service.  They need to be able to see how the data is being used.
-''Recommendations'': (what can be improved)
+''Recommendations'': It would also be helpful to show the user how their data is being shared/used via the api -- perhaps by sending them a message when a new site access the API (including a list of sites accessing their data through the api).
+{{ResolutionBox|{{new|Provide way for users to see which sites are accessing their data through the api and perhaps also what is being accessed}}}}
 ====Principle: Real Choice====
-''Recommendations'':
+Users have an opportunity to opt-in at registration, but should have control if they change their minds later.
+''Recommendations'': Expose an option in the user's "edit profile" screen to allow them control over whether their data is exposed via the API.
+{{ResolutionBox|{{new|Expose setting/checkbox to enable/disable sharing via this api}}}}
 ====Principle: Sensible Defaults====
+* the sensible default action will be no sharing of profile data, which is good.
 ''Recommendations'':
+* none
 ====Principle: Limited Data====
+* As all users must be logged in and vouched by other Mozillians to view profile data that is more than beyond name.  This limits web/data scrapers from collecting these profiles.
 ''Recommendations'':
+* none
 = Follow-up Tasks and tracking =