Paul,
Can 802 provide one response to this request versus responses from each individual working group?
Thanks,
Steve
From: ***** IEEE 802 Executive Committee List ***** [mailto:STDS-802-SEC@ieee.org]
On Behalf Of Benjamin A. Rolfe
Sent: Wednesday, September 27, 2017 12:19 PM
To: STDS-802-SEC@LISTSERV.IEEE.ORG
Subject: Re: [802SEC] Fwd: IMPORTANT AND TIME DEPENDENT -- Information Request to IEEE-SA Sponsors - Please reply by 06 October 2017
While Pat is completely correct that the information provided in the document is incomplete and raises many questions, Paul may be able to clarify, but I believe at this time the "task force" is asking only
for us to provide specifically what information we collect, retain and use, and the various systems involved. I read it that the task force is supposed to use this information and, we might *assume*, provide us with procedural guidance and requirements for
compliance with the regulatory requirements at some point between now and the regulations taking effect.
If we wish to list all the flaws in the document, that will take quite some time. Speculation on what irrational and impossible to comply with procedures the task force might come up with is likewise likely
to take some time. While both may be entertaining, neither seems productive. What seems productive to me is give them information on how we conduct our business as completely and accurately as possible, see what they do, and then whinge about the resul then
:-).
On 9/27/2017 12:04 PM, Adrian Stephens wrote:
Hello Pat,
Please see below...
Sincerely,
Adrian Stephens
IEEE 802.11 Working Group Chair
mailto: adrian.p.stephens@ieee.org
Phone: +447342178905
Skype: adrian_stephens
On 2017-09-27 08:52, Pat Thaler wrote:
The information sheet provided is flawed. It has the requirement:
· Must be explicit for sensitive data"
It defines Personal Data, but not sensitive data so it impossible to know whether one is meeting that requirement.
It asks about whether information is passed to a third party.
F2F collects information as part of registration and they collect data as part of that. Also, registration uses RegOnline.
One can enter a password to import data from the past registration so data is retained from meeting to meeting. It isn't clear that there is any mechanism to get your data removed.
I think you ask the meeting planners, who have administrative access to this data.
Registration requires an SA pin - is it used to access data from IEEE servers?
No. In the past the registration system confirmed username/password and discovered and retained SA pin.
Now, the SA pin is an input field that ~90% of registrants manage to enter correctly.
IMAT system captures attendance data. Working group officers download the data so have access to it.
IEEE 802.3 collects names and affiliation on paper to record partial participation since IMAT doesn't support that.
Names and affiliation are published in minutes. They aren't removable - in this case, we have legitimate legal reasons for not providing the "right to be forgotten."
MyBallot comment databases contain ballot pool member classification, email and phone as well as name and affiliation. It is visible on line to Sponsor officers (Sponsor chair and vice-chairs at least - I can see it for all 802 sponsor
ballots), WG chair and delegates. These volunteers can also download it in a CSV that includes name, classification, affiliation and email address
Information for commenters (name, affiliation, email and phone) is included when downloading comments and distributed to editors as part of the comment database to enable comment resolution.
That's all I can think of offhand.
On Wed, Sep 27, 2017 at 10:59 AM, Benjamin A. Rolfe <ben@blindcreek.com> wrote:
According to the "any operation performed on personal data, whether or not by automated means, including collection,
use, recording, etc." we need also report manual operations where we require personal information be provided even though it is not recorded, e.g. badge pickup where an attendee may must use a passport or other iD with a photo. Is meeting attendance
"personal" information? I don't know, so maybe we should include that this is recorded in imat and let the task force figure out if it's "personal" or not. Not sure if this is what they are asking for, but better be too complete than to risk being incomplete.
B
On 9/27/2017 5:44 AM, Clint Chaplin wrote:
I can tell right now that data is collected as part of the meeting registration process and the meeting fee payment system. As of now, that includes Authorize.net and RegOnline services.
On Wed, Sep 27, 2017 at 3:20 AM, paul.nikolich <paul.nikolich@att.net> wrote:
-------- Original message --------
Date: 9/26/17 9:44 PM (GMT-05:00)
Subject: IMPORTANT AND TIME DEPENDENT -- Information Request to IEEE-SA Sponsors - Please reply by 06 October 2017
As you may be aware, the European Union (EU) adopted the General Data Protection Regulation (GDPR) on 14 April 2016, which addresses collection and use of personal data. Similar regulations are being implemented in countries outside the
EU. The GDPR will go into effect on 25 May 2018 and IEEE has to meet the requirements of the regulation by that date.
In order to determine how our volunteers collect and use personal data, we will need to know what mechanisms/systems/applications are being used to collect or download personal data, where that personal data is sent, how it is used, and
what retention is in place. IEEE is asking its standards development groups to provide that information so that it can determine what system or process changes may need to be implemented to meet the GDPR requirements.
An information sheet is attached to help you understand the regulation. Your IEEE Staff Program Manager will contact you in an effort to obtain the needed information. We will need your response by
October 2017.
Thank you for your assistance in our effort to be compliant.
Regards,
Director, IPR and Risk Mgmt
IEEE Standards Association
Fostering technological innovation and excellence for the benefit of humanity.
---------- This email is sent from the 802 Executive Committee email reflector. This list is maintained by Listserv.
--
Clint Chaplin
Principal Standards Engineer
Samsung Research America
---------- This email is sent from the 802 Executive Committee email reflector. This list is maintained by Listserv.
---------- This email is sent from the 802 Executive Committee email reflector. This list is maintained by Listserv.
---------- This email is sent from the 802 Executive Committee email reflector. This list is maintained by Listserv.
---------- This email is sent from the 802 Executive Committee email reflector. This list is maintained by Listserv.
---------- This email is sent from the 802 Executive Committee email reflector. This list is maintained by Listserv.