Companies move slowly on P3P adoption

From...

By Patrick Thibodeau

(IDG) -- Some companies are gradually implementing the proposed Platform for Privacy Preferences (P3P) Internet data privacy specification on their Web sites. But it remains unclear whether P3P will succeed as a standard.

At this point, the P3P specification is primarily being eyed by companies that have already taken leadership roles on data privacy issues. For example, Cincinnati-based Procter & Gamble Co. is testing P3P after having previously adopted a worldwide privacy policy that meets restrictive European data-protection rules.

IDG.net INFOCENTER Computerworld main page Computerworld's topic-oriented communities Computerworld's IT career center Free daily newsletters Related IDG.net Stories Privacy measures fail to grab IT departments' attention Putting privacy into practice Free tool nabs Web bugs Features PC World.com Product Finder Mastering e-commerce by degrees Fast-track training puts nontechies in IT jobs Visit an IDG site Choose a site: IDG.net CIO Computerworld Darwin Dummies.com GamePro.com The Industry Standard ITWorld.com InfoWorld.com JavaWorld LinuxWorld Macworld Online Network World Fusion PC World Publish.com UnixInsider

P&G has implemented P3P on its main corporate Web site to gauge user response before deciding whether to expand the specification to about 500 related sites, said Mel Peterson, chief privacy officer at the consumer products giant.

Companies adopting P3P, which is being developed by the World Wide Web Consortium (W3C), must convert their data privacy policies to a question-and-answer format that's XML-based and machine-readable. P3P-enabled Web browsers can then "read" those policies and compare them with privacy preferences set by individual Internet users.

What has some companies betting on the future of P3P is Microsoft Corp.'s inclusion of the emerging standard in its Internet Explorer 6 browser.

That's "a huge driver" for P3P adoption, said Christopher Fisher, information systems director at Royal Appliance Manufacturing Co. in Glenwillow, Ohio. The company has begun making its Web site P3P-ready.

But adopting P3P raises some big legal issues, according to corporate officials and privacy analysts. Translating a detailed data-privacy policy into a machine-readable format can be complicated, they said, adding that P3P implementations shouldn't be handled solely by IT departments.

The codes used as part of P3P implementations "are legal promises," said Benjamin Wright, a Dallas-based attorney and electronic law expert. "It's like a contract."

Some companies are waiting to make decisions about adopting P3P until it's finalized, which may not happen until early next year. "We have not come to any conclusions yet," said Kevin Pursglove, a spokesman for San Jose-based eBay Inc.

Lorrie Cranor, chairwoman of the W3C's P3P working group and a principal technical staff member at AT&T Labs in Florham Park, N.J., said any last-minute changes to the specification will be backward-compatible.