RFC 1355

Privacy and Accuracy Issues in Network Information Center Databases 🎀

okay bestie, this is RFC 1355 💅 It's from the Network Working Group, published August 1992, and it's filed in the FYI series as FYI: 15, so it's labelled an informational memo ✨ Two authors wrote it: J. Curran from the NNSC and A. Marine from SRI. The title block doesn't list anything it obsoletes or updates, so it doesn't replace or amend any other RFC 🌸

Status of This Memo 📜

This memo provides information for the Internet community. It does not specify an Internet standard. Distribution of this memo is unlimited 🦋

Abstract ✨

okay so this doc gives you a set of guidelines for running public Network Information Center (NIC) databases 🗂️ The whole point is to make the way NICs handle personal and organizational info responsible and proper, and to make that data more accurate and easier to get to where it makes sense 💜

Acknowledgments 🫶

This doc is built on the work of the Network Information Services Infrastructure (NISI) working group in the User Services Area of the IETF. Huge thanks to everyone in that group who threw in ideas and comments, especially Glee Cady (University of Michigan), who contributed a ton 👑 Special shoutout to Steve Crocker (TIS) for his guidance too 🌈

Since NIC databases and public user directories overlap so much, this doc also draws on the North American Directory Forum's (NADF) "User Bill of Rights for Entries and Listings in the Public Directory" (RFC 1295) 🦋

1. Purpose 🎯

The purpose here is to look at the privacy and accuracy issues that come up when NIC databases are publicly accessible 🌸 It only covers generic concerns, and it deliberately doesn't make recommendations for specific databases on the Internet 🙈 Each NIC is responsible for figuring out which procedures should apply to each of its databases.

The doc also talks about what a NIC that maintains one of these databases owes the people whose data shows up in it 💖 Those obligations apply to database entries that hold information that's publicly accessible to Internet users.

2. Background and Organization 🧚

A NIC has to collect and share all sorts of info about the network it serves 💅 A big chunk of that is "directory" information that points to people, organizations, and resources across the network. Publicly accessible databases are seen as a good thing for the Internet because they make retrieval fast for users, Network Operation Centers (NOCs), and other NICs ✨

This doc is split into two parts. Part one has recommendations for stopping unauthorized disclosure of info in NIC databases 🔒 Part two lays out formal accuracy guidelines for NIC databases 🎀

3. NIC Database Privacy 🔐

Publicly accessible databases raise a lot of big questions about who controls gathering and distributing the data 👀 It's really important to deal with these before a public NIC database goes wide-scale, because otherwise a NIC could end up retrofitting an established system once formal guidelines finally show up 😭

For every publicly accessible database a NIC runs, it needs to give a clear statement of the database's purpose, the types of info it holds, and the privacy policy for that info 💜 In general, this policy should tell the people or organizations listed in the database what their entries contain and what they're for. Specifically, the privacy policy should:

1. Describe why the NIC needs the information and how it will use the information.
2. Give a list of all the information being stored in an entry.
3. Detail which information will be made available outside of the NIC, to whom it will be made available, and for what purpose.
4. Provide for notification of any person or organization added to the database at the request of a third party.
5. Explain how to have the information changed or updated.
6. Explain how to get information removed from the database, including any references to one's information in another's database entry.
7. Explain the consequences of removing information from the database and of failing to provide all or part of the information a NIC requests.

The privacy policy is what lets people make informed choices about which info to hand over for a given NIC database 🍓 Any info that's supplied should be treated in a way that matches the current privacy policy ✨ And if a NIC gives a whole database to another organization, the NIC should also hand that organization a copy of the database's current privacy policy 🫶

4. NIC Database Accuracy 💅

The whole value of a NIC database depends on how accurate and up-to-date its contents are 📈 A database that isn't maintained well can cause major problems for the people using it and for the people and organizations listed in it 😭

For every publicly accessible database a NIC runs, the NIC should have a clear statement describing how it keeps the database accurate 🎀 For administrative convenience, this statement could be combined with the privacy statement from above 🧚

The accuracy statement tells potential participants what precautions the NIC takes to keep the info correct 🔍 Any info that's supplied should be treated in a way that matches the current accuracy policy. And if a NIC gives a whole database to another organization, the NIC should also give that organization a copy of the database's current accuracy policy 🌈

The accuracy statement should:

1. Allow an individual or organization access to its own database entry, including private fields, for the purpose of correcting errors.
2. Allow an individual or organization to correct any errors that occur in its database entry.
3. Inform an individual or organization when information about them appears in an entry belonging to another party, so that the individual or organization can review that information and have the opportunity to submit corrections.
4. Change information in an entry only at the request of or with the approval of the individual or organization about which the entry applies.
5. Encourage an individual or organization to report any errors that occur in the database entries of others.
6. Provide for a "date of last review" for each entry in the database; this would reflect the date that the entry was last checked by the owner for accuracy.
7. Describe any and all practices used by the NIC to confirm data prior to inclusion in the database.
8. State the data backup procedures in use for this database.

5. Security Considerations 🔒

okay this part is serious, bestie 😭 This memo briefly looks at the security side of the info in NIC databases 🛡️ And it should be revisited as security infrastructure gets more developed on the Internet, because the landscape is literally going to keep changing 💀

6. Authors' Addresses 🦋

John Curran
NSF Network Service Center (NNSC)
10 Moulton Street
Cambridge, MA 02138

Phone: (617) 873-3400
EMail: jcurran@nnsc.nsf.net


April N. Marine
SRI International
Network Information Systems Center
333 Ravenswood Avenue, EJ294
Menlo Park, CA  94025-3493

Phone: (415) 859-5318
EMail: april@nisc.sri.com

---

That's the whole doc, bestie! 🌈💖 The big takeaway is that NIC databases need to be clear about privacy, honest about accuracy, and careful about security 👑✨