For the purposes of the present document, the terms and definitions given in [2] and the following apply. Personal Data: Privacy: Privacy Settings: Trust:

For the purposes of the present document, the following abbreviations apply: BAOC BOIC BOIC-exHC BIC BIC-Roam CLIP CLIR CS GUP HLR IMS ISDN LCS MSISDN OMA OSA PLMN PPR SIP SMS UE WLAN Additional definitions and abbreviations can be found in TR 21.905.

In the present document privacy is mainly considered as privacy of user information, i.e. privacy is considered as a requirement from an individual user. It should be noted, that privacy requirements may also arise from other parties involved in telecommunication. E.g. a PLMN operator could have the privacy requirement to hide its network topology from other operators, or a company (being a 3GPP subscriber for users, which are its employees) could have certain requirements for confidentiality of messaging among these employees, but privacy requirements from these parties are not covered the present document. Already in its most general form one may observe that, from a user's perspective, there exist several flavors of privacy:

• Protection of personal data
  (I do not want my personal data being accessible to unauthorized parties)
• Non-disclosure of identity
  (e.g. I do not want to reveal my phone-number to my communication partner, or I want to remain anonymous towards a service provider)
• Protection against tracking
  (e.g. I do not want to be tracked, geographically or on my behavior)
• Protection from unsolicited communication
  (e.g. I want not to be bothered by spam-mail)
• Access to undesirable information / kids-protection
  (e.g. I want to block access of my kids to adult or gambling content)

From a Generalized Privacy capability point of view only protection of personal data and non-disclosure of identity seem to be within the scope of our work. Privacy from unsolicited communication and Access to undesirable information / Kids-protection is considered as filtering of communication (incoming and outgoing) of the information being exchanged (e.g. originator, target, service, keyword search …). Filtering should be done on service level as separate service or enhancement to other services and is - generally - considered out of scope of our work. (exception: basic Call Barrings as in GSM, see below) Tracking of a user is considered as collecting figures about that user and deduce information about the user. This can be a feature of a service (e.g. fleet management needs to track the location of a truck) or an unwanted misuse of data, for which the service provider can be made liable. In any case Protection against tracking seems to be out of scope of standardization.

In the present document the following involved parties are considered:

• The user:
  In general it is assumed, that the user is provided with a 3GPP subscription.
• The home operator:
  The PLMN operator, with whom the user has the subscription.
• A "visited" operator:
  An operator of a PLMN, which is not the home operator. A visited operator may e.g. be the operator of a 3GPP network, in which the user currently is roaming.
• The service provider:
  Privacy of user information may be specific to a particular service. A service is provided by a service provider which may be a 3GPP operator - home or visited - (e.g. location services) or a third party service provider.

Amongst these parties trust relationships exist:

• User - home operator
  One of the most esteemed assets an operator has is the trust in protection of privacy, which is maintained by his customers. If a user communicates via the 3GPP system he considers this communication more "private" than communicating e.g. over the Internet.
• User - service provider
  • Service provider is the home operator, or the home operator acts on behalf of a (third party) service provider:
    If a service or access to the service is offered by the home operator, then the same trust relationship exists as in the previous case.
    It should be noted that the term "offered by the home operator" only means that the user has the impression that the operator is responsible for that service. This impression could e.g. be implied by the fact that the user needs no separate contract with the service provider or that the service is advertised by the operator. In this case usually some kind of Service level agreement exists between operator and service provider.
  • Service provider is a third party:
    This is the case where the service provider is a third party (e.g. the user has a separate contract with the service provider, or a service is downloaded to the terminal from a website). A Service level agreement does not exist.
    While this case essentially is out of scope of 3GPP, some implications exist, if the third party service has some information exchange with the 3GPP system (e.g. the 3GPP identity of the user via CLIP/CLIR).
• Home operator - third party service provider
  Depending on the trust relationship between the home operator and a third party service provider data about the user (e.g. location, presence, billing method, user preferences) may be exchanged between these parties.
  A Service level agreement exists between operator and service provider.
• Home operator - visited operator
  Essentially, this trust relationship is manifested in the existence of a roaming agreement between the two parties. However, still this could require that enforcement of some user data privacy (e.g. for LCS in 3GPP Release 6) is performed in the home network and not on in the visited network.

The present document is concerned with two types of privacy related information of a user:

• Personal Data
• Privacy Settings

The following general (i.e. non-service-specific) requirements are identified:

• The user shall be allowed access to her Privacy Data in order for instance to review, or modify information
  This requirement allows the user to monitor and control her Personal Data within the limitations set by the operator and / or service provider.
• The user shall be allowed to express preferences for her privacy settings on a per service basis.
  This requirement allows the user to modify her privacy settings within the limitations set by the operator and / or service provider. User preferences shall include specific personal data items, who may or may not access those data items and the permitted kind of access.
• A generic privacy capability
  It shall be possible to use a common set of access rules that can be used by any service that requires the protection of personal data or information about a user.
• Enforcement of privacy through the terminal
  Terminals shall ensure that existing trust relationships and privacy controls, already established by network operators, are not bypassed.
• Enforcement of privacy through Home Network
  This is the requirement that the means for enforcing privacy are located in the home network. Such a requirement exists e.g. in LCS Release 6.
• Requirement for control of access to the user's personal data by third parties or by third parties on behalf of the user
  This is the requirement, that a third party (e.g. a service provider, a different subscriber) may access certain data about a user. This may be done
  • Upon request of the user (e.g. a user wants to employ an - eessentially untrusted - cityguide service, which needs to be authorized by the user to obtain the user's location from the network);
  • Without explicit request of the user (e.g. Push services).
• Roaming support
  Enforcement of user privacy shall be supported for services which are provided by the visited network for the roaming user.
  Like on the Internet, there is a fundamental legal problem related to how service providers deal with the laws of the various locations of its users. For roaming users, the privacy policies applied should relate to the regional/local directives of the users home PLMN. See also Annex A.
• call/session related authorisation
• The user shall be able to invoke defined access rules for a service in order to control how the user-specific/personal data is made available to those services
  Override (lawful intercept)
  Mandatory obligations, enforced by for instance national laws, for overriding privacy settings shall be complied with, e.g. lawful interception [9].
• Backward compatibility with existing standardized Privacy concepts
• Privacy settings are most effective if related to a user, not a piece of equipment. Therefore, it should be possible for the privacy settings of a user to be maintained when a user switches terminals.
• If some privacy settings for services offered by the Network Operator are resident within the terminal, then they should be consistent with equivalent privacy settings stored within the operator's network, e.g. the HLR flag, the privacy exception list, any settings in the PPR etc...