The Working Party will inquire into whether Microsoft is giving individuals adequate notice of information processing and transferring of data; whether adequate consent from the individual is being obtained; whether Passport affiliates have adequate privacy protection rules; whether Passport's use of a unique identifier is necessary; the quality of data collected by the system; the rights of individuals to access or delete their Passport profile; and the security risks in the Passport system.

The stakes are rising because Microsoft recently announced plans to implement a Digital Rights Manageme
nt Operating System called "Palladium." The Palladium system would limit the use of content through so
ftware and hardware controls. These controls could also be used to identify individuals and eliminate
anonymous communication. Additionally, in order to legitimize the Passport system, Microsoft has begun
a partnership to develop Passport as an authentication tool for credit card transactions.

A competing identification system, called Project Liberty, is also developing. This week, the project'
s sponsors will release the specifications for their federated identification scheme. Project Liberty
presents the same risks as Microsoft's Passport. It will likely be used to profile individuals' web su
rfing habits, as the group's stated goals include the ability to "[e]nable commercial and non-commercia
l organizations to realize new revenue and cost saving opportunities that economically leverage their r
elationships with customers, business partners, and employees."

Related links:

"First orientations of the Article 29 Working P
arty concerning on-line authentication services," EU Article 29 Working Party, July 2, 2002 (PDF do
cument)

EPIC's Passport Investigation Do
cket Page
EPIC's Sign Out of Passport Page

Source: EPIC Alert 9.13