Wirtschaftsuniversität Wien Magisterarbeit - SemanticLab

Finally, an example should be provided to explain the STATEMENT element and
hence the data-specific assertions. Listing 3.8 shows how a statement in a P3P policy
may look like when a form is provided to e-mail webmasters comments about the website
including an input field to optionally provide an e-mail address so that the webmaster
can reply to the inquiry: the statement defines that the data submitted will only be
used to improve the website, that the information will be discarded once processed and
that the information provided will not be disclosed to any other party.
Listing 3.8: Policy statement regarding a e-mail comment form (Source: [Cra02])
As seen in the example above, this statements makes use of the DATA and CATE-
GORIES elements. These elements can be used within a policies’ DATA-GROUP
element. Within such a DATA-GROUP element, data types which the policy is applied
to have to be defined whereas such data types can be grouped in data schemas.
P3P specifies a base data schema where the following kind of data is defined: dynamic
data, user data, third party data and business data. As the base data schema has a
multitude of sub-(sub)-elements, it is not going to be covered in this thesis. Interested
readers should especially consult chapter five of the P3P specification for more details.
A complete P3P policy with all elements introduced can be found in Appendix A.1 for
further reference.
So far, predefined vocabularies were introduced which were designed by the P3P working
group. Although a lot of effort and time was devoted in creating the vocabulary as short
as possible and as long as necessary, it cannot contain every possible concept. That is
30