Ever Fresh: a data portability approach

Caveat Lector: this is a rough draft of my thinking on what a Portability EULA/TOS should say/do/include. Please comment. – Phil

"Hey, hey, hey, hey-now. Don't be mean; we don't have to be mean, cuz, remember, no matter where you go, there you are."

 Buckaroo Banzai from The Adventures of Buckaroo Banzai
Across the 8th Dimension (1984)

So you start your data portability relationship with Open Arms, end it with a Graceful Exit. What happens in between? What are our portability concerns during our relationship?

Ever Fresh is a combination of policy and technology.

The policy says:

We will consume and share your onlife with other services. So everywhere you go, you have all of yourself, as appropriate. As we change, we'll let you know.

Breaking it down...

We will consume and share. "Consuming" is a software syndication term. It brings data by/about/for you into a system. Sharing flips the direction, data by/about/for you moving out of the system. Synchronization systems (sync or synch for short) compare the data they have with data others have, find the "best" version of that data, and update each other.  Synch services keep your experiences up-to-date using the freshest, most trusted versions of your data.

Your onlife. Shorthand for everything digital created by your behavior. Your IDs, your profiles, your stuff (like photos and messages), and collective works you've created with others (like annotated photos or a wiki page).

Your onlife isn't just what happens at one web site. It's what happens with your mobile phone. It's your email, your browsing, the documents you create, the videos you shoot, the IMs and texts you send. It's you and your stuff and the stuff you make with others.

Other services. Here we come to portability. This site, the one with the portability policy, will consume and share your onlife (data you make explicitly, data you make with others, data others make about you) with other services.

• Enumeration. Which ones? Is this site going to disclose to you a list of those sites before sharing? After the fact? When will they get your permission and when won't they?
• Transitivity. Will they agree to these same portability and privacy terms of service?
• Jurisdiction. Are they covered by the same laws as you and this site?
• Agency for Enforcement. What steps will this site take with partners to enforce side agreements? Will they always act on your behalf? When won't they? 
• Remedies for Breaches. What steps will this site take on your behalf to fix breaches by partners?

Let's look at two examples of data  passed through a third party.

Case 1: Flickr, part of a US company, shares your photos with Moo, a UK company, so Moo can print your flickr photos on business cards. Moo, in turn, shares your home address with several shipping companies.

• What should your Portability Policy say about this?
• What should Flickr demand of Moo on your behalf?
• What information should Moo require of Flickr before or upon receipt of your data? How would Moo know Flickr had done a complete and thorough job? What risks does Moo
• What should Flickr demand Moo demand the shipping companies do with your data, especially when Flickr may not know anything about Moo's other partners  (printing in Mexico for Canadian customers)?

Case 2: Skype, a Luxembourg subsidiary of a US company, partners with MySpace, a US subsidiary of a company, to integrate MySpaceIM instant messaging and voice calling with Skype's instant messaging and voice calling. Skype shares personal profiles with another company for directory services, including my birthdate and where I live. Skype is sharing my IP address to help connect calls and status updates.

My email address and birth date are sensitive data, useful in identity theft. So I have a stake in knowing with whom and where Skype shares that data.

Everywhere you go. Dataportability is device, connection, and location agnostic. This service's portability of your stuff should apply to all the sites, software, and devices you use. You may have web browsers on multiple computers and your phone. You may talk on your mobile, your desk phone, your MySpace IM or your Skype. Your experience should be seamless across systems. When this service is unable or unwilling to port your data, they should say so and say why.

All of yourself. It's tough being incomplete. So where you produce data, we'll manage as much as we can.

• Your browser or operating system could make your bookmarks, browsing history, saved passwords and tabs available across devices.
• Your communication tools could share your address book, contacts, conversation history, contact groupings and metadata, things shared.
• Your medical services could assure your records of care, diagnosis, treatment, prescriptions, imaging are available where, when and as you need them.

As appropriate. You are too much for any one site. So, while a site may agree to take and share "all of you," it wont' know what to do with everything outside its scope. Photo comments on flickr aren't the same as your restaurant reviews on Yelp. While Monster might build a team-job search for you using some of your LinkedIn friends, Monster doesn't need your IMDB movie ratings. So sites will take what they can use on your behalf and ignore the rest.

As we change. We change our policies and behavior all the time. We modify our terms of service, our license agreement with you, our privacy policies, agreements with third-party developers who may have access to data by/about/for your, and this portability policy. These contract revisions, these changes in what we promise and what we expect, adapt us to changing situations. We acknowledge your stake in those changes.

We'll let you know. Since you have a stake, we'll give you meaningful notice of changes, notify you through the channels you prefer, help you separate changes with small impact from those with large ones, and ask you to opt-in when the changes are substantial.

Ever Fresh: We will consume and share your onlife with other services. So everywhere you go, you have all of yourself, as appropriate. As we change, we'll let you know.

See also:

• Mozilla Labs Weave Sync 
• DiSo Project
• Xmarks

Original photo credit: backpackphotography. Photoshopped version.

tags: dpp, dataportability, openarms, everfresh, gracefulexit

Call me at +1-510-455-4384, Skype me, follow @skypejournal and @Phil Wolff.
Visit our Skype Journal private roundtable, one of the longest running public Skype chats.