1733443 - Data review for Topsites and Firefox Suggest

Status: RESOLVED FIXED

(Firefox :: Search, task)

Description

[Jeff Klukas [:klukas] (UTC-4)]

This bug replaces https://bugzilla.mozilla.org/show_bug.cgi?id=1694693 which became stale.

It depends on the privacy notice updates announced in https://groups.google.com/a/mozilla.org/g/governance/c/aB4aqww-9k0

The schemas involved have not changed since the original description 6 months ago in https://bugzilla.mozilla.org/show_bug.cgi?id=1694693 but the updated description here includes more detail about what populations will be sending which specific fields.

:chutten had made a comment that the request doesn't match documentation, but data collection is happening through several modes and the request includes multiple documentation links. In particular, some of this is covered in the urlbar data docs.

Comment 1

[Jeff Klukas [:klukas] (UTC-4)]

Attachment: datareview-topsites-suggest.txt

Comment 2

[Chris H-C :chutten]

Comment on attachment 9243782 [details]
datareview-topsites-suggest.txt

DATA COLLECTION REVIEW RESPONSE:

Is there or will there be documentation that describes the schema for the ultimate data set available publicly, complete and accurate?

Yes. It is documented in the newtab data docs, the urlbar data docs, and in the Telemetry Probe Dictionary.

Is there a control mechanism that allows the user to turn the data collection on and off?

Yes. This collection is Telemetry so can be controlled through Firefox's Preferences.
In addition, some of this collection (search terms) are presented opt-in through a dedicated control.

If the request is for permanent data collection, is there someone who will monitor the data over time?

Yes, Nan Jiang and the folks working on Contextual Services are responsible.

Using the category system of data types on the Mozilla wiki, what collection type of data do the requested measurements fall under?

Category 3, Stored Content and Communications.

Is the data collection request for default-on or default-off?

Default on for all channels. (excepting search terms which are default-off)

Does the instrumentation include the addition of any new identifiers?

No.

Is the data collection covered by the existing Firefox privacy notice?

Unknown. Passing up to Trust.

Does the data collection use a third-party collection tool?

No.

---

Result: datareview-, pending Trust review

Comment 3

[Chris H-C :chutten]

(For those observing who are unfamiliar with how these kinds of data reviews work: "data-review- pending Trust review" is the step all Category 3+ (potentially-sensitive) data goes through in order to make sure it's okay. What tends to happen next is Trust reviews the Request and Response, perhaps has some conversations, then chimes in here with a result that'll move this to either "data-review-, do not ship" or, more likely, "data-review+ given Trust's review")

Comment 4

[Nicole Shadowen]

SENSITIVE DATA REVIEW result linked here.
Please work with trust/legal to update based on the recommendation and publish final sensitive data review.

Comment 5

[Jeff Klukas [:klukas] (UTC-4)]

Work to provide the recommended mitigations is being tracked in SNT-37 which may result in a dot release.

Comment 6

[Chris H-C :chutten]

Attachment: sensitive data review

Attaching Sensitive Data Review for publishing. The mitigations as requested in this review are being pursued in SNT-37.

Comment 7

[Chris H-C :chutten]

Comment on attachment 9243782 [details]
datareview-topsites-suggest.txt

Collection's good with the proposed and tracked changes.