1791773 - Should event extras each have their own `data_sensitivity`?

Status: NEW

(Data Platform and Tools :: Glean: SDK, task, P4)

Description

[Chris H-C :chutten]

:Standard8 makes a good point that events can have a certain sensitivity, and that confers a certain categorization colour to its extras... but now that the glean_parser data-review template calls each extra out individually (cf bug 1767027) it might be a little overzealous. A (fictitious) example:

page:
  load:
    type: event
    ...
    extra_keys:
      eltd_plus_one:
        type: string
        description: The etld and one segment of the domain of the page loaded
      first_paint:
        type: quantity
        description: How long it took us to get from first byte to first paint.

The data_sensitivity of page.load is clearly web_activity. But the first_paint extra specifically is definitely not web_activity and is instead at most interaction (and more likely technical).

This bug is about discussing whether it is worth accepting an overriding data_sensitivity property on individual event extras (and using that information in glean_parser data-review and, optionally, Glean Dictionary), and then tracking any work that falls out from that discussion.

Comment 1

[Mark Banner (:standard8)]

(In reply to Chris H-C :chutten from comment #0)

This bug is about discussing whether it is worth accepting an overriding data_sensitivity property on individual event extras (and using that information in glean_parser data-review and, optionally, Glean Dictionary), and then tracking any work that falls out from that discussion.

A slightly different alternative would be to consider not including the data_sensitivity property on the individual event extra rows in the data-review, and only having it on the top-level event.

Comment 2

[Chris H-C :chutten]

In discussing the alternatives in the Glean SDK Weekly meeting, :standard8's recommendation of removing data_sensitivity values for extra keys in the data review template wins! (at least because there is no way to get at event extras without using the top-level event itself, meaning there's no actual "subatomic" data sensitivity to bother documenting) This bug is now about customizing the template.