19.4 Encryption of personal information in tracking data
New standards released
The New Zealand Web Standards 2.0 were released in March 2009 and replace the previous version, the New Zealand Government Web Standards 1.0 (below). See Meeting the standards for more information.
The Standard
19.4 If encryption of personal information is the sole method used to prevent the information revealing identity for personal information persisted within tracking data as required in standard 19.3, the cryptographic specification of the encryption must meet an acceptable level of security. This can be met by utilising an approved cryptographic algorithm.
Refer to 9-4-encryption-of-personal-information-in-tracking-data/#mce_temp_url#">NZ Government Information Technology Security Manual NZSIT 400 chapter 9, for details of approved cryptographic algorithms.
Refer to FIPS-140 for further guidance.
Guide to this standard
It is not recommended that personal information be persisted in any nature within tracking data on the device on which the user is hosting their browser (e.g. client machine such as a user's personal computer).
Rationale for this standard
It is important not to inadvertently compromise the privacy of personal identity. Storage of personally identifiable information, for example in a cookie, can be insecure and is open to attack from malicious web sites and software, or can be read by other users who share use of a client device.
