19.3 Client-side personally identifiable data storage
The New Zealand Web Standards 2.0 were released in March 2009 and replace the previous version, the New Zealand Government Web Standards 1.0 (below). See Meeting the standards for more information.
The Standard
19.3 No directly readable personal information is to be persisted on the device on which the user is hosting their browser (e.g. client machine such as a user’s personal computer).
Guide to this standard
'Directly readable personal information' refers to data that would be able to reveal identity of an individual (or individuals) solely via
- reading the data without the need to decrypt the data, and/or
- without combining with other (secure) data
For example, a user name that is encrypted, or a reference 'handle' (i.e., a session ID) that can link to more identifiable user details server-side are examples of data relating to personal details that does not reveal individual identity.
An example of information persisted on the device hosting a user's browser session is data persisted in a client-side cookie in the case of a user hosting their browser session on a personal computer.
If personal information is to be persisted within tracking data using only encryption, it is expected that the cryptographic module specification meets an acceptable level of security (refer FIPS-140, as a guide). Refer also to NZ Government Information Technology Security Manual NZSIT 400, chapter 9, which details approved cryptographic algorithms.
Note: As per recommendation 19.1.2, if it is necessary to maintain 'state', server-side session management should be used in preference to client-side session management.
Rationale for this standard
It is important not to inadvertently compromise the privacy of personal identity. Storage of personally identifiable information, for example in a cookie, can be insecure and is open to attack from malicious web sites and software, or can be read by other users who share use of a client device.
