ed as personal. The authentication and reputation manager mechanisms are based on the calling party reputation as well as on the enhancing identity manage- ment of the SIP users and consequently they may imply the use of personal data. In the case of black/white lists, the SIP URL of the users is stored and consequently it could be used for indirect identification. The list of "friends" and "non-friends" are also stored by their URIs, revealing a user's personality and life profile. In the aforementioned cases the processing of personal data should be based either on the explicit consent of the user, as far as his data are processed, or on the protection his right to protect his privacy, which reg- ularly overrides the interests of the SPITter. Filtering tools may not be in compliance with the existing data protection legislation. Subscribers should keep the control over the information concerning them by having the possi- bility to opt out of SPIT detecting and the possibility to decide, what kind of spam should be filtered out. 19.8 Conclusions The SIP protocol raised significant concerns, as to whether SPIT will be equivalent to the current spam prevalence. In order to address and eval- uate these concerns, we addressed existing vulnerabilities of SIP for SPIT and proposed a SPIT identification framework. Additionally, we provided a macroscopic view of SPIT management techniques and mechanisms, alongside C 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security an extensive list of evaluation criteria that can be used for self-assessment against SPIT. Moreover, we presented a high-level and theoretical evalua- tion of the existing anti-SPIT mechanisms, and, finally we addressed the legal issues that are raised by the deployment of these candidate anti-SPIT mechanisms. References [1] McAfee Avert Labs. 2007. Top 10 threat predictions for 2008. [2] Asscher, L. V., and J. van Erve (IViR -Institute for Information Law). 2004. Regulating spam-directive 2002/58 and beyond. Amsterdam, 1