Ilya Grigorik wrote up a collection of thoughts about security and privacy as they relate to the design of performance APIs (mostly, the RUM-related ones). After some encouragement, he's started working on it as a Note: https://w3c.github.io/perf-security-privacy/