Hello again Jan, On 10/01/24 11:25, Jan Ingvoldstad wrote:
Basically, any public company register would be illegal according to the interpretation you lean on here.
Public company registries also need a lawful basis for processing. The Norwegian public company registry, for example, uses the lawful basis «exercise of official authority» – Article 6(1)(e) GDPR – as its lawful basis, see https://www.brreg.no/en/privacy-statement/. I would assume that to be the case in most other countries as well. (Most) LIRs are not official authorities, so unlike public company registries LIRs cannot use this lawful basis for publishing PII in the RIPE Database. In any case, all of this is rather off-topic. 2023-04 does not change the legal obligations on the LIRs relating to the publication of End User contact information, nor does it change the RIPE Database Terms and Conditions. If you want to publish PII in the RIPE Database, you need a lawful basis. That's true today, and that will continue to be true if 2023-04 passes.
Or you could take the other stance and stop publishing *any* contact details regarding an object, because you cannot know whether the information is personal data or not.
Exactly. LIRs may (but are not required to) chose this approach already *today*. This is a common and long-standing practice which the RIPE NCC has repeatedly clarified as compliant with today's policy. It will continue to be compliant with the policy after 2023-04 passes, as well. Thus, 2023-04 effects no change on the LIRs' obligations in this regard.
I think that because the WG discussion has almost exclusively revolved around this alleged changing of policy requirements to publish End User contact information (which may or may not be PII), it is easy to lose track of what this proposal is *actually* all about. We are talking about two different things:
1) The actual intention behind the proposal: Making it possible to aggregate multiple IPv4 End User assignments that have consistent contact information and purpose into a single database object. This is not possible today, and that is what we want to make that possible, in the same way it is already possible in IPv6.
2) The *alleged* change to what kind of End User contact information is required to be published in the RIPE database. We have never had any intention of changing this in any way, and the Impact Analysis and other statements from the RIPE NCC confirm that the proposal does not change it either.
In short: 1) is an intentional and desired change from today, while 2) is *not* a change from today – intentionally so.
This (regarding item 2) is simply not true. Any change in text *is a change*.
We are not making the claim that the policy text does not change. That it clearly does – in order to achieve the desired change described in item 1 above. We are however claiming that the *meanings* of the old and the new policy texts are exactly the same, with regards to how they translate into operational procedures and requirements for the publication of End User contact information (item 2). As the RIPE NCC writes in the Impact Analysis (emphasis added): «Acceptance of this proposal **will not change** the fact that the RIPE NCC cannot enforce which contact details members add to their IPv4 PA assignments in the RIPE Database; this **will remain** their decision.» So, once again: which End User contact details LIRs publish (if any) is their decision today, and it will be continue to be their decision if 2023-04 passes. Hence, 2023-04 does not effect any change in this regard.
So maybe we could discuss 1) instead of 2) going forward? :-)
I have no problem with 1), as already stated.
We're happy to hear that!
I do agree with you that this is distracting from the proper meat of your proposal. Which is why I suggest that you drop this part of it. Again, drop the part of the proposal that people have a beef with.
Don't make the change that you claim is not a change.
This «beef» is based on reading current policy to mean that which End User contact details LIRs publish in the database (if any) is *not* the LIRs' decision today. But the RIPE NCC has repeatedly clarified that that is simply not the case: it *is* the LIRs' decision today, and it will continue to be LIRs' decision should 2023-04 pass. Given that, it is hard to see how we could possibly amend the proposal to change this particular point to an even lesser extent than what is already the case? Tore & Jeroen