Dear TF members, Here are the minutes from our last call. Cheers Kjerstin *** 23 November 15:00 (UTC+2) Attendees: Denesh Bhabuta, Athina Fragkouli, Leo Vegoda, Salam Yamout Scribe: Kjerstin Burdiek Summary: The CoC TF discussed various updates to the document, especially in the sections on risk. Athina shared what the RIPE NCC’s Legal team had added to the document to address potential risk areas for CoC Team members. They had made changes to the section on data retention, updating the time periods, purposes and maximum time limit for data retention. This was to ensure compliance with laws about personal data retention in most jurisdictions, including those outside of the Netherlands. Athina also shared the Legal team’s changes to the section granting the shadow team access to data in reports, which she said was covered under the purpose of training to better evaluate future reports. The group also considered whether a clause might be needed to indemnify CoC Team members against possible legal damages. Athina said this could be added to the terms and conditions of meeting registration, and she would look into whether it would be possible to include this in other communications channels. Finally, the group reviewed other updates to the document made by the RIPE NCC. One update still needed to be considered regarding whether the RIPE Chair could overturn a CoC Team decision during an appeal. Leo would speak to the RIPE Chair Team about this and report back next time. 1. Minutes The minutes from the last meeting were approved. 2. Agenda There were no changes to the agenda. 3. Actions -(Ongoing) TF to think about how the CoC Team and the WG Chairs would work together to manage discussions on mailing lists. Including tools, e.g. Mattermost channel This action remained ongoing but would be picked up by the CoC Team. -Athina to investigate the scale of risk that data might be needed in a court. This action was completed. The RIPE NCC’s Legal team had reviewed this risk and updated the section on data retention in the process document. Athina shared the changes in the draft with the group. These changes included new periods for data retention to account for the possibility of litigation. The section had also been revised to include all the purposes for retaining personal data. The text outlining the data retention process for different types of data had been removed and replaced by a more general provision explaining that data would be retained for as long as needed to fulfil the purpose of assessment. This retention could be for up to five years, except in cases where there were legal requirements to retain data for longer. The limit was set at five years as this time period met the statute of limitations in most jurisdictions. Denesh asked whether this specifically addressed GDPR requirements. Athina said it did not. The section was intended to address potential litigation in other jurisdictions. Denesh asked if this meant jurisdictions outside of the Netherlands. Athina said yes, as RIPE events could take place in other countries, which could lead to litigation in these places. -Athina to review language over data retention, training and the broader team. This action was completed. Athina said that as the shadow team was still part of the CoC Team and just looking at reports for training purposes, it was acceptable under the purposes of data retention for them to view the reports. They were also covered to use reports as a reference for how to make future assessments. The RIPE NCC Legal team had updated the text to reflect this. -Athina to evaluate the risk of discovery in common-law jurisdictions and what language is needed in communications templates. This action remained ongoing. -RIPE NCC to draft a section about the importance of the RIPE Chair’s judgment when selecting a CoC Team and the importance of the quality of the CoC Team’s training. This action was completed. -RIPE NCC to review appeals text and clarify that the RIPE Chair is the final stage of appeal. This action was completed. -Athina to update the sections on data protection and legal protection for the CoC Team. This action was addressed in the agenda item on risk. 4. Risk Athina noted that what remained to be addressed was the risk of a discovery process in common-law jurisdictions. This could affect what templates the CoC Team would need to use in its communications, although the process document was not likely to be affected. Leo asked if the TF had yet covered how the CoC Team would be indemnified against potential legal action. Athina said this could be accomplished through adding a disclaimer in the terms and conditions for meeting attendees. This did not necessarily need to be in the process document. Leo asked if it would be wise to include some reference to it in the document. Athina said the group could do so, but putting it in the process document did not fully bind meeting attendees to agree to this clause. Only including it in terms and conditions that attendees had to explicitly agree to could provide legal indemnity. Leo asked if they could include a similar clause for community members when they communicated through other means, such as Zoom or Mattermost. Athina said this would be difficult. These were completely different fora that did not even require agreement with the CoC. Leo said the CoC should cover all forms of participation in the RIPE community. He asked the Legal team to look into which fora could have terms and conditions for community members to agree to when communicating. This would further reduce the legal risk for the CoC Team members. Salam asked if the CoC Team members would also be remunerated. Athina said they would not. Leo said the CoC consultant had advised that team members should receive some form of support, such as for travel to meetings and meeting registration, just like WG Chairs did. 5. Document Updates Kjerstin shared the updates the RIPE NCC had made to the process document, including a new section on the importance of the RIPE Chair’s judgement in selecting team members and the significance of the training they received. Another change had been made to reflect that anonymous reports would not be evaluated to the same extent as reports with names. The section about appeals had also been updated to state more clearly that the RIPE Chair was the final reviewer in the appeals process. Leo suggested some language clarifying that the RIPE Chair could make a different decision than the CoC Team when reviewing an appealed case if the Chair found that the assessment process had not been properly followed. Salam said it was better to leave this ambiguous as the RIPE Chair should not overrule decisions, just confirm that the process had been followed. If it had not, the Chair should turn the case back to the CoC Team, possibly with different team members, to re-do the assessment. Leo said it would be too much of a burden on all parties involved to ask the CoC Team to go through the whole process again. It would also take too long to train new team members to review a case. Salam said this made sense, but they still should not state in the text that the RIPE Chair could overrule decisions. Leo said he would follow up with the RIPE Chair Team for their thoughts on this. 6. AOB There was no other business. 7. Actions -Athina to evaluate the risk of discovery in common-law jurisdictions and what language is needed in communications templates. -RIPE NCC to look into including a clause indemnifying CoC Team members for communications in apps including Mattermost and Zoom. -Leo to follow up with the RIPE Chair Team about whether the RIPE Chair should be able to overturn a decision in an appeal.