Hi Nick, Athina

Perhaps the RIPE NCC legal team can give us some advice on this issue. In your presentation at RIPE 76 you said the justification for personal data in the RIPE Database was for contacting people about operational issues. If many of these 2 million people whose personal data is held in the RIPE Database are not contacts, is there any legal justification for having this amount of personal data in the database?

Also if 'contacts' can be roles rather than identifiable people, can we justify holding this personal data simply because, historically, PERSON objects were used instead of ROLE objects?

cheers

denis

co-chair DB-WG

From: Nick Hilliard <nick@foobar.org>
To: denis walker <ripedenis@yahoo.co.uk>
Cc: DB-WG <db-wg@ripe.net>
Sent: Sunday, 7 October 2018, 14:56
Subject: Re: [db-wg] PERSON objects in the RIPE Database

denis walker wrote on 25/09/2018 23:55:
> So really the only question that must be answered is "Can we justify
> holding this amount of personal data on the basis of contacts for
> administrative and technical issues relating to internet resources and
> network operations?" If the answer is 'no' then change MUST happen, long
> before the universe dies.

I.e. "is what we have [...] legal"?

DBWG probably needs to get a legal opinion on this.

Nick