Hi Denis,
On 12 Nov 2021, at 14:27, denis walker <ripedenis@gmail.com> wrote:
Hi all
In the Legal Review it seems to assume that for assignments "that are reasonably assumed to be related to one individual user", that user is a natural person. A /32 can be a business.
There is a suggestion to allow geofeed for registrations over a certain size. What is the implication of this suggestion? Will the update software only allow the "geofeed:" attribute in the larger assignment objects?
The legal advice is to enforce a minimum prefix size for geofeed, in order to minimise the RIPE NCC's responsibility to make sure that personally identifiable information is not added to the RIPE database. This needs to be enforced in software, rather than leaving it to the maintainer's discretion.
The update software is not going to validate the contents of the referenced URL. So a "geofeed:" attribute on a /24 (or larger) assignment object may reference a URL that contains geolocation data relating to a more specific /32. So are we saying the legal review is offering 'guidance' to resource holders not to include geolocation data for assignments smaller than /24, but the responsibility/liability is on the resource holder?
We previously decided in the implementation plan not to validate the contents of the geofeed: URL as it is not hosted in the RIPE database. The content of any external data source is the maintainer's own responsibility.
I can see the logical argument behind the legal comment, but I don't see the practicality of monitoring or enforcement of this argument.
cheers denis co-chair DB-WG
Regards Ed Shryane RIPE NCC