Let me try to summarise a few points before we move on. 

Some numbers I have previously quoted have been questioned. Occasionally the RIPE NCC publish some anonymous statistics on the number of person objects related to member organisations. From these authoritative statistics it can be seen that the top entries on the list are member organisations who maintain hundreds of thousands of person objects. It is quite obvious these organisations do not have this many admin, tech and abuse contacts. These person objects relate to their customers.  We have about 2m person objects in the database.  It is clear that many of these person objects relate to customers and publish names and addresses.  We simply do not have 2m contacts in the RIPE region. 

Perhaps the RIPE NCC can publish the top entries from a new set of these stats. If anyone then wishes to contest the numbers they can take it up directly with the RIPE NCC. 

After all the discussions in recent years on data quality,  I find it hard to believe that anyone can seriously promote the deliberate entering of false data into the database. If that is being presented as a serious solution to an issue, there is clearly a problem that needs to be solved. 

The problem is the privacy concerns of entering a full postal address of a member or end users home. This address is not required to fulfil the purposes of the RIPE Database. Even if it was, the exception in Article 6.1.f of the GDPR allows a data subjects rights to override the legitimate interests of the data controller. 

It's also been questioned about breaking down the 'personal data' into it's components. This is a mistake we have made over the last 15 years of discussing privacy issues. Personal data is an umbrella term. Taken as a block you can argue that the database purposes justify the processing of personal data. When you look at the components of personal data, it is clear that the purposes do justify processing the name, phone and email data. They don't justify publishing the full home address of members and end users. Each element of personal data must therefore be validated against the purposes. 

It has also been questioned if we should allow all the elements of a postal address to be optional for resource holders in the organisation object, including the country they are based in. Let's be clear on the facts here. The legal country that the member is based in is documented by the country attribute which is maintained and verified by the RIPE NCC. This unverified postal address is maintained by the member and by definition relates to any business contract who can be based anywhere in the world. It has little, if any, value to anyone outside of the organisation. 

Cheers

denis