Hi Denis, all

According to Article 3 of the RIPE Database Terms and Conditions, one of
the defined purposes for the use of the RIPE Database is "Facilitating
coordination between network operators".

A PERSON object is meant to contain the (business) contact information 
of people who are responsible for the networks the Internet number 
resources correspond to and/or for maintaining the related information 
in the RIPE Database and the DNS zone contacts.

If someone creates a PERSON object that is not meant for one of the
defined purposes, this would constitute a violation of the RIPE Database
Terms and Conditions (See Article 4.1.). It's also worth noting that 
PERSON objects that are not referenced in any other object (and thus do 
not serve any operational purpose) are automatically deleted after 90 days.

In general, personal data may only be processed in accordance with the 
relevant principles. If personal data is no longer required in relation 
to the defined purpose it was supplied/collected for, then its 
processing will not be justified any more.

However, depending on the information that is inserted when a ROLE 
object is created, it might contain personal data - this is something 
the RIPE NCC has no control over.

Kind regards,

Maria Stafyla
Legal Counsel
RIPE NCC

Hi Nick, Athina

Perhaps the RIPE NCC legal team can give us some advice on this issue. In your presentation at RIPE 76 you said the justification for personal data in the RIPE Database was for contacting people about operational issues. If many of these 2 million people whose personal data is held in the RIPE Database are not contacts, is there any legal justification for having this amount of personal data in the database?

Also if 'contacts' can be roles rather than identifiable people, can we justify holding this personal data simply because, historically, PERSON objects were used instead of ROLE objects?

cheers

denis

co-chair DB-WG

---

From: Nick Hilliard <nick@foobar.org>
To: denis walker <ripedenis@yahoo.co.uk>
Cc: DB-WG <db-wg@ripe.net>
Sent: Sunday, 7 October 2018, 14:56
Subject: Re: [db-wg] PERSON objects in the RIPE Database

denis walker wrote on 25/09/2018 23:55:
> So really the only question that must be answered is "Can we justify
> holding this amount of personal data on the basis of contacts for
> administrative and technical issues relating to internet resources and
> network operations?" If the answer is 'no' then change MUST happen, long
> before the universe dies.

I.e. "is what we have [...] legal"?

DBWG probably needs to get a legal opinion on this.

Nick