Hi Nick I'll give you the short answers first, then the detailed reply. So people who don't like to read long emails can skip the detail. On Sun, 19 Jun 2022, 16:06 Nick Hilliard, <nick@foobar.org> wrote:

denis walker via db-wg wrote on 16/06/2022 16:05:

...

I have listened to your comments in recent discussions and had some preliminary talks with the RIPE NCC about what could be implemented. So now we have a second version of my proposal on personal data.

There are some fairly serious structural issues with the justification in this proposal, for example:

- that there's something new with GDPR that wasn't there before

These issues have always been there. GDPR focused our minds on them in recent years. - that the RIPE database is not GDPR compliant

It isn't. - repeated claims that "In almost all cases, personal data is not needed".

It isn't. - etc

Please expand if you want me to reply.

GDPR, and previously the 1995 Data Protection Directive, has been addressed continuously by the RIPE NCC over the years.

No it hasn't. The first time it was considered was by the task force in 2006. They concluded in 2009. Nothing much was then discussed until GDPR came into effect in 2018. There are some

blog posts on the RIPE NCC web site which provide an overview of the current lawful basis for holding and publishing the information:

...

https://www.ripe.net/about-us/legal/corporate-governance/gdpr-and-the-ripe-n...

These blogs were written over 4 years ago and have quite a number of open issues outstanding. So in the absence of firm reasoning to the contrary, this policy needs

to step back quite far from claiming or hinting at GDPR non-compliance.

Read the detail below for the firm reasoning...

There are numerous other cases where the current justification presents opinions without providing an adequate factual basis.

Please highlight these opinions and I'll offer the factual basis.

Incidentally, I'm not arguing that there shouldn't be changes to the scope and style of information contained in the ripe database, but as it stands, the scope of this policy proposal isn't justified by the rationale provided.

Again, please elaborate and I'll expand on the rationale.

Nick

Now the detailed answers. Let me firstly disclose my interest here. I was a RIPE NCC staff member of the Data Protection Task Force (DPTF) from start to finish. Unlike with the recent Database TF, I wasn't just an advisor. Jochem and I were full and active members of the TF. At the start of the DPTF work, the RIPE NCC had no legal team. We worked with the NCC's external lawyers, who had limited knowledge of the RIPE Database. I drafted the early versions of the RIPE Database Terms & Conditions, Acceptable Use Policy, NRTM and Bulk Access Agreements and much of the Database content of the DPTF report. Towards the end of this work the NCC had a legal council and I worked with Jochem and Athina on final drafts of these documents before community and EB approval. So I have a good knowledge of what is in these documents, the context in which they were created and the mistakes (that still exist) in them. You referenced a series of RIPE Labs articles on GDPR. These articles referenced the DPTF Report. These contain some interesting points, and some errors, partly as a result of the errors in the DPTF report. Bear in mind also that these labs articles were all written over 4 years ago and the DPTF report over 10 years ago. Knowledge and understanding of the issues has increased in this time. 1st labs article ---------------- "In 2005, the RIPE Database Working Group identified a need to comply with data protection legislation by updating the processes and services relating to the RIPE Database. At RIPE 52 in April 2006, the community established the RIPE Data Protection Task Force (DPTF). The DPTF was mandated by the RIPE Database Working Group to recommend steps that the RIPE NCC should take to comply with the legislation." This was the first time the RIPE NCC and community considered privacy and personal data issues. It was a good starting point, but we were a bit naive and the external lawyers had little knowledge of the database. That is why some errors were made and these errors have been duplicated ever since. "According to the Dutch Personal Data Protection Act (prior to the GDPR), personal data may be collected for specific, explicitly defined and legitimate purposes. Once collected, this data must: -Be adequate, relevant and not excessive in relation to the purposes for which it is collected and further processed -Be accurate and, if necessary, kept up-to-date" The big mistake we made was to consider 'registration information' and 'personal data' as single entities. So when looking at the purposes of the database and asking the question "do the purposes allow for the processing of personal data" as a single entity, the answer was yes. But when you break down that personal data, single entity into components the answer is yes and no. The primary purpose of the database is as a public registry of 'who' holds or uses blocks of address space. The key is in the alternative name, 'whois database'. So yes the purposes do justify publishing names. Even for natural persons, there is justification for publishing the names. As a contact database to resolve network issues the purposes also justify processing phone numbers and/or email addresses. BUT none of these need to be personal. In fact in the second labs article it even stresses the business nature of this information. Now when it comes to (postal) address, this is where it is crucial to break down this personal data into components. By definition the postal address of resource holders is "a full postal address for the business contact related to the organisation holding the resource". By this definition this contact can be anyone located anywhere in the world. It has no 'relevance in relation to the purposes'. It also cannot be verified as accurate or up-to-date. Therefore it cannot be justified to be processed according to the purposes, where it is a personal address, under either the Dutch Personal Data Protection Act or the GDPR. 2nd labs article ---------------- "The contact details of a resource holder and their appointed contact persons consist of names, (business) email addresses, (business) phone and fax numbers, and (business) postal addresses." Although broken down here into components and the business nature of the data is stressed, the individual components were not compared with the purposes. "The purpose must be specified, explicit, and legitimate. Personal data may only be collected and processed to fulfil this purpose and must not be further processed in a way that is incompatible with this purpose." Again when personal postal address is compared to the purpose, it cannot be justified. "The purpose described in the third bullet point of Article 3 of the Terms & Conditions "Facilitating coordination between network operators (network problem resolution, outage notification etc.)" is the one that justifies the publication of personal data in the RIPE Database. For this reason, the RIPE Database includes the contact details of resource holders and persons that are responsible for the administration and the technical maintenance of a particular network." These statements are not correct. This need to coordinate between operators does not require any personal data. Contact details of persons is not needed. Contact details can all be business related information. 3rd labs article ---------------- [I am going to disagree with most of this...I have added my comments inside [...] ] Legal grounds for lawful personal data processing In order for the processing of personal data to be lawful, it must be done on a legitimate basis, as defined in Article 6.1 of the GDPR: Processing shall be lawful only if and to the extent that at least one of the following applies: [So which of these apply to the personal data in the RIPE Database?] (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; [Consent is difficult to verify in a database with such a widely distributed data entry. Better not to enter data that is not needed for the purposes, even if consent is given.] (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; [This covers some components of personal data, such as name of resource holder or end user.] (c) processing is necessary for compliance with a legal obligation to which the controller is subject; [Does not apply.] (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; [Does not apply.] (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; [This covers some components of personal data, such as name of resource holder or end user.] (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. [This one is interesting as the exception recognises that, if publishing the home address of resource holders or end users is against the interests of the data subject, that overrides the database purposes.] Personal data of a resource holder As our previous article mentioned, the RIPE NCC has a mandate from the RIPE community to register and distribute Internet number resources and maintain an Internet number resource registry. While the RIPE community defined the purposes of the RIPE Database, the RIPE NCC is responsible for operating it. [The RIPE community is not a legal authority. It cannot mandate the RIPE NCC to force natural persons to publish their full home postal address in the database, especially as this address is not relevant to the defined purposes.] The RIPE Database contains registration information about Internet number resources and, in particular, information about the natural or legal persons that hold these resources. The contact details consist of (legal) name, (business) email address, (business) phone and fax numbers, and (business) legal and postal address(es). [This mixes registration information with contact details. They are not the same. Legal address is not held in the RIPE Database. The definition of the postal address makes it not relevant to the defined purposes.] Contact details of the parties responsible for specific Internet number resources are essential for the smooth and uninterrupted operation of Internet and connectivity. The RIPE Database facilitates communication between the people responsible for networks to address technical issues, allowing for quick coordination between operators that do not have a direct relationship. [This paragraph mixes 3 terms, parties, people and operators. Bottom line is, personal data is not needed for contacts.] For the purpose described above, it is clear that the processing of personal data referring to a resource holder is necessary for the performance of the registry function, which is carried out in the legitimate interest of the RIPE community and the smooth operation of the Internet globally (and is therefore in accordance with Article 6.1.f of the GDPR). [The postal address of resource holders, as defined, is not relavant to the purposes and therefore not in accordance with the GDPR. It also comes under the exception stated in Article 6.1.f above] Personal data of a resource holder's contact person When resource holders are legal persons, they must provide contact details for the individuals responsible for the networks the Internet number resources correspond to, and/or responsible for maintaining information in the RIPE Database. This is also the case for resource holders that are individuals but do not want to have this role themselves. [Not correct. These contacts do not need to be identifiable persons for the purposes of the database.] The contact details usually refer to the technical and administrative employees of a resource holder and consist of names along with a (business) email address, phone, fax number and postal address. [Only business details are needed and no address is needed for a contact.] The purpose for which personal data is requested and made publicly available in the RIPE Database is always the same: ‘Facilitating coordination between network operators (network problem resolution, outage notification etc.). [Absolutely not correct. This purpose does not require any personal data.] In order for consent to serve as the legal ground of a processing activity, the resource holder must be able to demonstrate that the individual has consented to the processing of their personal data... [Consent is a murky area in a database with such a widely distributed data entry responsibility. It is possible to have multiple levels of sub-allocations. Each level introduces another layer of data entry, further removed from the RIPE NCC and resource holders. The data quality and responsibilities may be diminished with each level. Where personal data is not necessary for the purposes, it is better to avoid it rather than allow sporadic consensual data.] DPTF Report ----------- The Dutch Data Protection Act includes the definition: "Personal data is any information relating to an identified or identifiable natural person." So the term 'Personal Data' is an umbrella term for all pieces of personal information. It makes sense to use this umbrella term in some situations. But when considering if the database purposes cover the processing of 'personal data', this must be broken down into it's component pieces of information and each piece needs to be assessed against the purposes. "The data subject has the right to request that the responsible party correct or delete their personal data." In order for the data subject to be able to exercise this right, they must be given details of what personal data is processed and where to find it. It is not sufficient to sign a contract that mentions that personal details will be published in 'the RIPE Database' or 'some database'. cheers denis Proposal author

Colleagues Let me try to summarise a few points before we move on. Some numbers I have previously quoted have been questioned. Occasionally the RIPE NCC publish some anonymous statistics on the number of person objects related to member organisations. From these authoritative statistics it can be seen that the top entries on the list are member organisations who maintain hundreds of thousands of person objects. It is quite obvious these organisations do not have this many admin, tech and abuse contacts. These person objects relate to their customers. We have about 2m person objects in the database. It is clear that many of these person objects relate to customers and publish names and addresses. We simply do not have 2m contacts in the RIPE region. Perhaps the RIPE NCC can publish the top entries from a new set of these stats. If anyone then wishes to contest the numbers they can take it up directly with the RIPE NCC. After all the discussions in recent years on data quality, I find it hard to believe that anyone can seriously promote the deliberate entering of false data into the database. If that is being presented as a serious solution to an issue, there is clearly a problem that needs to be solved. The problem is the privacy concerns of entering a full postal address of a member or end users home. This address is not required to fulfil the purposes of the RIPE Database. Even if it was, the exception in Article 6.1.f of the GDPR allows a data subjects rights to override the legitimate interests of the data controller. It's also been questioned about breaking down the 'personal data' into it's components. This is a mistake we have made over the last 15 years of discussing privacy issues. Personal data is an umbrella term. Taken as a block you can argue that the database purposes justify the processing of personal data. When you look at the components of personal data, it is clear that the purposes do justify processing the name, phone and email data. They don't justify publishing the full home address of members and end users. Each element of personal data must therefore be validated against the purposes. It has also been questioned if we should allow all the elements of a postal address to be optional for resource holders in the organisation object, including the country they are based in. Let's be clear on the facts here. The legal country that the member is based in is documented by the country attribute which is maintained and verified by the RIPE NCC. This unverified postal address is maintained by the member and by definition relates to any business contract who can be based anywhere in the world. It has little, if any, value to anyone outside of the organisation. Cheers denis

On Thu, 23 Jun 2022, 12:27 Nick Hilliard, <nick@foobar.org> wrote:

denis walker via db-wg wrote on 22/06/2022 23:54:

...

Perhaps the RIPE NCC can publish the top entries from a new set of these stats. If anyone then wishes to contest the numbers they can take it up directly with the RIPE NCC.

fwiw, the ripe ncc has consistently been clear that there is a handful of organisations who export very large quantities of registration information to the ripedb, so this issue is not particularly in question.

Yes you are right Nick. Probably the top ten member organisations are responsible for half the 2m person objects. But that still leaves another 1m person objects entered by everyone else. Cheers denis Proposal author

Nick

On Fri, 24 Jun 2022, 01:40 Ronald F. Guilmette via db-wg, <db-wg@ripe.net> wrote:

In message <e7ddcc2c-3d1a-2fbc-8d3e-5472679ad842@foobar.org>, Nick Hilliard <nick@foobar.org> wrote:

...

...

Perhaps the RIPE NCC can publish the top entries from a new set of

denis walker via db-wg wrote on 22/06/2022 23:54: these

...

stats. If anyone then wishes to contest the numbers they can take it up directly with the RIPE NCC.

fwiw, the ripe ncc has consistently been clear that there is a handful of organisations who export very large quantities of registration information to the ripedb, so this issue is not particularly in question.

There are multiple obvious problems with this line of argument/reasoning/logic.

First and foremost, if in fact there exist such telecom companies, then -somebody- should be able to give us their names. I'm still waiting. I haven't seen -any- names of any such supposed telecom companies yet.

AFAIK the names of these organisations is not public information, only anonymous statistics have been published. If you have an issue with this I suggest you discuss it directly with the RIPE NCC legal team.

Second as was previously discussed, responsiblity, both legal and otherwise, for any unnecessary "leakage" of PII under GDPR belongs to the party that first leaked the data. So if some telecom company is carelessly shoveling their customer PII into the RIPE data base in a way that is not consistant with GDPR then the entire legal responsibility for that belongs to the telecom companies involved... *not* to RIPE. It is therefore quite obviously false to continue to insist that RIPE needs to take some action because of these specific companies or these specific WHOIS records. It doesn't.

This policy proposal is not about managing the legal responsibilities or liabilities of the RIPE NCC. It is about establishing a set of principles by which those who enter data into this database will manage personal data.

Third and lastly, underlying these arguments is a sort-of implicit and unspoken assumption that simply is not true and that can quite easily disproven, i.e. the obviously flawed assumption that the RIPE region is synomymous with the EU and/or the EEA and that thus, GDPR applies throughout the RIPE region. It doesn't.

The RIPE NCC is the data controller and is a Dutch organisation based in the EU. The RIPE Database is operated from servers within the EU. GDPR therefore applies to all data subjects within this database regardless of where they are located. Article 3.1 of the GDPR states: "This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not."

In addition to such notable and significant countries as Russia, Ukraine, and Turkey, it appears that there exist a whole raft of other countries also that are -in- RIPE but -outside- of EU/EEA, for example Aland Islands, Albania, Andorra, Armenia, Azerbaijan... and that's just the As! I'm sure that there are plenty more also. Companies and natural persons in these countries are not bound by GDPR, despite the fact that some would wish it to be so. Thus companies and persons outside of EU/EEA remain free to put whatever they like into the RIPE WHOIS data base, and RIPE is free to publish whatever they do put in there, as has already been discussed and agreed here. (Note that the Personally Identifiable Information involved in many of these cases will pertain to natural persons who themselves reside -outside- of the EU/EEA area, and GDPR is simply not applicable to the PII of any such persons.)

There are Russian lirs who provide address space and services to end users based in the Netherlands. Internet operations and business are not bound by geographical, political or legal jurisdictions. Cheers denis Proposal author

I understand the desire of some in Europe to impose GDPR upon the entire rest of the world, and onto all persons and companies from Alaska to Zanzibar, but wishing does not make it so. RIPE is free, morally, ethically, and legally to publish *my* phone number any time it wishes, as I am an American, and thus not a subject of the GDPR regime, and also not least because I myself have, in the first instance, made my own phone number public in my own domain WHOIS records, thus relieving any and all parties of any legal responsibility, under GDPR, for any mere re-publication of this Personally Identifiable Information.

Regards, rfg

--

To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/db-wg

Ron, Ronald F. Guilmette via db-wg wrote on 24/06/2022 00:40:

Second as was previously discussed, responsiblity, both legal and otherwise, for any unnecessary "leakage" of PII under GDPR belongs to the party that first leaked the data. So if some telecom company is carelessly shoveling their customer PII into the RIPE data base in a way that is not consistant with GDPR then the entire legal responsibility for that belongs to the telecom companies involved... *not* to RIPE.

the RIPE NCC is a GDPR joint controller of the PII published in the ripedb. This is acknowledged by the RIPE NCC:

With regards to the RIPE Database, the RIPE NCC fills the role of “Data Controller” - that is, the entity legally responsible for all personal data stored in the RIPE Database.

From: https://labs.ripe.net/author/athina/how-were-implementing-the-gdpr/

Third and lastly, underlying these arguments is a sort-of implicit and unspoken assumption that simply is not true and that can quite easily disproven, i.e. the obviously flawed assumption that the RIPE region is synomymous with the EU and/or the EEA and that thus, GDPR applies throughout the RIPE region. It doesn't.

there is no assumption, implicit or otherwise, that the RIPE service region is synonymous with the EU. However, as the RIPE NCC is legally constituted and operates in The Netherlands, it is subject to dutch and EU law. If you explicitly give consent for them to publish your personal information, that's fine. As this information is published in NL, your PII is subject to Dutch and EU law, and is therefore subject to the GDPR. In addition to your right to provide consent to publish your PII, you have lots of other rights, including the rights of access, rectification, restriction, and others. If you're concerned by the fact that your PII is now subject to the GDPR, perhaps you'd like to exercise your right of erasure? Nick

In addition to such notable and significant countries as Russia, Ukraine, and Turkey, it appears that there exist a whole raft of other countries also that are -in- RIPE but -outside- of EU/EEA, for example Aland Islands, Albania, Andorra, Armenia, Azerbaijan... and that's just the As! I'm sure that there are plenty more also. Companies and natural persons in these countries are not bound by GDPR, despite the fact that some would wish it to be so. Thus companies and persons outside of EU/EEA remain free to put whatever they like into the RIPE WHOIS data base, and RIPE is free to publish whatever they do put in there, as has already been discussed and agreed here. (Note that the Personally Identifiable Information involved in many of these cases will pertain to natural persons who themselves reside -outside- of the EU/EEA area, and GDPR is simply not applicable to the PII of any such persons.)

Zanzibar, but wishing does not make it so. RIPE is free, morally, ethically, and legally to publish *my* phone number any time it wishes, as I am an American, and thus not a subject of the GDPR regime, and also not least because I myself have, in the first instance, made my own phone number public in my own domain WHOIS records, thus relieving any and all parties of any legal responsibility, under GDPR, for any mere re-publication of this Personally Identifiable Information.

Regards, rfg

NOTE: Some or all of the following may perhaps have been rendered moot by the just-posted response of Sylvain Baya <abscoco@gmail.com> in this thread, but I'd like to get this all on the record anyway, especially since I spent over a hour composing it. :-) In message <d565baed-9c34-0ba5-9f8a-55b8c078d718@foobar.org>, Nick Hilliard <nick@foobar.org> wrote:

the RIPE NCC is a GDPR joint controller of the PII published in the ripedb. This is acknowledged by the RIPE NCC:

...

With regards to the RIPE Database, the RIPE NCC fills the role of “Data Controller” - that is, the entity legally responsible for all personal data stored in the RIPE Database.

From: https://labs.ripe.net/author/athina/how-were-implementing-the-gdpr/

This assertion, that RIPE is a "controller" under the GDPR, is simply wrong, at least with regards to these alleged millions of personal end-customer records that are alleged to have been stuffed into the RIPE WHOIS data base by these various alleged telecom companies, and or by any other third- party that sits between the natural person(s) whose PII is at issue and RIPE. Note that Ms. Fragkouli's assertion, as quoted above, is stated without any caveats or qualifications of any kind, and also without any reference to the actual text of GDPR, and lastly also without citation to any other statutory authority or to any existing case law. This is a perfect example of what I have been ranting about. Without any firm basis in either law or precedent it appears that Ms. Fragkouli, and others, have persuaded themselves that secrecy is a Good Thing and that thus, any excuse that may come to hand that may seem to permit even more excessive, arbitrary, and capricious secrecy must be, by definition, a Good Thing. I take issue with this viewpoint, which is arguably extreme, and I challenge both Ms. Fragkouli and any and all other parties to provide here the factual and legal basis they are claiming as support for this clear misinterpretation of the fundamental terms of reference of the actual GDPR legislation, as differentiated from the personal views of Ms. Fragkouli or any other member of the community. (A modest suggestion: It would perhaps be Helpful if some of the membership debating this issue would actually read the GDPR legislation, rather than simply speculating about what it actually says.) Again, to be clear, it is possible that RIPE may qualify, under the terms of reference of GDPR, as the data "controller" in those instances where there is no third party sitting between the natural person whose PII is at issue and RIPE, however even in those cases it is my assertion that the actual legal applicability of GDPR may be tempered by the explicit terms of the contractual relationship between the parties. In any and every case where there _is_ some third-party sitting between RIPE and the natural persons whose PII is at issue, I do not believe that there can be any question whatsoever that RIPE is not the data "controller", for purposes of GDPR, and that thus, RIPE bears no leagl responsibility of any kind in these instances.

If you explicitly give consent for them to publish your personal information, that's fine.

Now you are just playing with words. I _did not_ "explicitly" give consent to RIPE to publish any of my personal information. I simply included my personal information into an email message which was sent to this mailing list. Nontheless, subsequent to that RIPE _did_ in fact publish my private information. So now, do I have a legal cause of action against RIPE? Can I now sue RIPE for millions of dollars? Because that is one obvious possible implication of your use of the ever-so-maleable word "explicitly".

As this information is published in NL, your PII is subject to Dutch and EU law, and is therefore subject to the GDPR.

No, it isn't, and you are making the mistake of assuming, without any supporting evidence or any legal basis I might add, that GDPR applies to either natural persons or to data controllers that exist extirely outside of GDPR's legal jurisdiction (i.e EU+EEA). This is simply false, and GDPR does not have such broad extra-territorial jurisdiction over either natural persons or data controllers that exist entirely outside the GDPR jurisdictional region. (This is also one of my several pet peeves that I have been ranting about. I understand that there is a lot of wishful thinking associated with various bits of public speculation about the actual jurisdictional limits of GDPR, but the legislation just doesn't say either what many think it says or what many would like it to say.) In the example of my prior posting here I included some of my own PII. I am (and was) the "data controller" for purposes of GDPR with respect to that specific instance of "leakage" of my PII... not RIPE. To assert otherwise is to demonstrate a clear misunderstanding of the fundamental terms of reference of GDPR. And that misunderstanding becomes obvious when the legal implications of this misinterpretation of the term "controller" are adequately contemplated and found to lead to patently absurd practical outcomes. I cannot in fact sue RIPE over the fact that it has published my PII for all the world to see because as I have said, RIPE is not the controller in this example. Indeed, under the very explicit and specific terms of GDPR, I cannot even sue myself for having leaked my personal PII for the following TWO reasons: 1) I am a natural person residing outside of GDPR's jurisdiction, and thus, my own PII is not something that GDPR even has anything at all to say about. 2) I am (and was), for purposes of GDPR, the data "controller" when I posted my PII to this list. As a data controller which itself resides entirely outside of the GDPR jurisdictional area, GDPR does not provide me, as a natural person, with any grounds to sue myself, as a data controller, because the "data controller" is outside of GDPR's physical/territorial jurisdiction. If one of you Europeans gives your PII to some company that has a physical presence only in, say, Russia, or Ukraine, or Turkey, or Azerbaijan, or the United States for that matter, and if that company then splatters out PII all over the Internet, GDPR does not provide you with any basis for legal action. In summary, there has been and continues to be a great deal of mistaken misinformation and misinterpretation of the actual text of the GDPR legislation, much of which would lead to obviously absurd outcomes if taken seriously. These misinterpretations relate not only to the basic terms of reference, e.g. "controller", but also to the actual jurisdictional limitations and constraints of GDPR with respect to persons, places, entities and data. GDPR is not actually quite so boundless with respect to any of these things as some would wish, and mere misinterpretations of GDPR should not and cannot be used as a justification for ill-founded RIPE policies. Regards, rfg P.S. In order to forestall the inevitable assertions that I have herein been a sexist pig, or that I have in any way unfairly picked on Ms. Fragkouli or her expertise, I will say now quite plainly that all she has done is to write and publish a single somewhat overbroad sentence (quoted again above) regarding the applicability of GDPR to RIPE, and that one sentence is correct in some contexts, even as it is incorrect or inapplicable in others. For the sake of brevity, I assume, Ms. Fragkouli failed to attach to that one sentence relevant and important caveats which would qualify the sentence. More recently, and since the time Ms. Fragkouli wrote and published that one sentence, it has been others who have postulated what I believe to be incorrectly expansive interpretations of Ms. Fragkouli's single sentence on this topic. She is surely not not to blame in any way for these subsequent and arguably agressive misinterpretations.

Dear RIPE DB-WG, Hope this email finds you in good health! Please find my comments below, inline... Thanks. Le lundi 27 juin 2022, denis walker via db-wg <db-wg@ripe.net> a écrit :

Colleagues

There were 2 very long emails this weekend, both

Hi Denis, Thanks for your email, brother.

pretty much along the same lines. These points have been made several times. I believe I

Sure, you tried...and thanks brother, it helped me to better understand two or three things along...

have adequately addressed these points in my earlier reply here: https://www.ripe.net/ripe/mail/archives/db-wg/2022-June/007482.html

...i went through it again, and it appears to not satify me, though :-/ What i understand is that your understanding of the actual state of the RIPE DB compliance with GDPR diverge to the public statement of RIPE NCC's Legal Team, on the same topic... :-/ Given that you have a very insightful point of view on the topic, i ask myself, what could justify that *unexpected* divergence?

Now let's try to wrap this issue up with a reality check. In the text of the proposed policy, GDPR is not mentioned anywhere.

Right! but, who said it's part of the draft proposal to be implemented; if it reaches consensus?

The opening two lines of the proposed policy Abstract basically sum up what this proposed policy is about: "This policy arises from the need for the RIPE Database to avoid the publishing of unnecessary personal data. Personal data must not be entered into the RIPE Database unless this can be justified according to the acknowledged purposes of the RIPE Database."

...who have first invoqued [1] the GDPR regulatory framework? <quote> "Summary of Proposal: Since the beginning of the RIPE Database, personal data has been entered extensively in PERSON objects as well as in other objects’ attributes in the database, such as email addresses for notifications and postal addresses for resource holders. In those early days little consideration was given to privacy and personal data processing. In almost all cases, personal data is not needed. Now the EU General Data Protection Regulation (GDPR) adds legal constraints on personal data and the justification for its use. The RIPE NCC is the data controller and facilitator of the RIPE Database. The servers providing access to the RIPE Database are operated by the RIPE NCC. The RIPE NCC is a Dutch registered organisation based within the EU. Therefore, the GDPR applies to all the personal data contained within the RIPE Database, regardless of where the data subject is located. In almost all situations, there is no justification for publishing any personal data in the RIPE Database. This policy proposal outlines data that should be used in areas where personal data has been used in the past. All contacts must be documented as roles. There is no need for documenting personal information about any contacts in the database." </quote> __ [1]: https://www.ripe.net/participate/policies/proposals/2022-01#:~:text=Summary%...

Regardless of what part of the RIPE region any data maintainer or data subject is based in, regardless of legal jurisdiction, regardless of what personal data protection laws apply, regardless of who is considered to be the data controller of the data contained within the RIPE Database, this policy proposal is suggesting that these are the basic principles that the RIPE Database should operate under across the region.

Fine! then, let's just bound on that. Or no? :-/ ...having read and commented [2] the publication series [3] from the RIPE NCC's Legal Team, i can tell you that: *insertion* of PII into RIPE DB seems to be actually in line with both the *GDPR* and right of data subjects. Then if/when you find *a lot* of PII the only ones to blame are the resource holders. Because they have signed more than one legal documents where they agreed to not *pour* PII of their client within the RIPE DB. __ [2]: <https://www.ripe.net/ripe/mail/archives/db-wg/2022-June/007501.html> [3]: < https://www.ripe.net/about-us/legal/corporate-governance/gdpr-and-the-ripe-n...

The RIPE NCC's Legal Team concluded that: 1| the RIPE DB has no *insertion* problem; 2| the remaining problem with the RIPE DB is in its *query* to retrieve data it contains; 3| the RIPE Community should act accordingly; 4| ... ...i expect that those RIPE NCC Legal Team's publication series[3] would be targeted as obsolete, when the above will become false or inconsistent with their assessment of the situation. ...i call anyone from RIPE NCC to, please, bring the clarification needed to understand the current state of the RIPE DB; regarding its compliance to GDPR.

I don't think anyone can argue against the RIPE Database not containing unnecessary personal data or personal data that cannot be justified by the agreed purposes of the database.

You are right, imho! ...i, for myself, am opposed to any attempt to change the *purpose* of the RIPE Database. BtW! could you find anyone who can argue against the good standing, interest and usefulness of the RIPE DB's *purpose*?

The GDPR is a good guideline and benchmark to assess the database against as it does apply, without question, to a large part of the RIPE region and a large amount of the personal data contained within the database.

But it is not the only consideration.

Any other? Thanks to add it here [1], brother.

To focus so heavily on the GDPR alone is a distraction.

< https://dict.org/bin/Dict?Form=Dict1&Query=distraction&Strategy=*&Database=*> [1]?

The bottom line is that this policy proposal is about establishing reasonable, common sense principles for processing personal data across the RIPE region, supported by the agreed purposes of the RIPE Database.

If it's that the goal, then could we, please, start by considering the following: s0| identify, in all the twenty one (21) RIPE DB's type of objects, attributes which could contain unwilling PII; s1| filter output in 's0' to catch the more dangerous attributes to be balanced against (i) the purpose of the RIPE DB, and (ii) privacy considerations; s2| consult the members & community through a survey about the appropriate path to follow; s3| split the proposal {as suggested by Ronald}: s4| one separate DPP (Draft Policy Proposal) to address the problem, if any, with the general principles for processing data within the RIPE DB; s5| one separate DPP to address the problem, if any, with *insertion* of PII within the RIPE DB; s6| one separate DPP to adress the problem, with the *query* of the RIPE Database; s7| one separate DPP to adress the problem, if needed, with current PII present into the RIPE DB; s8| ... Hope this clarifies my personal PoV :-) Thanks. Shalom, --sb.

cheers denis Proposal author

[...]

-- Best Regards ! __ baya.sylvain[AT cmNOG DOT cm]|<https://cmnog.cm/dokuwiki/Structure> Subscribe to Mailing List: <https://lists.cmnog.cm/mailman/listinfo/cmnog/> __ #‎LASAINTEBIBLE‬|#‎Romains15‬:33«Que LE ‪#‎DIEU‬ de ‪#‎Paix‬ soit avec vous tous! ‪#‎Amen‬!» ‪#‎MaPrière‬ est que tu naisses de nouveau. #Chrétiennement‬ «Comme une biche soupire après des courants d’eau, ainsi mon âme soupire après TOI, ô DIEU!»(#Psaumes42:2)

Colleagues Some people are still questioning the GDPR in relation to the RIPE Database and this policy proposal and a series of articles written by the RIPE NCC a few years ago. Most of us on this list are not lawyers. This is why the RIPE NCC employs a team of expert legal professionals to (re)assess these issues. They will do so as part of the impact analysis after the discussion period ends. I have certainly reached the limit of my legal understanding of the GDPR issues. Therefore I will not address any more questions specifically on GDPR aspects until after we have the legal review of the discussion points raised already. cheers denis Proposal author