- dp-tf - mailman.ripe.net

Update from DT-TF meeting
by dp-tf-admin＠ripe.net 15 Oct '09

15 Oct '09

Dear all, I would like to thank you for your participation in the Data Protection Task Force. As a follow up, I would like to send you the documents/information you requested and to summarise what we agreed upon: 1. Proxy service agreement and AUP docs Please find attached the two documents. You can send your comments to the mailing list. 2. EU consultation Here is the URL where the announcement for the public consultation has been published. http://ec.europa.eu/justice_home/news/consulting_public/news_consulting_000… The RIPE NCC is considering participating in the EU consultation. Please send us your view and comments on this. 3. Continuation of the DP-TF During the meeting we have concluded that the purpose set out in the charter of the task force has been completed. All documentation has been finished and published, there are communicated procedures in accordance with the data protection legislation and the community is aware of the actions taken. The task force has given the basic guidelines on how the RIPE NCC should deal with future data protection issues. As a result, the task force will be closed. The DP-TF mailing list will remain open for a couple of months, for any last input. Kind regards, Athina Fragkouli RIPE NCC

1 1

DP-TF Monday: APOLOGY
by dp-tf-admin＠ripe.net 02 Oct '09

02 Oct '09

Further to my earlier mail when I said that I would be at Monday's DP-TF meeting, I now find that I have a major issue on a network that I manage which requires me to be in Wales on Monday (to fix it!) and so prevents my travelling to Lisbon over the weekend. Accordingly I have to ask that you accept my apologies for absence from the meeting on Monday. I feel particularly embarrassed by my inability to be with you in Lisbon not least because (as some of you will know) my previous absences were caused by illness and recovery from the resulting surgery. Please do not think that my interest and concern has waned in the slightest. Had I been with you, I would have asked that we re-address the issue of the "Changed Date" field in the WHOIS display. This field contains the date of the most recent change, and the authority ID for the change (the latter part is not necessarily personal data but it can be if the maintainer so chooses). What many people need to find is the date of the most recent change of the record data (etc) rather than the authority for the change. I did ask in the first meeting I attended, that we consider recommending that the DATE should be not be suppressed even when the ID is suppressed. I've heard nothing more about this, and indeed sadly I've not seen any mail from DP-TF until last week (has there been any email discussion of any DP-TF issues?) Can I therefore please ask that we now recommend this change in order that people needing to find the "changed" date do not need to look up the full personal data in order to just get the date information. Additionally, I would ask that for any future meeting of DP-TF, the date and time be notified to the TF members at the time of the notice of the RIPE meeting: and the agenda be published as soon as possible after that. I still have not seen any agenda for Monday's DP-TF meeting, so I cannot know whether there are any other issues on which I might have helpfully commented in advance of the meeting. I do of course expect to be in Lisbon later in the week, all assuming that British Telecom do not delay resolving my network issue any longer! -- Richard Cox

1 0

Draft Agenda DP-TF Monday 5 October 2009 10:30 - 12:30
by dp-tf-admin＠ripe.net 02 Oct '09

02 Oct '09

Dear all, Apologies for the late sending of the agenda for Monday. Draft Agenda DP-TF Monday 5 October 10:30 - 12:30 A. Administrative Matters and Action items - Proposal to improve admin and to publish work done B. Update from the the RIPE NCC - Published privacy statement - Updated AUP - Updated Proxy Access Service Agreement - Update on mandatory mnt-by C. Non referenced Person object clean-up - Discuss progress and comments on DB WG mailing list D. Nic-hdl - Standardise nic-hdl set up - Not re-using nic-hdls E. EU Consultation - EU consultation on Data Protection Directive F. Scenario's for enforcement of RIPE Database Z. AOB - Presentation at DB WG addressing action items List of Action items - 200709 Action RIPE NCC investigates termination of NRTMs and follow up on remaining ones (RIPE NCC). 22102007 Ongoing. Investigating follow-up procedure 05022008 Ongoing 05052008 Ongoing 05052009 Ongoing. See presentation on action plan. - 200810 Update the Database Manual and create FAQs (RIPE NCC) 05052009 Ongoing. - 200901 Third parties referencing RIPE Database personal Data - 200902 RIPE NCC take action on third party that collect RIPE DB data

1 0

DP-TF meeting Monday 5 October 10:30 -12:30
by dp-tf-admin＠ripe.net 02 Oct '09

02 Oct '09

Dear all, As at previous RIPE meeting we the Data Protection Task Force will take place on Monday at 10:30. Please let me know whether you will attend the meeting. Next week I will send all attendees the Draft Agenda, the location and the relevant documents for the meeting. Regards, Jochem de Ruig RIPE NCC

1 4

Next meeting Tuesday 5 May 10:00 -12:30
by Jochem de Ruig 29 Apr '09

29 Apr '09

Dear all, Hereby I would like to invite you to the Data Protection Task Force meeting. Unfortunately due to schedule problems we will not be able to meet on the Monday but instead we have a slot on the Tuesday 5 May, 10:00-12:30, in the Dam room, located on the 1st floor of hotel Krasnapolsky. The draft agenda including documents will be send in advance of the meeting. Please let me know if you will be able to attend. Kind regards, Jochem de Ruig RIPE NCC

4 3

Draft agenda DP-TF meeting 26 October Dubai
by Jochem de Ruig 21 Oct '08

21 Oct '08

Dear all, Hereby the agenda for the last DP-TF meeting, in Dubai. As most of the TF work has been done, we propose that this will be the last DP-TF meeting. The meeting will take place from 11.30 - 13.00. The meeting will be in the VIP lounge. If you have any additional agenda items or comments please let me know. Could you also please confirm your attendance to me. Kind regards, Jochem RIPE NCC Draft Agenda DP-TF Sunday 26 October 11:30 - 13:00, VIP lounge, Dubai A. Administrative Matters and Action items B. Update from the the RIPE NCC C. Final actions and deliverables from the RIPE NCC D. Proposal to close the DP-TF - Documentation of TF work, last comment round and closing statements Z. AOB List of Action items 200709 Action RIPE NCC investigates termination of NRTMs and follow up on remaining ones (RIPE NCC). 22102007 Ongoing. Investigating follow-up procedure 05022008 Ongoing 05052008 Ongoing 200810 RIPE NCC to produce an “associated document” that explains the Database Terms and Conditions document in simple terms. (Action RIPE NCC).

1 0

Final Database legal documents
by Denis Walker 14 Jul '08

14 Jul '08

Dear all, Following on from the Data Protection Task Force (DP TF) meeting during RIPE 56 in Berlin, we have finalised the documents for the RIPE Database. There were several outstanding issues which have been discussed by the RIPE NCC Senior Management: - Definition of "RIPE Community". We aligned this with the published definition on our website. - "Article 6.1 - The RIPE NCC does not guarantee the accuracy, or completeness or availability of the RIPE Database or of the data contained therein" This article will remain as it is. This is a legal document aimed at providing legal protection for the RIPE NCC. In legal language, this is the best option to describe our responsibility. From a practical point of view, this does not exclude our intention to provide an excellent service and aim to achieve 100% availability. - "Article 10 Copyright." The comments from the DP TF on the copyright statement were valid and useful and we have taken it upon ourselves to rewrite the copyright statements as a separate activity. Furthermore, we had some final iterations to improve the wording of the documents. We propose to publish the documents as they now stand. Please let us know if you have any final considerations/issues. Bear in mind that with any documents such as these, the wording can always be changed. However, we would prefer not to make any subjective changes at this stage but only amend anything that is inaccurate. We would appreciate any final comments within the next two weeks. Regards Denis Walker Business Analyst RIPE NCC Database Group

1 0

meeting room on Monday
by denis 03 May '08

03 May '08

Hi all The Data Protection Task Force meeting at RIPE 56 on Monday will be in the Provence III room. This is on the floor above the large meeting rooms and registration desk. To get to it walk past the registration desk, past the cloak room, then there is a small lift on the left hand side. This takes you to the other floor. The normal lifts do not go to this floor. If you hve any problems, please ask at the registration desk. regards Denis Walker RIPE NCC

1 0

Draft Agenda for DP-TF meeting Monday 5 May, Berlin
by Jochem de Ruig 29 Apr '08

29 Apr '08

Dear all, Hereby the draft agenda, the action list and the additional documents. The meeting will take place from 11.30 - 14.00. The meeting will be in the Provence III room, located one floor above the main meeting area, next to the Terminal Room. Unfortunately I cannot be present and Sonia Garbi, who is well informed regarding legal issues within the RIPE NCC, will step in instead of me. In addition the RIPE NCC will be represented by Denis Walker, Jos Boumans and a scribe will be there. Please confirm your attendance to either me or one of my colleagues. Kind regards, Jochem de Ruig ------------------------------------------------------------------------ Draft Agenda DP-TF Monday 5 May 11:30 - 14:00, Provence III room, Berlin A. Administrative Matters and Action items - 10 min - who is present - actionitems, see below B. Update from the the RIPE NCC - 20 min C. RIPE Database Terms and Conditions - 60 min - RIPE Database Terms and Conditions - AUP - Procedure for implementation http://www.ripe.net/db/support/RIPE-NCC-DB-23042008-terms-conditions.pdf D. Removal of Personal data procedure 20 min - Final draft procedure http://www.ripe.net/db/support/Removal_change-personal-data-procedure-28Apr… E. Bulk access (mirroring) - 20 min - New NRTM agreement for non personal data - NRTM with personal data Yes/No? - Way forward http://www.ripe.net/db/support/about-nrtm.html Z. AOB 20 min - schedule for future meetings - RIPE Plenary meeting presentation ------------------------------------------------------------------------- List of Action items 200701 The term end user needs to be clarified (action RIPE NCC) 22102007 Ongoing, no update will be incorporated in DB TCs 05022008 Ongoing, see definitions in Removal of Personal data procedure 200704 Define what objects will be involved in the complaint procedure (action RIPE NCC) 22102007 Ongoing, see draft Removal of Personal data procedure 05022008 Ongoing 200708 Wilfried will put the description forward to the WG chairs if this is in line with the view of the WGs on the purpose of the RIPE DB (WW) 22102007 Ongoing, after DB TCs 05022008 Ongoing 200709 Action RIPE NCC investigates termination of NRTMs and follow up on remaining ones (RIPE NCC). 22102007 Ongoing. Investigating follow-up procedure 05022008 Ongoing

6 5

Limit on access to personal data
by Denis Walker 24 Jan '08

24 Jan '08

Dear Colleagues The RIPE NCC has been working with the RIPE Data Protection Task Force on many areas, including access to personal data held in the RIPE Database. We have now developed a new Near Real Time Mirroring (NTRM) stream to filter out identifiable personal information. NRTM is a mechanism whereby users can receive filtered updates to the RIPE Database almost immediately. It maintains the references to nic-hdls. So anyone using this stream can find the references and then query the RIPE Database for the personal data they really need. This, of course, will be subject to our normal access limits. Initially, those requesting NRTM streams will be provided with the new stream and must sign a new contract. The data protection laws make it very difficult to justify giving anyone full access to all personal data held in the RIPE Database. The RIPE NCC now has a dilemma. We often get requests from organisations claiming to be spam or abuse fighters. They always ask for full access based on an unpredictable need to query large numbers of PERSON objects. A typical recent example is this: "You see, the number of queries doesn't depend on me; it depends on how many different IP addresses attack that server ... December was quiet and I probably made 4,000 or 5,000 queries, while in the first week of January alone I was hit by about 18,500 bots on distinct addresses and had to make just as many queries." To query a large number of inetnums without using the "-r" query flag could return tens of thousands of PERSON objects. This is much higher than our default access limit, which is the total number of personal data sets a user can receive from queries to the RIPE Database in a set period of time. (For security reasons, we do not disclose what the default value is or the time period.) We can raise the limit on the number of PERSON object queries allowed by a specific IP address, subject to the user signing a contract with the RIPE NCC. But we have some questions that need to be considered here: 1. How do we verify the validity of a claim that an organisation is a genuine spam or abuse fighter? We have no knowledge of these organisations. Often their website does not provide conclusive evidence. It could even be a spamming organisation that claims to fight spam and ask for an increased access limit. 2. If we are able to verify the claim, what is an acceptable increased limit for organisations involved in this type of work? From a data protection point of view, lower is better. We cannot accept an open-ended, unpredictable need. 3. Perhaps a better approach would be to provide training on how to use the RIPE Database. Rather than raising limits, advise people to query the IP addresses with the "-r" flag and see how many networks these individual addresses fall into. Find which of these networks have either an "abuse-mailbox:" attribute or reference to an IRT object. Then only query for personal data with those that are still difficult to trace. The RIPE NCC would appreciate any input and guidance on these questions. It is a topic that will be added to the agenda of the DP TF meeting in February. Regards Denis Walker Business Analyst RIPE NCC

1 0