Re: [ncc-services-wg] [anti-abuse-wg] EU Data Protection
On Wed, Nov 05, 2014 at 03:03:15AM -0800, Ronald F. Guilmette +wrote:
I personally think that publishing "person" objects does +indeed break the law, NCC Legal clearly disagrees.
It would seem so, and may God bless them for that.
Actually, this is something I'd like to hear the "official" answer to, so let's ask the NCC: Having looked at some resources registered in the ripedb to natural persons and having found that the organisation: objects contain information such as full names, addresses and phone numbers, Assuming that this information is *required* to be there in order to be assigned independent resources, how does the uncontrolled publishing of that data possibly comply with the EU Data Protection Directive and imminent General Data Protection Regulation, especially considering the entirely uncontrolled transfer of such data to non-EU countries (whois lookups!)? IANAL, but to me it looks like a breach of said regulations. rgds, Sascha Luck
On 5 Nov 2014, at 16:20, Sascha Luck <lists-ripe@c4inet.net> wrote:
how does the uncontrolled publishing of that data possibly comply with the EU Data Protection Directive and imminent General Data Protection Regulation,
especially considering the entirely uncontrolled transfer of such data to non-EU countries (whois lookups!)?
IANAL, but to me it looks like a breach of said regulations.
Sacha, what matters here is how Dutch law enacts the EU directive and regulation and how the Dutch Data Protection Authority enforces that law(s). I would presume/expect the NCC's legal staff have already checked this or got expert advice. The NCC is already publishing Personal Data -- eg names and addresses for Contact Objects -- without violating Dutch/EU Data Protection and/or Privacy legislation. So I would assume that publishing Person Objects will be equally acceptable. My understanding is the issues around export of Personal Data apply to cases where the data are processed/controlled in a country that does not have a Data Protection regime or Safe Harbour provisions equivalent to the EU Directives and Regulations. Publishing whois data probably does not fall into that. IANAL either. Though I have dealt with whois issues, ICANN, Data Protection and far too many lawyers in a previous life. The scars have nearly healed.
participants (2)
-
Jim Reid -
Sascha Luck