A quick search would show zendesk is GDPR compliant https://www.zendesk.com/company/customers-partners/eu-data-protection/#gdpr-... Sent from the road while on tour On Feb 27, 2018 12:57, "Jim Reid" <jim@rfc1035.com> wrote:

On 27 Feb 2018, at 15:47, Matt Parker <mparker@ripe.net> wrote:

if a user submits unsolicited email attachments that are deemed to be sensitive/confidential in nature, the RIPE NCC is able to redact these documents, removing them completely from any third-party servers.

Matt, this misses the point completely. IMO, nothing member-related should be getting stored or processed on third-party services. Ever. [Well, OK encrypted backups can be held off-site by a reputable provider.] What happens when $cloud-provider-du-jour goes bust or changes its T&Cs (all your data are belong to us) or does stuff to that data unknown to either the NCC or the member? Will it be possible to switch providers or bring it back in-house once the NCC’s finds out it’s been locked in? At the very least, there should have been a considered discussion about this in the NCC services WG (and the GM) before a decision was taken. Some stuff in Zendesk’s privacy policy is downright alarming: "Our Websites may contain links to other websites and the information practices and the content of such other websites are governed by the privacy statements of such other websites. We encourage you to review the privacy statements of any such other websites to understand their information practices.” "We and our authorized partners may use cookies and other information gathering technologies for a variety of purposes.” "Third parties with whom we partner to provide certain features on our Websites or to display advertising based upon your Web browsing activity.” "We collect analytics information..... We may also share anonymous data about your actions on our Websites with third-party service providers of analytics services.” "We may use the information we collect about you (including personal information, to the extent applicable) for a variety of purposes, including to ... (e) send promotional communications, such as providing you with information about products and services, features, surveys, newsletters, offers, promotions, contests, and events; and provide other news or information about us and our partners. ... (f) process and deliver contest or sweepstakes entries and rewards; (g) monitor and analyze trends, usage, and activities in connection with the Websites and Services and for marketing or advertising purposes; ... (i) personalize the Websites and Services, including by providing features or advertisements that match your interests and preferences" "We may also obtain other information, including personal information, from third parties and combine that with information we collect through our Websites. For example, we may have access to certain information from a third party social media or authentication service if you log into our Services through such a service or otherwise provide us with access to information from the service.” "We share information, including personal information, with our third-party service providers” I can’t imagine why anyone would sign up to this or think it was culturally compatible with the membership and RIPE community. I wonder too how this US company intends to comply with GDPR. I am saddened that the NCC does not appear to have learned from past mistakes. Some years ago, the NCC tried to use some (here today gone tomorrow?) third-party Web2.0 cloud thing or other for storing and presenting RIPE meeting materials. There was no prior consultation. IIRC it turned out the provider asserted copyright/IPR over anything that was uploaded to their systems. They also imposed other conditions which would have made it impossible for some speakers to provide content.

On 28 February 2018 at 00:25, Jim Reid <jim@rfc1035.com> wrote:

...

On 27 Feb 2018, at 22:29, Leslie <geekgirl@gmail.com> wrote:

A quick search would show zendesk is GDPR compliant

Thanks Leslie. FWIW I ran away in disgust after reading the so-called privacy policy.

It would be far more constructive if you could share what is not appropriate in the privacy policy and why. -- Sincerely, Hans Petter Holen - hph@oslo.net - +47 45066054

Dear Jim and all, We took the decision to move to a third party specialising in ticketing systems rather than continue to update our in-house system. This was to accommodate growing needs for efficiency and functionality. We needed a more resilient system that would meet the needs of our 18,000-strong membership. We ask members not to attach privacy-related documentation and instead to submit it via secure RIPE NCC processes, i.e. the request forms available through their LIR account or via the contact form on the RIPE NCC website. By following these procedures, all documentation is stored securely on RIPE NCC servers. If sensitive personal information is attached to an email, we delete that information from Zendesk once the information is moved to RIPE NCC servers. We also made members aware of these changes well in advance of starting to use Zendesk: https://www.ripe.net/ripe/mail/archives/ncc-announce/2017-August/001189.html As was noted, Zendesk guarantees that it is GDPR-compliant and the services we use are located by contract on servers in the EU. This in itself mitigates some of the concerns that have been raised. Zendesk is a well-established provider of these services, and we believe that their solution is likely to be maintained. And although we believe the likelihood of this company failing to meet our needs in future is very small, we have considered the risk and believe we can make any changes to our processes that scenario would require. We'd like to note that the quoted sections of Zendesk's privacy policy refer to activities that take place on their website. The RIPE NCC mitigated these concerns by choosing not to use these elements of the Zendesk solution. We can continue the discussion at the RIPE NCC Services WG in Marseilles in May and we are happy to take feedback on our approach. Best regards, Andrew de la Haye Chief Operations Officer RIPE NCC On 28/02/2018 10:40, Jim Reid wrote:

...

On 28 Feb 2018, at 08:57, Hans Petter Holen <hph@oslo.net> wrote:

It would be far more constructive if you could share what is not appropriate in the privacy policy and why.

Hans Petter, I thought I’d already done that by quoting extracts from that policy.

In short, you are fodder for our marketroids (and those of our unnamed partners). We’ll use tracking cookies so advertisers can monitor you. We will spam you too. Oh and you agree your personal data will be thrown over the wall to unknown third parties. Have a nice day. [I lied about the last bit. :-)]

NCC services and the NCC should not be party to any of that. I’m surprised this needs to be explained.

Aside from that, I made a much more important point about outsourcing important functions to the cloud: what happens when the provider goes bust or changes their T&Cs or achieves lock-in?