[address-policy-wg] 2023-04 Review Phase (Add AGGREGATED-BY-LIR status for IPv4 PA assignments)

Hello again Jan,

On 10/01/24 11:25, Jan Ingvoldstad wrote:
> Basically, any public company register would be illegal according to 
> the interpretation you lean on here.

Public company registries also need a lawful basis for processing. The 
Norwegian public company registry, for example, uses the lawful basis 
«exercise of official authority» – Article 6(1)(e) GDPR – as its lawful 
basis, see https://www.brreg.no/en/privacy-statement/. I would assume 
that to be the case in most other countries as well.

(Most) LIRs are not official authorities, so unlike public company 
registries LIRs cannot use this lawful basis for publishing PII in the 
RIPE Database.

In any case, all of this is rather off-topic. 2023-04 does not change 
the legal obligations on the LIRs relating to the publication of End 
User contact information, nor does it change the RIPE Database Terms and 
Conditions. If you want to publish PII in the RIPE Database, you need a 
lawful basis. That's true today, and that will continue to be true if 
2023-04 passes.


> Or you could take the other stance and stop publishing *any* contact 
> details regarding an object, because you cannot know whether the 
> information is personal data or not.

Exactly. LIRs may (but are not required to) chose this approach already 
*today*. This is a common and long-standing practice which the RIPE NCC 
has repeatedly clarified as compliant with today's policy.

It will continue to be compliant with the policy after 2023-04 passes, 
as well. Thus, 2023-04 effects no change on the LIRs' obligations in 
this regard.


> I think that because the WG discussion has almost exclusively revolved 
> around this alleged changing of policy requirements to publish End 
> User contact information (which may or may not be PII), it is easy to 
> lose track of what this proposal is *actually* all about. We are 
> talking about two different things:
>
>     1) The actual intention behind the proposal: Making it possible to
>     aggregate multiple IPv4 End User assignments that have consistent
>     contact information and purpose into a single database object.
>     This is not possible today, and that is what we want to make that
>     possible, in the same way it is already possible in IPv6.
>
>     2) The *alleged* change to what kind of End User contact
>     information is required to be published in the RIPE database. We
>     have never had any intention of changing this in any way, and the
>     Impact Analysis and other statements from the RIPE NCC confirm
>     that the proposal does not change it either.
>
>     In short: 1) is an intentional and desired change from today,
>     while 2) is *not* a change from today – intentionally so.
>
> This (regarding item 2) is simply not true. Any change in text *is a 
> change*.

We are not making the claim that the policy text does not change. That 
it clearly does – in order to achieve the desired change described in 
item 1 above.

We are however claiming that the *meanings* of the old and the new 
policy texts are exactly the same, with regards to how they translate 
into operational procedures and requirements for the publication of End 
User contact information (item 2).

As the RIPE NCC writes in the Impact Analysis (emphasis added):

     «Acceptance of this proposal **will not change** the fact that the 
RIPE NCC cannot enforce which contact details members add to their IPv4 
PA assignments in the RIPE Database; this **will remain** their decision.»

So, once again: which End User contact details LIRs publish (if any) is 
their decision today, and it will be continue to be their decision if 
2023-04 passes. Hence, 2023-04 does not effect any change in this regard.


>     So maybe we could discuss 1) instead of 2) going forward? :-)
>
> I have no problem with 1), as already stated.

We're happy to hear that!


> I do agree with you that this is distracting from the proper meat of 
> your proposal. Which is why I suggest that you drop this part of it.
> Again, drop the part of the proposal that people have a beef with.
>
> Don't make the change that you claim is not a change.

This «beef» is based on reading current policy to mean that which End 
User contact details LIRs publish in the database (if any) is *not* the 
LIRs' decision today.

But the RIPE NCC has repeatedly clarified that that is simply not the 
case: it *is* the LIRs' decision today, and it will continue to be LIRs' 
decision should 2023-04 pass.

Given that, it is hard to see how we could possibly amend the proposal 
to change this particular point to an even lesser extent than what is 
already the case?


Tore & Jeroen