<div dir="ltr"><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jan 9, 2024 at 3:12 PM Tore Anderson <<a href="mailto:tore@fud.no">tore@fud.no</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><u></u>
<div>
<div>Hi again Jan,<br>
</div>
<div><br></div></div></blockquote><div><br></div><div>Hello again, Tore, and thanks yet again!<br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div>
</div>
<div>On 09/01/24 13:38, Jan Ingvoldstad
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
It is important to also consider the cases where the End
Users are <br>
organisations that do not have non-PII role addresses.<br>
<br>
Consider for example a small one-person business, let's say
a farm owned <br>
by «Farmer Fred». This End User would be a company, not an
individual, <br>
yet the company is often given the same name as the person
owning it (at <br>
least here in Norway).<br>
<br>
The e-mail address might well be farmer.fred@gmail and the
phone number <br>
might be the Farmer Fred's personal mobile. This would mean
that both <br>
the name and the contact information for this End User *is*
PII and is <br>
in scope of the GDPR.<br>
</blockquote>
<div><br>
</div>
<div>The current interpretation of this part of the GDPR is
that "Farmer Fred" is permissible to publish.</div>
</div>
</div>
</blockquote>
<p>Whose interpretation? According to the EU Commission: «Personal
data is any information that relates to an identified or
identifiable living individual. Different pieces of information,
which collected together can lead to the identification of a
particular person, also constitute personal data.»</p>
<p><a href="https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en" target="_blank">https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en</a><br>
</p>
<p>«Farmer Fred» – the name of an individual – clearly falls within
this definition. So does his e-mail address and telephone number.
Publishing this information requires a lawful basis, e.g.,
consent. If consent was refused, it is not permissible to publish.
This is presumably the reason why the RIPE NCC states the
following in the 2023-04 Impact Analysis:</p>
<p>«Inserting any personal data in the RIPE Database must be in
compliance with the RIPE Database Terms and Conditions, even when
it relates to the contact details of the member’s own contact
person(s). In particular, before anyone updates the RIPE Database
with personal data, they must obtain the contact person’s informed
and expressed consent and ensure this data is kept accurate and
up-to-date.»</p>
<p><a href="https://www.ripe.net/participate/policies/proposals/2023-04#impact-analysis" target="_blank">https://www.ripe.net/participate/policies/proposals/2023-04#impact-analysis</a></p></div></blockquote><div>This is a fairly radical view of how GDPR regulates publishing of personal data, IMHO erring far to the side of misunderstood caution:</div><div><br></div><div><a href="https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/do-data-protection-rules-apply-data-about-company_en">https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/do-data-protection-rules-apply-data-about-company_en</a></div><div><br></div><div>Does "Farmer Fred" alone "allow the identification of a natural person"? IMHO it does not, and this seems to be the accepted view in various publicly databases publishing data regarding companies containing parts of the name of natural persons.</div><div><br></div><div>Basically, any public company register would be illegal according to the interpretation you lean on here.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><p>
</p><br><blockquote type="cite">
<div dir="ltr">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Precisely. The LIR, like a domain name registrar, can simply
serve as a <br>
proxy between the wider Internet community and its End
Users.</blockquote>
<div><br>
</div>
<div>No, that is not what I wrote.</div>
<div><br>
</div>
<div>This is about an automatic email forwarding scheme, not
about a registration by proxy scheme.</div>
<div><br>
</div>
<div>E.g. you register the domainname ripe-example.shop with a
registrar within the EEA, your email address is published
(for EEA-based domainnames, anyway) as e.g.
<a href="mailto:qaobuaidbvsas@privacy.example" target="_blank">qaobuaidbvsas@privacy.example</a>, which is a valid email
address that is automatically forwarded to e.g. <a href="mailto:tore%2Bripe-example@fud.no" target="_blank">tore+ripe-example@fud.no</a>.</div>
</div>
</div>
</blockquote>
<p>The policy is technology agnostic in this respect. An automatic
e-mail forwarding scheme such as the one you describe is one
example of a policy- (and presumably GDPR-) compliant way to do
it, but that's not the only possible option. The LIR could instead
opt for operating a human-staffed help desk that receives and
forwards messages to End Users as appropriate.</p></div></blockquote><div>The policy should be technology agnostic, and when requiring the publication of contact details for end users, require that such publication by a LIR conforms to regulations.</div><div><br></div><div>Or you could take the other stance and stop publishing *any* contact details regarding an object, because you cannot know whether the information is personal data or not.</div><div><br></div><div>The current stance is just not logical.<br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><br><p>I think that because the WG discussion has almost exclusively
revolved around this alleged changing of policy requirements to
publish End User contact information (which may or may not be
PII), it is easy to lose track of what this proposal is *actually*
all about. We are talking about two different things:</p>
<p>1) The actual intention behind the proposal: Making it possible
to aggregate multiple IPv4 End User assignments that have
consistent contact information and purpose into a single database
object. This is not possible today, and that is what we want to
make that possible, in the same way it is already possible in
IPv6.</p>
<p>2) The *alleged* change to what kind of End User contact
information is required to be published in the RIPE database. We
have never had any intention of changing this in any way, and the
Impact Analysis and other statements from the RIPE NCC confirm
that the proposal does not change it either.</p>
<p>In short: 1) is an intentional and desired change from today,
while 2) is *not* a change from today – intentionally so.</p></div></blockquote><div>This (regarding item 2) is simply not true. Any change in text *is a change*.</div></div><div class="gmail_quote"><br></div><div class="gmail_quote"><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>
<p>So maybe we could discuss 1) instead of 2) going forward? :-)</p></div></blockquote><div>I have no problem with 1), as already stated.</div><div><br></div><div>I do agree with you that this is distracting from the proper meat of your proposal. Which is why I suggest that you drop this part of it.<br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>
<p><br>
</p>
<blockquote type="cite">
<div dir="ltr">
<div>You have not actually addressed this concern and objection,
you have merely restated claims and opinions that do not
actually do so.</div>
<div><br>
</div>
<div>I therefore again urge you to resubmit the proposal
*without* this removal.</div>
</div>
</blockquote>
<p>As noted in 2) above, the proposal in its current form does not
cause any «removal» of any End User contact information publishing
requirement compared to current policy.</p></div></blockquote><div>It is a removal of the text in question. <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><p> It merely upholds the
status quo, which has been confirmed by the RIPE NCC on multiple
occasions. However, if you are dismissing the RIPE NCC's
clarifications on this subject in the Impact Analysis and
elsewhere as not factual, then there is not much more to discuss
and we would simply have to agree to disagree.<br></p></div></blockquote><div>I disagree that removing a piece of text is not removing a piece of text.</div><div><br></div><div>You can "agree to disagree" all you want, but this is starting to look dishonest.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><p>
</p>
<p><br>
</p>
<blockquote type="cite">
<div dir="ltr">
<div>Then, if this part of the policy change is of importance,
resubmit it as a separate proposal, and preferably clearing up
the PII mess a bit more. I have no beef with clearing that up.</div>
</div>
</blockquote>
<p>Any effort to «clearing up the PII mess» has always been outside
the scope of this proposal. This proposal is simply not about PII
or contact information. That could be a subject for another policy
proposal, of course, but one thing at a time.</p></div></blockquote></div><div>Again, drop the part of the proposal that people have a beef with.</div><div><br></div><div>Don't make the change that you claim is not a change.</div><div><br></div><div>That is all, and I believe you will not only have rough consensus, but near 100% consensus.<br></div><div><br><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature">Jan</div></div></div>