[anti-abuse-wg] Privacy requirements

>> Just make it opt-in, so that people can decide whether they want to 
>> publish their abuse contact point or not.
>
> I thought is already is "opt-in" as the contact enters the information
> with the knowledge it will be published.
>
> If it is opt-in the EU data protection laws do not come into play
> since there is an exemption for those
> that opt-in to their info being published.

The RIPE NCC has decided that publication in the RIPE database does not
give consent to publication (sic), at least not in bulk form as
generally needed for some forms of abuse processing.

I was surprised when this was announced and I believe RIPE NCC's legal
counsel was and is wrong.  It would have been better to advise its
members that they need to make sure that they have consent from the
folks whose data they've submitted to the RIPE NCC for publication.
This is what DENIC did when it was discovered that the WHOIS for
9.4.e164.arpa, despite being nominally opt-in, was populated by default
with personally identifiable information by several DENIC members.

Anyway, I don't think RIPE NCC will give us reassurances that they won't
make another u-turn on the abuse-c: attribute, particularly if it is
mandatory.  That's why I think the whole endeavor is rather pointless.

-- 
Florian Weimer                <fweimer at bfk.de>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99