[anti-abuse-wg] What is Personal information?

 >In other words, Russ could probably approach the Dutch privacy 
regulator with a query, cc RIPE NCC legal, and then accept whatever 
ruling applies? I seriously doubt if anybody on this list >other than 
the three parties above is qualified to comment definitely on this 
issue. So - Russ, please take it offlist, and do come back to let us 
know what ruling you get. I personally would be >interested in what you 
learn.


 >Under Dutch (and European) privacy directives, any information that 
can uniquely distinguish a natural person (ie. NOT 'a business'...) is 
to be considered 'personal information'. So, an IP >address CAN be 
personal information, if the data collector can link it to a person 
without too much hassle. Think webshops who log your IP at logon, they 
can connect that to your account >data, so in *that* case an IP address 
is logged by the shop is indeed considered 'personal information' and 
must be protected by the shop accordingly. In your case with RIPE, your 
IP address is >probably not considered 'personal information'. IANAL. 
Check out http://en.wikipedia.org/wiki/Data_Protection_Directive.


The same reasoning that says RIPE database information is "personal 
information" can be applied to IP addresses (in some cases).
If the IP is registered you would get those contacts by running a whois 
(or doing a reverse lookup would identify a domain which
can bee looked up).  It seems to me if the RIPE database entries are 
"personal information" then so it the IP address associated
with that record.  Even if is is personal information the issue is then 
whether they gave permission to have it posted in a public database.

If the RIPE NCC legal department had an answer it would have been put on 
the public reports and/or they would answer the inquiries
put forth my me and others.   I have sent an inquiry to the Dutch 
privacy office but, while these offices sound good in theory,
they are usually a bureaucratic nightmare.  Since I dot live within the 
region I think it is unlikely I would get an answer.  If the process
is legitimate I would have thought RIPE would have gone to the office 
for a ruling before they changed the access policy.  the fact is
RIPE won't supply their legal department's analysis and they won't 
respond to my request to have the Dutch privacy office review the
matter.  There would be a much better chance of getting a ruling if RIPE 
would ask them ... but they don't seem to want to do that
so I can only speculate why they would not want to do the obvious thing.

Thank You