[db-wg] 2022-01 V2 Resource Holders Address

Colleagues

Let me try to summarise a few points before we move on.

Some numbers I have previously quoted have been questioned. Occasionally
the RIPE NCC publish some anonymous statistics on the number of person
objects related to member organisations. From these authoritative
statistics it can be seen that the top entries on the list are member
organisations who maintain hundreds of thousands of person objects. It is
quite obvious these organisations do not have this many admin, tech and
abuse contacts. These person objects relate to their customers.  We have
about 2m person objects in the database.  It is clear that many of these
person objects relate to customers and publish names and addresses.  We
simply do not have 2m contacts in the RIPE region.

Perhaps the RIPE NCC can publish the top entries from a new set of these
stats. If anyone then wishes to contest the numbers they can take it up
directly with the RIPE NCC.

After all the discussions in recent years on data quality,  I find it hard
to believe that anyone can seriously promote the deliberate entering of
false data into the database. If that is being presented as a serious
solution to an issue, there is clearly a problem that needs to be solved.

The problem is the privacy concerns of entering a full postal address of a
member or end users home. This address is not required to fulfil the
purposes of the RIPE Database. Even if it was, the exception in Article
6.1.f of the GDPR allows a data subjects rights to override the legitimate
interests of the data controller.

It's also been questioned about breaking down the 'personal data' into it's
components. This is a mistake we have made over the last 15 years of
discussing privacy issues. Personal data is an umbrella term. Taken as a
block you can argue that the database purposes justify the processing of
personal data. When you look at the components of personal data, it is
clear that the purposes do justify processing the name, phone and email
data. They don't justify publishing the full home address of members and
end users. Each element of personal data must therefore be validated
against the purposes.

It has also been questioned if we should allow all the elements of a postal
address to be optional for resource holders in the organisation object,
including the country they are based in. Let's be clear on the facts here.
The legal country that the member is based in is documented by the country
attribute which is maintained and verified by the RIPE NCC. This unverified
postal address is maintained by the member and by definition relates to any
business contract who can be based anywhere in the world. It has little, if
any, value to anyone outside of the organisation.

Cheers
denis
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/db-wg/attachments/20220623/32775514/attachment.html>