[db-wg] 2022-01 V2 Resource Holders Address

Ron,

Ronald F. Guilmette via db-wg wrote on 24/06/2022 00:40:
> Second as was previously discussed, responsiblity, both legal and otherwise,
> for any unnecessary "leakage" of PII under GDPR belongs to the party that
> first leaked the data.  So if some telecom company is carelessly shoveling
> their customer PII into the RIPE data base in a way that is not consistant
> with GDPR then the entire legal responsibility for that belongs to the telecom
> companies involved... *not* to RIPE.

the RIPE NCC is a GDPR joint controller of the PII published in the 
ripedb. This is acknowledged by the RIPE NCC:
> With regards to the RIPE Database, the RIPE NCC fills the role of
> “Data Controller” - that is, the entity legally responsible for all
> personal data stored in the RIPE Database.

From: https://labs.ripe.net/author/athina/how-were-implementing-the-gdpr/

> Third and lastly, underlying these arguments is a sort-of implicit and
> unspoken assumption that simply is not true and that can quite easily
> disproven, i.e. the obviously flawed assumption that the RIPE region is
> synomymous with the EU and/or the EEA and that thus, GDPR applies
> throughout the RIPE region.  It doesn't.

there is no assumption, implicit or otherwise, that the RIPE service 
region is synonymous with the EU.  However, as the RIPE NCC is legally 
constituted and operates in The Netherlands, it is subject to dutch and 
EU law.

If you explicitly give consent for them to publish your personal 
information, that's fine.  As this information is published in NL, your 
PII is subject to Dutch and EU law, and is therefore subject to the GDPR.

In addition to your right to provide consent to publish your PII, you 
have lots of other rights, including the rights of access, 
rectification, restriction, and others.

If you're concerned by the fact that your PII is now subject to the 
GDPR, perhaps you'd like to exercise your right of erasure?

Nick

> In addition to such notable and significant countries as Russia, Ukraine,
> and Turkey, it appears that there exist a whole raft of other
> countries also that are -in- RIPE but -outside- of EU/EEA, for example
> Aland Islands, Albania, Andorra, Armenia, Azerbaijan... and that's just
> the As!  I'm sure that there are plenty more also.  Companies and natural
> persons in these countries are not bound by GDPR, despite the fact that
> some would wish it to be so.  Thus companies and persons outside of EU/EEA
> remain free to put whatever they like into the RIPE WHOIS data base, and
> RIPE is free to publish whatever they do put in there, as has already been
> discussed and agreed here.  (Note that the Personally Identifiable Information
> involved in many of these cases will pertain to natural persons who themselves
> reside -outside- of the EU/EEA area, and GDPR is simply not applicable to
> the PII of any such persons.)
> 

> Zanzibar, but wishing does not make it so.  RIPE is free, morally, ethically,
> and legally to publish *my* phone number any time it wishes, as I am an
> American, and thus not a subject of the GDPR regime, and also not least
> because I myself have, in the first instance, made my own phone number
> public in my own domain WHOIS records, thus relieving any and all parties
> of any legal responsibility, under GDPR, for any mere re-publication of
> this Personally Identifiable Information.
> 
> 
> Regards,
> rfg
>