[db-wg] 2022-01 New Policy Proposal (Personal Data in the RIPE Database)

On 2022 May 13 (Fri) at 00:56:59 +0200 (+0200), Cynthia Revström via db-wg wrote:
:Also I have a kinda Sweden-specific question about the following part
:(from 1.0 Organisations):
:> personal address for the organisation which is already in the public domain in a national, public, business registry.
:
:In Sweden there are multiple private organizations that publish home
:addresses for almost everyone in the country by combining some quirks
:of the freedom of the press act and government transparency.
:Would this count according to that, and as such would you say it is
:okay to publish the personal addresses for almost everyone in Sweden?
:The government doesn't directly publish this information, people have
:no right to demand to be excluded but it is still public.
:The important thing here though imo is that these websites generally
:are a lot harder to scrape than the RIPE Database.
:
:Also what if it was an address that was kinda public but you had to
:create an account and agree to not re-publish it elsewhere, would that
:make it okay or not okay to publish?
:Or what if that address is published somewhere, but not linked to that
:person's name, maybe it is linked to some unrelated legal entity that
:is on the same address, would that make it okay to publish?
:
:I think it would be a lot easier to just say that personal addresses
:should never be published.
:Just because it is already somewhere on the internet doesn't mean that
:the RIPE Database has to spread it further.
:
:-Cynthia
:

I agree with this assessment, and would STRONGLY suggest that we drop
the "if found online" clause for the address of natural persons.

I myself am a target of several hate groups.  I am not willing as a
natural peson to join as a LIR, because my home address will be
published.  That will put my life in danger, and is clearly not
something I am interested in.  I have no problems providing (and
verifying) my home address with RIPE NCC as part of the LIR registration
process, my entire concern is with the *publication* of that address.

Related, is the RIPE NCC Membership list covered under this policy?
Here's one example, using the RIPE NCC, that shows that the registration
address will be published.  When I look at members that appear to be
natural persons, it does list an address that seems to be a residence.

https://www.ripe.net/membership/indices/data/nl.ripencc-ts.html



:On Tue, May 10, 2022 at 11:29 AM Angela Dall'Ara via db-wg
:<db-wg at ripe.net> wrote:
:>
:> Dear colleagues,
:>
:> A new RIPE Policy proposal, 2022-01, "Personal Data in the RIPE Database"
:> is now available for discussion.
:>
:> The goal of this proposal is to allow the publication of verified Personal Data in the RIPE Database only when they are justified by its purpose.
:>
:> You can find the full proposal at:
:> https://www.ripe.net/participate/policies/proposals/2022-01
:>
:> As per the RIPE Policy Development Process (PDP), the purpose of this four week Discussion Phase
:> is to discuss the proposal and provide feedback to the proposer.
:>
:> At the end of the Discussion Phase, the proposer, with the agreement of the WG Chairs, will decide how to proceed with the proposal.
:>
:> The PDP document can be found at:
:> https://www.ripe.net/publications/docs/ripe-710
:>
:> We encourage you to review this proposal and send your comments to
:> db-wg at ripe.net  before 8 June 2022.
:>
:>
:> Kind regards,
:>
:> Angela Dall'Ara
:> Policy Officer
:> RIPE NCC