Dear DB-WG,<div><div><br></div><div><tl;dr></div><div>The legal team at RIPE NCC has made it easier for</div><div>us to got a clear picture [1] of their implementation</div><div> of the GDPR regulatory framework; within the RIPE</div><div> Database.</div><div>...i'm mostly quoting their related publication series</div><div>to conclude that this Draft Policy Proposal (DPP) is</div><div>not needed; when it comes to help RIPE NCC in any</div><div> quest of GDPR regulatory framework's compliance</div><div> regarding PII data insertion w/ the RIPE Database.</div><div> The legal team has said that their need could be </div><div>about *query* [6]...</div><div></tl;dr></div><div><br></div>Please find more context below, inline...</div><div><br><div>Thanks.<br><br>Le vendredi 24 juin 2022, Nick Hilliard via db-wg <<a href="mailto:db-wg@ripe.net" target="_blank">db-wg@ripe.net</a>> a écrit :<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Ron,<br>
<br>
Ronald F. Guilmette via db-wg wrote on 24/06/2022 00:40:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Second as was previously discussed, responsiblity, both legal and otherwise,<br>
for any unnecessary "leakage" of PII under GDPR belongs to the party that<br>
first leaked the data. So if some telecom company is carelessly shoveling<br>
their customer PII into the RIPE data base in a way that is not consistant<br>
with GDPR then the entire legal responsibility for that belongs to the telecom<br>
companies involved... *not* to RIPE.<br>
</blockquote>
<br>
the RIPE NCC is a GDPR joint controller of the PII published in the ripedb. This is acknowledged by the RIPE NCC:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
With regards to the RIPE Database, the RIPE NCC fills the role of<br>
“Data Controller” - that is, the entity legally responsible for all<br>
personal data stored in the RIPE Database.<br>
</blockquote>
<br>
From: <a href="https://labs.ripe.net/author/athina/how-were-implementing-the-gdpr/" target="_blank">https://labs.ripe.net/author/a<wbr>thina/how-were-implementing-th<wbr>e-gdpr/</a><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote></blockquote><div><br></div><div><br></div><div>Hi Nick,</div><div>Thanks for sharing that precious URI, brother!</div><div><br></div><div>...fwiw, we should start by questioning whether </div><div>that [1] *old* publication series is still reflecting </div><div>the actual understanding of RIPE NCC in how PII </div><div>data shall be managed within the RIPE Database.</div><div>__</div><div>[1]: <<a href="https://www.ripe.net/about-us/legal/corporate-governance/gdpr-and-the-ripe-ncc">https://www.ripe.net/about-us/legal/corporate-governance/gdpr-and-the-ripe-ncc</a>></div><div><br></div><div>This first precaution is needed, due to the fact that </div><div>its very content [2,3,4] seems to prove that RIPE </div><div>NCC has nearly no problem in regards to its implementation of the GDPR regulatory framework;</div><div> within the RIPE Database.</div><div><br></div><div><quote1></div><div>"The RIPE NCC considers that it is the responsibility</div><div> of the one who inserts the data in the RIPE </div><div>Database (i.e. the maintainer) to ensure that they </div><div>have obtained valid consent for the processing to </div><div>take place." <br></div><div></quote1></div><div>__</div><div>[2]: <a href="https://labs.ripe.net/author/athina/how-were-implementing-the-gdpr-legal-grounds-for-lawful-personal-data-processing-and-the-ripe-database/#:~:text=The%20RIPE%20NCC%20considers,the%20processing%20to%20take%20place" target="_blank">https://labs.ripe.net/aut<wbr>hor/athina/how-were-implementi<wbr>ng-the-gdpr-legal-grounds-for-<wbr>lawful-personal-data-<wbr>processing-and-the-ripe-databa<wbr>se/#:~:text=The%20RIPE%20NCC%<wbr>20considers,the%20processing%<wbr>20to%20take%20place</a></div><div><br></div><div><br></div><div><div><quote2></div><div>"We’ve heard feedback that there’s a lot of interest </div><div>in the way personal data is processed in the RIPE </div><div>Database and how it will be affected by the GDPR </div><div>implementation. Spoiler alert: our assessment </div><div>indicates that current operations are in line with the</div><div> legislation."</div><div></quote2></div><div>__</div><div>[3]: <a href="https://labs.ripe.net/author/athina/how-were-implementing-the-gdpr-the-ripe-database/#:~:text=We%E2%80%99ve%20heard%20feedback,current%20operations%20are%20in%20line%20with%20the%20legislation">https://labs.ripe.net/author/athina/how-were-implementing-the-gdpr-the-ripe-database/#:~:text=We%E2%80%99ve%20heard%20feedback,current%20operations%20are%20in%20line%20with%20the%20legislation</a>.</div></div><div><br></div><div><div><br></div><div><div><quote3></div><div>"Conclusion The RIPE NCC is confident that the current RIPE Database operations are in line with the requirements of the GDPR. Having said that, we do see some room for improvement in the relevant documentation and we are currently reviewing our procedures accordingly."<br></div><div></quote3></div><div>__</div><div>[4]: <a href="https://labs.ripe.net/author/athina/how-were-implementing-the-gdpr-the-ripe-database/#:~:text=Conclusion,our%20procedures%20accordingly">https://labs.ripe.net/author/athina/how-were-implementing-the-gdpr-the-ripe-database/#:~:text=Conclusion,our%20procedures%20accordingly</a>.</div></div></div><div><br></div><div><br></div><div>The above add more doubt in the rational between </div><div>the goal and problem statement attached to this </div><div>Draft Policy Proposal (DPP) :-/</div><div><br></div><div><br></div><div><quote4></div><div>"Responsible party’s obligations </div><div><br></div><div>As mentioned above, the responsible parties are </div><div>identified by the maintainer object (referenced by </div><div>the “mnt-by:” attribute in any data object), which is </div><div>mandatory for all objects in the RIPE Database, and</div><div> indicates who is really responsible for specific </div><div>personal data recorded in the RIPE Database. </div><div><br></div><div>In summary, the maintainer is responsible for: </div><div><br></div><div>• The accuracy of the personal data they insert into</div><div> the RIPE Database, that it is appropriate for the </div><div>purpose of the RIPE Database and that it is kept up-</div><div>to-date </div><div>• Informing the data subjects that their data is </div><div>being processed, of the purposes of the RIPE </div><div>Database, the RIPE NCC's role, and the maintainer’s </div><div>role as the responsible party </div><div>• Receiving the data subject's consent (before their</div><div> personal data is entered) • Handling any request </div><div>from persons whose personal data is inserted </div><div>regarding correction or deletion of personal data </div><div>• Accepting liability for any damage resulting from</div><div> the data being inaccurate, not relevant or out-of-</div><div>date, and any damage resulting from not informing</div><div> the data subjects, or receiving their consent or not </div><div>handling their requests </div><div><br></div><div>These responsibilities are already described in the</div><div> RIPE Database Terms and Conditions and the </div><div>resource holders, including the maintainers, are </div><div>contractually bound to these obligations." </div><div><div></quote4></div><div>__</div><div>[5]: <a href="https://labs.ripe.net/author/athina/how-were-implementing-the-gdpr-legal-grounds-for-lawful-personal-data-processing-and-the-ripe-database/#:~:text=Responsible%20party%E2%80%99s%20obligations,to%20these%20obligations">https://labs.ripe.net/author/athina/how-were-implementing-the-gdpr-legal-grounds-for-lawful-personal-data-processing-and-the-ripe-database/#:~:text=Responsible%20party%E2%80%99s%20obligations,to%20these%20obligations</a>.</div></div><div><br></div><div><br></div><div>Given that RIPE NCC has no record of fines for </div><div>have violating the GDPR since 2018; is there any </div><div>chance to find some valid usecases which could </div><div>justify such apparent need to change the *purpose*</div><div> of the RIPE Database?</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Third and lastly, underlying these arguments is a sort-of implicit and<br>
unspoken assumption that simply is not true and that can quite easily<br>
disproven, i.e. the obviously flawed assumption that the RIPE region is<br>
synomymous with the EU and/or the EEA and that thus, GDPR applies<br>
throughout the RIPE region. It doesn't.<br>
</blockquote>
<br>
there is no assumption, implicit or otherwise, that the RIPE service region is synonymous with the EU. However, as the RIPE NCC is legally constituted and operates in The Netherlands, it is subject to dutch and EU law.<br>
<br>
If you explicitly give consent for them to publish your personal information, that's fine. As this information is published in NL, your PII is subject to Dutch and EU law, and is therefore subject to the GDPR.<br>
<br><br></blockquote><div><br></div><div><br></div><div>...we do not need to deal with the usecase shared </div><div>by Ronald; because, imho, the legal team within RIPE NCC has already concluded [2,5], even in case </div><div>where PII of data subjects, from a country in EU, </div><div>are inserted into the RIPE Database, without formal</div><div> consent, by the *responsible* resource holder...</div><div><br></div><div>Now! the very *who is* question raised by Ronald </div><div>makes more sense :-/</div><div><br></div><div><br></div><div><quote5></div><div><div>"We have concluded that the processing of </div><div>personal data is in line with the GDPR and no </div><div>changes are necessary in this regard.</div><div><br></div><div>In this article, we’re taking a closer look at the </div><div>queries the RIPE Database allows; we will conclude</div><div> that some amendments are necessary to ensure </div><div>GDPR compliance."</div></div><div></quote5></div><div>__</div><div>[6]: <a href="https://labs.ripe.net/author/maria_stafyla/how-were-implementing-the-gdpr-amendments-to-the-ripe-database/#:~:text=We%20have%20concluded,ensure%20GDPR%20compliance">https://labs.ripe.net/author/maria_stafyla/how-were-implementing-the-gdpr-amendments-to-the-ripe-database/#:~:text=We%20have%20concluded,ensure%20GDPR%20compliance</a>.</div><div><br></div><div><br></div><div>:-/ so! the problem identified by RIPE NCC was not</div><div> about inserting PII into the RIPE Database; but its </div><div>query...</div><div><br></div><div>...here's a problem which might need a fix.</div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
In addition to your right to provide consent to publish your PII, you have lots of other rights, including the rights of access, rectification, restriction, and others.<br>
<br>
If you're concerned by the fact that your PII is now subject to the GDPR, perhaps you'd like to exercise your right of erasure?<br>
<br><br></blockquote><div><br></div><div><br></div><div>Thanks for noting this, as Athina has also listed [7] </div><div>the rights of data subjects regarding any request of</div><div> PII data removal [8].</div><div><br></div><div><quote6></div><div>"Removal of Personal Data </div><div><br></div><div>An individual whose personal data has been </div><div>inserted into the RIPE Database has the right to </div><div>ask for their personal data to be corrected or </div><div>removed. As most of the personal data contained </div><div>in the RIPE Database is not managed by the RIPE </div><div>NCC but by the persons indicated in the maintainer </div><div>object referenced in the "mnt-by:" attribute (mainly </div><div>the resource holders), it is the responsibility of the </div><div>maintainer to remove this personal data and </div><div>replace it with the personal data of another </div><div>individual. If a maintainer fails to fulfill these </div><div>responsibilities, the RIPE NCC will intervene and </div><div>modify or delete personal data in the RIPE </div><div>Database. However, the resource holder must find </div><div>another individual who is willing to share their </div><div>personal data in the RIPE Database." <br></div><div></quote6></div><div>__</div><div>[7]: <a href="https://labs.ripe.net/author/athina/how-were-implementing-the-gdpr-the-ripe-database/#:~:text=Removal%20of%20Personal%20Data,their%20personal%20data%20in%20the%20RIPE%20Database">https://labs.ripe.net/author/athina/how-were-implementing-the-gdpr-the-ripe-database/#:~:text=Removal%20of%20Personal%20Data,their%20personal%20data%20in%20the%20RIPE%20Database</a>. </div><div>[8]: Procedure for the Removal of Personal Contact</div><div> Details from the RIPE Database</div><div><<a href="https://www.ripe.net/manage-ips-and-asns/db/support/documentation/removal-of-personal-data">https://www.ripe.net/manage-ips-and-asns/db/support/documentation/removal-of-personal-data</a>></div><div><br></div><div><br></div><div>Note that, all these provisions appear to add more </div><div>arguments to the fact that RIPE NCC needs almost</div><div> no help to continue to manage the RIPE Database</div><div> in compliance to the GDPR regulatory framework.</div><div><br></div><div><br></div><div><quote7></div><div>"It must be highlighted that this procedure [6] was</div><div> established by the RIPE community through the </div><div>Data Protection Task Force as the right balance </div><div>between maintaining the accountability of resource</div><div>holders and safeguarding the data protection rights</div><div> of individuals." <br></div><div></quote7></div><div>__</div><div><a href="https://labs.ripe.net/author/athina/how-were-implementing-the-gdpr-the-ripe-database/#:~:text=It%20must%20be%20highlighted,protection%20rights%20of%20individuals">https://labs.ripe.net/author/athina/how-were-implementing-the-gdpr-the-ripe-database/#:~:text=It%20must%20be%20highlighted,protection%20rights%20of%20individuals</a>.<br></div><div><br></div><div><br></div><div>Thanks.</div><div><br></div><div>Shalom,</div><div>--sb.</div><div><br></div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Nick<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">[...]</blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
</blockquote>
<br><br></blockquote>
</div>
</div><br><br>-- <br><p>Best Regards !<br>__<br>baya.sylvain[AT cmNOG DOT cm]|<<a href="https://cmnog.cm/dokuwiki/Structure">https://cmnog.cm/dokuwiki/Structure</a>><br>Subscribe to Mailing List: <<a href="https://lists.cmnog.cm/mailman/listinfo/cmnog/">https://lists.cmnog.cm/mailman/listinfo/cmnog/</a>><br>__<br>#LASAINTEBIBLE|#Romains15:33«Que LE #DIEU de #Paix soit avec vous tous! #Amen!»<br>#MaPrière est que tu naisses de nouveau. #Chrétiennement<br>«Comme une biche soupire après des courants d’eau, ainsi mon âme soupire après TOI, ô DIEU!»(#Psaumes42:2)<br><br></p>