Dear RIPE DB-WG,<div>Hope this email finds you in good health!</div><div><br></div><div>Please find my comments below, inline...</div><div>Thanks.<br><br>Le lundi 27 juin 2022, denis walker via db-wg <<a href="mailto:db-wg@ripe.net">db-wg@ripe.net</a>> a écrit :<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Colleagues<br>
<br>
There were 2 very long emails this weekend, both</blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><div><br></div><div>Hi Denis,</div><div>Thanks for your email, brother.</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">pretty much along the same lines. These points have been made several times. I believe I<br><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><div><br></div><div><br></div><div>Sure, you tried...and thanks brother, it helped me to</div><div> better understand two or three things along...</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
have adequately addressed these points in my earlier reply here:<br>
<a href="https://www.ripe.net/ripe/mail/archives/db-wg/2022-June/007482.html" target="_blank">https://www.ripe.net/ripe/<wbr>mail/archives/db-wg/2022-June/<wbr>007482.html</a><br>
<br><br></blockquote><div><br></div><div>...i went through it again, and it appears to not </div><div>satify me, though :-/</div><div><br></div><div>What i understand is that your understanding of the</div><div> actual state of the RIPE DB compliance with GDPR</div><div>diverge to the public statement of RIPE NCC's Legal</div><div> Team, on the same topic... :-/</div><div><br></div><div>Given that you have a very insightful point of view </div><div>on the topic, i ask myself, what could justify that </div><div>*unexpected* divergence?</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Now let's try to wrap this issue up with a reality check. In the text of the proposed policy, GDPR is not mentioned anywhere. </blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><div><br></div><div><br></div><div>Right! but, who said it's part of the draft proposal to</div><div> be implemented; if it reaches consensus? </div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">The opening two lines of the proposed policy Abstract basically sum up what this proposed policy is about:<br>
"This policy arises from the need for the RIPE Database to avoid the<br>
publishing of unnecessary personal data. Personal data must not be<br>
entered into the RIPE Database unless this can be justified according<br>
to the acknowledged purposes of the RIPE Database."<br>
<br><br></blockquote><div><br></div><div><br></div><div>...who have first invoqued [1] the GDPR regulatory </div><div>framework?</div><div><br></div><div><quote></div><div>"Summary of Proposal: </div><div><br></div><div>Since the beginning of the RIPE Database, personal</div><div> data has been entered extensively in PERSON </div><div>objects as well as in other objects’ attributes in the</div><div> database, such as email addresses for </div><div>notifications and postal addresses for resource </div><div>holders. In those early days little consideration was</div><div> given to privacy and personal data processing. In </div><div>almost all cases, personal data is not needed. Now</div><div> the EU General Data Protection Regulation (GDPR)</div><div> adds legal constraints on personal data and the </div><div>justification for its use. The RIPE NCC is the data </div><div>controller and facilitator of the RIPE Database. The</div><div> servers providing access to the RIPE Database are</div><div> operated by the RIPE NCC. The RIPE NCC is a </div><div>Dutch registered organisation based within the EU.</div><div> Therefore, the GDPR applies to all the personal </div><div>data contained within the RIPE Database, </div><div>regardless of where the data subject is located. In</div><div> almost all situations, there is no justification for </div><div>publishing any personal data in the RIPE Database.</div><div> This policy proposal outlines data that should be </div><div>used in areas where personal data has been used </div><div>in the past. All contacts must be documented as </div><div>roles. There is no need for documenting personal </div><div>information about any contacts in the database." </div><div></quote></div><div>__</div><div>[1]: <a href="https://www.ripe.net/participate/policies/proposals/2022-01#:~:text=Summary%20of%20Proposal,in%20the%20database">https://www.ripe.net/participate/policies/proposals/2022-01#:~:text=Summary%20of%20Proposal,in%20the%20database</a></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Regardless of what part of the RIPE region any data maintainer or data subject is based in, regardless of legal jurisdiction, regardless of<br>
what personal data protection laws apply, regardless of who is considered to be the data controller of the data contained within the<br>
RIPE Database, this policy proposal is suggesting that these are the basic principles that the RIPE Database should operate under across the region. </blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><div><br></div><div><br></div><div>Fine! then, let's just bound on that. Or no? :-/</div><div><br></div><div>...having read and commented [2] the publication </div><div>series [3] from the RIPE NCC's Legal Team, i can tell</div><div> you that: *insertion* of PII into RIPE DB seems to </div><div>be actually in line with both the *GDPR* and right </div><div>of data subjects. Then if/when you find *a lot* of </div><div>PII the only ones to blame are the resource holders.</div><div> Because they have signed more than one legal documents where they agreed to not *pour* PII </div><div>of their client within the RIPE DB.</div><div>__</div><div>[2]: <<a href="https://www.ripe.net/ripe/mail/archives/db-wg/2022-June/007501.html">https://www.ripe.net/ripe/mail/archives/db-wg/2022-June/007501.html</a>></div><div>[3]: <<a href="https://www.ripe.net/about-us/legal/corporate-governance/gdpr-and-the-ripe-ncc">https://www.ripe.net/about-us/legal/corporate-governance/gdpr-and-the-ripe-ncc</a>></div><div><br></div><div>The RIPE NCC's Legal Team concluded that:</div><div><br></div><div>1| the RIPE DB has no *insertion* problem;</div><div>2| the remaining problem with the RIPE DB is in its </div><div>*query* to retrieve data it contains;</div><div>3| the RIPE Community should act accordingly;</div><div>4| ...</div><div><br></div><div><br></div><div>...i expect that those RIPE NCC Legal Team's </div><div>publication series[3] would be targeted as obsolete,</div><div> when the above will become false or inconsistent </div><div>with their assessment of the situation.</div><div><br></div><div>...i call anyone from RIPE NCC to, please, bring the </div><div>clarification needed to understand the current state</div><div> of the RIPE DB; regarding its compliance to GDPR.</div><div><br></div><div><br></div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I don't think anyone can argue against the RIPE Database not containing unnecessary personal data or personal data that cannot be justified by the agreed purposes of the database.<br>
<br><br></blockquote><div><br></div><div><br></div><div>You are right, imho!</div><div><br></div><div>...i, for myself, am opposed to any attempt to change the *purpose* of the RIPE Database. </div><div><br></div><div>BtW! could you find anyone who can argue against</div><div> the good standing, interest and usefulness of the </div><div>RIPE DB's *purpose*?</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
The GDPR is a good guideline and benchmark to assess the database against as it does apply, without question, to a large part of the RIPE region and a large amount of the personal data contained within the database. </blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">But it is not the only consideration. </blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><div><br></div><div><br></div><div>Any other?</div><div>Thanks to add it here [1], brother.</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">To focus so heavily on the GDPR alone is a distraction.<br>
<br><br></blockquote><div><br></div><div><br></div><div><<a href="https://dict.org/bin/Dict?Form=Dict1&Query=distraction&Strategy=*&Database=*">https://dict.org/bin/Dict?Form=Dict1&Query=distraction&Strategy=*&Database=*</a>> [1]?</div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
The bottom line is that this policy proposal is about establishing reasonable, common sense principles for processing personal data across the RIPE region, supported by the agreed purposes of the RIPE Database.<br>
<br><br></blockquote><div><br></div><div><br></div><div>If it's that the goal, then could we, please, start by </div><div>considering the following:</div><div><br></div><div>s0| identify, in all the twenty one (21) RIPE DB's type</div><div>of objects, attributes which could contain unwilling</div><div> PII;</div><div>s1| filter output in 's0' to catch the more dangerous</div><div> attributes to be balanced against (i) the purpose of</div><div> the RIPE DB, and (ii) privacy considerations;</div><div>s2| consult the members & community through a survey about the appropriate path to follow;</div><div>s3| split the proposal {as suggested by Ronald}:</div><div>s4| one separate DPP (Draft Policy Proposal) to </div><div>address the problem, if any, with the general </div><div>principles for processing data within the RIPE DB;</div><div>s5| one separate DPP to address the problem, if </div><div>any, with *insertion* of PII within the RIPE DB;</div><div>s6| one separate DPP to adress the problem, with </div><div>the *query* of the RIPE Database;</div><div>s7| one separate DPP to adress the problem, if </div><div>needed, with current PII present into the RIPE DB;</div><div>s8| ... </div><div><br></div><div><br></div><div>Hope this clarifies my personal PoV :-)</div><div><br></div><div>Thanks.</div><div><br></div><div>Shalom,</div><div>--sb.</div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
cheers<br>
denis<br>
Proposal author<br>
<br>[...]</blockquote></div><br><br>-- <br><p>Best Regards !<br>__<br>baya.sylvain[AT cmNOG DOT cm]|<<a href="https://cmnog.cm/dokuwiki/Structure">https://cmnog.cm/dokuwiki/Structure</a>><br>Subscribe to Mailing List: <<a href="https://lists.cmnog.cm/mailman/listinfo/cmnog/">https://lists.cmnog.cm/mailman/listinfo/cmnog/</a>><br>__<br>#LASAINTEBIBLE|#Romains15:33«Que LE #DIEU de #Paix soit avec vous tous! #Amen!»<br>#MaPrière est que tu naisses de nouveau. #Chrétiennement<br>«Comme une biche soupire après des courants d’eau, ainsi mon âme soupire après TOI, ô DIEU!»(#Psaumes42:2)<br><br></p>