<div dir="ltr"><div dir="ltr"><div>Dear RIPE DB-WG,</div><div>Hope this email finds you in good health!</div><div>Please see my comments below, inline...</div><div>Thanks.</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Le mer. 26 oct. 2022 à 23:39, denis walker via db-wg <<a href="mailto:db-wg@ripe.net">db-wg@ripe.net</a>> a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Frank<br>
<br>
Thank you for some very useful information here. This is the type of<br>
input we need in these discussions. I have had many discussions with<br>
the RIPE NCC legal team about this proposal. They did point out to me<br>
there is a difference between processing personal data for the<br>
'legitimate interest of the public' and processing it by consent of<br>
the data subject. I obviously didn't fully understand the consequences<br>
of such a change. Nor did I realise that certain phrases or comments<br>
would imply such a change has been made and that the change would then<br>
apply across the board. </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
</blockquote><div> </div><div>Hi Denis,</div><div>Thanks for your email, brother :-)</div><div>...i would like to join you in thanking Frank, for its *frank* expression <br>of its valuable experience; shared by some others earlier.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
Having read carefully what you have said here, I think we need to<br>
maintain the 'legitimate interest of the public' as the principle<br>
reason for processing personal data in the RIPE Database. </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br></blockquote><div> </div><div>Thanks for agreeing, Denis.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">It would seem this bypasses the need for explicit consent from the data subject where public interest is involved. </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br></blockquote><div> </div><div>Hey...my humble take, on it, is that the consent insentive would be <br>just keeped where it's required: under the resource holder...i might <br>be wrong though :-/ </div><div>In fact a resource holder is still bound to:</div><div><br>(i) the RIPE Database T&C (Terms & Conditions) [1];<br>(ii) the RIPE Database AUP (Acceptable Use Policy) [2];</div><div>(iii) the RIPE NCC Standard Service Agreement (SSA) [3];</div>__<br><div>[1]: deals with both insertion & query of data - <br><<a href="https://www.ripe.net/manage-ips-and-asns/db/support/documentation/terms">https://www.ripe.net/manage-ips-and-asns/db/support/documentation/terms</a>></div><div>[2]: not deals with insertion, but only with query of data - <br><<a href="https://www.ripe.net/manage-ips-and-asns/db/support/documentation/aup">https://www.ripe.net/manage-ips-and-asns/db/support/documentation/aup</a>></div><div>[3]: deals with acknowledgement of reading of all applicable policies -<br> <<a href="https://www.ripe.net/publications/docs/ripe-745">https://www.ripe.net/publications/docs/ripe-745</a>></div><div><quote></div><div><p style="box-sizing:border-box;margin:0px 0px 12px;max-width:700px;color:rgb(51,51,51);font-family:"Open Sans",Helvetica,Arial,sans-serif;font-size:13px">6.1 The Member acknowledges applicability of, and adheres to, the <a href="https://www.ripe.net/ripe-policies" style="box-sizing:border-box;background:0px 0px;color:rgb(0,171,171);text-decoration-line:none">RIPE Policies</a> and RIPE NCC procedural documents. The RIPE Policies and the RIPE NCC procedural documents are publicly available from the RIPE NCC Document Store. These documents, which may be revised and updated from time to time, form an integral part of and apply fully to the RIPE NCC Standard Service Agreement. Each revised document will receive a new document number and can be found on <a href="https://www.ripe.net/" style="box-sizing:border-box;background:0px 0px;color:rgb(0,171,171);text-decoration-line:none">https://www.ripe.net</a>.</p><p style="box-sizing:border-box;margin:0px 0px 12px;max-width:700px;color:rgb(51,51,51);font-family:"Open Sans",Helvetica,Arial,sans-serif;font-size:13px">Below is a non-exclusive list of these documents:</p><ul style="box-sizing:border-box;margin:0px 0px 12px;padding:0px 0px 0px 20px;color:rgb(51,51,51);font-family:"Open Sans",Helvetica,Arial,sans-serif;font-size:13px"><li style="box-sizing:border-box;max-width:700px"><a href="https://www.ripe.net/ripe/docs/ipv4-policies" style="box-sizing:border-box;background:0px 0px;color:rgb(0,171,171);text-decoration-line:none">IPv4 Address Allocation and Assignment Policies in the RIPE NCC Service Region</a> (current version)</li><li style="box-sizing:border-box;max-width:700px"><a href="https://www.ripe.net/ripe/docs/asn-assignment" style="box-sizing:border-box;background:0px 0px;color:rgb(0,171,171);text-decoration-line:none">Autonomous System (AS) Number Assignment Policies and Procedures</a> (current version)</li><li style="box-sizing:border-box;max-width:700px"><a href="https://www.ripe.net/ripe/docs/ipv6-policies" style="box-sizing:border-box;background:0px 0px;color:rgb(0,171,171);text-decoration-line:none">IPv6 Address Allocation and Assignment Policy</a> (current version)</li><li style="box-sizing:border-box;max-width:700px"><a href="https://www.ripe.net/ripe/docs/ap" style="box-sizing:border-box;background:0px 0px;color:rgb(0,171,171);text-decoration-line:none">RIPE NCC Activity Plan</a> (current version)</li><li style="box-sizing:border-box;max-width:700px"><a href="https://www.ripe.net/ripe/docs/charging" style="box-sizing:border-box;background:0px 0px;color:rgb(0,171,171);text-decoration-line:none">RIPE NCC Charging Scheme</a> (current version)</li><li style="box-sizing:border-box;max-width:700px"><a href="https://www.ripe.net/participate/billing/procedure" style="box-sizing:border-box;background:0px 0px;color:rgb(0,171,171);text-decoration-line:none">RIPE NCC Billing Procedure and Fee Schedule</a> (current version)</li><li style="box-sizing:border-box;max-width:700px"><a href="https://www.ripe.net/ripe/docs/closure" style="box-sizing:border-box;background:0px 0px;color:rgb(0,171,171);text-decoration-line:none">Closure of LIR and Deregistration of Internet Number Resources</a> (current version)</li><li style="box-sizing:border-box;max-width:700px"><a href="https://www.ripe.net/ripe/docs/transfer" style="box-sizing:border-box;background:0px 0px;color:rgb(0,171,171);text-decoration-line:none">Transfer of Internet Number Resources</a> (current version)</li><li style="box-sizing:border-box;max-width:700px"><a href="https://www.ripe.net/ripe/docs/clearinghouse" style="box-sizing:border-box;background:0px 0px;color:rgb(0,171,171);text-decoration-line:none">The RIPE NCC Clearing House Procedure</a> (current version)</li><li style="box-sizing:border-box;max-width:700px"><a href="https://www.ripe.net/ripe/docs/arbitration" style="box-sizing:border-box;background:0px 0px;color:rgb(0,171,171);text-decoration-line:none">RIPE NCC Conflict Arbitration Procedure</a> (current version)</li></ul></div><div></quote ></div><div><br></div><div>No matter whois the practical maintainer...the resource holder is </div><div>actually responsible.</div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">And the public interest is in keeping the internet running and identifying the users of blocks of IP addresses. </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
</blockquote><div> </div><div>...right! and, as it should stand :-)<br><br>Is it covering all the below section of text quoted from the T&C <br>(Terms & Conditions) of the RIPE Database [1]?<br><br><quote></div><div><h2 style="box-sizing:border-box;font-family:"Open Sans",Helvetica,Arial,sans-serif;line-height:1.3em;color:rgb(88,89,91);margin:0.75em 0px 12px;font-size:1.6em;max-width:700px">Article 3 -Purpose of the RIPE Database</h2><p style="box-sizing:border-box;margin:0px 0px 12px;max-width:700px;color:rgb(51,51,51);font-family:"Open Sans",Helvetica,Arial,sans-serif;font-size:13px">The <span class="gmail-ripe-glossary-popover" title="" style="box-sizing:border-box;background:transparent;border-bottom:1px dotted rgb(204,204,204)">RIPE Database</span> contains information for the following purposes:</p><ul style="box-sizing:border-box;margin:0px 0px 12px;padding:0px 0px 0px 20px;color:rgb(51,51,51);font-family:"Open Sans",Helvetica,Arial,sans-serif;font-size:13px"><li style="box-sizing:border-box;max-width:700px">Ensuring the uniqueness of Internet number resource usage through registration of information related to the resources and Registrants</li><li style="box-sizing:border-box;max-width:700px">Publishing routing policies by network operators (<span class="gmail-ripe-glossary-popover" title="" style="box-sizing:border-box;background:transparent;border-bottom:1px dotted rgb(204,204,204)">IRR</span>)</li><li style="box-sizing:border-box;max-width:700px">Facilitating coordination between network operators (network problem resolution, outage notification etc.)</li><li style="box-sizing:border-box;max-width:700px">Provisioning of Reverse <span class="gmail-ripe-glossary-popover" title="" style="box-sizing:border-box;background:transparent;border-bottom:1px dotted rgb(204,204,204)">Domain Name</span> System (DNS) and <span class="gmail-ripe-glossary-popover" title="" style="box-sizing:border-box;background:transparent;border-bottom:1px dotted rgb(204,204,204)">ENUM</span> delegations</li><li style="box-sizing:border-box;max-width:700px">Providing information about the <span class="gmail-ripe-glossary-popover" title="" style="box-sizing:border-box;background:transparent;border-bottom:1px dotted rgb(204,204,204)">Registrant</span> and <span class="gmail-ripe-glossary-popover" title="" style="box-sizing:border-box;background:transparent;border-bottom:1px dotted rgb(204,204,204)">Maintainer</span> of Internet number resources when the resources are suspected of being used for unlawful activities, to parties who are authorised under the law to receive such information.</li><li style="box-sizing:border-box;max-width:700px">Scientific research into network operations and topology</li><li style="box-sizing:border-box;max-width:700px">Providing information to parties involved in disputes over Internet number resource registrations to parties who are authorised under the law to receive such information.</li></ul></div><div></quote><br></div><div><br></div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
But, beyond this principle, I still see a need to change the elements<br>
of personal data that are processed for the different purposes of the<br>
database. </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br></blockquote><div><br></div><div>And yes, it matters! imho.</div><div>...my, humble & free, advice would still be: <br>__<br>Please propose a BCOP (Best Current Operational Practice) to try <br>to address it.<br>¯¯</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I understand what you say about IP addresses being<br>
considered as PII, as well as the business phone number of a 1 person<br>
company. So let me try to expand on my underlying thoughts. It seems<br>
we are all now surrounded by a multitude of PII elements. Name, home<br>
address, personal/private phone number and email, business related<br>
phone number and email, your IP addresses, etc. Even though all of it<br>
can be considered to be PII, which parts do you never want to end up<br>
in the public RIPE Database registry and what absolutely must be in<br>
the database?<br>
<br>
Most people accept that your name is a must, either as a resource<br>
holder or a contact. If you work from business premises the address is<br>
no problem, but if you work from home your full address should be an<br>
absolute no, although it is currently published. </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br></blockquote><div> </div><div>You might want to add an exceptional possibility in case of clear </div><div>demonstrated risks on the side of the home business owner. And </div><div>that means, imho, to: (i) an authorization request with documented </div><div>evidences, and (ii) approval to have the personal contact masked by </div><div>an email address alias within the RIPE NCC mailing system, such as </div><div>"contact$ContactId at privacy-protection·<a href="http://ripe.net">ripe.net</a>"</div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Many people say we cannot separate personal phones from business phones. But that is simply not true. Suppose we work for a 2 man business. This week I am on call 24/7 to fix network problems, next week you are on call. We both have a personal phone with us. If we also have a business phone (number) that can be routed to either phone, this is the only number that needs to be published in the RIPE Database. So no one can call me at 3am to fix a problem if I am not on call as they don't have my personal number. Calling the published business number will be routed<br>
to you. Maybe this business number is still technically PII. But there<br>
is a clear distinction between our core personal details and our<br>
business personal details. To maintain a healthy work/life balance no one should be forced, coerced, pressured into having their core<br>
personal details published in the RIPE Database, not even based on public interest regardless of what they want.<br>
<br>
This is what I mean by separating personal details from business<br>
details and only publishing business details in the database. </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br></blockquote><div> </div><div>Denis, it appears that you have already at least one really good thing<br> to include inside the draft of BCOP you should propose, imho ;-)</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Whether this can be expressed in general legalistic, or even in practical, terminology I don't know (yet). I believe the intent of this proposal is good (although some would disagree), but I don't think the current wording is good enough.<br><br></blockquote><div><br></div><div>...imho! this proposal, have now been at least demonstrated to:</div><div><br></div><div>|1. not be able to fairly address the problem targeted;</div><div>|2. have a problem which may oppose to the purpose of the RIPE DB.</div><div><br></div><div>...therefore, imho, it should be withdrawn asap.</div><div> </div><div>Shalom,</div><div>--sb.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">cheers<br>
denis<br>
proposal author<br>
<br>
<br>
<br>
On Wed, 26 Oct 2022 at 20:11, Frank Breedijk <<a href="mailto:f.breedijk@divd.nl" target="_blank">f.breedijk@divd.nl</a>> wrote:<br>
><br>
> [...]<br>
><br>
> Agree. I’m worried that this policy will have a negative impact in the long run.<br>
><br>
<br>[...]</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><br><div><font size="1">Best Regards ! <br>baya.sylvain [AT cmNOG DOT cm] |<a href="https://cmnog.cm/dokuwiki/Structure" target="_blank">cmNOG's Structure</a>|<a href="https://survey2.cmnog.cm/" target="_blank">cmNOG's Surveys</a><br>Subscribe to the <a href="https://lists.cmnog.cm/mailman/listinfo/cmnog/" target="_blank">cmNOG's Mailing List</a><br>__<i><br>#LASAINTEBIBLE|#Romains15:33«*Que LE #DIEU de #Paix soit avec vous tous! #Amen!*»<br>#MaPrière est que tu naisses de nouveau. #Chrétiennement<br>«*Comme une biche soupire après des courants d’eau, ainsi mon âme soupire après TOI, ô DIEU!*» (#Psaumes42:2)</i></font></div></div></div></div></div></div>