[dp-tf] Authorization to publish personal data in the DB (was Re: [dp-tf] Quadlogy of person proposals)

On Fri, 15 Jun 2007, Elmar K. Bins wrote:

Hi Elmar,

> Hi Janos and Larissa,
>
> zsako at 3c-hungary.hu (Janos Zsako) wrote:
>
> > You are saying that we may not invent new authorization rules,
> > as these are laid down by the law already (and may not be changed).
>
> As long as there is no unified european law governing this, the RIPE
> NCC and all contracts it makes are by default governed by dutch law.

Right. EU Directive will be also OK.
Let's look if the RIPE Database rules comly with it.
For example, Section II, "CRITERIA FOR MAKING DATA PROCESSING LEGITIMATE"

1. Member States shall provide that personal data may be processed only if:
(a) the data subject has unambiguously given his consent; or

No. admin-c and tech-c are mandatory, without any personal consent

(b) processing is necessary for the performance of a contract to which the data subject
is party or in order to take steps at the request of the data subject prior to entering
into a contract; or

Contract (SSA) says nothing about pers. data protection at the moment.

(c) processing is necessary for compliance with a legal obligation to which the controller is subject;

what a legal obligationis here, unclear. A loyer needed.
If in the sence of Policy ripe document "The RIPE NCC is responsible for the allocation and assignment of Internet Protocol (IP) address space, Autonomous System Numbers (ASNs) and the management of reverse domain names within this region..."

RIPE NCC can fulfil it's obligations without personal data publishing in the whois.
We do not need person nic-hdl entering resource objects into the db, mntner is enough.
To get approval from the hostmaster, we don't need to open data to everybody,
it would be enough to keep them on the lir portal. If smbody want to get in touch
because of spam etc, there is "remarks" in the inetnum and others objects etc.
What else? So, how my personal data help the RIPE NCC to fulfil obligations?

(d) processing is necessary in order to protect the vital interests of the data subject; or

No

(e) processing is necessary for the performance of a task carried out in the public
interest or in the exercise of official authority vested in the controller or in a third
party to whom the data are disclosed; or

No

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or
by the third party or parties to whom the data are disclosed,<...>

Legitimate interests also will do without personal data in "admin-c" or "tech-c",
which could be easily filled in with e-mail of org or tel number with the same effect.

Thats'all.
So, WHAT MAKES PERSONAL DATA PROCESSING IN THE RIPE DB LEGITIMATE?

:))

> There are cases where special contracts need to be made, governed by
> another country's law (e.g., russian federation).
>
> Nonetheless, as long as there is no such european general law that
> applies to the RIPE NCC, the RIPE NCC is free to create agreements
> that are legal under dutch law. What special laws any country within
> RIPE's region creates or doesn't is entirely irrelevant to the RIPE
> NCC's course _unless_ there is a special contract governed by that
> country's law.
>
> So, in order to follow Larissa's argument, the RIPE NCC would have to
> create special/different contracts for contractors from different
> countries, if the parties need the contract to be governed by that
> country's laws.
>
> I'm quite humble in legal matters, so if what I write above is crap,
> discard it. But to me the problem of international contracts breaks
> down to the simple thing of having an encompassing law or not.
>
> Yours,
> 	Elmar.
>
> --
>
> "Hinken ist kein Mangel eines Vergleichs, sondern sollte als wesentliche
>  Eigenschaft von Vergleichen angesehen werden."       (Marius FrДnzel in desd)
>
> --------------------------------------------------------------[ ELMI-RIPE ]---
>
>


With respect,
Larisa Yurkina
---
RIPN Registry center
-----