[members-discuss] is the RIPE NCC GDPR compliant ?

Hi Elvis,

As I mentioned previously, we have been working on the issues you 
mention.

You note that you have seen no progress on the ticketing issues. I can 
let you know that we have investigated all the options you mention (and 
more). Unfortunately, all options have some negative impacts and cause 
complexities for both the RIPE NCC and people who want to contact us.

Granular-level reporting on our progress is not always possible or 
useful, especially as much of this work involves assessment of all 
options before a decision can be made. Reporting to our members while 
work is ongoing can be problematic, as it can create false expectations 
or spark discussion on outcomes that might not take place. We have heard 
all of your comments on our ticketing system and you can be sure we will 
factor them into our work. The Executive Board, which follows this list 
closely, is also made aware of our progress on a regular basis. We will 
also present our operational update at RIPE 78, and we will be sure to 
include further details then.

Regarding the creation of objects in the RIPE Database, it’s important 
to be clear that here we are providing assistance for new RIPE NCC 
members. Objects are created by automated tooling, on behalf of the 
members, with the information they provide. Our tooling does not use the 
LIR's maintainer for authorising the creation or modification of 
objects. We are confident that we provide them with clear information on 
how the data they enter will be used and how they may update or delete 
it.

In 2008, the Data Protection Task Force decided that there was a 
requirement to have personal data in the database. The RIPE Database 
Working Group has suggested that it is time to revisit this analysis and 
we agree with this assessment. However, it would not be appropriate for 
the RIPE NCC to unilaterally determine whether PERSON objects are 
needed. We will therefore follow the community’s lead. The discussions 
in the Database Working Group and elsewhere will ultimately inform all 
the decisions we take regarding personal data in the RIPE Database.

And with multiple LIRs, it was not at all clear for a long time that the 
ability to create multiple LIRs would exist indefinitely. Indeed, the 
Executive Board prevented this via a resolution for a period until it 
became obvious that this led to people establishing new legal entities. 
The RIPE Database was set up to manage entries on an LIR basis, and it 
is not clear that changing this would be beneficial for RIPE Database 
users.

Kind regards,

Felipe Victolla Silveira
Chief Operations Officer
RIPE NCC