[ncc-services-wg] [anti-abuse-wg] EU Data Protection

On Wed, Nov 05, 2014 at 03:03:15AM -0800, Ronald F. Guilmette
+wrote:
>> I personally think that publishing "person" objects does
+indeed break the
>> law, NCC Legal clearly disagrees.
>
> It would seem so, and may God bless them for that.
  
Actually, this is something I'd like to hear the "official"
answer to, so let's ask the NCC:
  
Having looked at some resources registered in the ripedb to
natural persons and having found that the organisation: objects
contain information such as full names, addresses and phone
numbers,
  
Assuming that this information is *required* to be there in order
to be assigned independent resources,

how does the uncontrolled publishing of that data possibly comply
with the EU Data Protection Directive and imminent 
General Data Protection Regulation,

especially considering the entirely uncontrolled transfer of such
data to non-EU countries (whois lookups!)?

IANAL, but to me it looks like a breach of said regulations.

rgds,
Sascha Luck