Hello again Jan,
On 10/01/24 11:25, Jan Ingvoldstad wrote:
Basically, any public company register would be illegal according to
the interpretation you lean on here.
Public company registries also need a lawful basis for processing. The
Norwegian public company registry, for example, uses the lawful basis
«exercise of official authority» – Article 6(1)(e) GDPR – as its lawful
basis, see https://www.brreg.no/en/privacy-statement/. I would assume
that to be the case in most other countries as well.
(Most) LIRs are not official authorities, so unlike public company
registries LIRs cannot use this lawful basis for publishing PII in the
RIPE Database.
In any case, all of this is rather off-topic. 2023-04 does not change
the legal obligations on the LIRs relating to the publication of End
User contact information, nor does it change the RIPE Database Terms and
Conditions. If you want to publish PII in the RIPE Database, you need a
lawful basis. That's true today, and that will continue to be true if
2023-04 passes.
Or you could take the other stance and stop publishing *any* contact
details regarding an object, because you cannot know whether the
information is personal data or not.
Exactly. LIRs may (but are not required to) chose this approach already
*today*. This is a common and long-standing practice which the RIPE NCC
has repeatedly clarified as compliant with today's policy.
It will continue to be compliant with the policy after 2023-04 passes,
as well. Thus, 2023-04 effects no change on the LIRs' obligations in
this regard.
I think that because the WG discussion has almost exclusively revolved
around this alleged changing of policy requirements to publish End
User contact information (which may or may not be PII), it is easy to
lose track of what this proposal is *actually* all about. We are
talking about two different things:
1) The actual intention behind the proposal: Making it possible to
aggregate multiple IPv4 End User assignments that have consistent
contact information and purpose into a single database object.
This is not possible today, and that is what we want to make that
possible, in the same way it is already possible in IPv6.
2) The *alleged* change to what kind of End User contact
information is required to be published in the RIPE database. We
have never had any intention of changing this in any way, and the
Impact Analysis and other statements from the RIPE NCC confirm
that the proposal does not change it either.
In short: 1) is an intentional and desired change from today,
while 2) is *not* a change from today – intentionally so.
This (regarding item 2) is simply not true. Any change in text *is a
change*.
We are not making the claim that the policy text does not change. That
it clearly does – in order to achieve the desired change described in
item 1 above.
We are however claiming that the *meanings* of the old and the new
policy texts are exactly the same, with regards to how they translate
into operational procedures and requirements for the publication of End
User contact information (item 2).
As the RIPE NCC writes in the Impact Analysis (emphasis added):
«Acceptance of this proposal **will not change** the fact that the
RIPE NCC cannot enforce which contact details members add to their IPv4
PA assignments in the RIPE Database; this **will remain** their decision.»
So, once again: which End User contact details LIRs publish (if any) is
their decision today, and it will be continue to be their decision if
2023-04 passes. Hence, 2023-04 does not effect any change in this regard.
So maybe we could discuss 1) instead of 2) going forward? :-)
I have no problem with 1), as already stated.
We're happy to hear that!
I do agree with you that this is distracting from the proper meat of
your proposal. Which is why I suggest that you drop this part of it.
Again, drop the part of the proposal that people have a beef with.
Don't make the change that you claim is not a change.
This «beef» is based on reading current policy to mean that which End
User contact details LIRs publish in the database (if any) is *not* the
LIRs' decision today.
But the RIPE NCC has repeatedly clarified that that is simply not the
case: it *is* the LIRs' decision today, and it will continue to be LIRs'
decision should 2023-04 pass.
Given that, it is hard to see how we could possibly amend the proposal
to change this particular point to an even lesser extent than what is
already the case?
Tore & Jeroen
--
To unsubscribe from this mailing list, get a password reminder, or change your
subscription options, please visit:
https://lists.ripe.net/mailman/listinfo/address-policy-wg
