Hi Frank

Thank you for some very useful information here. This is the type of
input we need in these discussions. I have had many discussions with
the RIPE NCC legal team about this proposal. They did point out to me
there is a difference between processing personal data for the
'legitimate interest of the public' and processing it by consent of
the data subject. I obviously didn't fully understand the consequences
of such a change. Nor did I realise that certain phrases or comments
would imply such a change has been made and that the change would then
apply across the board. 

Having read carefully what you have said here, I think we need to
maintain the 'legitimate interest of the public' as the principle
reason for processing personal data in the RIPE Database. 

It would seem this bypasses the need for explicit consent from the data subject where public interest is involved. 

And the public interest is in keeping the internet running and identifying the users of blocks of IP addresses. 

But, beyond this principle, I still see a need to change the elements
of personal data that are processed for the different purposes of the
database. 

I understand what you say about IP addresses being
considered as PII, as well as the business phone number of a 1 person
company. So let me try to expand on my underlying thoughts. It seems
we are all now surrounded by a multitude of PII elements. Name, home
address, personal/private phone number and email, business related
phone number and email, your IP addresses, etc. Even though all of it
can be considered to be PII, which parts do you never want to end up
in the public RIPE Database registry and what absolutely must be in
the database?

Most people accept that your name is a must, either as a resource
holder or a contact. If you work from business premises the address is
no problem, but if you work from home your full address should be an
absolute no, although it is currently published. 

Many people say we cannot separate personal phones from business phones. But that is simply not true. Suppose we work for a 2 man business. This week I am on call 24/7 to fix network problems, next week you are on call. We both have a personal phone with us. If we also have a business phone (number) that can be routed to either phone, this is the only number that needs to be published in the RIPE Database. So no one can call me at 3am to fix a problem if I am not on call as they don't have my personal number. Calling the published business number will be routed
to you. Maybe this business number is still technically PII. But there
is a clear distinction between our core personal details and our
business personal details. To maintain a healthy work/life balance no one should be forced, coerced, pressured into having their core
personal details published in the RIPE Database, not even based on public interest regardless of what they want.

This is what I mean by separating personal details from business
details and only publishing business details in the database. 

Whether this can be expressed in general legalistic, or even in practical, terminology I don't know (yet). I believe the intent of this proposal is good (although some would disagree), but I don't think the current wording is good enough.

cheers
denis
proposal author



On Wed, 26 Oct 2022 at 20:11, Frank Breedijk <f.breedijk@divd.nl> wrote:
>
> [...]
>
> Agree. I’m worried that this policy will have a negative impact in the long run.
>

[...]