Hi Denis, all According to Article 3 of the RIPE Database Terms and Conditions, one of the defined purposes for the use of the RIPE Database is "Facilitating coordination between network operators". A PERSON object is meant to contain the (business) contact information of people who are responsible for the networks the Internet number resources correspond to and/or for maintaining the related information in the RIPE Database and the DNS zone contacts. If someone creates a PERSON object that is not meant for one of the defined purposes, this would constitute a violation of the RIPE Database Terms and Conditions (See Article 4.1.). It's also worth noting that PERSON objects that are not referenced in any other object (and thus do not serve any operational purpose) are automatically deleted after 90 days. In general, personal data may only be processed in accordance with the relevant principles. If personal data is no longer required in relation to the defined purpose it was supplied/collected for, then its processing will not be justified any more. However, depending on the information that is inserted when a ROLE object is created, it might contain personal data - this is something the RIPE NCC has no control over. Kind regards, Maria Stafyla Legal Counsel RIPE NCC

Hi Nick, Athina

Perhaps the RIPE NCC legal team can give us some advice on this issue. In your presentation at RIPE 76 you said the justification for personal data in the RIPE Database was for contacting people about operational issues. If many of these 2 million people whose personal data is held in the RIPE Database are not contacts, is there any legal justification for having this amount of personal data in the database?

Also if 'contacts' can be roles rather than identifiable people, can we justify holding this personal data simply because, historically, PERSON objects were used instead of ROLE objects?

cheers denis co-chair DB-WG

------------------------------------------------------------------------ *From:* Nick Hilliard <nick@foobar.org> *To:* denis walker <ripedenis@yahoo.co.uk> *Cc:* DB-WG <db-wg@ripe.net> *Sent:* Sunday, 7 October 2018, 14:56 *Subject:* Re: [db-wg] PERSON objects in the RIPE Database

denis walker wrote on 25/09/2018 23:55:

...

So really the only question that must be answered is "Can we justify holding this amount of personal data on the basis of contacts for administrative and technical issues relating to internet resources and network operations?" If the answer is 'no' then change MUST happen, long before the universe dies.

I.e. "is what we have [...] legal"?

DBWG probably needs to get a legal opinion on this.

Nick