Hi Denis, all,
To recap the discussion on this topic: after it was first suggested to
introduce geofeed as a new attribute in the RIPE Database, we raised
some legal concerns related to its implementation and suggested that
technical restrictions are required to minimise the associated legal
risks. The main concerns arose because providing geolocation
information, including geolocation information that might contain
personal data, is not covered under the current purposes of the RIPE
Database.
From the discussion on the RIPE Database Working Group mailing list
prior to RIPE 85, various feedback was provided on the use of
geolocation information and the reasons for which this is useful for
network and content operators. At the RIPE 85 Database Working Group
session, the Working Group chairs declared there was consensus that
geolocation is a purpose the RIPE Database has to fulfil. They also
asked for input on the process to follow for amending the current RIPE
Database Terms and Conditions and working on a draft purpose. A draft
purpose has now been suggested, along with the question of whether this
addresses all legal concerns and if we can go ahead with the
implementation of the geofeed attribute.
Having established that geolocation is a purpose and looking at the
proposed text, our advice is to make this more explicit and explain why
personal data may be processed for the purpose of geolocation. We will
work on updating the RIPE Database Terms and Conditions in order to
specify this. In line with the Adoption Process for RIPE NCC Corporate
Documents
<https://www.ripe.net/about-us/legal/corporate-governance/adoption-process-for-ripe-ncc-corporate-documents>,
the proposed amendments will have to be approved by the RIPE NCC
Executive Board.
On the implementation side, we will discuss internally how we can make
it explicit when adding a geofeed attribute that the privacy of the
users of the related resources is respected. This is necessary because,
as mentioned in our previous replies, although the RIPE NCC is not the
party inserting the data in the csv file, legally we are co-responsible
for the information inserted in the RIPE Database (even if it is not
hosted there directly). As with all the other personal data in the RIPE
Database, the party that enters it has the responsibility to inform the
individual to whom the data pertains and to obtain their explicit
consent before entering it (Art. 6.3 RIPE Database Terms and Conditions).
Kind regards,
Maria Stafyla
Senior Legal Counsel
RIPE NCC
On 25/04/2023 11:25, Maria Stafyla wrote:
Hi Denis, all
This is to confirm that we are already working on our analysis and we
will get back to you as soon as possible.
Kind regards,
Maria Stafyla
Senior Legal Counsel
RIPE NCC
On 13/04/2023 12:29, denis walker wrote:
Colleagues
A question for the legal team at the RIPE NCC. Would a simple purpose,
as suggested below, address all the concerns you had about the use of
the "geofeed:" attribute and allow you to remove any restrictions you
felt were necessary when it was introduced?
cheers
denis
co-chair DB-WG
---------- Forwarded message ---------
From: denis walker <[email protected]>
Date: Tue, 11 Apr 2023 at 10:41
Subject: Geofeed purpose
To: Database WG <[email protected]>
Colleagues
The conversation on deploying geofeed died shortly after RIPE 85. The
last comment was from myself asking if anyone was willing to propose
some wording for a new purpose covering the use of the RIPE Database
for geolocation information. No one proposed any wording. So below I
have made a proposal for a new purpose. Your comments are appreciated.
cheers
denis
co-chair DB-WG
The RIPE Database contains information for the following purposes:
Ensuring the uniqueness of Internet number resource usage through
registration of information related to the resources and Registrants
Publishing routing policies by network operators (IRR)
Facilitating coordination between network operators (network
problem resolution, outage notification etc.)
Provisioning of Reverse Domain Name System (DNS) and ENUM
delegations
Providing information about the Registrant and Maintainer of
Internet number resources when the resources are suspected of being
used for unlawful activities, to parties who are authorised under the
law to receive such information.
Scientific research into network operations and topology
Providing information to parties involved in disputes over
Internet number resource registrations to parties who are authorised
under the law to receive such information.
Providing information about the geolocation usage of Internet number
resources.
--
To unsubscribe from this mailing list, get a password reminder, or change your
subscription options, please visit:
https://lists.ripe.net/mailman/listinfo/db-wg
