[ncc-services-wg] personal data in the NCC

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Dear David,

The RIPE Policy ripe-452, "Contractual Requirements for Provider
Independent Resource Holders in the RIPE NCC Service Region", requires
that End Users who receive independent resources from a sponsoring LIR
have a contractual agreement with that LIR. Specifically, it states,
"The intention of this policy document is to ensure that the RIPE NCC,
as the intermediate manager of provider independent resource assignments
to End Users, can confirm that the End User exists, continues to exist
and that they continue to fulfil their obligations to comply with the
original assignment conditions."

The policy concludes, "without contractual links in place between the
End User and the RIPE NCC, it is impossible for the RIPE NCC to fulfil
its obligations of responsible stewardship of Internet resources."

The full policy is available at:
http://ripe.net/ripe/docs/ripe-452.html

The RIPE NCC needs to have evidence of the contractual agreement, so we
ask for a copy of the signed contract between the End User and the LIR,
and the registration papers of the company requesting the resources. If
the End User is not a registered company, we ask for identification.
This is to ensure that the RIPE NCC has complete and correct data about
the holder of the resources.

The only other occasion when the RIPE NCC requests identification papers
is if there are doubts about the validity of a contract. If this is the
case, the RIPE NCC asks for the identification to ensure that the
contracts are valid and that the person signing the contracts is a real
person. However, this only happens on rare occasions and when the RIPE
NCC believes it is absolutely necessary to confirm the validity of
contracts. This is standard procedure for diligent verification of
contracts.

All personal data received by the RIPE NCC is handled in an appropriate
manner and in accordance with our Privacy Statement.

The RIPE NCC will only discuss individual cases with the LIR concerned,
and this is something we are always happy to do.

I hope this clarifies matters and answers your question. If you have any
further questions, please feel free to contact me.

Best regards,

Andrea Cima
Registration Services Manager
RIPE NCC


David Monosov wrote:
> Dear Andrew,
> 
> In your e-mail, you state:
> 
>> As a registry, the RIPE NCC has a mandate to ensure the accuracy of our
>> registration data. Verifying the identity of LIR representatives is directly
>> relevant to this mandate.
>>
> 
> It is however my understanding that the question of Mr. Myasoedov relates to PI
> resources assigned to end users through the LIR in which he is a representative,
> where the end user is an organization, and the requested personal identification
> documents were required for the representatives of the end user organization,
> rather than the LIR itself.
> 
> The intention of the RIPE NCC to not only collect personal identification
> documents from representatives of organizational end users, but to externalize
> this burden to individual LIRs which process PI requests on behalf of end users
> was not apparent from proposal 2007-01, nor from subsequent operational
> discussions on its implementation.
> 
> Instead, it was understood, and has previously been the operational reality,
> that organizational users will submit a certificate of incorporation or similar
> document attesting the organization's existence under the laws of their country
> of origin, and a contract which meets the requirements outlined in policy
> proposal 2007-01.
> 
> Could you please elaborate on the circumstances which required this deviation
> from the standard operational procedure and the situations in which this new
> condition will be invoked?
> 
> Such unannounced changes can be very disruptive to an established administrative
> workflow between a LIR and its end users if imposed suddenly, and while I am
> certain that the RIPE NCC is acting with the goal of improving accountability in
> resource assignment, a balance must be maintained between the mandate the
> community has granted the RIPE NCC with the introduction of policy 2007-01, and
> its ability to spontaneously introduce new administrative conditions to resource
> assignment.
> 
> --
> Respectfully yours,
> 
> David Monosov
> 
> 
> On 10/20/2010 03:11 PM, Andrew de la Haye wrote:
>> Dear Sergey,
>>
>> Thank you for your email. All personal data obtained by the RIPE NCC is handled
>> in accordance with Dutch law and European Union data protection legislation, as
>> required for an organisation operating in the Netherlands.
>>
>> The RIPE NCC Privacy Statement is publicly available on the RIPE website, and
>> describes the situations in which personal data may be requested and the RIPE
>> NCC's responsibilities when handling such data:
>> http://www.ripe.net/legal/privacy-statement.html
>>
>> Please note the following sections:
>> - "Except as described herein or when under a statutory duty to do so, the RIPE
>> NCC does not share or transfer any personal data." [Section 2.1]
>> - "The RIPE NCC maintains a high level of physical security and protection for
>> all its computer and network facilities, and, in particular, for those in which
>> personal information may be stored." [Section 3]
>>
>> As a registry, the RIPE NCC has a mandate to ensure the accuracy of our
>> registration data. Verifying the identity of LIR representatives is directly
>> relevant to this mandate.
>>
>> I hope this clarifies the RIPE NCC's position in relation to this matter.
>>
>> Best regards,
>>
>> Andrew de la Haye
>> Chief Operations Officer, RIPE NCC
>>
>>
>>
>>
>>
>> On Oct 20, 2010, at 11:25 AM, Sergey Myasoedov wrote:
>>
>>> Hello,
>>>
>>> I would like to talk about personal data protection. After the audit process,
>>> NCC demands
>>> that we send them, together with the contract, the ID of person who signs the
>>> End User
>>> assignment contract (even if the contract is signed by a person on behalf of
>>> company).
>>>
>>> It seems strange: the CEO of company that wants IP resources signs the
>>> contract, probably
>>> stamps it and suddenly (!) RIPE NCC asks for the ID of CEO. We (LIR) have no
>>> choice on such
>>> operations - we should request ID or RIPE NCC will not assign resources for
>>> our customers.
>>>
>>> Even more, RIPE NCC requires scans of ID, and this action violates local laws
>>> in some
>>> countries (for example, CZ or RU). In Russia, personal data can be processed
>>> only after a
>>> special agreement (except some cases mentioned in the law), but we will send
>>> the ID images
>>> without any special agreements to the NCC.
>>>
>>> I tried to find some statements on data protection in the RIPE NCC or on any
>>> guarantee of
>>> confidentiality, but no such information found in the standard service
>>> agreement or any
>>> policy documents.
>>>
>>> On these grounds, I would like to initiate a change. RIPE NCC should have data
>>> protection
>>> procedures or RIPE NCC should not request personal IDs of third parties.
>>>
>>>
>>> --
>>> Sergey
>>>
> 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.11 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkzATOkACgkQXOgsmPkFrjM9pgCgmqNsEpLlc9c7pFH2U74AMxkh
amAAoI6xf2guTElG3eHzmJI7JbGff6Nu
=XvUw
-----END PGP SIGNATURE-----