Report of the RIPE Data Protection Task Force

The RIPE Data Protection Task Force (DPTF) was established at RIPE 52 in April 2006 when the Database Working Group identified a need to update the RIPE Database in compliance with Dutch legislation. It was decided that the task force would be disbanded when the discussed deliverables were completed.

Introduction

The RIPE Data Protection Task Force (DPTF) was established at RIPE 52 in April 2006 when the Database Working Group identified a need to update the RIPE Database in compliance with Dutch legislation. It was decided that the task force would be disbanded when the discussed deliverables were completed.

Background and Rationale

The RIPE NCC operates the RIPE Database. The RIPE Database contains registration details of IP addresses and AS Numbers. It shows the organisations that hold the resources, where the allocations were made and contact details of those responsible for the networks. This information in the RIPE Database is publicly available

The RIPE NCC is an association registered in the Netherlands, so it must comply with the EU Data Protection Directive and the Dutch Data Protection Act. The RIPE NCC is considered to be the “data controller” under the terms of the Dutch Data Protection Act. The DPTF agreed to take all necessary steps to ensure that the RIPE NCC complies with the legislation.

Goals and Deliverables

The DPTF agreed on the following deliverables:

  • Work with the RIPE NCC to develop procedures and practices required to comply with data protection regulations
  • Raise awareness about these issues within the RIPE community
  • Inform the RIPE community about new procedures and practices
  • Consider any serious issues arising from differences between Dutch legislation and rulings made in different parts of the RIPE NCC service region, advising on possible options

Meetings

The DPTF met during the following RIPE Meetings:

  • RIPE 53 (2-6 October 2006, Amsterdam, the Netherlands)
  • RIPE 54 (7-11 May 2007, Tallinn, Estonia)
  • RIPE 55 (22-26 October 2007, Amsterdam, the Netherlands)
  • RIPE 56 (5-9 May 2008, Berlin, Germany)
  • RIPE 57 (26-30 October 2008, Dubai, UAE)
  • RIPE 58 (4-8 May 2009, Amsterdam, the Netherlands)
  • RIPE 59 (5-9 October 2009, Lisbon, Portugal)

Outcome

The DPTF together with the RIPE NCC and input from the RIPE Community developed the procedures of the RIPE NCC to control personal data exposure and set up a legal framework for the use of personal data in accordance with the data protection regulations. In particular, the following actions were taken:

  • The DPTF was in communication with the RIPE community (via RIPE Meetings, the DPTF mailing list and the Database Working Group mailing list) and published the changes in procedures and documents.
  • A legal framework was set up for the use of personal data in the RIPE Database with the publication of the RIPE Database Terms and Conditions. Accordingly, the personal information in the RIPE Database must be used only for the purposes mentioned in the RIPE Database Terms and Conditions.
  • The RIPE Database Acceptable Use Policy (AUP) was created to limit the number of queries permitted to the RIPE Database and to avoid the abusive collection of personal data.
  • The DPTF formulated a procedure for the removal of personal contact details from the RIPE Database and issued the relevant document.
  • The DPTF requested mandatory authorisation for maintaining personal data in the RIPE Database and created the status of “Maintainer (Mnt-by)” for those responsible for personal details in the RIPE Database.
  • A clean up of all unreferenced personal data objects and associated maintainers from the RIPE Database was carried out. In parallel, a White Pages mechanism was created for those who wish to keep their personal data in the RIPE Database even if it is not referenced by any operational object.
  • Services such as Near Real Time Mirroring (NRTM), bulk access and proxy services were modified to comply with the data protection regulations. Accordingly, subscribers to the updated services must sign new agreements that the DPTF issued and communicated to the public.

 

More information and analysis of the legal reasoning behind these actions is available in the following document:

Conclusion

The tasks for which the DPTF was established are completed and as a result the task force is closed. The RIPE NCC will continue to listen to what the community has to say, will keep monitoring legal framework changes and will react appropriately when necessary. Thank you to all DPTF participants and supporters.

Members of the Task Force:

Manfredo Miserocchi (Chair), János Zsakó, Wilfried Woeber, Peter Koch, Richard Cox, Elmar K. Bins and Larissa Yurkina.

Athina Fragkouli, Jochem de Ruig and Denis Walker from the RIPE NCC provided support to the DPTF.