[address-policy-wg] Post Ident / Post Brief

Dear Athina,

On Tue, 25 Feb 2014 16:03:40 +0100
Athina Fragkouli <athina.fragkouli at ripe.net> wrote:

> police, the notary, the municipality, etc). Postident is issued by
> Deutsche Post AG, a private company, so we are unable to accept it.

It is not a means of identification that is issued, such as an id card,
but a standardized and widely used verification process. This process is
designed to accommodate national legal restrictions as concerns the
copying of identification documents.

The process is invoked by the entity that wishes a confirmation of
identity. Upon such a request a token is provided by Deutsche Post AG to
the person whose identity shall be validated. Said person hands the
token and their ID to an employee of Deutsche Post AG or one of their
subsidiaries in order to have the ID checked. If the ID is indeed valid
and matches the credentials stated in the validation token a
statement of confirmation is issued by Deutsche Post AG which sent back
to the invoking entity.

> If a natural person wants to register Internet number resources by
> signing a contract with either the RIPE NCC or a sponsoring LIR, the
> RIPE NCC accepts the following proof of identification:
> - National identification card or passport

...of which you can't - by German laws - demand a copy.

> - Valid driving license with photo

Not every natural person is necessarily holding a drivers license.

> - Birth certificate issued by the relevant municipality, notary
> declaration proving the existence of the person, etc.

That might work, however I fail to see the difference between a notary
declaration of the existence and validity of a document and the
postident-process. Granted... the German postal service (luckily?) has
no notarial authority but postident is the next best thing and it is
widely available.

> We believe these options cover situations where the natural persons do
> not want to provide their identification card or passport.

It is not about not _wanting_ to provide a copy... You are simply in
violation of the law if you demand a copy of an official id. The only
exemption from this law is §1 of the Geldwäschegesetz as laid out here:
http://www.gesetze-im-internet.de/gwg_2008/__1.html
Unless the NCC engages in banking activities (for which I fail to see
even the chance of a consensus) copies of nationally issued id cards
are off limits.

> The RIPE NCC is committed to protecting all personal information in
> accordance with its Privacy Statement:

To the best of your abilities. Which is ok but does not matter here.
It is not about people being concerned that their data might become
unintendedly available to a wider audience due to negligence on the
RIPE NCC's side, but compliance with local laws.

> If you have any further questions, please contact me.

dito.

I hope this clarifies the nature of the issue.
There are also detailed WP:de articles about this topic for further
reading:
http://de.wikipedia.org/wiki/Identit%C3%A4tsfeststellung
http://de.wikipedia.org/wiki/Legitimationspr%C3%BCfung
http://de.wikipedia.org/wiki/Postident-Verfahren

TL;DR: Unless you implement verification processes such as PostIdent or
demand notarized declarations of the validity of identities instead
of demanding copies of IDs you are in violation of German law. Please
keep us updated about changes in your verification procedures for German
citizens and the status of compliance with German laws.
As Gert pointed out, the process just applys to DAUs, which is a
category that's going to disappear. I hope this matter will resolve
itself thusly anyway.

Kind regards,
Michael

p.s. just looked up the exact legal norms for your convenience:
§14 and § 20 paragraph 1 Personalausweisgesetz
http://www.gesetze-im-internet.de/pauswg/BJNR134610009.html
original precedent at the Verwaltungsgericht Hannover,
10. Kammer, Urteil vom 28.11.2013, 10 A 5342/11:
http://www.rechtsprechung.niedersachsen.de/jportal/portal/page/bsndprod.psml?doc.id=JURE140002005&st=null&showdoccase=1
summary of the case 10 A 5342/11:
http://www.verwaltungsgericht-hannover.niedersachsen.de/portal/live.php?navigation_id=19421&article_id=120077&_psmand=126Legal