[db-wg] GDPR and the RIPE Database

In message <FAF10ECC-9DCE-4CCE-8289-A8BB416152DA at ripe.net>, 
Edward Shryane <eshryane at ripe.net> wrote:

>We implemented and deployed the changes below for GDPR compliance as 
>part of Whois 1.95.1, on the 18th September:
>
>https://www.ripe.net/manage-ips-and-asns/db/release-notes/ripe-database-release-1.95

Could you please provide some additional and detailed clarity on exactly
what will and what won't henceforth be hidden?

Neither the page you referenced nor the RIPE 76 presentation slides
perovide any real clarity about what has changed, exactly, much less
how, or whether the needs of legitimate historical research were taken
into account when deciding on the implementation specifics.

There is obviously a great desire, in some quarters, at least, to hide
everyhing as much as possible.  This applies to both governments and to
quasi-governmental organizations such as the five RIRs.  To the extent
that this is motivated by legitimate privacy concerns, as promoted by
GDPR, this is reasonable and desirable.  To the extent that this is
motivated by a desire to mask malfeasance it is not.  The devil is in
the details.

Is access to historical person and role informtaion being totally wiped
out entirely, or are the fine details that some would consider private
and personal information merely being elided?  The latter is justifiable,
under GDPR, and based upon a reasoanble concern for the privacy of the
individual.  The wholesale "disappearing" of history is however not
justifiable.

If the name of a person, the final four digits of the person's phone number
and the <<userID>> part of a person's exact email address are elided,
then this is both eminently reasonable and arguably required under GDPR.
Anything beyond that becomes reminicent of Winston Smith, cutting and
pasting old newspaper stories in order to adjust history in accordance
with the preferences of The Party.


Regards,
rfg