[db-wg] Fwd: proposal: new attribute 'geofeed:

Dear Maria,

On Wed, Jan 27, 2021 at 09:21:53AM +0100, Maria Stafyla via db-wg wrote:
> Thank you for your patience in this matter.
> 
> We looked into this and the answer varies depending on the situation.
> 
> Allocations and assignments can be made to either natural or legal
> persons. In the inetnums and inet6nums to be created the contact details
> of the relevant person will be inserted.
> 
> For example, if a /27 IPv4 block is assigned to a legal person, the
> geofeed data will likely not constitute personal data. This will not be
> the case if an IPv4 /32 (single IP address) is assigned to a sole trader
> and the assignment is registered under the sole trader's name in the
> RIPE Database*. In this latter example, the inetnum will contain the
> contact details of the sole trader and the geofeed data will qualify as
> personal data.
> 
> This is because personal data under GDPR is defined as any information
> that relates to an identified or identifiable natural person.
> 
> Based on the above and before introducing the geofeed attribute, a full
> impact analysis of its implementation would have to be conducted by the
> RIPE NCC.

>From the above it appears the reasoning stems from an assmumption that
RIPE NCC hosts or publishes geofeed data. I believe this is not the
case, the data in a geofeed file is whatever the hoster of the
geofeed.csv file puts in the file. 

The contents of the geofeed file (which is not published by RIPE NCC)
are at the discretion of whoever hosts the geofeed file, this entity
could be a sole trader or some other entity. It is the hoster's
responsibility to comply with GDPR and other applicable laws.

Can you confirm that merely listing an arbitary URL from within the
RIPE database does not constitute personal data? An example is here:

    $ whois -h whois.ripe.net 2001:67c:208c:: | grep Geofeed
    remarks:        Geofeed https://instituut.net/geofeed.csv

The string 'Geofeed https://instituut.net/geofeed.csv' itself is not
personal data, nor is it under control of the RIPE NCC.

Can you confirm a hyperlink such as 'https://instituut.net/geofeed.csv'
(or one step further, any content hosted at instituut.net) are outside
the scope of the RIPE NCC?

Kind regards,

Job