[db-wg] Update to RIPE Database Terms & Conditions

Colleagues

In the Impact Analysis (IA) for 2023-04, the RIPE NCC legal team
expressed rules for entering personal data into the RIPE Database that
are quite different to our previous understanding. This legal IA was
relied on heavily by the proposers of 2023-04 and constantly referred
to by them during the policy discussions. Based on the discussions and
the IA, the chairs of the AP-WG have now approved the proposal
2023-04. We MUST now update the RIPE Database Terms and Conditions to
reflect this new understanding on personal data.

In the IA the legal team said this:
"Inserting any personal data in the RIPE Database must be in
compliance with the RIPE Database Terms and Conditions, even when it
relates to the contact details of the member’s own contact person(s).
In particular, before anyone updates the RIPE Database with personal
data, they must obtain the contact person’s informed and expressed
consent and ensure this data is kept accurate and up-to-date."

Article 6.3 of the RIPE Database Terms and Conditions currently says:
"The Maintainer who enters personal data into the RIPE Database has a
responsibility to inform the individual to whom the data pertains and
to obtain their explicit consent for the entry in the public RIPE
Database if required by law."

This article does not accurately reflect the statement in the IA by
the legal team. The text "if required by law." must be removed. This
suggests that some personal data may not need the 'contact person’s
informed and expressed consent'. The IA makes it clear that all
personal data entered into the RIPE Database must have the 'contact
person’s informed and expressed consent'. There are no exceptions or
caveats to this consent. Also the responsibility must not be
restricted to the 'Maintainer'. ANYONE has the capability to enter
personal data into the RIPE Database. This personal data can then be
referenced by a Maintainer of resource data.

I would suggest Article 6.3 says something like this:

"Anyone who updates the RIPE Database with personal data must obtain
the contact person’s informed and expressed consent to enter their
personal details into a global, freely accessible, public database.
This consent cannot be subject to any conditions. If the consent is
withdrawn, the personal data must be removed from the RIPE Database in
a reasonable time frame. The personal data must be kept accurate and
up-to-date. The right to use some Internet resources requires a
consenting contact. If no such contact person is available, the right
to use some Internet resources may be revoked."

This is a clear and honest statement that fully reflects the IA
understanding of the use of personal data in the RIPE Database. I
would like to ask the RIPE NCC legal team to make arrangements for
this update to the Terms and Conditions.

cheers
denis
co-chair DB-WG

========================================================
DISCLAIMER
Everything I said above is my personal, professional opinion. It is
what I believe to be honest and true to the best of my knowledge. No
one in this industry pays me anything. I have nothing to gain or lose
by any decision. I push for what I believe is for the good of the
Internet, in some small way. Nothing I say is ever intended to be
offensive or a personal attack. Even if I strongly disagree with you
or question your motives. Politicians question each other's motives
all the time. RIPE discussion is often as much about politics and self
interest as it is technical. I have a style of writing that some may
not be familiar with, others sometimes use it against me. I also have
OCD. It makes me see the world slightly differently to others. It
drives my mind's obsessive need for detail. I can not change the way I
express my detailed opinions. People may choose how to interpret them.
========================================================