<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Denis,<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 12 Nov 2021, at 14:27, denis walker <<a href="mailto:ripedenis@gmail.com" class="">ripedenis@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi all<br class=""><br class="">In the Legal Review it seems to assume that for assignments "that are<br class="">reasonably assumed to be related to one individual user", that user is<br class="">a natural person. A /32 can be a business.<br class=""><br class="">There is a suggestion to allow geofeed for registrations over a<br class="">certain size. What is the implication of this suggestion? Will the<br class="">update software only allow the "geofeed:" attribute in the larger<br class="">assignment objects? </div></div></blockquote><div><br class=""></div><div><span style="color: rgb(36, 41, 46); font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 13px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">The legal advice is to enforce a minimum prefix size for geofeed, in order to minimise the RIPE NCC's responsibility to make sure that personally identifiable information is not added to the RIPE database. This needs to be enforced in software, rather than leaving it to the maintainer's discretion.</span></div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div class="">The update software is not going to validate the<br class="">contents of the referenced URL. So a "geofeed:" attribute on a /24 (or<br class="">larger) assignment object may reference a URL that contains<br class="">geolocation data relating to a more specific /32. So are we saying the<br class="">legal review is offering 'guidance' to resource holders not to include<br class="">geolocation data for assignments smaller than /24, but the<br class="">responsibility/liability is on the resource holder?<br class=""></div></div></blockquote><div><br class=""></div><span style="color: rgb(36, 41, 46); font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 13px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">We previously decided in the implementation plan not to validate the contents of the geofeed: URL as it is not hosted in the RIPE database. The content of any external data source is the maintainer's own responsibility.
</span><br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class="">I can see the logical argument behind the legal comment, but I don't<br class="">see the practicality of monitoring or enforcement of this argument.<br class=""><br class="">cheers<br class="">denis<br class="">co-chair DB-WG<br class=""><br class=""></div></div></blockquote><br class=""></div><div>Regards</div><div>Ed Shryane</div><div>RIPE NCC</div><div><br class=""></div><br class=""></body></html>