<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>
    </p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB">Dear colleagues,</span></p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB">Following the legal update we
        provided on NWI-13: Geofeed at the DB WG session at RIPE 84,
        here is our analysis in case further
        discussion on this topic is needed.<br
          style="mso-special-character:line-break">
        <br style="mso-special-character:line-break">
      </span></p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB">Executive Summary:</span></p>
    <p class="MsoListParagraphCxSpFirst"
      style="margin-top:9.0pt;margin-right:0cm;
margin-bottom:9.0pt;margin-left:36.0pt;mso-add-space:auto;text-indent:-18.0pt;
      mso-list:l0 level1 lfo1"><span lang="EN-GB"><span
          style="mso-list:Ignore">-<span style="font:7.0pt "Times
            New Roman"">      
          </span></span></span><span lang="EN-GB">The RIPE Database is
        meant to
        contain specific information for its documented purposes.</span></p>
    <p class="MsoListParagraphCxSpMiddle"
      style="margin-top:9.0pt;margin-right:0cm;
margin-bottom:9.0pt;margin-left:36.0pt;mso-add-space:auto;text-indent:-18.0pt;
      mso-list:l0 level1 lfo1"><span lang="EN-GB"><span
          style="mso-list:Ignore">-<span style="font:7.0pt "Times
            New Roman"">      
          </span></span></span><span lang="EN-GB">Information inserted
        in the
        geofeed attribute could in some cases qualify as personal data.</span></p>
    <p class="MsoListParagraphCxSpMiddle"
      style="margin-top:9.0pt;margin-right:0cm;
margin-bottom:9.0pt;margin-left:36.0pt;mso-add-space:auto;text-indent:-18.0pt;
      mso-list:l0 level1 lfo1"><span lang="EN-GB"><span
          style="mso-list:Ignore">-<span style="font:7.0pt "Times
            New Roman"">      
          </span></span></span><span lang="EN-GB">The current purposes
        could
        explain geolocation information to be inserted only for
        ‘scientific research
        into network operations and topology’.</span></p>
    <p class="MsoListParagraphCxSpMiddle"
      style="margin-top:9.0pt;margin-right:0cm;
margin-bottom:9.0pt;margin-left:36.0pt;mso-add-space:auto;text-indent:-18.0pt;
      mso-list:l0 level1 lfo1"><span lang="EN-GB"><span
          style="mso-list:Ignore">-<span style="font:7.0pt "Times
            New Roman"">      
          </span></span></span><span lang="EN-GB">This purpose does not
        justify
        the processing of personal data; therefore restrictions had to
        be put in place
        to avoid the processing of unnecessary personal data.</span></p>
    <p class="MsoListParagraphCxSpMiddle"
      style="margin-top:9.0pt;margin-right:0cm;
margin-bottom:9.0pt;margin-left:36.0pt;mso-add-space:auto;text-indent:-18.0pt;
      mso-list:l0 level1 lfo1"><span lang="EN-GB"><span
          style="mso-list:Ignore">-<span style="font:7.0pt "Times
            New Roman"">      
          </span></span></span><span lang="EN-GB">The restrictions are
        now
        implemented based on the status of the registration.</span></p>
    <p class="MsoListParagraphCxSpLast"
      style="margin-top:9.0pt;margin-right:0cm;
margin-bottom:9.0pt;margin-left:36.0pt;mso-add-space:auto;text-indent:-18.0pt;
      mso-list:l0 level1 lfo1"><span lang="EN-GB"><span
          style="mso-list:Ignore">-<span style="font:7.0pt "Times
            New Roman"">      
          </span></span></span><span lang="EN-GB">If the purposes of the
        RIPE Database
        have changed in the meantime, this should be established via the
        community
        processes and documented. In that case we will re-evaluate the
        situation and
        the need for restrictions. Until then, the restrictions remain
        necessary.</span></p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB"><br>
        Legal Analysis:</span></p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB">The RIPE Database is meant to
        contain
        specific information for the purposes that are defined in the
        RIPE Database
        Terms and Conditions.</span></p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB">In terms of the _personal
        data_ inserted in
        there, the purpose that justifies its publication is to
        facilitate the
        coordination of network operations for the smooth and
        uninterrupted operation
        of Internet; this purpose explains why contact details of
        resource holders or
        their appointed contact persons are required. </span></p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB">Before any new type of
        personal data is
        permitted to be inserted in the RIPE Database, we must evaluate
        if their
        processing is required for the purposes already defined and
        their processing
        can be considered in line with the basic personal data
        processing principles.</span></p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB">Although it is the
        responsibility of the
        party inserting personal data to ensure that they have the
        appropriate legal
        grounds before doing so, the RIPE NCC has also shared
        responsibilities with
        regards to the personal data in the RIPE Database. This is
        because the RIPE NCC
        is the party that is making the RIPE Database available and
        implements the
        instructions given by the RIPE community.</span></p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB">As mentioned in the Legal
        Review Impact
        Analysis, if the geofeed attribute is inserted for registrations
        of assignments
        that are reasonably assumed to be related to one individual
        user, then the
        attribute will be considered as containing personal data and
        GDPR will apply. This
        is why we have proposed to implement restrictions.</span></p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB">These restrictions are
        essential to avoid any
        processing of personal data that is not required or necessary
        for the <b>currently
          defined</b> purposes of the RIPE Database and to limit the
        RIPE NCC's liability
        as a party with shared responsibilities in relation to the
        personal data
        inserted in the RIPE Database. </span></p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB">Regarding the _(non-personal)
        data _inserted
        in the RIPE Database, it is also paramount that only data that
        is needed for
        the defined purposes of the RIPE Database is inserted.</span></p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB">According to the RIPE Database
        Terms and
        Conditions, introducing the geofeed attribute (with
        restrictions) would be
        considered in line and acceptable to be used only for scientific
        research into
        network operations and topology (see Art. 3).</span></p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB">We also understand that the
        purposes the RIPE
        Database must fulfil are not static but evolve over time.</span></p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB">The RIPE Database Requirements
        Task Force has
        recently concluded its work and, with regard to geolocation, it
        has established
        that, although there is an active user group for geolocation
        data, geolocation
        itself is not an objective that the RIPE Database should fulfil.</span></p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB">If the community's interests
        have changed
        since then and it is now agreed that geolocation is one of the
        purposes the
        RIPE Database must fulfil, this should be decided via the
        community's processes
        and reflected in the RIPE Database Terms and Conditions. </span></p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB">In line with the data
        management principles
        proposed by the RIPE Database Requirements Task Force, it would
        be prudent to
        approach this issue holistically, taking into account that other
        geolocation
        information is already provided in the RIPE Database (i.e.
        geoloc, country code
        attributes in ORG and resource objects). </span></p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB">On the basis of a new purpose
        for the
        geolocation information, we could then reassess the situation to
        understand
        whether the restrictions on the geofeed attribute are still
        necessary or whether
        it is justified to process personal data for this purpose.</span></p>
    <p class="MsoNormal"
      style="margin-top:9.0pt;margin-right:0cm;margin-bottom:9.0pt;
      margin-left:0cm"><span lang="EN-GB">Kind regards,<br>
        <br>
        Maria Stafyla<br>
        Senior Legal Counsel<br>
        RIPE NCC</span></p>
    <p>
      <style>@font-face
        {font-family:Wingdings;
        panose-1:5 0 0 0 0 0 0 0 0 0;
        mso-font-charset:77;
        mso-generic-font-family:decorative;
        mso-font-pitch:variable;
        mso-font-signature:3 0 0 0 -2147483647 0;}@font-face
        {font-family:"Cambria Math";
        panose-1:2 4 5 3 5 4 6 3 2 4;
        mso-font-charset:0;
        mso-generic-font-family:roman;
        mso-font-pitch:variable;
        mso-font-signature:-536870145 1107305727 0 0 415 0;}p.MsoNormal, li.MsoNormal, div.MsoNormal
        {mso-style-unhide:no;
        mso-style-qformat:yes;
        mso-style-parent:"";
        margin:0cm;
        line-height:115%;
        mso-pagination:widow-orphan;
        font-size:11.0pt;
        font-family:"Arial",sans-serif;
        mso-fareast-font-family:Arial;
        mso-ansi-language:EN-GB;}p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
        {mso-style-priority:34;
        mso-style-unhide:no;
        mso-style-qformat:yes;
        margin-top:0cm;
        margin-right:0cm;
        margin-bottom:0cm;
        margin-left:36.0pt;
        mso-add-space:auto;
        line-height:115%;
        mso-pagination:widow-orphan;
        font-size:11.0pt;
        font-family:"Arial",sans-serif;
        mso-fareast-font-family:Arial;
        mso-ansi-language:EN-GB;}p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst
        {mso-style-priority:34;
        mso-style-unhide:no;
        mso-style-qformat:yes;
        mso-style-type:export-only;
        margin-top:0cm;
        margin-right:0cm;
        margin-bottom:0cm;
        margin-left:36.0pt;
        mso-add-space:auto;
        line-height:115%;
        mso-pagination:widow-orphan;
        font-size:11.0pt;
        font-family:"Arial",sans-serif;
        mso-fareast-font-family:Arial;
        mso-ansi-language:EN-GB;}p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle
        {mso-style-priority:34;
        mso-style-unhide:no;
        mso-style-qformat:yes;
        mso-style-type:export-only;
        margin-top:0cm;
        margin-right:0cm;
        margin-bottom:0cm;
        margin-left:36.0pt;
        mso-add-space:auto;
        line-height:115%;
        mso-pagination:widow-orphan;
        font-size:11.0pt;
        font-family:"Arial",sans-serif;
        mso-fareast-font-family:Arial;
        mso-ansi-language:EN-GB;}p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast
        {mso-style-priority:34;
        mso-style-unhide:no;
        mso-style-qformat:yes;
        mso-style-type:export-only;
        margin-top:0cm;
        margin-right:0cm;
        margin-bottom:0cm;
        margin-left:36.0pt;
        mso-add-space:auto;
        line-height:115%;
        mso-pagination:widow-orphan;
        font-size:11.0pt;
        font-family:"Arial",sans-serif;
        mso-fareast-font-family:Arial;
        mso-ansi-language:EN-GB;}.MsoChpDefault
        {mso-style-type:export-only;
        mso-default-props:yes;
        font-size:11.0pt;
        mso-ansi-font-size:11.0pt;
        mso-bidi-font-size:11.0pt;
        font-family:"Arial",sans-serif;
        mso-ascii-font-family:Arial;
        mso-fareast-font-family:Arial;
        mso-hansi-font-family:Arial;
        mso-bidi-font-family:Arial;
        mso-ansi-language:EN-GB;}.MsoPapDefault
        {mso-style-type:export-only;
        line-height:115%;}div.WordSection1
        {page:WordSection1;}ol
        {margin-bottom:0cm;}ul
        {margin-bottom:0cm;}</style></p>
  </body>
</html>