# Procedure for the Removal of Personal Contact Details

# Introduction

The RIPE NCC is authorised by the RIPE community to act as the registration authority and keep an accurate register of Internet number resources in its service region and to manage the operation of the RIPE Database. Many of the operational responsibilities for data handling are delegated to the individuals who have mntner objects in the database. These individuals, or Maintainers, maintain sets of data related to their IP network operations.

If one of these Maintainers fails to fulfill their Data Protection responsibilities, the RIPE NCC could have a legal obligation to intervene. This may require the RIPE NCC to modify or delete personal Contact Details. The procedure outlined in this document balances maintaining accountability with the privacy rights of individuals.

# Definitions

In this document, the following terms shall be understood to have the meanings assigned to them below:

RIPE NCC – Réseaux IP Européens Network Coordination Centre. A membership association under Dutch law operating its registered office in Amsterdam, the Netherlands.

RIPE Community – RIPE (Réseaux IP Européens) is a collaborative forum open to all parties interested in wide area IP networks in Europe and beyond. The objective of RIPE is to ensure the administrative and technical coordination necessary to enable the operation of a pan-European IP network.

Update – submitting information for entry into or removal from the RIPE Database.

Internet number resource – globally unique address space (IPv4 and IPv6) and Autonomous System Numbers (ASNs) issued by any Internet Number Registry.

Primary objects – Internet number resources and other data object types that are not directly related to any other Primary object type and which are defined by Routing Policy Specification Language (RPSL) or which have been agreed by the RIPE Community as acceptable primary data.

RIPE Database – the publicly available data collection of Internet Number Registry (INR) and Internet Routing Registry (IRR) data published by the RIPE NCC. It contains all the Primary and Secondary objects. There is also some non-public data required for the operation of the RIPE Database and the registries, but this non-public data does not form part of the RIPE Database.

Registrant – a natural person or legal entity to whom an Internet number resource has been registered or who has registered any other Primary object in the RIPE Database by specific or general agreement with the RIPE NCC.

Maintainer – any Registrant or person to whom the authority to Update has been delegated by a Registrant, either directly or indirectly, and who holds an identifier that allows updates to be authenticated and authorised.

End User – a person for whom an Internet number resource has been registered for their use.

Data Subject – a natural person whose personal Contact Details or other personal data are recorded in the RIPE Database.

Contact Details – all details relating to name, postal address, phone, fax, e-mail or any other form of electronic communication that is used by a natural person or a legal entity.

Personal Contact Details – Contact Details pertaining to a natural person.

Internet Registry – Any registry that makes Internet number resources available to other people and records information in a database about the Registrant.

# General

Personal Contact Details are held in several object types (see Appendix G) The person object is the starting point for all data sets in the RIPE Database and this procedure will focus on these objects.

Changes to Personal Contact Details can have significant consequences. To change or remove Personal Contact Details may require:

  • References to be removed from other objects.
  • Some other objects to be deleted.
  • Internet number resources to be returned to the appropriate Internet Registry.
  • Registrant/Maintainer to lose control and/or right of usage of the Internet number resource.

The precise course of action depends on the type of object in which the person object is referenced. The RIPE NCC has a legal obligation to remove Personal Contact Details on request from the Data Subject in some situations.

If the Data Subject is the Registrant of an Internet number resource and wishes to remain the Registrant of that resource, the following options are available:

  • Insert Personal Contact Details for some other person from the Data Subject’s organisation.
  • Insert Contact Details related to the Maintainer of the resource if this is not the Data Subject. This option is only available if the Maintainer agrees or if the Maintainer is also the Registrant.
  • Insert Contact Details related to the organisation responsible for the parent resource (provided that this is not the RIPE NCC). In this case, responsibility for maintaining the data should also pass to this parent resource organisation if they are not already the Maintainer. This option is only available if the parent resource organisation agrees.
  • Deny the request to remove Personal Contact Details if the Data Subject is the Registrant and does not wish to return the Internet number resource, or the Data Subject is the Maintainer and does not wish to release control over the resource and none of the above options are available.

The Data Subject needs to be aware of the consequences of removing Personal Contact Details where the options above are not possible or acceptable. The Data Subject cannot maintain an Internet number resource and be anonymous. Where accountability for registrations of global resources conflicts with an individual’s right to privacy, drastic action may be required. This may involve returning Internet number resources to the Internet Registry that issued them and removing all associated data from the RIPE Database.

# Procedure

The RIPE NCC has tried to clearly identify a series of steps that can be taken at different stages. The aim is to resolve the issue to the satisfaction of all parties and protect everyone’s interests while maintaining the RIPE NCC’s responsibility as a public registry of Internet number resources. The RIPE NCC will always inform the Data Subject within four weeks in writing whether a request for change or removal of Personal Contact Details will be granted. If the request is denied, the RIPE NCC will duly motivate this decision. This procedure refers only to person objects for clarity, but other objects may be involved (see Appendix G).

The steps that will be taken are as follows:

  1. The RIPE NCC is contacted by a Data Subject asking for their Personal Contact Details to be removed from the RIPE Database. The Data Subject must clearly identify the details they are referring to by sending a copy of the Personal Contact Details to the RIPE NCC.
  2. The RIPE NCC forwards the request to the Maintainer of the person object and copies the Data Subject on the
    e-mail. The Maintainer is asked to resolve the issue within ten working days and send confirmation to both the RIPE NCC and the Data Subject.
  3. a. If the RIPE NCC receives confirmation from the Maintainer that action has been taken, the RIPE NCC notifies both the Maintainer and the Data Subject that the case is closed.
    b. If no confirmation is received from the Maintainer, but the person object has been deleted or substantially changed, the RIPE NCC notifies both the Maintainer and the Data Subject that the issue has been resolved and the case is closed.
    c. If no confirmation is received from the Maintainer, and nothing has changed, the RIPE NCC contacts the Data Subject and copies the message to the Maintainer. The Data Subject is asked to confirm that they still want the personal Contact Details removed. If they confirm this, the RIPE NCC moves to Step 4 (below).

The following steps are the actions the RIPE NCC will take when the Maintainer does not respond to or does not comply with the request to change or remove Contact Details:

  1. The RIPE NCC asks the Data Subject for a copy of a legal identification document. This document must match the personal Contact Details to be removed. This should be faxed to the RIPE NCC together with a formal request for the removal of the personal Contact Details.
  2. The RIPE NCC receives the signed request and identification document from the Data Subject.
  3. If it is a simple case where:
    • The person object is unreferenced.
    • Each object referencing the person object references more than one person object.
  4. For a simple case, the RIPE NCC sends an acknowledgement to the Data Subject and the Maintainer informing them that the personal Contact Details have been removed and the case is closed.

For anything other than one of the simple cases, the RIPE NCC continues with the following steps:

  1. The RIPE NCC sends a statement to the Data Subject of actions to be taken, which includes a list of any other data that may be affected which is directly related to the person object and the changes that need to be made to this data. This list will highlight any resources that will need to be returned to an Internet Registry or transferred to another Maintainer and the possible consequences of this action. These consequences may include the removal of some data from the RIPE Database.

  2. Because of the referential integrity rules, when any data is removed from the RIPE Database, there can be a chain reaction. This may result in more data being changed or removed. The Maintainers of any such data will be informed and requested to make the appropriate changes. These changes will have to be made before the Data Subject's details can be removed because no object can be deleted from the RIPE Database while it is still referenced.

  3. If there is an option for data to be transferred to another Maintainer but the latter Maintainer is not willing to be the Maintainer of this data, then there are only two options available:

    • The User must return the resource to the appropriate Internet registry and their personal Contact Details will be removed.
    • The User’s personal Contact Details cannot be removed but can be corrected if there is an error.

    In the former case, if the Data Subject confirms the action, the RIPE NCC moves into the clean-up phase. In the latter case, any corrections will be applied and the case is closed.

  4. a. If the Data Subject confirms the action in the statement, the RIPE NCC moves into the clean-up phase.
    b. If the Data Subject does not confirm this action, no further action is possible and the case is closed.

# Clean-up Phase

This is the procedure taken by the RIPE NCC when the removal of personal Contact Details is not a simple case. The actual implementation is very technical and requires some recursive searching for references.

The goal is to remove the person object containing the Data Subject’s personal Contact Details. All reference chains must be followed and appropriate changes made as close in the chain as possible to the person object to maintain the referential integrity of the RIPE Database.

If an object needs to be deleted, special considerations may apply, depending on the object type (see Appendix F). This may involve returning some resources to the appropriate Internet Registries. If these resources are registered to the Data Subject requesting the removal of personal Contact Details, the resources will be listed in the statement to the Data Subject together with the consequences. If the resources are managed by other Maintainers, the Maintainers will be notified and given an opportunity to change the references and take their resources off the list of affected objects. This must be done before the Data Subject’s personal Contact Details can be removed.

# Conclusion

It is easier for all concerned if the Maintainers make any necessary changes to the personal Contact Details. The Maintainers are closer to the people involved and have a better understanding of how to replace references to the Data Subject. If the RIPE NCC has to make changes it is because the Maintainer of the data has not responded in a timely manner. In this case, the drastic actions detailed in this procedure, including requiring resources to be returned, are necessary.

Because the procedure requires drastic actions in some cases, it is important that the RIPE NCC can contact the right people to inform them of the actions in advance. Currently, the RIPE NCC has no authoritative contact details for the Maintainer of many sets of data objects. The RIPE NCC only has the set of e-mail addresses listed in the objects in the RIPE Database. Few of these have been verified and some may prove to be invalid. The RIPE NCC will consider the Maintainer to have been informed by sending an e-mail to the address listed in the RIPE Database.