<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Apr 11, 2018, at 08:07 , John Walu <<a href="mailto:walu.john@gmail.com" class="">walu.john@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial" class="">Further, unless your in a silly country that was dumb enough to sign a treaty extending EU’s legal reach into your sovereignty, such as the stupid congress of the united States, then you can offer the EU a nice big Italian sign language gesture regarding their GDPR and continue on with business as usual.</div><span class="gmail-HOEnZb" style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial"><font color="#888888" class=""><br class="gmail-Apple-interchange-newline"></font></span>@Owen, the above is not entirely true.<div class=""><br class=""></div><div class="">EU regulation/GDPR does affect African countries in general. Or at least those wishing to remain trade partners with European Countries.</div><div class=""><br class=""></div><div class="">Most of Africa has little or no Data Protection/Privacy laws (with a few exception being Ghana, Mauritius, SA, etc). Kenya for example doesn't have one. </div><div class=""><br class=""></div><div class="">Should Kenya show the EU the middle finger?</div><div class=""><br class=""></div><div class="">Yes they could. But essentially, that middle finger will translate into losing money. </div><div class=""><br class=""></div><div class="">A European Union Company would for example NOTdare engage (Data-wise/Business wise) with a Kenyan partner/subsidiary that for example sells flowers to European destinations/customers since Kenyan privacy /data protection environment would be suspect. </div><div class=""><br class=""></div><div class="">Whereas the EU cannot directly hold the Kenyan company liable for breaches, it will penalize the European company thoroughly. The net effect is that most European companies would review their risk profiles with African partners and basically cut linkages or open new ones - only with 'compliant' countries in Africa.</div></div></div></blockquote><div><br class=""></div>Sure… There’s the question of actual jurisdiction vs. voluntary compliance. Any given organization in Africa may find that it wishes to comply with GDPR voluntarily in order to avoid such issues, but my point was that the EU does not automatically have world-wide jurisdiction over other sovereign nations and unless some form of voluntary subjugation is created through treaty or other mechanisms (economic extortion by the EU as you have described, for example), then there are no actual legal consequences to an organization outside of the EU for violating GDPR.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class="">Unlike US, Africa does need EU Euros ;-). And so we will have to improve our Data protection regimes. Though it would have been good if we did it out of our own volition.</div></div></div></blockquote><div><br class=""></div>I personally thing that GDPR goes too far and has a number of rather onerous requirements (maintaining a person on staff domiciled in the EU, for example) that should be closely examined by those feeling we should all just roll over and take it from the EU.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class="">Now more specifically for the Afrinic registry,</div><div class=""><br class=""></div><div class="">The board just need to do an impact analysis of the GDPR on the Afrinic Company and share with members.</div></div></div></blockquote><div><br class=""></div>Yes.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class="">Just off my head, the data within the registry (IP, Whois, etc) would need to be protected. Essentially, if we have some data sitting in our Mauritius/SA registries and it relates to European citizens/subject then we need to review it in light of the GDPR requirements. Essentially EU citizens/residents have a whole list of rights to the data (consent, delete, etc) and whoever is hosting it also has some obligations.</div></div></div></blockquote><div><br class=""></div>IF and only IF they are legally or voluntarily subject to EU jurisdiction. Apparently in the case of MU, due to treaties signed by MU and MU’s own DPA, AfriNIC is legally subject. Due to treaty obligations, US and US Organizations are subject.</div><div><br class=""></div><div>Likely, Kenya is not legally subject (as Mike pointed out, there is clarification needed on this), but Kenyan entities may wish to voluntarily subject themselves in order to preserve their ability to do business with certain organizations in EU. This is an individual and voluntary decision which must be made by each entity, however, rather than legal subjugation.</div><div><br class=""></div><div>The clarification is that while EU may consider them legally subject, the EU’s ability to enforce EU law upon entities within Kenya is entirely up to the Kenyan government. Just as no US entity would take it seriously if Kenya passed a law requiring all US residents to wear red bandanas. Sure, if we were visiting Kenya, we’d likely wear the bandanas while we’re there, because that’s within Kenyan jurisdiction and we are during that time subject to Kenyan sovereignty. But while we’re home in the US, we’re not subject to Kenyan laws.</div><div><br class=""></div><div>US gets creative on some of this subjecting its citizens to certain US laws regardless of location (for example, it’s illegal under US law for a US Citizen to conduct a space launch without authorization from the FAA Office of Space Transportation no matter where in the world said launch is conducted). However, they have no control whatsoever over what Kenyan citizens do in Kenya.</div><div><br class=""></div><div>Owen</div><div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class=""><br class=""></div><div class="">That's my 1bitcoin on the matter ;-)</div><div class=""><br class=""></div><div class="">walu. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div></div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Wed, Apr 11, 2018 at 9:08 AM, Owen DeLong <span dir="ltr" class=""><<a href="mailto:owen@delong.com" target="_blank" class="">owen@delong.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word;line-break:after-white-space" class=""><br class=""><div class=""><span class=""><br class=""><blockquote type="cite" class=""><div class="">On Apr 10, 2018, at 22:42 , Andrew Alston <<a href="mailto:Andrew.Alston@liquidtelecom.com" target="_blank" class="">Andrew.Alston@liquidtelecom.<wbr class="">com</a>> wrote:</div><br class="m_-2879897327988520572Apple-interchange-newline"><div class=""><div class="m_-2879897327988520572WordSection1" style="font-family:Monaco;font-size:12px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"><div style="margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class="">Hi AfriNIC Board,<u class=""></u><u class=""></u></div><div style="margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=""><u class=""></u> <u class=""></u></div><div style="margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class="">Can this board please *<b class="">urgently</b>* inform this community as to what preparations they have made as regards to compliance with the General Data Protection Regulations passed by the European Commision and the board will be in a position to give this community a full and complete report as to their GDPR compliance status and what will be changing before the 25<sup class="">th</sup><span class="m_-2879897327988520572Apple-converted-space"> </span>of May to ensure that when the GDPR comes into force AfriNIC is compliant.</div></div></div></blockquote><div class=""><br class=""></div></span>Is Mauritius signatory to some treaty making them subject to GDPR?</div><span class=""><div class=""><span style="font-family:Calibri,sans-serif;font-size:11pt" class=""> </span><br class=""><blockquote type="cite" class=""><div class="m_-2879897327988520572WordSection1" style="font-family:Monaco;font-size:12px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"><div style="margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class="">Considering that the regulation comes into force on the 25<sup class="">th</sup><span class="m_-2879897327988520572Apple-converted-space"> </span>of May 2018 – and AfriNIC is 100% holding data of EU Citizens, which makes them subject to the regulations irrespective of the fact that they are domiciled in Mauritius – this is an urgent and critical issue. It has direct impact on the whois database, abuse contact information, handling of data submitted during application process and potentially even the proposed review policy, just to name a few things that I can think of off the top of my head – and cannot be ignored. I would in fact have liked to have seen discussions by the board in the minutes that have been published about the GDPR long before now – considering the impact – but failing that – the question is now being asked.</div></div></blockquote><div class=""><br class=""></div></div></span>It’s not about EU Citizens. It’s about EU Residents. (Common misconception about GDPR).<div class=""><br class=""></div><div class="">Further, unless your in a silly country that was dumb enough to sign a treaty extending EU’s legal reach into your sovereignty, such as the stupid congress of the united States, then you can offer the EU a nice big Italian sign language gesture regarding their GDPR and continue on with business as usual.</div><span class="HOEnZb"><font color="#888888" class=""><div class=""><br class=""></div><div class="">Owen</div><div class=""><br class=""></div></font></span></div><br class="">______________________________<wbr class="">_________________<br class="">
Community-Discuss mailing list<br class="">
<a href="mailto:Community-Discuss@afrinic.net" class="">Community-Discuss@afrinic.net</a><br class="">
<a href="https://lists.afrinic.net/mailman/listinfo/community-discuss" rel="noreferrer" target="_blank" class="">https://lists.afrinic.net/<wbr class="">mailman/listinfo/community-<wbr class="">discuss</a><br class="">
<br class=""></blockquote></div><br class=""></div>
</div></blockquote></div><br class=""></body></html>