<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Apr 11, 2018, at 07:19 , Andrew Alston <<a href="mailto:Andrew.Alston@liquidtelecom.com" class="">Andrew.Alston@liquidtelecom.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" class="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)" class="">
<style class=""><!--
/* Font Definitions */
@font-face
{font-family:Courier;
panose-1:2 7 4 9 2 2 5 2 4 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI Emoji";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.apple-tab-span
{mso-style-name:apple-tab-span;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Courier;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle22
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle23
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle24
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:595.0pt 842.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
<div lang="EN-GB" link="blue" vlink="purple" class="">
<div class="WordSection1"><p class="MsoNormal"><span style="mso-fareast-language:EN-US" class="">Owen,<o:p class=""></o:p></span></p><p class="MsoNormal"><span style="mso-fareast-language:EN-US" class=""><o:p class=""> </o:p></span></p><p class="MsoNormal"><span style="mso-fareast-language:EN-US" class="">Would the fact that AfriNIC
</span><span style="mso-fareast-language:EN-US" class="">serves </span><span style="color:#222222;background:white" class=""> </span><span style="background:white" class="">La Réunion</span> and Mayotte not create such a nexus since both are formally part of the EU?</p></div></div></div></blockquote><div><br class=""></div>The answer is it depends. IANAL, but AIUI…</div><div><br class=""></div><div>La Réunion and Mayotte may think it does, but that doesn’t necessarily matter to AfriNIC.</div><div><br class=""></div><div>Since AfriNIC isn’t actually present in either location, it’s up to the government of Mauritius whether it would do any of the following:</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>1.<span class="Apple-tab-span" style="white-space:pre"> </span>Allow suit based on GDPR violation to be brought in an MU court.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>2.<span class="Apple-tab-span" style="white-space:pre"> </span>Extradite AfriNIC for suit in a court of competent jurisdiction in one of those countries.</div><div><br class=""></div><div>However, given the new information from Kirs that MU signed a safe harbor treaty with EU subjecting MU to EU ICO->GDPR, then yes, everyone and all organizations in MU are subject to GDPR by virtue of the treaty requiring MU to do one of the two things above in such a case.</div><div><br class=""></div><div><blockquote type="cite" class=""><div class=""><div lang="EN-GB" link="blue" vlink="purple" class=""><div class="WordSection1"><p class="MsoNormal">In the same way – there are various EU members served by ARIN?</p></div></div></div></blockquote><div><br class=""></div>And in the same way, the only reason ARIN as a company in the US which does not have nexus in those EU member countries would not be subject except for the fact that the US signed a very bad treaty with the EU granting them extraterritorial jurisdiction to pursue cases in US courts in regards to GDPR violations.</div><div><br class=""></div><div>It is going to make live _VERY_ interesting for a lot of US organizations going forward and keep our courts quite busy for a number of years.</div><div><br class=""></div><div>Owen</div><div><br class=""><blockquote type="cite" class=""><div class=""><div lang="EN-GB" link="blue" vlink="purple" class=""><div class="WordSection1"><p class="MsoNormal"><o:p class=""></o:p></p><p class="MsoNormal"><o:p class=""></o:p></p><p class="MsoNormal"><o:p class=""> </o:p></p><p class="MsoNormal">Andrew<o:p class=""></o:p></p><p class="MsoNormal"><span style="mso-fareast-language:EN-US" class=""><o:p class=""> </o:p></span></p><p class="MsoNormal"><span style="mso-fareast-language:EN-US" class=""><o:p class=""> </o:p></span></p>
<div class="">
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm" class=""><p class="MsoNormal"><b class=""><span lang="EN-US" class="">From:</span></b><span lang="EN-US" class=""> Owen DeLong [<a href="mailto:owen@delong.com" class="">mailto:owen@delong.com</a>]
<br class="">
<b class="">Sent:</b> 11 April 2018 17:12<br class="">
<b class="">To:</b> Andrew Alston <<a href="mailto:Andrew.Alston@liquidtelecom.com" class="">Andrew.Alston@liquidtelecom.com</a>><br class="">
<b class="">Cc:</b> Mike Silber <<a href="mailto:silber.mike@gmail.com" class="">silber.mike@gmail.com</a>>; Abibu R. Ntahigiye <<a href="mailto:abibu@tznic.or.tz" class="">abibu@tznic.or.tz</a>>; General Discussions of AFRINIC <<a href="mailto:community-discuss@afrinic.net" class="">community-discuss@afrinic.net</a>>; AfriNIC Discuss <<a href="mailto:members-discuss@afrinic.net" class="">members-discuss@afrinic.net</a>><br class="">
<b class="">Subject:</b> Re: [Community-Discuss] AFRINIC and the GDPR<o:p class=""></o:p></span></p>
</div>
</div><p class="MsoNormal"><o:p class=""> </o:p></p><p class="MsoNormal">Roughly translated:<o:p class=""></o:p></p>
<div class=""><p class="MsoNormal"><span class="apple-tab-span"> </span>The ability of EU to inflict GDPR on those operators outside of EU is predicated on that operator<o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal"><span class="apple-tab-span"> </span>having some business operation or presence within the EU which allows them to subject you to their<o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal"><span class="apple-tab-span"> </span>jurisdiction. Determining that you have said presence requires a specific determination by the<o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal"><span class="apple-tab-span"> </span>EU member state where said presence exists.<o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal"><o:p class=""> </o:p></p>
</div>
<div class=""><p class="MsoNormal">I’m pretty sure AfriNIC has no such nexus.<o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal"><o:p class=""> </o:p></p>
</div>
<div class=""><p class="MsoNormal">However, what is left out of Mike’s statement is the potential that any other country may have signed some<o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal">sort of treaty with the EU (or a member state) which subjects them to GDPR and/or grants additional<o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal">extraterritorial rights to the EU. Such is (unfortunately) the case with the US, for example.<o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal"><o:p class=""> </o:p></p>
</div>
<div class=""><p class="MsoNormal">Another key point is that EU citizens not living in Europe are not covered by GDPR. Non-EU citizens living<o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal">within the EU are covered by GDPR. (At least that is my understanding… AIUI, GDPR applies to EU residents,<o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal">not EU citizens.)<o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal"><o:p class=""> </o:p></p>
</div>
<div class=""><p class="MsoNormal">Owen<o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal"><o:p class=""> </o:p></p>
<div class=""><p class="MsoNormal"><br class="">
<br class="">
<o:p class=""></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt" class="">
<div class=""><p class="MsoNormal">On Apr 11, 2018, at 06:44 , Andrew Alston <<a href="mailto:Andrew.Alston@liquidtelecom.com" class="">Andrew.Alston@liquidtelecom.com</a>> wrote:<o:p class=""></o:p></p>
</div><p class="MsoNormal"><o:p class=""> </o:p></p>
<div class="">
<div class="">
<div class=""><p class="MsoNormal"><span style="mso-fareast-language:EN-US" class="">Thanks Mike,</span><o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal"><span style="mso-fareast-language:EN-US" class=""> </span><o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal"><span style="mso-fareast-language:EN-US" class="">That’s actually pretty useful in some sense – but can I ask for an English interpretation of the last sentence for those of us that sadly don’t speak Lawyer
</span><span style="font-family:"Segoe UI Emoji",sans-serif;mso-fareast-language:EN-US" class="">☺</span><o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal"><span style="mso-fareast-language:EN-US" class=""> </span><o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal"><span style="mso-fareast-language:EN-US" class="">Thanks</span><o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal"><span style="mso-fareast-language:EN-US" class=""> </span><o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal"><span style="mso-fareast-language:EN-US" class="">Andrew</span><o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal"><span style="mso-fareast-language:EN-US" class=""> </span><o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal"><span style="mso-fareast-language:EN-US" class=""> </span><o:p class=""></o:p></p>
</div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm" class="">
<div class=""><p class="MsoNormal"><b class=""><span style="font-size:12.0pt" class="">From: </span></b><span style="font-size:12.0pt" class="">Mike Silber <<a href="mailto:silber.mike@gmail.com" class="">silber.mike@gmail.com</a>><br class="">
<b class="">Date: </b>Wednesday, 11 April 2018 at 16:34<br class="">
<b class="">To: </b>"Abibu R. Ntahigiye" <<a href="mailto:abibu@tznic.or.tz" class="">abibu@tznic.or.tz</a>><br class="">
<b class="">Cc: </b>Andrew Alston <<a href="mailto:Andrew.Alston@liquidtelecom.com" class="">Andrew.Alston@liquidtelecom.com</a>>, General Discussions of AFRINIC <<a href="mailto:community-discuss@afrinic.net" class="">community-discuss@afrinic.net</a>>, AfriNIC Discuss <<a href="mailto:members-discuss@afrinic.net" class="">members-discuss@afrinic.net</a>><br class="">
<b class="">Subject: </b>Re: [Community-Discuss] AFRINIC and the GDPR</span><o:p class=""></o:p></p>
</div>
</div>
<div class="">
<div class=""><p class="MsoNormal"> <o:p class=""></o:p></p>
</div>
</div>
<div class=""><p class="MsoNormal">If I can add to this, there is as yet no clear direction from the European DPAs as a collective on how GDPR affects whois access in general.
<o:p class=""></o:p></p>
</div>
<div class="">
<div class=""><p class="MsoNormal"> <o:p class=""></o:p></p>
</div>
</div>
<div class="">
<div class=""><p class="MsoNormal">The RIPE NCC approach is premised on their interactions with the Dutch DPA, rather than a Europe wide approach.<o:p class=""></o:p></p>
</div>
</div>
<div class="">
<div class=""><p class="MsoNormal"> <o:p class=""></o:p></p>
</div>
</div>
<div class="">
<div class=""><p class="MsoNormal">In addition, I am not sure I concur with Mr Alston’s insistence that “holding data of EU citizens” automatically places AfriNIC into the category of data controller in terms of GDPR or imposes any requirements on AfriNIC, particularly as
the GDPR applies to processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union.<o:p class=""></o:p></p>
</div>
</div>
<div class="">
<div class=""><p class="MsoNormal"> <o:p class=""></o:p></p>
</div>
</div>
<div class="">
<div class=""><p class="MsoNormal">The extraterritorial application is premised on a nexus requirement set out in general terms in Recital 23, but requiring specific determination in terms of national law by Member States.<o:p class=""></o:p></p>
</div>
</div>
<div class="">
<div class=""><p class="MsoNormal"> <o:p class=""></o:p></p>
</div>
</div>
<div class="">
<div class=""><p class="MsoNormal">Mike<o:p class=""></o:p></p>
</div>
</div>
<div class="">
<div class=""><p class="MsoNormal"> <o:p class=""></o:p></p>
</div>
</div>
<div class="">
<div class="">
<div class=""><p class="MsoNormal"><br class="">
<br class="">
<br class="">
<o:p class=""></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt" class="">
<div class="">
<div class=""><p class="MsoNormal">On 11 Apr 2018, at 13:36, Abibu R. Ntahigiye <<a href="mailto:abibu@tznic.or.tz" class="">abibu@tznic.or.tz</a>> wrote:<o:p class=""></o:p></p>
</div>
</div>
<div class=""><p class="MsoNormal"> <o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white;caret-color: rgb(0, 0, 0);font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:10.5pt;font-family:"Arial",sans-serif" class="">Dear Andrew, Members and the whole Afrinic community,</span><o:p class=""></o:p></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white;caret-color: rgb(0, 0, 0);font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:10.5pt;font-family:"Arial",sans-serif" class="">Andrew has raised a very important issue for Afrinic operations - Thanks so much Andrew.</span><o:p class=""></o:p></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white;caret-color: rgb(0, 0, 0);font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:10.5pt;font-family:"Arial",sans-serif" class="">The Board would like to inform you that the issue was discussed within the Board at the Afrinic 27 meeting in Lagos and the Management was tasked to work on the issue.</span><o:p class=""></o:p></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white;caret-color: rgb(0, 0, 0);font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:10.5pt;font-family:"Arial",sans-serif" class="">The Board has also been made aware that the Mauritius Data Protection Act 2017 is already in effect and is aligned with the EU GDPR regulations. The Board believes that these regulations are not
a barrier to publication of the WHOIS data, and it has noted the RIPE NCC study that made such a finding. The Board further believes that the biggest changes required by AFRINIC are in documenting how personal data is used, and in informing people at the
time data is collected.<span class="apple-converted-space"> </span></span><o:p class=""></o:p></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white;caret-color: rgb(0, 0, 0);font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:10.5pt;font-family:"Arial",sans-serif" class="">The AFRINIC management will provide further updates on the issues at AIS 2018 in Senegal.</span><o:p class=""></o:p></p>
<div class=""><p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;background:white" class="">Further to the above, the Board expects to receive more insights on GDPR related issues at the joint Boards (AfriNIC and RIPE NCC) meeting planned in Senegal.</span><span style="font-size:10.5pt;font-family:"Arial",sans-serif" class=""><br class="">
<br class="">
<span style="background:white" class="">Kind regards</span><br class="">
<br class="">
<br class="">
<br class="">
</span><o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal" style="background:white"><span style="font-size:10.5pt;font-family:"Arial",sans-serif" class="">On 11/04/2018 08:42, Andrew Alston wrote:</span><o:p class=""></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt;font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px" class="">
<div class=""><p class="MsoNormal" style="background:white">Hi AfriNIC Board,<o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal" style="background:white"> <o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal" style="background:white">Can this board please *<b class="">urgently</b>* inform this community as to what preparations they have made as regards to compliance with the General Data Protection Regulations passed by the European Commision and the
board will be in a position to give this community a full and complete report as to their GDPR compliance status and what will be changing before the 25<sup class="">th</sup><span class="apple-converted-space"> </span>of May to ensure that when the GDPR comes into
force AfriNIC is compliant.<o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal" style="background:white"> <o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal" style="background:white">Considering that the regulation comes into force on the 25<sup class="">th</sup><span class="apple-converted-space"> </span>of May 2018 – and AfriNIC is 100% holding data of EU Citizens, which makes them subject to the regulations
irrespective of the fact that they are domiciled in Mauritius – this is an urgent and critical issue. It has direct impact on the whois database, abuse contact information, handling of data submitted during application process and potentially even the proposed
review policy, just to name a few things that I can think of off the top of my head – and cannot be ignored. I would in fact have liked to have seen discussions by the board in the minutes that have been published about the GDPR long before now – considering
the impact – but failing that – the question is now being asked.<o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal" style="background:white"> <o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal" style="background:white">Andrew<o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal" style="background:white"> <o:p class=""></o:p></p>
</div>
<div class=""><p class="MsoNormal" style="background:white"> <o:p class=""></o:p></p>
</div>
<pre style="background:white" class="">_______________________________________________<o:p class=""></o:p></pre>
<pre style="background:white" class="">Community-Discuss mailing list<o:p class=""></o:p></pre>
<pre style="background:white" class=""><a href="mailto:Community-Discuss@afrinic.net" class=""><span style="color:#954F72" class="">Community-Discuss@afrinic.net</span></a><o:p class=""></o:p></pre>
<pre style="background:white" class=""><a href="https://lists.afrinic.net/mailman/listinfo/community-discuss" class=""><span style="color:#954F72" class="">https://lists.afrinic.net/mailman/listinfo/community-discuss</span></a><o:p class=""></o:p></pre>
</blockquote>
<div class=""><p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif" class=""><br class="">
<br class="">
<br class="">
</span><o:p class=""></o:p></p>
</div>
<pre style="background:white" class=""><span style="font-size:10.5pt" class="">-- </span><o:p class=""></o:p></pre>
<pre style="background:white" class=""><span style="font-size:10.5pt" class="">Abibu R. Ntahigiye</span><o:p class=""></o:p></pre>
<pre style="background:white" class=""><span style="font-size:10.5pt" class=""> </span><o:p class=""></o:p></pre>
<pre style="background:white" class=""><span style="font-size:10.5pt" class="">CEO, tzNIC / Interim Chairman, Afrinic.</span><o:p class=""></o:p></pre>
<div class=""><p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;background:white" class="">_______________________________________________</span><span style="font-size:10.5pt;font-family:"Arial",sans-serif" class=""><br class="">
<span style="background:white" class="">Community-Discuss mailing list</span><br class="">
</span><a href="mailto:Community-Discuss@afrinic.net" class=""><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#954F72;background:white" class="">Community-Discuss@afrinic.net</span></a><span style="font-size:10.5pt;font-family:"Arial",sans-serif" class=""><br class="">
</span><a href="https://lists.afrinic.net/mailman/listinfo/community-discuss" class=""><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#954F72;background:white" class="">https://lists.afrinic.net/mailman/listinfo/community-discuss</span></a><o:p class=""></o:p></p>
</div>
</div>
</blockquote>
</div>
<div class=""><p class="MsoNormal"> <o:p class=""></o:p></p>
</div>
</div>
</div><p class="MsoNormal">_______________________________________________<br class="">
Community-Discuss mailing list<br class="">
<a href="mailto:Community-Discuss@afrinic.net" class="">Community-Discuss@afrinic.net</a><br class="">
<a href="https://lists.afrinic.net/mailman/listinfo/community-discuss" class="">https://lists.afrinic.net/mailman/listinfo/community-discuss</a><o:p class=""></o:p></p>
</div>
</blockquote>
</div><p class="MsoNormal"><o:p class=""> </o:p></p>
</div>
</div>
</div>
</div></blockquote></div><br class=""></body></html>