<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EstiloCorreo19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EstiloCorreo20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EstiloCorreo21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang=ES link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>I think Andrew is right.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>I just found a short article that explains it:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><a href="https://www.gdprandbeyond.com/blog-post/data-privacy/gdpr-affect-non-european-companies/">https://www.gdprandbeyond.com/blog-post/data-privacy/gdpr-affect-non-european-companies/</a><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>If you don’t want to read all the article, this is the key:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>“The short answer is: the regulation will affect firms both inside and outside of the EU. In fact, any company dealing with EU businesses’, residents’, or citizens’ data will have to comply with the GDPR.”<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>Even more than that, it affects any company that may hold data from EU citizens, and that includes IP addresses.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>For example, if EU citizens are using a DNS resolver sitting in any AfriNIC country, then the logs with the IP addresses of the queries are subjected to the GDPR, if you make business out of those logs, and don’t anonymize them, you are subjected to fines of up to 4% of your annual turnover, up to a maximum of 20 million euros.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>In chats with EU lawyers, they basically told that there is a long road with this regulation in the courts, and ISPs need to be aware that this means that if their customers do “bad” things with EU citizens personal data, and they don’t react on those “abuse” cases, you may be at the end of the history, liable for that.<o:p></o:p></span></p><div><p class=MsoNormal><span lang=EN-US style='font-size:10.5pt;color:black'><br></span><span lang=ES-TRAD style='font-size:10.5pt;color:black'>Regards,<o:p></o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=ES-TRAD style='font-size:10.5pt;color:black;mso-fareast-language:EN-US'>Jordi<o:p></o:p></span></p></div><p class=MsoNormal><span lang=ES-TRAD style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal style='margin-left:35.4pt'><b><span style='font-size:12.0pt;color:black'>De: </span></b><span style='font-size:12.0pt;color:black'>Andrew Alston <Andrew.Alston@liquidtelecom.com><br><b>Fecha: </b>miércoles, 11 de abril de 2018, 12:15<br><b>Para: </b>Owen DeLong <owen@delong.com><br><b>CC: </b>General <community-discuss@afrinic.net>, AFRINIC Board of Directors' List <Board@afrinic.net><br><b>Asunto: </b>Re: [Community-Discuss] AFRINIC and the GDPR<o:p></o:p></span></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p></div><p class=MsoNormal style='margin-left:35.4pt'><a name="_MailOriginalBody"><span style='mso-fareast-language:EN-US'>Owen,</span><o:p></o:p></a></p><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'><span style='mso-fareast-language:EN-US'> </span><o:p></o:p></span></p><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'><span style='mso-fareast-language:EN-US'>Firstly – AfriNIC does hold data on EU residents – that is without question – I know of a couple of cases of EU residents with their data held by AfriNIC without even thinking of it.</span><o:p></o:p></span></p><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'><span style='mso-fareast-language:EN-US'>Secondly – irrespective of if they are signatories or not – if AfriNIC chooses to do any business with RIPE for example, they are doing business with an EU entity and can be prevented from doing so if they don’t comply is my understanding.</span><o:p></o:p></span></p><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'><span style='mso-fareast-language:EN-US'> </span><o:p></o:p></span></p><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'><span style='mso-fareast-language:EN-US'>Irrespective of this – the AfriNIC board if they believe they do not need to comply in any way shape or form – needs to state that to this community and to its members and give reasons as to why not – at that point – the affected members can then make an informed decision as to their course of action should they choose one. But – AfriNIC still has an obligation to inform its community as to its standing in this regard and do so before the legislation becomes reality.</span><o:p></o:p></span></p><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'><span style='mso-fareast-language:EN-US'> </span><o:p></o:p></span></p><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'><span style='mso-fareast-language:EN-US'>Please note clause 3.4.vii of the bylaws:</span><o:p></o:p></span></p><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'><span style='mso-fareast-language:EN-US'> </span><o:p></o:p></span></p><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'><span style='font-size:9.0pt;font-family:Helvetica;color:#333333;background:#EEEEEE'>(vii) to disseminate among its members information on all matters affecting the Company and its members and to provide for and be a central channel of communication for the members of the Company and generally for the furtherance and promotion of their interests;</span><o:p></o:p></span></p><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'><span style='font-size:9.0pt;font-family:Helvetica;color:#333333;background:#EEEEEE'> </span><o:p></o:p></span></p><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'><span style='mso-fareast-language:EN-US'>Andrew</span><o:p></o:p></span></p><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'><span style='mso-fareast-language:EN-US'> </span><o:p></o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'><b><span lang=EN-US>From:</span></b></span><span style='mso-bookmark:_MailOriginalBody'><span lang=EN-US> Owen DeLong [mailto:owen@delong.com] <br><b>Sent:</b> 11 April 2018 09:08<br><b>To:</b> Andrew Alston <Andrew.Alston@liquidtelecom.com><br><b>Cc:</b> General <community-discuss@afrinic.net>; AFRINIC Board of Directors' List <Board@afrinic.net><br><b>Subject:</b> Re: [Community-Discuss] AFRINIC and the GDPR<br><b>Importance:</b> High</span><o:p></o:p></span></p></div></div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'> <o:p></o:p></span></p><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'> <o:p></o:p></span></p><div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'><br><br><br><o:p></o:p></span></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'>On Apr 10, 2018, at 22:42 , Andrew Alston <</span><a href="mailto:Andrew.Alston@liquidtelecom.com"><span style='mso-bookmark:_MailOriginalBody'>Andrew.Alston@liquidtelecom.com</span><span style='mso-bookmark:_MailOriginalBody'></span></a><span style='mso-bookmark:_MailOriginalBody'>> wrote:<o:p></o:p></span></p></div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'> <o:p></o:p></span></p><div><div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'>Hi AfriNIC Board,<o:p></o:p></span></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'> <o:p></o:p></span></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'>Can this board please *<b>urgently</b>* inform this community as to what preparations they have made as regards to compliance with the General Data Protection Regulations passed by the European Commision and the board will be in a position to give this community a full and complete report as to their GDPR compliance status and what will be changing before the 25<sup>th</sup><span class=apple-converted-space> </span>of May to ensure that when the GDPR comes into force AfriNIC is compliant.<o:p></o:p></span></p></div></div></blockquote><div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'> <o:p></o:p></span></p></div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'>Is Mauritius signatory to some treaty making them subject to GDPR?<o:p></o:p></span></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'> <br><br><br><o:p></o:p></span></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'>Considering that the regulation comes into force on the 25<sup>th</sup><span class=apple-converted-space> </span>of May 2018 – and AfriNIC is 100% holding data of EU Citizens, which makes them subject to the regulations irrespective of the fact that they are domiciled in Mauritius – this is an urgent and critical issue. It has direct impact on the whois database, abuse contact information, handling of data submitted during application process and potentially even the proposed review policy, just to name a few things that I can think of off the top of my head – and cannot be ignored. I would in fact have liked to have seen discussions by the board in the minutes that have been published about the GDPR long before now – considering the impact – but failing that – the question is now being asked.<o:p></o:p></span></p></div></blockquote><div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'> <o:p></o:p></span></p></div></div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'>It’s not about EU Citizens. It’s about EU Residents. (Common misconception about GDPR).<o:p></o:p></span></p><div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'> <o:p></o:p></span></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'>Further, unless your in a silly country that was dumb enough to sign a treaty extending EU’s legal reach into your sovereignty, such as the stupid congress of the united States, then you can offer the EU a nice big Italian sign language gesture regarding their GDPR and continue on with business as usual.<o:p></o:p></span></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'> <o:p></o:p></span></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'>Owen<o:p></o:p></span></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'> <o:p></o:p></span></p></div><p class=MsoNormal style='margin-left:35.4pt'><span style='mso-bookmark:_MailOriginalBody'>_______________________________________________ Community-Discuss mailing list Community-Discuss@afrinic.net https://lists.afrinic.net/mailman/listinfo/community-discuss </span><o:p></o:p></p></div><br>**********************************************<br>
IPv4 is over<br>
Are you ready for the new Internet ?<br>
http://www.consulintel.es<br>
The IPv6 Company<br>
<br>
This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.<br>
<br>
</body></html>