<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \(Cuerpo en alfa";
panose-1:2 2 6 3 5 4 5 2 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EstiloCorreo18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:2117824640;
mso-list-type:hybrid;
mso-list-template-ids:-1489459030 -1893802554 67764227 67764229 67764225 67764227 67764229 67764225 67764227 67764229;}
@list l0:level1
{mso-level-start-at:2;
mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-font-family:Calibri;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style></head><body lang=ES link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>Hi John,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>Right, those are the points that most of the people is missing:<o:p></o:p></span></p><ul style='margin-top:0cm' type=disc><li class=MsoListParagraph style='margin-left:0cm;mso-list:l0 level1 lfo1'><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>Citizens and Residents of the EU are protected, never mind the infringement is committed outside that territory. You may decide not to pay the fine, but then that person/organization will not be able to continue doing business with the EU persons/organizations, and even more, if you at some point come to the EU, you can get detained until you pay the fine.<o:p></o:p></span></li><li class=MsoListParagraph style='margin-left:0cm;mso-list:l0 level1 lfo1'><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>Mauritius signed an agreement with the EU about GDPR, so all the Mauritius organizations are also bound (Afrinic in our case). The same happened with Uruguay (so it happens the same with LACNIC).<o:p></o:p></span></li></ul><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>Further, there is no need for a citizen to file a complaint in the courts (of course it can be done and it can claim even damages).<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>The process is much simpler. Any citizen/resident can file a free complaint, even via a web site if you have a digital certificate or equivalent (or by postal mail if you don’t have it), to the Data Protection Agency (of any EU country or equivalent entity in countries that signed the agreement with the EU). I’ve done that myself (even before GDPR), already about 2.000 times in the last 5 years, and I can tell that it works (and the companies pay fines), so I’m not talking about “smoke”.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>The point is that in many cases, the Data Protection Agencies will open the case automatically by themselves. Before GDPR the maximum fine (for almost equivalent data protection breaches and spam) was 600.000 euros. Now is 20 million euros or up to 4% of the worldwide annual revenue of the prior financial year, whichever is higher.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>So, just make sure that if you are managing phone numbers or emails from EU citizens, you comply with the GDPR, and don’t provide those data to “others” even to friends or colleagues, unless you have a previous and explicit consent from the owner.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>One recent example (this week) about a big fine:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><a href="https://www.theverge.com/2019/7/8/20685830/british-airways-data-breach-fine-information-commissioners-office-gdpr"><span lang=EN-US>https://www.theverge.com/2019/7/8/20685830/british-airways-data-breach-fine-information-commissioners-office-gdpr</span></a><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>I just hope that Afrinic has already took sufficient measures to comply with GDPR. Those fines aren’t peanuts!<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>Right now, I just checked the privacy statement in the web site (</span><a href="https://afrinic.net/privacy"><span lang=EN-US>https://afrinic.net/privacy</span></a><span lang=EN-US>). Sadly, I don’t think this is consistent with the latest GDPR (even for the Mauritius regulation).<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>The board meeting on 6<sup>th</sup> May 2018 talks about that and confirms that it will be resolved before 24<sup>th</sup> May 2018 (25<sup>th</sup> was the strict deadline). If that really happened, the web site doesn’t state that. Minutes from the April 2019 still keep talking about that, but nothing clear from my reading.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>This needs to be corrected ****immediately****, or Afrinic can be subjected to very high fines.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;color:black'>Regards,<o:p></o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-US style='font-size:12.0pt;color:black;mso-fareast-language:EN-US'>Jordi<o:p></o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-US style='font-size:12.0pt;color:black;mso-fareast-language:EN-US'>@jordipalet<o:p></o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-US style='font-size:12.0pt;color:black;mso-fareast-language:EN-US'><o:p> </o:p></span></p></div><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><div><p class=MsoNormal style='margin-left:35.4pt'>El 10/7/19 9:51, "John Walu" <<a href="mailto:walu.john@gmail.com">walu.john@gmail.com</a>> escribió:<o:p></o:p></p></div></div><div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'>@ Owen <o:p></o:p></p><div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'>GDPR territorial scope extends beyond Europe since its is EU citizen specific rather than geo-specific.<o:p></o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><a href="https://gdpr-info.eu/art-3-gdpr/">https://gdpr-info.eu/art-3-gdpr/</a><o:p></o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'>In other words, anyone (Data controller/processor) handling EU citizen data is automatically subject to the GDPR in the event of a data breach - irrespective of their geo-locality.<o:p></o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'> Ofcourse the main issue will be if the affected EU citizen will actually file a complaint in the EU Courts or not. The second issue is whether the EU courts will find the data controller guilty and if the fined/penalized entity will to pay up or ignore given their remoteness to EU centers of power. (nb:Facebook and Google have so far been paying up ;-)<o:p></o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'>Is AfriNIC bound by GDPR?<o:p></o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'>The simple answer is - it depends. <o:p></o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'>Do Afrinic processes and systems at any one point collect, store or process data that contains EU citizens?<o:p></o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'>If the answer is NO. Then they are not bound by GDPR.<o:p></o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'>If the answer is YES. Then they are potentially bound by GDPR to the extent that if that data is abused/breached, then they potentially face sanctions/penalties from EU courts.<o:p></o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'>Either way, Mauritius has one of the <a href="http://dataprotection.govmu.org/English/Legislation/Pages/default.aspx">most comprehensive Data Protection legislation on the continent</a> and any data breach can actually be litigated locally (without the need for GDPR) with penalties to AfriNIC (if for example it is determined that email targets/addresses were harvested from Afrinic digital resources without consent from the data subjects).<o:p></o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'>walu.<o:p></o:p></p></div></div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p><div><div><p class=MsoNormal style='margin-left:35.4pt'>On Wed, Jul 10, 2019 at 8:04 AM Owen DeLong <<a href="mailto:owen@delong.com">owen@delong.com</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><p class=MsoNormal style='margin-left:35.4pt'><br><br>> On Jul 5, 2019, at 14:13 , JORDI PALET MARTINEZ via Community-Discuss <<a href="mailto:community-discuss@afrinic.net" target="_blank">community-discuss@afrinic.net</a>> wrote:<br>> <br>> Hi Alan,<br>> <br>> If the board can't investigate that, we may have a problem, because Afrinic has to comply with GDPR.<br><br>Why? AfriNIC is not located in the EU and does not solicit business with EU persons.<br><br>AfriNIC is not, by my reading, subject to the GDPR.<br><br>Even if they were, AfriNIC did not violate GDPR here. Wafa might have, but I don’t think she is subject to GDPR, either. Last I looked, Tunisia was outside EU jurisdiction.<br><br><br>> I don't know if those emails come from whois or something else, but some logs may tell.<br><br>Why is this relevant?<br><br>> I my opinion it will be nicer to get a response from Wafa, and I'm sure the community will be happy to forgive her. My intent is not to punish anyone, just to make sure that we find solutions to possible problems and mistakes and avoid repeating them.<br><br>I have no issue with the use of the email addresses. I think the far more important issue here is the message sent under color of authority which authority likely was not authorized to Wafa at the time.<br><br>Owen<br><br>> <br>> Regards,<br>> Jordi<br>> @jordipalet<br>> <br>> <br>> <br>> El 5/7/19 10:16, "Alan Barrett" <<a href="mailto:alan.barrett@afrinic.net" target="_blank">alan.barrett@afrinic.net</a>> escribió:<br>> <br>> <br>> <br>>> On 3 Jul 2019, at 15:50, JORDI PALET MARTINEZ via Community-Discuss <<a href="mailto:community-discuss@afrinic.net" target="_blank">community-discuss@afrinic.net</a>> wrote:<br>>> <br>>> I’m angrier about this as much as I think on it again.<br>>> <br>>> Can the board and the staff investigate this?<br>>> <br>>> Can all the people that got those emails confirm if they have provided voluntarily their emails or if they have participated in Afrinic lists, or if those emails are part of their Afrinic contacts, in order to understand if this personal data (emails are personal data), have been collected from Afrinic internal databases.<br>> <br>> There is no reasonable way for AFRINIC staff to investigate whether the recipients had agreed to receive the messages sent by Wafa Dahmani. There is also no reasonable way for staff to investigate whether email addresses were collected from the public WHOIS database. There is no non-public AFRINIC database that could have been used.<br>> <br>> Regards,<br>> Alan Barrett<br>> <br>> <br>> _______________________________________________<br>> Community-Discuss mailing list<br>> <a href="mailto:Community-Discuss@afrinic.net" target="_blank">Community-Discuss@afrinic.net</a><br>> <a href="https://lists.afrinic.net/mailman/listinfo/community-discuss" target="_blank">https://lists.afrinic.net/mailman/listinfo/community-discuss</a><br>> <br>> <br>> <br>> <br>> **********************************************<br>> IPv4 is over<br>> Are you ready for the new Internet ?<br>> <a href="http://www.theipv6company.com" target="_blank">http://www.theipv6company.com</a><br>> The IPv6 Company<br>> <br>> This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.<br>> <br>> <br>> <br>> <br>> _______________________________________________<br>> Community-Discuss mailing list<br>> <a href="mailto:Community-Discuss@afrinic.net" target="_blank">Community-Discuss@afrinic.net</a><br>> <a href="https://lists.afrinic.net/mailman/listinfo/community-discuss" target="_blank">https://lists.afrinic.net/mailman/listinfo/community-discuss</a><br><br><br>_______________________________________________<br>Community-Discuss mailing list<br><a href="mailto:Community-Discuss@afrinic.net" target="_blank">Community-Discuss@afrinic.net</a><br><a href="https://lists.afrinic.net/mailman/listinfo/community-discuss" target="_blank">https://lists.afrinic.net/mailman/listinfo/community-discuss</a><o:p></o:p></p></blockquote></div></div><br>**********************************************<br>
IPv4 is over<br>
Are you ready for the new Internet ?<br>
http://www.theipv6company.com<br>
The IPv6 Company<br>
<br>
This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.<br>
<br>
</body></html>