<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang=en-MU link=blue vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span lang=EN-US>Hi DBWG,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Please find below the report on WHOWAS in plain text. I have also attached it in PDF format.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Kind regards,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Yogesh Chadee</span></p><div style='mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;padding:0cm 0cm 1.0pt 0cm'><p class=MsoNormal style='border:none;padding:0cm'><o:p> </o:p></p></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Recommendation </p><p class=MsoNormal>for an AFRINIC </p><p class=MsoNormal>WHOWAS service</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>March 2021</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>By AFRINIC Team</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>________________</p><p class=MsoNormal>Introduction</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The WHOWAS service was first proposed by APNIC and is now offered by a second RIRs as well. There has been recent interest from the AFRINIC community for a WHOWAS service offering by AFRINIC.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This report is about the WHOWAS product at AFRINIC. The product is intended to provide a new service at AFRINIC named WHOWAS.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The service aims at providing historical WHOIS data to the general public. Although the WHOIS already has the capability of providing historical data, the WHOWAS will provide intuitive search and browse capabilities which will be added-value for end-users.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The objectives of this paper are as follows:</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>1. Review whether the WHOWAS as it is in its present form respects the laws of Mauritius;</p><p class=MsoNormal>2. Consider the alternative options with respect to a potential WHOWAS service by AFRINIC; </p><p class=MsoNormal>3. Describe the amount of work required in each case;</p><p class=MsoNormal>4. Put forth the risks associated with each option; and</p><p class=MsoNormal>5. Give a recommendation.</p><p class=MsoNormal>________________</p><p class=MsoNormal>Legal due diligence</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Source code</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The source code used is offered by APNIC and licensed under BSD licence (rdapd, rdap-history-ui). In summary, the source code is free for use and distribution but must retain the BSD license upon distribution as well as the BSD license notice.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Therefore AFRINIC is free to use the WHOWAS source code published by APNIC.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Data protection</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>According to the Data Protection Act 2017, </p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>1. Personal data is any data that can, directly or indirectly, help to identify a data subject;</p><p class=MsoNormal>2. Before processing any personal data, a data controller must have the explicit consent of the data subject concerned provided for a specific purpose; and</p><p class=MsoNormal>3. Explicit consent must be obtained for each processing/purpose.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Data subjects may be directly or indirectly identified through data contained in these fields, as provided by the WHOWAS product in its present form:</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>__________________________________</p><p class=MsoNormal>Field WHOWAS object type</p><p class=MsoNormal>__________________________________</p><p class=MsoNormal>remarks organisation, inetnum, inet6num, aut-num, person, role, mntner, irt</p><p class=MsoNormal>description organisation, inetnum, inet6num, aut-num, mntner</p><p class=MsoNormal>name person, role, irt</p><p class=MsoNormal>email person, role, irt</p><p class=MsoNormal>__________________________________</p><p class=MsoNormal>Table 1: Fields potentially containing personal data in WHOWAS</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>________________</p><p class=MsoNormal>Alternative options</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This presents AFRINIC with the following viable alternative options with respect to a potential WHOWAS service:</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>1. Do not propose any WHOWAS service at the moment;</p><p class=MsoNormal>2. Go-Live with the WHOWAS product as-is and face possible litigation;</p><p class=MsoNormal>3. Obtain explicit consent from data subjects prior to publishing their personal data on the WHOWAS; or</p><p class=MsoNormal>4. Exclude personal data from the WHOWAS service.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>No WHOWAS service</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>No further work is required with this option.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The risk of this option is that end-users who are looking forward to a WHOWAS service offering by AFRINIC will be disappointed.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Go-Live as-is</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The WHOWAS product is ready for Go-Live. There is little work involved with this option.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>However, this option opens up serious risk of litigation for AFRINIC.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Obtaining explicit consent</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>It has been established that the WHOWAS product publishes personal data in its present form.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The Registration Service Agreement of AFRINIC covers the WHOIS service. However, providing historical WHOIS information to the general public is a separate and/or standalone form of processing the same underlying data. </p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Providing a WHOWAS service based on the current WHOWAS product will require AFRINIC to obtain explicit consent from all concerned data subjects concerned prior to Go-Live. After Go-Live, new data subjects will also need to give their explicit consent. </p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>To achieve this, consent management would be added to the membership processes as well as the membership data update processes.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The risk with this option is to increase the workload on AFRINIC for an indeterminate period of time.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Exclude personal data</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Personal data can be excluded from the WHOWAS product’s output prior to Go-Live with the WHOWAS service, by eliminating the above-mentioned data fields.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>AFRINIC anticipates that by doing so, the relevance of the WHOWAS service may be questioned by the end-users.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>To address the afore-mentioned concern, AFRINIC views that since the purpose of the WHOWAS service is to provide historical data on the allocation and assignment of Internet Resources to member organisations, removing personal data should not reduce the quality nor relevance of the service.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>________________</p><p class=MsoNormal>Recommendation</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>There have been requests for AFRINIC to provide a WHOWAS service, and AFRINIC has a WHOWAS product to match the requests. However, after observing legal due diligence, it has been found that going live with the above-mentioned product as-is would be risky for AFRINIC.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This report contains alternative options for AFRINIC to consider. Each option has implications for AFRINIC’s day-to-day business as well as associated risks.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Of the four alternative options proposed, the recommendation is to exclude the above-mentioned data fields from the WHOWAS service so as to be compliant with the Data Protection Act 2017.</p><div style='mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;padding:0cm 0cm 1.0pt 0cm'><p class=MsoNormal style='border:none;padding:0cm'><o:p> </o:p></p></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><div style='mso-element:para-border-div;border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal style='border:none;padding:0cm'><b>From: </b><a href="mailto:yogesh@afrinic.net">Yogesh Chadee</a><br><b>Sent: </b>Thursday, 25 February 2021 14:10<br><b>To: </b><a href="mailto:dbwg@afrinic.net">Ben Maddison via DBWG</a><br><b>Cc: </b><a href="mailto:dbwg@afrinic.net">dbwg@afrinic.net</a><br><b>Subject: </b>Re: [DBWG] --list-versions query on deleted resources?</p></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=EN-US>Hi Ben,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>3 weeks is a long time, yes. I will do my best to give by next week, 4<sup>th</sup> March 2021.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Regards,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Yogesh Chadee</span><span lang=en-MU><o:p></o:p></span></p><p class=MsoNormal><span lang=en-MU><o:p> </o:p></span></p><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=en-MU>From: </span></b><span lang=en-MU><a href="mailto:benm@workonline.africa">Ben Maddison</a><br><b>Sent: </b>Thursday, 25 February 2021 14:06<br><b>To: </b><a href="mailto:yogesh@afrinic.net">Yogesh Chadee</a><br><b>Cc: </b><a href="mailto:dbwg@afrinic.net">dbwg@afrinic.net</a><br><b>Subject: </b>Re: [DBWG] --list-versions query on deleted resources?<o:p></o:p></span></p></div><p class=MsoNormal><span lang=en-MU><o:p> </o:p></span></p><p class=MsoNormal><span lang=en-MU>Hi Yogesh,<o:p></o:p></span></p><p class=MsoNormal><span lang=en-MU><o:p> </o:p></span></p><p class=MsoNormal><span lang=en-MU>I think our messages crossed on the wire.<o:p></o:p></span></p><p class=MsoNormal><span lang=en-MU><o:p> </o:p></span></p><p class=MsoNormal><span lang=en-MU>On 02/25, Yogesh Chadee wrote:<o:p></o:p></span></p><p class=MsoNormal><span lang=en-MU>> Hi,<o:p></o:p></span></p><p class=MsoNormal><span lang=en-MU>> <o:p></o:p></span></p><p class=MsoNormal><span lang=en-MU>> Thank you for suggesting 3 weeks for the “legal due diligence” work. It works for me.<o:p></o:p></span></p><p class=MsoNormal><span lang=en-MU>> <o:p></o:p></span></p><p class=MsoNormal><span lang=en-MU>Thanks for your feedback.<o:p></o:p></span></p><p class=MsoNormal><span lang=en-MU>However, (without wishing to put words in his mouth) I believe Nishal<o:p></o:p></span></p><p class=MsoNormal><span lang=en-MU>was referring to the 3 weeks (or more) that have already elapsed, not<o:p></o:p></span></p><p class=MsoNormal><span lang=en-MU>that the WG should wait a further 3 weeks from today.<o:p></o:p></span></p><p class=MsoNormal><span lang=en-MU><o:p> </o:p></span></p><p class=MsoNormal><span lang=en-MU>Perhaps we can aim for more like one week?<o:p></o:p></span></p><p class=MsoNormal><span lang=en-MU><o:p> </o:p></span></p><p class=MsoNormal><span lang=en-MU>Cheers,<o:p></o:p></span></p><p class=MsoNormal><span lang=en-MU><o:p> </o:p></span></p><p class=MsoNormal><span lang=en-MU>Ben<o:p></o:p></span></p><p class=MsoNormal><span lang=en-MU><o:p> </o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>