<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Reply in</div><br class=""><div><blockquote type="cite" class=""><div class="">On Dec 11, 2016, at 11:52 PM, serge ilunga <<a href="mailto:sergekbk@gmail.com" class="">sergekbk@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><p class="MsoNormal"><span lang="FR" class="">Hello SM / Kris,</span></p><div class=""><span lang="FR" class=""> </span><br class="webkit-block-placeholder"></div><p class="MsoNormal"><span lang="FR" class="">1.<span class=""> </span>Est-ce légal qu’AfriNIC procède à
l’audit et à la récupération des ressources? Oui.</span></p></div></div></blockquote><div><br class=""></div><div class=""><div dir="ltr" class=""><div class="">Oui de par les contraintes du RSA, mais ce que je propose c’est de revisiter les exigences. Ce que nous avons aujourd'hui ne permet pas vraiment les audits en questions que nous ne parlons pas. Si ca reste ouvert on n’aide pas aussi l’audit en question. On peux rester ouvert mais certaine peux dire pourquoi nous ? Si on arrive a mettre en exergue quelques critères on arrivera au résultats escomptée</div></div></div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><p class="MsoNormal"><span lang="FR" class="">2.<span class=""> </span>L’exigence de faire l’audit en toute
transparence constitue-t-elle un risque de violation du NDA ?</span></p><p class="MsoNormal"><span lang="FR" class="">Nous ne pensons
pas que ça soit le cas car les informations échangées ne sont pas mises sur la
place publique et sont manipulées exclusivement<span class="">
</span>par AfriNIC. </span></p></div></div></blockquote><div>Non tant que L’audit effectuée reste interne a afrinic en transparence au membre concernée, donc en effet ce qui dois se passer c’est que l’audit peux être aléatoire mais dois suivre une certaine exigence qui justifie le besoin de l’audit est le membre concernée dois savoir de quoi l’audit va prendre en consideration. Pour moi comme Auditeur on prepare toujours les audits en avance est tous est fais par rapport a un agenda spécifique. Est a la fin un rapport est partager entre le membre concernée est une poignée de personne interne. </div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class=""><span lang="FR" class=""></span><br class="webkit-block-placeholder"></div><p class="MsoNormal"><span lang="FR" class="">3.<span class=""> </span>La publication du rapport : celle-ci ne
constitue pas un risque de violation du NDA les données personnelles ne sont
pas publiées et la version actuelle de la proposition n’impose pas de les
publier. Pour éviter toute équivoque, nous nous proposons de spécifier
clairement dans la section 3.6<span class=""> </span>de ne pas
publier les données personnelles pour ne pas violer le NDA.</span></p><p class="MsoNormal"><span lang="FR" class="">En rapport avec
la DPA, est-ce le modèle de rapport proposé sur la liste <span class=""> </span>et présenté sous [1] expose t’il a une violation
quelconque ? </span></p><p class="MsoNormal"><span lang="FR" class="">Si oui quel type
de données y contribue ?</span></p><div class=""><br class=""></div></div></div></blockquote><h4 data-kwik="117" style="padding-bottom: 5px; margin: 5px 0px 10px; font-weight: normal; line-height: 18.72px; font-size: 14.4px; color: rgb(51, 51, 51); font-family: Helvetica, Arial, FreeSans, sans-serif; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(238, 238, 238);" class="">3.6 Compliance Report</h4><p data-kwik="121" style="margin-top: 5px; margin-bottom: 5px; color: rgb(51, 51, 51); font-family: Helvetica, Arial, FreeSans, sans-serif; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(238, 238, 238);" class="">AFRNIC shall publish an annual report describing the members which have been audited and their level of compliance.</p><div><br class=""></div><div>Rapport annuelle détaillant les membres qui ont subis un audit est leur niveau de conformité —— ces donnes donne deja une indications des membres. Or je pense sous reserve legal qu’on peux trouver un entente ou on peux presentees ces infos différemment. C’est dire un rapport statistique ne dévoilant pas le nom de l’organisation etc., peut être comme RIPE </div><div><br class=""></div></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div><div><span style="font-family: Helvetica-Light;" class="">There was the following comment from RIPE NCC about its existing audit practices:</span></div></div><div><div><br style="font-family: Helvetica-Light;" class=""></div></div><div><div><span style="font-family: Helvetica-Light;" class=""> "It was noted that 200 cases were reported/received so far in 2016, leading</span></div></div><div><div><span style="font-family: Helvetica-Light;" class=""> to 76 investigations.</span><font face="Helvetica-Light" class="">”</font></div></div></blockquote><div><div><span style="font-family: Helvetica-Light;" class=""><br class=""></span></div><div><font face="Helvetica-Light" class="">Mais la aussi on parle de cas de complainte reçus a des infractions pas des audits. Soyons claire.</font></div><div><br class=""></div><div>Pour continuer je reprend le icp-2 - icann qui regis les RIRs: <a href="https://www.icann.org/resources/pages/new-rirs-criteria-2012-02-25-en" class="">https://www.icann.org/resources/pages/new-rirs-criteria-2012-02-25-en</a></div><div><br class=""></div><div><p align="left" style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><b style="box-sizing: border-box;" class="">9) Record Keeping</b></p><p align="left" style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">All RIRs must maintain proper records of all registry activities, including the archiving of all information collected from LIRs in the process of making <abbr title="Internet Protocol or Intellectual Property" class="" style="box-sizing: border-box; unicode-bidi: bidi-override; direction: ltr; border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(153, 153, 153); cursor: help; transition: all 0.2s; -webkit-transition: all 0.2s;">IP</abbr> address space assignments. This data is needed for internal purposes (namely, the evaluation of subsequent requests from the same customers), and also to maintain the auditability of <abbr title="Regional Internet Registry" style="box-sizing: border-box; unicode-bidi: bidi-override; direction: ltr; border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(153, 153, 153); cursor: help; transition: all 0.2s; -webkit-transition: all 0.2s;" class="">RIR</abbr> operations, essential in demonstrating responsible and neutral operations.</p><p align="left" style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">English is considered the official language of the registry system. Therefore, core registry documentation and records which may be subject to frequent review by (or exchange with) other RIRs, <abbr title="Internet Assigned Numbers Authority" style="box-sizing: border-box; unicode-bidi: bidi-override; direction: ltr; border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(153, 153, 153); cursor: help; transition: all 0.2s; -webkit-transition: all 0.2s;" class="">IANA</abbr> or <abbr title="Internet Corporation for Assigned Names and Numbers" style="box-sizing: border-box; unicode-bidi: bidi-override; direction: ltr; border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(153, 153, 153); cursor: help; transition: all 0.2s; -webkit-transition: all 0.2s;" class="">ICANN</abbr> must be available at all times in English. In addition information which may be required for operational audit of <abbr title="Regional Internet Registry" style="box-sizing: border-box; unicode-bidi: bidi-override; direction: ltr; border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(153, 153, 153); cursor: help; transition: all 0.2s; -webkit-transition: all 0.2s;" class="">RIR</abbr>procedures must be able to be provided in English within a reasonable timeframe.</p><p align="left" style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><b style="box-sizing: border-box;" class=""></b></p><p align="left" style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">This policy document does not detail precisely which information may be classified as "core documentation." The Emerging <abbr title="Regional Internet Registry" class="" style="box-sizing: border-box; unicode-bidi: bidi-override; direction: ltr; border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(153, 153, 153); cursor: help; transition: all 0.2s; -webkit-transition: all 0.2s;">RIR</abbr> should propose in its application an auditable procedure for Registry Record Keeping in English.</p><p align="left" style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><b style="box-sizing: border-box;" class="">10) Confidentiality</b></p><p align="left" style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">Information collected by a <abbr title="Regional Internet Registry" style="box-sizing: border-box; unicode-bidi: bidi-override; direction: ltr; border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(153, 153, 153); cursor: help; transition: all 0.2s; -webkit-transition: all 0.2s;" class="">RIR</abbr> in the registration process must be kept in strict confidence, and used for registration purposes only. It must be transmitted only to another <abbr title="Regional Internet Registry" style="box-sizing: border-box; unicode-bidi: bidi-override; direction: ltr; border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(153, 153, 153); cursor: help; transition: all 0.2s; -webkit-transition: all 0.2s;" class="">RIR</abbr> or <abbr title="Internet Assigned Numbers Authority" style="box-sizing: border-box; unicode-bidi: bidi-override; direction: ltr; border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(153, 153, 153); cursor: help; transition: all 0.2s; -webkit-transition: all 0.2s;" class="">IANA</abbr> upon request, but will not be transmitted to any other party unless explicitly agreed to in writing by the LIR/<abbr title="Internet Service Provider" style="box-sizing: border-box; unicode-bidi: bidi-override; direction: ltr; border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(153, 153, 153); cursor: help; transition: all 0.2s; -webkit-transition: all 0.2s;" class="">ISP</abbr> served.</p><p align="left" style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">RIRs may establish their own local standards and policies for confidentiality, providing that the basic confidentiality provisions are maintained.</p></div><div>Par ce rapport: <a href="https://www.iana.org/reports/2005/afrinic-report-05aug2005.pdf" class="">https://www.iana.org/reports/2005/afrinic-report-05aug2005.pdf</a> — IANA-ICANN Afrinic satisfais les besoin de confidentialité</div><div><br class=""></div></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div><div>10) Confidentiality.
The AfriNIC application satisfies Principle 10. AfriNIC has developed and implemented
a comprehensive set of policies and procedures to ensure that the information it collects
in the registration process will be kept in strict confidence, and used for registration
purposes only. </div></div><div><div><br class=""></div></div><div><div>As stated in AfriNIC’s application:
Every piece of information collected by AfriNIC from members or any other
entity will be processed and managed according to a nondisclosure agreement
which should be signed between the two parties. All AfriNIC’s staff has signed a
nondisclosure and confidentiality agreement at the start of work in the company.</div></div></blockquote><div><div><br class=""></div><div><br class=""></div><div>La on a IANA est DPA — Si on arrive a terme de presenter un stats comme celle que présente SM dans son blog de recherche, on arrivera peut être a un juste milieux. Je pense dans ce sense que le conseiller legal peux nous indiquer le milieux qui marche.</div><div><br class=""></div><div>Si on prend </div><div><blockquote type="cite" class=""><div dir="ltr" class=""><p class="MsoNormal">[1] </p><p class="MsoNormal">Description of "members” in AFRINIC context may at some points looks like:</p><p class="MsoNormal">A- How many members have been reviewed <b class=""><i class="">(we can keep the brief here)</i></b></p><p class="MsoNormal"><span class=""> </span>- By type:<span class=""> </span>LIR, End-users, etc… <b class=""><i class="">(we start opening the guess work and going in details)</i></b></p><p class="MsoNormal"><span class=""> </span>- By Category:<span class=""> </span>Extralarge, Large, Medium, small, etc…<b class=""><i class=""> (we start opening the guess work and going in details)</i></b></p></div></blockquote><blockquote type="cite" class=""><div dir="ltr" class=""><p class="MsoNormal">B- Type of ressources involved:<span class=""> </span>ASN, IPv4 ,IPv6 <b class=""><i class=""> (we start opening the guess work and going in details)</i></b></p></div></blockquote><blockquote type="cite" class=""><div dir="ltr" class=""><p class="MsoNormal">C- Level of compliance - <b class=""><i class=""> (we start opening the guess work and going in details - but what do you want to say with level of compliance a well)</i></b></p><div class=""><br class=""></div></div></blockquote></div><div><br class=""></div><div>Alons prendre un example : category: large , resources: ASN / IPv4 , level of compliance: RED/ no compliance</div><div><br class=""></div><div>On peux deviner le nombre de membre dans cet catégorie deja est les autres infos vont suivre. </div><div><br class=""></div><div>Toute ces infos done trop de possibilité … meme si le nom de l’organisation ou membre n’est mentioner. Trouvons un entente de ce qui peut être publier ou pas. Mais ce type d’infos peut être jouable est ne constitue pas de problème direct de confidentialité.</div><div><br class=""></div><div><img apple-inline="yes" id="315C0926-40D8-4499-950E-A2D62B1C1101" height="251" width="460" apple-width="yes" apple-height="yes" src="cid:FE46AE3D-B819-48C9-8D76-1E28BA7B8CD1" class=""></div><div><br class=""></div><div><br class=""></div><div>Kris</div><div><br class=""></div><div><br class=""></div><div><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class=""><span lang="FR" class=""> </span><br class="webkit-block-placeholder"></div><div class=""> <br class="webkit-block-placeholder"></div><p class="MsoNormal">Bien cordialement.</p><div class=""> <br class="webkit-block-placeholder"></div><div class=""> <br class="webkit-block-placeholder"></div><p class="MsoNormal">[1] </p><p class="MsoNormal">Description of "members” in AFRINIC context may at some
points looks like:</p><p class="MsoNormal">A- How many members have been reviewed :</p><p class="MsoNormal"><span class=""> </span>- By type:<span class=""> </span>LIR, End-users, etc…</p><p class="MsoNormal"><span class=""> </span>- By Category:<span class=""> </span>Extralarge, Large, Medium, small, etc…</p><p class="MsoNormal">B- Type of ressources involved:<span class=""> </span>ASN, IPv4 ,IPv6</p><p class="MsoNormal">C- Level of compliance</p>
</div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Sun, Dec 11, 2016 at 3:55 PM, Kris Seeburn <span dir="ltr" class=""><<a href="mailto:seeburn.k@gmail.com" target="_blank" class="">seeburn.k@gmail.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word" class=""><div class="">People,</div><div class=""><br class=""></div><div class="">You may want to note that afrinic staff review already stated these:</div><div class=""><br class=""></div><div class=""><span class=""><ul style="color:rgb(51,51,51);font-family:Helvetica,Arial,FreeSans,sans-serif;font-variant-ligatures:normal;background-color:rgb(238,238,238)" class=""><li class=""><em class="">The requirement that the review be conducted with "full transparency" may be in conflict with privacy provisions in NDAs, in the RSA, or in law.</em></li><li class=""><em class="">The requirement to publish a "compliance report" may be in conflict with privacy provisions in NDAs, in the RSA, or in law.</em></li></ul></span><div class="">I’ve already voiced that there be a revisit to this policy differently but i think pointing this in the DPA should be noted. Unless the NDA and RSA are modified to state that there is no confidentiality…. If that is the case.</div></div><div class=""><br class=""></div><div class="">These may help guide all. The data controller is an appointed staff of afrinic. Whether we state Mauritian law or else the NDA. In essence we need to note what is Public information and what is Private and confidential information.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div id="m_-3878510581784387672viewlet-below-content-body" style="box-sizing:border-box;color:rgb(51,51,51);font-family:'Open Sans',Helvetica,Arial,sans-serif;font-size:14.3px;font-variant-ligatures:normal;background-color:rgb(255,255,255)" class=""></div></div><div class=""><br class=""></div><div class=""><p class="MsoNormal" style="line-height:normal"><a name="m_-3878510581784387672__Toc66683978" class=""><b class=""><span style="font-size:18.0pt;font-family:"Times New Roman"" class="">29.
Unlawful disclosure of personal data</span></b></a><a name="m_-3878510581784387672_b29" class=""></a><b class=""><span style="font-size:18.0pt;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></b></p><p class="MsoNormal" style="line-height:normal"><span style="font-size:12.0pt;font-family:"Times New Roman"" lang="EN-GB" class="">(1) Any <b class="">data</b>
controller who, without lawful excuse, discloses personal <b class="">data</b> in any
manner that is incompatible with the purposes for which such <b class="">data</b> has
been collected shall commit an offence.</span><span style="font-size:12.0pt;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="line-height:normal"><span style="font-size:12.0pt;font-family:"Times New Roman"" lang="EN-GB" class="">(2) Any <b class="">data</b>
processor who, without lawful excuse, discloses personal <b class="">data</b> processed
by him without the prior authority of the <b class="">data</b> controller on whose
behalf such <b class="">data</b> is or has been processed shall commit an offence.</span><span style="font-size:12.0pt;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="line-height:normal"><span style="font-size:12.0pt;font-family:"Times New Roman"" lang="EN-GB" class="">(3) Subject
to subsection (4), any person who -</span><span style="font-size:12.0pt;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="margin-top:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:108.0pt;margin-bottom:.0001pt;text-align:justify;line-height:150%"><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">(a) obtains access to personal <b class="">data</b>, or obtains
any information constituting such <b class="">data</b>, without prior authority of the <b class="">data</b>
controller or <b class="">data</b> processor by whom such <b class="">data</b> is kept; and</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="margin-top:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:72.0pt;margin-bottom:.0001pt;text-align:justify;line-height:150%"><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">(b) discloses the <b class="">data</b> or information to another person,</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="margin-top:12.0pt;text-align:justify;line-height:150%"><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">
shall commit an offence.</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="line-height:normal"><span style="font-size:12.0pt;font-family:"Times New Roman"" lang="EN-GB" class="">(4)
Subsection (3) shall not apply to a person who is an employee or agent of a <b class="">data</b>
controller or processor and is <b class="">act</b>ing within his mandate.</span><span style="font-size:12.0pt;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="line-height:normal"><span style="font-size:12.0pt;font-family:"Times New Roman"" lang="EN-GB" class="">(5) Any
person who offers to sell personal <b class="">data</b> where such personal <b class="">data</b>
has been obtained in breach of subsection (1) shall commit an offence.</span><span style="font-size:12.0pt;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="line-height:normal"><span style="font-size:12.0pt;font-family:"Times New Roman"" lang="EN-GB" class="">(6) For the
purposes of subsection (5), an advertisement indicating that personal <b class="">data</b>
is or may be for sale, constitutes an offer to sell the personal <b class="">data</b>.</span><span style="font-size:12.0pt;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="line-height:normal"><span style="font-size:12.0pt;font-family:"Times New Roman"" lang="EN-GB" class=""><br class=""></span></p><p class="MsoNormal" style="line-height:normal"><span style="font-size:12.0pt;font-family:"Times New Roman"" lang="EN-GB" class="">further reading:</span></p><div class=""><br class=""></div><div class=""><p class="MsoNormal" style="line-height:normal"><a name="m_-3878510581784387672__Toc66683980" class=""><b class=""><span style="font-size:18.0pt;font-family:"Times New Roman"" class="">31.
Transfer of personal data</span></b></a><a name="m_-3878510581784387672_b31" class=""></a><b class=""><span style="font-size:18.0pt;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></b></p><p class="MsoNormal" style="margin-top:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:72.0pt;margin-bottom:.0001pt;text-align:justify;line-height:150%"><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">(1)</span><span style="font-size:7.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">
</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">Subject to subsection (2), no <b class="">data</b> controller shall, except with
the written authorisation of the Commissioner, transfer personal <b class="">data</b> to
another country. </span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="margin-top:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:72.0pt;margin-bottom:.0001pt;text-align:justify;line-height:150%"><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">(2)</span><span style="font-size:7.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">
</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">The Eighth <b class="">data</b> <b class="">protection</b> principle specified in the
First Schedule shall not apply where –</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="margin-top:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:108.0pt;margin-bottom:.0001pt;text-align:justify;line-height:150%"><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">(a)</span><span style="font-size:7.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">
</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">the <b class="">data</b> subject has given his consent to the transfer;</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="margin-top:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:108.0pt;margin-bottom:.0001pt;text-align:justify;line-height:150%"><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">(b)</span><span style="font-size:7.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">
</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">the transfer is necessary –</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="margin-top:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:144.0pt;margin-bottom:.0001pt;text-align:justify;line-height:150%"><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">(i)</span><span style="font-size:7.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">
</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">for the performance of a contr<b class="">act</b> between the <b class="">data</b> subject
and the <b class="">data</b> controller, or for the taking of steps at the request of
the <b class="">data</b> subject with a view to his entering into a contr<b class="">act</b> with
the <b class="">data</b> controller;</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="margin-top:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:144.0pt;margin-bottom:.0001pt;text-align:justify;line-height:150%"><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">(ii)</span><span style="font-size:7.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">
</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">for the conclusion of a contr<b class="">act</b> between the <b class="">data</b>
controller and a person, other than the <b class="">data</b> subject, which is entered
at the request of the <b class="">data</b> subject, or is in the interest of the <b class="">data</b>
subject, or for the performance of such a contr<b class="">act</b>;</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="margin-top:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:144.0pt;margin-bottom:.0001pt;text-align:justify;line-height:150%"><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">(iii)</span><span style="font-size:7.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">
</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">in the public interest, to safeguard public security or national
security.</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="margin-top:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:108.0pt;margin-bottom:.0001pt;text-align:justify;line-height:150%"><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">(c)</span><span style="font-size:7.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">
</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">the transfer is made on such terms as may be approved by the
Commissioner as ensuring the adequate safeguards for the <b class="">protection</b> of
the rights of the <b class="">data</b> subject.</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="margin-left:72.0pt;line-height:150%"><span style="font-family:"Times New Roman"" lang="EN-GB" class="">(3)</span><span style="font-size:7.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">
</span><span style="font-family:"Times New Roman"" lang="EN-GB" class="">For the purpose of subsection
(2)(c), the adequacy of the level of <b class="">protection</b> of a country shall be
assessed in the light of all the circumstances surrounding the <b class="">data</b>
transfer, having regard in particular to -</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="margin-top:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:108.0pt;margin-bottom:.0001pt;text-align:justify;line-height:150%"><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">(a)</span><span style="font-size:7.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">
</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">the nature of the <b class="">data</b>;</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="margin-top:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:108.0pt;margin-bottom:.0001pt;text-align:justify;line-height:150%"><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">(b)</span><span style="font-size:7.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">
</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">the purpose and duration of the proposed processing;</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="margin-top:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:108.0pt;margin-bottom:.0001pt;text-align:justify;line-height:150%"><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">(c)</span><span style="font-size:7.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">
</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">the country of origin and country of final destination;</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="margin-top:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:108.0pt;margin-bottom:.0001pt;text-align:justify;line-height:150%"><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">(d)</span><span style="font-size:7.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">
</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">the rules of law, both general and sectoral, in force in the country in
question; and</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="margin-top:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:108.0pt;margin-bottom:.0001pt;text-align:justify;line-height:150%"><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">(e)</span><span style="font-size:7.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">
</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" lang="EN-GB" class="">any relevant codes of conduct or other rules and security measures which
are<a name="m_-3878510581784387672__Toc64105280" class=""></a><a name="m_-3878510581784387672__Toc61409608" class=""></a><a name="m_-3878510581784387672__Toc61409681" class=""></a><a name="m_-3878510581784387672__Toc61423544" class=""></a><a name="m_-3878510581784387672__Toc64010766" class=""></a><a name="m_-3878510581784387672__Toc64015389" class=""></a><a name="m_-3878510581784387672__Toc64089514" class=""></a> complied with
in that country.</span><span style="font-size:12.0pt;line-height:150%;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal" style="margin-top:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:72.0pt;margin-bottom:.0001pt;text-align:justify;line-height:normal"><b class=""><span style="font-size:12.0pt;font-family:"Times New Roman"" lang="EN-GB" class="">Amended by [<a href="http://supremecourt.intnet.mu/Main/GetDoc.asp?Doc_Title=Act+No.+14+of+2009&Mode=Html&Search=No" target="_blank" class=""><span style="color:windowtext" class="">Act No. 14 of 2009</span></a>]</span></b><span style="font-size:12.0pt;font-family:"Times New Roman"" class=""><u class=""></u><u class=""></u></span></p>
</div>
</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">We need to see a balance and decide properly. I would like to say that i am not taking sides but we need to understand to what extent things can and cannot be reported. The mauritius DPA takes precedence from the EU Act. But still an NDA binds the resource member and afrinic within the binds of a legal clause of confidentiality that any member can recall and use against afrinic. </div><div class=""><br class=""></div><div class="">However, i am sure if we keep to a brief as i said X number of applicants received and Y numbers not accepted may be still fine but category etc., may already lead to guesswork and this may again lead to legal hassle. A compliance report as per the current state of proposal releases too much information already. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Further the RIPE NCC policy:</div><div class=""><br class=""></div><div class=""><div class="">If you are referring to RiPE NCC policy:</div><div class=""><br class=""></div><div class=""><h1 class="m_-3878510581784387672documentFirstHeading" style="box-sizing:border-box;margin:0px 0px 12px;font-family:'Open Sans',Helvetica,Arial,sans-serif;line-height:1.3em;color:rgb(88,89,91);max-width:700px;font-variant-ligatures:normal;background-color:rgb(255,255,255)">RIPE NCC Audit Activity</h1><div id="m_-3878510581784387672viewlet-below-content-title" style="box-sizing:border-box;color:rgb(51,51,51);font-family:'Open Sans',Helvetica,Arial,sans-serif;font-size:14.3px;font-variant-ligatures:normal;background-color:rgb(255,255,255)" class=""><div class="m_-3878510581784387672documentByLine" id="m_-3878510581784387672plone-document-byline" style="box-sizing:border-box;margin:0px 0px 12px"></div></div><div id="m_-3878510581784387672viewlet-above-content-body" style="box-sizing:border-box;color:rgb(51,51,51);font-family:'Open Sans',Helvetica,Arial,sans-serif;font-size:14.3px;font-variant-ligatures:normal;background-color:rgb(255,255,255)" class=""></div></div></div></div>...<br class=""><br class="">[Message clipped] <br class="">______________________________<wbr class="">_________________<br class="">
RPD mailing list<br class="">
<a href="mailto:RPD@afrinic.net" class="">RPD@afrinic.net</a><br class="">
<a href="https://lists.afrinic.net/mailman/listinfo/rpd" rel="noreferrer" target="_blank" class="">https://lists.afrinic.net/<wbr class="">mailman/listinfo/rpd</a><br class="">
<br class=""></blockquote></div><br class=""><br clear="all" class=""><br class="">-- <br class=""><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr" class=""><div style="text-align:center" class=""><div style="text-align:center" class=""><span style="color:rgb(0,0,255)" class=""><span style="background-color:rgb(238,238,238)" class=""><b class=""><span style="font-family:comic sans ms,sans-serif" class="">Serge ILUNGA KABWIKA</span></b><br class=""></span></span></div><span style="color:rgb(0,0,255)" class=""><span style="background-color:rgb(238,238,238)" class=""><b class=""><span style="font-family:comic sans ms,sans-serif" class=""></span></b></span></span></div><div style="text-align:center" class=""><span style="color:rgb(0,0,255)" class=""><span style="background-color:rgb(238,238,238)" class=""><b class=""><span style="font-family:comic sans ms,sans-serif" class="">Skype: sergekbk</span></b><br class=""><b class=""><span style="font-family:comic sans ms,sans-serif" class="">Cell: +243814443160</span></b></span></span></div></div></div>
</div>
</div></blockquote></div><br class=""><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Kris Seeburn</div><div class=""><a href="mailto:seeburn.k@gmail.com" class="">seeburn.k@gmail.com</a></div><div class=""><ul style="margin: 0px; padding: 0px 0px 8px; border: 0px; outline: 0px; font-family: Helvetica, Arial, sans-serif; vertical-align: baseline; list-style: none; line-height: 17px; display: table-cell; width: 504px; color: rgb(51, 51, 51);" class=""><li style="margin: 0px; padding: 8px 12px 2px 0px; border: 0px; outline: 0px; font-style: inherit; font-size: 11px; font-family: inherit; vertical-align: baseline; font-variant: inherit; line-height: 1.2em;" class=""><dl class="public-profile" style="margin: 0px; padding: 0px; border: 0px; outline: 0px; font-style: inherit; font-family: inherit; vertical-align: baseline; font-variant: inherit; line-height: inherit; word-wrap: break-word;"><dd style="margin: 0px; padding: 2px 9px 1px 0px; border: 0px; outline: 0px; font-style: inherit; font-family: inherit; vertical-align: top; font-variant: inherit; line-height: inherit; display: inline-block; zoom: 1;" class=""><a href="http://www.linkedin.com/in/kseeburn/" title="View public profile" name="webProfileURL" style="margin: 0px 10px 0px 0px; padding: 0px 0px 0px 19px; border: 0px; outline: 0px; font-style: inherit; font-family: inherit; vertical-align: middle; text-decoration: none; color: rgb(102, 102, 102); font-variant: inherit; line-height: inherit; display: inline-block; zoom: 1; background-image: url(http://s.c.lnkd.licdn.com/scds/common/u/images/apps/profile/sprite/sprite_profile_top_card_v8.png); background-position: 0px -249px; background-repeat: no-repeat no-repeat;" class="">www.linkedin.com/in/kseeburn/</a></dd></dl></li></ul></div><div class=""><br class=""></div></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>