Summary

  • AFRINIC’s Publication of Information (Draft-2), submitted on 9 November 2021, proposed making a short summary of every accepted resource request public after two years. Its staff assessment, dated 15 November 2021, said roughly 5,000 historical requests had already crossed that threshold, yet their justifications sat in non-standardized tickets and members had not agreed to publication.
  • The official page records AFRINIC’s legal view that information exchanged before or during the Registration Services Agreement was confidential at common law and could be disclosed only with the member’s express consent or a judge’s order. That is an attributed institutional assessment, not an adjudicated holding.
  • Contractual authority, express member consent, and an order from a competent court or lawful public authority are distinct permission paths. Mailing-list agreement, a policy-development consensus, a Board decision, institutional convenience, and thirty days of silence cannot substitute for them.
  • The best case for transparency is real: comparable public records can reveal inconsistent decisions, exceptions, delay, drift, or favouritism. But AFRINIC can expose its decision through a minimum public receipt while protecting the business, technical, and security evidence supplied by a member.
  • A lawful prospective design would show applicants the exact summary to be published, its purpose, audience, timing, correction rules, and retention terms; require a specific opt-in; protect refusal from becoming a service penalty; and preserve independent review. Nothing in the record establishes that Draft 2 was adopted, implemented, caused a disclosure, or harmed a member.

The moment the publication plan met the permission question

The collision was unusually plain. Publication of Information (Draft-2), formally identified as AFPUB-2021-GEN-001-DRAFT02, proposed a new article 13.0 for AFRINIC’s policy manual. Jordi Palet Martinez submitted version 2.0 on 9 November 2021. Its central idea was that, two years after AFRINIC accepted a request for internet number resources, a short summary of the request justification should become public. The publication venue would be left to AFRINIC.

Six days later, on 15 November, the staff assessment displayed on the official proposal page described the information AFRINIC actually possessed. Since 2005, staff said, the registry had issued about 6,500 ASN, IPv4, and IPv6 resources. About 5,000 had already passed their second anniversary. But AFRINIC did not hold 5,000 publication-ready summaries. It held needs justifications in request tickets. The material was not stored in one standardized form, AFRINIC had not previously asked members to agree to summary publication, and existing members had not consented to that use.

That difference—between a historical request file and a public summary—was not a minor administrative gap. Someone would have to reopen thousands of records, decide what counted as the justification, compress it, remove or preserve context, send a proposed account to the member, deal with questions and alternative wording, and decide what to do when the member objected. Staff anticipated clarifications, disagreements, consent work, and additional human resources. The figures were AFRINIC’s own estimates, not an audited inventory, but the institutional problem did not depend on exact arithmetic.

The proposed public object did not already exist. It would be newly authored from material collected for another transaction.

Draft 2 contemplated notice and review. Three months before publication, a member would receive warning and a draft summary. Within a month, the member could offer alternative text or seek a one-year extension for patent-related or similarly sensitive services whose exposure could harm the business. AFRINIC would have a month to assess the non-publication case. If it remained doubtful, the matter could go to the Board, which would decide within another month after hearing the holder. Historical resources would enter a chronological warning sequence.

Those procedures might reduce surprise, but they did not answer the prior question: what gave the registry a right to disclose? A consultation period is not an authorization source. A chance to suggest better wording does not itself supply permission to publish any wording. A private Board’s review may be procedurally important within an association, but it is not a court order. Most importantly, failure to reply within thirty days is not the express consent of the person whose information is about to be exposed.

AFRINIC’s staff assessment connected that point to Section 4(d) of its Registration Services Agreement, which the assessment described as requiring compliance with applicable Mauritian data-protection and privacy law in handling applicant information. Staff warned that publication following a member’s silence could expose AFRINIC to a potential breach of that provision. The legal assessment went further. It characterized the needs material as information shared at the pre-contractual stage and stated that information exchanged before or during the agreement was confidential at common law.

On AFRINIC’s published legal view, disclosure to third parties required the concerned member’s express consent or a judge’s order. The PDP could not impose the result unilaterally on individual members, and the proposal therefore lacked legal soundness.

That conclusion must be handled with care. It shows what AFRINIC’s own assessment said. It does not convert the official proposal page into a judicial decision on Mauritian law. The available record contains no court ruling adjudicating Draft 2, does not reproduce and decide the scope of every historical agreement, and does not prove that every conceivable request field is confidential in every circumstance. The revision history also says Draft 2 was updated following impact-assessment inputs even though the displayed assessment date comes six days after submission; the sequence of document production is not resolved here.

Those limits matter because precise institutional criticism loses force when it claims more than its sources establish.

What the record does establish is narrower and more useful. AFRINIC published a proposal and an assessment that confronted the proposal with the registry’s existing information practices and stated legal obligations. That confrontation identified three possible sources of permission: a clear disclosure right already contained in the applicable contract; fresh, express agreement from the affected member to a specified disclosure; or an order from a competent court or other lawful public authority.

It rejected a fourth, invented route in which agreement inside a policy forum would itself become legal permission to release someone else’s confidential information.

This distinction follows from AFRINIC’s institutional character. A regional internet registry coordinates unique identifiers and provides membership services. It maintains accurate and auditable records, preserves contactability, supports security-relevant coordination, records recognized changes of control, and helps sustain operational continuity. Those are consequential functions, but consequence is not sovereignty. AFRINIC is not a legislature for a service region, a regulator by virtue of operating an indispensable database, a police force, a prosecutor, a punisher, a confiscator, or a public-law tribunal. Its region is not territory.

Its mailing list is not a parliament. Its Board does not become a court when a proposed procedure assigns it a dispute.

The distinction is not hostile to participatory policy. A policy room can identify a genuine problem, compare practices, gather technical experience, and recommend a better voluntary term. It can define what a future public receipt ought to contain. It can persuade members that some controlled disclosure would improve trust. What it cannot do is turn participation into consent by the absent or dissenting information holder. Consensus answers whether a group supports a recommendation. Consent answers whether a particular rights-holder authorizes a particular use. The questions have different subjects, objects, and legal effects.

The strongest case for Draft 2’s transparency objective should nevertheless be taken seriously. Comparable summaries of accepted requests might help observers detect whether similar cases received different treatment. They might reveal unexplained exceptions, changes in interpretation, unusual delay, or favouritism. In a system that allocates unique and historically scarce resources, unexplained inconsistency can weaken confidence even without proof of wrongdoing. A registry should therefore leave a public trail of its decisions.

But a trail of the registry’s decision is not the same thing as a public version of the customer’s evidence. A minimum decision receipt could identify the resource class and aggregate size, the request and decision dates, the applicable policy and version, a standardized reason code, the decision role, any exception class, and the later correction or supersession state. Such a receipt makes AFRINIC explain what AFRINIC did.

It does not require the publication of a member’s business plan, customer relationships, contracts, forecasts, network topology, security design, patent-sensitive concept, trade secret, private correspondence, or raw supporting document.

This alternative is a design proposal, not a claim about what AFRINIC implemented. The sealed record establishes no adoption or operation of Draft 2, no publication under it, no privacy breach, no injured member, and no damages. It establishes an institutional warning at the proposal stage: transparency cannot be built by treating a registry’s possession of private evidence as a right to repurpose it. The public deserves proof of the decision. That does not mean it is entitled to the customer file.