Summary

  • In March, the RIPE NCC board recorded a 12-month ceiling on public access to meeting attendee lists, while allowing internal retention for election and chair-selection records.
  • On 28 October, the official RIPE 89, 90 and 91 attendee pages still opened anonymously, although every meeting had ended more than a year earlier.

A conference badge has two afterlives. One belongs in the institution's records. The other sits on a public website, where anyone can read it. RIPE NCC's own board said in March that the second life should end 12 months after a meeting. By late October, three older meeting sites were still serving attendee lists to an anonymous visitor.

The 191st Executive Board minutes are unusually plain about the split. Under “Data Retention of Meeting Attendees,” RIPE NCC's chief legal officer told the board that personal information in attendee lists was public. The review concluded that the lists must not be publicly available longer than 12 months after each meeting. The data could stay inside the organisation, she said, so the NRO NC election and RIPE Chair selection could be traced. Procedures would be updated to make the outside deletion happen.

The old sites supply the uncomfortable follow-up. An anonymous, direct request on 28 October opened populated RIPE 89, RIPE 90 and RIPE 91 attendee pages. Those meetings ended in November 2024, May 2025 and October 2025 respectively. None needs a login or an archive trick. This report records the pages' availability, not the identities on them.

In September the board took another step. Its 195th meeting minutes record unanimous approval of a new privacy-statement section explaining how retention periods are chosen. The current statement mentions lists of event attendees under the interest in open policy development and says that such material can remain while it serves that purpose, subject to a person's removal request. Its Section 5 describes how an individual can request removal of a name. It does not put the board's 12-month public cutoff on the page.

That difference matters to a visitor deciding whether to register. An opt-out address asks each person to police a list. A timed public limit asks the publisher to police the site. The board's minutes chose the second rule while preserving a private trail for institutional accountability. A browser check of older meeting pages shows how far that choice has travelled into the sites that actually display the data.

The published minutes do not explain whether older meeting sites have an exception or a delayed removal schedule; a public scope rule or removal of the lists would settle that point. Until then, the board's clock and the open pages tell different stories. The meeting dates can be checked in the first-party programmes for RIPE 89, RIPE 90, RIPE 91.