Summary

  • LACNIC's account-creation notice says the event website will publish a participant list, identifies the attendance purpose and rights contact, and asks the user to accept the terms. This is not a story about hidden or absent consent.
  • The LACNIC 46 page makes four fields public—Name, Organization, Participation and Country—but neither the page nor the general privacy policy gives readers an event-specific date for reviewing or ending that visibility.
  • A useful remedy is a public, privacy-safe receipt linking notice version, field scope, visibility window and aggregate request outcomes, while keeping every person's acceptance record and any protected attendance record private.

Consent is a beginning, not a timer.

That distinction matters because the LACNIC 46–LACNOG 2026 participant page is unusually easy to misunderstand in both directions. One reading treats any public name as an unexplained privacy failure. The opposite reading treats acceptance of terms as a permission without an operational end. The documentary record supports neither shortcut.

The event system is direct. LACNIC's account-creation notice says the data entered in the form will be placed in attendance-registration databases for the current and future events or courses it organizes. It identifies LACNIC as the responsible party and gives a postal address and the privacy email for access, correction, updating, inclusion or deletion requests. It then says that the website of the event for which the user registers will publish the participant list and images from the event. The form asks the user to accept the terms.

That is meaningful notice. This article does not allege unlawful, secret or non-consensual publication. It does not claim that a participant was surprised, that a request was ignored, or that the list is insecure. The question begins after the notice has done its work: what public evidence shows the exact scope and life of the resulting disclosure?

A live list is a state, not a policy

The public LACNIC 46 page identifies a meeting scheduled for 19–22 October 2026 in Mendoza, Argentina. At 21:13:15 UTC on 9 September, a privacy-minimized capture reported 348 registered participants. That figure is not a final attendance total. Registration is still a changing state, and a separate cached observation can show a different number. The relevant evidence is the schema: the public page labels four columns Name, Organization, Participation and Country.

No attendee row has been retained or repeated for this analysis. The identities are not needed to see the control surface.

Four visible columns answer one question: what the page disclosed at the captured moment. They do not answer which version of the notice each registrant saw, whether those four fields were the scope accepted at that time, when public visibility began, when it will be reconsidered after the meeting, or how a later request changes the public surface. A screenshot would preserve the display but not the permission chain. A database entry could preserve acceptance but would be inappropriate to publish. Governance needs a join between those states without exposing the person at the centre of them.

The difference becomes clearer if the list changes. A corrected organization name is not a renewed consent. A switch from remote to in-person participation is not necessarily a wider disclosure. A fifth public field would be a scope change even if the page design barely moved. Removal from public view is not the same operation as deletion from an attendance database. Each event needs a record that can tell those actions apart.

LACNIC's own policy supplies the clock, but not its date

LACNIC's Privacy Policy, updated on 20 December 2024, expressly applies to event and course registration. It says data is obtained for legal or contractual purposes or with the data subject's consent, maintained for the time required for the purpose, and subject to reasonable efforts to correct or delete incorrect data. Its preservation section says personal data will be retained as long as necessary for the purpose for which it was collected and deleted from LACNIC systems once it is no longer necessary, when preservation is neither mandated nor permitted by law.

Those are substantive commitments. They also show why a generic policy cannot by itself close the LACNIC 46 question. “As long as necessary” is a rule for deciding, not a date a registrant can monitor. The policy notes that certain essential information related to registration services may need to remain. It does not say that a public event list and a protected registration record must share the same lifetime. Indeed, the distinction is the heart of a sensible design: public display can end while a narrowly defined record is retained for a stated purpose.

Uruguay's Law No. 18.331 provides the legal setting without deciding this particular case for us. Its consolidated text defines consent as free, unequivocal, specific and informed. Article 8 establishes purpose limitation and deletion when data is no longer necessary or pertinent, subject to lawful exceptions. Article 9 says prior informed consent, where relied upon, must be documented. Article 13 lists information that should be given at collection, including purpose, recipients, controller, consequences, rights and international transfers.

Article 15 addresses rectification and suppression, while Article 17 says prior consent for communication of data is revocable.

These provisions should not be converted into a verdict by editorial assertion. We do not know the complete internal record for any registrant; we have not reviewed a request; and the application of law can depend on facts not visible on a public page. The law is useful here because it exposes the evidence objects an operator should be able to distinguish: notice, acceptance, purpose, public communication, correction, suppression and continuing retention.

The receipt should be public; the consent record should not

The answer is not to publish proof that named people clicked a box. That would reproduce the privacy problem while pretending to solve it. A public receipt should describe the rules of the list rather than the people on it.

For LACNIC 46, such a receipt could be one short page or a compact panel beside the list. It would identify the event; the date or hash of the applicable account notice; the linked privacy-policy version; the four authorized public fields; the date visibility begins; the meeting end date; a post-event review date; the channel for correction, public removal or withdrawal; and the office responsible for closing requests.

It could distinguish “removed from public view” from “protected attendance record retained for a stated purpose.” It could publish aggregate counts of requests received, authenticated, corrected, removed, refused with reasons, and closed, without naming a requester.

This is a modest evidence design, not a demand for a public consent database. The acceptance timestamp, notice version, locale, later amendments and request authentication belong in a protected internal receipt. If a participant changes participation mode, the system can record the change without exposing its history. If public display ends, the operator can record which fields were removed and why any residual record remains. An auditor can test the process using aggregates and samples under authority; a reader does not need access to personal evidence.

The same design avoids an impossible promise. Removing a row from the source page cannot prove that a search cache, screenshot or independent copy also disappeared. No evidence reviewed for this article shows that anyone copied the LACNIC 46 list. But a rights process should state what LACNIC controls: the source page, its own systems and the actions it can verify. “Removed from public view at the source” is precise. “Erased from the Internet” would not be.

The case for keeping the list

The strongest counterargument is practical. LACNIC's notice is more candid than many event forms. It says the participant list will be published. The fields are predictable and useful. Before a regional meeting, names and organizations help operators find colleagues, arrange conversations and decide whether travel or remote attendance will be worthwhile. Participation mode helps coordinate access. Country can indicate the regional range of the room. A visible list can also make extravagant claims about community reach easier to test.

It would be perverse to treat this coordination value as evidence that the list should vanish. It would be equally perverse to turn a four-column event page into a legal instrument so elaborate that participants cannot read it. A retention receipt earns its place only if it stays small.

The proportionate version is a sentence and a clock: these are the public fields; this notice governs them; public display begins on this date; it will be reviewed on this date after the event; use this channel to request a correction or removal; a protected attendance record may remain for this stated purpose. That is enough to make the transition observable without sacrificing the meeting's networking function.

What changes when the clock is visible

First, consent becomes versioned evidence rather than a timeless abstraction. If the field schema changes, LACNIC can decide whether the existing notice still covers it and document that decision before publication.

Second, event operations gain an explicit closing task. The organizer must choose whether the list remains public, is reduced, is archived under a distinct purpose, or is removed. Inaction no longer masquerades as a retention decision.

Third, requests acquire an outcome vocabulary. A message sent to a privacy address is not the same as an authenticated request; an authenticated request is not the same as a corrected public row; a public removal is not the same as deletion of every protected record. Reporting those states in aggregate makes the process measurable without making the person visible again.

Finally, the boundary of certainty improves. The captured total of 348 can be stated as an observation at one time, not recycled later as a fact about attendance. The four columns can be treated as the current public schema, not assumed to be the only schema ever used. The event end date can trigger a review, not automatically dictate deletion. The record becomes honest about what is known and what remains a decision.

LACNIC has already done the hard first part: it tells users that the participant list will be public. The next step is not another privacy slogan. It is an operational receipt that lets a registrant see where that permission starts, where it is reviewed, and what happens when the public purpose ends.

Sources