Late last week, ICANN published the guidance from the Article 29 Working Party (WP29) that we have been waiting for. Predictably, WP29 took a privacy maximalist approach to the question of how Europe’s General Data Protection Regulation (GDPR) applies to WHOIS, a tool widely used by cybersecurity professionals, businesses, intellectual property owners, consumer protection agencies and others to facilitate a safer and more secure internet. Unfortunately, comments submitted to WP29, and to Data Protection Authorities (DPAs) directly, detailing legitimate purposes for access to data that serve the public interest, and detailed proposals for accreditation and access to non-public data were largely ignored. The WP29 guidance seems to imply that a fragmented WHOIS system, with no reasonable way to access critical information to facilitate legitimate goals such as preventing fraud and the distribution of malware, is simply an inevitable consequence of implementing the GDPR.

Criticism from the United States Government, the cyber- and operational security community, and business community was swift. On Monday, United States Special Assistant to the President and Cybersecurity Coordinator, National Security Council Rob Joyce tweeted: “EU’s GDPR is going to undercut a key tool for identifying malicious domains on the internet. WHOIS database will be noncompliant, or have to purge the data that makes it useful to find bad actors… Cyber Criminals are celebrating GDPR”. Joyce’s criticism of WP29’s analysis echoes security professional Brian Krebs’ prediction from April 4, 2018, stating that “the volume of spam, phishing and just about every form of cybercrime is going to increase noticeably. New privacy rules coming out the EU are going to take away the single most useful tool available to security experts: WHOIS.” United States Secretary of Commerce, Wilbur Ross also weighed in, imploring the European Commission to take action.

Now that we know the thoughts of WP29, which, after May 25, 2018 (the date that the GDPR goes into effect) will become the European Data Protection Board (EDPB), it is time to fight back, and demand a balance of the right to protect personal information with other fundamental rights. ICANN is currently collecting comments from the community, in preparation for meetings with WP29 in Brussels on April 23, 2018.

Background

ICANN had asked WP29, the data protection and privacy advisory group made up of representatives from the DPA of each EU Member State, the European Data Protection Supervisor, and the European Commission, to give guidance on the “Interim Model for Compliance with ICANN Agreements and Policies in Relation to the European Union’s General Data Protection Regulation,” (the “Model”) which was developed and published by ICANN earlier in the year. ICANN had presented the Model, and its detailed rationale, to WP29 along with an acknowledgment of areas of community divergence, with a special plea to WP29 to guide ICANN on these issues. Among the areas of divergence were prime points of concern raised by the Intellectual Property Constituency (IPC) and Business Constituency (BC) of ICANN, such as the need for continued publication of registrant email address, the global territorial application of the model even where no nexus to Europe exists, and other aspects of the Model which the IPC and BC have identified as being over-compliant with the GDPR. ICANN CEO Göran Marby acknowledged to the DPAs that many in the community provided extensive analysis and legal support to justify continued access to WHOIS for purposes of cybersecurity, consumer protection, and law enforcement and to prevent intellectual property theft, fraud and other malicious activity online.

The Advice

In its guidance to ICANN, WP29 deemed the purposes for WHOIS, as enumerated in the Model, to be insufficiently defined. In its letter, the group cited a previous opinion on purpose limitation, stating “WP29 has clarified that purposes specified by the controller must be detailed enough to determine what kind of processing is and is not included within the specified purpose, and to allow that compliance with the law can be assessed and data protection safeguards applied.” The community has acknowledged the need for data protection safeguards (via a Code of Conduct for access to non-public WHOIS, which ICANN has asked its Governmental Advisory Committee (GAC) to develop), but it is surprising to see WP29 call for data safeguards to be developed per every individual purpose - a burdensome exercise for legitimate requestors that would destroy much of the operational functionality of WHOIS.

WP29 also cautioned ICANN to ensure that legitimate purposes contained within its model for compliance relate to ICANN’s own mission, defined in its letter as “to coordinate the stable operation of the Internet’s unique identifier system.” They cautioned ICANN not to conflate its own purposes with the concerns and purposes of third parties, no matter how legitimate. This is, no doubt, a nod to the equally privacy maximalist statements on this issue from the International Working Group on Data Protection in Telecommunications (IWGDPT a.k.a. the “Berlin Group”), a privacy advocacy group made up of DPA representatives, NGO representatives, and members from civil society and the private sector. Last year, prior to the publication of any model for GDPR compliance, and referring to the then-fully-open WHOIS ecosystem, the Berlin Group had questioned whether the role of ICANN allows the organization to take into account any legitimate purpose related to law enforcement or security. Obviously many in the ICANN community are concerned about that statement, and WP29’s reliance on it, including the GAC’s Public Safety Working Group (PSWG), various security-oriented groups at ICANN, the IPC and the BC. The Berlin Group paper is misapplied to the Model, and is not authoritative. Further, ICANN’s role is much broader than that suggested in the Berlin Group paper and subsequently the WP29’s guidance. The full mission of ICANN can be found here, in the ICANN bylaws.

WP29 also gave advice related to accreditation for access to non-public WHOIS data, and again stressed the importance of clearly defined purposes with a specific legal basis for access to individual WHOIS data elements.

Notable in its absence, WP29 did not grant, or even mention a moratorium on the implementation of GDPR, which is understandably a primary focus of many within the community at this time, as well as ICANN itself. The May 25, 2018 deadline will remain the number one barrier to ensuring continued access to WHOIS data, as the contracted parties have indicated that the promise of hefty fines for not complying with GDPR will result in over-compliance, in the absence of a more nuanced model that can be quickly implemented. Some contracted parties have already indicated that any model which provides accreditation and layered/tiered access would be impossible to implement by May 25.

Also absent from WP29 guidance was any mention of the distinction between natural and legal persons, and the application of the GDPR in the Model to contracted parties and registrants that are not in the EU, both prime concerns of the IPC and BC.

The Fight

ICANN responded to WP29 just hours after their communication was made public last week, via a letter from Mr. Marby. The letter again stressed the need for a moratorium on GDPR enforcement, emphasized the negative consequences of a fragmented WHOIS system, and clarified the critical importance of ICANN’s role in coordinating the global WHOIS system on the overall security and stability of the Internet—an obligation that falls squarely within its mission. Mr. Marby pointed out that fragmented WHOIS would “have a detrimental impact on the entire Internet”, pointing out the concerns of law enforcement, cybersecurity processionals, consumer protection agencies, and IP owners. Mr. Marby further stated in his most recent blog that “ICANN recognizes the important of the GDPR and its goal of protecting personal data, but also notes the importance of balancing the right to privacy with the need for information.”

ICANN recognized that following the WP29 guidance would result in fragmentation and notably indicated that it is “studying all available remedies, in order to seek clarity in our ability to continue to properly coordinate this important global information resource without fragmentation” (emphasis added). This thinly-veiled threat of legal action is surprising, and welcome. Mr. Marby also wrote that ICANN implores WP29 to “spend more time balancing between the important right to privacy and the need for information,” further implying that ICANN is unhappy with the WP29 guidance, and may not intend to follow it blindly. Indeed, Recital 4 of the GDPR clarifies that the right to protection of personal data is not absolute, and must be balanced against other rights and the function of such data in society according to principles of proportionality.

As noted above, United States Secretary of Commerce Wilbur Ross also weighed in, in a recent letter to V?ra Jourová, Commissioner for Justice, Consumers and Gender Equality (European Commission), citing the importance of quick access to WHOIS data necessary for intellectual property rights enforcement, cybersecurity and law enforcement. Secretary Ross called for a temporary forbearance from GDPR enforcement on the processing of WHOIS data in order to address these goals.

ICANN is set to meet with the Technology Subgroup of WP29 to discuss these issues further on April 23, 2018. In the meantime, the community has been invited to comment on the WP29 guidance and to make further suggestions to WP29 about compliance with GDPR and accreditation and access to non-public data (including supporting a Code of Conduct which may address some of the DPA concerns about data safeguards). ICANN has assured the community that any information shared with ICANN will be provided to the DPAs, and has suggested that the community also send comments and analysis directly to the DPAs themselves. This response from ICANN indicates that the fight to preserve access to WHOIS data is far from over.

We suggest that businesses, intellectual property owners, consumer advocates, cybersecurity professionals and law enforcement and government representatives marshal additional comments to ICANN and the DPAs further illustrating and impacting the problems that a fragmented WHOIS system would create, and the negative impact it would have for consumers and other Internet users, the ecommerce ecosystem, and the Internet generally. Comments to ICANN can continue to be submitted to [email protected] and we encourage all community members to weigh in as soon as possible so that feedback can be taken into consideration during the next ICANN meeting with the DPAs on April 23, 2018.

Those affected by this issue should also consider additional steps to ensure continued access to WHOIS, including reaching out to Member States in Europe and other government representatives, considering other actions and remedies through courts and legislatures, and continuing to participate in developing an accreditation and access model for non-public WHOIS. The IPC and BC are holding another community-wide call to discuss the Accreditation and Access Model for Non-Public WHOIS data on April 24, 2018. Interested parties should sign up for that discussion by emailing [email protected].

The Intellectual Property Constituency is currently working on comments to ICANN and WP29, and contemplating other additional next steps.