The early designers of the Internet quickly realized that as the number of domain names flourished, there was a need for tracking domain name owners to resolve questions and conflicts that might arise. To that end, they created WHOIS, a public database with the names, phone numbers, email addresses, and mailing addresses of registered domain owners and operators.

This database has become a fundamental tool of transparency on the Internet, helping catch cybercriminals, stop malware and spam, and protect copyright and trademark owners. For example, Facebook has used the WHOIS database to identify a network of fake news sites spreading disinformation, and Microsoft has used the it to identify fraudulent domains used for phishing attacks. Unfortunately, Europe’s poorly crafted privacy law, the General Data Protection Regulation (GDPR), is undermining both the WHOIS database and the global multi-stakeholder governance structure that has been key to the Internet’s flourishing. If the EU will not back down, and ICANN—the nonprofit organization that runs key technical functions of the Internet, including WHOIS—finds itself unable or unwilling to act, then the United States should step in to protect these global interests.

The GDPR went into effect in May 2018, requiring organizations to minimize the personal data they collect and granting individuals more control over how organizations use their data. Since the EU can seek penalties against any organization that violates the GDPR, including those outside the EU, this means that domain registrars who collect and publish WHOIS information from website owners also must be GDPR compliant, even if they are located in the United States.

Here is where things get sticky.

ICANN sets its policies through a transparent multi-stakeholder process involving the private sector, civil society, and governments. The goal of this process is to ensure fair and equitable outcomes and to foster global collaboration and consensus building—in short, the purpose is to encourage stakeholders to work together and avoid having a few countries tell the rest of the world what to do.

Some of these policies are about the WHOIS database. ICANN has contracts with domain registries and registrars requiring them to collect and publish domain ownership information in WHOIS. However, since GDPR gives users the right to delete their personal data, and GDPR violators face fines of up to €20 million or 4 percent of their annual turnover, some domain registrars have started violating their contracts with ICANN by no longer collecting the required WHOIS information. And while the U.S. government has pushed ICANN to make sure registrars collect and release WHOIS information, ICANN has failed to act.

In an attempt to update its rules before GDPR went into effect in May 2018, ICANN approved a temporary policy that made a lot of personal information on WHOIS unavailable to the public. Under this policy, only certain third parties who have a “legitimate interest” can receive permission from ICANN to access non-redacted WHOIS data. These restrictions have already had a negative impact on those working to fight fraud and abuse online. For example, the electronics company Panasonic was unable to identify the owner of a domain that was using its logo to steal its customers’ credentials. Furthermore, an October 2018 survey of 300 cybersecurity professionals found that this new policy is “significantly impeding cyber applications and forensic investigations and allowing more harm to victims,” and 91 percent of respondents believed the redaction of WHOIS data was excessive.

This is not to say that ICANN should not modernize the WHOIS database. The WHOIS protocol has no standard data formats, no international support (i.e., using different character sets), and no security controls. But ICANN should make updates in a way that preserves the openness and transparency of the existing databases, balances the needs of different stakeholders, and does not simply bow down to the EU’s overly restrictive privacy rules. To ensure that happens, the United States should step in to prevent the EU from steamrolling ICANN.

The best way to do this, absent ICANN expeditiously changing its policy—call it the nuclear option—would be for Congress to pass a law requiring all U.S. registrars to gather and report WHOIS data. Because most major domain registrars are located in the United States, congressional action would ensure the majority of the WHOIS database remains intact.

The goal would not be to dictate the rules for other countries, as the EU is attempting to do, but rather reassert that no government has the right to set the rules for others by setting up a clear contradiction with the EU’s privacy law. Such a U.S. law would result in many domain registrars making the WHOIS data publicly available rather than capitulating to the threat of European fines. Once ICANN sees that companies are operating under two WHOIS policies—an unsustainable situation—it will force them to revisit the policy. The U.S. government should then work with key allies, such as Japan, to pressure the EU to limit the scope of the GDPR so it does not continue to undermine the multi-stakeholder framework that is the foundation of Internet governance.