Home / Blogs

European Privacy Authorities Object to ICANN Whois Proposals

Brenden Kuerbis

In response to a letter from ICANN's Noncommercial Users Constituency (NCUC) to data protection authorities concerning overreaching requests of law enforcement agencies in ICANN's ongoing Registrar Accreditation Agreement negotiations, the Article 29 Data Protection Working Party has written the ICANN Board. Their comments focused on two new requirements proposed by LEAs for domain name registrars, namely that they re-verify registrant contact details and that they retain registrant data for a period of two years after a contract for a domain has ended.

Regarding re-verification the Working Party noted that the problem of inaccurate WHOIS data can only be solved by addressing the unlimited public accessibility of private contact details in the WHOIS database. It also disagreed with the notion that the re-verification request originated from LEAs when the purpose of the WHOIS database is to facilitate contact about technical issues:

The fact that WHOIS data can be used for other beneficial purposes does not in itself legitimise the collection and processing of personal data for those other purposes.

The Working Party finds the proposed new requirement ... excessive and therefore unlawful.

Concerning data retention, the Working Party found the proposed specification to have very broad scope, suggesting it may well facilitate the collection of information like credit card data, Skype handles, and communication log files and registration data. They noted that the requirement did not stem from any legal requirement in Europe, but "is explicitly introduced by ICANN to accommodate wishes from law enforcement." As such,

The Working Party strongly objects to the introduction of data retention by means of contract issued by a private corporation in order to facilitate (public) law enforcement..."

You can read the Working Party's entire letter here.

By Brenden Kuerbis, Fellow in Internet Security Governance, Citizen Lab, Univ of Toronto. Kuerbis is also a contributor to the Internet Governance Project blog.

Related topics: Domain Names, ICANN, Internet Governance, Policy & Regulation, Privacy, Whois

WEEKLY WRAP — Get CircleID's Weekly Summary Report by Email:

Comments

Cannot be mandatory Alessandro Vesely  –  Oct 02, 2012 11:26 PM PDT

Obtuse as it may seem, WP29's response has the merit to point out that one-size-fits-all solutions are inadequate. We don't need verified data for all domain name holders, but just for those domains that do email, e-commerce, and similar activities that may affect netizens at large. We don't need unlimited access to personal data, just to the abuse-contact. (Actually, we may just be happy to know whether accurate contact data might be obtained for a given domain.)

Sadly, I note that it's not by chance that WP29 replied by paper. It is because of how they consider the Internet.

To post comments, please login or create an account.

Related Blogs

Related News

Topics

Industry Updates – Sponsored Posts

Adrian Kinderis Appointed as Chair of Domain Name Association

Internet Reaches 271 Million Domain Names in the Fourth Quarter of 2013

Internet Business Council for Africa Participates at the EU-Africa 2014 Business Forum, Brussels

The Future of Chinese Domain Names (a Panel Discussion)

dotStrategy Selects Neustar's Registry Threat Mitigation Services for .BUZZ Registry

Tony Kirsch Announced As Head of Global Consulting of ARI Registry Services

Afilias Chairman Appointed to Domain Name Association Board

.BUILD Enters Landrush with Support of ARI Registry Services

Radix Awards Contracts for .website, .host, .space, and .press to CentralNic plc

DotConnectAfrica Statement Regarding NTIA's Intent to Transition Key Internet Domain Name Function

Afilias Welcomes "Dot Chinese Online" and "Dot Chinese Website" Top-Level Domains to the Internet

Afilias Joins Internet Technical Leaders in Welcoming IANA Globalization Progress

Afilias Welcomes .ONL and .RICH to the Internet

Neustar Selected to Continue Administering the .US Domain

The Practicalities of a New Domain Launch

Neustar Launches First Site Under '.Neustar' - Its Own Branded TLD

Dot Desi Reseller, LLC Selects LogicBoxes' Vertical Integration Solutions for the .desi gTLD

Afilias Announces Its First Internationalized TLD With the Launch of .MOBILE in Chinese

Afilias Announces Sunrise Launch Dates for 3 New TLDs: .PINK, .RED and .BLUE

Afilias Announces Sunrise Period Start of .KIM, the First Family of the Web

Sponsored Topics