Latest news of the domain name industry

Recent Posts

Expect more Whois accuracy emails under new ICANN policy

Kevin Murphy, February 25, 2019, 12:15:32 (UTC), Domain Policy

Registrars will be obliged to send out even more Whois accuracy emails, under a set of recommendations being considered in ICANN.

Assuming recent recommendations out of the Whois policy working group are accepted, every registrant of a gTLD domain with something listed in the “Organization” field will receive a one-off mail from their registrar asking them to confirm its accuracy.

It’s Recommendation 12 of the EPDP Team Final Report, which was published last week (pdf) by ICANN’s first Expedited Policy Development Process working group.

In general, the Organization field would be redacted in the public Whois under the proposed policy, but registrants will be proactively asked if they want to opt in to having it published.

While registrars can pick their own methods to conduct this outreach, email seem like the most likely medium in the vast majority of cases.

These mails would be sent out the registrants of the over 192 million gTLD domains (if they have something in their Org field) at some point between May 2019, when ICANN is likely to formally adopt the policy, and February 29, 2020, which is EPDP group’s recommended implementation deadline.

In theory, the Org field is perhaps the main indicator of whether a domain is registered to a natural person (and therefore subject to the General Data Protection Regulation) or a legal person (and therefore not).

But it’s not uncommon for registrants or registrars to simply populate the field with the name of the natural-person registrant, even when there’s no actual organization involved.

That’s a GDPR problem, as it means personally identifiable information could leak into the public Whois.

Under the EPDP’s recommendation, registrars would be obliged to reach out to their customers to confirm whether the contents of their Org field are correct, and to ask whether they want that information to be made public.

Opting in would mean the registrar would begin to publish Org data in the public Whois. Ignoring the email or actively refusing publication would mean your registrar would redact or delete this field.

After this mass outreach has finished, registrars would stop redacting the Org field, unless the registrant has not consented to its publication.

For new registrations, registrars would have to show you a prominent warning that the Org data will be published and get your consent for it to do so.

The recommendation is among 29 that were arrived at following over six months of intensive discussions in the EPDP group.

Others we’ve previously reported on include the total elimination of the Admin Contact, making the Technical Contact both smaller and completely optional, and the mandatory introduction of an anonymous means for Whois users to contact registrants.

The recommendations have been submitted to the GNSO Council, which will vote on them March 4.

The EPDP report will then be opened for 30 days of public comment, before being sent to the ICANN board of directors for a full, final vote.

The policy will replace the current Temporary Specification governing Whois, which the board rushed through on an emergency basis last May in order to make the DNS ecosystem as GDPR-compliant as possible when the EU law came into effect.

The EPDP group is expected to shortly enter “phase two” of its work, which will look at whether there should be a unified access mechanism for security and intellectual property interests to snoop on otherwise private Whois data.

Tagged: , , , ,

Add Your Comment