Latest news of the domain name industry

Recent Posts

PwC wants to be your Whois gatekeeper

Kevin Murphy, June 11, 2019, 15:31:22 (UTC), Domain Services

PricewaterhouseCoopers has built a Whois access system that may help domain name companies and intellectual property interests call a truce in their ongoing battle over access to private Whois data.
Its new TieredAccess Platform will enable registries and registrars to “outsource the entire process of providing access to non-public domain registration data”.
That’s according to IP lawyer Bart Lieben, partner at the Belgian law firm ARTES, who devised the system and is working with PwC to develop it.
The offering is designed to give trademark lawyers access to the data they lust after, while also reducing costs and mitigating domain name industry liability under the General Data Protection Regulation.
TieredAccess would make PwC essentially the gatekeeper for all requests for private Whois data (at least, in the registries plugged into the platform) coming from the likes of trademark owners, security researchers, lawyers and law enforcement agencies.
At one end, these requestors would be pre-vetted by PwC, after which they’d be able to ask for unredacted Whois records using PwC as an intermediary.
They’d have to pick from one of 43 pre-written request scenarios (such as cybersquatting investigation, criminal probe or spam prevention) and assert that they will only use the data they obtain for the stated purposes.
At the other end, registries and registrars will have adopted a set of rules that specify how such requests should be responded to.
A ruleset could say that cops get more access to data than security researchers, for example, or that a criminal investigation is more important than a UDRP complaint.
PwC has created a bunch of templates, but registrars and registries would be able to adapt these policies to their own tastes.
Once the rules are put in place, and the up-front implementation work has been done to plug PwC into their Whois servers, they wouldn’t have to worry about dealing with Whois requests manually as most are today. The whole lot would be automated.
Not even PwC would have human eyes on the requests. The private data would only be stored temporarily.
One could argue that there’s the potential for abusive or non-compliant requests making it through, which may give liability-nervous companies pause.
But the requests and response metadata would be logged for audit and compliance, so abusive users could be fingered after the act.
Lieben says the whole system has been checked for GDPR compliance, assuming its prefabricated baseline scenarios and templates are adopted unadulterated.
He said that the PwC brand should give clients on both sides “peace of mind” that they’re not breaking privacy law.
If a registrar requires an affidavit before releasing data, the assertions requestors make to PwC should tick that box, he said.
Given that this is probably a harder sell to the domain name industry side of the equation, it’s perhaps not surprising that it’s the requestors that are likely to shoulder most of the cost burden of using the service.
Lieben said a pricing model has not yet been set, but that it could see fees paid by registrars subsidized by the fees paid by requestors.
There’s a chance registries could wind up paying nothing, he said.
The project has been in the works since September and is currently in the testing phase, with PwC trying to entice registries and registrars onto the platform.
Lieben said some companies have already agreed to test the service, but he could not name them yet.
The service was developed against the backdrop of ongoing community discussions within ICANN in the Expedited Policy Development Working group, which is trying to create a GDPR-compliant policy for access to private Whois records.
ICANN Org has also made it known that it is considering making itself the clearinghouse for Whois queries, to allow its contracted parties to offload some liability.
It’s quite possible that once the policies are in place, ICANN may well decide to outsource the gatekeeper function to the likes of PwC.
That appears to be what Lieben has in mind. After all, it’s what he did with the Trademark Clearinghouse almost a decade ago — building it independently with Deloitte while the new gTLD rules were still being written and then selling the service to ICANN when the time came.
The TieredAccess service is described in some detail here.

Tagged: , , , , , , , , , ,

Comments (5)

  1. Volker Greimann says:
    June 11, 2019 at 3:59 pm

    “Not even PwC would have human eyes on the requests. The private data would only be stored temporarily.”
    Automated balancing tests and sanity checks? Yeah, sure, that’s going to fly (right out the door)

    Reply
  2. Volker Greimann says:
    June 11, 2019 at 4:03 pm

    And I wonder why we should pay for something that was essentially running mostly for free (excluding staff costs for reviewing the half-a-dozen requests each month).

    Reply
  3. Michele Neylon says:
    June 11, 2019 at 4:24 pm

    Is PwC going to provide registrars AND registries with full indemnity?

    Reply
  4. Mira P. says:
    June 12, 2019 at 8:10 am

    I expect that the no human eyes part wont be accepted in court if you provide data to parties who aren’t pre-screened. But it could work with verified parties. Some European registries already work with similar processes. So I am quite positive about the idea.
    And verified parties need to have (symbolic) limits to the amount of data they can automatically request which realistically fit or can be adjusted to their needs.
    But you should be careful about granting trademark owners too much access to domains unrelated to their brands, as everyone can be a trademark owner. You can already expect shady parties to set up shell companies. Luckily this tiered access system allows for such a nuance it seems, where governments and certification authorities get treated differently from trademark owners.

    Reply
  5. Michele Neylon says:
    June 12, 2019 at 2:11 pm

    Mira
    I’m not aware of any European domain name registry that would grant blanket access to anyone with the possible exception of law enforcement.
    I don’t think this system was built by anyone with knowledge of privacy, but more by people with an interest in pandering to IP interests.
    Michele

    Reply

Add Your Comment