How Whois could survive new EU privacy law

Reports of the death of Whois may have been greatly exaggerated.
Lawyers for ICANN reckon the current public system “could continue to exist in some form” after new European Union privacy laws kick in next May, according to advice published (hurriedly, judging by the typos towards the end) shortly before Christmas.
Hamilton, the Swedish law firm hired by ICANN to probe the impact of the General Data Protection Regulation, seems to be mellowing on its recommendation that Whois access be permanently “layered” according to who wants to access registration records.
Now, it’s saying that layered Whois access could merely be a “temporary solution” to protect the industry from fines and litigation until ICANN negotiates a permanent peace treaty with EU privacy regulators that would have less impact on current Whois users.
This opinion came in the third of three memorandums from Hamilton, published by ICANN last week. You can read it here (pdf).
With the first two memos strongly hinting that layered access would be the most appropriate way forward, the third points out the huge, possibly insurmountable burden this would place on registrars, registries, law enforcement agencies, the courts, IP lawyers, and others.
It instead suggests that layered access be temporary, with ICANN taking the lead in arranging a longer-term understanding with the EU.
The latest Hamilton memo seems to have taken on board comments from registries and registrars, intellectual property lawyers and domain investors, none of which are particularly enthusiastic about GDPR and the lack of clarity surrounding its impacts.
GDPR is an EU-wide law that gives much stronger protection to the personal data of private citizens.
Companies that process such data are kept on a much tighter leash and could face millions of euros of fines if they use the data for purposes their customers have not consented to or without a good enough reason.
It’s not a specifically intended to regulate Whois — indeed, its conflict with longstanding practice and ICANN rules seems to have been an afterthought — but Whois is the place the domain industry is most likely to find itself breaking the law.
It seems to be generally agreed that the current system of open, public access to all fields in all Whois records in all gTLDs would not be compliant with GDPR without some significant changes.
It also seems to be generally agreed that the data can be hugely useful for purposes such as police investigations, trademark enforcement and the domain secondary market.
The idea that layered access — where different sets of folks get access to different sets of data based on their legitimate needs — might be a solution has therefore gained some support.
Hamilton notes:

Given the limited time remaining until the GDPR enters into effect, we believe that the best chance of continuing to provide the Whois services and still be compliant with the GDPR will be to implement an interim solution based on an layered access model that would ensure continued processing of Whois data for some limited purposes.

The problem with this solution, as Hamilton now notes, is that it could be hugely impractical.

such a model would require the registrars to perform an assessment of interests in accordance with Article 6.1(f) GDPR on an individual case-by-case basis each time a request for access is made. This would put a significant organizational and administrative pressure on the registrars and also require them to obtain and maintain the competence required to make such assessments in order to deliver the requested data in a reasonably timely manner. In our opinion, public access to (limited) Whois data would therefore be of preference and necessary to fulfill the above purposes in a practical and efficient way.

And, Hamilton says, a scenario in which all cops had access to all Whois data would not necessarily be GDPR-compliant. Police may have to right to access the data, but they’d have to request it on a case-by-case basis.
Registrars — or even the courts — would have to make the decision as to whether each request was legit.
It would get even more complex for registrars when the Whois requester was an IP lawyer, as they’d have to check whether it was appropriate to disclose the personal data to both the lawyer and her client, the memo says.
For registrars, the largely nominal cost of providing a Whois service today would suddenly rocket as each Whois lookup would require human intervention.
Having introduced the concept of layered access and then shot it to pieces, Hamilton finally recommends that ICANN start talks with data protection authorities in the EU in order to find a solution where Whois services can continue to be provided in a form available to the general public in the future”.
ICANN should start an “informal dialogue” with the Article 29 Working Party, the EU privacy watchdog made up of data protection authorities from each member state, and initiate formal consultations with one or more of these DPAs individually, the memo recommends.
The WP29 could prove a tough chat, given that the group has a long history of calling for layered access, and its views, even if changed, would not be binding anyway.
So Hamilton says ICANN, in conjunction with its registries and registrars, should carry out a formal data protection impact assessment (DPIA) and submit it to a relevant DPA in a EU country where it has a corporate presence, such as Belgium.
That way, at least ICANN has a chance of retaining Whois in a vaguely recognizable form while protecting the industry from crippling extra costs.
In short, the industry is still going to have to make some changes to Whois in the first half of 2018, some of which may make Whois access troublesome for many current users, but those changes may not last forever.
ICANN CEO Goran Marby said in a blog post:

We’ve made it a high priority to find a path forward to ensure compliance with the GDPR while maintaining WHOIS to the greatest extent possible. Now, it is time to identify potential models that address both GDPR and ICANN compliance obligations.
We’ll need to move quickly, while taking measured steps to develop proposed compliance models. Based on the analysis from Hamilton, it appears likely that we will need to incorporate the advice about using a layered access model as a way forward.

He wants the industry to submit compliance models by January 10 for publication January 15, with ICANN hoping to “settle on a compliance model by the end of January”.

ICANN: tell us how you will break Whois rules

ICANN has invited registrars and registries to formally describe how they plan to break the current rules governing Whois in order to come into compliance with European Union law.
The organization today published a set of guidelines for companies to submit proposals for closing off parts of Whois to most internet users.
It’s the latest stage of the increasingly panicky path towards reconciling ICANN’s contracts with the General Data Protection Regulation, the EU law that comes into full effect in a little over five months.
GDPR is designed to protect the privacy of EU citizens. It’s generally thought to essentially ban the full, blanket, open publication of individual registrants’ contact information, but there’s still some confusion about what exactly registries and registrars can do to become compliant.
Fines maxing out at of millions of euros could be levied against companies that break the GDPR.
ICANN said last month that it would not pursue contracted parties that have to breach their agreements in order to avoid breaking the law.
The catch was that they would have to submit their proposals for revised Whois services to ICANN for approval first. Today is the first time since then that ICANN has officially requested such proposals.
The request appears fairly comprehensive.
Registries and registrars will have to describe how their Whois would differ from the norm, how it would affect interoperability, how protected data could be accessed by parties with “legitimate interests”, and so on.
Proposals would be given to ICANN’s legal adviser on GDPR, the Swedish law firm Hamilton, and published on ICANN’s web site.
ICANN notes that submitting a proposal does not guarantee that it will be accepted.

Open Whois must die, Europe privacy chiefs tell ICANN

Unfettered public access to full Whois records is illegal and has to got to go, an influential European Union advisory body has told ICANN.
The Article 29 Working Party on Data Protection, WP29, wrote to ICANN yesterday to say that “that the original purposes of the WHOIS directories can be achieved via layered access” and that the current system “does not appear to meet the criteria” of EU law.
WP29 is made up of representatives of the data protection agencies in each EU member state. It’s named after Article 29 of the EU’s 1995 Data Protection Directive.
This directive is parent legislation of the incoming General Data Protection Regulation, which from May 2018 will see companies fined potentially millions of euros if they fail to protect the privacy of EU citizens’ data.
But WP29 said that there are questions about the legality of full public Whois under even the 1995 directive, claiming to have been warning ICANN about this since 2003:

WP29 wishes to stress that the unlimited publication of personal data of individual domain name holders raises serious concerns regarding the lawfulness of such practice under the current European Data Protection directive (95/46/EC), especially regarding the necessity to have a legitimate purpose and a legal ground for such processing.

Under the directive and GDPR, companies are not allowed to make consent to the publication of private data a precondition of a service, which is currently the case with domain registration, according to WP29.
Registrars cannot even claim the publication is contractually mandated, because registrants are not party to the Registrar Accreditation Agreement, the letter (pdf) says.
WP29 adds that law enforcement should still be able to get access to Whois data, but that a “layered” access control approach should be used to prevent full disclosure to anyone with a web browser.
ICANN recently put a freeze on its contract compliance activities surrounding Whois, asking registries and registrars to supply the organization with the framework and legal advice they’re using to become compliant with GDPR.
Registries and registrars are naturally impatient — after a GDPR-compatible workaround is agreed upon, they’ll still need to invest time and resources into actually implementing it.
But ICANN recently told contracted parties that it hopes to lay out a path forward before school breaks up for Christmas December 22.

ICANN chief tells industry to lawyer up as privacy law looms

The domain name industry should not rely on ICANN to protect it from incoming EU privacy law.
That’s the strong message that came out of ICANN 60 in Abu Dhabi last week, with the organization’s CEO repeatedly advising companies to seek their own legal advice on compliance with the General Data Protection Regulation.
The organization also said that it will “defer taking action” against any registrar or registry that does not live up its contractual Whois commitments, within certain limits.
“GDPR is a law. I didn’t come up with it, it didn’t come from ICANN policy, it’s the law,” Marby said during ICANN 60 in Abu Dhabi last week.
“This is the first time we’ve seen any legislation that has a direct impact on our ability to make policies,” he said.
GDPR is the EU law governing how companies treat the private information of individuals. While in force now, from May next year companies in any industry found in breach of GDPR could face millions of euros in fines.
For the domain industry, it is expected to force potentially big changes on the current Whois system. The days of all Whois contact information published freely for all to see may well be numbered.
But nobody — not even ICANN — yet knows precisely how registries and registrars are going to be able to comply with the law whilst still publishing Whois data as required by their ICANN contracts.
The latest official line from ICANN is:

At this point, we know that the GDPR will have an impact on open, publicly available WHOIS. We have no indication that abandoning existing WHOIS requirements is necessary to comply with the GDPR, but we don’t know the extent to which personal domain registration data of residents of the European Union should continue to be publicly available.

Marby told ICANNers last week that it might not be definitively known how the law applies until some EU case law has been established in the highest European courts, which could take years.
A GNSO working group and ICANN org have both commissioned legal studies by European law experts. The ICANN one, by Swedish law firm Hamilton, is rather more comprehensive and can be read here (pdf).
Even after this report, Marby said ICANN is still in “discovery” mode.
Marby encouraged the industry to not only submit their questions to ICANN, to be referred on to Hamilton for follow-up studies, but also to share whatever legal advice they have been given and are able to share.
He and others pointed out that Whois is not the only point of friction with GDPR — it’s a privacy law, not a Whois law — so registries and registrars should be studying all of their personal data collection processes for potential conflicts.
Because there is very likely going to be a clash between GDPR compliance and ICANN contract compliance, ICANN has suspended all enforcement actions against Whois violations, within certain parameters.
It said last week that: “ICANN Contractual Compliance will defer taking action against any registry or registrar for noncompliance with contractual obligations related to the handling of registration data.”
This is not ICANN saying that registries and registrars can abandon Whois altogether, the statement stresses, but they might be able to adjust their data-handling models.
Domain firms will have to show “a reasonable accommodation of existing contractual obligations and the GDPR” and will have to submit their models to ICANN for review by Hamilton.
ICANN also stressed that registries may have to undergo a Registry Services Evaluation Process review before they can deploy their new model.
The organization has already told two Dutch new gTLD registries that they must submit to an RSEP, after .amsterdam and .frl abruptly stopped publishing Whois data for private registrants recently.
General counsel John Jeffrey wrote to the registries’ lawyer (pdf) to state that an RSEP is required regardless of whether the “new registry service” was introduced to comply with local law.
“One of the underlying purposes of this policy is to ensure that a new registry service does not create and security, stability or competition concerns,” he wrote.
Jeffrey said that while Whois privacy was offered at the registry level, registrars were still publishing full contact details for the same registrants.
ICANN said last week that it will publish more detailed guidance advising registries and registrars how to avoid breach notices will be published “shortly”.

.wine no longer blocked after EU drops complaint

Donuts and ICANN are currently in the process of signing new gTLD agreements for .wine and .vin, after the European Union and wine sellers dropped objections.
As of today, both gTLDs are “In Contracting” rather than “On Hold”, according to ICANN’s web site.
ICANN revealed earlier this week that the European Union and various wine trade associations have both dropped their Cooperative Engagement Process complaints.
CEP is less formal precursor to a much more expensive and lawyer-hungry Independent Review Process complaint.
With the CEPs out of the way, Donuts is now free to sign its contracts.
Donuts won the auction for .wine back in November, but its application was frozen due to ongoing arguments about the protection of “geographic indicators” representing wine-making regions.
Governments, particularly in Europe and Latin America, had protested that .wine and .vin should not be allowed to launch until areas such as Rioja and Champagne were given special privileges.
Last October, ICANN CEO Fadi Chehade told the French government that it was negotiating with applicants to get these protections included in the contracts.
Either Donuts has agreed to such protections, or the EU and wine-makers have gotten bored of complaining.
My feeling is the former is probably more likely, which may be controversial in itself.
There is no international agreement on GI protection — the US and Australia opposed the EU’s position on .wine — so this may be seen as a case of ICANN creating new rights where none previously existed.

EU IDN not banned after all

The European Union request for the Greek-script ccTLD .ευ has not been thrown out, according to ICANN.
Last week DI reported that .ευ was the only one of three IDN ccTLD requests — the other two being Bulgaria’s .бг and Greece’s .ελ — to fail a test for confusing similarity on appeal.
.ευ was found to be confusingly similar to .EY and .EU, but only when in upper case.
The similarity panel’s decision would mean, I reported, that .бг and .ελ would be delegated but .ευ would not, under ICANN rules.
I wondered aloud what the Governmental Advisory Committee would think about that, given that it had lobbied for the creation of the appeals process in order to get an earlier rejection of .ευ overturned.
Shortly after publishing the article, ICANN reached out to say I was wrong and ask for a correction.
“We (ICANN) have not rejected the .ευ application,” a spokesperson said.
“Due to the unprecedented nature of the split results, the issue needs to be discussed at the senior management and Board level before a final decision is made,” he said.
The “split results” refers to the fact that there was found to be no confusing similarity with .ευ in lower case.
However, the ICANN rule I referred to says (which my emphasis):

The rule is that if the appearance of the selected string, in upper or lower case, in common fonts in small sizes at typical screen resolutions, is sufficiently close to one or more other strings, it is probable that a reasonable Internet user who is unfamiliar with the script perceives the strings to be the same or confuses one for the other.

That’s adapted almost verbatim from the original recommendations of the ccNSO. The only addition ICANN made was to add the clearly important clause “in upper or lower case” to the text.
It seemed pretty straightforward to me — confusing similarity exists regardless of case.
I pointed this out to ICANN last Wednesday and asked where I could find the rule that said the ICANN board or staff get to review a “split results” finding but have yet to receive a reply.

.wine is a go

ICANN has approved the new gTLDs .wine and .vin, despite objections from the European Union.
In a resolution this weekend, published today, its board’s New gTLD Program Committee said “that the applications for .WINE and .VIN should proceed through the normal evaluation process.”
The resolution acknowledges the Governmental Advisory Committee’s lack of consensus against the two wine-related gTLDs, but not the EU’s view that geographic indicators such as “Champagne” should be protected.
European nations thought both gTLDs should be put on hold until the applicants agreed to these special protections, but the US, Australia and other nations disagreed.
ICANN sought the legal opinion (pdf) of a French law professor in its decision-making.
The EU is going to be pretty angry about this, but in the absence of a consensus objection from the GAC against the strings, it appears that the NGPC has made the right call in this case.

.eu names to be sold outside the EU

EURid is to expand sales of .eu domains to three countries outside the European Union from January 8.
Companies and individuals from Iceland, Lichtenstein and Norway will get to register .eu names, due to a rule change at the registry.
The three countries are members of the European Economic Area, which enjoys many of the trade benefits of the Union but without full EU membership.
EURid said that the 2002 European Parliament regulation that created .eu always envisaged the eventual expansion of the ccTLD to the EEA.
The change expands the registry’s addressable market by fewer than 5.4 million people, five million of whom are Norwegian.

.eu registry contract up for grabs

The European Commission has opened up the .eu registry contract to competitive bidding.
The sort-of ccTLD has been managed by EurID since it launched 2004 but its contract, which has already been extended to its maximum term, is due to expire in October next year.
Would-be usurpers must be not-for-profit organizations based in the European Union, according to a Commission RFP, which should narrow the field quite a lot.
The .eu space has 3.7 million registered domain names, growing at 5.4% a year. Considering that the TLD is open to all in the EU, the numbers fare poorly compared to many European ccTLDs.
The deadline for submissions is June 20.

Seized .eu, .be counterfeiting domains now pointing to US government servers

At least three of the European domain names seized in this year’s batch of Cyber Monday anti-counterfeiting law enforcement are now pointing to servers controlled by the US government.
We’ve found that chaussuresfoot.be, chaussurevogue.eu and eshopreplica.eu are now hosted on the same IP addresses as SeizedServers.com, the US Immigration and Customs Enforcement site.
But the three domains, believed to be among the 132 grabbed ahead of this year’s online shopping rush, display warnings incorporating the logos of multiple European law enforcement agencies.
While domains in .dk, .fr, .ro and .uk were also targeted by this year’s transatlantic crackdown, none appear to be using SeizedServers.com.
According to an ICE press release yesterday, this was the first year that Operation In Our Sites, which kicked off at this time in 2010, has included overseas law enforcement.
The partnership, coordinated between ICE and Europol, was code-named Project Transatlantic.