Latest news of the domain name industry

Recent Posts

ICANN says Article 29 letter does not give EU registrars privacy opt-out

Kevin Murphy, July 15, 2013, Domain Policy

Registrars based in the European Union won’t immediately be able to opt out of “illegal” data retention provisions in the new 2013 Registrar Accreditation Agreement, according to ICANN.

ICANN VP Cyrus Namazi on Saturday told the Governmental Advisory Committee that a recent letter from the Article 29 Working Party, which comprises the data protection authorities of EU member states, is “not a legal authority”.

Article 29 told ICANN last month that the RAA’s provisions requiring registrars to hold registrant data for two years after the domain expires were “illegal”.

While the RAA allows registrars to opt out of clauses that would be illegal for them to comply with, they can only do so with the confirmation of an adequate legal opinion.

The Article 29 letter was designed to give EU registrars that legal opinion across the board.

But according to Namazi, the letter does not meet the test. In response to a question from the Netherlands, he told the GAC:

We accept it from being an authority, but it’s not a legal authority, is our interpretation of it. That it actually has not been adopted into legislation by the EU. When and if it becomes adopted then of course there are certain steps to ensure that our contracted parties are in line with — in compliance with it. But we look at them as an authority but not a legal authority at this stage.

It seems that when the privacy watchdogs of the entire European Union tell ICANN that it is in violation of EU privacy law, that’s not taken as an indication that it is in fact in violation of EU privacy law.

The European Commission representative on the GAC expressed concern about this development during Saturday’s session, which took place at ICANN 47 in Durban, South Africa.

2013 RAA is illegal, says EU privacy watchdog

European privacy regulators have slammed the new 2013 Registrar Accreditation Agreement, saying it would be illegal for registrars based in the EU to comply with it.

The Article 29 Working Party, which comprises privacy regulators from the 27 European Union nations, had harsh words for the part of the contract that requires registrars to store data about registrants for two years after their domains expire.

In a letter (pdf) to ICANN last month, Article 29 states plainly that such provisions would be illegal in the EU:

The fact that these personal data can be useful for law enforcement does not legitimise the retention of these personal data after termination of the contract. Because there is no legal ground for the data processing, the proposed data retention requirement violates data protection law in Europe.

The 2013 RAA allows any registrar to opt out of the data retention provisions if it can prove that to comply would be illegal its own jurisdiction.

The Article 29 letter has been sent to act as blanket proof of this for all EU-based registrars, but it’s not yet clear if ICANN will treat it as such.

The letter goes on to sharply criticize ICANN for allowing itself to be used by governments (and big copyright interests) to circumvent their own legislative processes. It says:

The fact that these data may be useful for law enforcement (including copyright enforcement by private parties) does not equal a necessity to retain these data after termination of the contract.

the Working Party reiterates its strong objection to the introduction of data retention by means of a contract issued by a private corporation in order to facilitate (public) law enforcement.

If there is a pressing social need for specific collections of personal data to be available for law enforcement, and the proposed data retention is proportionate to the legitimate aim pursued, it is up to national governments to introduce legislation

So why is ICANN trying to get many of its registrars to break the law?

While it’s tempting to follow the Article 29 WP’s reasoning and blame law enforcement agencies and the Governmental Advisory Committee, which pushed for the new RAA to be created in the first place, the illegal data retention provisions appear to be entirely ICANN’s handiwork.

The original law enforcement demands (pdf) say registrars should “securely collect and store” data about registrants, but there’s no mention of the period for which it should be stored.

And while the GAC has expressly supported the LEA recommendations since 2010, it has always said that ICANN should comply with privacy laws in their implementation.

The GAC does not appear to have added any of its own recommendations relating to data retention.

ICANN can’t claim it was unaware that the new RAA might be illegal for some registrars either. The Article 29 WP told it so last September, causing ICANN to introduce the idea of exemptions.

However, the European Commission’s GAC representative then seemed to dismiss the WP’s concerns during ICANN’s public meeting in Toronto last October.

Perhaps ICANN was justifiably confused by these mixed messages.

According to Michele Neylon, chair of the Registrars Stakeholder Group, it has yet to respond to European registrars’ inquiries about the Article 29 letter, which was sent June 6.

“We hope that ICANN staff will take the letter into consideration, as it is clear that the data protection authorities do not want create extra work either for themselves or for registrars,” Neylon said.

“For European registrars, and non-European registrars with a customer base in the EU, we look forward to ICANN staff providing us with clarity on how we can deal with this matter and respect EU and national law,” he said.

ICANN approves 2013 RAA

ICANN has approved a new version of its standard Registrar Accreditation Agreement, after almost two years of talks with registrars.

The new 2013 RAA will be obligatory for any registrar that wants to sell new gTLD domain names, and may in future become obligatory for .org, .info and .biz.

The new deal’s primary changes include obligations for registrars to verify email addresses supplied for Whois records as well as stronger oversight on proxy/privacy services and resellers.

Akram Atallah, president of ICANN’s new Generic Domains Division said in a statement:

In no small way this agreement is transformational for the domain name industry. Our multiple stakeholders weighed in, from law enforcement, to business, to consumers and what we have ended up with is something that affords better protections and positively redefines the domain name industry.

Registrars Stakeholder Group chair Michele Neylon told DI:

The 2013 RAA does include lot of changes that will be welcomed by the broad community. It addresses the concerns of the Governmental Advisory Committee, it addresses the concerns of law enforcement, it addresses the concerns of IP rights advocates, end user consumer groups and many others.

But Neylon warned that ICANN will need “proactive outreach” to registrars, particularly those that do not regularly participate in the ICANN community or do not have English as their first language.

The new RAA puts a lot of new obligations on registrars that they all need to be fully aware of, he said.

“The unfortunate reality is that a lot of companies may sign contracts without being aware of what they’re agreeing to,” Neylon said. “The entire exercise could be seen as a failure if the outliers — registrars not actively engaged in the ICANN process or whose first language is not English — are not communicated with.”

A new RAA was also considered a gateway event for the launch of new gTLDs, so applicants have a reason to be cheerful today.

New registrar contract could be approved next week

ICANN’s board of directors is set to vote next week on the 2013 Registrar Accreditation agreement, but we hear some last-minute objections have emerged from registrars.

The new RAA has been about two years in the making. It will make registrars verify email addresses and do some rudimentary mailing address validation when new domains are registered.

It will also set in motion a process for ICANN oversight of proxy/privacy services and some aspects of the reseller business. In order to sell domain names in new gTLDs, registrars will have to sign up to the 2013 RAA.

ICANN has put approval of the contract on its board’s June 27 agenda.

But I gather that some registrars are unhappy about some last-minute changes ICANN has made to the draft deal.

For one, some linguistic tweaks to the text have given registrars an “advisory” role in seeking out technical ways to do the aforementioned address validation, which has caused some concern that ICANN may try to mandate expensive commercial solutions without their approval.

There also appears to be some concern that the new contract now requires registrars to make sure their resellers follow the same rules on proxy/privacy services, which wasn’t in previous drafts.

Huge registrar shake-up coming to .biz and .info

Afilias and Neustar will be soon able to sell .biz and .info domains direct, and may have to shut down registrars that refuse to sign up to the new 2013 Registrar Accreditation Agreement.

Those are two of the biggest changes proposed to the companies’ ICANN contracts, drafts of which were published this morning six months after their last registry agreements expired.

The new .biz and .info deals would allow both companies to vertically integrate — that is, own a controlling position in a registrar that sells domains in their respective gTLDs.

This would remove unwanted friction from their sales and marketing efforts, but would mean both registries would start competing with their own registrar channel in the retail market.

That’s currently not allowed in almost all gTLD contracts, but is expected to become commonplace in the era of new gTLDs, which have no such ownership restrictions.

These new vertical integration clauses were not unexpected; it’s been envisaged for a couple of years that the restrictions would be dropped in legacy gTLDs.

What is surprising are newly proposed clauses that would oblige Neustar and Afilias to terminate accredited registrars’ access to their TLDs if they don’t sign up to the 2013 RAA.

Under the process set out in the contracts, when registrars representing 67% of the domains in each given TLD have signed up to the 2013 RAA, all the other registrars would have between 270 and 330 days to also sign up to it or lose their ability to access the .biz/.info registries.

That would mean no selling new names and no accepting inbound transfers — a growth death sentence in the affected TLDs.

In the case of .info, in which Go Daddy has a 45% market share, it would only take the top four registrars to sign up to the 2013 RAA before the clock started ticking for the others.

However, this 67% rule would only kick in for Afilias and Neustar if Public Interest Registry and Verisign also voluntarily agree to the same rules for their .org, .com and .net gTLDs.

It’s a pretty aggressive move by ICANN to push the 2013 RAA onto registrars via its contracts with registries, but not the first.

In the separately proposed base New gTLD Registry Agreement, expected to be finalized in the next few weeks, registrars can only sell new gTLD domains if they’re on the 2013 RAA.

Other changes to the .biz and .info contracts include giving the registries the ability to block certain domains from registration to deal with security threats. Registries have been doing this since Conficker, but now they’ll be explicitly allowed to under their contracts.

They’ll also now be subject to the same emergency back-end transition provisions as new gTLDs, in the event of a catastrophic failure.

Both companies will also get to keep their ability to raise registry fees by 10% a year.

Presumably, given that the US Department of Commerce is not party to the .biz and .info deals, neither registry will get the same nasty surprise that Verisign got last year when Commerce froze its prices.

Both proposed contracts are now open for public comment at ICANN, here and here.

The previous contracts actually expired last December but were extended for six months due to ICANN’s focus on new gTLDs and the fact that it wanted to bring both agreements closer to the new gTLD contract.