Latest news of the domain name industry

Recent Posts

ICANN says Article 29 letter does not give EU registrars privacy opt-out

Kevin Murphy, July 15, 2013, 09:24:30 (UTC), Domain Policy

Registrars based in the European Union won’t immediately be able to opt out of “illegal” data retention provisions in the new 2013 Registrar Accreditation Agreement, according to ICANN.
ICANN VP Cyrus Namazi on Saturday told the Governmental Advisory Committee that a recent letter from the Article 29 Working Party, which comprises the data protection authorities of EU member states, is “not a legal authority”.
Article 29 told ICANN last month that the RAA’s provisions requiring registrars to hold registrant data for two years after the domain expires were “illegal”.
While the RAA allows registrars to opt out of clauses that would be illegal for them to comply with, they can only do so with the confirmation of an adequate legal opinion.
The Article 29 letter was designed to give EU registrars that legal opinion across the board.
But according to Namazi, the letter does not meet the test. In response to a question from the Netherlands, he told the GAC:

We accept it from being an authority, but it’s not a legal authority, is our interpretation of it. That it actually has not been adopted into legislation by the EU. When and if it becomes adopted then of course there are certain steps to ensure that our contracted parties are in line with — in compliance with it. But we look at them as an authority but not a legal authority at this stage.

It seems that when the privacy watchdogs of the entire European Union tell ICANN that it is in violation of EU privacy law, that’s not taken as an indication that it is in fact in violation of EU privacy law.
The European Commission representative on the GAC expressed concern about this development during Saturday’s session, which took place at ICANN 47 in Durban, South Africa.

Tagged: , , , , , ,

Comments (1)

  1. Roland Perry says:
    July 15, 2013 at 9:36 am

    ICANN is correct that there’s not really an “EU Privacy Law”, but there *is* a Directive that has to be implemented in every member state. Which amounts to much the same thing.
    Keeping data longer than “necessary” is against those laws, and it’s bodies like the Article 29 committee that states will turn to for advice on how long is “necessary” in the particular context.
    So if they say “only up to two years”, then that’s pretty conclusive.
    It’s worth thinking about this in the context of the separate EU Data Retention Directive, which only exists in order to allow organisations to keep data longer than might otherwise be deemed necessary.
    That has a limit of two years on this sort of subscriber data. So even a law intended to neuter the original Data Protection Directive is only good for two years.
    Article 6: “Member States shall ensure that the categories of data specified in Article 5 are retained for periods of not less than six months and not more than two years from the date of the communication”
    http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2006:105:0054:0063:EN:PDF

    Reply

Add Your Comment