Whois working group imploding in GDPR’s wake

An ICANN working group devoted to Whois policy is looking increasingly dead after being trumped by incoming European Union privacy law.
Registration Data Services PDP working group chair Chuck Gomes threw in the towel late last week, resigning from the group shortly after cancelling proposed face-to-face meetings scheduled for the Panama ICANN meeting in June.
That followed his announcement last month that the WG’s teleconferences were to be put on hold while ICANN works out how to respond to the General Data Protection Regulation, which comes into effect May 25, 11 days from now.
The WG had been working on ICANN’s future Whois policy since November 2015 but faced the usual impasses that occur whenever the various sides of the ICANN community face off over privacy.
Gomes, a former Versign executive who retired almost a year ago but stuck around to chair the RDS group, said he’d originally expected its work to wrap up in 2017.
Now, with GDPR rendering much of the discussions moot, there’s a feeling among some WG volunteers that they’ve been wasting their time.
ICANN’s response to GDPR is expected to be an emergency, top-down policy, written by staff and approved by the board, that would stay in place for a year.
The GNSO would then have a year to rally the community, under its own emergency procedures, to make formal policy to replace it for the long term.
There’s an open question about whether the RDS WG could be re-purposed to take on this task, but it’s my sense it’s more likely that a new group would be formed.
It may prove more challenging to recruit volunteers to such a group given the experiences of the RDS crowd.
Gomes, a long-time ICANN veteran and former GNSO Council chair, plans to spend more time travelling around in his RV with his wife. We wish them well.

ICANN flips off governments over Whois privacy

ICANN has formally extended its middle finger to its Governmental Advisory Committee for only the third time, telling the GAC that it cannot comply with its advice on Whois privacy.
It’s triggered a clause in its bylaws used to force both parties to the table for urgent talks, first used when ICANN clashed with the GAC on approving .xxx back in 2010.
The ICANN board of directors has decided that it cannot accept nine of the 10 bulleted items of formal advice on compliance with the General Data Protection Regulation that the GAC provided after its meetings in Puerto Rico in March.
Among that advice is a direction that public Whois records should continue to contain the email address of the registrant after GDPR goes into effect May 25, and that parties with a “legitimate purpose” in Whois data should continue to get access.
Of the 10 pieces of advice, ICANN proposes kicking eight of them down the road to be dealt with at a later date.
It’s given the GAC a face-saving way to back away from these items by clarifying that they refer not to the “interim” Whois model likely to come into effect at the GDPR deadline, but to the “ultimate” model that could come into effect a year later after the ICANN community’s got its shit together.
Attempting to retcon GAC advice is not unusual when ICANN disagrees with its governments, but this time at least it’s being up-front about it.
ICANN chair Cherine Chalaby told GAC chair Manal Ismail:

Reaching a common understanding of the GAC’s advice in relation to the Interim Model (May 25) versus the Ultimate Model would greatly assist the Board’s deliberations on the GAC’s advice.

Of the remaining two items of advice, ICANN agrees with one and proposes immediate talks on the other.
One item, concerning the deployment of a Temporary Policy to enforce a uniform Whois on an emergency basis, ICANN says it can accept immediately. Indeed, the Temporary Policy route we first reported on a month ago now appears to be a done deal.
ICANN has asked the GAC for a teleconference this week to discuss the remaining item, which is:

Ensure continued access to the WHOIS, including non-public data, for users with a legitimate purpose, until the time when the interim WHOIS model is fully operational, on a mandatory basis for all contracted parties;

Basically, the GAC is trying to prevent the juicier bits of Whois from going dark for everyone, including the likes of law enforcement and trademark lawyers, two weeks from now.
The problem here is that while ICANN has tacit agreement from European data protection authorities that a tiered-access, accreditation-based model is probably a good idea, no such system currently exists and until very recently it’s not been something in which ICANN has invested a lot of focus.
A hundred or so members of the ICANN community, led by IP lawyers who won’t take no for an answer, are currently working off-the-books on an interim accreditation model that could feasibly be used, but it is still subject to substantial debate.
In any event, it would be basically impossible for any agreed-upon accreditation solution to be implemented across the industry before May 25.
So ICANN has invoked its bylaws fuck-you powers for only the third time in its history.
The first time was when the GAC opposed .xxx for reasons lost in the mists of time back in 2010. The second was in 2014 when the GAC overstepped its powers and told ICANN to ignore the rest of the community on the issue of Red Cross related domains.
The board resolved at a meeting last Thursday:

the Board has determined that it may take an action that is not consistent or may not be consistent with the GAC’s advice in the San Juan Communiqué concerning the GDPR and ICANN’s proposed Interim GDPR Compliance Model, and hereby initiates the required Board-GAC Bylaws Consultation Process required in such an event. The Board will provide written notice to the GAC to initiate the process as required by the Bylaws Consultation Process.

Chalaby asked Ismail (pdf) for a call this week. I don’t know if that call has yet taken place, but given the short notice I expect it has not.
For the record, here’s the GAC’s GDPR advice from its Puerto Rico communique (pdf).

the GAC advises the ICANN Board to instruct the ICANN Organization to:
i. Ensure that the proposed interim model maintains current WHOIS requirements to the fullest extent possible;
ii. Provide a detailed rationale for the choices made in the interim model, explaining their necessity and proportionality in relation to the legitimate purposes identified;
iii. In particular, reconsider the proposal to hide the registrant email address as this may not be proportionate in view of the significant negative impact on law enforcement, cybersecurity and rights protection;
iv. Distinguish between legal and natural persons, allowing for public access to WHOIS data of legal entities, which are not in the remit of the GDPR;
v. Ensure continued access to the WHOIS, including non-public data, for users with a legitimate purpose, until the time when the interim WHOIS model is fully operational, on a mandatory basis for all contracted parties;
vi. Ensure that limitations in terms of query volume envisaged under an accreditation program balance realistic investigatory crossreferencing needs; and
vii. Ensure confidentiality of WHOIS queries by law enforcement agencies.
b. the GAC advises the ICANN Board to instruct the ICANN Organization to:
i. Complete the interim model as swiftly as possible, taking into account the advice above. Once the model is finalized, the GAC will complement ICANN’s outreach to the Article 29 Working Party, inviting them to provide their views;
ii. Consider the use of Temporary Policies and/or Special Amendments to ICANN’s standard Registry and Registrar contracts to mandate implementation of an interim model and a temporary access mechanism; and
iii. Assist in informing other national governments not represented in the GAC of the opportunity for individual governments, if they wish to do so, to provide information to ICANN on governmental users to ensure continued access to WHOIS.

Van Gelder remembered in GNSO resolution

Former GNSO Council chair Stéphane Van Gelder, who died last month, has been remembered in a motion passed by the Council on Friday.
The motion noted that Van Gelder was “a well-respected and much liked” member of the ICANN community, “admired for his passion, his fairness, his ability to find the best in people and his true gift for uniting people.”
It recognizes the “significant contribution” he made to the GNSO, his “genuine passion, energy and commitment” to his role, and concludes by offering “heartfelt sympathies to his family and friends”.
I’m reproducing the whole motion, which was obviously passed unanimously, here:

Whereas:

1. 1. Stéphane Van Gelder first entered the domain name business in the late 1990s when he founded Indom, a registrar in France, which later become part of the GroupNBT based in the United Kingdom. It was while Stéphane was General manager of INDOM that he was elected to the GNSO Council by the Registrar Stakeholder Group.
2. 2. Stéphane served on the GNSO Council from 2008 through 2012, as an elected representative of the Registrars Constituency.
3. 3. Stéphane served as Vice Chair of the GNSO Council in 2010 and was elected and served two consecutive terms as Chair of the GNSO Council in 2011 and 2012.
4. 4. As Chair of the GNSO Council, Stéphane was an impartial and neutral facilitator on all issues. For Stéphane, remaining neutral was key to ensuring collective dialogue.
5. 5. Stéphane made significant contributions to ICANN and was a strong and respected community leader. During his tenure as GNSO Chair, Stéphane oversaw and shepherded the:
   1. a. completion of an extensive update of the GNSO’s operating procedures;
   2. b. establishment of the DNS Security & Stability Analysis working group jointly with the ALAC, ccNSO and NRO;
   3. c. completion of the Fast Flux, Post-Expiration Domain Name Recovery and Inter-Registrar Transfer Policy (IRTP) Part B Policy Development Processes (PDPs) and the joint ccNSO-GNSO Internationalized Domain Name working group;
   4. d. launch of the IRTP Part C, Thick WHOIS and Locking of Domain Names subject to Uniform Dispute Resolution Policy Proceedings PDPs; and (e) continuing work on WHOIS studies, registration abuse policies, and multiple other GNSO projects.
   5. e. the completion of the Applicant Guidebook for the 2012 New gTLD Program and the launch of the Program.
   6. f. Stéphane was a well-respected and much liked member of not only the GNSO, but of the broader ICANN Community. He was admired for his passion, his fairness, his ability to find the best in people and his true gift for uniting people.
   7. g. Stéphane’s passing is a great loss to the many people in the ICANN community that had the pleasure to work and interact with him, and for his many friends at ICANN the loss is significant.

Resolved:

1. 1. The GNSO Council wishes to recognize the significant contribution Stéphane made to the GNSO Council during his tenure and his notable achievements during this time.
2. 2. Stéphane’s genuine passion, energy and commitment to the Internet and all that it brought to the world was second to none and we will miss him dearly.
3. 3. On behalf of the current and previous GNSO Councils, we offer our deepest and heartfelt sympathies to his family and friends at this most difficult time.

Van Gelder died after an automobile accident, which also injured his wife, in Switzerland at the end of March.

Iceland breaks ranks on Whois, will publish emails

Iceland’s ccTLD has become what I believe is the first registry to state that it will continue to publish email addresses in public Whois records after the General Data Protection Regulation comes into effect.
The move seems to put the registry, ISNIC, in direct conflict with the opinions of European data protection authorities.
The company said in a statement last week that after GDPR comes into effect May 25 it will stop publishing almost all personal information about .is registrants in the public Whois.
However, it broke ranks with other European ccTLDs and the likely ruleset for ICANN-regulated gTLDs, by saying it would not expunge email addresses:

ISNIC will however, at least for the time being, continue to publish email addresses, country and techincal information of all NIC-handles associated with .is domains. Those customers (individuals) who have recorded a personally identifiable email address, and do not want it published, will need to change their .is WHOIS email address to something impersonal.

Registrants will be able to opt in to having their full details published.
ISNIC appears to be taking a principled stand against the Draconian regulation. It said in a statement:

Assuming that GDPR directive applies fully to the “WHOIS” service provided for decades by most ccTLD registries, these new restrictions will lead to less transparency in domain registrations and less trust in the domain registration system in general. ISNIC, as many others, strongly disagrees with the view of the European parlament [sic] in this matter and warns that GDPR, as it is being implemented, will neither lead to better privacy nor a safer network environment.

It’s a surprising decision, given that privacy regulators have indicated that they agree that email addresses are personal data that should not be published.
The Article 29 Working Party told ICANN earlier this month that it “welcomed” a proposal to replace email addresses with anonymized emails or web-based contact forms.

Muslim world still thinks .islam isn’t kosher

The Organization of Islamic Cooperation has repeated its objection to the gTLDs .islam and .halal ever seeing the light of day.
OIC Secretary General Yousef Al-Othaimeen wrote to ICANN earlier this month to declare that its position on the two controversial applications has not changed since it initially objected to them in 2013.
The OIC comprises the foreign ministers from 57 majority-Muslim countries and these ministers recently voted unanimously to re-adopt the 2013 objection, Al-Othaimeen said (pdf).
The group “maintain the position that the new gTLDs with Islamic identity are extremely sensitive in nature as they concern the entire Muslim nature” he wrote.
He reiterated “official opposition of the OIC Member states towards the probable authorization that might allow the use of these gTLDs .islam and .halal by any entity.”
This puts ICANN between a rock an a hard place.
The applicant for both strings, Turkish outfit Asia-Green IT Systems (AGIT), won an Independent Review Process case against ICANN last November.
The IRP panel ruled that ICANN broke its own bylaws when it placed .islam and .halal into permanent limbo — an “On Hold” status pending withdrawal of the applications or OIC approval — in 2014.
ICANN’s board accepted the ruling and bounced the decision on whether to finally approve or reject the bids to its Board Accountability Mechanisms Committee, which is currently mulling over the problem.
Technically, it’s “non-consensus Governmental Advisory Committee advice”, which means the board has some wriggle room to simply accept the advice and reject the applications.
But AGIT’s lawyer disagrees, recently telling ICANN (pdf) its options are to approve the bids or facilitate dialogue towards their approval, rather like ICANN is doing with .amazon right now.

Child abuse becoming big problem for new gTLDs

There were 3,791 domain names used to host child sexual abuse imagery in 2017, up 57%, according to the latest annual report from the Internet Watch Foundation.
While .com was the by far the worst TLD for such material in terms of URLs, over a quarter of the domains were registered in new gTLDs.
Abuse imagery was found on 78,589 URLs on 3,791 domains in 152 TLDs, the IWF said in its report.
.com accounted for 39,937 of these URLs, a little over half of the total, with .net, .org, .ru and .co also in the top five TLDs. Together they accounted for 85% of all the abuse URLs found. The 2016 top five TLDs included .se, .io and .cc.
New gTLDs accounted for a small portion of the abuse URLs — just over 5,000, up 221% on 2016 — but a disproportionate number of domains.
The number of new gTLD domains used for abuse content was 1,063, spread over 50 new gTLDs. Equivalent numbers were not available in the 2016 report and IWF does not break down which TLDs were most-abused.
According to Verisign’s Q4 Domain Name Industry Brief (pdf), new gTLDs account for just 6.2% of all existing domain names, and yet they account for over 28% of the domains where IWF found child abuse imagery.
IWF said that the increasing number of domains registered to host abuse imagery can be linked to what it calls “disguised websites”.
These are sites “where the child sexual abuse imagery will only be revealed to someone who has followed a pre-set digital pathway — to anyone else, they will be shown legal content.”
Presumably this means that registries and registrars spot-checking domains they have under management could be unaware of their true intended use.

Now GNSO mulls emergency response to GDPR deadline

ICANN’s GNSO Council is thinking about deploying a never-before-used emergency mechanism to develop a Whois privacy policy in response to GDPR.
With the May 25 deadline for compliance with the EU’s General Data Protection Regulation fast approaching, the community is scrambling to figure out how it can bring ICANN’s policies and therefore its contracts into line with the Draconian privacy provisions of the new law.
Currently, ICANN contracts with registries and registrars demand the publication of full Whois records, something GDPR will not permit, so each company in the industry is busily figuring out how its own Whois database will comply.
Fearful of a “fragmented” Whois, ICANN’s board of directors is considering deploying its own top-down emergency measure — called a Temporary Policy in its contracts — to ensure uniformity across its contracts.
CEO Goran Marby revealed to DI earlier this month that a Temporary Policy was being considered, and he and other members of the board confirmed as much to GNSO leadership during a telephone briefing last week.
(It should be noted that the call took place prior to the receipt last week of guidance from the EU Article 29 Working Party, which prompted ICANN to start mulling legal options as one way to buy the industry some time to comply post-May.)
The call (recorded here with password Eur3wiEK and summarized in this letter (pdf)), focused almost exclusively on how the Council could respond to a board-mandated Temporary Policy, with the board suggesting a GNSO Expedited Policy Development Process might be the best way to proceed.
A Temporary Policy would expire within a year, so the GNSO would have to come up with a formal Consensus Policy within that time-frame if ICANN were to have any hope of having a uniform view of Whois across its contracts.
The Temporary Policy is a “strong option” for the board, and a “highly likely or likely” outcome, but nothing has been formally decided, the GNSO leaders heard from ICANN vice-chair Chris Disspain. He was briefly challenged by Marby, who appeared somewhat more committed to the move.
While the GNSO Council has not yet formally decided to deploy the EPDP, it appears to be the most-feasible option to meet the deadline a Temporary Policy would impose.
It is estimated that an EPDP could take as little as 360 days, compared to the estimated 849 days of a regular PDP.
The EPDP cuts out several of the initial steps of a regular PDP — mainly the need for an Initial Report and associated public comment period — which by my reading would shorten the process by at least 100 days.
It also seems to give the GNSO some wriggle room in how the actual policy creation takes place. It appears that the regular “working group” structure could be replaced, for example, with a “drafting team”.
If the EPDP has the Temporary Policy and WP29 guidance as its baseline for discussions, that could also help cut out some of the circular argument that usually characterizes Whois discussions.
Aware that the EPDP is a strong possibility, the Council is currently planning to give itself a crash course in the process, which has never been used before by any iteration of the Council.
It’s uncharted territory for both the GNSO and the ICANN board, and the only people who seem to have a firm grasp on how the two emergency mechanisms slot together are the ICANN staffers who are paid to know such things.
UPDATE: A couple of hours after this article was published, ICANN posted this three-page flow-chart (pdf) comparing EPDP to PDP. Lots of luck.

Panic stations as Europe plays hardball on Whois privacy

Hopes that Whois records will continue to be available to broad sections of the internet community appeared dashed this week as European data protection heads ripped holes in ICANN’s plan for the industry to comply with the General Data Protection Regulation.
ICANN CEO Goran Marby warned that Whois faces imminent fragmentation and expressed disappointment that authorities have basically ignored his repeated requests for a moratorium on GDPR enforcement.
The Article 29 Working Party, made up of the heads of data protection authorities of EU member states, told ICANN this week that its so-called “Cookbook” compliance plan is nowhere near detailed enough.
In a letter (pdf), it also strongly hinted that intellectual property interests have little hope of retaining access to Whois contact information after GDPR comes into effect next month.
Any notion that WP29 might tell ICANN that the Cookbook was an over-reaction to GDPR, eschewing too many data elements from public records, was firmly put to bed.
Instead, the group explicitly supported ICANN’s plan to replace email addresses in the public Whois with anonymized addresses or a web-based registrant contact form.
It said it “welcomes the proposal to significantly reduce the types of personal data that shall be made publically [sic] available, as well as its proposal [to] introduce alternative methods to contact registrants”.
It also approved of the plan for a “layered” access plan, under which some entities — law enforcement in particular — would be able to access private contact information under an accreditation program.
But WP29 pooh-poohed the idea, put forward by some in the trademark community, that access to Whois could be restricted merely with the use of an IP address white-list.
It warned that the purposes for such access should be explicitly defined and said that what can be accessed should be tightly controlled.
WP29 does not appear to be a fan of anyone, even accredited users, getting bulk access to private Whois data.
While the group endorsed the idea that law enforcement agencies should be able to access Whois, it failed to provide similar comfort to IP interests, security researchers and other groups with self-declared “legitimate interests” in the data.
In what I’m reading as a veiled attack on the IP lobby, the WP29 letter says:

ICANN should take care in defining purposes in a manner which corresponds to its own organisational mission and mandate, which is to coordinate the stable operation of the Internet’s unique identifier systems. Purposes pursued by other interested third parties should not determine the purposes pursued by ICANN. The WP29 cautions ICANN not to conflate its own purposes with the interests of third parties, nor with the lawful grounds of processing which may be applicable in a particular case.

While it would be fairly easy to argue that giving access to security researchers contributes to “stable operation of the Internet’s unique identifier systems”, I think it would be considerably harder to argue that giving trademark owners an easy way to pursue suspected cybersquatters does the same.
In short, the letter clarifies that, rather than complying too much, ICANN has not gone far enough.
WP29 also roundly ignored ICANN’s request for an enforcement moratorium to give the community enough time to come up with a compliance policy and the industry enough time to implement it, irking ICANN into threatening legal action.
Marby said in a blog post yesterday:

Without a moratorium on enforcement, WHOIS will become fragmented and we must take steps to mitigate this issue. As such, we are studying all available remedies, including legal action in Europe to clarify our ability to continue to properly coordinate this important global information resource. We will provide more information in the coming days.

He said that the WP29 statement puts ICANN at odds with the consensus advice of its Governmental Advisory Committee — which, it should be noted, includes the European Commission and most of the EU member states.
The GAC has told ICANN to “Ensure that the proposed interim model maintains current WHOIS requirements to the fullest extent possible” and to reconsider its plan to remove registrant email addresses from public records.
That’s how stupid the situation has become — the same governments telling ICANN to retain email addresses is also telling it to remove them.
Outside of Europe, the United States government has been explicit that it wants Whois access to remain available.
Marby said that an ICANN delegation will attend a meeting of the WP29 Technology Subgroup in Brussels on April 23 to further discuss the outstanding issues.
In a quick response (pdf) to the WP29 letter, he warned that a fragmented Whois and the absence of a moratorium could spell doom for the smooth functioning of the internet.

We strongly believe that if WHOIS is fragmented, it will have a detrimental impact on the entire Internet. A key function of WHOIS allows those participating in the domain name system and in other aspects of work on the Internet to know who else is working within that system. Those working on the Internet require the information contained within WHOIS to be able to communicate with others working within that system.

Reaction from elsewhere in the community has so far comprised variations of “told you so” and hand-wringing about the impact after May 25.
Michele Neylon, head of the registrar Blacknight, blogged that the letter signaled “game over” for the public Whois.
“Come the end of May, public whois as we know it will be dead,” he wrote.
Academic Farzaneh Badii, executive director of the Internet Governance Project and a leading figure in ICANN’s non-commercial users community, blamed several factors for the current 11th-hour predicament, but mainly the fact that her constituency’s lobbying was ignored for so long.
“The Noncommercial Stakeholders Group was the broken record that everyone perceived as not worth paying attention to. But GDPR got real and ICANN has to deal with it,” she wrote.
Matt Serlin of the IP-centric registrar Brandsight, wrote that the letter was “predictable” and said:

The WHOIS system, as it has been known for two decades, will cease to exist. Unfettered access to registration information for gTLDs is simply not going to be possible going forward after May 25th. Yes, there are still questions as to what the final model ICANN puts forth will be, but it will certainly drastically change how WHOIS will function.

Serlin held out some hope that the unspecified legal action Marby has floated may go some way to extend the May 25 GDPR enforcement date.
The community awaits Marby’s next update with bated breath.

Afilias scraps plan to scrap Whois

Afilias has “temporarily suspended” its plan to migrate its TLDs to an essentially thin Whois model.
In what appears to be an effort to roll back some GDPR-related gun-jumping, the registry said it will instead wait and see how ICANN’s efforts to consult with European data protection authorities play out.
Afilias had told its registrars earlier this week that its public Whois output from May 25 will be devoid of any contact information for the registrant, as reported by DNW.
It had said that it would continue to work with law enforcement on access to Whois records, but said that others (such as trademark owners) would not have access until ICANN comes up with an accreditation program.
It was the first major gTLD registry to announce its GDPR plans, but it evidently received push-back.
The affected TLDs were to be: .info, .mobi, .pro, .poker, .pink, .black, .red, .blue, .kim, .shiksha, .promo, .lgbt, .ski, .bio, .green, .lotto, .pet, .bet, .vote, .voto, .archi, .organic and .llc.
Many more client gTLDs would have been able to opt-in to the same scaled-back system.
But the company told registrars today that it wanted to correct “mis-characterizations” of that message and wanted to “clarify that Afilias is not ‘going it alone'”.
Rather, it’s going to hang back until ICANN gets guidance from the EU’s DPAs.
“Importantly, we expect that ICANN’s request for guidance from the data protection authorities will yield helpful input that, in conjunction with the best thinking of the community, will enable a workable solution to emerge,” the Afilias message said.
The company said in a statement sent to DI tonight:

Afilias today announced that it is temporarily suspending plans to limit the display of WHOIS data to comply with the EU General Data Protection Regulation (GDPR) currently scheduled to take effect on 25MAY2018. Afilias has received a number of questions about its plans, and anticipates that they may be affected by guidance from data protection authorities that has been requested by ICANN. This guidance is expected to be materially helpful in the community’s efforts to resolve the various issues surrounding GDPR requirements.
Afilias is participating in a number of community groups that are considering these issues, including as a principal in ICANN’s pilot implementation of the Registration Data Access Protocol (RDAP), a potential technical solution for enabling differentiated access to registration data depending on the legitimate purpose of the requestor. For example, law enforcement may need access to certain types of Personally Identifiable Information (PII), trademark guardians to other types, etc. RDAP enables the management of this access in an efficient and effective manner.
As the deadline for GDPR implementation approaches, the community is working diligently in a number of areas to find solutions needed to balance a wide range of community interests. Afilias will continue working collaboratively within these groups in the expectation that appropriate solutions will be reached prior to the GDPR implementation date. Absent guidance from the data protection authorities, Afilias will reconsider its plans as appropriate to ensure compliance with GDPR.

It’s still very possible that Afilias, and other gTLD registries and registrars, could end up gutting Whois in much the same way come May 25 anyway, but for now at least it seems Afilias it willing to play wait-and-see.
As a reminder, there’s going to be an ICANN-supported conference call tomorrow on an Intellectual Property Constituency proposal for a post-GDPR Whois accreditation model.

Whois policy group closes down in face of GDPR

An ICANN working group devoted to crafting Whois policy has closed down “until further notice” in light of the EU General Data Protection Regulation.
The Registration Data Service Policy Development Process Working Group will have no more meetings until it receives “guidance from the [ICANN] Board regarding how this WG will be affected by the GDPR compliance efforts”.
That’s according to WG co-chair Chuck Gomes, in an email to the group this morning. The mailing list will remain active to keep members informed of progress, he said.
The group has been tasked with developing “comprehensive Whois reform”.
It’s been working for over two years to attempt to find consensus on changes such as tiered access and data privacy, the latest iteration of fruitless, fractious Whois policy discussions dating back a couple of decades, and had made very little progress.
Recently, it’s also been hit by infighting and, in my opinion, a sense of helplessness in the face of GDPR, the EU privacy law that will take precedence over any policy ICANN comes up with.
Last month, prominent Non-Commercial Stakeholder Group member Stephanie Perrin publicly resigned from the WG, saying it was “fundamentally flawed” and complaining the process was an “antique” that wasn’t sufficiently taking GDPR into account.
As DI has been reporting for the last several months, there’s very little clarity right now about how GDPR will effect ICANN’s Whois policy.
ICANN CEO Goran Marby told us yesterday that he’s “cautiously optimistic” that EU data protection authorities will soon provide some firm guidance on what it means to be GDPR-compliant.
It appears that the RDS group’s fate may also lie in the hands of the DPAs, for now.