2013 RAA is illegal, says EU privacy watchdog

European privacy regulators have slammed the new 2013 Registrar Accreditation Agreement, saying it would be illegal for registrars based in the EU to comply with it.
The Article 29 Working Party, which comprises privacy regulators from the 27 European Union nations, had harsh words for the part of the contract that requires registrars to store data about registrants for two years after their domains expire.
In a letter (pdf) to ICANN last month, Article 29 states plainly that such provisions would be illegal in the EU:

The fact that these personal data can be useful for law enforcement does not legitimise the retention of these personal data after termination of the contract. Because there is no legal ground for the data processing, the proposed data retention requirement violates data protection law in Europe.

The 2013 RAA allows any registrar to opt out of the data retention provisions if it can prove that to comply would be illegal its own jurisdiction.
The Article 29 letter has been sent to act as blanket proof of this for all EU-based registrars, but it’s not yet clear if ICANN will treat it as such.
The letter goes on to sharply criticize ICANN for allowing itself to be used by governments (and big copyright interests) to circumvent their own legislative processes. It says:

The fact that these data may be useful for law enforcement (including copyright enforcement by private parties) does not equal a necessity to retain these data after termination of the contract.
…
the Working Party reiterates its strong objection to the introduction of data retention by means of a contract issued by a private corporation in order to facilitate (public) law enforcement.
If there is a pressing social need for specific collections of personal data to be available for law enforcement, and the proposed data retention is proportionate to the legitimate aim pursued, it is up to national governments to introduce legislation

So why is ICANN trying to get many of its registrars to break the law?
While it’s tempting to follow the Article 29 WP’s reasoning and blame law enforcement agencies and the Governmental Advisory Committee, which pushed for the new RAA to be created in the first place, the illegal data retention provisions appear to be entirely ICANN’s handiwork.
The original law enforcement demands (pdf) say registrars should “securely collect and store” data about registrants, but there’s no mention of the period for which it should be stored.
And while the GAC has expressly supported the LEA recommendations since 2010, it has always said that ICANN should comply with privacy laws in their implementation.
The GAC does not appear to have added any of its own recommendations relating to data retention.
ICANN can’t claim it was unaware that the new RAA might be illegal for some registrars either. The Article 29 WP told it so last September, causing ICANN to introduce the idea of exemptions.
However, the European Commission’s GAC representative then seemed to dismiss the WP’s concerns during ICANN’s public meeting in Toronto last October.
Perhaps ICANN was justifiably confused by these mixed messages.
According to Michele Neylon, chair of the Registrars Stakeholder Group, it has yet to respond to European registrars’ inquiries about the Article 29 letter, which was sent June 6.
“We hope that ICANN staff will take the letter into consideration, as it is clear that the data protection authorities do not want create extra work either for themselves or for registrars,” Neylon said.
“For European registrars, and non-European registrars with a customer base in the EU, we look forward to ICANN staff providing us with clarity on how we can deal with this matter and respect EU and national law,” he said.

DomainsBot to be “at the heart” of new gTLD sales

DomainsBot, which powers the name suggestion feature on most major registrar storefronts, has unveiled a significant update designed to make selling new gTLD domains easier.
The company reckons its new technology will soon be promoted from a follow-up sales tool, rolled out if a customer’s first choice of domain is not available, to “replacing the availability check” entirely.
“The idea is to be at the heart of the process of promoting new gTLDs,” CEO Emiliano Pasqualetti told DI.
The idea is pretty straightforward: a customer types a word into a search box, the service suggests available domain names with conceptually similar TLDs.
There’s a demo online already. If you type “chocolate”, it suggests domains such as chocolate.food, chocolate.menu and chocolate.health. Domain Name Wire did a quick test run today too.
While it may not be perfect today, it was pretty good at finding appropriate TLDs for the keywords I tested.
And Pasqualetti said that under the hood is a machine learning engine that will make its suggestions increasingly more relevant as new gTLD domains start to go on sale.
“It tries to predict which TLD we need to show to each individual using a combination of their query, their IP address and as much history as we can legally collect in partnership with registrars,” Pasqualetti said.
If, for example, customers based in London show a tendency to buy lots of .london domains but hardly ever .rome, Londoners will start to see .london feature prominently on their registrar’s home page.
“We learn from each registrar what people search for and what people end up buying,” he said.
Some registrars may start using the software in their pre-registration portals, increasing relevance before anything actually goes on sale, he said.
My feeling is that this technology could play a big role in which new gTLDs live or die, depending on how it is implemented and by which registrars.
Today, DomainsBot powers the suggestion engine for the likes of Go Daddy, eNom, Tucows and Moniker. Pasqualetti reckons about 10% of all the domains being sold are sold via its suggestions.
Judging by today’s press release, registrars are already starting to implement the new API. Melbourne IT, Tucows and eNom are all quoted, but Pasqualetti declined to specify precisely how they will use the service.
It’s been widely speculated that Go Daddy plans to deploy an automated “pay for placement” system — think AdSense for domains — to determine which TLDs get prominence on its storefront.
Pasqualetti said that’s the complete opposite of what DomainsBot is offering.
“We’re relevance for placement,” he said. “We want to give every TLD a chance to thrive, as long as they’re relevant for the end user.”
According to Pasqualetti (and most other people I’ve been talking to recently) there are a lot of new gTLD applicants still struggling to figure out how to market their TLDs via registrars.
There are about 550 “commercially interesting” applied-for gTLD strings in the DomainsBot system right now, he said. New gTLD applicants may want to make sure they’re one of them.
Next week, the company will reveal more details about how it plans to work with new gTLD registries specifically.

ICANN approves 2013 RAA

ICANN has approved a new version of its standard Registrar Accreditation Agreement, after almost two years of talks with registrars.
The new 2013 RAA will be obligatory for any registrar that wants to sell new gTLD domain names, and may in future become obligatory for .org, .info and .biz.
The new deal’s primary changes include obligations for registrars to verify email addresses supplied for Whois records as well as stronger oversight on proxy/privacy services and resellers.
Akram Atallah, president of ICANN’s new Generic Domains Division said in a statement:

In no small way this agreement is transformational for the domain name industry. Our multiple stakeholders weighed in, from law enforcement, to business, to consumers and what we have ended up with is something that affords better protections and positively redefines the domain name industry.

Registrars Stakeholder Group chair Michele Neylon told DI:

The 2013 RAA does include lot of changes that will be welcomed by the broad community. It addresses the concerns of the Governmental Advisory Committee, it addresses the concerns of law enforcement, it addresses the concerns of IP rights advocates, end user consumer groups and many others.

But Neylon warned that ICANN will need “proactive outreach” to registrars, particularly those that do not regularly participate in the ICANN community or do not have English as their first language.
The new RAA puts a lot of new obligations on registrars that they all need to be fully aware of, he said.
“The unfortunate reality is that a lot of companies may sign contracts without being aware of what they’re agreeing to,” Neylon said. “The entire exercise could be seen as a failure if the outliers — registrars not actively engaged in the ICANN process or whose first language is not English — are not communicated with.”
A new RAA was also considered a gateway event for the launch of new gTLDs, so applicants have a reason to be cheerful today.

New registrar contract could be approved next week

ICANN’s board of directors is set to vote next week on the 2013 Registrar Accreditation agreement, but we hear some last-minute objections have emerged from registrars.
The new RAA has been about two years in the making. It will make registrars verify email addresses and do some rudimentary mailing address validation when new domains are registered.
It will also set in motion a process for ICANN oversight of proxy/privacy services and some aspects of the reseller business. In order to sell domain names in new gTLDs, registrars will have to sign up to the 2013 RAA.
ICANN has put approval of the contract on its board’s June 27 agenda.
But I gather that some registrars are unhappy about some last-minute changes ICANN has made to the draft deal.
For one, some linguistic tweaks to the text have given registrars an “advisory” role in seeking out technical ways to do the aforementioned address validation, which has caused some concern that ICANN may try to mandate expensive commercial solutions without their approval.
There also appears to be some concern that the new contract now requires registrars to make sure their resellers follow the same rules on proxy/privacy services, which wasn’t in previous drafts.

Hexonet scores dot-brand deal with Brights

Hexonet has made a deal with new gTLD consultancy Brights Consulting to provide registrar technical services for all of Brights’ dot-brand clients.
All new gTLDs, even dot-brands, are obliged to use accredited registrars to register domain names. Under this deal, Brights will use Hexonet’s RegistrarOC service to make the process a little easier.
RegistrarOC is basically a way for companies accredited by ICANN as registrars to outsource the technical and compliance functions of running a registrar to Hexonet.
Brights will use its own accreditation and RegistrarOC to manage its clients’ portfolios of second-level domains in their respective dot-brands, Hexonet chief strategy officer Robbie Birkner said.
The exact number of dot-brands Brights is taking care of has not been disclosed, but I believe it’s in double figures. Most are based in Japan, same as Brights.

Four registrars terminated

Four small domain name registrars have lost their ICANN accreditation and their domain names have been transferred to another.
ICANN announced on Friday that US-based C I Host and Central Registrar (Domainmonger.com), along with Panama-based Power Brand Center have all been terminated for non-compliance.
Breach notices had been sent earlier this year covering everything from broken Whois to a failure to cooperate with audits.
Dotted Ventures, also American, had allowed its accreditation to lapse in March. It had, however, also been sent a breach notice for non-payment of ICANN fees in April.
The gTLD domains they managed, which amount to between a couple of hundred and a couple of thousand each, have all been transferred to UK-based Astutium, which isn’t much bigger.
Customers of each terminated registrar will receive notices from Astutium instructing them how to proceed, ICANN said. There shouldn’t be a cost to transfer, so any request for cash may be a phishing attack.

Go Daddy IPO “not off the table”

Go Daddy may be on the IPO track with its new investors and management.
Speaking to the Wall Street Journal about the possibility of going public, CEO Blake Irving said:

It’s not off the table. We’re growing at double digits [in terms of percentage] on the customer side, on revenue, on earnings, so the opportunity for us to have an IPO is quite good. The board is quite supportive of taking that direction, if that’s what we want to do.

Go Daddy famously yanked its planned IPO in 2006 just weeks before it was set to execute, apparently at the whim of then-CEO and majority owner Bob Parsons.
Since then, Parsons has taken a lower profile role at the company, and his shareholding was diluted to reportedly lower than 35% by an investment from KKR and Silver Lake Partners reportedly worth over $2 billion.
The short WSJ interview also reveals a few other interesting tidbits, such as the fact that Irving commutes to Go Daddy’s Arizona headquarters by plane once a week.

Interim CEO gets two C-level roles at Go Daddy

Go Daddy’s management shake-up continues apace, with the news last night that former interim CEO Scott Wagner has been appointed COO and CFO.
Wagner comes from KKR, one of three major investors to take a big stake in the registrar in 2011.
He was CEO in the interregnum between Warren Adelman’s short-lived stint and the appointment of Yahoo alum Blake Irving this January.
Irving has been filling senior spots at the company ever since taking over. Many of his new recruits are former Yahoo colleagues.
GoDaddy said in a press release that its sales hit almost $1.3 billion last year and that it has more than 11 million customers.

Three more registrars get breach notices

ICANN has told three registrars that they’re in breach of their contracts and risk losing their accreditations.
Two of the companies in receipt of breach notices this week — Internet Solutions and DomainSnap — have no gTLD domains under management, but the other, Aregentinian registrar Dattatec, has over 90,000, making it the 112th-largest registrar.
The former two have simply not paid their fees, according to ICANN.
Dattatec, meanwhile, also stands accused of not adequately responding to Whois accuracy complaints on a handful of distinctly spammy-looking domain names in its care.
All three have been given until almost the end of the month to sort out the problems or face the possibility of termination.

Go Daddy building big new facility in Arizona

Go Daddy has “broken ground” on a new 150,000 square foot facility in Tempe, Arizona.
The new Global Technology Center will have room for 1,300 technology and customer care employees, the registrar said in a press release today. It expects to create 300 new jobs locally.
The construction project was ceremonially kicked off by CEO Blake Irving and Arizona governor Jan Brewer today.
Go Daddy is of course a native of the state, with its headquarters in Scottsdale.
The new two-story center will be located in Arizona State University Research Park, and is set for completion in 2014.