In GDPR case, ICANN ready to fight Tucows to the bitter end

ICANN has appealed its recent court defeat as it attempts to force a Tucows subsidiary to carry on collecting full Whois data from customers.
The org said yesterday that it is taking its lawsuit against Germany-based EPAG to a higher court and has asked it to bounce the case up to the European Court of Justice, as the first test case of the new General Data Protection Regulation.
In its appeal, an English translation (pdf) of which has been published, ICANN argues that the Higher Regional Court of Cologne must provide an interpretation of GDPR in order to rule on its request for an injunction.
And if it does, ICANN says, then it is obliged by the GDPR itself to refer that question to the ECJ, Europe’s highest judicial authority.
The case concerns Tucows’ refusal to carry on collecting contact information about the administrative and technical contacts for each domain name it sells, which it is contractually obliged to do under ICANN’s Whois policy.
These are the Admin-C and Tech-C fields that complement the registrant’s own contact information, which Tucows is of course still collecting.
Tucows says that these extra fields are unnecessary, and that GDPR demands it minimize the amount of data it collects to only that which it strictly needs to execute the registration contact.
It also argues that, if the Admin-C and Tech-C are third parties, it has no business collecting any data on them at all.
According to Tucows legal filings, more than half of its 10 million domains have identical data for all three contacts, and in more than three quarters of cases the registrant and Admin-C are identical.
In its appeal, ICANN argues that the data is “crucial for the objectives of a secure domain name system, including but not limited to the legitimate purposes of consumer protection,
investigation of cybercrime, DNS abuse and intellectual property protection and law enforcement needs”.
ICANN uses Tucows’ own numbers against it, pointing out that if Tucow has 7.5 million domains with shared registrant and Admin-C data, it therefore has 2.5 million domains where the Admin-C is a different person or entity, proving the utility of these records.
It says that registrars must continue to collect the disputed data, at the very least if it has secured consent from the third parties named.
ICANN says that nothing in the Whois policy requires personal data to be collected on “natural persons” — Admin-C and Tech-C could quite easily be legal persons — therefore there is no direct clash with GDPR, which only covers natural persons.
Its appeal, in translation, reads: “the GDPR is irrelevant if no data about natural persons are collected. In this respect, the Defendant is contractually obliged to collect such data, and failure to do so violates its contract with the Applicant.”
It goes on to argue that even if the registrant chooses to provide natural-person data, that’s still perfectly fine as a “legitimate purpose” under GDPR.
ICANN was handed a blow last month after a Bonn-based court refused to give it an injunction obliging EPAG (and, by inference, all registrars) to continue collecting Admin-C and Tech-C.
The lower court had said that registrants would be able to continue to voluntarily provide Admin-C and Tech-C, but ICANN’s appeal points out that this is not true as EPAG is no longer requesting or collecting this data.
In ICANN’s estimation, the lower court declined to comment on the GDPR implications of its decision.
It says the appeals court, referred to in translation as the “Senate”, cannot avoid interpreting GDPR if it has any hope of ruling on the injunction request.
Given the lack of GDPR case law — the regulation has only been in effect for a few weeks — ICANN reckons the German court is obliged by GDPR itself to kick the can up to the ECJ.
It says: “If the Senate is therefore convinced that the outcome of this procedure depends on the interpretation of certain provisions of the GDPR, the Senate must refer these possible questions to the ECJ for a preliminary ruling”.
It adds that should a referral happen it should happen under the ECJ’s “expedited” procedures.
An ECJ ruling has been in ICANN’s sights for some time; late last year CEO Goran Marby was pointing out that a decision from the EU’s top court would probably be the only way full legal clarity on GDPR’s intersection with Whois could be obtained.
It should be pointed out of course that this case is limited to the data collection issue.
The far, far trickier issue of when this data should be released to people who believe they have a legitimate purpose to see it — think: trademark guys — isn’t even up for discussion in the courts.
It will be, of course. Give it time.
All of ICANN’s legal filings, in the original German and unofficial translation, can be found here.

.cam given the nod as Rightside wins confusion appeal

Rightside’s application for .cam will be un-rejected after the company beat Verisign in an appeal against a 2013 String Confusion Objection decision.
That’s right, .cam is officially no longer too confusingly similar to .com.
In a just-published August 26 decision (pdf) a three-person International Centre for Dispute Resolution panel overruled the original SCO panelist’s decision.
The new panel wrote:

Based on the average, reasonable Internet’s user’s experience, and the importance of search engines, in the [Final Review Panel]’s view, confusion, if any, between .COM and .CAM is highly likely to be fleeting. While a fleeting association may create some “possibility of confusion” or evoke an “association in the sense that the string brings another string to mind,” both such reactions are insufficient under the ICANN SCO standard to support a finding that confusion is probable.

It’s not quite as clear-cut a ruling as the .shop versus .通販 ruling last week, relying on the appeals panel essentially just disagreeing with some of the finer points of the original panel’s interpretation of the evidence.
Relating to one piece of evidence, the appeals panel found that the original panelist “improperly shifted the burden of proof” to Rightside to show that .cam was intended for camera-related uses.
Rightside was one of two applicants given the opportunity to appeal its SCO decision by ICANN last year, largely because two other .cam applicants managed to pass their Verisign objections with flying colors, creating obvious inconsistency.
Taryn Naidu, Rightside’s CEO, said in a statement:

We always felt strongly that the first panel’s decision was seriously flawed. How can .CAM in one application be different from the .CAM in another application when evaluated on the basis of string similarity? The fact is, it can’t.

It’s always struck me as unfair that Verisign did not get the chance to appeal the two SCOs it lost, given that the panelist in both cases was the same guy using the same thought processes.
The question now is: is the appeals panel correct?
I suppose we’ll find out after .cam goes on sale and unscrupulous domainers attempt to sell .cam names for inflated prices, hoping their would-be buyers don’t notice the difference.
The other two .cam applicants are AC Webconnecting and Famous Four Media. All three will now go to auction.

Panel throws out ludicrous .shop confusion ruling

The new gTLD strings .shop and .通販 are not too confusingly similar-looking to coexist on the internet.
While that may be blindingly obvious to anyone who is not already blind, it’s taken the ICANN process three years to arrive at this conclusion.
An August 18 ruling by a three-person International Centre for Dispute Resolution appeals panel has “reversed, replaced and superseded” a two-year-old decision by a lone String Confusion Objection panelist. The appeals panel found:

the [original] expert panel could not have reasonably come to the decision reached by it in connection with the underlying String Confusion Objection
…
The two strings indisputably have no visual or aural similarity, are in different languages, written in different scripts that look very different, and have different phonetic spellings and pronunciations.

.通販 is the Japanese for “.onlineshopping”, applied for by Amazon in the 2012 new gTLD round.
.shop is a contested string applied for by Commercial Connect and others.
The two strings were ruled dissimilar by the String Similarity Panel in February 2013, but Commercial Connect filed the SCO a few weeks later.
In an SCO, the complainant must show that it is “probable, not merely possible” that the two strings will get mixed up by internet users.
In August 2013, ICDR panelist Robert Nau ignored that burden of proof and inexplicably ruled that the two strings were too similar to coexist and should therefore be placed in a contention set.
Nau would later rule that .shop and .shopping are also confusingly similar.
The .通販 decision was widely criticized for being completely mad.
Amazon appealed the decision via the ICANN Request for Reconsideration, but predictably lost.
After much lobbying, last October ICANN’s board of directors created an appeals process for SCO decisions, but limited the appellant pool to Amazon with .通販 and applicants for .cam (which had been ruled similar to .com).
Now, 10 months later, we finally have a sane decision in the Amazon case. Its application will presumably now be removed from the .shop contention set.
Read the final ruling here.