EU body tells ICANN that 2013 RAA really is illegal

A European Union data protection body has told ICANN for a second time — after being snubbed the first — that parts of the 2013 Registrar Accreditation Agreement are in conflict with EU law.
The Article 29 Data Protection Working Party, which is made up of the data protection commissioners in all 28 EU member states, reiterated its claim in a letter (pdf) sent earlier this month.
In the letter, the Working Party takes issue with the part of the RAA that requires registrars to keep hold of customers’ Whois data for two years after their registrations expire. It says:

The Working Party’s objection to the Data Retention Requirement in the 2013 RAA arises because the requirement is not compatible with Article 6(e) of the European Data Protection Directive 95/46/EC which states that personal data must be:
“kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected”
The 2013 RAA fails to specify a legitimate purpose which is compatible with the purpose for which the data was collected, for the retention of personal data of a period of two years after the life of a domain registration or six months from the relevant transaction respectively.

Under ICANN practice, any registrar may request an opt out of the RAA data retention clauses if they can present a legal opinion to the effect that to comply would be in violation of local laws.
The Working Party told ICANN the same thing in July last year, clearly under the impression that its statement would create a blanket opinion covering all EU-based registrars.
But a week later ICANN VP Cyrus Namazi told ICANN’s Governmental Advisory Committee that the Working Party was “not a legal authority” as far as ICANN is concerned.
The Working Party is clearly a bit miffed at the snub, telling ICANN this month:

The Working Party regrets that ICANN does not acknowledge our correspondence as written guidance to support the Waiver application of a Registrar operating in Europe.
…
the Working Party would request that ICANN accepts the Working Party’s position as appropriate written guidance which can accompany a Registrar’s Data Retention Waiver Request.

It points out that the data protection commissioners of all 28 member states have confirmed that the letter “reflects the legal position in their member state”.
ICANN has so far processed one waiver request, made by the French registrar OVH, as we reported earlier this week.
Weirdly, the written legal opinion used to support the OVH request is a three-page missive by Blandine Poidevin of the French law firm Jurisexpert, which cites the original Working Party letter heavily.
It also cites letters from CNIL, the French data protection authority, which seem to merely confirm the opinion of the Working Party (of which it is of course a member).
EU registrars seem to be in a position here where in order to have the Working Party’s letter taken seriously by ICANN, they have to pay a high street lawyer to endorse it.

First European registrar to get Whois data opt-out

ICANN plans to give a French registrar the ability to opt out of parts of the 2013 Registrar Accreditation Agreement due to data privacy concerns.
OVH, the 14th-largest registrar of gTLD domains, asked ICANN to waive parts of the RAA that would require it to keep hold of registrant Whois data for two years after it stops having a relationship with the customer.
The company asked for the requirement to be reduced to one year, based on a French law and a European Union Directive.
ICANN told registrars last April that they would be able to opt-out of these rules if they provided a written opinion from a local jurist opining that to comply would be illegal.
OVH has provided such an opinion and now ICANN, having decided on a preliminary basis to grant the request, is asking for comments before making a final decision.
If granted, it would apply to “would apply to similar waivers requested by other registrars located in the same jurisdiction”, ICANN said.
It’s not clear if that means France or the whole EU — my guess is France, given that EU Directives can be implemented in different ways in different member states.
Throughout the 2013 RAA negotiation process, data privacy was a recurring concern for EU registrars. It’s not just a French issue.
ICANN has more details, including OVH’s request and links for commenting, here.

Scottish gTLD may launch before independence vote

The application for .scot, a new gTLD for Scottish people, is ahead of schedule and is likely to launch before the nation heads to voting booths for an independence referendum later this year.
Glasgow-based applicant Dot Scot Registry signed its ICANN Registry Agreement on January 23. That’s despite having a processing priority number way down the pile at 1,453.
The company had previously expected that it would launch in “early 2015”, according to a press release. Now it’s hoping to launch before the Commonwealth Games kicks off, also in Glasgow, on July 23.
If .scot moves as quickly through the remaining stages of the application process as other registries have, it could be delegated in late March, meaning general availability could come as early as June.
This means the domain is likely to be in the hands of Scots and those of Scottish heritage before the landmark independence referendum, which is set for September 18 this year.
The vote will see Scots asked “Should Scotland be an independent country?”. If the majority says “yes”, Scotland would withdraw from the United Kingdom and become fully self-governing.
Scotland’s first minister, Alex Salmond, said in the press release:

2014 is an exciting year for Scotland, and I’m delighted that this distinct online identity for the nation, and all who take an interest in Scotland, will become available this summer.

If Scotland does become the world’s newest formally recognized country, it will be eligible for its own two-character ccTLD too.
The string would be designated by the International Standards Organization and is not likely to be particularly meaningful. The only two-character strings remaining that begin with S are .sf, .sp, .sq and .sw.
The process of obtaining a ccTLD would also take at least a year after (if) Scotland is recognized by the United Nations as an independent nation, which wouldn’t be until at least 2016.
Whatever happens, .scot is going to see the light of day well before any potential Scottish ccTLD, perhaps making it the .com to the country’s .us over the long term.

Gripe sites and PPC banned in new gTLD

New gTLD registry Plan Bee expects to ban gripe sites in its forthcoming .build registry.
Its Acceptable Use and Takedown Policy (pdf), published this week, is among the strictest I’ve seen.
The gTLD was delegated last weekend. It’s going to be an open space targeted at the construction industry, but its AUP bans a lot of stuff.
As might be expected, any form of malicious hacking or spamming behavior is verboten, as is child abuse material.
Activities more often regulated today by registrar user agreements — such as piracy and counterfeiting — are also prohibited.
But the policy goes on to ban activities that are typically permitted in other TLDs, including “gripe sites” and “pay-per-click”. The AUP reads (I’ve emphasized some oddities):

Further abusive behaviors include, but are not limited to: cybersquatting, front-running, gripe sites, deceptive and⁄or offensive domain names, fake renewal notices, cross-gTLD registration scam, name spinning, pay-per-click, traffic diversion, false affiliation, domain kiting⁄tasting, fast-flux, 419 scams or if the domain name is being used in a manner that appears to threaten the stability, integrity or security of the Registry, or any of its Registrar partners and ⁄or that may put the safety and security of any registrant or user at risk.

Domains deemed abusive can be suspended or deleted by Plan Bee, under the policy.
I can see why a niche gTLD might want to build up loyalty in its associated industry by suspending gripe sites targeting construction companies, but banning “pay-per-click” is a baffling decision.
Will .build registrants be prohibited from using Google Adsense to support their sites?
The .build launch dates have not yet been revealed but it’s likely to be a matter of weeks.

Ten more new gTLDs go live

Donuts, Afilias and Atgron were the beneficiaries of 10 new gTLD delegations yesterday.
Various Donuts subsidiaries had .boutique, .bargains, .cool, .expert, .tienda (“shop” in Spanish), .tools, .watch, .works delegated, bringing the company’s total portfolio to 70 gTLDs.
Afilias had its fourth new gTLD of this round go live in the DNS root: .kim, which is expected to serve people who have the first or last name Kim.
I think it’s the first personal-name gTLD to hit the internet.
Finally, Atgron had .wed delegated. It’s going to be an unrestricted gTLD aimed at marrying couples. It will eventually compete with the currently contested string .wedding.
I have to ponder what the renewal rates are going to be like for what seems to be the first event-focused TLD.
How long before their big day will registrants register their names, and for how long afterwards will they keep the registration alive for sentimental reasons? Atgron reckons such sites stay live for about 18 months.
There are also reportedly twice half as many divorces as marriages in the US at the moment. One wonders why nobody applied for .divorce.

DotConnectAfrica files for ICANN independent review

Failed .africa gTLD applicant DotConnectAfrica has filed an Independent Review Process appeal against ICANN, it emerged today.
The nature of the complaint is not entirely clear, but in a press release DCA said it’s related to “ICANN Board decisions and actions taken with regard to DCA Trust’s application for the .africa new gTLD”.
It’s only the third time an IRP has been filed. The first two were related to .xxx; ICM Registry won its pioneering case in 2009 and Manwin Licensing settled its followup case last year.
DCA said that it’s an “amended” complaint. It turns out the first notice of IRP was sent October 23. ICANN published it December 12, but I missed it at the time.
I’d guess that the original needed to be amended due to a lack of detail. The “Nature of Dispute” section of the form, filed with the International Center for Dispute Resolution, is just a sentence long, whereas ICM and Manwin attached 30 to 60-page legal complaints to theirs.
The revised notice, which has not yet been published, was filed January 10, according to DCA.
DCA applied for .africa in the current new gTLD round, but lacked the government support required by the Applicant Guidebook for strings matching the names of important geographic regions.
Its rival applicant, South African ccTLD registry Uniforum, which does have government backing, looks set to wind up delegated, whereas ICANN has designated DCA’s bid as officially “Not Approved”.
DCA has been alleging a conspiracy — often involving DI — at almost every juncture of the process, even before it filed its application. Read more here, here and here.
To win an IRP, it’s going to have to show that it suffered “injury or harm that is directly and causally connected to the Board’s alleged violation of the Bylaws or the Articles of Incorporation”.

New gTLDs top 100 as first dot-brands hit the root

There are now 107 new gTLDs live on the internet, following the latest batch of delegations.
Sixteen strings were entered into the DNS root today, including the first two dot-brands, which are Monash University’s .monash and CITIC Group’s .中信 (“.citic” in Chinese).
.CLUB Domains, Luxury Partners and Plan Bee became freshly-minted registries with the delegations of .club, .luxury and .build while legacy gTLD registry Afiias added .red, .pink and .shiksha to its roster.
Uniregistry added five new gTLDs to the two it had delegated in an earlier batch: .gift, .guitars, .link, .photo and .pics.
The delegation of .photo means the root now has its first singular/plural clash; Donuts already owns .photos.
Finally, I-REGISTRY added .rich to its .onl and China’s CNNIC had .网络 (“.network”) and .公司 (“.company”) delegated.
UPDATE (Jan 22): This post originally overlooked the delegation of .公司. It has been updated accordingly.

Eight more new gTLDs delegated

Donuts and United TLD had a combined total of eight new gTLDs added to the DNS root zone today.
Donuts subsidiaries saw .zone, .agency, .cheap and .marketing go live, while United TLD (Demand Media/Rightside) got .dance, .democrat, .moda (Spanish for “fashion/style”) and .social.
The nic.[tld] domains all appear to be resolving, albeit to the registries’ web sites in other TLDs.
There are now 91 new gTLDs live in the root, more than five times the number of legacy gTLDs. It seems likely that we’re going to pass 100 this week.

Cops can’t block domain transfers without court order, NAF rules

Law enforcement and IP owners were dealt a setback last week when the National Arbitration Forum ruled that they cannot block domain transfers unless they have a court order.
The ruling could make it more difficult for registrars to acquiesce to requests from police trying to shut down piracy sites, as they might technically be in breach of their ICANN contracts.
NAF panelist Bruce Meyerson made the call in a Transfer Dispute Resolution Policy ruling after a complaint filed by EasyDNS against Directi (PublicDomainRegistry.com).
You’re probably asking right about now: “The what policy?”
I had to look it up, too.
TDRP, it turns out, has been part of the ICANN rulebook since the Inter-Registrar Transfer Policy was adopted in 2004.
It’s designed for disputes where one registrar refuses to transfer a domain to another. As part of the IRTP, it’s a binding part of the Registrar Accreditation Agreement.
It seems to have been rarely used in full over the last decade, possibly because the first point of complaint is the registry for the TLD in question, with only appeals going to a professional arbitrator.
Only NAF and the Asian Domain Name Dispute Resolution Centre are approved to handle such cases, and their respective records show that only one TDRP appeal has previously filed, and that was in 2013.
In the latest case, Directi had refused to allow the transfer of three domains to EasyDNS after receiving a suspension request from the Intellectual Property Crime Unit of the City of London Police.
The IPCU had sent suspension requests, targeting music download sites “suspected” of criminal activity, to several registrars.
The three sites — maxalbums.com, emp3world.com, and full-albums.net — are all primarily concerned with hosting links to pirated music while trying to install as much adware as possible on visitors’ PCs.
The registrants of the names had tried to move from India-based Directi to Canada-based EasyDNS, but found the transfers denied by Directi.
EasyDNS, which I think it’s fair to say is becoming something of an activist when it come to this kind of thing, filed the TDRP first with Verisign then appealed its “No Decision” ruling to NAF.
NAF’s Meyerson delivered a blunt, if reluctant-sounding, win to EasyDNS:

Although there are compelling reasons why the request from a recognized law enforcement agency such as the City of London Police should be honored, the Transfer Policy is unambiguous in requiring a court order before a Registrar of Record may deny a request to transfer a domain name… The term “court order” is unambiguous and cannot be interpreted to be the equivalent of suspicion of wrong doing by a policy agency.
To permit a registrar of record to withhold the transfer of a domain based on the suspicion of a law enforcement agency, without the intervention of a judicial body, opens the possibility for abuse by agencies far less reputable than the City of London Police.

That’s a pretty unambiguous statement, as far as ICANN policy is concerned: no court order, no transfer block.
It’s probably not going to stop British cops trying to have domains suspended based on suspicion alone — the Metropolitan Police has a track record of getting Nominet to suspend thousands of .uk domains in this way — but it will give registrars an excuse to decline such requests when they receive them, if they want the hassle.

Two new gTLD apps pass EE

While the industry’s attention may be focused — rightly — on new gTLD sunrise periods and launch plans, a handful of applicants are still slogging their way through ICANN evaluation.
Two more applications passed Extended Evaluation this week — Locus Analytics’ dot-brand .locus and DotPlace’s .place.
Both had failed Initial Evaluation in 2013 due to a lack of provided financial statements.
While .locus is uncontested and can now proceed to contracting, testing and delegation, .place has also been applied for by Donuts so will presumably be auctioned off.