Just before ICANN 61, ICANN and its community received essential information regarding WHOIS and the GDPR and more.
The latest statement and recommendations are from the Berlin Group (International Working Group on Data Protection in Telecommunications and Media or IWGDPT).
The Berlin Group started out in 1983 on the initiative of some national data protection authorities; nowadays members include government agencies, representatives of international organizations and IT experts from all over the world.
So basically we have the opinion on ICANN and registrant data and WHOIS vetted by all the members of the International Conference of Data Protection and Privacy Commissioners from around the world (see https://icdppc.org/ ).
And let me put this into perspective for you as a reader. There are 122 countries with data protection laws, this opinion, is not just the opinion of a few EU DPA’s, far from it.
A few highlights from the report.
First, the report describes the current procedure for registrars regarding WHOIS and conflicts with data protection law. This procedure created in 2006 is currently not workable for registrars, and the report explains why it is barely used.
Moving on.
The report sets out that the data collection as required by the RAA 2013 (the contract between ICANN and registrars) appear to be excessive, disproportionate and obtained without free consent. My personal opinion, it is not a matter of appearance, it is the reality.
WHOIS
The Berlin group observes that publication of personal data in the WHOIS is a no go, and data gathered by service providers creates barriers for registrants to have their data removed. The examples cited are DomainIQ and Domain Tools. Anyone who knows a little about the DNS knows that it does not stop with those two companies, we are talking hundreds of companies who harvest WHOIS data.
Recommendations extracts.
1 All current WHOIS purposes for several stakeholders are not necessarily legitimate purposes and require remediation.
2 Purpose, purpose, purpose, only process data necessary for the registration of the domain name and not beyond.,
3 LEA’s should get access to a tiered WHOIS system.
Private sector security firms, to have access to such a tiered system seems to be very problematic.
4 Data retention requirements and the RAA 2013 should be re-examined.
5 Reverse WHOIS is not a given and so is bulk data capture in the new WHOIS/RDS
6 Transborder data flow.
This advice relates to the upcoming (but still in limbo) Thick WHOIS migration. The Berlin Group is somewhat skeptical here and recommends to limit data flows when necessary. In my opinion, there is zero reason to replicate data registrant databases and centralize them at registries. It is a data breach waiting to happen, and it will happen.
7 ICANN should take into account that data from small businesses, sole contracts, home businesses, start-ups may contain personal data.
There are several ICANN stakeholders, who push for a distinction between commercial and personal data.
The Berlin Group notes that there is a distinction, but it does not mean that it is up to ICANN or the WHOIS to make such a difference.
In most cases, if not all, regional law or national law requires companies to publish their contact data on their website(s) NOT the WHOIS.
8 There are, as mentioned earlier 122 countries with data protection laws, ICANN should make sure it is compliant with the highest data protection requirements.
Let us hope that ICANN takes the recommendations seriously and goes back to its core function.
The Berlin Group recommendations can be read in full here.