<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 22 Apr 2018, at 14:46, <<a href="mailto:trachtenbergm@gtlaw.com" class="">trachtenbergm@gtlaw.com</a>> <<a href="mailto:trachtenbergm@gtlaw.com" class="">trachtenbergm@gtlaw.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" class="">
<div dir="auto" class="">
Rubens,
<div class=""><br class="">
</div>
<div class="">See some preliminary responses below to your responses. I will likely have additional ones later, but am traveling and these jump out at me:</div>
<div class=""><br class="">
</div>
<div class="">
<blockquote type="cite" class=""><span style="-webkit-text-size-adjust: auto; text-decoration: -webkit-letterpress;" class="">No contract can exempt parties from following applicable law, otherwise there would be no laws.</span></blockquote>
<br class="">
</div>
<div class="">This is not true in the U.S. In the U.S. Courts may choose to enforce some provisions in contracts even though they violate applicable law. If course I recognize that EU and EU member state law are applicable here in the relevant cases, but are you certain
that the same is not true in all EU and member state courts? Have you done legal research on this or are you just making a logical conclusion? If the latter, often times logical conclusions and how the law is drafted or applied are not the same.</div></div></div></blockquote><div><br class=""></div>Not a legal research, not a logical conclusion; it's the experience of living in a civil law country, opposed to a case law country like the US. Welcome to our side of the world. </div><div><br class=""><blockquote type="cite" class=""><div class=""><div dir="auto" class=""><div class=""> I
<span style="background-color: rgba(255, 255, 255, 0);" class=""> would also point out that we do not know that showing registrant name and email violates GDPR and there is no evidence or indication that there is not a sufficient legitimate interest to display such
that doesn't outweigh the data subject's interest in privacy. </span></div></div></div></blockquote><div><br class=""></div>You are welcome to make that point to DPAs and get them to say so. Before that happens, the many lawyers hired by contracted parties and ICANN seem to be in large agreement that they are. From the first part of the Hamilton papers:</div><div><a href="https://www.icann.org/en/system/files/files/gdpr-memorandum-part1-16oct17-en.pdf" class="">https://www.icann.org/en/system/files/files/gdpr-memorandum-part1-16oct17-en.pdf</a></div><div><br class=""></div><div>"Some of this data is
clearly personal data (e.g. the name and address of a natural person)"</div><div>" Even if the information relates only to a legal person, it
would still constitute personal data if, for instance, the company name includes
the name of an identifiable natural person, if the contact address is a natural
person’s residence or if the e-mail contact address contains the name of a natural
person. "</div><div><br class=""></div><div><br class=""><blockquote type="cite" class=""><div class=""><div dir="auto" class="">
<div class=""><br class="">
</div>
<div class="">
<blockquote type="cite" class=""><span style="-webkit-text-size-adjust: auto; text-decoration: -webkit-letterpress;" class="">While WHOIS was an useful correlation tool, other techniques such as Passive DNS(2004) have been providing real good intelligence from actual attempts
at bypassing security... so it's not fair to say that without WHOIS, everything falls apart.</span></blockquote>
<br class="">
</div>
<div class="">This could only be said by someone who does not do online enforcement on an everyday or even regular basis. As someone who does, I can assure you that WhoIs is the foundation and starting point for all online investigation and enforcement and without
it those conducting such efforts to protect everyone, including you, like law enforcement, researchers, and intellectual property owners, will be blind. This is particularly the case that the majority of attacks now are not content (i.e.) website based. Without
WhoIs that shows registrant name and email there is no effective online investigation and enforcement, plain and simple. </div></div></div></blockquote><div><br class=""></div>The problem with choosing an ad-hominem attack on someone you don't know is that it increases your odds of being wrong. I happen to take down a dozen domains a day as part of my mission as liaison to a threat intelligence community, and just last week I was coordinating a take-down of a 300+ domain set owned by a single criminal organisation. So, I'm talking from 20+ years experience and technical knowledge when I say what other avenues there are to achieve the same goals. </div><div><br class=""></div><div>And if this group wants to proceed towards a community-acceptable model, I strongly suggest to refrain from ad-hominem arguments. </div><div><br class=""></div><div><br class=""><blockquote type="cite" class=""><div class=""><div dir="auto" class="">
<div class=""><br class="">
</div>
<div class="">
<blockquote type="cite" class=""><span style="text-decoration: -webkit-letterpress; background-color: rgba(255, 255, 255, 0);" class="">"force majeure" clause that, among othe</span><span style="-webkit-text-size-adjust: auto; text-decoration: -webkit-letterpress;" class="">r things,
prevents liability from change of applicable law.</span></blockquote>
</div>
<div class=""><br class="">
</div>
<div class="">Most force majeure clauses I have seen in contracts, including those governed by EU member state law do not include change in law as a trigger. Rather they refer to things like "Acts of God", strikes, and natural disasters. But even if such clauses do
cover change in law, as I mentioned above, <span style="background-color: rgba(255, 255, 255, 0);" class="">
we do not know that showing registrant name and email violates GDPR and there is no evidence or indication that there is not a sufficient legitimate interest to display such that doesn't outweigh the data subject's interest in privacy. </span></div>
<div class=""><br class=""></div></div></div></blockquote><br class=""></div><div><a href="https://www.icann.org/en/system/files/correspondence/falque-pierrotin-to-chalaby-marby-06Dec17-en.pdf" class="">https://www.icann.org/en/system/files/correspondence/falque-pierrotin-to-chalaby-marby-06Dec17-en.pdf</a></div><div><br class=""></div><div>"ICANN and the registries would also not be able to rely on a legitimate interest for
making available all personal data in WHOIS directories to the general public."</div><div><br class=""></div><div>But as I said before, cut the middle-man and get the DPAs to say exactly what you believe is right. Then anyone not agreeing would first have to challenge that in an European court, but still comply with it in the mean time. </div><div><br class=""></div><div><br class=""></div><div>Rubens</div><div><br class=""></div><div><br class=""></div><div><br class=""></div><div><br class=""></div><br class=""></body></html>