<html><div style='background-color:'><DIV class=RTE>
<P>I will look at this.</P>
<P>But, as Tim says, this discussion isn't about privacy policies per se. </P>
<P> </P>
<P>It is about where the notice and consent statements are provided. </P>
<P> </P>
<P>Tim, as to what lawyers think about "clear and conspicious" -- as someone who did a lot of work on the online privacy policy initiative in the US and in the negotiations with the Euros on safe harbor, BUT is not a lawyer, only a pragmatic business/policy type, you are right to note that you can get a range of views on intrepretations of words.</P>
<P> </P>
<P>The offer i made of the language was to achieve an outcome. I'm not wedded to that phrase, only to the concept of having the registrant informed. </P>
<P>How about we all think of a pragmatic approach,and then we instruct the lawyers to help us? Isn't that the right approach, after all, for legal guidance? </P>
<P>I recall that we were often able to turn to the legal counsel, Louie Touton, for such advice. Perhaps we should be asking for consultation -- not advice, at this stage -- with the ICANN legal team on this interpretation. </P>
<P> </P>
<P> </P>
<P><BR><BR> </P><BR><BR><BR>>From: Tim Ruiz <tim@godaddy.com><BR>>Reply-To: Tim Ruiz <tim@godaddy.com><BR>>To: Bruce Tonkin <Bruce.Tonkin@melbourneit.com.au><BR>>CC: gnso-dow123@gnso.icann.org, council@gnso.icann.org<BR>>Subject: RE: [gnso-dow123] Proposed consensus recommendation on improving notification to Registered Name Holders of the public access to contact data via the WHOIS service<BR>>Date: Sun, 26 Jun 2005 07:52:43 -0700<BR>><BR>>Bruce,<BR>><BR>>This is only a slight improvement. I say that because of this part of<BR>>your draft:<BR>><BR>>"...(1) above, and how to make the information available to the<BR>>Registered Name Holder through means in<BR>>addition to the registration agreement (e.g as part of the registration<BR>>process, or via a privacy policy)."<BR>><BR>>That seems to put it right back to
having many of the same problems as<BR>>before. If the notice is "clear and conspicuous" in the registration<BR>>agreement, and the registration agreement has to always be accessible<BR>>by the registrant, then why does it need to be available somehow in<BR>>addition to that?<BR>><BR>>If we want to put a requirement on Registrars to have a privacy<BR>>statement, I have no problem with that. And if we want to require that<BR>>this notice be a part of that privacy statement, that is also<BR>>reasonable. But I would prefer that the recommendation be specific, and<BR>>not so open ended that we have no idea of what will come out of the<BR>>other end when actually implemented by ICANN. I would suggest that<BR>>section quoted above be removed.<BR>><BR>>Also, I will be interested in the what lawyers among think about the<BR>>"clear and conspicuous"
verbiage.<BR>><BR>>Tim<BR>><BR>>-------- Original Message --------<BR>>Subject: [gnso-dow123] Proposed consensus recommendation on improving<BR>>notification to Registered Name Holders of the public access to contact<BR>>data via the WHOIS service<BR>>From: "Bruce Tonkin" <Bruce.Tonkin@melbourneit.com.au><BR>>Date: Sat, June 25, 2005 4:25 am<BR>>To: council@gnso.icann.org<BR>>Cc: gnso-dow123@gnso.icann.org<BR>><BR>>Hello All,<BR>><BR>>Building on the work of the WHOIS task force, and the discussion on the<BR>>GNSO Council to reach consensus, the following is a proposed consensus<BR>>recommendation.<BR>><BR>>I have put the recommendation in the context of solving a problem within<BR>>ICANN's mission - ie that of security. I expect that there will also<BR>>be benefits outside of ICANN's mission -
including consumer protection<BR>>(which includes privacy protection), but these are not addressed<BR>>directly.<BR>><BR>>I welcome feedback and suggestions for improvement.<BR>><BR>>The recommendation (or as it is refined on the Council mailing list)<BR>>will be on the agenda for the GNSO Council meeting in Luxembourg, and I<BR>>encourage Council members to discuss it with their constituencies in<BR>>Luxembourg.<BR>><BR>>Finally I would like to thank the members of the WHOIS task force for<BR>>their work in this area.<BR>><BR>>Regards,<BR>>Bruce Tonkin<BR>><BR>><BR>>(I) Background<BR>>===============<BR>><BR>>The obligations of a registrar are governed by the Registrar<BR>>Accreditation Agreement (RAA)<BR>>(http://www.icann.org/registrars/ra-agreement-17may01.htm) and<BR>>ICANN consensus
policies<BR>>(http://www.icann.org/general/consensus-policies.htm).<BR>><BR>>The obligations of a Registered Name Holder (Registrant) is governed by<BR>>an electronic or paper registration agreement with the Registrar. Each<BR>>Registrar's agreement is different, and Registered Name Holders (or<BR>>their agents) should review each agreement when making their choice of<BR>>Registrar.<BR>><BR>>A registrar is obligated by the RAA to require a Registered Name Holder<BR>>to agree to provide to the registrar accurate and reliable contact<BR>>details and promptly correct and update them during the term of the<BR>>Registered Name registration (clause 3.7.7.1 of the RAA).<BR>><BR>>A registrar is obligated by the RAA to, at its expense, provide an<BR>>interactive web page and a port 43 Whois service providing free public<BR>>query-based
access to up-to-date (i.e., updated at least daily) data<BR>>concerning all active Registered Names sponsored by the Registrar<BR>>(clause 3.3.1 of the RAA). In addition a Registrar must provide<BR>>third-party bulk access to the data (clause 3.3.6 of the RAA).<BR>><BR>>A registrar is obligated by the RAA to provide notice in the<BR>>registration agreement with the Registered Name Holder stating:<BR>><BR>>(a) The purposes for which any Personal Data collected from the<BR>>applicant are intended;<BR>><BR>>(b) The intended recipients or categories of recipients of the data<BR>>(including the Registry Operator and others who will receive the data<BR>>from Registry Operator);<BR>><BR>>(c) Which data are obligatory and which data, if any, are voluntary; and<BR>><BR>>(d) How the Registered Name Holder or data subject can
access and, if<BR>>necessary, rectify the data held about them.<BR>><BR>><BR>><BR>>(II) Problem statement with respect to ICANN's mission and Core Values<BR>>=====================================================================<BR>><BR>>From Article 1, Section 1 of the ICANN Bylaws<BR>>(http://www.icann.org/general/bylaws.htm#I ):<BR>><BR>>"The mission of The Internet Corporation for Assigned Names and Numbers<BR>>("ICANN") is to coordinate, at the overall level, the global Internet's<BR>>systems of unique identifiers, and in particular to ensure the stable<BR>>and secure operation of the Internet's unique identifier systems. In<BR>>particular, ICANN:<BR>><BR>>1. Coordinates the allocation and assignment of the three sets<BR>>of unique identifiers for the Internet, which are<BR>><BR>>a. Domain names (forming a system referred to
as "DNS");<BR>><BR>>b. Internet protocol ("IP") addresses and autonomous system<BR>>("AS") numbers; and<BR>><BR>>c. Protocol port and parameter numbers.<BR>><BR>>2. Coordinates the operation and evolution of the DNS root name<BR>>server system.<BR>><BR>>3. Coordinates policy development reasonably and appropriately<BR>>related to these technical functions."<BR>><BR>><BR>>In addition one of ICANN's core values is:<BR>>"Preserving and enhancing the operational stability, reliability,<BR>>security, and global interoperability of the Internet." (Core value 1,<BR>>from Article 1, section 2)<BR>><BR>><BR>>The problem with the current system is that although registrars are<BR>>required to include information in the registration agreement on the<BR>>purposes for which data is collected and the intended recipients of
the<BR>>data, the information is often hard to find in long agreements, and<BR>>often the information does not explicitly explain that personal data is<BR>>freely available to third parties via the WHOIS service (for example<BR>>sometimes a registrar makes a general statement such as that the<BR>>information is provided to third parties in accordance with ICANN<BR>>policies).<BR>><BR>>Many registrants that reside in locations where strong privacy laws<BR>>exist, would not expect their personal data to be used for anything<BR>>other than the registration and renewal of a domain name, and the<BR>>authentication of an entity claiming to be the registrant. In some<BR>>locations a registrant must have the option to opt-in or opt-out of<BR>>making the data provided for a registration available for any
other<BR>>purpose.<BR>><BR>>The lack of knowledge amongst Registered Name Holders can lead to<BR>>security problems for domain names. Many Registered Name Holders<BR>>provide Personal information to companies that can be used by those<BR>>companies for authentication (for example home billing address), and<BR>>provide public information (such as post office box and business<BR>>telephone number, typically via websites, whitepages and yellow pages<BR>>services) suitable for third parties to contact the Registered Name<BR>>Holders. Without an understanding of the obligation of a registrar to<BR>>publish information to the public via a WHOIS service, Registered Name<BR>>Holders may be inadvertently releasing information to the public<BR>>normally used for authentication. This assists domain name hijackers<BR>>(and
those using stolen credit cards) to pretend to be the Registered<BR>>Name Holder.<BR>><BR>>Thus the problem falls under the ICANN mission, and in particular the<BR>>first core value.<BR>><BR>><BR>>(III) Proposed Consensus Recommendation<BR>>=======================================<BR>><BR>>(1) Registrars must provide notice in the registration agreement with<BR>>the Registered Name Holder that is easy to find, clear, and conspicuous<BR>>within the registration agreement stating:<BR>><BR>>(a) The purposes of the WHOIS service, which consists of the provision<BR>>of an interactive web page and a port 43 Whois service providing free<BR>>public query-based access to up-to-date (i.e., updated at least daily)<BR>>data concerning all active Registered Names sponsored by the Registrar.<BR>>In addition the WHOIS service includes the provision
of third-party bulk<BR>>access to the data.<BR>><BR>>(b) The purposes of the Registered Name Holder, technical, and<BR>>administrative contacts<BR>><BR>>(c) Which of the contact data in (b) will be made public via the WHOIS<BR>>service in (a).<BR>><BR>><BR>>(2) ICANN must provide on its website information on industry best<BR>>practice to meet the obligation in (1) above, and how to make the<BR>>information available to the Registered Name Holder through means in<BR>>addition to the registration agreement (e.g as part of the registration<BR>>process, or via a privacy policy).<BR>><BR>>The proposed recommendation will ensure that Registered Name Holders<BR>>provide contact information that is appropriate for public access and<BR>>sufficient for third parties to contact them in accordance with the<BR>>purposes of the WHOIS
service. The purposes will be refined as part of<BR>>the current WHOIS task force work. Information (which may include<BR>>Personal Data) that can be used for authentication and billing purposes<BR>>will be separately provided to registrars.<BR>><BR></DIV></div></html>