<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Arial;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:595.0pt 842.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">+1 Rod<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">We’ve had and continue to have issues with people using our contact details for domain names that are no longer associated with us.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">We’ve also had the “fun” experience of nearly ending up in court due to some “charmer” unilaterally deciding to put all our contact details into the whois for a domain name that had absolutely nothing
to do with us. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Permission for contact use is not a simple topic, but it is a very important one.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Michele<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;color:black">--<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;color:black">Mr Michele Neylon<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;color:black">Blacknight Solutions<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;color:black">Hosting, Colocation & Domains<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;color:black">https://www.blacknight.com<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;color:black">https://blacknight.blog /<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;color:black">http://ceo.hosting/<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;color:black">Intl. +353 (0) 59 9183072<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;color:black">Direct Dial: +353 (0)59 9183090<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;color:black">-------------------------------<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;color:black">Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black;mso-fareast-language:EN-US">Road,Graiguecullen,Carlow,</span><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#191919;background:white">
</span><span style="font-size:10.5pt;color:black;mso-fareast-language:EN-US">R93 X265<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black;mso-fareast-language:EN-US">,Ireland Company No.: 370845</span><span style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black"><gnso-rds-pdp-wg-bounces@icann.org> on behalf of Rod Rasmussen <rod@rodrasmussen.com><br>
<b>Date: </b>Thursday 27 July 2017 at 18:23<br>
<b>To: </b>Volker Greimann <vgreimann@key-systems.net><br>
<b>Cc: </b>"gnso-rds-pdp-wg@icann.org" <gnso-rds-pdp-wg@icann.org><br>
<b>Subject: </b>Re: [gnso-rds-pdp-wg] List discussion topics<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">Clipping off most of the long thread here. <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">So, we actually discussed this issue of “contact permission" at length in the EWG and covered it in our report. At the time we were thinking more along the lines of fraudsters putting in a company’s actual contact data in various fields
of whois (say the corporate address and phone) to make it look more authentic, but keeping the all-important admin e-mail address to one of their throw-aways. This is quite common. The issue Volker brings up makes it even more important to have mechanisms
for listed contacts to approve of their information being used for the designated role. This is important for web hosting operations for example, who may be listed as the “technical contact” for a domain they haven’t hosted in many years. Such a mechanism
has to allow for that contact to opt out of their role in the future. Again, this was very nicely covered in the treatment of contacts as separate data objects that are actually controlled/edited/moved about by the contact entity themselves. When a domain
registrant wishes to list a particular contact for a role, they can either get something like a code from that entity to use ahead of time, or use an approval process. Most of this can be automated by a registrar for most domains, and corporate registrars
would be able to automate most of the more complex situations that large companies may have. This makes it easy for registrants to change contacts if they change service providers (e.g. they change law firms and need to update legal contacts) and let’s contacts
easily opt-out of handling roles for domains they no longer support (e.g. a proxy service that isn’t getting paid any more).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Again, territory where I think we did a really good job anticipating issues within the EWG - see sections III g. RDS Contact Use Authorization on pages 39-40 of the final EWG report for a description. I would suggest being familiar with
the entire section though for full context. This also ties into validation and an entity’s desire to be a globally unique contact that is touched on later in the report. The whole system described allows for contacts to ensure they are unique (non-spoofed),
know about every domain they are associated with, and know their roles for their domains - very elegant. Given the technologies and services that have been developed for automating notifications and handling of notifications for a bevy of Internet services
out there, IHMO, this is far easier to implement, maintain, and provide customer service for than many of the more manually driven processes we’ve traditionally seen in the domain name ecosystem.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Cheers,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Rod<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Jul 27, 2017, at 9:58 AM, Volker Greimann <<a href="mailto:vgreimann@key-systems.net">vgreimann@key-systems.net</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white;font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:9.0pt;font-family:"Helvetica",sans-serif">Sadly it is no longer solved as we simply cannot rely on such assurances anymore. The data processor has to ensure that the data subject has consented to the use of his data and that simply is
not the case if the single touch point is the registrant, or even his agent.<span class="apple-converted-space"> </span><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white;font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:9.0pt;font-family:"Helvetica",sans-serif">It is the data processor and the data controller that will ultimately face the consequences, not the registrant.<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white;font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:9.0pt;font-family:"Helvetica",sans-serif">And yes, identity validation is too hard and expensive for this industry and the prices people have come to expect.<span class="apple-converted-space"> </span><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white;font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:9.0pt;font-family:"Helvetica",sans-serif">And while you personally may not have heard of Admins suing a registrant, we have seen many cases where our privacy contacts (legal entity) or local presence services (legal entity or indivisual,
dependent on registry requirements) are used by registrants without permission. This usually leads to a domain delection request to the registrar or registry by the admin. And we receive requests for removal of contact data from people who did not know their
data was used on a regular basis.<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white;font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:9.0pt;font-family:"Helvetica",sans-serif">Best,<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white;font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:9.0pt;font-family:"Helvetica",sans-serif">Volker<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>