<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""><br class=""></div><div class=""><br class=""></div><div class="">I was reading the COA suggested framework for privacy laws compliance, available at <a href="https://www.icann.org/en/system/files/files/gdpr-cm2-coa-proposal-details-21dec17-en.pdf" class="">https://www.icann.org/en/system/files/files/gdpr-cm2-coa-proposal-details-21dec17-en.pdf</a> , and noted the suggestion that someone could self-certify for a purpose. Is that really viable on a global scale ? I understand that a good number of common law jurisdictions allow for it, but those that make a false representation can face consequences... for instance, are there consequences that can be imposed on someone that said would access RDS to enforce IP rights and ends up spamming registrants ? If we do provide penalties, can we be sure they are being applied on the right individual ? </div><div class=""><br class=""></div><div class="">While I like the scale advantages and simplifying nature of self-certification, it seems there is something lacking if we are going to use such in RDS. One example of this not working is CZDS, where spammers get the information for newly registered domains and send commercial solicitations, usually of a deceiving nature, for registrants on WHOIS records. It has terms and conditions that would prohibit such activity, with no success whatsoever.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Rubens</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>