<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">They are talking about the practical negative impact to privacy and security caused by a myopic and one-sided of whois (that everything everywhere needs to be shut off). It should be noted that the DPAs have not specified specific courses of action nor have specific courses of action be presented to them for analysis. For instance a fully free and consent driven system for GDPR impacted constituents has yet to be considered.<br><br><div id="AppleMailSignature">Sent from my iPad</div><div><br>On Apr 13, 2018, at 18:19, Rubens Kuhl <<a href="mailto:rubensk@nic.br">rubensk@nic.br</a>> wrote:<br><br></div><blockquote type="cite"><div><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">Em 12 de abr de 2018, à(s) 14:47:000, John Bambenek via gnso-rds-pdp-wg <<a href="mailto:gnso-rds-pdp-wg@icann.org" class="">gnso-rds-pdp-wg@icann.org</a>> escreveu:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="content-type" content="text/html; charset=utf-8" class=""><div dir="auto" class="">A good read from a European entity on why open and free access to whois data is both essential AND legal under GDPR. And its coming from a state sponsored entity. <div class=""><br class=""></div><div class=""><a href="https://www.circl.lu/pub/tr-53/" class="">https://www.circl.lu/pub/tr-53/</a><br class=""></div></div></div></blockquote></div><br class=""><div class=""><br class=""></div><div class="">The legal questions posed but the statement has already been discussed, so I will focus on one thing that called my attention: referring RFC 3912. First, it's a circular reference saying that WHOIS only contains non-sensitive information, so everything should be there and public. The same can be read as if something is not public, shouldn't be published in WHOIS... not that every data element should be available thru WHOIS. It also forgets to mention that the RDAP RFCs already foresee differentiated access. And finally, RFCs are interoperability definitions, not binding standards; you only need to follow them if you want to be characterized as interoperable. So they can't be used as justification to not follow the law. </div><div class=""><br class=""></div><div class="">As for them being a state sponsored entity, it would be nice if they talk to their local DPA, also a government official, get them to support their statement and discuss that with other EU DPAs. If the DPAs issue a supporting statement for that, neither ICANN or contracted parties will shy away from following it... but when it comes to data privacy, DPAs have the word. Just a comparison: if the ministry of Science & Technology says that interest rates should be lower in order to foster innovation, no bank has to follow it. If the central bank says so, that's different. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Rubens</div><div class=""><br class=""></div><div class=""><br class=""></div></div></blockquote></body></html>