<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">Em 12 de abr de 2018, à(s) 14:47:000, John Bambenek via gnso-rds-pdp-wg <<a href="mailto:gnso-rds-pdp-wg@icann.org" class="">gnso-rds-pdp-wg@icann.org</a>> escreveu:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="content-type" content="text/html; charset=utf-8" class=""><div dir="auto" class="">A good read from a European entity on why open and free access to whois data is both essential AND legal under GDPR. And its coming from a state sponsored entity. <div class=""><br class=""></div><div class=""><a href="https://www.circl.lu/pub/tr-53/" class="">https://www.circl.lu/pub/tr-53/</a><br class=""></div></div></div></blockquote></div><br class=""><div class=""><br class=""></div><div class="">The legal questions posed but the statement has already been discussed, so I will focus on one thing that called my attention: referring RFC 3912. First, it's a circular reference saying that WHOIS only contains non-sensitive information, so everything should be there and public. The same can be read as if something is not public, shouldn't be published in WHOIS... not that every data element should be available thru WHOIS. It also forgets to mention that the RDAP RFCs already foresee differentiated access. And finally, RFCs are interoperability definitions, not binding standards; you only need to follow them if you want to be characterized as interoperable. So they can't be used as justification to not follow the law. </div><div class=""><br class=""></div><div class="">As for them being a state sponsored entity, it would be nice if they talk to their local DPA, also a government official, get them to support their statement and discuss that with other EU DPAs. If the DPAs issue a supporting statement for that, neither ICANN or contracted parties will shy away from following it... but when it comes to data privacy, DPAs have the word. Just a comparison: if the ministry of Science & Technology says that interest rates should be lower in order to foster innovation, no bank has to follow it. If the central bank says so, that's different. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Rubens</div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>