[IRT.RegDataPolicy] Tech contact consent

[Sarah Wyld]

Hello team,

There is some great discussion in the Google Doc
(https://docs.google.com/document/d/1OuZT7xL5wuV1ynVmpVNxFycU93gvPlvbzx_g9lXCYCw/edit?ts=5d2f60ce#)
about the possibility for the Tech contact to consent to publication of
their data (name, phone and email), but I think it's a bit easier to
consider it by email, so I will start this discussion and look forward
to hearing what everyone else thinks.

I see it as two separate questions, one of which is already resolved and
the other remaining open.

*1 - can the RNH grant consent for publication of Tech contact data? *

Based on comments in the doc (including mine) and Dennis's subsequent
changes, there is agreement that it is not possible for one person to
consent to publication of another person's data. So, if the RNH is also
the Tech contact, then maybe they could grant consent (if it's possible
in an automated manner for the registrar to know that these contacts are
the same, which may not be possible) but certainly if it's a different
person then this is not an option.

*2 - can the Tech contact grant consent for publication of its own data? *

Although on the surface this sounds straightforward, I think it's
actually a problem.

There is no Recommendation in the Phase 1 final report relating to the
Tech contact granting consent. Rec 5 explains what the tech contact may
be ("For the purpose of the Technical contact, which is optional for the
Registered Name Holder to complete (and if the Registrar provides this
option), Registrars are to advise the Registered Name Holder at the time
of registration that the Registered Name Holder is free to (1) designate
the same person as the registrant (or its representative) as the
technical contact; or (2) provide contact information which does not
directly identify the technical contact person concerned.") Rec 6
requires that the RNH can consent to publication ("The EPDP Team
recommends that, as soon as commercially reasonable, Registrar must
provide the opportunity for the Registered Name Holder to provide its
Consent to publish redacted contact information, as well as the email
address, in the RDS for the sponsoring registrar.") Rec 10 requires that
the tech contact is redacted. Rec 13 refers again to the RNH consenting
to publication of their data ("1) The EPDP Team recommends that the
Registrar MUST provide an email address or a web form to facilitate
email communication with the relevant contact, but MUST NOT identify the
contact email address or the contact itself, unless as per
Recommendation #6, the Registered Name Holder has provided consent for
the publication of its email address.")

Additionally, the Registrar may not have a legal basis on which to
publish the Tech contact data (again, assuming it is not known to be the
same as the RNH data). There is no contractual relationship between the
registrar and the tech contact, so 'performance of a contract' cannot be
the basis for publication, and because there is no contractual
relationship it would be improper for the registrar to communicate with
the tech contact (the registrar does not have any legal basis on which
to process the tech contact's data) even just to send them an email
about this consent request.

As such, for question 2 the answer should be no, *the Tech contact
cannot grant consent to publish their data*.

Thanks,

-- 
Sarah Wyld
Domains Product Team
Tucows
+1.416 535 0123 Ext. 1392

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/irt.regdatapolicy/attachments/20190718/5cd7ccbb/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://mm.icann.org/pipermail/irt.regdatapolicy/attachments/20190718/5cd7ccbb/signature.asc>