[registrars] Revised draft for TF2

Tue Apr 13 21:24:06 UTC 2004

I believe that for this document we should not get into further requirements for disclosure to registrant.  As several have pointed out, it is already in the RAA and is not germane to being able to provide input to the TF, which is the primary goal.

I also support the idea of softening the language regarding bulk whois.  There is legal opinion on both sides of the question of its legality.  It is best posed as an issue of concern to registrars because of the legal interpretation provided by authorities such as George.  After all, this is simply a registrar statement of input to the TF.  Our reasoning behind can fairly raise issues, rather than state conclusions that some will debate.

Tom - I don't understand the intent behind the statement about IETF, "The term standard in this case is not only referring to the data fields that must be displayed if there is no contradicting local legislation but also to the format such data fields must have if they exist. Having said this it must be mentioned that the way the format is defined should not be part of an ICANN process but be left to the technical involved parties or technical standardization bodies like IETF."  IETF does not like to involve itself in policy decisions and it seems to me that some of the format decisions involve policy?

Also please see 3.6 - I think you meant to say email address of "admin contact" not registrant.

thanks for the hard work Tom!

Elana Broitman
Register.com
575 Eighth Avenue
New York, NY 10018
Phone (212) 798-9215
> EFax  (800) 886-2716
Fax   (212) 629-9309
ebroitman at register.com 

-----Original Message-----
From: owner-registrars at gnso.icann.org
[mailto:owner-registrars at gnso.icann.org]On Behalf Of Cute, Brian A.
Sent: Tuesday, April 13, 2004 4:57 PM
To: Paul Stahura; Tim Ruiz; ross at tucows.com; Rob Hall
Cc: registrars at dnso.org
Subject: RE: [registrars] Revised draft for TF2

An additional thought, also look at slide # 12 which states unequivocally that multicriteria searching is unacceptable.  This is the use often cited by current users of bulk whois, isn't it? 

-----Original Message-----
From: owner-registrars at gnso.icann.org
[mailto:owner-registrars at gnso.icann.org]On Behalf Of Paul Stahura
Sent: Tuesday, April 13, 2004 4:31 PM
To: 'Tim Ruiz'; Ross Rader; 'Rob Hall'
Cc: registrars at dnso.org
Subject: RE: [registrars] Revised draft for TF2

Yes, the framework is there.  We suggest that needs to be fleshed out more.

Registrars may need to spell out, for example 1) who the specific recipients
are (this can be categories but they need to be very well fleshed out and
would probably depending on what comes out of this whois process. They do
not need the exact recipient, according to eNom's interpretation of the EU
laws), 2) that the recipients and data collection is subject to ICANN's
whois and transfer policies (including a link to these policies) and subject
to change, 3) known disclosure risks 4) how the recipients use the data
etc..

Paul

-----Original Message-----
From: Tim Ruiz [mailto:tim at godaddy.com] 
Sent: Tuesday, April 13, 2004 1:08 PM
To: 'Paul Stahura'; ross at tucows.com; 'Rob Hall'
Cc: registrars at dnso.org
Subject: RE: [registrars] Revised draft for TF2

Paul, 

Don't sections 3.7.7.4 through 3.7.7.8 of the RAA already require what you
suggest regarding consent?

Tim

-----Original Message-----
From: owner-registrars at gnso.icann.org
[mailto:owner-registrars at gnso.icann.org] On Behalf Of Paul Stahura
Sent: Tuesday, April 13, 2004 12:28 PM
To: 'ross at tucows.com'; Rob Hall
Cc: registrars at dnso.org
Subject: RE: [registrars] Revised draft for TF2

1) Our GC informs me that publishing whois, even in bulk form, is not
flat-out illegal in the EU.  Providing bulk access does not require a court
order.  A court order is one means, but not the only means.  The data
subject can also consent (see next point).  No nations laws (at least that I
am aware of) prevent anyone from becoming a registrar in their jurisdiction.
The most stringent laws require informed consent.  Informed consent can be
given to individualized whois searches and to bulk access.  The basic
question is whether the data subject is informed of how the personal
information is going to be published, who will have access to it, how it
will be used, and what the known risks of disclosure are. 

2)  Consent.

	a)	Consent is the basic criteria, both in the EU and in many
other jurisdictions (even, to a lesser extent, in the US).  Registrants can
consent to having their personal information published in the whois. They do
have to be informed about what third parties are going to have access to the
data and what uses these third parties will put to the data (such as if the
third parties will be searching for TM violators or if the third parties are
known to sell the data further downstream).  Consent can be given to
individualized one-of WHOIS publications in response to specific searches.
Consent can also be given to the bulk publication of whois, provided the
bulk purchasers and their uses of the information are disclosed.  The
disclosure requirement is pretty steep, inasmuch as even known *risks* of
down-stream disclosure must be identified to achieve truly informed consent.

	b)	Consent can be obtained a priori, which, in the context of
domain name registration, mean that the ICANN required registration
agreement would include language requiring the registrant to consent to
disclosure of the personal information according to the whois and transfers
policies developed by ICANN.  This consent would link to the whois and
transfers policies, where a complete statement of the purposes, third party
access, and risks would be found.  This consent can even contractually
stipulate that the ICANN whois and transfers policies may change over time,
following ICANN's consensus procedures. 

	c) 	Consent can also be obtained after the fact, "ex post
facto."  Ex post facto consent is *almost* workable in the transfers
context.  The non-EU gaining registrar would have to include the consent
language in the transfer authorization process and in the transfer consent
email. Not an inconsiderable burden, but also not totally out of the
question.  However, after-the-fact consent would certainly not satisfy the
IP community's desire for whois information.  The IP community has no
convenient means through which it can obtain individualized ex post facto
consent. 

An ex post facto approach to obtaining consent may be an acceptable burden
to registrars in the context of transfers.  In this case, simply leave the
IP community to figure out and lobby for an a priori
ICANN-registration-agreement approach. And even then some registrars will be
playing by different rules outside the context of transfers. However, it is
unlikely that the IP community is asleep at the switch, in which case
registrars just might as well accept and work with an a priori
ICANN-registration-agreement approach to this issue.

Bottom line, eNom advocates before-hand consent because it is fairer across
registrars. ICANN should require registrars to get consent from registrants
to disclose the whois information according to the whois and transfer
policies established by ICANN from time to time.  Make that a "must have" in
the registration agreement. I really doubt if a requirement to get consent
would be illegal in any jurisdiction on the planet, therefore no registrar
would be in violation of their agreement with ICANN.  

-----Original Message-----
From: owner-registrars at gnso.icann.org
[mailto:owner-registrars at gnso.icann.org] On Behalf Of Ross Wm. Rader
Sent: Tuesday, April 13, 2004 9:31 AM
To: Rob Hall
Cc: registrars at dnso.org
Subject: Re: [registrars] Revised draft for TF2

On 4/13/2004 10:02 AM Rob Hall noted that:

Rob, inline...

> Can you tell me on what basis you say buk whois is 100% illegal in Europe
?
> 
> My understanding of your privacy laws is that you must inform the user of
> how their information will be disseminated.  Is it not true that if you
tell
> the user that you will publish their information, and give it to whoever
> applies under your bulk whois contract, that you are covered legally ?
> 
> You have informed the user of how their information is to be used, and
> distributed. It is then the users choice to continue given that they now
> know the playing field.
> 

Is your issue with the registrar constituency advocating that the bulk 
whois provisions in the contract be eliminated or the logic that 
Thomas has used to justify that position?

> You also make a statement that seems to unlink whois and transfers.  But
> they are in fact directly linked.
>

I didn't draw this same conclusion - which passage are you referring to?

> I also believe that one of the primary reasons we have a distributed whois
> for com/net is to promote competition, not lessen it.  I am at a loss as
to
> how making whois information available to the public hurts competition.  I
> believe just the opposite occurs.

I think Thomas is saying that having two standards in place (i.e. one 
based in ICANN policy and the other based in local legislation) will 
create "forum shopping". Not sure if competition is especially germane 
to this particular point.

> 
> I believe that if you unilaterally break your ICANN contract for any
reason,
> you should face enforement and penalties.  If a big european telco broke
> their ICANN contract by not providing whois anymore, I suspect they would
be
> found in breach, and no longer have a contract.  Exactly as would any
> non-european registrar who broke their contract.
> 

The key here is for the GNSO to develop policy that can be applied 
equally across all relevant jurisdictions. The current policy 
regarding Whois plays extremely close to this line - many of the 
proposals completely cross it. Any proposal that can't be implemented 
by registrars because of legal considerations needs to be discarded to 
avoid the conditions you are concerned about.

-- 

                        -rwr

                 "Don't be too timid and squeamish about your actions.
                                            All life is an experiment.
                             The more experiments you make the better."
						- Ralph Waldo Emerson

Got Blog? http://www.blogware.com
My Blogware: http://www.byte.org