Statement of the gTLD Registries Constituency on the final WHOIS Task Force Report The following statement is provided by the gTLD Registries Constituency (RyC) in response to the motion approved by the GNSO Council on 6 September, 2007 instructing the representatives of the constituencies to solicit comments regarding the issue under consideration. The information is grouped as follows: I. General Information about the RyC II. Background Information about the development of the Comments III. Comments of the RyC IV. Method for Reaching Agreement on RyC Position V. Impact on Constituency VI. Time Period Necessary to Complete Implementation I. General Information Name of organization: GNSO gTLD Registries Constituency Contact Person: David W. Maher, Chair Contact email address: dmaher[at]pir.org Number of official members of the organization: 15 Estimated number of potential eligible members of the organization: 16 Number of members that participated in developing this input: 11 II. Background Information about the development of the comments The RyC comments included in this document were developed and adopted by constituency members via participation in the constituencys online mailing list and teleconference calls. All members and potential members of the constituency were encouraged to participate. Drafts of the comments were distributed via the constituency email list, which is open to all members and potential members. Participants were then asked to propose possible edits and to communicate whether or not they agree with the comments and edits. In the end, only statements for which there was consensus support were included in this document. III. Comments The RyC previously filed comments with the GNSO on January 15, 2007 on the draft Preliminary Task Force Report on Whois Services1. The final WHOIS Task Force Report of 12 March, 2007 is posted at http://gnso.icann.org/issues/whois-privacy/whois-services-final-tf-report-12.... As reported by the GNSO Secretariat, "Following completion of the Task Force Report and public comment period, on 28 March the GNSO Council issued a resolution creating a WHOIS Working Group to examine three issues and to make recommendations concerning how current policies may be improved to address these issues: 1. to examine the roles, responsibilities and requirements of the OPOC, and what happens if they are not fulfilled; 2. to examine how legitimate interests will access unpublished registration data; and 3. to examine whether publication of registration contact information should be based on the type of registered name holder (legal vs. natural persons) or the registrant's use of a domain name." The Working Group was neither able to reach consensus on these issues, nor to make recommendations concerning how current policies may be improved. There are several motions pending before the GNSO Council, all recognizing the lack of consensus and varying widely in proposals for a way forward. RyC believes that a decent respect for registrants interests in protection of personal privacy demands a change in the type of data published in the WHOIS service. There is, of course, a difference between the types of data collected by registrars, and the types of data published in the WHOIS service. RyC generally supports the concepts underlying the Registrar Constituencys OPoC proposal (although there are some practical concerns addressed below). Registrars have their own business needs for collection of registrant data, and should be able to make decisions primarily based on these needs and on the legal requirements of the jurisdictions where they operate. RyC strongly believes that there is no acceptable reason for publication of an individuals personal data such as home address, phone number or email address, whether by a registry or registrar unless that individual freely and explicitly gives consent to such publication. To the extent that such data is needed for law enforcement purposes or for the resolution of conflicts such as intellectual property, the appropriate means to meet these needs should be a tiered access process. RyC acknowledges that a tiered access model presents some policy implementation challenges but believes that it would be very worthwhile to confront those challenges in a constructive and diligent manner. As stated above, RyC generally supports the underlying concepts of the OPoC proposal. There are, however, special needs of some registries that are not addressed by OPoC. Sponsored registries, including .aero, .cat, .coop, .jobs, .museum and .travel must be able to determine the eligibility of registration applicants. The OPoC proposal does not adequately deal with these needs, but this can be remedied without sacrifice of the general concept that the collection of data should be based primarily on business needs, local law, and the need to escrow data, while the publication of data should be consistent with protection of personal privacy and local law. With respect to publication of data by registrars, RyC supports that portion of the current OPoC proposal, as follows: Accredited registrars will publish three types of data: 1) Registered Name Holder 2) Country and state/province of the registered name holder 3) Contact information of the OPoC, including name, address, telephone number, email. Also published by the registrar: date of initial registration of the domain name (creation date) expiry date, registry level data as follows: registered name, sponsoring registrar, URI of the authoritative Whois server, authoritative names associated with the registration, and status of the registered name (e.g. lock, hold, expired). With respect to publication of data by the unsponsored registries, RyC also supports the OPoC position, as follows: Registry data published is limited to: registered name identity of sponsoring registrar (i.e. registrar name, registrar IANA identification number, URL of authoritative Whois server) name server hostnames and corresponding IP addresses associated with the name status of the registered name (e.g. lock, etc.) and possibly the creation and expiry dates of the name. RyC believes that the sponsored registries should be free to determine what data should be collected for their specific needs and also to determine whether any data, beyond that listed above should be published. RyC offers the following comments on the three issues specified in the resolution creating the WHOIS Working Group: 1. " the roles, responsibilities and requirements of the OPOC, and what happens if they are not fulfilled;" 2." to examine how legitimate interests will access unpublished registration data;" The OPoC proposal in its present form does not deal with the question of access to unpublished Whois data nor did the Whois Working Group reach adequate agreement in this regard. This question must be answered in sufficient detail to provide policy direction regarding what, when, how and to whom unpublished Whois data must be released by the OPoC. Until that is done, the OPoC proposal provides a solution for accommodating privacy concerns, but does nothing to deal with the legitimate needs of access for unpublished Whois data. The RyC believes that the question of access can be dealt with separately and most appropriately by a tiered access mechanism to be developed. The RyC proposes that the GNSO Council, or the ICANN Board, take appropriate steps to encourage the parties at interest to negotiate and develop such a mechanism. 3. " whether publication of registration contact information should be based on the type of registered name holder (legal vs. natural persons) or the registrant's use of a domain name." The RyC believes that the appropriate distinction should be based on whether the name holder is a natural person with an inherent right to privacy of personal data. The RyC does not believe that there is a practical test for determining what types of use might qualify for privacy protection. IV. Method for Reaching Agreement on RyC Position RyC drafted and circulated via email a constituency statement, soliciting input from its members. RyC members suggested edits and additions to the draft which were subsequently incorporated into the final constituency statement. The statement was adopted by affirmative vote of 11 of the 15 registries. V. Impact on Constituency Adoption of the positions advocated by RyC would assist the members of the RyC in fulfilling their legal obligations in their respective jurisdictions, and would be of significant benefit through lifting burdensome contractual requirements. The impact of WHOIS changes is larger for thick registries than it is for thin, and the impact on sponsored registries can be more significant than on unsponsored registries. Any major changes would likely have considerable impact on registries and especially on registrars, in time, money and resources. VI. Time Period Necessary to Complete Implementation Completion of the OPoC proposal (or for that matter any tiered access proposal) to deal with policy and procedures to support access to non-published WHOIS data could involve considerable effort because questions must be answered prior to implementation such as the following: Who decides who gets access? How are requests for access authenticated? To whom should access be given? Who provides access? How would access be given? In addition, implementing a tiered access system would probably involve all registries and registrars migrating from the current WHOIS protocol to the IRIS protocol, a process that would undoubtedly take considerable time. RyC suggests that the time spent in addressing the above and finding a workable tiered access solution is a step in the right direction and such activity presents __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com