Forwarding on behalf of Yuko Yokoyama

 

Dear GNSO Council, 

 

In follow up to our communication from 13 March 2023, we are writing to provide you with the attached update on ICANN’s efforts related to exploring registration data accuracy in support of the Council’s Accuracy Scoping Team work. As shared previously, ICANN initially proposed four scenarios that it would assess to determine whether they could produce useful material for the Accuracy Scoping Team, taking into account current contractual requirements and applicable laws. ICANN has now concluded its assessment of the four scenarios, as well as Data Protection Impact Assessments (DIPA) on scenarios two and four, and identified several deficiencies and challenges in pursuing them. Those challenges are detailed in the attached paper which has also been shared with the ICANN Board as they originally requested this work on the scenarios to help inform the Scoping Team’s efforts. 

 

In addition to and in light of the challenges outlined in the paper that indicate that ICANN does not have a legitimate purpose that is proportionate, i.e., not outweighed by the privacy rights of the individual data subject(s) to request Contracted Parties to provide access to individual records as well as bulk access to registration data in order to review the accuracy of registration data, ICANN has identified possible alternative steps that can be taken, which may provide information that helps advance the Accuracy Scoping Team’s work, including the following: 

• Reviewing existing ICANN Contractual Compliance RAA Audit Program data: This data (see Annex A of the attached report) could be helpful in place of a full “accuracy” audit as originally identified in accuracy scenario 2. ICANN notes that Scoping Team recommendation #2 foresees further exploration of a Registrar audit, but before further considering that path, the Scoping Team could benefit from reviewing the existing data, while taking into account that any future audit will not produce information beyond compliance levels with current obligations under the RAA or more granular data than what is already available through the regular RAA audit program.  
• Engage with contracted parties on current developments with respect to European policy-making: This engagement, led by ICANN staff, will focus on the likelihood that policymakers may put forward requirements for accuracy of registration data, including verification practices, through legislation. In this case, current European ccTLD identity verification practices, which typically have more onerous registration data accuracy requirements than those for gTLDs, are likely to influence policymakers’ choices for new legislation.  

 

We note that the Council has previously sought information on negotiations regarding the Data Processing Agreement between ICANN and its contracted parties, as the Council believes that may impact further work in this regard. The options ICANN has proposed in the attached paper are not dependent on the conclusion of those negotiations. ICANN has sent a separate communication to the Council in response to the Council’s 3 August 2023 letter. 

 

ICANN stands ready to support the ongoing community discussions about the accuracy of gTLD registration data and hopes the information provided in this report will prove useful.

 

Thank you,

 

Yuko Yokoyama