Hello Bret, Thanks for passing on the comment from John Levine. Note that task 3 includes the requirement: "Determine how to access data that is not available for public access."

This concern from ALAC member John Levine seems like a fair subject for inclusion in the terms of reference. Specifically, could we have a discussion about what constitutes abusive v. legitimate access to a registrar's whois data? and avenues for users claiming to be legitimate users to follow when they want/need whois access?

The starting point is to first determine the purpose for which the data is collected, the purpose of the public display of this data via WHOIS, and determine what is available for public access. Abuse in simple terms would be using the data for purposes other than which it was collected. Registrars implement various mechanisms to meet their obligations to ensure they take reasonable precautions to protect Personal Data from loss, misuse, unauthorized access or disclosure, alteration, or destruction. The mechanisms should not stop a user accessing the public data for the purpose for which it was collected and displayed. Regards, Bruce