Hello All, I pass this message on to the Council as part of the public comments regarding the current WHOIS recommendation before the Council. This comment was referenced during our recent GNSO Council teleconference. Regards, Bruce To the ICANN GNSO Council, I have been asked to provide an opinion regarding the proposal to adopt a WHOIS "privacy" policy that simply requires the registrars to provide information about the purpose of the WHOIS service, third-party bulk access, and the categories of information for the registered name holder that will be made available to the public. The current proposal does not advise registrants of any legal rights they may have. It does not provide a redress mechanism if their personal information is misused. It lacks transparency as to the disclosure of their data. And it fails to provide basic contact information for the person responsible for the data.

From the perspective of privacy protection, the current proposal is more likely to undermine Internet privacy than it is to protect it. In this context, notice operates as a disclaimer, i.e. it provides a "take it or leave it" proposition to the registrant. There are not even obligations established to safeguard the data that is collected.

The only theoretical basis for a notice-based privacy regime is where there are market-based alternatives that would allow an individual to select from among competing policies But since the ICANN seeks to establish a policy that will cover all registrars, there is no market-based alternative. I would urge you to establish a privacy policy for WHOIS data based on Fair Information Practices. Simply stated, this approach would establish responsibilities for those entities that collect and use personal information and rights for those who are asked to provide personal information. This is the basis of privacy laws all around the world. Significantly, this is also the approach taken in policy frameworks that seek to facilitate the flow of personal information across national borders. This includes, for example, the OECD Privacy Guidelines of 1981 and the recently adopted APEC Privacy Framework. Thank you for your consideration of these views. Sincerely, Marc Rotenberg EPIC REFERENCES APEC Privacy Framework (2004) OECD Privacy Guidelines (1981) M. Rotenberg, "The Privacy Law Sourcebook: United States Law, International Law, and Recent Developments" (EPIC 2003) M. Rotenberg, "Fair Information Practices and the Architecture of Privacy (What Larry Doesn't Get)" 2001 Stanford Technology Law Review 1. D. Solove, M. Rotenberg, "Information Privacy Law" (Aspen 2003)