Hi all,
In response to the attached document:
A) Proposal for the user group " registrants " be removed:
Reason:
a) Registrants generally do not use Whois to access their data,
they access it through their service portal with their service
provider.
b) It is not necessary for performance of contract as: see a)
c) Whois and RDAP do not provide data update functionality.
B) Proposal for the user group " end users " to be removed:
Reason:
a) End users do not have a sufficient legitimate interest that
outweighs the interest of the data subject.
b) It is impossible to differentiate commercial and
non-commercial use, which could be the only conceivable
justification for the end user to request that data and even that
is highly contestable.
c) End Users can access the public part of the registration record for listed purpose a). While purpose b) is benficial, there is no corresponding legal right that outweighs the interest of the data subject.
C) Proposal to break up User group "EU Law Enforcement into law
enforcement of applicable jurisdiction" and "law enforcement of
other jurisdiction" also add other similarly legally endowed
entities like agencies with enforcement rights that are not
strictly LEA.
Reason:
a) EU jurisdiction of LEA has no significance to Non-EU-based CPs.
b) Even within EU, LEA jurisdiction stops at country borders unless special treaty or agreement exists.
D)
Proposal to change purposes of all LEA user groups to:
"Investigation
or enforcement action within legal remit and jurisdiction,
for example investigation of cybercrime or DNS Abuse"
Reason:
a) Purposes for all LEA actors should be aligned
b) Purpose of current EU LEA user group does not require actual criminal investigation, therefore is too broad.
E) Proposal to changes of purposes in IP user group:
1) First bullet: Change "parties using a domain name" to registered name holders or their representatives"
2) Second bullet: Change
"registration data" to "domain name registration", remove
"and "respond to fraudulent use of legitimate data"
3) Remove third bullet
Reasons:
1) Users of a domain name can be anyone, not just the registrant
2) Fraudulent use of legitimate data would only be detectable if data is already available. How would such a review even get triggered if data is redacted?
3) Hard to see how this
purpose outweighs registered name holder rights to privacy.
4) IP User group only have
legitimate interest in registration data when their rights
are violated.
Remove user group: Commercial:
Reason: Wanting to buy a
domain name is not a legitimate purpose that outweighs the
rights of the registered name holders. If they wanted to
sell it, they would open other venues. If not, purchase
requests amount to unsolicited commercial mails that most
forwarding services legitimately filter out for their
customers.
Further thoughts: Academic
Researcher and Security Researcher would need much more
refining or everyone will apply as such.