Summary:

This document is a letter from the European Data Protection Supervisor to ICANN in response to its 2013 public consultation on the RAA Data Retention Specification Data Elements and Potentially Legitimate Purposes for Collection/Retention ('the draft Specification').
The draft Specification “falls short of compliance with European data protection law.”
“The draft Specification should only require collection of personal data which is genuinely necessary for the performance of the contract between the Registrar and the Registrant (e.g. billing) or for other compatible purposes such as fighting fraud related to domain name registration. This data should be retained for no longer than is necessary for these purposes. It would not be acceptable for the data to be retained for longer periods or for other, incompatible purposes, such as law enforcement purposes or to enforce copyright.”
The “retention of personal data originally collected for commercial purposes, and subsequently retained for law enforcement purposes … [is] invalid.”
ICANN is encouraged “to take a lead in ensuring that privacy and data protection are embedded by default, when new tools and instruments or new Internet policies are designed, for the benefit of all – not just European – Internet users.”

Ayden Férdeline