Thanks for making this point. One of the risks to law abiding end users, who are not checking their domain registrations every day like big corporations do, is that identity theft will surely follow greater accuracy requirements. Since many governments have failed to take ownership of the problem of ID theft (I can speak knowledgeably for Canada, but plenty of international work on this topic leads me to believe the matter is falling between stools elsewhere) we need to focus on this genuine risk to end users. Not much written about it, do we have a document we can add to our list so that we can digest a potential requirement?
Thanks for
raising this, Stephanie. I do
not have any reference documents to introduce but I agree it is a potential
requirement we need to be addressing. In the case of ID theft, it is not only
the individual whose data which has been stolen who is the victim, but the
government too, albeit with different consequences. If the RDS collects what (in my view is) registrar-registrant contract information, any data breach would present a harm not only to the end-user, but also to the company whose customer's data has been stolen, perhaps for coercive purposes.
- Ayden