- Whois-iag-volunteers - lists.icann.org

Scheduling IAG-WHOIS Conflicts call, June 3rd
by Maria Otanes May 21, 2015

May 21, 2015

Hello all, The next IAG-WHOIS Conflicts call will be held on Wednesday, June 3rd. Please complete the Doodle Poll below with your preferred time by Wednesday, May 27th. The available times are: 13:00 UTC 18:30 UTC 23:00 UTC http://doodle.com/x7g9258vcht4zqxf Best, Maria Otanes

1 0

News from Brazil
by Alyne Andrade May 11, 2015

May 11, 2015

Hello Everybody, In this week, was noticed a site “*nomesbrasil.com <http://nomesbrasil.com>” in Brazil. * *The site show *personal data of Brazilian citizens, such as full name and the registration of individual (number which may indicate the financial situation). This site violated the Marco Civil of Internet and the Consumer Protection Code. The the Ministry of Justice notified the goddady provider to seek information about this domain name. The penalties for irregularities may reach $ 7.2 million. This site (“*nomesbrasil.com <http://nomesbrasil.com>”) *use of domain names for illegal and abusive activities. However, Nomesbrasil.com is hosted in United States by GoDaddy.com, LLC. jQuery was not found on the site. More details can be found in Section server. http://sitemacro.com/www/pt/nomesbrasil.com#server-properties-section http://sitemacro.com/www/pt/nomesbrasil.com http://www.tribunadabahia.com.br/2015/05/06/invasao-de-privacidade-generali… http://www.procon.sc.gov.br/index.php/outros-destaques/766-ministerio-da-ju… The databases with personal information of citizens collected illegally are common and used by criminals for various types of fraud. They can buy things in other names, get some kind of credit. Unfortunately, it is not difficult, being in possession of the data, practicing criminal actions. The person (who had the stolen data) could end up with a debt. But usually criminals have no significant credit without the signature of the person. The Ministry of Justice wants to know who is responsible for this site. How to make sure the IP address? How to protect the personal data of citizens of sites that hide to avoid any legal penalties? Is a cyber war of personal data control? Do you believe that they can find the responsible of this site? Best Regards, Alyne Andrade. President of the IBDI http://www.ibdi.org.br/site/ https://www.facebook.com/groups/ibdi.grupo/?fref=ts

5 5

Re: [IAG-WHOIS conflicts] IAG-WHOIS Conflicts call
by James Gannon May 6, 2015

May 6, 2015

Hey Maria, Quick question is there any way we could have the audio option turned on for the adobe connect sessions so that we can just connect directly from our computers/devices and not have to dial in? Possibly not in time for today's call but for any future ones? -James -----Original Appointment----- From: Maria Otanes [mailto:maria.otanes@icann.org] Sent: Thursday, April 23, 2015 4:48 PM To: Maria Otanes; whois-iag-volunteers(a)icann.org Subject: [IAG-WHOIS conflicts] IAG-WHOIS Conflicts call When: Wednesday, May 06, 2015 6:30 PM-8:00 PM (UTC) Coordinated Universal Time. Where: See Audio Access below for meeting access information. 18:30-20:00 UTC http://www.timeanddate.com/worldclock/fixedtime.html?msg=IAG-WHOIS+Conflict… Agenda to follow. ---------------------------------------------------------- Link to Adobe Connect: https://icann.adobeconnect.com/iag-whois/ ***Upon logging into Adobe Connect, a pop up window will provide you the option to dial out to your phone. Enter your phone number, + country, phone number*** If you are unable to log into Adobe Connect and can only join via phone or Skype: [Select *6 to mute and unmute on the call] International Dial In Numbers: https://www.myrcplus.com/cnums.asp?bwebid=8369444&ppc=3515982074&num=1-719-… Participant Passcode: 351 598 2074 << File: ATT00001.txt >>

8 11

Re: [IAG-WHOIS conflicts] Discussion paper for 1 April 2015 meeting
by arbitrator May 6, 2015

May 6, 2015

When comparing the Icann standard registry agreement with the EU privacy data protection regulations, for instance, it is obvious to me that the contractual provisions have no conflict with these regulations. That might explain why no one had invoked the procedure in all these years. I invite my colleagues to consider the issues in the context of the case before us. Sorry for missing the upcoming call. Best, Raymond Raymond HO <arbitrator(a)raymondho.com> wrote: >Thanks, Steven. > > > >I respectfully invite you to consider the goals for the procedure as highlighted in resolution 20051128-05 below: > >“20051128-05 > > The GNSO votes in favour of the following consensus policy recommendation from the WHOIS task force CONSENSUS POLICY RECOMMENDATION > > In order to facilitate reconciliation of any conflicts between local/national mandatory privacy laws or regulations and applicable provisions of the ICANN contract regarding the collection, display and distribution of personal data via the gTLD WHOIS service, ICANN should: > > Develop and publicly document a procedure for dealing with the situation in which a registrar or registry can credibly demonstrate that it is legally prevented by local/national privacy laws or regulations from fully complying with applicable provisions of its ICANN contract regarding the collection, display and distribution of personal data via the gTLD WHOIS service. > > Create goals for the procedure which include: > > Ensuring that ICANN staff is informed of a conflict at the earliest appropriate juncture; > > Resolving the conflict, if possible, in a manner conducive to ICANN's Mission, applicable Core Values and the stability and uniformity of the Whois system; > > Providing a mechanism for the recognition, if appropriate, in circumstances where the conflict cannot be otherwise resolved, of an exception to contractual obligations to those registries/registrars to which the specific conflict applies with regard to collection, display and distribution of personally identifiable data via the gTLD WHOIS service; and > > Preserving sufficient flexibility for ICANN staff to respond to particular factual situations as they arise. > > As regards the applicable contractual provisions regarding the collection, display and distribution of personal data via the gTLD WHOIS service, I think it might be helpful to review the standard Registry Agreement https://www.icann.org/resources/pages/registries/registries-agreements-en, in particular, clause 2.18 and Specification 4 reproduced below: > > > > 2.18 Personal Data. Registry Operator shall (i) notify each ICANN-accredited registrar that is a party to the

3 2

Discussion paper for 1 April 2015 meeting
by Jamie Hedlund May 6, 2015

May 6, 2015

All, Attached please find a short paper for the upcoming call. It is intended to spur discussion on whether the trigger could be modified so long as adequate verification requirements were in place. The paper follows on from contributions to the discussions to date. This is the only proposed agenda item. Based on how the call goes, we can spend the last 10 minutes or so discussing next steps. If anyone would like to add anything to the agenda please let me know. Thanks. Best, Jamie Jamie Hedlund VP, Strategic Programs Global Domains Division ICANN +1.202.374.3969 (m) +1.202.570.7125 (d) jamie.hedlund(a)icann.org

9 24

Re: [IAG-WHOIS conflicts] Discussion paper for 1 April 2015 meeting
by Michele Neylon - Blacknight May 6, 2015

May 6, 2015

+1 I agree 100% with James’ view on this The trigger needs to be reasonable and proportional As a registrar based in Ireland I cannot get the DPA or another body to issue anything – that’s not how they work. It’s not how they are setup. They will, however, express their opinion via Article 29. And the only reason that the DPA in Ireland isn’t pursuing this actively is because they’re too busy with the likes of Facebook .. The DPAs are on the record on multiple occasions as to how they view the ICANN whois requirements and their obligations on registrars and registries – just look at any of the letters from Article 29 to ICANN over the last few years Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://www.blacknight.press - get our latest news & media coverage http://www.technology.ie Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Random Stuff: http://michele.irish ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845 From: James Gannon Date: Wednesday 6 May 2015 09:13 To: Steven Metalitz, 'Jamie Hedlund', "whois-iag-volunteers(a)icann.org<mailto:whois-iag-volunteers@icann.org>" Subject: Re: [IAG-WHOIS conflicts] Discussion paper for 1 April 2015 meeting Steve, I made a point of the google doc that there is a huge imbalance, the final decision-making rests with ICANNS General Council so why can’t we have something approaching parity, why can’t a registrar have counsel advise them and have that sent to ICANNs counsel as the trigger? I still don’t see the national bodies, with power of enforcement, issuing letters saying they intend to enforce the law ever happening. It’s an unreasonable request. -James Gannon From: whois-iag-volunteers-bounces(a)icann.org<mailto:whois-iag-volunteers-bounces@icann.org> [mailto:whois-iag-volunteers-bounces@icann.org] On Behalf Of Metalitz, Steven Sent: Wednesday, May 06, 2015 1:08 AM To: 'Jamie Hedlund'; whois-iag-volunteers(a)icann.org<mailto:whois-iag-volunteers@icann.org> Subject: Re: [IAG-WHOIS conflicts] Discussion paper for 1 April 2015 meeting Jamie and IAG-WHOIS colleagues, In response to Jamie’s paper, and the limited discussion we were able to have about it on last month’s call, please see attached some ideas for an alternative trigger mechanism aimed at meeting the “credible demonstration of legal prevention” threshold set by the ICANN consensus policy on this topic. I look forward to discussing this on tomorrow’s call, which I will endeavor to attend as much as I can, although it conflicts directly with another obligation on my calendar. Steve Metalitz From: Jamie Hedlund [mailto:jamie.hedlund@icann.org] Sent: Tuesday, March 31, 2015 5:17 PM To: Metalitz, Steven; whois-iag-volunteers(a)icann.org<mailto:whois-iag-volunteers@icann.org> Subject: Re: Discussion paper for 1 April 2015 meeting Steve, Thanks for pointing out the overlap. You are absolutely correct on all points. The discussion paper tries to tee up for discussion whether a package of verification elements that did not include notice of a process against an operator could meet the "credible demonstration of legal prevention" threshold. That package might include advice from the relevant GAC member, opinion from the ICANN GC, evidence of enforcement or intent to enforce the conflicting national privacy law, public comment and/or something else. Hope that makes sense. Look forward to tomorrow’s call. Thanks. Best, Jamie Jamie Hedlund VP, Strategic Programs Global Domains Division ICANN +1.202.374.3969 (m) +1.202.570.7125 (d) jamie.hedlund(a)icann.org<mailto:jamie.hedlund@icann.org> From: <Metalitz>, Steven Metalitz <met(a)msk.com<mailto:met@msk.com>> Date: Tuesday, March 31, 2015 at 5:02 PM To: Jamie Hedlund <jamie.hedlund(a)icann.org<mailto:jamie.hedlund@icann.org>>, "whois-iag-volunteers(a)icann.org<mailto:whois-iag-volunteers@icann.org>" <whois-iag-volunteers(a)icann.org<mailto:whois-iag-volunteers@icann.org>> Subject: RE: Discussion paper for 1 April 2015 meeting Thanks for this discussion paper, Jamie, it should be helpful in framing our discussion tomorrow. As one aspect of the discussion tomorrow we should take a look at the existing procedure, as there may be some overlap with what you are proposing. For example, see section 2.1.2 of the current procedure: 2.1.2 Pursuant to advice from ICANN's Governmental Advisory Committee, ICANN will request advice from the relevant national government on the authority of the request for derogation from the ICANN WHOIS requirements. Of course, the touchstone remains “credible demonstration of legal prevention,” which is the standard adopted by the community and articulated in the policy, which the procedure that we have been asked to review is intended to implement. Steve Metalitz From:whois-iag-volunteers-bounces@icann.org<mailto:whois-iag-volunteers-bounces@icann.org> [mailto:whois-iag-volunteers-bounces@icann.org] On Behalf Of Jamie Hedlund Sent: Monday, March 30, 2015 1:27 PM To: whois-iag-volunteers(a)icann.org<mailto:whois-iag-volunteers@icann.org> Subject: [IAG-WHOIS conflicts] Discussion paper for 1 April 2015 meeting All, Attached please find a short paper for the upcoming call. It is intended to spur discussion on whether the trigger could be modified so long as adequate verification requirements were in place. The paper follows on from contributions to the discussions to date. This is the only proposed agenda item. Based on how the call goes, we can spend the last 10 minutes or so discussing next steps. If anyone would like to add anything to the agenda please let me know. Thanks. Best, Jamie Jamie Hedlund VP, Strategic Programs Global Domains Division ICANN +1.202.374.3969 (m) +1.202.570.7125 (d) jamie.hedlund(a)icann.org<mailto:jamie.hedlund@icann.org>

1 0

Re: [IAG-WHOIS conflicts] Discussion paper for 1 April 2015 meeting
by arbitrator May 6, 2015

May 6, 2015

My recommendation is not to change to the procedure. If it works there is no need to fix it. Best, Raymond arbitrator <arbitrator(a)raymondho.com> wrote: >When comparing the Icann standard registry agreement with the EU privacy data protection regulations, for instance, it is obvious to me that the contractual provisions have no conflict with these regulations. That might explain why no one had invoked the procedure in all these years. I invite my colleagues to consider the issues in the context of the case before us. Sorry for missing the upcoming call. > >Best, >Raymond > > > > > > Raymond HO <arbitrator(a)raymondho.com> wrote: > >>Thanks, Steven. >> >> >> >>I respectfully invite you to consider the goals for the procedure as highlighted in resolution 20051128-05 below: >> >>“20051128-05 >> >> The GNSO votes in favour of the following consensus policy recommendation from the WHOIS task force CONSENSUS POLICY RECOMMENDATION >> >> In order to facilitate reconciliation of any conflicts between local/national mandatory privacy laws or regulations and applicable provisions of the ICANN contract regarding the collection, display and distribution of personal data via the gTLD WHOIS service, ICANN should: >> >> Develop and publicly document a procedure for dealing with the situation in which a registrar or registry can credibly demonstrate that it is legally prevented by local/national privacy laws or regulations from fully complying with applicable provisions of its ICANN contract regarding the collection, display and distribution of personal data via the gTLD WHOIS service. >> >> Create goals for the procedure which include: >> >> Ensuring that ICANN staff is informed of a conflict at the earliest appropriate juncture; >> >> Resolving the conflict, if possible, in a manner conducive to ICANN's Mission, applicable Core Values and the stability and uniformity of the Whois system; >> >> Providing a mechanism for the recognition, if appropriate, in circumstances where the conflict cannot be otherwise resolved, of an exception to contractual obligations to those registries/registrars to which the specific conflict applies with regard to collection, display and distribution of personally identifiable data via the gTLD WHOIS service; and >> >> Preserving sufficient flexibility for ICANN staff to respond to particular factual situations as they arise. >> >> As regards the applicable contractual provisions regarding the collection, display and distribution of personal data via the gTLD WHOIS service, I think it might be helpful to review the standard Registry Agreement https://www.icann.org/resources/pages/registries/registries-agreements-en, in particular, clause 2.18 and Specification 4 reproduced below: >> >> >> >> 2.18 Personal Data. Registry Operator shall (i) notify each ICANN-accredited registrar that is a party to the

3 2

Follow up from IAG call
by Mary Wong May 5, 2015

May 5, 2015

Dear IAG members, Thank you for a productive meeting earlier today. To follow up, these points that emerged from the discussion may be useful ³action items² for the group to consider prior to the next call: (1) On what would be adequate and practicable to satisfy the policy that a registry or registrar ³credibly demonstrate² that it is legally prevented from complying with its contractual obligations regarding its collection, display or distribution of Whois data in other words, what the appropriate ³triggers² for invoking the procedure should be: The IAG may find the report of public comments received to the proposal to review the procedure, as well as the actual public comments themselves, helpful in continuing its discussions on this issue. These documents can be found on the IAG wiki space as well as here: https://www.icann.org/public-comments/whois-conflicts-procedure-2014-05-22-e n. Your further deliberations will be critical to taking forward some of the suggestions outlined in the discussion paper that Jamie had circulated, to ensure that future discussions center on suggestions made by the community (as reflected in the public comments received) and the IAG. (2) On whether, in addition to the procedure, the underlying policy itself needs to be reviewed (noting that the IAG¹s mandate is limited to recommending such a review, if any, to the GNSO, as the IAG is not chartered as a policy making body): The IAG may find it helpful to list and document those elements and/or steps in the current procedure that need to be changed, and do the same for the underlying policy. This exercise should be of assistance in both framing further discussions of the IAG beyond the triggers and on the various other aspects of the procedure, as well as identifying the specific rationale for, and elements that require reviewing, in the policy, if any. The procedure can be found here: https://www.icann.org/resources/pages/whois-privacy-conflicts-procedure-2008 -01-17-en and the policy, as approved by the GNSO Council and subsequently by the ICANN Board, is contained in the GNSO Council¹s resolution here: http://gnso.icann.org/en/council/resolutions#200511. ICANN staff will look into creating a Google Docs workspace, as requested on the call, in the hopes of furthering the IAG¹s deliberations on these and the other topics outlined in the mission and scope for the group. Thanks and cheers Mary Mary Wong Senior Policy Director Internet Corporation for Assigned Names & Numbers (ICANN) Telephone: +1 603 574 4892 Email: mary.wong(a)icann.org

6 8

IAG-WHOIS Archived Emails
by Maria Otanes May 1, 2015

May 1, 2015

Hello all, The archived emails can be found at http://mm.icann.org/pipermail/whois-iag-volunteers/ I've also added the link to the IAG-WHOIS Community Wiki: https://community.icann.org/display/WNLCI/IAG-WHOIS+Archived+Emails Have a wonderful weekend. Best, Maria

1 0

Re: [IAG-WHOIS conflicts] Follow up from IAG call
by Maria Otanes April 30, 2015

April 30, 2015

Hello all, Following up on a request from yesterday¹s call and Mary¹s email below, we have created a Google docs workspace for the ICANN Procedure for Handling WHOIS Conflicts with Privacy Law. Everyone on this email distribution has access to the document and has the ability to suggest edits or provide comments. If you have any questions or run into any problems with the Google doc, please let us know. Thanks. https://docs.google.com/document/d/18WWFEu2ud7Prd4g2LI2UM0a9zT-Q8v9lHtbLJ8rc hvU/edit Kind regards, Maria From: Mary Wong <mary.wong(a)icann.org> Date: Wednesday, April 1, 2015 8:04 PM To: "whois-iag-volunteers(a)icann.org" <whois-iag-volunteers(a)icann.org> Subject: [IAG-WHOIS conflicts] Follow up from IAG call Dear IAG members, Thank you for a productive meeting earlier today. To follow up, these points that emerged from the discussion may be useful ³action items² for the group to consider prior to the next call: (1) On what would be adequate and practicable to satisfy the policy that a registry or registrar ³credibly demonstrate² that it is legally prevented from complying with its contractual obligations regarding its collection, display or distribution of Whois data in other words, what the appropriate ³triggers² for invoking the procedure should be: The IAG may find the report of public comments received to the proposal to review the procedure, as well as the actual public comments themselves, helpful in continuing its discussions on this issue. These documents can be found on the IAG wiki space as well as here: https://www.icann.org/public-comments/whois-conflicts-procedure-2014-05-22-e n. Your further deliberations will be critical to taking forward some of the suggestions outlined in the discussion paper that Jamie had circulated, to ensure that future discussions center on suggestions made by the community (as reflected in the public comments received) and the IAG. (2) On whether, in addition to the procedure, the underlying policy itself needs to be reviewed (noting that the IAG¹s mandate is limited to recommending such a review, if any, to the GNSO, as the IAG is not chartered as a policy making body): The IAG may find it helpful to list and document those elements and/or steps in the current procedure that need to be changed, and do the same for the underlying policy. This exercise should be of assistance in both framing further discussions of the IAG beyond the triggers and on the various other aspects of the procedure, as well as identifying the specific rationale for, and elements that require reviewing, in the policy, if any. The procedure can be found here: https://www.icann.org/resources/pages/whois-privacy-conflicts-procedure-2008 -01-17-en and the policy, as approved by the GNSO Council and subsequently by the ICANN Board, is contained in the GNSO Council¹s resolution here: http://gnso.icann.org/en/council/resolutions#200511. ICANN staff will look into creating a Google Docs workspace, as requested on the call, in the hopes of furthering the IAG¹s deliberations on these and the other topics outlined in the mission and scope for the group. Thanks and cheers Mary Mary Wong Senior Policy Director Internet Corporation for Assigned Names & Numbers (ICANN) Telephone: +1 603 574 4892 Email: mary.wong(a)icann.org

5 6