5 ms·

It seems to me that ICANN came up with a plausible interpretation and the pushback from the regulator should be a wake-up call to those who naively claimed GDPR

It seems to me that ICANN came up with a plausible interpretation and the pushback from the regulator should be a wake-up call to those who naively claimed GDPR was reasonable and no big deal. I think it makes a lot of sense for a domain registrar to keep basic information in the long-term, about who registered what. I find it odd that this has become a point of contention.

detaro 8y ago
Then require registrars to do so legally. They probably already are in many cases, due to long-running storage requirements for business documents (e.g. they probably keep "we billed Mr. X for example.com on $date, and he paid using the credit card on file" for many years). Less clear why ICANN needs to store that data too, I think it's right that they should have to properly justify that. ICANN has made up rules however they liked forever and ignored warnings about privacy for over a decade, and about GDPR specifically for years, so I have to admit I have little compassion for their self-created problem here.
Tijdreiziger 8y ago
Sure, but why should that information be public?
galadran 8y ago
Did you read the letter [1] that was linked in the article? It is much less hyperbolic than the article makes out. Paraphrased: Yes, of course you can keep registration data for your own legitimate usage. Contact information for the lifetime of the domain is fine. Storing it for 2 years after expiry is not necessarily problematic, but you need to document why you legitimately need it. You can't make private contact information public without consent. However, you can disclose it to 3rd parties who make a legitimate request, but you should record the request. [1] https://regmedia.co.uk/2018/07/05/edpb-icann-whois.pdf https://regmedia.co.uk/2018/07/05/edpb-icann-whois.pdf
- drtillberg 8y ago
  It also sets up peculiar legal fictions, i.e., it is ok to keep contact info for 'legal' persons, but not 'natural' persons and if the 'legal' contact info hints indirectly about a 'natural' person, that's a violation, unless, I'm sure a series of other conditions and legal fictions are satisfied. The 8 pages are dense with impenetrable legalese, and the message essentially is that ICANN is not allowed under GDPR to fulfill its mission of publishing the identities of website owners to the public. That is not a reasonable position, from a US perspective. Why is only a government inquirer allowed to know such things automatically, why must my request as a member of the public be logged for ICANN to fulfill it? Is that actually beneficial to 'privacy' or a derivative GDPR minefield? GDPR is a negative development for openness, tranparancy and interconnectivity.
  - galadran 8y ago
    I can explain it simply to you. Only the personal data of flesh and blood human beings is protected. So contact info is protected if it is the direct email of a human being. If its a huge faceless corporation and the email is just "legal@.." it is not protected. Saavy? Well its certainly beneficial for privacy. There are very few social media sites in the world where publishing other people's contact details without their permissions is allowed. Its banned here. Its banned on Reddit. And a ton of other sites. There is really very little difference. How would you feel if all HN submitters had to list a personal phone number? Why is running a website any different?
tinus_hn 8y ago
Whois is not about that at all, it’s about offering that information to the public at large. GDPR does not limit the collection of data that has a legitimate business use as long as it is used for that business use only and removed when the use no longer exists. Otherwise how could you do billing?
lucb1e 8y ago
I can't even find what the ICANN proposed in the article. (The article contains little more information than the headline does by itself.) What interpretation did the ICANN come up with that you think is reasonable but is still not GDPR compliant?
- kierenmccarthy 8y ago
  I'm the author of this piece. I considered writing a full policy breakdown but figured people would get bored very quickly. Plus, things keep moving so fast (almost arbitrarily sometimes) that I wonder whether it's worthwhile. Fundamentally, the issue is this: US intellectual property lawyers are very well organized and have the backing of big corporations. As a result, they have a disproportionate influence in US organizations - in this case, ICANN. With each new proposal, each new rule, each new policy, these (very smart) IP lawyers find ways around it to suit their main goals. And because ICANN, unfortunately, has no moral or ethical center, it tends to bend its own policies to accommodate whoever is the most powerful and/or loudest on any given issue. In this case, the American IP lawyers are very driven to retain the existing system. But in this particular case of Whois they have come up against a brick wall of decided European law. And they have been trying to find ways around it, pressuring ICANN into a series of policy positions that are very clever but can't go anywhere because the law is settled. Plus the data regulators are the people in charge of deciding how it is interpreted. And they, naturally, have a fairly strict interpretation of GDRP. It's worth noting btw that European governments have often ignored the data regulators in favor of their own corporations (just take a look at the whole Privacy Shield debate). But in the case of GDPR, the data regulators are in the driving seat. At least for now. So I could give a detailed rundown of what ICANN has proposed, and how it has changed, and how it is going to change again. But in truth it doesn't matter - ICANN and the IP lawyers will try on any new interpretation they can think of to get what they want - access to the contact details of every domain name - and they will discard any or all of them as soon as they no longer further that goal. What's really happening is that ICANN has, for the first time, hit a situation where it doesn't get to decide for itself what happens. As such this Whois/GDPR process is shining a spotlight on the dangerously flawed policy-making process of this critical organization where it keeps insisting on transparently bad policies, keeps putting forward arguments that don't make sense, and keeps trying to bend its own processes to fit with a pre-determined conclusion. And the Europeans look at it, say No, and the whole facade comes crumbling down. And that is causing massive temporal dissonance at the organization in charge of the internet's naming and numbering systems. That's what this article is about. And it's unlikely to be the last.

detaro 8y ago

Then require registrars to do so legally. They probably already are in many cases, due to long-running storage requirements for business documents (e.g. they probably keep "we billed Mr. X for example.com on $date, and he paid using the credit card on file" for many years). Less clear why ICANN needs to store that data too, I think it's right that they should have to properly justify that. ICANN has made up rules however they liked forever and ignored warnings about privacy for over a decade, and about GDPR specifically for years, so I have to admit I have little compassion for their self-created problem here.

Tijdreiziger 8y ago

Sure, but why should that information be public?

galadran 8y ago

Did you read the letter [1] that was linked in the article? It is much less hyperbolic than the article makes out. Paraphrased: Yes, of course you can keep registration data for your own legitimate usage. Contact information for the lifetime of the domain is fine. Storing it for 2 years after expiry is not necessarily problematic, but you need to document why you legitimately need it. You can't make private contact information public without consent. However, you can disclose it to 3rd parties who make a legitimate request, but you should record the request. [1] https://regmedia.co.uk/2018/07/05/edpb-icann-whois.pdf https://regmedia.co.uk/2018/07/05/edpb-icann-whois.pdf

drtillberg 8y ago
It also sets up peculiar legal fictions, i.e., it is ok to keep contact info for 'legal' persons, but not 'natural' persons and if the 'legal' contact info hints indirectly about a 'natural' person, that's a violation, unless, I'm sure a series of other conditions and legal fictions are satisfied. The 8 pages are dense with impenetrable legalese, and the message essentially is that ICANN is not allowed under GDPR to fulfill its mission of publishing the identities of website owners to the public. That is not a reasonable position, from a US perspective. Why is only a government inquirer allowed to know such things automatically, why must my request as a member of the public be logged for ICANN to fulfill it? Is that actually beneficial to 'privacy' or a derivative GDPR minefield? GDPR is a negative development for openness, tranparancy and interconnectivity.
- galadran 8y ago
  I can explain it simply to you. Only the personal data of flesh and blood human beings is protected. So contact info is protected if it is the direct email of a human being. If its a huge faceless corporation and the email is just "legal@.." it is not protected. Saavy? Well its certainly beneficial for privacy. There are very few social media sites in the world where publishing other people's contact details without their permissions is allowed. Its banned here. Its banned on Reddit. And a ton of other sites. There is really very little difference. How would you feel if all HN submitters had to list a personal phone number? Why is running a website any different?

tinus_hn 8y ago

Whois is not about that at all, it’s about offering that information to the public at large. GDPR does not limit the collection of data that has a legitimate business use as long as it is used for that business use only and removed when the use no longer exists. Otherwise how could you do billing?

lucb1e 8y ago

I can't even find what the ICANN proposed in the article. (The article contains little more information than the headline does by itself.) What interpretation did the ICANN come up with that you think is reasonable but is still not GDPR compliant?

kierenmccarthy 8y ago
I'm the author of this piece. I considered writing a full policy breakdown but figured people would get bored very quickly. Plus, things keep moving so fast (almost arbitrarily sometimes) that I wonder whether it's worthwhile. Fundamentally, the issue is this: US intellectual property lawyers are very well organized and have the backing of big corporations. As a result, they have a disproportionate influence in US organizations - in this case, ICANN. With each new proposal, each new rule, each new policy, these (very smart) IP lawyers find ways around it to suit their main goals. And because ICANN, unfortunately, has no moral or ethical center, it tends to bend its own policies to accommodate whoever is the most powerful and/or loudest on any given issue. In this case, the American IP lawyers are very driven to retain the existing system. But in this particular case of Whois they have come up against a brick wall of decided European law. And they have been trying to find ways around it, pressuring ICANN into a series of policy positions that are very clever but can't go anywhere because the law is settled. Plus the data regulators are the people in charge of deciding how it is interpreted. And they, naturally, have a fairly strict interpretation of GDRP. It's worth noting btw that European governments have often ignored the data regulators in favor of their own corporations (just take a look at the whole Privacy Shield debate). But in the case of GDPR, the data regulators are in the driving seat. At least for now. So I could give a detailed rundown of what ICANN has proposed, and how it has changed, and how it is going to change again. But in truth it doesn't matter - ICANN and the IP lawyers will try on any new interpretation they can think of to get what they want - access to the contact details of every domain name - and they will discard any or all of them as soon as they no longer further that goal. What's really happening is that ICANN has, for the first time, hit a situation where it doesn't get to decide for itself what happens. As such this Whois/GDPR process is shining a spotlight on the dangerously flawed policy-making process of this critical organization where it keeps insisting on transparently bad policies, keeps putting forward arguments that don't make sense, and keeps trying to bend its own processes to fit with a pre-determined conclusion. And the Europeans look at it, say No, and the whole facade comes crumbling down. And that is causing massive temporal dissonance at the organization in charge of the internet's naming and numbering systems. That's what this article is about. And it's unlikely to be the last.