4 ms·

Did you read the letter [1] that was linked in the article? It is much less hyperbolic than the article makes out. Paraphrased: Yes, of course you can keep re

Did you read the letter [1] that was linked in the article? It is much less hyperbolic than the article makes out. Paraphrased: Yes, of course you can keep registration data for your own legitimate usage. Contact information for the lifetime of the domain is fine. Storing it for 2 years after expiry is not necessarily problematic, but you need to document why you legitimately need it. You can't make private contact information public without consent. However, you can disclose it to 3rd parties who make a legitimate request, but you should record the request. [1] https://regmedia.co.uk/2018/07/05/edpb-icann-whois.pdf https://regmedia.co.uk/2018/07/05/edpb-icann-whois.pdf

drtillberg 8y ago
It also sets up peculiar legal fictions, i.e., it is ok to keep contact info for 'legal' persons, but not 'natural' persons and if the 'legal' contact info hints indirectly about a 'natural' person, that's a violation, unless, I'm sure a series of other conditions and legal fictions are satisfied. The 8 pages are dense with impenetrable legalese, and the message essentially is that ICANN is not allowed under GDPR to fulfill its mission of publishing the identities of website owners to the public. That is not a reasonable position, from a US perspective. Why is only a government inquirer allowed to know such things automatically, why must my request as a member of the public be logged for ICANN to fulfill it? Is that actually beneficial to 'privacy' or a derivative GDPR minefield? GDPR is a negative development for openness, tranparancy and interconnectivity.
- galadran 8y ago
  I can explain it simply to you. Only the personal data of flesh and blood human beings is protected. So contact info is protected if it is the direct email of a human being. If its a huge faceless corporation and the email is just "legal@.." it is not protected. Saavy? Well its certainly beneficial for privacy. There are very few social media sites in the world where publishing other people's contact details without their permissions is allowed. Its banned here. Its banned on Reddit. And a ton of other sites. There is really very little difference. How would you feel if all HN submitters had to list a personal phone number? Why is running a website any different?

drtillberg 8y ago

It also sets up peculiar legal fictions, i.e., it is ok to keep contact info for 'legal' persons, but not 'natural' persons and if the 'legal' contact info hints indirectly about a 'natural' person, that's a violation, unless, I'm sure a series of other conditions and legal fictions are satisfied. The 8 pages are dense with impenetrable legalese, and the message essentially is that ICANN is not allowed under GDPR to fulfill its mission of publishing the identities of website owners to the public. That is not a reasonable position, from a US perspective. Why is only a government inquirer allowed to know such things automatically, why must my request as a member of the public be logged for ICANN to fulfill it? Is that actually beneficial to 'privacy' or a derivative GDPR minefield? GDPR is a negative development for openness, tranparancy and interconnectivity.

galadran 8y ago
I can explain it simply to you. Only the personal data of flesh and blood human beings is protected. So contact info is protected if it is the direct email of a human being. If its a huge faceless corporation and the email is just "legal@.." it is not protected. Saavy? Well its certainly beneficial for privacy. There are very few social media sites in the world where publishing other people's contact details without their permissions is allowed. Its banned here. Its banned on Reddit. And a ton of other sites. There is really very little difference. How would you feel if all HN submitters had to list a personal phone number? Why is running a website any different?