Data privacy and the clash of badges

For the first time at an ICANN meeting, data privacy law was central to the agenda.

While data privacy laws and their consequences for the domain name industry are nothing new (the current EU Directive dates from 1995), the General Data Protection Regulation which goes into force May 25, 2018 has already had a catalytic effect.

That this regulation will trigger important fines for actors from the industry located both inside and outside Europe - including ICANN itself – certainly explains why data privacy was the focal point of the agenda.

In any case, it was refreshing to finally hear some law enforcement representatives counterbalancing their colleagues’ usual argument that any kind of privacy in the domain name industry is a shield used solely by bad actors who seek impunity for their actions.

Of course, their presentations did not magically solve the complicated privacy issues inherent to the domain name registration industry; several ICANN policies and contractual instruments would need to be reformed for that to happen.

But acknowledging that privacy is not a black and white issue is an important step. It is now up to ICANN to keep law enforcement experts actively involved in the policy development process.

European escrow: a new hope

As an ICANN accredited registrar, EuroDNS is obligated to escrow our customers’ WHOIS records with an authorised provider. This ensures that should we lose our customers' records, an escrowed/backup copy of our database is available to reallocate each domain name to its owner.

As of now, the sole authorised and subsidised provider is US-based company, Iron Mountain Inc. While this company adheres to the Privacy Shield framework, we firmly believe that ICANN should use part of the budget allocated for the Registrar Data Escrow program to subsidise a provider located within the European Economic Area. This is why two years ago EuroDNS, along with several other registrars, wrote a letter requesting ICANN do just that.

Happily, Jennifer Gore, ICANN Director for Registrar Services, reported that ICANN has started the process to retain the services of an EU-based escrow services provider. There is hope after all!

A second bite at the apple

Anyone familiar with the domain name industry already knows that the solution to any problem is always the same: develop another accreditation programme.

And, to be fair, these programmes meet all transnational and dematerialised requirements to properly regulate the provision of domain privacy services.

That said, ensuring that these accreditation programmes meet the needs of all concerned parties can prove challenging. For example, in 2013, ICANN initiated a policy development process to define accreditation rules. This process ended in 2016 with the release of a report from the working group responsible for developing the process. And, per ICANN’s policy development framework, an Implementation Review Team (IRT) was formed to assist ICANN with implementing the working group’s findings.

However, at the beginning of this year, the Governmental Advisory Committee (GAC) decided to do away with this established process, forming a so-called Task Force to ensure that the accreditation regime "fits the needs of law enforcement agencies."

ICANN regrettably caved to the GAC’s call for changes. The IRT is now awaiting the GAC’s proposed draft with the slim hope that it will only contain implementation directions and not policy.

Stay tuned for next week’s report

For more news concerning the GAC and its impact on everything from changes to how customers' addresses are validated to a next-generation WHOIS system, tune in next week when Luc shares more ICANN news from the 58th convention!

photo credit