IAG Initial Report and Proposed Revisions to the ICANN Procedure for Whois Conflicts with Privacy Laws

Purpose: Public comment is sought on Implementation Advisory Group's proposals to improve the current Whois Conflicts Procedure.

Current Status: The Implementation Advisory Group seeks public comment on its proposed revisions to the existing Whois Conflicts Procedure.

Next Steps: The Implementation Advisory Group will incorporate public comments into its preliminary report and submit a final report to GNSO Council for its consideration.

In November 2005, the Generic Names Supporting Organization (GNSO) concluded a policy development process (PDP) on Whois conflicts with privacy law, which recommended the creation of a procedure to address conflicts between a contracted party's Whois obligations and local/national privacy laws or regulations.  A contracted party that credibly demonstrates that it is legally prevented from complying with its Whois obligations can invoke the procedure, which became effective in January 2008. The procedure defines a credible demonstration as one in which the contracted party has received "notification of an investigation, litigation, regulatory proceeding or other government or civil action that might affect its compliance." The procedure has never been invoked. ICANN launched a review of the procedure in May 2014. An Implementation Advisory Group (IAG) was formed and began its work in January 2015. The IAG devoted most of its time discussing whether additional triggers to invoke the procedure should be incorporated and if so how to ensure that they remain consistent with the existing policy. The IAG now submits its initial report for public comment and to the GNSO Council.

In November 2005, the Generic Names Supporting Organization (GNSO) concluded a policy development process (PDP) on Whois conflicts with privacy law which recommended that, "In order to facilitate reconciliation of any conflicts between local/national mandatory privacy laws or regulations and applicable provisions of the ICANN contract regarding the collection, display and distribution of personal data via the gTLD Whois service, ICANN should:

• Develop and publicly document a procedure for dealing with the situation in which a registrar or registry can credibly demonstrate that it is legally prevented by local/national privacy laws or regulations from fully complying with applicable provisions of its ICANN contract regarding the collection, display and distribution of personal data via Whois.
• Create goals for the procedure which include:
  • Ensuring that ICANN staff is informed of a conflict at the earliest appropriate juncture;
  • Resolving the conflict, if possible, in a manner conducive to ICANN's Mission, applicable Core Values, and the stability and uniformity of the Whois system;
  • Providing a mechanism for the recognition, if appropriate, in circumstances where the conflict cannot be otherwise resolved, of an exception to contractual obligations to those registries/registrars to which the specific conflict applies with regard to collection, display and distribution of personally identifiable data via Whois; and
  • Preserving sufficient flexibility for ICANN staff to respond to particular factual situations as they arise."

The ICANN Board of Directors adopted the recommendations in May 2006 and the final procedure was made effective in January 2008. Although to date no registrar or registry operator has formally invoked the Procedure, concerns have been expressed both by public authorities as well as registrars and registry operators concerning potential conflicts between Whois contractual obligations and local law.

Given that the Whois Procedure has not been invoked and yet numerous concerns have arisen from contracted parties and the wider community, ICANN launched a review as provided for in Step Six of the Procedure, which calls for an annual review of the Procedure's effectiveness. The review was launched with the publication of a paper for public comment on 22 May 2014. The paper outlined the Procedure's steps and invited public comments on a series of questions. Following review of the public comments received, this Implementation Advisory Group (IAG) was formed to consider the need for changes to how the Procedure is invoked and used. A few common themes were discerned from some of the suggestions in the public comments, which may allow for changes to implementation of the Procedure in line with the underlying policy.

• Policy recommendation and advice on a procedure for handling conflicts between a registrar/registry's legal obligations under privacy laws and their contractual obligations to ICANN: http://gnso.icann.org/en/issues/whois-privacy/council-rpt-18jan06.htm
• Whois Conflicts Procedure: https://www.icann.org/resources/pages/whois-privacy-conflicts-procedure-2008-01-17-en
• Initial Report on the Implementation Advisory Group Review of Existing ICANN Procedure for Handling Whois Conflicts with Privacy Laws [PDF, 617 KB]

• Appendices 1-4 [PDF, 564 KB]

• Report