Registration Data Accuracy Scoping Team – Formation and Instructions
The topic of registration data accuracy is not new; it is provided for in ICANN’s contracts and has been the subject of many community discussions and work streams over the years. Following its agreement to start a more holistic effort, the GNSO Council received the ICANN org Briefing and held further discussions on the topic of registration data accuracy. The Council has now developed these instructions to guide the formation and work of a Registration Data Accuracy Scoping Team.
Background
Two recent documents inform the Scoping Team’s remit:
- The proposal adopted by the GNSO Council (see here):
- recommends the Scoping Team addresses the effects of GDPR on Registration Data accuracy requirements and the Whois Accuracy Reporting System (ARS)[1], stating, “a scoping team would be tasked to, ‘facilitate community understanding of the issue; assist in scoping and defining the issue; gather support for the request of an Issue Report, and/or; serve as a means to gather additional data and/or information before a request [for an Issue Report] is submitted,’”
- suggests that it “…may also consider reaching out to ICANN org to better understand the impact, if any, on ARS and enforcing existing accuracy requirements.”
- The ICANN Org Briefing, which provides an overview of existing accuracy requirements and programs, as well as the impact that GDPR has had on these. It furthermore advises that:
- the Scoping Team views the question of measuring registration data accuracy in light of ongoing higher-level conversations on accuracy,
- the discussion of accuracy measurement should not be solely focused on the ARS but should encompass the wider range of issues related to the GDPR and data protection, and
- it may be beneficial to commission a study on how accuracy of registration data might be measured.
Effects of GDPR on existing accuracy requirements and ARS
While privacy legislation might have an impact on what data can be published to third parties, it does not impact the obligation for Registrars and Registries to collect accurate information, i.e., contracted parties must adhere to the law and their contractual requirements.
However, the ICANN org briefing does indicate the effects of GDPR on various efforts:
- Existing Whois accuracy policies are marginally affected,
- Contractual compliance is minimally affected,
- Whois ARS is paused, because it cannot obtain the data necessary to perform its function.
Similarly, in response to the GAC’s ICANN70 Communique, the Board’s scorecard highlighted the fact that redaction of registration data has diminished ICANN Contractual Compliance’s ability to check compliance and the unavailability of some public contact information in RDDS has hampered ICANN org’s ability to continue with the original framework for the ARS. The Board noted:
“This context is important to factor in when discussing ICANN policies concerning accuracy as in practice it might be difficult to implement such policies due to the restrictions on access to registration data as a result of the GDPR”.
In order to carry out the objectives laid out in the proposal adopted by the GNSO Council and the ICANN org Briefing, one aspect of the Scoping Team’s work will be to consider whether and how an accuracy measurement program (including ARS or its successor / replacement) can be effectively implemented to gather necessary data and facts and assess the state of accuracy and what, if any, improvements to existing requirements or programs need to be further considered.
The Charge to the Scoping Team
- Enforcement and reporting: The Scoping Team will assess the measures, including proactive measures, used by ICANN Compliance to monitor, measure, enforce and report on the accuracy obligations as specified in the Registry Agreements (RAs) and Registrar Accreditation Agreement (RAA). This assessment will include consideration of what compliance with the existing contractual data accuracy obligations means. The Scoping Team shall, with reference to the resources that will be included in the index of relevant resources cited below, consider whether there is an agreed definition of registration data accuracy and, if not, consider what working definitions should be used in the context of the Scoping Team's deliberations. Particular attention should be given to the definition that ICANN Compliance employs for “accuracy” in ICANN’s contracts. Note, this does not preclude any subsequent effort from formalising the definition(s) that should be applied in the context of any existing and/or new accuracy requirements that may be developed.
- Measurement of accuracy: The Scoping Team is expected to provide recommendations for how accuracy levels can be determined and measured, including, but not limited to, whether the WHOIS ARS needs a revamp to make it fit for purpose or whether there are other ways in which accuracy levels can/should be measured. The information and data resulting from these recommendations are expected to help inform the Scoping Team’s work under 3.
- Effectiveness: The Scoping Team will, on the basis of its assessment under 1. and data resulting from 2., undertake an analysis of the accuracy levels measured to assess whether the contractual data accuracy obligations are effective at ensuring that Registered Name Holders provide “accurate and reliable” contact information.
- Impact and Improvements: Based on its findings under 3., the Scoping Team will (taking into account estimates of benefits and costs) assess whether any changes are recommended to improve accuracy levels, and if so, recommend to the GNSO Council how and by whom these changes would need to be developed (for example, if changes to existing contractual requirements are recommended, a PDP or contractual negotiations may be necessary to effect a change).
For clarity, it is the expectation that the Scoping Team will first address items 1 and 2 and only once those are completed it will commence work on items 3 and 4. Any recommendations stemming from 1-4 will need to be approved by the GNSO Council before these are directed to the appropriate parties for action.
In carrying out its work above, the Scoping Team is expected to take into account the policy recommendations from the EPDP on gTLD Registration Data (EPDP) Team that have been adopted by the GNSO Council and the ICANN Board, including the EPDP-identified purposes and the related data processing activities. However, the scoping team is not tasked to review these purposes or suggest changes. If the scoping team finds that further review of these purposes is necessary, especially in the context of implementation and enforcement of existing requirements, it will identify this as an area of further work in its recommendations.
As the Scoping Team deliberates these issues, it might find the need to spin-up a group with an alternative skill set or commission a study. If so, the Scoping Team is expected to consult with the GNSO Council, especially if there are resource implications, such as funding needs, that will need to go through the appropriate approval processes before these can be implemented.
Resources
The Staff Support Team will create an index of relevant resources, including studies, reports and recommendations from SSR2, ATRT, CCT RT, RDS RT, WHOIS RT, the GAC Principles Regarding gTLD WHOIS Services, the ICANN org briefing paper and the Bird & Bird advisory memoranda, that the Scoping Team can consult, as necessary. This is not intended to be an exhaustive index, Scoping Team members will be encouraged to add any sources that they deem relevant.
Scoping team composition
The Scoping Team will be based on a set representation from each Supporting Organization, Constituency, Stakeholder Group and Advisory Committee that is interested to participate. The work described above requires a breadth of experience, skill sets and talents. Representatives will possess a mix of quantitative skills, experience, privacy legislation acumen, data quality expertise, ICANN contract knowledge, and policy perspectives.
Preliminarily, each interested Supporting Organization, Constituency, Stakeholder Group and Advisory Committee can assign up to two members to this effort, with the exception of the Registrar and Registry Stakeholder Group which may each appoint up to three members who are expected to reflect the different business models that are impacted by accuracy requirements due to their different relationships with end-users (namely, wholesale, corporate and retail for registrars and open, restricted and brand for registries). However, the Council or the Scoping Team might decide to augment the Team. Examples might be to obtain a breadth of experience complying with ICANN contract provisions across different jurisdictions, or in governmental legislative implementation. The Team might also call upon experts as needed but in a way that will not disturb the consensus determination methods of the Team.
In addition, both ICANN org and the ICANN Board will be invited to appoint a liaison to this effort.
The GNSO Council will appoint a qualified Chair for the Scoping Team. The Scoping Team, once formed, may select a Vice Chair to assist the Chair.
Timing and Timeline
The Scoping Team will be timed to start work after the completion of the Registration Data EPDP Phase 2A work (currently target for delivery of Final Report: end of August 2021). There is a sense of urgency in some ACs/Cs to start and complete this work, and so staff and Council leadership planning activities (including the survey of existing resources described above) can start immediately and the call for volunteers can be launched so that waiting for the EPDP Phase 2A’s Final Report will have little or no effect on the timeline.
An early Scoping Team task will be to develop a detailed work plan and timeline which are to be submitted to the Council for review. The work plan and timeline are expected to address the different assignments (see 1-4 above) although it is understood that for the later assignments it may not be possible to provide specific details until earlier assignments are complete or underway. There might be efficiencies and overlap across tasks so that the work can be completed in a year, recognizing that if any study needs to take place, this timeline may be extended.
[1] ARS is “a framework for conducting repeatable assessments of WHOIS accuracy, publicly report the findings, and provide data to the ICANN Contractual Compliance team to follow up on potentially inaccurate records with registrars”. For further information, see https://whois.icann.org/en/whoisars.
