Page History

WHOIS Task Force & Policy Review Team Reports

• Here

Procedure for Handling Conflicts with National Laws

• Here

WHOIS Studies

• Here

SSAC Reports

• Here

Registry & Registrar Agreements

• Here

WHOIS Program Improvement Documents

• Here

Related GNSO PDP Reports

• Here

GAC Communiques regarding WHOIS

• Here

Article 29 Data Protection Working Party Letters

• Here

IETF RDAP & EPP RFCs

• Here

• WHOIS Policy Review Team Final Report (2012)
• WHOIS Task Force Final Report (2007) [HTML] and [PDF]
• WHOIS Task Force Final Report (2003)
• Further links to GNSO Closed/Archived WHOIS Policy Work (2001-2011)

WHOIS Studies

• GNSO Council Recommendation on Further Studies of WHOIS (2008)
• WHOIS Misuse Study and Final Study Report (2014)
• WHOIS Registrant Identification Study and Final Study Report (2013)
• WHOIS Privacy and Proxy Services Abuse Study and Final Study Report (2014)
• WHOIS Privacy and Proxy Relay/Reveal Survey and Final Survey Results (2012)
• NORC WHOIS Accuracy Study (2010)
• NORC Study on the Prevalence of Domain Names Registered Using A Privacy or Proxy Service Among the Top 5 gTLDs (2010)
• US GAO Prevalence of False Contact Information for Registered Domain Names Study (2005)
• GNSO WHOIS Technical Requirements Survey (2013)
• Further links to GNSO WHOIS Study announcements and comments (2009-2014)

SSAC Reports about WHOIS

• SAC061, SSAC Comment on ICANN’s Initial Report from the Expert Working  Group on gTLD Directory Services (2013)
• SAC058, Report on Domain Name Registration Data Validation (2013)
• SAC055, WHOIS: Blind Men and an Elephant (September 2012)
• SAC054, Report on Domain Name Registration Data Model (June 2012)
• SAC051, Report on Domain Name WHOIS Terminology (2011)
  
  

Registry & Registrar Agreements

• 2013 Registrar Accreditation Agreement (RAA), including RAA WHOIS requirements for Registrants (2013)
• 2014 New gTLD Registry Agreement, including Specification 4 Registration Data Publication Services (2014)

WHOIS Program Improvement Documents

• Accuracy Reporting System (ARS) Pilot Study Report (2014)
• ICANN Blog: Phase 1 of the ARS
• ARS Phase 1 Validation Criteria (2015)
• ICANN WHOIS Portal Knowledge Center Q&A: What is WHOIS data used for?
• WHOIS Information Portal and Consolidated WHOIS Lookup Tool
• WHOIS Primer
• Annual Report on WHOIS Improvements (2014)
• WHOIS Implementation Report (2015)
• Final Report from the Working Group on Internationalized Registration Data (2015)
• Final Report from the Expert Working Group on Internationalized Registration Data (2015)
• ICANN Memorandum (Legal Review) to the IRT on Thin to Thick WHOIS Transition - Final Memorandum and Scope (2014-2015)
• RDAP Operational Profile for Registries and Registrars (2016)

Related GNSO PDP Reports

• GNSO PDP on Thick WHOIS and Final Report (2013)
• GNSO PDP on Privacy & Proxy Services Accreditation Issues (PPSAI), Final Report, and GNSO Council Recommendations to Board (2015)
• GNSO PDP on Translation/Transliteration of Contact Information and Final Report (2015)
• See also IRD-related reports under WHOIS Improvements above

Procedure for Handling Conflicts with National Laws

• GNSO Policy underlying current ICANN Procedure (2006)
• ICANN Procedure For Handling WHOIS Conflicts with Privacy Law (2008)
• Review of the ICANN Procedure for Handling WHOIS Conflicts with Privacy Law (2014)
• 2013 RAA's Data Retention Specification Waiver and Discussion Document (2014)
• Final Report on the Implementation Advisory Group Review of Existing ICANN Procedure for Handling Whois Conflicts with Privacy Laws (2016)

Other GNSO WHOIS Consensus Policies

• WHOIS Uniform Domain Name Dispute Resolution Policy and Rules for Uniform Domain Name Dispute Resolution Policy

• WHOIS New gTLD URS Policy and Rules for URS Policy

• WHOIS Expired Domain Deletion Policy
• WHOIS Inter-Registrar Transfer Policy

GAC Communiques regarding WHOIS

• Singapore GAC Communiqué (11 February 2015)
• Los Angeles GAC Communiqué (16 October 2014)
• London GAC Communiqué (25 June 2014)
• Singapore GAC Communiqué (27 March 2014)
• Beijing GAC Communiqué (11 April 2013)
• GAC 44 Prague Communiqué (28 June 2012)
• GAC Principles regarding gTLD WHOIS Services (28 March 2007)
• All GAC Communiques can also be reached through this link
• Additional inputs suggested by the GAC

  • Law Enforcement Due Diligence Recommendations for ICANN (2010)

  • GAC Comments to Initial Report on the PPSAI PDP (Sep 2015)

  • GAC Public Comments to 2013 RAA WHOIS Accuracy Specification Review

  • GAC Comments to New gTLD Program Safeguards Against DNS Abuse Report (19 May 2016)

Article 29 Data Protection Working Party Letters and Documents

• Article 29 WP statement on the data protection impact of the revision of the ICANN RAA (2013-2014)
  https://www.icann.org/en/system/files/correspondence/namazi-to-kohnstamm-25mar14-en.pdf
  https://www.icann.org/en/system/files/correspondence/kohnstamm-to-jeffrey-08jan14-en.pdf
  https://www.icann.org/en/system/files/correspondence/jeffrey-to-kohnstamm-20sep13-en.pdf
  https://www.icann.org/en/system/files/correspondence/kohnstamm-to-crocker-chehade-06jun13-en.pdf
   
• Article 29 WP comments on the data protection impact of the revision of the ICANN RAA concerning accuracy and data retention of WHOIS (2012)
  

  https://www.icann.org/en/system/files/correspondence/kohnstamm-to-crocker-atallah-26sep12-en.pdf

  https://www.icann.org/en/news/correspondence/chehade-to-kohnstamm-09oct12-en
   

• Article 29 WP on ICANN Procedure for Handling WHOIS Conflicts with Privacy Law (2007)
  http://gnso.icann.org/en/correspondence/cerf-to-schaar-24oct07.pdf
  https://www.icann.org/en/system/files/files/cerf-to-schaar-15mar07-en.pdf

  https://www.icann.org/en/correspondence/schaar-to-cerf-12mar07.pdf
   

• Article 29 WP on ICANN’s WHOIS Database Policy (2006)
  https://www.icann.org/en/system/files/files/schaar-to-cerf-22jun06-en.pdf
  https://www.icann.org/en/correspondence/lawson-to-cerf-22jun06.pdf
  https://www.icann.org/en/correspondence/parisse-to-icann-22jun06.pdf
  https://www.icann.org/en/system/files/files/fingleton-to-cerf-20jun06-en.pdf
   
• Article 29 WP 76 Opinion 2/2003 
  Opinion on the application of the data protection principles to the WHOIS directories
   
• Additional Article 29 WP documents that may be of interest to this PDP WG
  Article 29 WP 5 Recommendation 2/1997
  Article 29 WP 20 Opinion 3/1999 
  Article 29 WP 33 Opinion 5/2000 
  Article 29 WP 41 Opinion 4/2001 
  Article 29 WP 56 Working Document 5/2002
  Article 29 WP Opinion 1/2010
  Article 29 WP 203 Opinion 3/2013
  Article 29 WP 217 Opinion 4/2014  
   
• Further documents produced by the Article 29 WP may be found at their website

Council of Europe Declaration

• Declaration of the Committee of Ministers on ICANN, human rights and the rule of law (3 June 2015)
  
• Council of Europe's Treaty 108 on Data Protection (1985)

European Parliament

• Final Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016)
• News: Data protection reform – Parliament approves new rules fit for the digital era (April 2016)
• UK Information Commissioner's Office Overview of the General Data Protection Regulation (July 2016)
• European Data Protection Directive (1995)

EDPS Correspondence regarding Registration Data

• Opinion of the European Data Protection Supervisor: Europe's role in shaping the future of Internet Governance (23 June 2014)
• ICANN's public consultation on 2013 RAA Data Retention Specification Data Elements and Legitimate Purposes for Collection and Retention (17 April 2014)
• EDPS Toolkit: Assessing the necessity of measures that limit the fundamental right to the protection of personal data (2017)
  
  

European Commission Website

• Obligations of Data Controllers
• Definition of Data Controllers
  
• Exchanging and Protecting Personal Data in a Globalised World (January 2017)

European Commission EU-US Privacy Shield-related Documents

• European Commission News Announcement: EU-US Privacy Shield
• Judgement of the Court (Grand Chamber) - Maximillian Schrems v Data Protection Commissioner
• EU-U.S. Privacy Shield draft (full text, February 2016)
• Opinion 01/2016 on the EU-U.S. Privacy Shield draft adequacy decision of the Article 29 WP 238

Africa Union Documents

• Africa Union Convention on Cybersecurity and Personal Data Protection

International Working Group on Data Protection in Telecommunications and Media Documents

• Common Position relating to Reverse Directories (Hong Kong, 15.04.1998)

• Common Position on Privacy and Data Protection aspects of the Registration of Domain Names on the Internet (Crete, 4./5.05.2000)
• Common Position on Privacy and Data Protection aspects of the Publication of Personal Data contained in publicly available documents on the Internet (Crete, 4./5.05.2000)

• Common Position on Incorporation of telecommunications-specific principles in multilateral privacy agreements: Ten Commandments to protect Privacy in the Internet World (Berlin, 13/14.09.2000)

• Common Position on data protection aspects in the Draft Convention on cyber-crime of the Council of Europe (Berlin, 13/14.09.2000)
• Working Paper on Privacy and Data Protection Issues with Regard to Registrant data and the WHOIS Directory at ICANN (Paris, 27/28.11.2017)

• Further documents produced by this "Berlin Group" may be found at their website

Organisation for Economic Co-operation and Development ("OECD")

• OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (2013)
  
  

United Nations Human Rights Council

• Human Rights Council - Report by the UN Special Rapporteur on the right to privacy (2016)

U.S. Department of Commerce, National Telecommunications and Information Administration (NTIA)

• Green Paper: Improvement of Technical Management of Internet Names and Addresses (1998)
• White Paper: Management of Internet Names and Addresses, Statement of Policy (2012)
  
  

National Laws or Court Rulings that may possibly apply to gTLDs, including

• U.S. Anticybersquatting Consumer Protection Act (ACPA), 15 USC §1125
• Judgement on preliminary ruling under Article 267 TFEU from Audiencia Nacional (Spain)
• Judgement on preliminary ruling under Article 267 TFEU from the Oberster Gerichtshof (Supreme Court, Austria)
• Judgment on preliminary ruling under Article 267 TFEU, from the Bundesgerichtshof (Federal Court of Justice, Germany)
• U.S. Supreme Court Case - McIntyre v. Ohio Elections Commission, 514 U.S. 334 (1995)
• The Constitution of the State of California (USA): Article 1, Section 1
• Massachusetts (USA) Right of Privacy, MGL c.214, s.1B
• U.S. Judicial Redress Act of 2015
• U.S. Federal Communications Commission Proposed Rule FCC 16-39: Protecting the Privacy of Customers of Broadband and Other Telecommunications Services
• Ghana Protection Act, 2012
• South Africa’s Act No. 4 of 2013: Protection of Personal Information Act
• U.S. Court of Appeals Decision: Microsoft v United States, Docket No. 14-2985, July 14, 2016

IETF RFCs

• Legacy WHOIS protocol (RFC 3912) (2004)
• Registration Data Access Protocol (RDAP - RFC 7480) (2015) and related RFCs 7481, 7482
  See also RDAP Operational Profile under WHOIS Improvements above 
• Extensible Provisioning Protocol (EPP - RFC 5730) (2009) and related RFCs 5731, 5732, 5733
• Inventory and Analysis of WHOIS Registration Objects (RFC 7485) (2015)
• Privacy Considerations for Internet Protocols (RFC 6973) (2013)

Other Industry Expert Publications identified by PDP WG sub-teams thus far

• Privacy & Information Security Law Blog: Article 29 Working Party Clarifies Purpose Limitation Principles
• Anti-Phishing Working Group Advisory on Utilization of Whois Data For Phishing Site Take Down (2008)
• Book: Global Tables of Data Privacy Laws and Bills (Greenleaf, 4rd Edition, January 2015)
• Article: Global data privacy laws 2015: 109 countries, with European laws now a minority (Greenleaf)
• WorldLII Database of National Data Privacy Legislation
• Blog: The EU General Data Protection Regulation - GDPR (Simon Stickley - Capco, 12 May 2016)

• Pew Research Center Surveys on Privacy:
  Anonymity, Privacy, and Security Online (2013)
  What Americans Think About Privacy (2014)
  Teens, Social Media, and Privacy (2013)

• eMarketer Article: Who Do Great Britain's Internet Users Trust with Data? (2016)

• Privacy by Design: 7 Foundational Principles (Ann Cavoukian - Ontario Information & Privacy Commissioner, 2009)

• International Association of Chiefs of Police (IACP) 2016 Resolutions: Support for Law Enforcement Access to Publicly Available and Accurate Internet Address Registration Data (2016)

  
  
  

Other Input Documents (summary of Background Documents page, repeated here for completeness) Other Input Documents

• General GNSO Processes & Background
• Board & GNSO Motions
• EWG Final Report, FAQs, and Research (2014)
• EWG RDS Tutorials and Webinars (2014)
• EWG Member Individual Statements and Blogs: (2014)
  
  • Dissenting Report from Stephanie Perrin [PDF, 108 KB] by Stephanie Perrin, EWG Member
  • How to Improve WHOIS Data Accuracy, by Lanre Ajayi, EWG Member
  • Where Do Old Protocols Go To Die?, by Scott Hollenbeck, EWG Member
  • Some Thoughts on the ICANN EWG Recommended Registration Directory Service (RDS), by Rod Rasmussen, EWG Member
  • Building a Better WHOIS for the Individual Registrant, by Carlton Samuels, EWG Member
• EP-WG Process Framework (2015)
• Issue Reports Report & Public Comments (2015)
• WG Charter (2015)
• Affirmation of Commitments (AoC)Tutorials

Additional key input documents may be added here as needed.