At-Large Workspace: Registration Directory Service (RDS-WHOIS2) Review Team Final Report

The ALAC welcomes the report of the registration directory service (RDS) second review team and takes this opportunity to provide its comments on the report herein.

We highlight the importance of recommendation R5.1 which addresses the accuracy of the data and we strongly advise its acceptance by the Board. Given the fact that the WHOIS Accuracy Reporting System (ARS) project has shown that there are many errors in existing registration data and taking into consideration the EPDP team phase one report on gTLD registration data which reduced the number of contact fields, ensuring accuracy is even more important than before. Entities that work to protect the Internet end users depend heavily on the accuracy of the data and the contact information provided through it. In addition, principle 5(1)d of the GDPR particularly requires that all reasonable steps are taken to ensure the personal data is not incorrect or misleading as to any matter of fact. Depending on the purpose of use of the data, it should be kept updated. To comply with GDPR, serve the purpose of collection (specifically to be able to contact the registrant), give the data subjects their rights and allow parties trying to protect end users to access useful data; implementation of this high priority recommendation is required.

In light of the GDPR and to enhance the accuracy of the data we note the importance of recommendations R4.1, R4.2 and CC.3 which address contractual compliance methodology and resourcing. Compliance should be taking a more pro-active position and not just responding to individual complaints. This also aligns with recent discussions during ICANN 66 on domain name abuse.

Recommendation R3.1 about documentation is also important to end users and to registrants. WHOIS is confusing to users and registrants and GDPR makes it more so. In addition GDPR requires documenting what we are doing.

The ALAC regards the team's findings with regard to recommendations LE.1 and LE.2 in relation to the law enforcement needs as very important. 89% of the respondents deemed RDS as very important in their investigations. We note that 60% of the respondents to the law enforcement survey responded that they did not have alternatives that would fulfill the same investigative need as the former WHOIS. However, when respondents who said they had alternative options were asked to identify the tools, the majority identified tools that also rely on RDS lookup. When asked about how investigation is affected if RDS information is not available on a public query basis, 79% indicated that investigations are either delayed or discontinued altogether. The ALAC welcomes the recommendations of the team and supports surveys and information gathering. In addition, we note to the importance of the surveys conducted by the review team to the EPDP team working on gTLD registration data policy development.

With regard to consumer trust the ALAC finds the definition of consumer trust in relation to the RDS provided by the WHOIS1 review final report which says “consumer trust can be narrowly construed to mean the level of trust users have in available WHOIS data; or more broadly as the level of trust consumers have in Internet information and transactions in general” as a very important guide when looking at the benefits of the RDS to users. The report notes that although users do not directly use the system nevertheless the data stored does indirectly significantly impact users.

Recommendations R11.1, R11.2 addressing the WHOIS portal are also important, although GDPR has reduced the amount of information publicly available, the portal is not delivering all of the data that is available, maintaining full functionality is required. The portal must provide all available information in a clear and usable fashion.  

With regard to recommendation R12.1 we would like to highlight the importance of the translation of the registration data. However, we understand that reviewing the effectiveness of the recommendations of the first review team in this regard is currently not possible and that such an evaluation will only be possible after the adoption of the new Registration Data Access Protocol (RDAP)

Finally, in light of the Temp. Spec and the new RDS policy being developed to comply with the GDPR the ALAC acknowledges the challenges that might have faced the review team in the development of the report. Nevertheless, we find the report including very useful information that should be used to guide the development of relevant policies. The ALAC appreciates the team’s effort and supports the provided recommendations.

Hadia ElMiniawi

12/3/2019 3:30 UTC

The ALAC welcomes the report of the registration directory service (RDS) second review team and takes this opportunity to provide its comments on the report herein. We note the importance of recommendation R5.1 which addresses the accuracy of the data. Given the fact that the WHOIS Accuracy Reporting System (ARS) project has shown that there are many errors in the registration data and taking into consideration the EPDP team phase one report on gTLD registration data, which reduced the number of contact fields, ensuring accuracy is even more important than before. Entities that work to protect the Internet end users depend heavily on the accuracy of the data and the contact information provided through it. In addition principle 5(1)d of the GDPR particularly requires that all reasonable steps are taken to ensure the personal data is not incorrect or misleading as to any matter of fact. Depending on the purpose of use of the data, it should be kept updated. In addition, all challenges to the accuracy of the data should be taken into consideration. To comply with GDPR, serve the purpose of collection, give the data subjects their rights and allow parties trying to protect end users to access useful data; implementation of this high priority recommendation is required. In light of the GDPR and to enhance the accuracy of the data we note the importance of recommendations R4.1, R4.2 and CC.3 that address compliance and resources for compliance. Compliance should be taking a more pro-active position and not just responding to individual complaints. This also aligns with the needs of important issues like domain name abuse. Recommendation R3.1 about documentation is also important to end users. WHOIS is confusing to users and registrants and GDPR makes it more so. In addition GDPR requires documenting what we are doing. The ALAC regards the team's findings with regard to recommendations LE.1 and LE.2 in relation to the law enforcement needs as very important. Where 60% of the respondents to a survey to identify possible alternatives to the RDS lookups that would fulfill the same investigative need, indicated that they do not have any other tool in this regard. In addition, 89% of the respondents deemed RDS as very important. The ALAC welcomes the recommendations of the team and supports surveys and information gathering. In addition, we note to the importance of the surveys conducted by the review team to the EPDP team working on gTLD registration data policy development. With regard to consumer trust the ALAC finds the definition of consumer trust in relation to the RDS provided by the WHOIS1 review final report which says “consumer trust can be narrowly construed to mean the level of trust users have in available WHOIS data; or more broadly as the level of trust consumers have in Internet information and transactions in general” as a very important guide when looking at the benefits of the RDS to users. The report mentions that although users do not directly use the system nevertheless the data stored does indirectly significantly impact users. Recommendations R11.1, R11.2  addressing the WHOIS portal are also important, although GDPR has reduced the amount of information publicly available, the portal is not delivering all of the data that is available, maintaining full functionality is required. With regard to recommendation R12.1 we would like to highlight the importance of the translation of the registration data. However, we understand that reviewing the effectiveness of the recommendations of the first review team in this regard is currently not possible and that such an evaluation will only be possible after the adoption of the new Registration Data Access Protocol (RDAP)

Finally, in light of the Temp. Spec and the new RDS policy being developed to comply with the GDPR the ALAC acknowledges the challenges that might have faced the review team in the development of the report. Nevertheless, we find the report including very useful information that should be used to guide the development of relevant policies. The ALAC appreciates the team’s effort and supports the provided recommendations.

Hadia Elminiawi

The ALAC welcomes the report of the registration directory service (RDS) second review team and takes this opportunity to provide its comments on the report herein. The ALAC fully supports the recommendations in relation to objective one with regard to the recommendations of the first RDS review team and we particularly note the importance of recommendation R5.1 addressing the data accuracy. Principle 5(1)d of the GDPR particularly requires that all reasonable steps are taken to ensure the personal data is not incorrect or misleading as to any matter of fact. Depending on the purpose of use of the data, it should be kept updated. In addition, all challenges to the accuracy of the data should be taken into consideration. To comply with GDPR, serve the purpose of collection and give the data subjects their rights; implementation of this high priority recommendation is required. We also note the importance of this recommendation in supporting the entities that work to protect the Internet end users. With regard to recommendation R12.1 we would like to highlight the importance of the translation of the registration data. However, we understand that reviewing the effectiveness of the recommendations of the first review team in this regard is currently not possible and that such an evaluation will only be possible after the adoption of the new Registration Data Access Protocol (RDAP). The ALAC regards some of the findings with regard to objective three in relation to the law enforcement needs as very important. Where 60% of the respondents to a survey to identify possible alternatives to the RDS lookups that would fulfill the same investigative need, indicated that they do not have any other tool in this regard. In addition, 89% of the respondents deemed RDS as very important. The ALAC welcomes the recommendation of the team and supports surveys and information gathering. In addition, we note to the importance of the surveys conducted by the WHOIS2 review team to the EPDP team working on gTLD registration data policy development. In addressing objective four, consumer trust the ALAC finds the definition of consumer trust in relation to the RDS provided by the WHOIS1 review final report which says “consumer trust can be narrowly construed to mean the level of trust users have in available WHOIS data; or more broadly as the level of trust consumers have in Internet information and transactions in general” as a very important guide when looking at the benefits of the RDS to users. The report mentions that although users do not directly use the system nevertheless the data stored does indirectly significantly impact users. The ALAC would like to emphasis on the findings of the review team and its importance to the Internet users.

Finally, in light of the Temp. Spec and the new RDS policy being developed to comply with the GDPR the ALAC acknowledges the challenges that might have faced the review team in the development of the report. Nevertheless, we find the report including very useful information that should be used to guide the development of relevant policies. The ALAC appreciates the team’s effort and supports the provided recommendations.