For the past few months, ICANN (Internet Corporation for Assigned Names and Numbers), a charitable association under Californian law that administers certain top-level domain names, has been involved in an overhaul of WHOIS. This search service publicly lists the names and contact details of domain name holders.

Following extensive research, ICANN published a new temporary model on Feb. 28 that substantially modifies the philosophy of WHOIS. This model, dubbed “Calzone," is designed to protect the private lives of domain name holders by guaranteeing that their names will remain confidential. As a reminder, up until now, anyone reserving a domain had to declare publicly that they had done so, as their name as the holder was shown in WHOIS. In practice, the effects of this advertising mechanism had already been diminished: Some registrars and registries (that are not subject to the ICANN’s rules) have been proposing anonymization methods for several years. An example of such a case is AFNIC, a French registry administering .fr domains, among others, which anonymizes the names of natural person holders by default.

At the root of this WHOIS overhaul lies a relatively old problem: bringing WHOIS into compliance with European principles on personal data protection. The entry went into effect in 2016 (and the impending entry into application May 25, 2018), and Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data merely accelerated the work to overhaul this public mega-directory.

The major contribution of the Calzone model is its innovative approach to confidentiality. The categories of data processed by WHOIS do not actually change: It is how this data is accessed and distributed that has been revolutionized. From now on, there will be a distinction between the public WHOIS (which will show limited information) and the WHOIS that requires certified access (containing all the data).

ICANN has thus (at least temporarily) sounded the death-knell of having an open-access WHOIS by default. This is a major change in vision, and comes in the wake of various correspondence sent by WP29 to the American regulatory authority. For several years, European data protection authorities had been voicing their concerns as to the legality of the WHOIS mechanism. In a letter dated Dec. 11, 2017, WP29 clearly indicated that ICANN could not have a legitimate interest in publicly releasing WHOIS data.

Calzone is the direct response to these concerns. Nonetheless, this model does not offer the greatest protection of all the models presented by ICANN during its preparatory work, and in certain aspects, differs from some very protective models, such as the model proposed by the Electronic Frontier Foundation.

The emergence of a restricted public WHOIS

The aim of the new model is clear: to stop personal data being released publicly, unless the domain holder in question freely and expressly consents. Domain holders, as well as their administrative and technical contacts, will have their personal data withheld from publication by default, and their contact email will be anonymized within the public WHOIS:

Although the field of application is still the subject of heated debate, the Calzone model will apply indiscriminately to natural persons and legal persons holding domains. ICANN has thus taken the decision to extend the guarantees of confidentiality offered by its model to the names of legal person domain holders (the names of one-person companies, the legal representative’s email address, etc.). It will be recalled that in a judgment of March 2017, the Court of Justice of the European Union had opened a crack in the fundamental rights of respect for one’s private life and the protection of personal data, guaranteed by the Charter of Fundamental Rights of the European Union, in that it refused to guarantee physical persons the right to have their personal data entered in the trade and companies register deleted.

Furthermore, for holders who would like their personal data to be publicly available, ICANN has provided for an opt-in mechanism. Registrars will be responsible for asking for this opt-in when registering a domain. In practice, rights holders and professionals specializing in purchasing and reselling domain names will be the main parties responsible for exercising such an option in the future.

An imprecise accreditation mechanism

If the Calzone model is to offer genuine protection of holders’ private lives, the terms and conditions of access and accreditation to the restricted WHOIS must themselves protect the private lives of domain holders. For ardent defenders of people’s private lives, the data contained in this WHOIS may be communicated solely under the strict circumstances stipulated by law: to legal and/or administrative authorities, including in the context of requisitions.

ICANN decided to opt for a compromise solution. Some parties have spoken out in favor of not losing access to the data contained in the current WHOIS. One such category of parties encompasses the rights holders who joined forces under the Intellectual Property Constituency to assert their rights against ICANN. As restated on January 29, 2018, in a letter sent by three European Commissioners to ICANN, the information contained in WHOIS is currently used not only by police forces but also by private parties, such as the holders of intellectual property rights and certain bodies specializing in cybersecurity.

These are specifically the types of party who may be entitled to authorizations granting them access to all data in the restricted WHOIS. ICANN is expected to give details in the very near future on how accreditations can be obtained in practice. These rules and procedures will be defined in collaboration with the Governmental Advisory Committee.

It now remains to be seen whether such interests can justify the existence of this model and, in particular, constitute legitimate grounds as a basis for the lawfulness of the data processing effected, in accordance with Article 6-1(f) of the General Data Protection Regulation. Without a doubt, WP29 will take a detailed look at this issue, which will be closely linked to the more or less strict procedure allowing private individuals to access the personal data contained in the restricted WHOIS.

A model applicable worldwide

The principle of extraterritoriality defined under Article 3 of the General Data Protection Regulation is properly complied with by ICANN. The Calzone model will thus apply as soon as one of the following three conditions is met:

• The registry and/or registrar are based within the European Economic Area.
• The registry and/or registrar are based outside the EEA, but offer services to persons located within the EEA.
• The registry and/or registrar are based outside the EEA, and do not offer services to persons located within the EEA, but have recourse to a subcontractor within the EEA.

Registries and/or registrars can also choose to follow the Calzone model, even outside the cases imposed by ICANN.

In practice, merely offering to sell a domain to a person located within the EEA will be sufficient to trigger the application of the Calzone model. Non-European registries and registrars would therefore be well-advised to follow the Calzone model, at the risk of having to use two different models based on where their customers are located geographically.

No change to the fundamentals

ICANN has proven to be considerably less daring on a certain number of other principles that govern how WHOIS functions. One such principle is the one governing retention periods. The rules on this issue remain the same: Data will be conserved for two years after the domain’s registration period has ended, unless the registrar has received a “data retention waiver request." This mechanism allows some registrars to obtain derogations in order to comply with their respective national legislation. To date, 35 registrars have been granted such arrangements for retention periods, following in the footsteps of OVH, which was the first registrar to obtain such a derogation, and whose conservation obligations are now limited to one year after a domain’s registration period ends.

The rules for transferring data between registries, registrars and custodians designated by ICANN to conserve data remain unchanged. They will certainly imply that these parties will have access to the restricted WHOIS.

Finally, it should be recalled that the Calzone model applies solely to the domains administered by ICANN. As a result, numerous domains are not affected, such as national top-level domains: the ccTLDs (.fr, .be, .dk, etc.). Since each registry has its own interpretation of the regulations, the likelihood is that the current upheavals will result in a multitude of different models emerging. It is, therefore, disappointing to see that there is no real drive for standardization between registers. Such a standardization would, without a doubt, promote greater transparency in favor of citizens and the processing operations for data concerning them.

photo credit: hasgeek via photopin.