General Data Protection Regulation

The General Data Protection Regulation (GDPR) or Regulation (EU) 2016/679 is a regulation designed to modernize and harmonize the data protection laws across the European Union (EU), giving citizens and residents of the EU more control of their data and providing a more consistent regulatory framework for businesses. This new EU data protection framework will replace the Data Protection Directive, or Directive 95/46/EC of 1995. Enforcement for the GDPR goes into effect on 25 May 2018.

The GDPR places specific legal obligations on 'controllers' and 'processors', those who acts as intermediaries between the user/consumer and themselves, the government or any other actor. The controller determines how and why data is processed and processors act on the controller's behalf. Processors maintain data records and are held responsible in case of a breach.

With the update on existing legislation, the GDPR is more precise and inclusive of what constitutes private information than its predecessor. Personal data, that is anything that can identify a user, including an IP address is included, as well as 'sensitive personal data' which may include genetic and biomedical data.

Applicability and Scope

Under the Data Protection Directive of 1995 only applied to companies with legal establishment in an EU country or uses equipment located in the country to process the data. The GDPR expands the territorial reach to include controllers or processors outside of the EU for data processing activities relating to the offering of goods or services to individuals in the EU or to the monitoring of their behavior. EU guidance has made it clear that any website that offers goods or services to EU residents, or that routinely processes and/or stores data of website visitors is technically subject to GDPR enforcement. Two exceptions apply to this broad statement:

1. The GDPR only applies to organizations engaged in “professional or commercial activity.” Note that "professional or commercial activity" is only defined in contrast to "personal or household activity." "Enterprise" is defined in Article 4 as "a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity." This seems to assign "professional or commercial activity" by inference to the activity of "enterprises," while "personal or household activity" is described as a "natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity." However, natural people can be "enterprises" under the definition. The EU guidance suggests, for example, that "if you’re collecting email addresses from friends to fundraise [for] a side business project, then the GDPR may apply to you."
2. Small- and medium-sized enterprises (SMEs - defined as having less than 250 employees) are not totally exempt from the GDPR, but they do not have to comply with the record-keeping regulations in Article 30.

GDPR and WHOIS

The GDPR directly impacts the domain name space, most notability the WHOIS service. Prior to the GDPR enforcement date, ICANN's contracted parties (Registries and Registrars) expressed concern about their about to comply with their contractual requirement and be GDPR compliant. In light of this concern and the uncertainty around the implications of GDPR on WHOIS, ICANN announced that it would defer action against registries and registrars for noncompliance related to registration data.

The "Cookbook"

On 8 March 2018, the ICANN Organization released its "Interim Model for Compliance with ICANN Agreements and Policies in Relation to the European Union's General Data Protection Regulation," (or The Cookbook) including a description of the interim model, as well as explanation and rationale for its plan. The Cookbook also provides open question about several elements, seeking guidance from the community and DPAs.

Temporary Specification ("Temp Spec")

On 17 May 2018 the Temporary Specification for gTLD Registration Data was approved by the ICANN Board. If a contracted parties is based in the European Economic Area or deals with EEA-based registrants it is required for them to to redact the following data from public whois records, unless the Registered Name Holder consents to its publishing:

• Registry Registrant ID
• Registrant Name
• Registrant Street
• Registrant City
• Registrant Postal Code
• Registrant Phone
• Registrant Phone Ext
• Registrant Fax
• Registrant Fax Ext

Notwithstanding, if the contact (e.g., Admin, Tech) does not consent, the analogous Tech and Admin data must also be redacted.

Accreditation Model

Under the Temporary Specification Policy, Appendix A, point 4.1, it is extablished that Registrars and Registries must comply to requests from third parties with legitimate interests.

Registrar and Registry Operator MUST provide reasonable access to Personal Data in Registration Data to third parties on the basis of a legitimate interests pursued by the third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Registered Name Holder or data subject pursuant to Article 6(1)(f) GDPR. 

At ICANN62 it was discussed how a layered Accreditation Model would look like, which would allow third parties with legitimate interests to have access to Personal Data in Registration Data regarding the fields relevant to their legitimate interests. This is, as of 27 June 2018, still under debate.

Similiar Initiatives in Other Countries

India is exploring a similar data protection measure, and has a call for public comments on a white paper. It is available for comment as of March 2018.

Brazil's legislative is currently debating two Data Protection Bills, one of which was designed as to be GDPR-compliant.

General Data Protection Regulation