Second Registration Directory Service Review

The Second Registration Directory Service Review (RDS2, also known as WHOIS2) was initiated in the fall of 2016 and completed in September 2019. Implementation of recommendations is ongoing as of May 2021.

Background

The Affirmation of Commitments, an agreement between ICANN and the United States Department of Commerce, establishes ICANN's obligations to perform its duties with specific commitments in mind. All of the commitments bear on public and consumer trust of the organization. ICANN is to perform its functions in a manner that:

• ensures accountability and transparency of decision-making;
• preserves the security, stability, and resiliency of the DNS;
• promotes competition, consumer trust, and consumer choice; and
• enables access to registration data.

ICANN is also charged to periodically review and assess its performance through the lens of each of the above commitments.

ICANN's board enshrined these commitments (and the associated reviews) in its Bylaws in Article 1 (Mission, Commitments, and Core Values) and in Article 4 (Accountability and Review). Article 4.6 deals with "Specific Reviews," each of which are tied to one of the commitments in the Affirmation of Commitments.

The Organizational Effectiveness Committee of the board oversees the conduct of specific reviews. The RDS is one such review. The Affirmation of Commitments specifies that RDS reviews should be carried out by volunteers from among the community, as well as "experts, and representatives of the global law enforcement community, and global privacy experts."

External Factors and Timing of Substantive Work

The General Data Protection Regulation was passed by the EU in 2016, with full implementation planned for May 2018. The implications of this regulation on WHOIS data collection and display was the subject of much conversation within the ICANN community. As the RDS2 review was being planned, ICANN staff and organizations were preparing to begin work to craft the Temporary Specification for gTLD Registration Data. In addition, the Implementation Advisory Group on WHOIS Conflicts with National Privacy Laws completed work in the spring of 2016.

As a result of the crowded work environment, and citing concerns about volunteer workload, the board extended the deadline for volunteer applications twice, with a final deadline set for March 20, 2017. The review team was not fully formulated until June 2017, and did not deliver its Terms of Reference until February 2018.

At that time, the review team noted a total of nine ongoing projects which might potentially overlap with the scope of review:

• GNSO PDP on Next-Generation Registration Directory Service (RDS)
• Registration Data Access Protocol (RDAP) Implementation
• Cross-Field Address Validation
• Translation and Transliteration of Contact Information Implementation
• Privacy/Proxy Services Accreditation Implementation
• ICANN Procedures for Handling WHOIS Conflicts with Privacy Laws
• WHOIS Accuracy/GAC Safeguard Advice on WHOIS Verification and Checks
• Implementation of THICK WHOIS
• ICANN organization’s work with the community on GDPR Compliance with existing agreements with registries and registrars

In its Terms of Reference document, the team also noted that some review work may need to be deferred pending policy decisions and directions that might emerge from the above list:

In recognition that the WHOIS landscape will be changing, perhaps radically, over the coming months as ICANN addresses how it will respond to the EU General Data Protection Regulation (GDPR), the review team may choose to defer some or all of its work in relation to the scope items on Law Enforcement Needs, Consumer Trust and Safeguarding Registrant Data until it is more clear what path ICANN will be following. Should any work be deferred, individual timelines may slip. However, it is the intent of the review team that the overall schedule calling for the final report to be delivered by the end of December 2018 not change appreciably.

Scope of Review

In November 2016, the chairs of ICANN's supporting organizations and advisory committees proposed a narrowed scope of review for RDS2, given the crowded and uncertain field of work being conducted at the same time.. The proposal suggested a narrow focus on review of implementation of RDS1 recommendations. The proposal was summarized in a memo prepared for the review team in February 2017. SO and AC commentary on the proposal was included.

After deliberation among the review team regarding the possibility of a narrowed scope of review, the team decided that it should engage topic areas beyond simply reviewing the progress made on RDS1 implementation:

After much discussion the RDS-WHOIS2 Review Team decided that it would review all of the Bylaw mandated areas, except the OECD Guidelines, as they were under consideration by the Next-Generation gTLD RDS PDP and were judged to be less relevant, particularly in relation to the GDPR. In addition, the RDS-WHOIS2 Review Team included in its scope a review of new policy adopted by ICANN since the WHOIS1 Review Team published its report, and decided to perform a substantive review of Contractual Compliance with the intent of (a) assessing the effectiveness and transparency of ICANN enforcement of existing policy relating to RDS (WHOIS) through ICANN Contractual Compliance actions, structure and processes, including consistency of enforcement actions and availability of related data, (b) identifying high-priority procedural or data gaps (if any), and (c) recommending specific measurable steps (if any) the team believes are important to fill gaps.

Commencement of Review & Findings

Substantive work began with the drafting of the Terms of Reference document in 2018.

Generic Names Supporting Organization. Develops and recommends to the Board substantive policies relating to generic top-level domains and other responsibilities set forth in the Bylaws (ICANN Bylaws).

Policy Development Process

Governmental Advisory Committee. Considers and provides advice on the activities of ICANN as they relate to concerns of governments, particularly matters where there may be an interaction between ICANN's policies and various laws and international agreements or where they may affect public policy issues (ICANN Bylaws).

General Data Protection Regulation