[council] [Fwd: Statement from Electronic Privacy Information Center]

[Robin Gross <robin@xxxxxxxxxxxxxx>]

--- Begin Message ---

• To: robin@xxxxxxxxxxxxx, ross@xxxxxxxxxx, bruce.tonkin@xxxxxxxxxxxxxxxxxx, Jordyn@xxxxxxxxxxxxx
• Subject: Statement from Electronic Privacy Information Center
• From: KathrynKL@xxxxxxx
• Date: Thu, 18 Aug 2005 09:18:14 EDT
• Delivery-date: Thu, 18 Aug 2005 06:18:26 -0700
• Envelope-to: robin@xxxxxxxxxxxxx

Could you kindly forward the following to Council?
------------------------------------------------------------------------------
-------------------------------------------
Marc Rotenberg, Director of the Electronic Privacy Information Center just 
issued the following written statement of the waiever concerns in the  WHOIS 
"Notification and Consent" item.

Thank for the opportunity to address Council at this meeting.  I hope this 
statement will assist in the work ahead.  Regards, Kathy Kleiman, NCUC WHOIS TF 
Member:
------------------------------------------------------------------------------
------------------------

To the ICANN GNSO Council,

I have been asked to provide an opinion regarding the 
proposal to adopt a WHOIS "privacy" policy that simply
requires the registrars to provide information about the
purpose of  the WHOIS service, third-party bulk access,
and the categories of information for the registered
name holder that will be made available to the public. The
current proposal does not advise registrants of any legal
rights they may have. It does not provide a redress mechanism
if their personal information is misused. It lacks transparency
as to the disclosure of their data. And it fails to provide basic
contact information for the person responsible for the data.


>From the perspective of privacy protection, the current
proposal is more likely to undermine Internet privacy than
it is to protect it. In this context, notice operates as a
disclaimer, i.e. it provides a "take it or leave it" proposition
to the registrant. There are not even  obligations established 
to safeguard the data that is collected.


The only theoretical basis for a notice-based privacy regime
is where there are market-based alternatives that would
allow an individual to select from among competing
policies But since the ICANN seeks to establish a policy
that will cover all registrars, there is no market-based
alternative. 


I would urge you to establish a privacy policy for WHOIS data
based on Fair Information Practices. Simply stated, this
approach would establish responsibilities for those entities
that collect and use personal information and rights for
those who are asked to provide personal information.
This is the basis of privacy laws all around the world.
Significantly, this is also the approach taken in policy
frameworks that seek to facilitate the flow of personal
information across national borders. This includes, for
example, the OECD Privacy Guidelines of 1981 and the
recently adopted APEC Privacy Framework.


Thank you for your consideration of these views.


Sincerely,


Marc Rotenberg
EPIC




REFERENCES


APEC Privacy Framework (2004)


OECD Privacy Guidelines (1981)


M. Rotenberg, "The Privacy Law Sourcebook: United States Law, 
International Law, and Recent Developments" (EPIC 2003)


M. Rotenberg, "Fair Information Practices and the Architecture
of Privacy (What Larry Doesn't Get)" 2001 Stanford Technology
Law Review 1.


D. Solove, M. Rotenberg, "Information Privacy Law" (Aspen 2003)

--- End Message ---