[council] Public input on current WHOIS recommendation from Marc Rotenberg, Director of the Electronic Privacy Information Center

["Bruce Tonkin" <Bruce.Tonkin@xxxxxxxxxxxxxxxxxx>]

Hello All,
 
I pass this message on to the Council as part of the public comments
regarding the current WHOIS recommendation before the Council.   This
comment was referenced during our recent GNSO Council teleconference.
 
Regards,
Bruce

To the ICANN GNSO Council,

I have been asked to provide an opinion regarding the 
proposal to adopt a WHOIS "privacy" policy that simply
requires the registrars to provide information about the
purpose of  the WHOIS service, third-party bulk access,
and the categories of information for the registered
name holder that will be made available to the public. The
current proposal does not advise registrants of any legal
rights they may have. It does not provide a redress mechanism
if their personal information is misused. It lacks transparency
as to the disclosure of their data. And it fails to provide basic
contact information for the person responsible for the data.

>From the perspective of privacy protection, the current
proposal is more likely to undermine Internet privacy than
it is to protect it. In this context, notice operates as a
disclaimer, i.e. it provides a "take it or leave it" proposition
to the registrant. There are not even  obligations established 
to safeguard the data that is collected.

The only theoretical basis for a notice-based privacy regime
is where there are market-based alternatives that would
allow an individual to select from among competing
policies But since the ICANN seeks to establish a policy
that will cover all registrars, there is no market-based
alternative. 

I would urge you to establish a privacy policy for WHOIS data
based on Fair Information Practices. Simply stated, this
approach would establish responsibilities for those entities
that collect and use personal information and rights for
those who are asked to provide personal information.
This is the basis of privacy laws all around the world.
Significantly, this is also the approach taken in policy
frameworks that seek to facilitate the flow of personal
information across national borders. This includes, for
example, the OECD Privacy Guidelines of 1981 and the
recently adopted APEC Privacy Framework.

Thank you for your consideration of these views.
Sincerely,
Marc Rotenberg
EPIC

REFERENCES
APEC Privacy Framework (2004)
OECD Privacy Guidelines (1981)
M. Rotenberg, "The Privacy Law Sourcebook: United States Law, 
  International Law, and Recent Developments" (EPIC 2003)
M. Rotenberg, "Fair Information Practices and the Architecture
  of Privacy (What Larry Doesn't Get)" 2001 Stanford Technology
  Law Review 1.
D. Solove, M. Rotenberg, "Information Privacy Law" (Aspen 2003)