[dow1-2tf] Constituency statements Whois task force 1&2

["GNSO SECRETARIAT" <gnso.secretariat@xxxxxxxxxxxxxx>]

Whois task Force 1 & 2

Four Constituency Statements have been received.

A. Intellectual Property Interests Consitituency (IPC)
B. Registrars Constituency
C. Non Commercial Users Constituency (NCUC)
D. Commercial and Business Users constituency (BC)

They have all been put on one mail, in the order that were received, for
convenience sake:

Intellectual Property Constituency (IPC) Statement on Whois Task Force 1/2

Recommendation: Improving Notification and Consent for the Use of Contact
Data in the Whois System
This statement responds to the request for constituency input on the Whois
Task Force 1/2 recommendations regarding improving notice and consent for
the use of contact data in the Whois database. See Call for constituency
statements on Whois tf 1/2 recommendations, available at
http://gnso.icann.org/mailing-lists/archives/dow1-2tf/msg00191.html.
Pursuant to requirements of the GSNO policy development process, outlined by
the ICANN bylaws, see Annex A, Sec. 7(d), available at
http://www.icann.org/general/archive-bylaws/bylaws-19apr04.htm, the IPC came
to the following conclusion.

I. Constituency Position

This set of recommendations, see
http://gnso.icann.org/issues/whois-privacy/whois-notification-30nov04.pdf,
is the first of two that have been put forward by the joint task force. The
second set of recommendations, available at
http://gnso.icann.org/issues/whois-privacy/whois-tf-conflict-30nov04.pdf,
has not yet been formally offered to the GNSO constituencies for comment.
The notification and consent recommendations are based on a similar
recommendation from the previous Task Force 2, tasked with reviewing issues
surrounding the data collected and displayed in the Whois database. At the
outset of the work of that earlier Task Force (April 2004), IPC submitted a
constituency statement on the purposes of the task force, which stated in
relevant part:

Based on the limited data which has been collected so far, IPC believes that
the effectiveness of notification to domain name registrants, and the
obtaining of their consent as required by the RAA Secs. 3.7.7.4, 3.7.7.5,
generally need improvement.

For example, obtaining specific consent on this issue from the registrant
during the registration process, separate from obtaining agreement to
extensive terms and conditions for the registration in general, should be
encouraged. Similarly, some registrars should be more specific and
forthright in communicating to registrants about the circumstances under
which Whois data is available to third parties.

ICANN should:

" incorporate compliance with the notification and consent requirement as
part of its overall plan to improve registrar compliance with the RAA. (See
Memorandum of Understanding Amendment II.C.14.d, available at
http://www.icann.org/general/amend6-jpamou-17sep03.htm).

" issue an advisory reminding registrars of the importance of compliance
with this contractual requirement, even registrars operating primarily in
countries in which local law apparently does not require registrant consent
to be obtained.

IPC believes that registrars should take the lead in developing best
practices, with input from other interested constituencies, that will
improve the effectiveness of giving notice to, and obtaining consent from,
domain name registrants with regard to uses of registrant contact data. IPC
would be glad to participate in such an effort.

IPC Constituency Statement on Whois Task Force 2 (April 13, 2004) available
at http://www.gnso.icann.org./mailing-lists/archives/dow2tf/msg00191.html.

In IPC's view, the current set of recommendations is responsive to the
concerns voiced in our earlier constituency statement. Their implementation
should help to address the problems identified and to increase the
likelihood that registrants are providing fully informed consent.

IPC continues to believe that its two suggestions bulleted in the April 2004
statement should be implemented, but we recognize that these suggestions may
fall outside the scope of the current Policy Development Process. In any
case, we do not perceive any inconsistency between these suggestions and the
recommendation currently under consideration. We also renew our offer to
work with interested registrars to help develop best practices in this area.

We find the recommendations ambiguous in some respects and suggest a few
drafting changes to clarify these points.

Recommendation 1 states that "[l]inking to an external web page is not
sufficient" to provide the required disclosure. It is unclear to us what an
"external" (or "internal" for that matter) web page is. Perhaps this
sentence could be amended to read: "Linking to a web page is not
sufficient."

Recommendation 2 states that disclosures must be "set aside" from other
provisions of the registration agreement if the disclosure is presented as
part of the agreement. It is unclear what "set aside" means. Futhermore,
Recommendation 2 allows as an alternative that disclosures may be presented
"separate from the registration agreement." This might be viewed as
inconsistent with the requirement in Recommendation 1 that the disclosure be
provided "during the registration process." As such, Recommendation 2 could
be amended as follows: "Such disclosures must be displayed prominently and
conspicuously prior to the agreement being executed by the registrant,
regardless of whether they appear as a term of the agreement or separate
from the agreement."

IPC also suggests that the recommendations include notice to registrants of
the consequences of providing false or inaccurate Whois data during the
registration process. The text of such a notice could be similar to what
registrars provide registrants pursuant to the Whois Data Reminder Policy.
See http://www.icann.org/registrars/wdrp.htm.

We also identify two very minor typographical errors that should be
corrected. In the title, the word "of" should appear between "Use" and
"Contact." In the first line of Recommendation 3, the second "registrars"
should be changed to "registrants."

In general, IPC supports the recommendation put forward by the Task Force,
and commends it for its hard work and its success at coming to consensus. We
hope that similar consensus can be reached as the Task Force examines other
policy issues surrounding the Whois database. IPC believes this
recommendation will have a positive effect for Internet stakeholders as a
whole, not just registrants. The more clearly the Whois policy is disclosed
to registrants, the more effective their stated consent to this policy will
be. In addition to giving registrants the information they need to make
informed choices, implementation of this policy may very well result in
general improvements to the Whois database as a whole.

II. Methodology for Reaching Agreement on IPC Position

IPC drafted and circulated via email a constituency statement, soliciting
input from its members. IPC members suggested edits and additions to the
draft which were subsequently incorporated into the finalized constituency
statement.

III. Impact on Constituency

This recommendation will have a positive impact on IPC by potentially
enhancing the utility of the Whois database, a vital tool for protecting
intellectual property rights in the online environment. IPC does not
anticipate any direct financial impact on the constituency as a result of
this policy. We think any costs associated with this policy will be minimal;
if there are any, those costs will most likely be initially borne by
registrars, and ultimately passed onto registrants, including IPC members,
many of whom hold registrations for literally thousands of domain names.

IV. Time Period Necessary to Complete Implementation

We would not anticipate that an extensive time period would be necessary to
implement this policy, as it would apply only to new registrations or
renewals and would not require new contracts with existing registrants.


B. REGISTRAR CONSTITUENCY:
# RC Preliminary Submission ---------------------------------------

Whereas, the GNSO Registrar Constituency ("RC") has considered the
proposed policy recommendations of Whois Task Force 1/2 in their
entirety;

Whereas, the RC believes that the continued stability of the
registration process depends on its simplicity, straightforwardness, and
transparency;

Whereas, burdening this process with policy and consumer rights
education notices diminishes its simplicity, straightforwardness and
transparency;

Whereas, the RC believes that prescribing the method of notification
from registrants interferes with the simplicity of this process,
discourages desirable business innovations, and represents entirely new
obligations that would require many registrars to completely
re-establish their method of registration;

Whereas, the RC appreciates and understands the concerns of the task
force pertaining to Recommendations #2 and #3, but does not agree with
the costly and difficult to implement proposal to require the specific
highlighting of one provision out of the many important provisions
contained within the registration agreement;

Whereas, the requirements in Recommendation #3 already are mandated in
the current Registrar Accreditation Agreement in sub-sections 3.7.7.4,
3.7.7.5, and 3.7.7.6; and

Whereas, no data or evidence has been presented that indicate that the
requirements of the current RAA are unsuitable or ineffective; and
implementing a separate and additional acknowledgement from registrants
as proposed would be a costly and cumbersome process that cannot be
practically implemented in the current environment.

Therefore, it is resolved that;

[Resolved 1.0]; the Registrar Constituency does not support adopting
Recommendation #1 as consensus policy, but would support a
recommendation in the following form:

"Registrars must ensure that disclosures regarding availability and
third-party access to personal data associated with domain names
actually be available to registrants during the registration process;"

[Resolved 2.0]; the Registrar Constituency does not support adopting
Recommendation #2 as consensus policy, but encourages registrars to
increase such notification to registrants on a voluntary basis;

[Resolved 3.0]; the Registrar Constituency does not support adopting
Recommendation #3 as a consensus policy, as it believes that the current
RAA requirements are sufficient, but encourages registrars to increase
such notification to registrants on a voluntary basis;

[Resolved 4.0]; the foregoing positions of the Registrar Constituency be
reported to the Whois Task Force 1/2 and be included in any Task Force
report; and

[Resolved 4.1]; the Task Force members from the Registrar Constituency
represent the foregoing positions at Task Force 1/2.


C. NON COMMERCIAL USERS CONSTITUENCY

Statement of the Noncommercial Users Constituency on Whois Task Force
1/2 Recommendation: Improving Notification and Consent for the Use of
Contact Data in the Whois Service

1. Constituency position
Noncommercial domain name users welcome efforts to ensure that domain
name registrants are better informed about the publication of their
private contact information via the Whois system. Public, anonymous
access to private contact information poses a number of risks to
registrants and may violate their rights to privacy. Until this
situation is reformed, conspicuous notification is essential.

The text we reviewed contains an error. Under point 3, the sentence
"Registrars must obtain a separate acknowledgement from registrars that
they have read and understand these disclosures" should read
"Registrars must obtain a separate acknowledgement from _registrants_
that they have read and understand these disclosures."

NCUC strongly supports the requirement to set aside the notification
and to require a distinct and separate acknowledgement from registrants
that they are aware of the exposure of their private information. We
observe, however, that for customers registering multiple domain names
in the same transaction, only one such acknowledgement should be
required. The constituency would like to make sure that the same
notification and acknowledgement should take place during renewals.

We strongly support the statement "The wording of the notice provided
by registrars should, to the extent feasible, be uniform." Because of
the highly competitive nature of the registrar business, registrars
have
an incentive to downplay or obscure the privacy implications of
registering a domain name because they fear it may deter customers from
signing up. The specific wording of the notification, therefore, should
not be left to the discretion of registrars. We suggest that the wording
be developed by staff subject to the approval of the GNSO Council, and
translated as literally as possible into different languages by an
independent party. This language should then be incorporated into the
Registrar Accreditation Agreement.

2. Method for Reaching Agreement on NCUC position

NCUC's Chair drafted and circulated via email a constituency statement
on its discussion list, soliciting input from its members. A minor
addition to the draft, concerning renewals, was suggested and agreed and
incorporated into the constituency statement. All comments were
supportive except for one, which  emphasized the additional burden on
registrants of the additional process.

3. Impact on Constituency.
While there is some recognition that the registration process might be
slightly more complicated as a result of the proposed change, all member
organizations but one considered the benefits of more prominent
notification and registrant awareness to outweigh any burden.


D. COMMERCIAL AND BUSINESS USERS CONSTITUENCY

PROVISIONAL COMMENTS OF THE BC:
The BC membership has reviewed the comments provided and we are submitting
these as the provisional comments, while we conclude the validation of our
membership. That will be completed shortly. We do not expect changes to
these comments, however. Thus, these comments can be taken as the input of
the BC.

The BC has several questions about the proposed recommendation which are
described below, along with some suggested modifications; however, the BC
fully supports the general intent of the draft policy recommendation.

Suggested changes or requests for clarification are noted below, embedded in
a copy of the recommendation. Immediately following our suggested changes
are further comments and suggestions.

Suggested modifications to the Proposed Policy:
(modifications are in CAPITALS: () are the original GNSO Secretariat)

1. Registrars must ensure that (disclosures) NOTICES regarding availability
and POSSIBLE third-party access to personal data associated with domain name
REGISTRATIONS actually be presented to registrants during the registration
process IN A MANNER THAT IS EASILY VISIBLE AND DISTINCT TO THE REGISTRANT .
. Linking to an external web page is not sufficient.

2. Registrars must ensure that these NOTICES (disclosures)  are set aside
from other provisions of the registration agreement if they are presented to
registrants together with that agreement.

Alternatively, registrars may present data AVAILABILITY AND DATA access
(disclosures)NOTICES separate from the registration agreement, AS LONG AS
THE REGISTRATION CANNOT BE COMPLETED UNTIL THERE IS ACKNOWLEDGEMENT OF THE
NOTICE. The wording of the notice provided by registrars should, (to the
extent feasible,) be uniform AND BASED ON GUIDANCE INCLUDED IN THE CONSENSUS
POLICY.

3. Registrars must obtain a separate acknowledgement from REGISTRANTS that
they have read and understand these (disclosures)NOTICES. This provision
does not affect registrars' existing obligations to obtain registrant
consent to the use of their contact information in the WHOIS system,AS A
REGISTRANT MUST PERMIT SUCH USE BEFORE REGISTRATION CAN OCCUR.

General Input and Further Comments of the BC

The BC suggests that it is preferable to use the term ?notice?, since the
use of disclosure makes it sound as though the registrars are making the
decision individually regarding the requirement to provide accurate data and
to have that data included in the WHOIS database.

In fact, the registrant is required by current policy to provide accurate
information and we believe that the purpose is to remind the registrants of
their obligations.

Secondly, we recommend the use of uniform and consistent notices. We believe
that the Registrars and the registrants are best served by using a uniform
and consistent notice. We are concerned that it is possible to provide
confusing notices regarding the obligation and wish to prevent that, or to
have this viewed as a way to achieve a competitive advantage.

It is the position of the BC that ensuring a fair and level playing field in
the areas of policy/contract compliance is best supported by uniform and
consistent notices; we also recommend that such notices should be developed
with guidance by the Council?s relevant TF, with approval by Council, and
drafted by the ICANN staff/legal counsel.

We inserted the additional language to the last sentence in #3 in order to
clarify that ?consent? should not suggest that this is an option. Acceptance
of this policy requirement is required before the registration can continue,
as specified by current consensus policy of ICANN.

Impact on BC members: The BC members are negatively impacted by inaccurate
registrant data, since they are reliant upon WHOIS data for a number of
uses, including policing their domain names, preventing fraud; defending
against harmful and confusing uses of their trademark names by competitors,
or for other negative purposes. They also heavily use WHOIS data in
cooperation with law enforcement when dealing with fraud, and other civil
legal issues, or in resolving and dealing with network problems. Thus
accurate data is extremely important to the BC membership. The BC also
endorses the need for registrants to be factually informed of their
obligations.  We do not believe that entities, whether individuals or
organizations/corporations should be allowed to register domain names
without providing full and complete contact data that is kept accurate and
up to date.

Implementation: As to the length of time it will take to implement the
policy, it appears to us that the policy can be implemented expeditiously,
once approved by the TF, and then the Council and sent to the Board for
approval. The drafting of a standardized statement to be used for disclosure
should be done by the ICANN staff/legal counsel, with the input and
agreement of the Council, and should not be an onerous task, since there are
many models of notice statements in the commercial and non commercial online
world.

As a part of approving the consensus policy, the Council could request from
the registrars constituency preliminary advice on how long it might take to
enable a uniform posting throughout the registrar community.
Understandably, the registrars will want to have this change supported by
factual explanations that explain to the registrants in a neutral manner,
the need for the change and the purpose of the change. However, it is the
position of the BC that ICANN should not exclude those who are impacted by
such changes, e.g. users/registrants as represented by the BC, ISPCP, IPC,
Non Commercial representatives, At Large, from participating in any
consideration about the development of a uniform posting notice, or any
discussions about time frames.

Further Recommendations to the TF:

Extension to renewals: Further, we strongly recommend that this notice be
required in any re-registration, or renewal of a registration. It is likely
that the TF has taken that for granted in its deliberations, but we note it,
in the event it has been overlooked.

Additional and related work of the TF: The TF is also examining ?tiered
access? at this time, and as a separate work item from the above proposed
policy modification. In the view of the BC members, this TF should also be
examining the availability of services that meet the needs of any registrant
with a legitimate need for non display of data. This should include the
availability of ?anonymizing services? provided either by the registrar or
third parties for a fee, and the soon to be available .post which seems to
provide yet another solution for any registrant who needs to remain
anonymous.

In any event, the BC notes that its members fully support the gathering of
full identifying and contact data, and that all data collected should be
accurate, and that mechanisms to support the efficient and effective
correction of data should be a priority.

Timing of policy changes: However, since TF 3 is also considering a related
possible policy change, the BC recommends that other policy changes related
to WHOIS based on consensus policy be examined for possible aggregation, if
feasible, and practical. We exclude the work on Tiered Access from this
given its fledgling nature, but the work of the present TF3 should be
considered for possible implementation at the same time as this policy
change, should they both be accepted as consensus policy. Thus, if there are
a number of changes approved as consensus policy, they all be made at one
time, so that the registrars and registrants are not overburdened by
multiple changes, introduced at different times.

Better Information and Educational resources by ICANN: Finally, the BC has
from time to time noted that it supports the importance of ICANN itself
providing easily available and distributed information about changes in
policy.



--
Glen de Saint Géry
GNSO Secretariat
gnso.secretariat@xxxxxxxxxxxxxx