Realtime Register Release and New Features

This page is dedicated to the relevant changes, added features and fixes of the Realtime Register front and back end. Please visit regularly to stay up to speed. The API Changes are documented in more detail on the API Docs Change Log pages and additional documentation. Please note, login is required.

26/09/2017
Improvement: Privacy Protect v2 allows transfer out without exposing registrants date. In preparation for GDPR.
Bugfix: Denic, some unsupported Unicode characters in address contacts will now give the proper error message.
Improvement: NicIT, NS check now inline with registry policy.
Improvement: NicIT, Client hold option removed.
Bugfix: Fixed check on additional properties.

EU GDPR, is consent the Silver Bullet for Domain Name Registrations?

Update:28-11-2017

According to the Dutch DPA, consent is not the silver bullet. 

https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-unlimited-publication-whois-data-violates-privacy-law

This will make ccTLD registrations outside of the EU for natural persons very problematic and perhaps such registrations should be avoided, though this is not legal advice in any shape or form. 

Consent is often cited as the Silver Bullet to transfer data outside of the EU.The requirements, however, can be rather complex given the fact how registries/ICANN process and control the data.

The rules according to Art.6.1(b).

Data subjects are provided with a clear explanation of the processing to which they are consenting; The consent mechanism is genuinely of a voluntary and “opt-in” nature;
Data subjects are permitted to withdraw their consent easily;
The organization does not rely on silence or inactivity to collect consent (e.g., pre‑ticked boxes do not constitute valid consent);

  • Be specific and granular. Vague or blanket consent is not enough
  • Name any third parties who will rely on the consent
  • Make it easy for people to withdraw consent and tell them how
  • Consent must specifically cover the controller’s name, the purposes of the processing and the types of processing activity

Purpose
Consent will be needed for different processing operations wherever appropriate – so you need to give granular options to consent separately to separate purposes unless this would be unduly disruptive or confusing. As a minimum, consent must specifically cover all purposes.

Consent shouldn’t be.
Recital 32 also makes clear that electronic consent requests must not be unnecessarily disruptive to users. You will need to give some thought to how best to tailor your consent requests and methods to ensure clear and comprehensive information without confusing people or disrupting the user experience – for example, by developing user-friendly layered information and just-in-time consents.

Principles of data protection
In data protection, there is the fundamental principle which is unchanged even in the age of Big Data.

The data subject has to be in control of her/his data, which means for consent that you need consent for every each of the data processing activities (even for minor changes in the processing)

Scope

Considering that Registrars and Domain Name Resellers do business with more than 1000’s of TLDs located in more than 200 countries the complexity of getting consent “right” seems to be very difficult and complex and not recommended for domain name registrations.

The Right to be forgotten.
Individuals have a right to have personal data erased and to prevent processing in specific circumstances:

  • Where the personal data is no longer necessarily about the purpose for which it was originally collected/processed
  • When the individual withdraws consent
  • When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing
  • The personal data was unlawfully processed (ie otherwise in breach of the GDPR)
  • The personal data has to be erased in order to comply with a legal obligation

The above adds another layer of complexity. Some Registries will delete the data of the data subject; some don’t. Currently, it is unknown which policies the registries have in place. In short, consent adds a whole layer of organizational challenges. It is assumed that the withdrawal of consent does not automatically imply that the service can be terminated as consent was not ““freely given”, a requirement of the GDPR.

Given the fact how the public WHOIS system works it is unknown how the right to be forgotten should work in practice within the DNS.

More information about consent can be read here.

 

FAQ Privacy Protect support

1. What does privacy protect do?
2. Why should you offer privacy protect to your customers?
3. What are the benefits of privacy protecting?
4. How can I set all domains of a registrant contact to privacy protect?
5. Do I need to have consent of the registrant for privacy protect?
6. Do ALL TLDs allow privacy protecting?
7. How can someone get in touch with the registrant of a privacy protected domain?
8. Why should I set my customers domains on client transfer prohibited TRUE?
9. How about exposing registrant information through the other contacts?

1. What does privacy protect do?

Realtime Register privacy protect removes the exposed registrant information and replaces it by a default data set and email address related to the domain name.

Example whois output non-privacy protected domain

Registrant Name: John Johnson
Registrant Organization:
Registrant Street: 404 street name
Registrant City: Amsterdam
Registrant State/Province:
Registrant Postal Code: 1000 AA
Registrant Country: NL
Registrant Phone: +31.106660666
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: john@whatever.whatever

Example whois output privacy protected domain

Registrant Name: Privacy Protect
Registrant Organization: My Domain Provider
Registrant Street: Ceintuurbaan 32A
Registrant City: Zwolle
Registrant State/Province: 
Registrant Postal Code: 8024 AA
Registrant Country: NL
Registrant Phone: +31.382305013
Registrant Phone Ext:
Registrant Fax: 
Registrant Fax Ext:
Registrant Email: domainname.extension@mydomainprovider.com


Where “domainname.extension” is replaced by the domain name of the whois output. If the  phone number is called a recorded message is played to contact the registrant through email.

To Top Of Page

2. Why should you offer privacy protect to your customers?

By exposing the registrant information, you might be in breach with the GDPR. Especially if you don’t have explicit consent to have the registrant information published in a public whois. And in addition, it’s a human right. As article 12 of the United Nations Universal Declaration of Human Rights states:

No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Every-one has the right to the protection of the law against such interference or attacks.

To Top Of Page

3. What are the benefits of privacy protecting?

  • It protects your customer’s privacy even more effectively
  • It prevents spam by email, phone calls or text messages to your customers
  • It is compliant with over 100 data protection laws worldwide.


To Top Of Page

4. How can I set all domains of a registrant contact to privacy protect?

For starters, make sure you have your customers consent for setting domains to privacy protect. You can do this by either explicit consent or through your terms of service. If you use the Realtime Register Domain Manager, we have a Privacy Protect step-by-step plan available for you. If you use the Realtime Register API, you can use the API commands set to privacy protect. However, even then you want to have a look at the Privacy Protect step-by-step plan.

To Top Of Page

5. Do I need to have consent of the registrant for privacy protect?

Yes, you need to have some form of consent, please have a look at item 4 of this FAQ.  The privacy protect feature also sets the domain to transfer prohibited. This also requirers the consent of the registrant.

To Top Of Page

6. Do ALL TLDs allow privacy protecting?

Nope, I am sorry, however, privacy protect is allowed for practically all generic TLDs. Most ccTLDs don’t allow it. However, the ccTLDs that don’t allow privacy protect in general show very few information, so effectively it’s privacy protected.
For example; the Dutch .nl extension does not display the registrant name if there is no organization name added to the registrant information. As do other ccTLD registries like DNS BE, Eurid and Afnic.


To Top Of Page

7. How can someone get in touch with the registrant of a privacy protected domain?

Basically, in two ways by using a captcha-protected form at my domainprovider.com and sending an email to the domainname.extension@mydomainprovider.com email address.

  1. If the form at mydomainprovider.com is used, the email with optional attachment is directly send to the registrant’s email address in the registrant contact handle. Of course, the sender does not get to see the real address.
  2. If the mail is send directly to the email address in the whois, the behaviour depends on the status of the client transfer prohibited setting.
    1. If client transfer prohibited is TRUE, the sender gets an email to go to the mydomainprovider.com form. Effectively blocking spam bots from reaching the registrant.
    2. If the setting client transfer prohibited is FALSE, the registrant gets a standard email with a link to view the message. Attachments from the sender are discarded. This route ensures limited protection from spam though allows for transfer out FOA’s to reach the registrant.


To Top Of Page

8. Why should I set my customers domains on client transfer prohibited TRUE?

  1. It helps to prevent domain theft and unwanted transfers.
    • Even if someone of your staff has been socially engineered to provide an authorization code to an unauthorized person, it adds an additional threshold for transferring the domain away.
  2. It reduces spam reaching the registrant even better.
    • If the domain is privacy protected automated spam is unable to get in your customers mailbox.


To Top Of Page

9. How about exposing registrant information through the other contacts?

That is a tricky one, if you use different contacts with the registrant’s information you will end up exposing unwillingly contact information of the registrant. In general, there are two approaches:

  1. Change all admin, billing and tech contacts to a contact that has your brand information. As a nice side effect, your brand gets more exposure in the whois information.
  2. Change all contacts to the contact handle of the registrant. This way, these whois contacts will also display the privacy protect information.

It’s up to you, make your pick!

Updated privacy protect service

On September 26 we will release a revamped version of our privacy protection service. It contains significant changes and will comply with upcoming EU GDPR and ICANN policies.

Why you need the new privacy protect service

At Realtime Register we value the privacy of your customers the registrants, by using the new Realtime Register privacy protect services you’ll bring your customers privacy to the highest level possible. Regarding domain names, it will enable you to be GDPR ready, saving you a lot of time in this area.

The new privacy protect service:

  • is free! That is, for reselling customers with standard pricing
  • protects your customer’s privacy even more effectively
  • allows for transfers without dropping privacy protect
  • prevents spam for your customers
  • is compliant with over 100 data protection laws worldwide.

Main differences

Current Privacy Protect

New Privacy Protect

Contacts
Automatically privacy protect for both the registrant and admin, billing and tech contacts. Only the registrant has Privacy Protect data, the other contacts have the information of the contacts used by you.
Email
Branded form at mydomainprovider.com Branded email informing a registrant, plus link to email
Post transfer out behavior
Privacy protect needs to be lifted before transfer out After a privacy protected domain has been transferred out the privacy protect stays intact, though the information should be changed asap.

What you need to do

what you need to do after the release on September 26, is:

  1. Set your customer’s domain status to transfer prohibited* this will prevent that email will be forwarded to the registrant. You need to make sure you have the registrants consent to do so.
  2. If you want to keep privacy protect for the admin, billing and tech contacts, you need to set these contacts to the same contacts as the registrants.
  3. Customize the new email template** for your brand(s).

*If you want to transfer a domain out, removing this status will forward emails to the registrant making it possible to receive the outgoing FOA email. The spam blocking effect will be disabled.
**The new email template is for reminding the registrant to have the privacy protect information changed after the domain has been transferred away from Realtime Register. This email will only be sent if the privacy protect information has not been updated to the data set of the new privacy protect provider and still contains our information.

Make sure to pass this information on to the people in your organization responsible for policies concerning registrant information and legal issues.

The most important GDPR requirements at a glance

The article below is a partial copy of this fact sheet by Legalist and was used with its consent. (De Nederlandstalige versie staat hier)

The General Data Protection Regulation (GDPR) is a new pan-European privacy law. From 25 May 2018, your organization must comply with this strict new law. So, what is changing? And what do you need to change?

1. Your activities are much more likely to be covered by eu privacy legislation
If your organization processes personal data of a person who is in the EU, you must comply with the GDPR. It does not matter if your organization is not established in the EU or if the processing does not take place within the EU. And if there was any doubt before: the definition of personal data now explicitly includes online identifiers, such as IP and MAC addresses or a cookie-ID.

2. Your privacy statement must be even more transparent
You must explain clearly and fully, using plain language, how you use personal data and why. Furthermore, you must advise people of their rights, such as the right to view their data, to amend or erase it if there are clear mistakes, to object to excessive processing, and to take their data to another service provider. If you create interest profiles, you must be able to destroy them upon request. Finally, you should not forget to explicitly advise people of their right to file a complaint with the supervisory authority, as this is now required by law.

3. You must also publish an internal privacy policy
You need to document how personal data is handled and secured within your organization. Raising awareness of this policy among employees is key. Periodic training will also be required.

4. You must keep records of all personal data processing activities
The records must include, among other things, a description of the personal data processed, the purpose for processing them, and how they are protected. This obligation applies to organizations with more than 250 employees, but also to The most important GDPR requirements at a glance with fewer than 250 employees provided they process personal data on a regular basis or they process special categories of personal data.

5. You must document all data breaches internally
Under current privacy legislation, you are required to document only those data breaches that you are obliged to report to the supervisory authority. The GDPR makes it compulsory to document all data breaches internally, even those which you are not required to report. If you process personal data on a client’s behalf, the GDPR also imposes a legal obligation to report all data breaches that occur during such activities to the client, so that they can notify the supervisory authority.

6. You need to know where your personal data is stored, and may need extra safeguards
If you store personal data with a third party abroad, you must check whether the data is stored within or outside of the EU. The latter is only permitted if the third party meets strict legal requirements, e.g. the country in question has been certified by the European Commission. With regard to third parties in the United States, the so-called Privacy Shield offers the necessary safeguards. However, please note that customers may demand that their data simply does not leave the EU at all.

7. Your data processing agreements with suppliers and customers must be revised
The GDPR contains more specific requirements for data processing agreements, which must be concluded if you process personal data on behalf of another organization, or if another organization processes personal data on your behalf. For example, if you process personal data on behalf of another organization, you need permission before subcontracting any processing operation.

8. You must carry out a thorough privacy impact assessment (pia) for risky activities
A PIA is an extensive assessment intended to identify privacy risks, and to eliminate such risks as much as possible so that privacy is not put in jeopardy beyond what is strictly necessary and proportionate. You may not carry out a processing activity which poses a risk to privacy until after the PIA has been conducted and its outcomes have been implemented.

9. You must better minimise the personal data you process and store
Even though current privacy legislation already requires data minimisation, you may be keeping data longer than necessary, ‘because you never know’. Under the GDPR you must take active steps to erase information as soon as it has lost its relevance. You must also put in place policies for the assessment of the relevance of information and its erasure in case of irrelevance.

10. You must implement ‘privacy by design’ and ‘privacy by default’
This means that privacy considerations must be identified and incorporated at every step in the development process. In addition, the default settings of any new service must be as privacy-friendly as possible.

11. You may be asked to stop profiling, or explain exactly what you are doing
If you create interest profiles or risk analyses for your clients, visitors, etc., you must be able to explain to them how you do this and why at their request. This also applies to activities which may seem trivial or highly ordinary, such as cookies for personalized advertising.

12. Your security measures must be fit for purpose, both now and in the future
The security of personal data is crucial. In this day and age, if you don’t restrict access to only those users with a need-to-know, using strong (multi-factor) authentication and encryption, if you don’t use TLS, firewalls, anti-virus software, or if you don’t patch your software and systems in time, you are at serious risk. You are also at risk if you do not regularly evaluate and update your security measures.

13. You must be able to handle requests from persons about their personal data
The GDPR provides more rights to individuals to access, correct or erase their data, or take their data with them to another provider. Under normal circumstances, any request from a person regarding their personal data should be handled within one month. Is your helpdesk up to speed.

14. You may need to appoint a data protection officer (dpo)
A data protection officer is an independent person who advises and reports on GDPR compliance. Appointing a DPO is compulsory if you process more sensitive personal data (such as medical records) on a large scale, or if you are engaged in regular and systemic monitoring of people’s activities on a large scale. The DPO can be appointed either internally or externally, for example one of Legal ICT’s (virtual) privacy officers.

15. You may need to offer ‘data portability’
If you offer an online service that allows people to store their personal information, they must be able to export all their information in a commonly used digital format for transfer to another organization. This might involve downloading photos, social media posts or forum contributions.

16. You may need to pay special attention to biometric data
Does your organization make use of fingerprints or other biometrics, e.g. for access control? Then you need to comply with the GDPR’s strict protection regime for biometric data.

17 You need to comply, to avoid higher fines which are drastically higher
Under the GDPR, the supervisory authorities may issue penalties of up to the higher of 20 million euro or 4% of global turnover. Privacy now really requires boardroom attention.

Conclusion

All in all, many changes that will require your attention. At Realtime Register are aware that personal data affects many of our processes. This will also apply to our reseller’s processes. We are working hard to incorporate these requirements in a reseller- and customer-friendly manner. We will keep you informed through this blog and other information channels.