Nic IT and consent for publishing data?

The Italian registry has made some changes to their production system and in my opinion, it is not an improvement.

Till today you could opt out for publishing data in the WHOIS for the following entities:

  • Natural persons Italian and EU based
  • Freelance workers/professionals (Italian based)
  • Italian Companies/one-man companies (Italian based)
  •  Public organizations (Italian based)
  •  Non-profit organizations(Italian based)
  •  Foreign companies/organizations matching 2-6 (EU based)
  •  Other subjects (Italian based)

Since today the opt-out is available for natural persons only.
All other entities must agree to the fact that its data will be published in the WHOIS. If the registrant is not a natural person and does not agree, the domain name will not be registered.

While legally speaking the above is correct as only natural persons are covered by the GDPR and legal entities are not.
However, a majority of the lawyers in the EU think there is an exception to the rule, as one-man-owned entities and freelancers are viewed as a natural person as it is not possible to separate personal and corporate data. But unless a DPA or a court confirms this exception, the situation is as it is.

Due to the above, we advise our resellers to inform their customers of the changes by the Italian Registry and warn of the consequences.

How the Registry handles personal data in the WHOIS can be read here.

Brexit & Domain Names, recipe for Chaos?

The short answer is no, depending on the scenario.

While there are many Brexit experts, their views and opinions are not helping when it comes to making business decisions. When it comes to predictions, it might be even better to check the British bookmakers and get a sense of the betting odds if there will be a Brexit or not.

 

However, we can make a few assumptions when it comes to domain names and the Brexit, let us assume the worst scenario; hard Brexit, as in no deal.

The issue
In case of a, no deal Brexit currently slated for March 30th would deem the UK as a third country from a GDPR legal perspective. And it will not come as a surprise for most that the GDPR has a whole set of rules when it comes to data export outside of the EEA, which you can read here.

Transition  Period
There is the option that the Commission will issue some kind of emergency legislation which allows for a smaller transition period as it will be only a few months. Which is not a lot but might mitigate some of the issues.

Solution
You usually have a set of options to transfer data outside of the EU.
Adequacy decisions, data subject consent, public interest, etc.
With domain names, the options become limited due to various reasons.
The most logical solution is the use of standard contract clauses, sometimes called model clauses.
Nominet and applicable gTLD registries would include these standard contract clauses in their contracts which you as a reseller a solid legal basis when it comes to domain name registrations and transferring data to the UK.

Affected TLDs due to the Brexit

.cymru Nominet
.wales Nominet
.blog Knock Knock WHOIS There LLC
.abogado MMX
.bayern Bayern Connect GMBH/MMX
.beer MMX
.boston Boston TLD Management LLC /MMX
.bradesco Banco Bradesco S.A./MMX
.budapest MMX
.casa MMX
.cooking MMX
.dds MMX
.fashion MMX
.fishing MMX
.fit MMX
.garden MMX
.gop Republican State Leadership Committee Inc./MMX
.horse MMX
.law MMX
.london Dot London Domains Ltd./MMX
.luxe MMX
.miami MMX
.rodeo MMX
.surf MMX
.vip MMX
.vodka MMX
.wedding MMX
.work MMX
.yoga MMX
.broadway Celebrate Broadway Inc.

And last but not least, .UK and .CO.UK.

In the above scenario where domain name resellers or registrars in the EU register domain names in the UK for their customers who are in scope of the GDPR (art 2&3), there seems to be plenty of time and not much to worry about.

The not so clear scenario
It becomes very complicated when you create scenarios with domain name resellers in the UK also dealing with customers from the EU, registering domain names in China or Russia or the USA using a domain name registrar located in Europe.
It goes beyond the scope of this article to flesh out every scenario to the core or the bone.

A pragmatic approach to deal with this scenario or other scenarios could be mapping each data flow and check what legal basis you have used pre-Brexit.

Did you use EU adequacy decisions as a legal basis, can you still use them?
Was the legal basis consent? Do you need to update such approval?
If Privacy Shield is the legal basis to transfer data to the USA what are the options?
Even with a transition period, there is much ground to be covered. If there will be no transition period options will be very limited.

The when Satan will ice skate to work scenario
If the ICANN EPDP workgroup who are currently struggling with the EU GDPR would recommend that thick whois registries are a thing from the past and no longer there is a need to send personal data to the registry, then there is of course in the case of gTLDs no issue at all, let alone you require a legal basis.
The EPDP team final report is slated for February 1. The ICANN board would have to accept such recommendations and undo a decision they made in 2012 when they decided all registries should operate a thick whois.
Given the divide within the EPDP team, I doubt we will see much solid recommendations, let alone a speedy process of implementation.

For more information and tools on data protection in combination with the Brexit please visit the ICO website.

Brexit, and the impact on .EU domain names, sound the alarm?

Update 04-01-2019

The British government issued further guidance regarding the Brexit and Eurid.

Click here to view the guidance and scenarios.

Update 05-11-2018

It seems very likely the two scenarios posted below are the most likely outcome as we quickly move towards the deadline of 29th of March 2019.

(1) If the UK exits the EU and becomes a temporary member of the European Economic Area (EEA) there will be no issue until the duration of such membership.

(2) If however, it turns out to be a “hard Brexit” or “no deal Brexit” than registrars are no longer in a position to service UK registrants for .EU domain names. Please read the below article if the situation is applicable to you as a reseller.

I do not think it is time to sound the alarm yet, but some caution and some thinking ahead of the Brexit might be advised when it comes to .EU domain names and Brittish registrants.

Who will be affected?

Organizations that are established in the United Kingdom but not in the EU and natural persons who reside in the United Kingdom.

Impact

The above-listed persons or organizations will no longer be eligible to register .eu domain names or, if they are .eu registrants, to renew .eu domain names registered before the withdrawal date. Accredited .eu Registrars will not be entitled to process any request for the registration of or for renewing registrations of .eu domain names by those undertakings, organizations, and persons.

Relevant dates

Measures are effective as from 1 January 2021 or, in case that there was no withdrawal agreement in force prior to 30 March 2019, as from 30 March 2019. Negotiations are ongoing with the United Kingdom and the EU to come up a withdrawal agreement.

What to do?

At the moment there is little information to go about. The latest status update can be located here, we urge our customers to check this website often for more information.

If the EC really wants to push through remains to be seen, given the current status between the UK and the EU it looks pretty grim. It is advisable to contact high profile customers (if you have them) who have a .EU domain name and match the criteria mentioned earlier on.

A possible solution for Brittish registrants is to update the domain names via their European (non-UK) address (if available). We highly advise against the use of proxy solutions as they are in violation of Eurid’s terms and conditions. One can expect that after the Brexit, Eurid might monitor affected domain names and enforce their terms and conditions.

Using incorrect registrant information is always ill-advised and a violation of Registrar and Registry terms and conditions.

Registration changes for .ES and new contractual obligations for our resellers.

And it is not going to get easier for sure.

At the moment we run a validation process, this process also makes sure that there is a registration contract between Realtime Register, Esnic and the registrant, as required by the registry. An easy process for you as a reseller.

However, with the GDPR and some local laws in Spain which go beyond the original purpose of domain name registrations, the contractual requirements for the registrant and reseller increased in such a manner that we are no longer in a position to create such contracts for our resellers in a one size fits all solution.

As a result, we pass this obligation to our resellers once more for .ES domain names to ensure maximum flexibility for your registration processes towards your customers.

However, the changes made by Esnic require that you obtain explicit consent from your customer/registrant for several obligations. Below is a sample provided by Esnic.

template-resellers

The template is for reference purposes only. In addition to this registrants will need to enter into a registration contract with Esnic, which is located here.

We urge our resellers to create registration agreements as suggested by Esnic. Not having a registration contract regarding .ES is not an option as Esnic processes personal data in a different manner compared to other EU registries and beyond the primary purpose of domain name registrations.

Update since 11-10-2018 we are no longer validating .ES registrant contact handles.

Data Protection/GDPR TLD Guidance Matrix

I think this is the first blog where I start with phrases like;

  • We are not done yet
  • Guidance only
  • We are not done yet
  • By no means legal advise
  • Best effort only
  • We are not done yet

While we are not done, we are trying to get this matrix as complete as possible before May 25; we do expect that we will still be updating the matrix way beyond May 25.

Back in 2016, I was under the impression that our industry would work together and come up with solutions to make things easier when it comes to the GDPR.
However, it is April 2018, ICANN is still in chaos, the EU ccTLD registries move at a glacial pace, and the ccTLD registries outside of the EU still have to figure out what the EU GDPR is.

A few months ago we came up with the idea that we should assist our customers when it comes to the GDPR.Over a thousand registries, located all over the world in many different jurisdictions, processing personal data in ways not known to us. At the time, it was like asking the question, how do you put an elephant in a car?

The answer? Put the GDPR and all the data protection laws of the world into the metadata of our API.
https://dm.realtimeregister.com/docs/api/tlds/metadata#privacy

 

At first glance, this looks very complex and confusing, just like the GDPR itself.
When you send an info request on the metadata for the name, “gdprCategory”, it will give you four values depending on the TLD.

  • EU_BASED: Registrations are under EU jurisdiction
  • ADEQUACY: Registrations are in a jurisdiction that provides an adequate level of data protection according to the EU
  • DATA_EXPORT: Registrations are in a jurisdiction without an adequate level of data protection as outlined by the EU. Fundamental rights like the right to be forgotten or erasure do not apply
  • UNKNOWN: Situation unknown

So how does this work?
As I mentioned before we still need to complete this and things are still in motion with a lot of registries, but we can tell you a few things already based on current info and predictions, as such we came up the following suggestions.

  • Caution advised
  • Use privacy protect
  • EU based, whois exposed
  • Safe, data adequacy or EU based

GDPR Advise
Let’s start with the advice called:”Caution advised.”
And be advised these are the most complex TLD’s to register.
We know that these TLDs are outside of the EU and Article 49 is most likely to be relevant for such TLD’s.
In some cases, we do not know what will happen and how the registry in that country will treat the data of your customer.

Our advice, consult a lawyer when your customer wants to register a domain name in a TLD labeled “Caution advised.”
You do not need to worry about this when this is a company registration. Companies (legal entities) are exempt from the GDPR. Make sure you do not use any personal data for such registrations.

Use privacy protect
Rather straightforward advice. We do not know what ICANN will be doing or not. With our privacy protect service you do not have to worry about the following:

  • Consult a lawyer regarding your legal requirements to register a domain name (money saver).
  • The data will not be exported to a “third country.
  • Do you need privacy shield as a legal basis or not?
  • No need to worry about “third parties” having access to your customer’s data outside of the EU.
  • If the right to be forgotten or erasure applies or not?
  • EU GDPR data minimization requirements
  • Can the GDPR data accuracy requirements be exercised or not?
  • The need to ask consent from your customer for every possible data processing (no disruption of registration flows in your shop)

Our advice, use this service whenever you can, it will save you a lot of time and hassle.

EU based, whois exposed.
These registries are EU GDPR compliant. But some of them do expose personal data in the WHOIS. Personally, I do not like this, but there can be a few legal reasons (on a member state level) that such a practice is permitted under the GDPR.
You might want to give your customers a heads-up of such practices as their perception might be different.

Safe, data adequacy or EU based.
My personal favorite.
These TLDs are GDPR compliant and do not expose personal data through the WHOIS. Hassle free; let’s hope the rest will follow soon.

Terms of Service & Privacy notice.
As an extra service, we have included links to the relevant registration contracts and privacy notices. I am aware it is not complete at the moment, but we hope to have most of it ready, before the 25th of May.
Keep in mind, so far we have seen zero new contracts from gTLD registries. I expect that we as a registrar we will have to sign over a thousand contracts just a few weeks before the 25th of May.

So check the matrix regularly to remain up to date.

More information regarding the Realtime Register Privacy Service can be located here