Data Protection/GDPR TLD Guidance Matrix

I think this is the first blog where I start with phrases like;

  • We are not done yet
  • Guidance only
  • We are not done yet
  • By no means legal advise
  • Best effort only
  • We are not done yet

While we are not done, we are trying to get this matrix as complete as possible before May 25; we do expect that we will still be updating the matrix way beyond May 25.

Back in 2016, I was under the impression that our industry would work together and come up with solutions to make things easier when it comes to the GDPR.
However, it is April 2018, ICANN is still in chaos, the EU ccTLD registries move at a glacial pace, and the ccTLD registries outside of the EU still have to figure out what the EU GDPR is.

A few months ago we came up with the idea that we should assist our customers when it comes to the GDPR.Over a thousand registries, located all over the world in many different jurisdictions, processing personal data in ways not known to us. At the time, it was like asking the question, how do you put an elephant in a car?

The answer? Put the GDPR and all the data protection laws of the world into the metadata of our API.
https://dm.realtimeregister.com/docs/api/tlds/metadata#privacy

 

At first glance, this looks very complex and confusing, just like the GDPR itself.
When you send an info request on the metadata for the name, “gdprCategory”, it will give you four values depending on the TLD.

  • EU_BASED: Registrations are under EU jurisdiction
  • ADEQUACY: Registrations are in a jurisdiction that provides an adequate level of data protection according to the EU
  • DATA_EXPORT: Registrations are in a jurisdiction without an adequate level of data protection as outlined by the EU. Fundamental rights like the right to be forgotten or erasure do not apply
  • UNKNOWN: Situation unknown

So how does this work?
As I mentioned before we still need to complete this and things are still in motion with a lot of registries, but we can tell you a few things already based on current info and predictions, as such we came up the following suggestions.

  • Caution advised
  • Use privacy protect
  • EU based, whois exposed
  • Safe, data adequacy or EU based

GDPR Advise
Let’s start with the advice called:”Caution advised.”
And be advised these are the most complex TLD’s to register.
We know that these TLDs are outside of the EU and Article 49 is most likely to be relevant for such TLD’s.
In some cases, we do not know what will happen and how the registry in that country will treat the data of your customer.

Our advice, consult a lawyer when your customer wants to register a domain name in a TLD labeled “Caution advised.”
You do not need to worry about this when this is a company registration. Companies (legal entities) are exempt from the GDPR. Make sure you do not use any personal data for such registrations.

Use privacy protect
Rather straightforward advice. We do not know what ICANN will be doing or not. With our privacy protect service you do not have to worry about the following:

  • Consult a lawyer regarding your legal requirements to register a domain name (money saver).
  • The data will not be exported to a “third country.
  • Do you need privacy shield as a legal basis or not?
  • No need to worry about “third parties” having access to your customer’s data outside of the EU.
  • If the right to be forgotten or erasure applies or not?
  • EU GDPR data minimization requirements
  • Can the GDPR data accuracy requirements be exercised or not?
  • The need to ask consent from your customer for every possible data processing (no disruption of registration flows in your shop)

Our advice, use this service whenever you can, it will save you a lot of time and hassle.

EU based, whois exposed.
These registries are EU GDPR compliant. But some of them do expose personal data in the WHOIS. Personally, I do not like this, but there can be a few legal reasons (on a member state level) that such a practice is permitted under the GDPR.
You might want to give your customers a heads-up of such practices as their perception might be different.

Safe, data adequacy or EU based.
My personal favorite.
These TLDs are GDPR compliant and do not expose personal data through the WHOIS. Hassle free; let’s hope the rest will follow soon.

Terms of Service & Privacy notice.
As an extra service, we have included links to the relevant registration contracts and privacy notices. I am aware it is not complete at the moment, but we hope to have most of it ready, before the 25th of May.
Keep in mind, so far we have seen zero new contracts from gTLD registries. I expect that we as a registrar we will have to sign over a thousand contracts just a few weeks before the 25th of May.

So check the matrix regularly to remain up to date.

More information regarding the Realtime Register Privacy Service can be located here

 

GDPR and domain name resellers, 20 million reasons to read this.

Companies will face very harsh punishments for infringements under the GDPR. Art. 83 Paragraph 5 of the GDPR offers the supervising authorities the possibility of imposing fines of up to 20 million Euro or, for corporations, up to 4% of the worldwide turnover of the preceding financial year.

 

Tick tock, tick tock, goes the clock
The EU GDPR will go into effect May 25th, 2018. It looks like there is still a lot of time, but actually, there is not much time left to prep your organization for the GDPR!

Most of your company’s operations will be affected by the GDPR, from your human resources to your marketing department. Policies and processes need to be reviewed, altered and communicated. Privacy by design will be key.

From a wholesale registrar perspective, the impact of the GDPR in combination with domain names is relatively low.
However, the impact for you as a reseller is a massive one.
In respect to registering domain names, your company, as the data collector, sends a lot of Personally Identifiable Information (PII) all over the globe. Be it a ccTLD registration or a gTLD registration.
The GDPR will affect all of our resellers who deal with European citizens as customers even if you, as a reseller are not located in the EU.

We at Realtime Register will, however, assist you in the upcoming struggle.

Privacy protect
As you may have read in one of our previous blog posts, we will offer our privacy protect services for free for our resellers.
This will make sure that you can comply with the EU GDPR and ICANN regulations without too much hassle. We strongly suggest to evaluate your customers and see who will require this service. The easiest and safest way is to use Privacy protect by default for your customers.
For Dutch resellers, who have so-called ZZPers as customers, by law they are exempt from the demanded privacy. However, the GDPR did not take into account how these self-employed business owners should be treated, as the lines between being a professional and a natural person often cross each other.
If you make mistakes here and you forget to enable privacy protect and your customers PII is unprotected, you will be risking the high fines as mentioned earlier. Forgetting about (overlooking) a customer or customers could result in a data breach.

Currently, we are working with a leading juristically advice agency to set up a deal for several services including the new agreements and privacy statement you will need; more details will follow soon.

Some aspects of exporting PII data outside the EU and ccTLD registries (and several others) are still not clear. We will inform you about this as soon as there is more clarity on this subject.

The bottom line, when it comes concerning the GDPR to the GDPR, think twice about how you deal with PII. Be prepared the GDPR will be affecting your business in more ways than you expect.

Other geographical areas
China already introduced severe privacy laws, and companies need to comply early 2018. Overall there are over 100 countries with data protection laws, and 46 countries are currently drafting data protection laws similar to the GDPR.

It is a shame that ICANN and a lot of Registries do not support the privacy by design principle, at the moment, this would have made our lives a lot easier. Perhaps ICANN and Registries should consider the following.

On December 10, 1948 the General Assembly of the United Nations adopted and proclaimed the Universal Declaration of Human Rights.

Article 12:

No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.

So let us be sensible about privacy.

 

 

 

 

FAQ Privacy Protect support

1. What does privacy protect do?
2. Why should you offer privacy protect to your customers?
3. What are the benefits of privacy protecting?
4. How can I set all domains of a registrant contact to privacy protect?
5. Do I need to have consent of the registrant for privacy protect?
6. Do ALL TLDs allow privacy protecting?
7. How can someone get in touch with the registrant of a privacy protected domain?
8. Why should I set my customers domains on client transfer prohibited TRUE?
9. How about exposing registrant information through the other contacts?

1. What does privacy protect do?

Realtime Register privacy protect removes the exposed registrant information and replaces it by a default data set and email address related to the domain name.

Example whois output non-privacy protected domain

Registrant Name: John Johnson
Registrant Organization:
Registrant Street: 404 street name
Registrant City: Amsterdam
Registrant State/Province:
Registrant Postal Code: 1000 AA
Registrant Country: NL
Registrant Phone: +31.106660666
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: john@whatever.whatever

Example whois output privacy protected domain

Registrant Name: Privacy Protect
Registrant Organization: My Domain Provider
Registrant Street: Ceintuurbaan 32A
Registrant City: Zwolle
Registrant State/Province: 
Registrant Postal Code: 8024 AA
Registrant Country: NL
Registrant Phone: +31.382305013
Registrant Phone Ext:
Registrant Fax: 
Registrant Fax Ext:
Registrant Email: domainname.extension@mydomainprovider.com


Where “domainname.extension” is replaced by the domain name of the whois output. If the  phone number is called a recorded message is played to contact the registrant through email.

To Top Of Page

2. Why should you offer privacy protect to your customers?

By exposing the registrant information, you might be in breach with the GDPR. Especially if you don’t have explicit consent to have the registrant information published in a public whois. And in addition, it’s a human right. As article 12 of the United Nations Universal Declaration of Human Rights states:

No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Every-one has the right to the protection of the law against such interference or attacks.

To Top Of Page

3. What are the benefits of privacy protecting?

  • It protects your customer’s privacy even more effectively
  • It prevents spam by email, phone calls or text messages to your customers
  • It is compliant with over 100 data protection laws worldwide.


To Top Of Page

4. How can I set all domains of a registrant contact to privacy protect?

For starters, make sure you have your customers consent for setting domains to privacy protect. You can do this by either explicit consent or through your terms of service. If you use the Realtime Register Domain Manager, we have a Privacy Protect step-by-step plan available for you. If you use the Realtime Register API, you can use the API commands set to privacy protect. However, even then you want to have a look at the Privacy Protect step-by-step plan.

To Top Of Page

5. Do I need to have consent of the registrant for privacy protect?

Yes, you need to have some form of consent, please have a look at item 4 of this FAQ.  The privacy protect feature also sets the domain to transfer prohibited. This also requirers the consent of the registrant.

To Top Of Page

6. Do ALL TLDs allow privacy protecting?

Nope, I am sorry, however, privacy protect is allowed for practically all generic TLDs. Most ccTLDs don’t allow it. However, the ccTLDs that don’t allow privacy protect in general show very few information, so effectively it’s privacy protected.
For example; the Dutch .nl extension does not display the registrant name if there is no organization name added to the registrant information. As do other ccTLD registries like DNS BE, Eurid and Afnic.


To Top Of Page

7. How can someone get in touch with the registrant of a privacy protected domain?

Basically, in two ways by using a captcha-protected form at my domainprovider.com and sending an email to the domainname.extension@mydomainprovider.com email address.

  1. If the form at mydomainprovider.com is used, the email with optional attachment is directly send to the registrant’s email address in the registrant contact handle. Of course, the sender does not get to see the real address.
  2. If the mail is send directly to the email address in the whois, the behaviour depends on the status of the client transfer prohibited setting.
    1. If client transfer prohibited is TRUE, the sender gets an email to go to the mydomainprovider.com form. Effectively blocking spam bots from reaching the registrant.
    2. If the setting client transfer prohibited is FALSE, the registrant gets a standard email with a link to view the message. Attachments from the sender are discarded. This route ensures limited protection from spam though allows for transfer out FOA’s to reach the registrant.


To Top Of Page

8. Why should I set my customers domains on client transfer prohibited TRUE?

  1. It helps to prevent domain theft and unwanted transfers.
    • Even if someone of your staff has been socially engineered to provide an authorization code to an unauthorized person, it adds an additional threshold for transferring the domain away.
  2. It reduces spam reaching the registrant even better.
    • If the domain is privacy protected automated spam is unable to get in your customers mailbox.


To Top Of Page

9. How about exposing registrant information through the other contacts?

That is a tricky one, if you use different contacts with the registrant’s information you will end up exposing unwillingly contact information of the registrant. In general, there are two approaches:

  1. Change all admin, billing and tech contacts to a contact that has your brand information. As a nice side effect, your brand gets more exposure in the whois information.
  2. Change all contacts to the contact handle of the registrant. This way, these whois contacts will also display the privacy protect information.

It’s up to you, make your pick!