International Video Federation

…1 29 April 2020 Feedback to the European Commission’s Roadmap Document: “Report on the application of the General Data Protection Regulation” WHOIS & the GDPR Background: What is WHOIS? The Internet Corporation for Assigned Names and Numbers (ICANN) is the organization which, through its multi-stakeholder community, sets and enforces policies to ensure the secure and stable operation of the Internet domain name system, including about the registration of domain names. Under the rules and by contract with ICANN, entities known as registries and registrars sell and administer domain names. Amongst other things, registrars and registries are required to collect, share and process certain data from people and companies which register domain names (who they are, how they can be contacted, etc.).

…certain data from people and companies which register domain names (who they are, how they can be contacted, etc.). Until the entry into force of the GDPR in May 2018, this information was publicly accessible through a system called WHOIS and used for a variety of purposes, including by law enforcement agencies, private sector organizations and consumers. For example, anti-counterfeiting and anti-piracy right holders and groups used such information to help identify, contact and/or take legal action against registrants of Internet domains where illicit activity, such as trade mark or copyright infringement, was taking place. Other organizations similarly used this data to fight a wide range of online harms, including serious crimes such as fraud, cyber threats (e.g. phishing), fake pharmacies, and child exploitation.

…harms, including serious crimes such as fraud, cyber threats (e.g. phishing), fake pharmacies, and child exploitation. Even the inaccurate or outdated information contained in WHOIS served as key indicators allowing investigators to link together entire networks of bad actors. There is simply no question that the use of WHOIS data had many benefits for the protection of the public interest and the secure and stable operation of the Internet. Effect of Misguided Application of the GDPR on WHOIS In May 2018, ICANN adopted a temporary policy intended to comply with the GDPR. This policy gave the relevant registrar or registry the authority to decide whether to accept or reject each access request, and required that they grant access to entities that have a legitimate purpose for such access.

…each access request, and required that they grant access to entities that have a legitimate purpose for such access. In practice, almost all access requests (well over 90% in the practical experience of one group) are now denied, even when they conform with the requirements of ICANN’s temporary policy. This contributes to a lack of accountability and facilitates the use of domain names for illegal purposes. It also contributes to decreased compliance with Article 5 of the EU E-Commerce Directive, which affirmatively requires online service providers to make publicly available a set of basic identity and contact information that is very similar to WHOIS data. Ref.

…to make publicly available a set of basic identity and contact information that is very similar to WHOIS data. Ref. Ares(2020)2295290 - 29/04/2020 2 Development of a New Access Policy In May 2018, simultaneously with implementing the temporary policy, ICANN convened an Expedited Policy Development Process (EPDP)1 to propose a permanent and GDPR-compliant access policy. The EPDP must decide under what conditions registrars and registries can collect and process data and then who can request and be granted access to non-public registrantinformation, such as: what are legitimate purposes to access this data, who can access it and what restrictions are imposed on its use? While the EPDP is labouring to find compromises on a multitude of issues, it remains deeply divided over some fundamental questions.

…is labouring to find compromises on a multitude of issues, it remains deeply divided over some fundamental questions. This division includes whether fighting against copyright and trade mark infringement is a “legitimate purpose” and whether data from legal and natural persons should be treated differently. It also includes the most important question: will the authority to grant or deny each access request be centralized (whether at ICANN or at another authority), or will it remain decentralized at the thousands of registrars and registries around the world? We are convinced, based on real-world experience, that decentralization would accommodate the least diligent providers and virtually guarantee that legitimate access would continue to be routinely denied.

…the least diligent providers and virtually guarantee that legitimate access would continue to be routinely denied. Therefore, we support the initiative, taken by the CEO of ICANN in October 2019, to share with the European Data Protection Board (EDPB) a proposed unified and centralized mechanism for access to non- public registration data. This initiative seeks clarification of the legal foundation upon which such a model could be built. Getting answers to the questions included in this paper is imperative so that the ICANN community can continue working on a model knowing which policy options they can consider. Depending on the EDPB answers, a unified and consistent model for access to data could be possible, otherwise the community will have to work on a distributed one, where each individual contracted party applies its individual judgement to requests for access.

…on a distributed one, where each individual contracted party applies its individual judgement to requests for access. The GDPR was never intended to cut off access to data for legitimate purposes; the unintended consequences it has had on the availability of WHOIS data deserve careful scrutiny. This concern over the lack of access to WHOIS data is also echoed in the European Parliament, as evidenced by Parliamentary Question E-000826/2020. Recommendations for EU Policymakers: • Call on ICANN’s Expedited Policy Development Process (EPDP) to develop a mechanism by a date certain that guarantees effective and timely access to registration data to entities with legitimate purposes, including but not limited to private parties enforcing their intellectual property rights.

…with legitimate purposes, including but not limited to private parties enforcing their intellectual property rights. • Support the initiative of the ICANN CEO towards the European Data Protection Board advocating a centralized model, as such a model is the only one that is likely to deliver effective access. • Consider appropriate means to provide additional clarification to eliminate misinterpretations that have unnecessarily hampered access to Internet domain registration data, and confirm the need for access to WHOIS data as necessary for the public interest. 1 The EPDP brings together representatives of the various groups of Internet stakeholders: business, Internet users, registrars and registries, governments and independent experts. 3 Signatories: Aktionskreis gegen Produkt- und Markenpiraterie e. V.

…registries, governments and independent experts. 3 Signatories: Aktionskreis gegen Produkt- und Markenpiraterie e. V. (APM) Alliance for Safe Online Pharmacy (ASOP) Associazione Nazionale Esercenti Cinema (ANEC) Associazione Nazionale Esercenti Multiplex (ANEM) Associazione Nazionale Industrie Cinematografiche Audiovisive e Multimediali (ANICA) Associazione Produttori Audiovisivi (APA) BREIN Center of the Picture Industry (CEPIC) Copyright Information and Anti-Piracy Centre (CIAPC) European and International Booksellers Federation (EIBF) European Brands Association (AIM) European Coordination of Independent Producers (CEPI) European Writers' Council (EWC) Fédération Internationale des Associations de Producteurs de Films (FIAPF) Federation of European Publishers (FEP) Federation of Screenwriters in Europe (FSE) Federazione per la Tutela dei Contenuti Audiovisivi e Multimediali (FAPAV)…

(LaLiga) Ligue de Football Professionnel (LFP) Louis Vuitton Moët Hennessy (LVMH) MEDIAPRO Motion Picture Association (MPA) Premier League Rättighetsalliansen Union des Fabricants (UNIFAB) Unione Italiana Editoria Audiovisiva Media Digitali Online (UNIVIDEO) VAP - Verein für Anti-Piraterie VAUNET

originalus šaltinis (PDF) ↗