Publication of Data
2.5 Findings 

The topic of publication of data received considerable attention in TF2.  While public access to the WHOIS databases by Internet users have been a feature of the domain name system since its inception, the network was originally small and the WHOIS database was  limited to the information of research and technical institutions.  This data -- including in some cases registrant name, address, phone and email – is now accessible to a much broader spectrum of members of the public (including on anonymous basis).  With this evolution have come increasing expressions of concern about the impact of the data on personal privacy and freedom of expression infringement (outlined below).

One topic the TF addressed and did not answer was the purpose of the database.  Our mandate was to balance contactability and privacy, which we have tried to do.  We leave to another day the knotty question of the ultimate purposes of this database, and whether and how they can change.

Findings:

1.	WHOIS data continues to serve a host of technical and operational functions for Registries and Registrars.  Transfers and other technical processes require the ability to access, verify and transfer WHOIS data.

2. 	WHOIS data often includes personally identifiable and otherwise sensitive data in the registrant, administrative contact and technical contact fields.  It is the type of information that, in some other contexts, individuals, human rights organizations and businesses (such as abortion clinics) have some ability to limit and control access to (e.g., an unlisted or ex-directory phone number). 

3. 	Submissions to the TF show that WHOIS data is used for a wide range of uses.  The data is widely used by network operators, businesses of all kinds, law enforcement, consumer protection agencies and members of the public for learning who has registered a domain name.   

4.  	Abuses of public access to Whois data have occurred and have impacted on registrant privacy.  Instances of identity theft, telemarketing, spamming and other forms of email and telephone harassment, stalking, abuse and harassment by groups acting outside of normal scope and legal need have been  presented to the TF, although the extent of such abuses has not been documented.  

5.	In order to maintain the balance of contactability and privacy, which TF2 was charged to find, a tiered access system deserves careful consideration and received extensive discussion in the Task Force.  Other options that also merit consideration but received less discussion in TF deliberations to date include proxy registration services (see questions raised in section 2.2)  and the ability of domain name registrants to “opt-out” of publication of WHOIS data on a case-by-case basis (as is currently the case in some ccTLDs).  .

6.	Some data requesters want timely, even immediate, responsiveness to their requests for Whois data.  Some data subjects (domain name holders) want timely, even immediate, notification when their personal/sensitive data is requested and revealed to a third party.  

Possible Balances:
 Several models were submitted in Constituency statements.  The Registries recommended that only General Information be provided in the WHOIS (which is technical data without registrant, administrative contact or technical contact information).  The Registrars recommended a 3-tiered system with limited information in the public WHOIS (name/country of registrant, administrative contact and technical contact) and technical data; additional information at a screened-access second tier (name/address of registrant, administrative contact and technical contact) and all data displayed for technical purposes by registries and registrars.

Noncommercial Users Constituency called for publication of technical contact data in the WHOIS, but removal of all registrant and administrative contact fields.  ALAC also requested removal of all personally identifying information, but asked as an alternative for notification of the domain name holder when his/her personal data was revealed.  The attention of the Task Force was also called to the example of GNR, registry operator for .NAME, which adopted (with ICANN approval), but has not yet implemented, a tiered access system for Whois in .NAME. [add link]
					
A tiered access proposal submitted to the TF during its deliberations called for a combination of some of the elements above: reduction of data available to the public for anonymous and unlimited access; additional but limited contact information provided to a party who can verify his/her/its identity and state a specific reason for the access to the particular domain name data; confirmation and then release of data via an automated process; immediate notification of the domain name holder by email of the release of personal data (allowing domain name holder to act for personal safety (e.g., data released to stalker) or enforce legal rights).

Other constituencies urged further explorations of other mechanisms to adjust the privacy/contactability balance, including (a) whether a system for withholding some contact data on individual registrants on a case-by-case basis due to special circumstances, already in place in some ccTLDs, could be viably extended to the gTLD environment as well as (b) the role of CRISP and other merging and relevant technical standards.

Publication of Data
3.5  Recommendations:

[see separate file]