Dear Mr. Buchanan and Members of WHOIS Task Force 2:
As Director of the Office for Information Technology Policy of The American Library Association (ALA), I am pleased to submit these comments to WHOIS Task Force 2.  The American Library Association (ALA) is the oldest and largest library association in the world with some 64,000 members, primarily
school, public, academic and some special librarians, but also trustees, publishers, and friends of libraries. The Association's mission is to provide leadership for the development, promotion and improvement of library and information services and the profession of librarianship in order to enhance learning and ensure access to information for all.  ALA is also a member of the International Federation of Library Associations, an organization which devotes considerable energies to information policy issues, including privacy and fair information practices.

ALA represents the interests of libraries and archives; we also represent the interests of our patrons.  As an “internet service provider,” our members offer Internet access, services and education to millions of patrons who use the Internet through our library facilities..

ALA has a long traditional of protecting the rights of its member libraries and archives, and our and patrons.  Our commitments include:
 
	-	Resisting abridgement of free expression and free access to ideas
	-	Protecting privacy and personal information
	-	Advancing intellectual freedom.
		See Library Bill of Rights and ALA's Task Force on Privacy and Confidentiality in the Electronic Age http://www.ala.org/ala/oif/statementspols/statementsif/librarybillrights.htm and 
		http://www.ala.org/ala/lita/litaresources/taskforceonpriv/alataskforce.htm
		
Before addressing the specific issues of the TF2 report, we would like to offer a general statement regarding privacy and fair information practices relevant to this WHOIS discussion.

ALA believes that ICANN policies regarding the privacy of personal information in registrar databases should be, at minimum, grounded in the international concept of fair information practices. Over the last thirty years, these principles in one form or other have become the foundation for national privacy laws, international agreements, and voluntary codes of conduct all over the world. It would not only be aberrant for an international organization such as ICANN to establish policies that ignore these principles, it would place registrars in an untenable position between privacy laws of their national governments and ICANN policy. It would put ICANN at odds with a global consensus on the proper and fair treatment of personal information.

Among the principles, ALA particularly points to two as relevant for this Task Force report:

Limitations on Disclosure: Unless compelled by law, data collectors should not disclose personal information to third parties without explicit permission of the data subject. This principle is fundamental to the treatment of transaction records of library users, for example. The example below of this principle in action in the commercial sector comes from the privacy statements on the AT&T web page.

“AT&T will not sell, trade, or disclose to third parties any customer identifiable information derived from the registration for or use of an AT&T online service -- including customer names and addresses -- without the consent of the customer (except as required by subpoena, search warrant, or other legal process or in the case of imminent physical harm to the customer or others).”

Limitation on collection: Only information specifically needed for the intended purpose should be collected, and it should be retained only as long as it is needed for that purpose. Many, if not most libraries, for instance, will destroy lending transaction records when a book is returned, since it is no longer required for library operation. Another example of collection limitation in the case of government agency practice comes from the 1974 Privacy Act (US):

Each agency that maintains a system of records shall-- …  maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or by Executive order of the President; Privacy Act of 1974 (US).

ALA believes these international principles are fundamental. Its model library privacy policy (http://www.ala.org/ala/oif/iftoolkits/toolkitsprivacy/libraryprivacy.htm#modelprivacy) contains the following statement:

“In all cases we avoid creating unnecessary records, we avoid retaining records not needed for the fulfillment of the mission of the library, and we do not engage in practices that might place information on public view.”

We believe that personal data collected by registrars should be treated with the same level of privacy consideration, and the Task Force 2 Report does not give these principles sufficient attention or weight in its recommendation.

ALA now responds to specific issues in the order they were raised in the TF2 report.

A.	Notification and Consent
TF2's recommendations, summarized, advise ICANN to “incorporate compliance with the notification and consent requirement,” “issue an advisory reminding registrars of the importance of compliance with this contractual requirement,” and encourage development of best practices that will improve the effectiveness of giving notice to, and obtaining consent from, domain name registrants.”  TF2 Report, Section 3.1

ALA supports these recommendations, subject to the caveats of the next paragraph.  ALA agrees that additional notification and consent regarding the collection, use and publication of WHOIS data, especially the “sensitive data” of registrant and administrative contact fields, should be discussed much more clearly with registrants.  We agree that many who register for domain names are unaware that highly sensitive data is made immediately available in the WHOIS directory.

Despite the global nature of the Internet, ICANN does not have the right to demand that registrants waive fundamental individual and civil rights as a condition of registration. Where contract violate fundamental rights, the clauses are considered void.  For example, contractual clauses that bar people of certain races or religions from owning property or entering premises in US are “void against public policy” and deemed struck from the contract, regardless of the binding nature of the rest of the agreement.

Accordingly, ALA asks TF2 in its final report to clarify that notification and consent are insufficient if the registrant is asked to waive fundamental individual and civil rights (such as privacy and free speech), and given no options other than not registering a domain name. 
 
B.	Local Law
The TF2 report did a good job of data gathering in the area of national law.  Through our membership in the Noncommercial Constituency, we followed the presentations of George Papapavlou and Giovanni Buttarelli at the Rome ICANN meeting, and compliment the extensive work of TF2 in researching data protection and free speech laws around the world. 

We agree with the recommendation of the TF that:
“ICANN should develop and implement a procedure for dealing with the situation where a registrar... can credibly demonstrate that it is prevented by local mandatory privacy law or regulations from fully complying with applicable provisions of its ICANN contract regarding the collection, display and distribution of personal data via WHOIS.”

We recommend that the concept be clarified and expanded to include not only privacy, but freedom of speech protections, and not only laws and regulations, but also court rulings and other direct governmental orders to ICANN and/or the registrars and registries in this important area of public policy.  

We do not agree with the recommendation that:
“Except in those cases arising from a formal complaint by a local law enforcement authority that will not permit consultation with ICANN prior to resolution of the complaint under local law,” that the Registrar or registry must consult first with ICANN before addressing the concern or complaint.  

ALA questions this recommendation.  If data protection officials, courts or other governmental agencies are acting within the scope of their legal authority in addressing privacy and free speech concerns regarding the collection, use and publication of WHOIS data, then their concerns should be addressed in a timely and satisfactory manner by the registrars.  If the process does not lend itself to involving ICANN, then the registrar should inform ICANN of the results.  But the registrar should not be forced to bring ICANN into the process (with the implication that ICANN will argue against the national law and registrant rights).  ALA asks TF2 to revise this recommendation to allow registrars to act in their discretion and good judgement on whether to involve or merely inform ICANN. 

C.	Collection of Data
Despite calls from several Constituencies and the EU’s Data Protection Article 29 Working Group to limit the collection of personal data for the WHOIS database/directory, TF2 failed to act on these concerns:
“The Task Force makes no recommendation with regards 
		to the collection of data at this time.” TF2 Report, Section 3.4.

We are disappointed and concerned about the result.   It is clear that the collection of sensitive and personal data, far beyond the scope of technical and operational utility, is not an appropriate function of ICANN which is charged with technical management.  ALA asks TF2 to revisit and revise this section to allow registrars and thick registries to collect the data necessary for their business purposes, but to restrict the collection of data for the WHOIS database/directory solely to those elements that are technical, or in the terminology of TF1,  “non-sensitive.” 

D.	Publication of Data

Section 3.5 raises a varied set of issues, so we will review each in turn. 
3.5 a)  “Technical and operational details about the domain name should continue to be displayed to the public on an anonymous basis.... Further contact details for the registrant and administrative contact would only be available in one or more protected tiers.”

As discussed above, ALA sees no reason for the WHOIS database to publish data beyond the scope of technical and operational utility.

3.5 b) 	“Registrants should have the option to direct that some or all of their protected data be displayed to the public.”

ALA agrees that registrants should have the ability to “opt-in” to the publication of “sensitive data,” namely the registrant and administrative contact fields.  This voluntary publication of data, we expect, would be especially valuable to companies holding themselves out to do business with the public.  But in these limited cases, such publication of sensitive data could provide reassurance to a potential customer that the company strives to be located and its staff will be available to handle complaints should they arise.   

This type of voluntary disclosure could easily become part of our member library Internet training programs, and help our patrons decide which companies they choose to do business with online.  This recommendation, accompanied by privacy for the sensitive data of other registrants, provides a good balance of registrant rights and consumer needs.

3.5 c) “Those meeting the requirements and identifying a legitimate use to access protected information should be able to obtain it in a timely manner.” 

ALA disagrees.  Protected information, or “sensitive data,” should only be provided pursuant to a formal request by law enforcement or judiciary (e.g., subpoena).  This is the standard in other areas of telecommunications law, and appropriate for the WHOIS database/directory system in the now-mature domain name industry. 

E.	Questions Raised by TF2 Under Publication of Data, Section 3.5

The TF2 Report raises some good questions and, consistent with the views we expressed to TF1, we propose some answers.

	a): 	What process of notification to registrants, if any, should take place when their protected data is accessed other than in circumstances required by law or contract....?
	
As state above, ALA opposes the release of sensitive data without legal process.  But if ICANN decides to make such sensitive data available to third parties without subpoena or other legal process, then notice to the registrant of the release of sensitive data must be a critical and necessary part of this process. 

There are human rights organization, planned parenthood clinics, libraries and archives posting documents critical of governments or officials, and individuals posting controversial or cutting-edge ideas.  Such organizations and individuals (noncommercial or commercial) should be protected, by existing public policy, from the disclosure of their data for the mere purpose of tracking them down to compliment or condemn the speech.  

If ICANN cannot give them the protection they need and deserve, then it must - at a very minimum - give Registrants notice.  Such notice must be complete, accurate, and especially timely.  Further, ALA submits that the data requestor must provide a detailed reason for its request of the sensitive data.  ALA calls on TF2 to include such a mandatory notice requirement in its future reports should it move forward with "tiered access" recommendations.

	b):  	What contact data should be shown in the protected tier?  

Technical contact and registrar contact data should be shown in the protected tier.   Consistent with our comments above, ALA does not believe the protected tier should disclose data to those who do not have legal process to obtain it.  The abuses of such data, and its protection under national law, mandate such protection.

However, additional steps might be taken to improve the technical contact data, including better educating registrants about its use so they can better choose the individual or organization they list to help others resolve technical or operational problems. 

Should ICANN proceed with the “tiered access” model, then ALA recommends that as little sensitive data as possible be published in the “protected tier.” 

F.	An Important Missing Part of TF2's Work

ALA notes that TF2's work lacks any discussion of the fundamental right to communicate anonymously. Obviously,  the domain name system, with its ability to create places online that can be bookmarked and linked to with clear and easily circulated URLs, is a critical part of worldwide communication today.

The US Supreme writes that anonymous speech is a crucial part of not only US communication, but world history:

"Anonymous pamphlets, leaflets, brochures and even books have played an important role in the progress of mankind." Talley v. California, 362 U.S. 60, 64 (1960). Great works of literature have frequently been produced by authors writing under assumed names.  Despite readers' curiosity and the public's interest in identifying the creator of a work of art, an author generally is free to decide whether or not to disclose her true identity. The decision in favor of anonymity may be motivated by fear of economic or official retaliation, by concern about social ostracism, or merely by a desire to preserve as much of one's privacy as possible. Whatever the motivation may be, at least in the field of literary endeavor, the interest in having anonymous works enter the marketplace of ideas unquestionably outweighs any public interest in requiring disclosure as a condition of entry. 

McIntyre v. Ohio Elections Comm'n (93-986), 514 U.S. 334 (1995).   Accordingly, ALA advises ICANN and TF1 to find a way to protect anonymous speech.  Creating protections for sensitive data and privacy is a good start, but ICANN must do more.  

ALA asks TF2 to recommend creation of a process to review domain names being canceled for inaccurate data and failure to update.  Such a process might include creation of a group empaneled from public interest organizations which would review the domain names, the available websites, and content associated with that domain name, and the reason for the complaint filed against the domain name.  If the panel finds that the use of the domain name is protected under traditional values of free speech and human rights, then it would remove the domain name from the delesion list.  

After all, 
“.... anonymous pamphleteering is not a pernicious, fraudulent practice, but an honorable tradition of advocacy and of dissent. Anonymity is a shield from the tyranny of the majority. See generally J. S. Mill, On Liberty, in On Liberty and Considerations on Representative Government 1, 3-4 (R. McCallum ed. 1947).

McIntyre v. Ohio Elections Comm'n.

Conclusion

ALA thanks TF2 for this opportunity to comment on its work. 

Frederick Weingarten
Director, Office for Technology Policy
American Library Association
1301 Pennsylvania Avenue NW, Suite 403
Washington, DC 20004