Consideration of the Temporary Specification for gTLD Registration Data (Implementation of GDPR Interim Compliance Model)

The European Union's General Data Protection Regulation (GDPR) will go into effect on 25 May 2018. The GDPR is a set of rules adopted by the European Parliament, the European Council and the European Commission that will impose new obligations on all companies and organizations that collect and maintain any "personal data" of residents of the European Union, as defined under EU data protection law. The GDPR impacts how personal data is collected, displayed and processed among participants in the gTLD domain name ecosystem (including registries and registrars) pursuant to ICANN contracts and policies. Modifications need to be made prior to 25 May to allow ICANN and gTLD registries and registrars to continue to comply with ICANN contractual requirements and community-developed policies in relation to the GDPR. Though there has been significant work across the ICANN community to reach a compliance model, ICANN-adopted policies need to be updated to allow compliance with the GDPR. A full community-developed consensus policy is not yet available. Without a unified applicable policy in place, there will be fragmentation in how ICANN's contracted parties implement their own compliance programs in relation to gTLD registration data. As such, a unified applicable policy is needed in place prior to 25 May 2018, and doing so is in the public interest. The public interest is not served if the ICANN Board fails to take action on this critical issue.

ICANN org's agreements with registries and registrars require compliance with Board-adopted temporary policies or specifications. To develop a temporary policy or specification, at least two-thirds of the Board must vote to approve the temporary specification, and the changes in the specification must be justified and "necessary to maintain the stability or security of Registrar Services, Registry Services or the DNS or the Internet." The temporary policy or specification must be as narrowly tailored as feasible to achieve those objectives.

ICANN org, in consultation with the Board, has been exploring the possibility of a temporary policy or specification as a mechanism to implement the Interim GDPR Compliance Model. A draft of a proposed Temporary Specification for gTLD Registration Data ("Temporary Specification") was released to the Board and the community on 11 May 2018. That proposed Temporary Specification is drafted to establish temporary requirements for how ICANN and gTLD registries and registrars will continue to comply with existing ICANN contractual requirements and community-developed policies in relation to the GDPR.

At the Board's Vancouver Workshop, the Board used its time on 12 and 13 May 2018 to engage in substantial discussion with ICANN organization on the posted draft of the Temporary Specification, which resulted in additional proposed changes. At the end of its workshop, the Board took a resolution signaling its intention to consider a proposed Temporary Specification, and that doing so will be in the public interest. The Board identified that because of the significance of the Board approving a Temporary Specification, it was appropriate for the Board to take additional time prior to adoption, both for the Board's review and to have opportunities to discuss with the ICANN community on the contents of a proposed Temporary Specification.

The Board in its 13 May 2018 also identified that taking action on a Temporary Specification is within the public interest, because of the need for a uniformly applicable policy drafted to achieve compliance with the GDPR. It is important that a Temporary Specification be adopted so that it can be in force on 25 May 2018. The Board reaffirms these positions today.

An updated draft of a proposed Temporary Specification was shared with the ICANN community and Board on 14 May 2018. On 15 May 2018, ICANN org hosted a community-wide webinar to discuss the updated document. Where invited, the Board accepted invitations from community constituencies to further discuss a draft Temporary Specification. Additional refinements were made to the language of the Temporary Specification as a result of these ongoing discussion, however, there were no changes made that modified how the Proposed Interim Compliance Model is implemented through the Temporary Specification.

Through the Board's deliberations, it also identified that there are areas that are not policy topics within a Temporary Specification, but where further community conversation is needed on implementation. These items are identified in the Annex to the Temporary Specification, though they are not required to be part of the scope of the resulting policy development process. The Board encourages the community to resolve these items as quickly as possible after the effective date of the Temporary Specification.

This action is consistent with ICANN's mission "[…] to ensure the stable and secure operation of the Internet's unique identifier systems […]". As one of ICANN's primary roles is to be responsible for the administration of the topmost levels of the Internet's identifiers, facilitating the ability to identify the holders of those identifiers is a core function of ICANN.

ICANN's mission to ensure the security and stability of the operation of the Internet's system of unique identifiers has led to the obligations associated with providing the WHOIS service that are in ICANN consensus policies and contracts that ICANN has with registries and registrars. These policies and contractual obligations govern the collection, retention, escrow, transfer, and display of WHOIS registration data, which includes contact information of natural and legal persons as well as technical information associated with a domain name. Through these policies and contracts, ICANN sets the minimum requirements for WHOIS, ensuring the availability of WHOIS information to mitigate attacks that threaten the stable and secure operation of the Internet and to serve the public service uses above.

WHOIS is not a single, centrally managed database. Rather, registration data is held in disparate locations and administered by multiple registries and registrars. They each set their own conventions for the WHOIS service, consistent with the minimum requirements established in their contracts with ICANN.

Many gTLD registries and registrars are concerned about whether ICANN policies and contracts requiring them to collect, create, retain, escrow, and publish a variety of data elements related to registry/registrar operations, domain name registrations, and registrants are in conflict with the GDPR.

To ensure continued availability of the WHOIS service to the greatest extent possible and other processing of gTLD registration data while complying with the GDPR and avoid fragmentation of WHOIS, the Temporary Specification will provide a single, unified interim model to ensure a common framework for registration data directory services. To continue this public service and maintain the security and stability of the Internet, the Temporary Specification will allow for continued provision of WHOIS services via ICANN's contracts with domain name registries and accredited registrars.

There is work continuing to define standard forms of data processing addenda (containing EU Model Clauses to govern international data transfers where applicable) for Registry-Registrar Agreements and Data Escrow Agreements that Registry Operators and Registrars can rely upon to implement certain of the obligations in force in the Temporary Specification without the requirement to give notice to ICANN and seek approval for necessary data processing provisions. These will be completed and made publicly available prior to the Temporary Specification going into force.

As required when a temporary policy or specification is adopted, the Board also is taking action to implement the consensus policy development process. The Board will consult with the GNSO Council on potential paths forward (e.g. Expedited Policy Development Process) for considering the development of a consensus policy on the issues within the Temporary Specification, which must be concluded in a one-year time period.

The Board has developed an Advisory Statement to provide a detailed explanation of its reasons for adopting the Temporary Specification and why the Board believes such Temporary Specification should receive the consensus support of Internet stakeholders. The Advisory Statement is provided here [PDF, 511 KB] and is incorporated by reference into the rationale to the Board's resolutions.

On 16 May 2018, the ICANN Board received a letter from the GAC requesting that the Board defer a formal rejection of the GAC Advice to allow the GAC time to provide further clarification where possible. Pursuant to that request, the Board is not taking action today to initiate a formal Bylaws Consultation meeting between the GAC and the Board to address elements of the Temporary Specification that are inconsistent or could be viewed as inconsistent with items of the GAC advice in the San Juan Communiqué. The Board looks forward to receiving further clarification from the GAC and engaging in further discussion.

Overall, the Board's actions are expected to have an immediate impact on the continued security, stability or resiliency of the DNS, as it will assist in maintaining WHOIS to the greatest extent possible while the community works to develop a consensus policy. The initiation of focused consensus policy development work to consider the Temporary Specification is expected to have an impact on financial resources as the research and work progresses. If the resource needs are greater than the amounts currently budgeted to perform work on WHOIS- and GDPR-related issues, the President and CEO will bring any additional resource needs to the Board Finance Committee for consideration, in line with existing fund request practices.

When the Temporary Specification goes into effect on 25 May 2018, the WHOIS system will remain available, though there will be some changes. Registry Operators and Registrars are still required to collect all registration data. If Internet users submit a WHOIS query, at a minimum the user will receive "thin" data in return, including technical data sufficient to identify the sponsoring Registrar, status of the registration, and creation and expiration dates for each registration. Additionally, the user will have access to an anonymized email address or a web form to facilitate email communication with the relevant contact (e.g. registrant, administrative, technical contacts). ICANN org is expected to enforce the Temporary Specification as it is fully incorporated into the relevant Registry Agreements and Registrar Accreditation Agreements.

This is an Organizational Administrative Function of the Board for which public comment is not required, however the proposed Interim Compliance Model implemented through the Temporary Specification has been the subject of comments from the community over the past several months (https://www.icann.org/resources/pages/gdpr-legal-analysis-2017-11-17-en). The Board actions approved today help serve the public interest and further the requirement in ICANN's Bylaws to "assess the effectiveness of the then current gTLD registry directory service and whether its implementation meets the legitimate needs of law enforcement, promoting consumer trust and safeguarding registrant data." [Bylaws Sec. 4.6(e)(ii)]