Motion - GNSO Council Input on Recommendation 7 of the Expedited Policy Development Process (EPDP) on the Temporary Specification for gTLD Registration Data Phase 1 Final Report and Thick Whois Transition Policy

WHEREAS

1. The Thick RDDS (Whois) Transition Policy for .COM, .NET and .JOBS (Thick Whois Transition Policy) is an ICANN consensus policy resulting from the implementation of the policy recommendations in the Final Report on the Thick WHOIS Policy Development Process (“Thick Whois PDP”).

1. Section 16 of ANNEX 2: Policy Development Process Manual to the GNSO Operating Procedures v3.5 provides: “Approved GNSO Council policies that have been adopted by the ICANN Board and have been implemented by ICANN Staff may only be amended by the initiation of a new PDP on the issue.”

1. On 17 May 2018, the ICANN Board adopted the Temporary Specification for gTLD Registration Data (“Temporary Specification”).

1. On 19 July 2018, the GNSO Council initiated an Expedited Policy Development Process (“EPDP”) and chartered the EPDP on the Temporary Specification for gTLD Registration Data Team to determine if the Temporary Specification should become an ICANN consensus policy as is, or with modifications (emphasis added).

1. Recommendation #7 in the EPDP Phase 1 Final Report (“Final Report”) makes transfer of registrant contact information optional, depending on whether the registry operator in question      has an appropriate legal basis to require the data and a data processing agreement is in place.

1. To the extent the Thick Whois Transition Policy is modified by Recommendation #7, the EPDP Team recommends the Thick Whois Transition Policy and other impacted consensus policies be updated to ensure consistency (see Recommendation #27 of the Final Report).

1. Recommendation #7 was developed in response to the questions in Section C of the EPDP Charter, with a consensus designation of “Full Consensus / Consensus” (see Annex E of the Final Report).

1. On 4 March 2019, the GNSO Council adopted all the policy recommendations in the Final Report, including Recommendation #7, with the required GNSO Supermajority.

1. On 15 May 2019, the ICANN Board passed a resolution adopting most of the policy recommendations contained in the Final Report, including Recommendation #7 and noting Recommendation #7 does not repeal or overturn the Thick WHOIS Policy [sic] and directed “ICANN org to work with the Implementation Review Team to examine and transparently report on the extent to which these Recommendations require modification of existing Consensus Policies, including the Thick WHOIS Transition Policy”.

1. Section 7 of Annex A-1 to the ICANN Bylaws provides: “Upon a final decision of the Board adopting the EPDP recommendations, the Board shall, as appropriate, give authorization or direction to ICANN staff to implement the EPDP Recommendations. If deemed necessary, the Board shall direct ICANN staff to work with the GNSO Council to create a guidance implementation plan, based upon the guidance recommendations identified in the Final EPDP Recommendation(s) Report.”

1. Section III. A of the Consensus Policy Implementation Framework provides: The GNSO Council may continue to provide input on the implementation of a policy, for example, if the GNSO Council believes that the implementation is inconsistent with the policy [recommendation]”.

RESOLVED

1. The GNSO Council confirms that the EPDP had the mandate to modify the Thick Whois Transition Policy under the EPDP

1. The GNSO Council determines that in light of the EPDP being chartered by the GNSO Council, among other things, to address the questions in Part 2(c) under “Mission and Scope” to specifically address the transfer of data from registrar to registry, the resulting recommendation #7 appropriately fulfills this purpose. Furthermore, the requirement of Section 16 of the PDP Manual is deemed satisfied for the purpose of amending the Thick Whois Transition Policy.

1. The GNSO Council determines, notwithstanding the absence of a clear statement, the intent of EPDP Phase 1 Recommendation #7 to modify the Thick Whois Transition Policy is implied, taking into account the history, background, context and purpose of the EPDP, the specific language of Recommendation #7 and the EPDP Phase 1 Final Report in its entirety.

1. The GNSO Council determines that the Recommendation #7 language, “must be transferred from registrar to registry provided an appropriate legal basis exists and data processing agreement is in place” should be included in the Registration Data Policy in order to conform with the intent of the EPDP Phase 1 Team’s policy recommendation and the subsequent GNSO Council adoption (“GNSO Council Input”).

1. The GNSO Council instructs the Council’s Liaison to communicate the GNSO Council Input to the Registration Data Policy Implementation Review Team pursuant to Section III.A of the Consensus Policy Implementation Framework.

1. The GNSO Council shall communicate the GNSO Council Input to the ICANN Board of Directors.

RATIONALE

The Thick Whois PDP Final Report anticipated that its recommendations might be affected by evolving privacy regulation. In particular, Recommendation 3 states,

“As part of the implementation process a legal review of law applicable to the transition of data from a thin to thick model … due consideration is given to potential privacy issues that may arise from the discussions on the transition from thin to thick Whois … Should any privacy issues emerge from these transition discussions that were not anticipated by the WG and which would require additional policy consideration, the Implementation Review Team is expected to notify the GNSO Council of these so that appropriate action can be taken.”

In addition, the implementation advice (“Other Observations”) mentions in part,

“...the increasing number of data protection and privacy laws and regulations around the world, as well as specific Whois-related concerns raised by the public. While recognizing that this exceeds the scope of our remit, we suggest that, as part of the development of the registration data directory system model currently in process, ICANN ensure that the ramifications of data protection and privacy laws and regulations with respect to Whois requirements be examined thoroughly.”

In effect, the Temporary Specification and the EPDP accomplished the legal review of the ramifications of data protection laws required by Recommendation 3 of the Thick Whois PDP Final Report     .

The requirements set out in the Temporary Specification supersede and replace the contractual requirements in the Registrar Accreditation Agreement and the Registry Agreements, which incorporate by reference all ICANN consensus policies.

There is a conflict between the data processing principles under the Temporary Specification and the requirements under existing gTLD Registry Agreements as well as the Thick Whois Transition Policy. In other words, the Thick Whois Transition Policy was modified by the Temporary Specification and further modified by Recommendation #7 in the EPDP Phase 1 Final Report, as the EPDP Team was mandated to do.

While there is no explicit reference to the Thick Whois Transition Policy, this consensus policy and others that are affected by the GDPR and other relevant data privacy laws fell squarely within the scope of the Temporary Specification and hence they are also within the scope of the EPDP. The EPDP Charter states:

“Mission and Scope

This EPDP Team is being chartered to determine if the Temporary Specification for gTLD Registration Data should become an ICANN Consensus Policy, as is or with modifications, while complying with the GDPR and other relevant privacy and data protection law. As part of this determination, the EPDP Team is, at a minimum, expected to consider the following elements of the Temporary Specification and answer the following charter questions. The EPDP Team shall consider what subsidiary recommendations it might make for future work by the GNSO which might be necessary to ensure relevant Consensus Policies, including those related to registration data, are reassessed to become consistent with applicable law.”

Specifically, Section C of the EPDP Charter contains a set of questions regarding “transfer of data from registrar to registry”:

c1) What data should registrars be required to transfer to the registry?

c2) What data is required to fulfill the purpose of a registry registering and resolving a domain name?

c3) What data is transferred to the registry because it is necessary to deliver the service of fulfilling a domain registration versus other legitimate purposes as outlined in part (a) above?

c4) Is there a legal reason why registrars should not be required to transfer data to the registries, in accordance with previous consensus policy on this point?

c5) Should registries have the option to require contact data or not?

c6) Is there a valid purpose for the registrant contact data to be transferred to the registry, or should it continue to reside at the registrar?

While the Final Report does not contain express language that the policy recommendations are intended to supersede the requirements in the existing ICANN consensus policies, in this case, the Thick Whois Transition Policy, such intent is implied (i.e., it goes without saying in light of the history, background, context and purpose of the EPDP).

The EPDP was conducted in an open and transparent manner with representatives from all GNSO Stakeholder Groups and Constituencies, as well as some ICANN Advisory Committees. As such, Recommendation #7 cannot be considered to be a “shadow repeal” of the Thick Whois Transition Policy.

The recommendations contained in the Thick WHOIS PDP Final Report anticipated that the implementation of those recommendations might be affected by new privacy regulations and the GNSO should address such an occurrence. Therefore, while there is no “clear statement in new consensus policy recommendations that the new policy is intended to supersede (in whole or part) requirements in existing consensus policies,” claiming otherwise ignores the history, background, context, purpose of the EPDP as well as the Thick Whois PDP Final Report itself.           

The intent and meaning of Recommendation #7 is clear. It is the role of the Implementation Review Team (IRT) to ensure that the implementation of Recommendation #7 conforms to the intent of the policy recommendation. The IRT is not a forum for opening or revisiting policy discussions (see III.A and III.B, Implementation Review Team (IRT) Principles and Guidelines https://www.icann.org/resources/files/1201611-2016-08-23-en).

The Policy Development Process Manual makes clear that “Approved GNSO Council policies that have been adopted by the ICANN Board and have been implemented by ICANN Staff may only be amended by the initiation of a new PDP on the issue.” It can therefore be concluded that where there is a conflict between an existing consensus policy and subsequent policy recommendation(s) on the same subject matter, the newer policy recommendation prevails. While the EPDP was scoped differently and under different circumstances than the Thick Whois PDP, it is undeniable that the two policy development processes overlapped in covering the same issue of transfer of Registration Data from registrar to registry, and therefore, the IRT should implement Recommendation #7 as written and intended.