Edited Statement of the Noncommercial Users Constituency on Purpose of WHOIS Contacts -- Circulated on 1/29/2006  (original NCUC Contacts statements remains in effect; this statement is edited to highlight specific points relevant to the current discussion).

Summary:  NCUC submits that whatever “purpose” formulation the GNSO Council chooses,  we must ask the follow-up questions:  What Whois contact information is necessary to fulfill that purpose?  What data should Registrars should be required by ICANN to collect?

[section edited….]

…. once we have selected a purpose for our database, data protection laws require us to closely examine whether the information we collect meets the goals we have set out – and make adjustments accordingly. These comments discuss the Contact data currently collected for WHOIS and the personal nature of much of it.  They raise the question whether this data should be collected at all for WHOIS purposes.

I.	Data Protection Laws Require Limited Collection of 
	Personal Data	

In its 2003 Opinion, the Article 29 Data Protection Working Party of European Union Data Protection Commissions urged ICANN to closely examine the personal data it collects for WHOIS.  The Commissioners warned:  

“Article 6c of the Directive imposes clear limitations concerning the collection and processing of personal data meaning that data should be relevant and not excessive for the specific purpose.  In that light it is essential to limit the amount of personal data to be collected and processed.”  

Opinion 2/2003 on the application of the data protection principles to the Whois directories
http://europa.eu.int/comm/justice_home/fsj/privacy/docs/wpdocs/2003/wp76_en.pdf (emphasis added).  

The Data Protection Commissioners’ concern over collection of WHOIS data is grounded in the clear language of the EU Data Protection Directive and its Article 6  “Principles Relating to Data Quality” which clearly sets limits on the collection of personal data:  

“Member States shall provide that personal data must be:
(a) processed fairly and lawfully;
(b) collected for specified, explicit and legitimate purposes and not further  processed in a way incompatible with those purposes. ***
(c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed;”

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,http://europa.eu.int/comm/justice_home/fsj/privacy/law/index_en.htm.

	The Canadian Personal Information Protection and Electronics Document Act also sets limits on the collection of personal data:   

“The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.”  
http://laws.justice.gc.ca/en/P-8.6/93196.html#rid-93228 [emphasis added].

Similarly, Australia’s Privacy Principles mandate: 
“1.1 An organisation must not collect personal information unless the information is necessary for one or more of its functions or activities.”

National Privacy Principles (Extracted from the Privacy Amendment (Private Sector) Act 2000), http://www.privacy.gov.au/publications/npps01.html.

Based on these legal requirements, the NCUC submits that the WHOIS Task Force must review the contact data currently collected, evaluate whether it is personal, and determine whether it should continue to be collected in keeping with the purpose of the WHOIS Database.  Over-collection of personal data does not serve ICANN’s mission nor does it help registrars comply with the many existing laws that protect registrant privacy worldwide.  

 [Sections edited.]

Administrative Contact

 [Section edited.]

In our review, we found that the Administrative Contact data OFTEN includes personal data, especially for individuals and small organization leaders who must list their own names, home addresses, personal (and often unlisted) phone numbers and private email addresses for the Administrative Contact field.  

This type of personal data is exactly what the privacy laws of many regions and countries set out to protect.  Its collection invokes major privacy concerns for individuals and small organizations -- and draws the formal protection of data protection laws in many countries in which registrants live and registrars operate.  

Finally, since the purpose of the WHOIS database is technical and the Administrative Contact is expressly non-technical, NCUC submits that this contact data should no longer be collected for the WHOIS database.  

	C.	Registered Name Holder or “Domain Holder”

 [Section edited.]

Of all the contact data, we find the Domain Holder to be the most personal.  This is the woman, the family head, the Cub Scout leader, and other individuals and leaders of small organizations who must list their personal names, home addresses, private phone numbers and personal email addresses.  Once published, this personal data is used for all the abuse and misuse documented in the Task Force Uses report – from spamming to stalking and harassment.  

This personal data is exactly the type of data that data protection laws seek to protect.  Article 29 Data Protection Commissioners now urge ICANN and our TF that:  

“The registration of domain names by individuals raises different legal considerations than that of companies and other legal persons registering domain names” and  “it is essential to limit the amount of personal data to be collected and processed.” Article 29 WG citation above. 

The collection of such personal data as a global ICANN WHOIS policy serves no technical purpose.  Individual registrants rarely answer technical questions about their domains or their abuse – and would refer such questions (such as the hijacking of their domain name by a spammer) to their technical contact instead.   Accordingly, the collection of Domain Holder data serves little purpose for the WHOIS database and should not be continued as a global ICANN policy. 

Conclusion:
The best way to protect millions of individual and small organizational domain name registrants, and to comply with data protection laws worldwide, is for ICANN to carefully review the contact data collected for the WHOIS database and limit the data strictly to that necessary for its technical purposes and mission.