Study Suggestion Number 16

[study-suggestion-response@xxxxxxxxx]

Submitted By:
[Redacted for privacy reasons]

Topic:
To identify whether registrants have legally consented to the disclosure of 
their personal information in Whois records under a variety of legal regimes.

Hypothesis:
It is impossible for registrars to obtain legally valid consent to the 
disclosure of registrantsâ?? personal information in Whois records under 
various national data protection / privacy laws.

How the hypothesis could be falsified:
The hypothesis would be falsified if it can be shown _either_ that registrars 
are currently obtaining valid legal consent to disclose registrantsâ?? personal 
information in Whois records, _or_ that the consent obtained would be valid if 
registrars incorporated additional steps into the process they use to obtain 
consent.

Utility:
It would identify whether registrants are validly consenting in a verifiable 
and enforceable manner to the submission of their personal information in Whois 
records (or whether their consent could be valid if modifications were made to 
registrarsâ?? processes), thus suggesting that additional measures either are, 
or are not, necessary to bring Whois services in conformance with the 
requirements of national privacy laws. 

Type of Study Needed:
A legal analysis of the terms in various registrarsâ?? registration agreements 
concerning data collection and disclosure and their process for collecting such 
data and obtaining consent, under the laws of a variety of jurisdictions.

Data that needs to be collected:
This study could be done by obtaining a representative sampling of 
registrarsâ?? terms and conditions covering various TLDs. The study should also 
track for each registrar how (or whether) the terms and conditions are 
communicated to registrants and the registrant provides consent in the 
registration process. The policies and procedures thus documented would be 
analyzed for compliance with a variety of pre-selected legal regimes that are 
diverse in geography and in the substance of their privacy requirements. If the 
policies and procedures are not deemed to comply with a particular legal 
regime, the regime should be analyzed to determine if consent could be validly 
obtained, consistent with ICANN Registrar Accreditation Agreement 3.7.7.5 
(under which consent to the data processing necessary to provide the required 
Whois services is a necessary prerequisite to registration).

The study would be conducted by an independent law firm retained by ICANN, 
preferably one with a privacy and data protection practice spanning the 
selected jurisdictions, or by multiple firms.

Population to be surveyed:
Statistically relevant number of registrars covering TLDs and law regimes which 
represent a relevant part of the relevant geographical regions in which privacy 
of such data is currently a public issue of concern such as European Union and 
the USA.  Because there may be significant variations in consent in different 
jurisdictions, the population should be segmented by jurisdictions.

Sample Size:
Because registrarsâ?? terms and conditions are readily available, a significant 
sample size is available. If not all registrars, the sample should represent a 
sampling of registrars large enough to be instructive, with sufficient 
geographical diversity to provide insight about various legal regimes. 

Type of Analysis:
Once the data is collected, an analysis could be done to understand what 
percentage of sampled registrars is legally obtaining its registrantsâ?? 
consent to include personal information in Whois records, and what percentage 
could with additional steps obtain consent consistent with both national law 
and ICANN RAA 3.7.7.5.