I have made some modifications and additions to
Bruce's original draft, keeping within its spirit but
narrowing the focus and adding milestones.
Title: Review of data collected and displayed
Participants:
- 1 representative from each constituency
- ALAC liaison
- GAC liaison
- ccNSO liaison
- SECSAC liaison
- liaisons from other GNSO WHOIS task forces
Description of Task Force:
==========================
There are domain name holders that are concerned about their privacy,
both in terms of data that is collected and held about them, and also in
terms of what data is made available to other parties.
Extensive contact information can assist a registrar or network provider
to contact a domain name holder in the event of a technical problem or
in the event of domain name expiration. However, a domain name
holder may be prepared to make a personal decision to accept a lower
standard of service (e.g take their own steps to be reminded of when a
domain expires) in return for greater privacy. A domain name holder
may be prepared to provide extensive contact information to their domain
name provider, but would prefer to control what information is available
for public access. For example a telephone customer may provide
detailed address information to a telephone service provider, but may
elect not to have this information displayed in a public whitepages
directory. Note however that national laws often permit access to the
complete information to groups such as law enforcement and emergency
services personnel. Another issue is that there is limited public
understanding of the present contractual obligations. Most domain name
holders are unaware that their information is being displayed publically via
the present port-43 and interactive web access methods.
The purpose of this task force is to determine:
a) What is the minimum required information about registrants that
must be collected at the time of registration to maintain adequate
contact-ability?
b) Should domain name holders be allowed to remove certain
parts of the required contact information from anonymous (public)
access, and if so, what data elements can be withdrawn from public
access and what contractual changes (if any) are required to enable
this? Should registrars be required to notify domain name holders when
the withheld data is released to third parties?
c) What is the best way to inform registrants of what information about
themselves is made publicly available when they register a domain
name and what options they have to restrict access to that data and
receive notification of its use?
To ensure that the task force remains focussed and that
its goal is achievable and within a reasonable time frame, it
is necessary to be clear on what is out of scope for the task force.
Out-of-scope
============
The task force should not examine the mechanisms available for
anonymous public access of the data - this is the subject of a separate
task force.
The task force should not examine mechanisms for law enforcement
access to the data collected. This is generally subject to varying local
laws, and may be the subject of a future task force.
The task force should not study new methods or policies for ensuring
the accuracy of the required data. However, it should study
whether giving registrants the ability to withhold data from public,
anonymous access will increase user incentives to keep the contact
information they supply current and accurate.
The task force should not consider issues regarding registrars' ability
to use Whois data for their own marketing purposes, or their claims
of proprietary rights to customers' personal data.
Tasks/Milestones
================
This Task Force would begin at the same time as the other one and
execute its duties in the following order:
1. Conduct an analysis of the existing uses of the registrant data
elements currently captured as part of the domain name registration
process. Develop list of minimal required elements for contact-ability. The intent is to determine whether all of the data
elements now collected are necessary for current and foreseeable
needs of the community, and if so, how they may be acquired with
the greatest accuracy, least cost, and in compliance with applicable
privacy, security, and stability considerations. 4-5 months?
2. Decide what options will be given to registrants to remove data
elements from public access and what contractual changes (if any) are required to enable this. 3 months?
3. Examine the current methods by which registrars and their resellers
inform registrants of the purpose for which contact data is collected,
and how that data will be released to the public. Examine whether policy
changes (or published guidelines) are necessary to improve how this
information is provided to registrants. 2 months?
|
