Awesome stuff Farzaneh!


--

Best Regards,
Ephraim Percy Kenyanito
Public Policy Specialist/ Regulatory Affairs Specialist/ Project Manager-
International Trade, Technology, Media & Telecommunications Laws
Website: https://ekenyanito.com/
Twitter: @ekenyanito <https://twitter.com/ekenyanito>
PGP Fingerprint: B0FA394AF73DEB7AA1FDC7360CFED26DE6BA8DC1


On Sun, 17 Dec 2023 at 02:46, farzaneh badii <[log in to unmask]>
wrote:

> Hi NCSG
>
> I have started doing HRIA on GAC Communiques. I started with a Communique
> in Cancun.
>
> If NCSG and NCSG Policy Committee wants to, they can send this (with
> amendments and comments) as a letter to the Board. I am hopefully going to
> periodically do that and the next one is the GAC communique on urgent
> requests. Link to document to comment on:
> https://docs.google.com/document/d/1kmXgKaob7lIULB_6dXIepeZ7l2e6AzAJcfzAhuBKSEg/edit?usp=sharing
>
> The text:
>
> Governments asking for confidentiality of law enforcement requests for
> access to domain name registrants personal, private data: A human rights
> impact assessment
>
> WHOIS Disclosure System
>
> a. The GAC advises the Board:
>
> i. To direct ICANN org to promptly engage with the PSWG to identify and
> advance
>
> solutions for confidentiality of law enforcement requests so as not to
> preclude
>
> participation by law enforcement requesters when measuring usage of the
> WHOIS
>
> Disclosure System.
>
> Governmental Advisory Committee/ Cancun, Mexico, 2023
> <https://www.icann.org/en/system/files/correspondence/gac-to-icann-20mar23-en.pdf>
>
> Sources used: Business Social Responsibility Rapid Human Rights
> Assessment:
> https://www.bsr.org/files/BSR-Rapid-HRDD-Political-Armed-Conflict-Tool.pdf
>
> Rapid human rights impact assessment:
>
> The situation: WHOIS is the directory that includes the domain name
> registrants private, personal, sensitive data such as phone numbers,
> physical addresses and email addresses. Domain name owners can set up
> websites around the world. This database was public and accessible for
> years until General Data Protection Regulation came into effect which
> required redaction of data. However, GDPR also had provisions for
> disclosing the private data to third parties with a legitimate purpose.
> GDPR is vague on how such disclosure can take place.
>
>
> Rightsholders: Rightsholders in this situation are domain name
> registrants.
>
> Impacted vulnerable communities: potential impacted communities can be
> minority groups that discuss sensitive issues on their blog that are
> unfairly illegal in their countries. Such as minority religious groups,
> minority political oppositions and others.
>
> What is the severity of the actual or potential human rights impact?
>
> Unfair arrest, potential imprisonment, illegal house raids, cruel
> punishments
>
> What are the potential long-term implications of the situation?
>
> Decrease in use of domain names and public websites for exercising
> fundamental rights
>
> Inaccuracy of the database
>
> Peer companies that are taking action that the company can consult with
> directly?
>
> Regional Internet Registries that have similar WHOIS databases do not make
> the requests confidential, they report on which countries asked for the
> data in their transparency reports (See RIPE NCC)
> https://www.ripe.net/publications/lea-documents
>
> What can ICANN do to avoid, prevent, or mitigate the actual or potential
> human rights impacts?
>
> ICANN should not grant law enforcement agencies the option to seek
> disclosure of data confidentially from the registrars.
>
>
>
> Farzaneh
>