>>> <[log in to unmask]> 08/18/05 9:07 AM >>>
To the ICANN GNSO Council,

I have been asked to provide an opinion regarding the
proposal to adopt a WHOIS "privacy" policy that simply
requires the registrars to provide information about the
purpose of  the WHOIS service, third-party bulk access,
and the categories of information for the registered
name holder that will be made available to the public. The
current proposal does not advise registrants of any legal
rights they may have. It does not provide a redress mechanism
if their personal information is misused. It lacks transparency
as to the disclosure of their data. And it fails to provide basic
contact information for the person responsible for the data.

 From the perspective of privacy protection, the current
proposal is more likely to undermine Internet privacy than
it is to protect it. In this context, notice operates as a
disclaimer, i.e. it provides a "take it or leave it" proposition
to the registrant. There are not even  obligations established
to safeguard the data that is collected.

The only theoretical basis for a notice-based privacy regime
is where there are market-based alternatives that would
allow an individual to select from among competing
policies But since the ICANN seeks to establish a policy
that will cover all registrars, there is no market-based
alternative.

I would urge you to establish a privacy policy for WHOIS data
based on Fair Information Practices. Simply stated, this
approach would establish responsibilities for those entities
that collect and use personal information and rights for
those who are asked to provide personal information.
This is the basis of privacy laws all around the world.
Significantly, this is also the approach taken in policy
frameworks that seek to facilitate the flow of personal
information across national borders. This includes, for
example, the OECD Privacy Guidelines of 1981 and the
recently adopted APEC Privacy Framework.

Thank you for your consideration of these views.

Sincerely,

Marc Rotenberg
EPIC


REFERENCES

APEC Privacy Framework (2004)

OECD Privacy Guidelines (1981)

M. Rotenberg, "The Privacy Law Sourcebook: United States Law,
International Law, and Recent Developments" (EPIC 2003)

M. Rotenberg, "Fair Information Practices and the Architecture
of Privacy (What Larry Doesn't Get)" 2001 Stanford Technology
Law Review 1.

D. Solove, M. Rotenberg, "Information Privacy Law" (Aspen 2003)

On Aug 17, 2005, at 4:17 PM, [log in to unmask] wrote:

> Marc:
> I have a special request.  Tomorrow the ICANN GNSO Council may vote 

> on teh Notice provision we have been discussing.  If you could  
> issue a formal statement of one or two sentences about your legal  
> opinion of why this recommendation might be interpreted as a  
> waiver, then we can delay the vote as Council seeks additional  
> input from Jones Day (ICANN's attorney).
>
> This strategy has been suggested to me from well-placed person  
> outside our NCUC constituency, and it will definitely work :-).
>
> Would you be willing to issue such a short statement/opinion?   
> Again, a line or two is fine.  (You have the text of the resolution 

> from our prior emails.)  I have cc'ed Robin and Norbert -- our NCUC 

> reps and Milton.   Meeting tomorrow 8AM (DC time)
>
> Regards, and thanks,
> Kathy
> p.s. I am traveling and offline until tonight. If you have a  
> quewstion, I think Milton may be online.