Belgian Registrar NAMEWEB BVBA Makes A Data Retention Waiver Request To ICANN

Belgian registrar NAMEWEB BVBA made a data retention waiver request to ICANN. The waiver request comes after the first waiver granted by ICANN to OVH SAS on the basis of French law.

ICANN has made a preliminary determination that it is prepared to grant a data retention waiver request submitted by Registrar NAMEWEB BVBA under the 2013 Registrar Accreditation Agreement (the “2013 RAA“). Section 2 of the Data Retention Specification (the “Specification”) of 2013 RAA provides that prior to granting any exemption under the Specification, ICANN will post its determination on the ICANN website for a period of thirty (30) calendar days.

Pursuant to Section 2 of the Specification, NAMEWEB BVBA submitted to ICANN a Registrar Data Retention Waiver Request (“Waiver Request”) on the basis of NAMEWEB BVBA’s contention that compliance with the data collection and/or retention requirements of the Specification violates applicable law in Belgium.

The Waiver Request cited Article 5 of Chapter 2 of the Belgium Act of 8 December 1992 on the protection of privacy in relation to the processing of personal data. That article provides as follows (the following is an unofficial English translation from Dutch):

Article 5.

Personal data may be processed only if:

1. the data subject has unambiguously given his consent;
2. the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;
3. the processing is necessary for the compliance with an obligation to which the data controller is subject by or by virtue of law, decree or ordinance;
4. the processing is necessary in order to protect a vital interest of the data subject;
5. the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller or in a third party to whom the data are disclosed;
6. the processing is necessary for the purposes of the legitimate interests pursued by the data controller or by the third party to whom the data are disclosed, except where such interests are overridden by the fundamental rights and freedoms of the data subject.

The King may specify, by royal decree deliberated upon in the Council of Ministers and after having taken advice from the Commission for the protection of privacy, in such cases the conditions under f) shall not be considered fulfilled.

The Waiver Request was accompanied by a letter from the Article 29 Working Party dated 8 January 2014 regarding European Data Protection Directive 94/46/EC and asserted that the Belgian law cited is an almost direct translation into Dutch of the European Directive. The Waiver Request also cited the previous waiver granted by ICANN to OVH SAS on the basis of French law.

Following receipt of the Waiver Request, and in accordance with the 2013 RAA, ICANN through its legal counsel and NAMEWEB BVBA discussed the matter in good faith in an effort to reach a mutually acceptable resolution of the matter.

The outcome of those discussions is that NAMEWEB BVBA is seeking a waiver with respect to Sections 1.1.1 through 1.1.8 of the Specification that seeks to reduce from two years to one year the period for which these specified data elements must be retained after the Registrar’s sponsorship of the Registration ends.

ICANN has determined on a preliminary basis that it is prepared to grant the data retention waiver request. ICANN is posting this preliminary determination for a period of thirty (30) days to seek feedback and input from the community on the proposed data retention waiver. After the thirty (30) day period following this posting has expired, ICANN will consider all feedback and input received before making a final determination on whether to grant the Waiver Request.

The scope of the proposed waiver would be to permit NAMEWEB BVBA to maintain the information specified in Sections 1.1.1 through 1.1.8 of the Specification for the duration of its sponsorship of the Registration and for a period of one (1) additional year thereafter rather than two (2) additional years thereafter. In all other respects the terms of the Specification would remain AS-IS.

The specific change to the Specification would be that, for the duration of the Waiver, the retention requirement of Paragraph 1.1 of the Data Retention Specification be changed from “two additional years” to “one additional year.”

If ICANN does make a final determination to grant the Waiver Request sought by NAMEWEB BVBA, the provisions of Section 3 of the Specification would apply to similar waivers requested by other registrars located in the same jurisdiction. Section 3 of the Specification provides as follows:

If (i) ICANN has previously waived compliance with the requirements of any requirement of this Data Retention Specification in response to a Waiver Request from a registrar that is located in the same jurisdiction as Registrar and (ii) Registrar is subject to the same applicable law that gave rise to ICANN‘s agreement to grant such wavier, Registrar may request that ICANN to grant a similar waiver, which request shall be approved by ICANN, unless ICANN provides Registrar with a reasonable justification for not approving such request, in which case Registrar may thereafter make an Wavier Request pursuant to Section 2 of this Data Retention Specification.

A public comment period will remain open until 23:59 UTC, 21 April 2014. Public comments will be available for consideration by ICANN staff and the ICANN Board.