CentralNic makes changes to domain WHOIS for many extensions to comply with GDPR

CentralNic announced changes they are planning to make to its registry system in order to comply with the European Union’s General Data Protection Regulation (GDPR).

They have published a document (PDF) which describes these changes, how they will affect its registrars, and the timeline for deployment. Changes will be implemented on July 11, 2018.

There is no single, uniform model for domains on the CentralNic registry platform, since each TLD is operated by a Registry Operator who has their own business requirements, their own registry policies, and who serve different Internet communities. Instead, TLDs (both generic and country-code) and second-level domains on CentralNic’s platform will adopt one of three models.

These three models are described in the document.

Standard Model (Unchanged by GDPR)
TLDs following the “Standard Model” will not see any change in their data collection and display policies.

Registrars must assign contact objects to the Registrant, Administrative, Technical and (optionally) Billing contacts for each domain. These contacts will be displayed in full in Whois records.
This model has mostly been selected by “brand” TLD operators who operate their TLDs for their own exclusive use.

Zones that will remain on the Standard Model:
•.adac
•.deloitte
•.dhl
•.edu.fm
•.epost
•.etisalat
•.gov.fm
•.idn
•.kfh
•.kpn
•.lidl
•.lpl
•.lplfinancial
•.meo
•.sapo
•.schwarz
•.smart
•.stc
•.stcgroup
•.viva
•.كتqب (.xn--ngbe9e0a)
•.تلااصتا (.xn--mgbaakc7dvf)

Minimum Data Model (A)

In the Minimum Data Model, registrars will no longer assign contact objects to the Administrative, Technical or Billing contacts for domains under their sponsorship. Only the Registrant must be specified, and other contact objects assigned to the domain in <create> or <update> commands will be ignored.

Since domains under TLDs operating under this model will not have Administrative, Technical or Billing contacts, this information cannot not be displayed in Whois records.

The “Registry Registrant ID”, which uniquely identifies the contact object in CentralNic’s system (and which is equal to the ROID of that object), will always be displayed in Whois records.
All other Registrant data elements, including those listed below, will only appear if the registrar has explicitly opted those fields in to be displayed:
•Registrant Name
•Registrant Organization
•Registrant Street
•Registrant City
•Registrant State/Province
•Registrant Postal Code
•Registrant Country
•Registrant Phone
•Registrant Phone Ext
•Registrant Fax
•Registrant Fax Ext
•Registrant Email

If it has been explicitly opted in, the “Registrant Email” will appear unmasked. Otherwise, it will be replaced with a link to a contact form.

Zones that will switch to the Minimum Data Model (A):
•.co.nl
•.contact
•.feedback
•.forum
•.fun
•.host
•.in.net
•.la
•.observer
•.online
•.pid
•.press
•.pw
•.realty
•.reit
•.sfr
•.site
•.space
•.store
•.tech
•.web.in
•.website
•.wme

Adapted ICANN Model (B)

This model is based on the “Cookbook” designed by ICANN but has been amended to address some of the issues that have been identified with that model. Under this model, domains must still be assigned Administrative and Technical contacts. The Billing contact remains optional.

The “Registry Registrant ID”, which uniquely identifies the contact object in CentralNic’s system (and which is equal to the ROID of that object), will always be displayed in Whois records.
All other Registrant data elements, including those listed below, will only appear if the registrar has explicitly opted those fields into display:
•Registrant Name
•Registrant Organization
•Registrant Street
•Registrant City
•Registrant State/Province
•Registrant Postal Code
•Registrant Country
•Registrant Phone
•Registrant Phone Ext
•Registrant Fax
•Registrant Fax Ext
•Registrant Email

If it has been explicitly opted in, the “Registrant Email” will appear unmasked. Otherwise, it will be replaced with a link to a contact form. No information relating to the Administrative, Technical or Billing contacts will be displayed. As a result, domains under TLDs operating under the Adapted ICANN Model (B) will have identical Whois records to those operating under the Minimum Data Model (A).

Zones that will switch to the Adapted ICANN Model (B):
•.ae.org
•.art
•.bar
•.basketball
•.best*
•.br.com
•.ceo*
•.cn.com
•.co.com
•.co.no
•.college
•.com.fm
•.coop
•.de.com
•.design
•.eu.com
•.fm
•.fo*
•gb.net
•.gent
•.gr.com
•.hu.net
•.icu
•.ink
•.jp.net
•.jpn.com
•.kred*
•.love
•.mex.com
•.net.fm
•.ooo
•.org.fm
•.protection
•.radio.am
•.radio.fm
•.rent
•rest
•.ru.com
•.rugby
•.sa.com
•.se.net
•.security
•.storage
•.theatre
•.tickets
•.uk.com
•.uk.net
•.us.com
•.us.org
•.wiki
•.xyz
•.za.bz
•.za.com

* These TLDs have not yet migrated onto CentralNic from their current backend RSP

Example Whois Records

Web-based Contact Form
For registrants who have not opted-in to have their email address displayed in Whois, a URL will be displayed in the “Registrant Email” field.
This URL will point to a web-based contact form which will allow third parties to send messages to the registrant of the domain. This form is hosted on the same platform that supports the port-43 and web-based Whois services.

The URLs will have the form:
https://<whois server name>/contact/<domain>/registrant
In most cases, the “<whois server name>” will be “whois.nic.<tld>”.
Parties who wish to send a message must agree to the service terms and conditions, complete a CAPTCHA, and prove their identity by clicking a link on an email sent to them before their message is sent to the registrant. They must complete this process each time they wish to send a message.

Impact on inter-registrar transfers
Registrars will no longer be able to use Whois reliably obtain the email address of a domain’s registrant in order to obtain the Form of Authorisation (FOA) required to submit a transfer request.
However, registrars can use EPP to perform an <info> command on the domain’s registrant contact, using the authInfo code of the domain. This will provide the email address which may be used to obtain the FOA.