ICANN request to preserve WHOIS data referred to German appeal court

The madness continues…

The Internet Corporation for Assigned Names and Numbers (ICANN) was informed yesterday that the Regional Court in Bonn, Germany, has decided to refer to the Higher Regional Court in Cologne, Germany, the injunction proceedings ICANN initiated against EPAG, a Germany-based, ICANN-accredited registrar that is part of the Tucows Group. ICANN filed the injunction proceedings seeking assistance in interpreting the European Union’s General Data Protection Regulation (GDPR) in order to protect the data collected in WHOIS.

In its initial ruling, the Regional Court determined that it would not issue an injunction against EPAG. ICANN appealed this decision. Upon receipt of the appeal, the Regional Court exercised its option to re-evaluate its decision instead of immediately forwarding the matter to the Higher Regional Court to address the appeal.

In referring the matter to the Higher Regional Court in Cologne, the Regional Court did not change its original determination not to issue an injunction against EPAG. The Regional Court also rejected the alternative claims submitted by EPAG in recent court filings. Notably, the Regional Court issued this second ruling without consideration of the additional court filings submitted earlier this week by ICANN and ICANN’s Intellectual Property Constituency. Those filings will be part of the record to be transferred to the Higher Regional Court for the appeal.

ICANN will continue to pursue this matter as part of its public interest role in coordinating a decentralized global WHOIS for the generic top-level domain system. ICANN awaits further direction from the Higher Regional Court on next steps, which could include referring the matter to the European Court of Justice, issuing a decision based upon the papers already submitted, requesting additional briefings or scheduling a hearing with the parties.

ICANN has created a mess because of their incompetence for formulate a GDPR solution in time and execute it. These proceedings is just an excuse fro ICANN to not do anything before there is an outcome. The outcome is bound to not be meaningful to anyone. This is just a waste of time and a waste of ICANN’s funds (i.e. our money) in legal fees.

Some background from ICANN about this matter:

On 25 May 2018, ICANN filed the injunction proceedings against EPAG. ICANN asked the Court for assistance in interpreting the GDPR in an effort to protect the data collected in WHOIS. ICANN sought a court ruling to ensure the continued collection of all WHOIS data. The intent was to assure that all such data remains available to parties that demonstrate a legitimate purpose to access it, and to seek clarification that under the GDPR, ICANN may continue to require such collection.

ICANN filed the proceedings because EPAG had informed ICANN that as of 25 May 2018, it would no longer collect administrative and technical contact information when it sells new domain name registrations. EPAG believes collection of that particular data would violate the GDPR. ICANN’s contract with EPAG requires that information to be collected.

EPAG is one of over 2,500 registrars and registries that help ICANN maintain the global information resource of the WHOIS system. ICANN is not seeking to have its contracted parties violate the law. Put simply, EPAG’s position spotlights a disagreement with ICANN and others as to how the GDPR should be interpreted.

On 30 May 2018, the Regional Court determined that it would not issue an injunction against EPAG. In rejecting the injunctive relief, the Court ruled that it would not require EPAG to collect the administrative and technical data for new registrations. However, the Court did not indicate in its ruling that collecting such data would be a violation of the GDPR. Rather, the Court said that the collection of the domain name registrant data should suffice in order to safeguard against misuse in connection with the domain name (such as criminal activity, infringement, or security problems).

The Court reasoned that because it is possible for a registrant to provide the same data elements for the registrant as for the administrative and technical contacts, ICANN did not demonstrate that it is necessary to collect additional data elements for those contacts. The Court also noted that a registrant could consent and provide administrative and technical contact data at its discretion.

On 13 June 2018, ICANN appealed the Regional Court’s ruling to the Higher Regional Court of Cologne, Germany, and again asked for an injunction that would require EPAG to reinstate the collection of all WHOIS data required under EPAG’s Registrar Accreditation Agreement with ICANN.

In addition to the court proceedings, ICANN is continuing to pursue ongoing discussions with the European Commission and the European Data Protection Board to gain further clarification of the GDPR as it relates to the integrity of WHOIS services.