Latest step along the long road to accessing domain registration (WHOIS) data

ICANN has opened a public comment on the Initial Report of the Phase 2 Expedited Policy Development Process (EPDP) on the Temporary Specification for gTLD Registration Data Team, the team tasked with developing a consensus policy for the treatment of WHOIS data in the light of GDPR.

The EPDP Phase 2 Draft Report represents an important and welcome step towards standardised and predictable access to registrant data, but there is still much to be done.

Disclosure decision stays with the registrar/registry

Many brand owners and their representatives would ideally like a return to the personal data elements of registration data being fully and automatically available for those wanting to enforce their IP rights. The EPDP Phase 2 draft recommendations do not deliver that, and it is not a scenario that is likely to return. The proposed system does seek to provide automation, where possible – i.e. in the receipt, authentication and transmission of SSAD (System for Standardized Access/Disclosure) requests – but the decision on whether to disclose the data will rest with and be made by the individual Contracted Party (generally the registrar).

This seems an inevitability, given the responses to date from the data protection authorities about where the liability rests, and lies at the heart of Contracted Party determination that if they will be on the hook as the controller for a wrongful disclosure they should also be the ones making the decision. Whilst understandable, this does mean that even with the efforts to bring standardisation to requests, the format of responses, and the factors to be taken into account in making the balancing assessment whether to disclose, there will inevitably not be the hoped-for predictable outcome for the requesting party.

Automated handling for URS/UDRP service provider requests

There are some efforts to fully automate some categories of request, that is both the validation of the incoming requests for disclosure and the disclosure decision itself. There is good news for brand owners, in that requests from URS/UDRP service providers are envisaged to be fully automated from the outset, along with requests from local enforcement authorities within an applicable jurisdiction, but this is nevertheless still very narrow. The Initial Report notes that the EPDP will be considering whether other categories could be fully automated from the outset, and the proposal is for there to be further review as the system beds-in.  Members of the working group have proposed various other possible request-types that might be considered for fully-automated disclosure, including a scenario involving “clear-cut” trademark claims (such as a match to a TMCH-recorded trademark), but there seems little appetite for this across the wider working group. It remains to be seen whether any of these additional categories will be adopted from the outset, or at all.

Trevor Little at World Trademark Review published an article on this topic, and includes my comments.

WTA subscribers can access it here (paywall).