<HTML><FONT FACE=arial,helvetica><HTML><FONT SIZE=2 PTSIZE=10 FAMILY="SANSSERIF" FACE="Arial" LANG="0">Milton: I would be happy to submit the WHOIS Purpose statement -- it is a good one. Thank you for drafting it.<BR>
<BR>
All: Are there any future edits (concerns, etc) prior to submission? For those not familiar with the EU Privacy Directive, it is my understanding that ICANN has broad powers to define the purpose of its databases -- but will then will be bound closely to what it has set out. So this statement is very important to our pursuit of privacy.<BR>
<BR>
Regards, Kathy<BR>
<BR>
<BR>
<BLOCKQUOTE TYPE=CITE style="BORDER-LEFT: #0000ff 2px solid; MARGIN-LEFT: 5px; MARGIN-RIGHT: 0px; PADDING-LEFT: 5px"><BR>
==========<BR>
<BR>
Statement of the NCUC on WHOIS Purpose<BR>
July 21, 2005<BR>
<BR>
Task 1 asks us to "Define the purpose of the WHOIS service in the<BR>
context of ICANN's mission and relevant core values, international and<BR>
national laws protecting privacy of natural persons, international and<BR>
national laws that relate specifically to the WHOIS service, and the<BR>
changing nature of Registered Name Holders."<BR>
<BR>
A. The importance of defining "purpose"<BR>
Regarding international and national privacy laws, NCUC notes that it<BR>
is well-established in data protection law that the purpose of data and<BR>
data collection processes must be well-defined before policies regarding<BR>
data collection, use and access can be established. The need for an<BR>
explicit, well-defined purpose is meant to protect data subjects from<BR>
abuse by either the data collectors or third parties using the data. A<BR>
definition of purpose is intended to impose strict constraints on the<BR>
collection and use of contact data. A specified purpose determines what<BR>
data elements should be collected, and therefore actively prevents<BR>
collection of any data that is not clearly necessary for that purpose.<BR>
Furthermore, a defined purpose helps to ensure that data is used only<BR>
for the specified purposes, preventing uses that are different from or<BR>
incompatible with the purpose giving rise to their collection. Finally,<BR>
sound data protection principles hold that data subjects must be<BR>
informed of the purpose for which the Data is intended and whether and<BR>
under what conditions the Data is likely to be passed to a third party.<BR>
<BR>
B. WHOIS and ICANN's mission and core values<BR>
Regarding ICANN's mission and relevant core values, we note that<BR>
ICANN's mission is primarily technical: "to coordinate, at the<BR>
overall level, the global Internet's systems of unique identifiers, and<BR>
in particular to ensure the stable and secure operation of the<BR>
Internet's unique identifier systems." In enumerating ICANN's core<BR>
values, we find that the first three are most relevant to a discussion<BR>
of WHOIS and its purpose:<BR>
<BR>
1. Preserving and enhancing the operational stability, reliability,<BR>
security, and global interoperability of the Internet.<BR>
<BR>
2. Respecting the creativity, innovation, and flow of information made<BR>
possible by the Internet by limiting ICANN's activities to those matters<BR>
within ICANN's mission requiring or significantly benefiting from global<BR>
coordination.<BR>
<BR>
3. To the extent feasible and appropriate, delegating coordination<BR>
functions to or recognizing the policy role of other responsible<BR>
entities that reflect the interests of affected parties<BR>
<BR>
The original purpose of the WHOIS protocol, when the Internet was an<BR>
experimental network, was the identification of and provision of contact<BR>
information for domain administrators for purposes of solving technical<BR>
problems. Speaking at the "Freedom 2.0" conference held by the<BR>
Electronic Privacy Information Center in May 2004, Vinton G. Cerf, the<BR>
Chairman of ICANN's Board, confirmed directly that the original<BR>
purpose of WHOIS was indeed purely technical. This original purpose is<BR>
consistent with the plain language of ICANN's current mission and is<BR>
further supported by core value #1, which addresses exclusively<BR>
technical values such as stability, reliability, security and<BR>
interoperability.<BR>
<BR>
We note also that Core Values #2 and #3 mandate that ICANN limit its<BR>
activities to a minimal set of areas requiring global technical<BR>
coordination. Thus, even though WHOIS data may be useful for a broad<BR>
variety of purposes, uses and users, ICANN's core values require that<BR>
it not embrace those purposes and activities just because it can, or<BR>
because interested parties find it convenient. ICANN must limit its<BR>
activities to matters within its mission and recognize and defer to the<BR>
policy role of other responsible entities.<BR>
<BR>
C. Proposed definition of purpose<BR>
NCUC proposes the following definition of purpose for the WHOIS<BR>
service:<BR>
<BR>
The purpose of the WHOIS is to provide to third parties an accurate and<BR>
authoritative link between a domain name and a responsive party who can<BR>
either act to resolve, or reliably pass information to those who can<BR>
resolve technical and administrative problems associated with or caused<BR>
by the domain.<BR>
<BR>
By "technical problems" we mean problems affecting the operational<BR>
stability, reliability, security, and global interoperability of the<BR>
Internet. By "administrative problems" we mean issues regarding<BR>
domain transfers and problems regarding who is responsible for a domain.<BR>
<BR>
<BR>
D. Excluded or invalid purposes<BR>
It is important to also identify purposes that are inconsistent with<BR>
ICANN's stated mission and core values.<BR>
<BR>
First, WHOIS is not designed to be a global data mining operation with<BR>
completely unlimited access to all registrant data by any Internet user<BR>
for any purpose, including marketing.<BR>
<BR>
Second, the purpose of WHOIS is not to support law enforcement or other<BR>
self-policing interests. National law enforcement is unrelated to the<BR>
basic goals of the WHOIS service and of ICANN's global coordinating<BR>
mission. We have no objection to the use of WHOIS by law enforcement but<BR>
a WHOIS service is one of many tools law enforcement may use to gain<BR>
access to more detailed personal data consistent with existing due<BR>
process mechanisms. Such an ancillary use should not expose the data to<BR>
uses and abuses incompatible with the primary purpose of WHOIS as stated<BR>
above.<BR>
<BR>
Third, the purpose of WHOIS is not to expand the surveillance powers<BR>
given to law enforcement under law, or to bypass the protections and<BR>
limitations imposed by sovereign governments to prevent the abuse and<BR>
misuse of personal data, even by law enforcement. Law enforcement<BR>
agencies can obtain wiretap authorizations, subpoena specific subscriber<BR>
records through Internet service providers, or learn about a domain name<BR>
registrant's identity information through subpoenas of registrar<BR>
records.<BR>
<BR>
Finally, the purpose of WHOIS data is not to facilitate legal or other<BR>
kinds of retribution by those interested in pursuing companies and<BR>
individuals who criticize and compete against them.<BR>
</BLOCKQUOTE><BR>
<BR>
</FONT></HTML>