NCUC statement on Australia GAC rep position regarding WHOIS

[Carlos Afonso]

To: Bruce Tonkin, Chair of the GNSO Council
From: Carlos A. Afonso, Chair, NCUC
cc: Glen de Saint Géry, GNSO Secretariat

Dear Bruce,

Regarding Australia's contribution to GNSO on the Whois issues recently 
submitted by the GAC representative Ashley Cross, the NCUC would like 
that the statement below be conveyed to him as an official inquiry from 
NCUC and copied to GNSO Council, as well as to all GAC members.

fraternal regards

--c.a.
Carlos A. Afonso
Chair, NCUC

====== beginning of NCUC statement =====

NCUC statement on Australia's contribution to GNSO on the Whois issues
(submitted to GNSO in April, 2006, by the GAC representative Ashley Cross)

1. We would like to recall the Australian national privacy principles 
(at http://www.privacy.gov.au/publications/npps01.html), which, under 
the heading "Use and disclosure", state: "An organisation must not use 
or disclose personal information about an individual for a purpose (the 
secondary purpose) other than the primary purpose of collection unless:

"(f) the organisation has reason to suspect that unlawful activity has 
been, is being or may be engaged in, and uses or discloses the personal 
information as a necessary part of its investigation of the matter or in 
reporting its concerns to relevant persons or authorities; or

(g) the use or disclosure is required or authorised by or under law; or

(h) the organisation reasonably believes that the use or disclosure is 
reasonably necessary for one or more of the following by or on behalf of 
an enforcement body:

(i) the prevention, detection, investigation, prosecution or punishment 
of criminal offences, breaches of a law imposing a penalty or sanction 
or breaches of a prescribed law;

(ii) the enforcement of laws relating to the confiscation of the 
proceeds of crime;

(iii) the protection of the public revenue;

(iv) the prevention, detection, investigation or remedying of seriously 
improper conduct or prescribed conduct;

(v) the preparation for, or conduct of, proceedings before any court or 
tribunal, or implementation of the orders of a court or
tribunal."

The Australian national privacy principles also state: "If an 
organisation uses or discloses personal information under
paragraph (h), it must make a written note of the use or disclosure."

So, at least in Australia, law enforcement activities are already 
covered under the privacy laws. What is not envisaged in the privacy 
laws is that the method to provide data to law enforcement should be via 
public publication.

There is literally no practical way to restrict the subsequent "use" of 
data once it is published in the public.

In light of the above, is the Australia GAC representative contradicting 
Australia's national policy or suggesting that its laws be changed?

2. Why is the Australia GAC representative supporting Formulation 2, 
when ".au" has a Whois policy and purpose that corresponds more closely 
to Formulation 1 than Formulation 2?

3. If GAC itself has not come to a unified position on Formulation 1 
versus Formulation 2 -- we are aware of governments who support 
Formulation 1 or who take a more pro-privacy position --, what relevance 
does the position of the Australia GAC representative have?

April 23rd, 2006

==== end of NCUC statement =====

-- 

Carlos A. Afonso
diretor de planejamento
Rits -- http://www.rits.org.br

********************************************
* Sacix -- distribuição Debian CDD Linux   *
* orientada a projetos de inclusão digital *
* com software livre e de código aberto,   *
* mantida pela Rits em colaboração com o   *
* Coletivo Digital.                        *
* Saiba mais: http://www.sacix.org.br      *
********************************************