back to article Who had ICANN suing a German registrar over GDPR and Whois? Congrats, it's happening

A fight over private information and the internet's domain name system is heading to a German court, in a proxy battle between European legislators and American intellectual property lawyers. On Friday – the same day that new European GDPR privacy legislation took effect – DNS overseer and US corporation ICANN filed a lawsuit …

Anonymous Coward

Merica f*ck yeah

Where any innovation in anything is stamped on in the name of continued business.

"you want us to reconsider our 20 year old policies in light of the changes to the internet... don't you understand this is america?"

36
5
Silver badge

Re: Merica f*ck yeah

"Fundamentally, ICANN is arguing that there are exceptions in GDPR that say data collection is allowed when it is a "necessity for the performance of a contract" – and the Whois clause in its contract qualifies for such a protection."

Data collection might be. Publishing it without explicit opt in permission isn't.

30
2

This post has been deleted by its author

Silver badge

Re: Merica f*ck yeah

" Publishing it without explicit opt in permission isn't."

ITYM Publishing personal data

A lot of registrations use role accounts and those aren't personal data.

The problem is that domain registrations (and WHOIS) requires actual legally serviceable registrant addresses (ie, ones that can be served with legal paperwork in the event of shit hitting fan) and the tech contacts are supposed to be there to ensure that someone can be contacted to try and shut the mess down if something goes nuts.

ICANN hasn't been adequately enforcing accuracy requirements for 15-20 years (meaning that scammers have registered bogus addresses for kid porn domains that have had the wrong doors kicked in, etc etc) and scammers have spammed the living hell out of published email addresses, rendering the tech addresses useless/encouraging people to obfuscate or remove contact details.

At this point, trying to argue that collecting the data is necessary falls flat on its face over the kerbstone of historic indifference to its accuracy and I'm fairly sure that german courts will point that out.

Harder lines taken against network abuse and prioritising that over gross revenue maximisation would have prevented a lot of the issues that's got ICANN in court today. As it is, IMHO their actions have pretty much ensured that they won't prevail. (IANAL, YMMV, HAND)

23
0
Silver badge

Re: Merica f*ck yeah

"At this point, trying to argue that collecting the data is necessary falls flat on its face over the kerbstone of historic indifference to its accuracy and I'm fairly sure that german courts will point that out."

Sort of. The defendants might well point it out to the courts and the court would then note it in the judgement. Most likely the defence will point out that contract terms can't override legislation and here's a sling in which the court can hand ICANN its arse.

1
0
Silver badge

Re: Merica f*ck yeah

"The defendants might well point it out to the courts and the court would then note it in the judgement."

Yup - and from that point forward, even if ICANN tried to bring cases in non-GDPR jurisdictions they'd fail.

You're absolutely right that contracts can't trump law and that would be the first plank of any defence, however pointing out that ICANN haven't historically been bothered about enforcing accuracy makes a mockery of their demands now - and that's a pretty good supporting plank.

1
0
Silver badge
Facepalm

U.S.A. U.S.A. U.S.A!

Remeber kids the internet is not yours or mine, or everyone's.... it's uncle Sam's so their laws and rules. And if you don't like it, tough.

What's that? Fines for silly amounts of money from somewhere that isn't the US? Sod em we'll just not bother paying..

Is that about the long and the short of how this is going to be for the next few years?

Time to invent some subscription system for popcorni think..

24
5
Silver badge

I hope ICANN loses completely.

I hope the German court finds that the ICANN contracts require the contracted parties to do illegal things & thus are Null&Void. Then when ICANN appeals (and appeals & appeals & appeals) it goes straight to the top court where it's summarily told in no uncertain terms "Tough shit, you lose, go fuck yourselves".

Because ICANN has thumbed it's nose at everyone else's laws, ignored the requirements that were made policy over two years ago, has tried to weasel it's way out of doing it's damned job, so I hope the courts nail 'em to a wall & use 'em as a dart board.

ICANN has told the rest of the world "fuck you" for far too long; it's about time the rest of the world bends it over a table & does obscene things to it in retribution.

66
3
Len

Re: I hope ICANN loses completely.

I just wonder how long ICANN still exists in its current form. It will probably be replaced by something else (sitting under the UN and based in Geneva?) or slowly rendered irrelevant because the stopgaps to circumvent its issues keep chipping away at ICANN's authority until the collection of stopgaps is better organised than ICANN itself.

26
1
Silver badge

Re: I hope ICANN loses completely.

"Tough shit, you lose, go fuck yourselves".

I'd love to see the German word for that. Let's hope they use the "wrap text" format.

34
0
Silver badge

Re: I hope ICANN loses completely.

That would be a bad outcome, if you'd like the Internet to run smoothly. And it probably won't happen - ICANN isn't actually planning to violate GDPR by publishing private information. And there isn't redundancy in requesting three contacts: owner (the person ultimately responsible), admin (the person to pay any fees involved), technical (the person to fix operational issues).

ICANN has been arrogant once in a while, but I don't think they've thumbed their nose at anybody's laws. As a corporation, they're bound by the law of their state of incorporation, which happens to be ca.us, but so is every corporation

3
40
Silver badge

It will probably be replaced by something else...

Let's hope not, above all not by the ITU. I promise you, that would be a hundred times worse.

What does "stopgaps to circumvent its issues" refer to, please?

4
2

Re: I hope ICANN loses completely.

"...I don't think they've thumbed their nose at anybody's laws."

They have. Since 2003 actually, when they were first told they were breaking the data protection laws as they existed then.

31
1
Silver badge

Re: I hope ICANN loses completely.

Backdated.

This was always wrong. From the beginning.

3
0
Silver badge
Thumb Up

Re: probably be replaced by something else

The UN took over oversight of the ITU created in the 1850s,

There are issues with UN and ITU, but it was USA arrogance that DNS, IP assignments and Domain registration wasn't ITU from the beginning. Long before Web was added to the Internet. Possibly as soon as Arpanet was available outside Government & Universities.

4
2
Anonymous Coward

Re: I hope ICANN loses completely.

"As a corporation, they're bound by the law of their state of incorporation"

Wuuuuuut????? Err - no, not at all. As anybody, corporation or not, they're bound by the laws of the place they're operating in. Ie, they're doing business in the US, they follow US laws, they're operating in the EU, they follow EU laws.

Or to take a different example, where the US is not the reference - do you believe that Chinese companies operating in the US follow Chinese laws only?

25
0

Re: I hope ICANN loses completely.

@The Nazz

I think you'll find it's roughly

"harte Scheiße, du verlierst, geh dich ficken"

Sadly it's not a single long word as you were hoping. :(

4
0
aks

Re: probably be replaced by something else

USA arrogance now being replaced by EU arrogance and attempting to export their regulations world-wide.

2
8
Bronze badge

Re: I hope ICANN loses completely.

That may be the litteral translation, but it doesnt have the right tone or severity of language, I hope a native german speaker can chip in, but rules of good etiquete prevent me from exploring the depths of my german vocab for a better phrasing.

0
0
Anonymous Coward

Re: I hope ICANN loses completely.

But, logically, if the contract is declared null and void, ICANN will just cancel all the domains registered via that registrar and they will be up for anyone to buy, because there will be no contract any more.

3
0
Silver badge

Re: probably be replaced by something else

EU arrogance?

The German registrar is operating in the EU and is therefore obliged to abide by EU rules.

ICANN want them to NOT do that. Is that EU Arrogance?

5
0
Silver badge

Re: I hope ICANN loses completely.

@ the Nazz: the closest in German, when it comes to intent, would be:

Gute Krokodilsträne....aber jetzt.... Bück dich!

0
0
Silver badge

Re: probably be replaced by something else

"USA arrogance now being replaced by EU arrogance and attempting to export their regulations world-wide."

...except in this case, it's a standard of regulation many people in the USA would like, but their corporate overlords don't want it (and pay their politicians to say so for them)

4
1
Silver badge
Coat

Re: I hope ICANN loses completely.

Unfortunately not one word...

"Viel Glück, du verlierst, geh und fick euch selbst"

Mines the one with the Hungarian Phrasebook in the pocket...

0
0
Silver badge

Re: probably be replaced by something else

"it was USA arrogance that DNS, IP assignments and Domain registration wasn't ITU from the beginning. "

Huh?

The ITU didn't _want_ to be involved in any of this stuff until relatively recently.

In any case, ICANN has exactly as much power as people choose to give it. There have been alternative DNS systems and roots setup but they've all fallen over - largely due to ICANN being the monopoly, but secondarily due to ICANN playing 9000 pound gorilla and deliberately rolling out TLDs which conflicted with those of the alternates (they could and should have been charged with anti-competitive behaviour over that one and the decision to do it was _very_ deliberate)

0
0
Silver badge

Re: I hope ICANN loses completely.

"Mines the one with the Hungarian Phrasebook in the pocket..."

And the eels in another?

0
0
Silver badge

Should result in summary judgement...

You can't contractually require anyone to break the law and the law is pretty damn clear from here, in America.

38
0
Silver badge

Re: Should result in summary judgement...

What if the law itself explicitly says that "you can contractually require people to break this particular law"? Because that's basically ICANN's case.

2
5

Re: Should result in summary judgement...

The exception clause applies to the relationship between the owner of the data and the entity providing a service to the data owner.

In other words, if I apply to a bank for credit they can acquire, store and retain data necessary for the provision of that credit. If that bank has a separate contract with an advertiser to provide email addresses of anyone applying for credit then the necessity exception doesn't apply there. And contract terms can never override law. Any term in the bank to advertiser contract that breaks the law becomes void.

So a registrar can collect data necessary for the provision of service to the end user but their contract to publish that data in whois is void as it compels them to break the law. That is exactly the position of EPGA and I would be very surprised if they do not prevail.

If ICANN are pressing ahead with this challenge then one of two things has happened. Their lawyers know it will fail but they get paid anyway so what the hell, lets bilk our client (likely), or their lawyers think the law is worded sloppily and they can twist it to cover the third party contract which was actually what you were hinting it. That is less likely but still possible.

22
0
Silver badge

Re: Should result in summary judgement...

That's well-established, not just GDPR. It's explicit in GDPR, and lawyers like "explicit", but if you didn't have something like that it would be a breach for somebody to put your name and address on a letter they post to you. I've had GDPR opt-in emails warning me that I won't get any notifications of dispatch if I don't opt-in. Which means they're saying they can't fulfil a contract. without an opt-in to everything.

How dodgy is that? A US service gave me a web page with default-on permissions for over 300 companies they share my data with. I tried to count them, as I clicked to "off", but lost track at over 270. As the Good Book says:

"Three shall be the number thou shalt count, and the number of the counting shall be three. Four shalt thou not count, neither count thou two, excepting that thou then proceed to three. Five is right out."

12
0
Silver badge

Re: Should result in summary judgement...

"if I apply to a bank for credit they can acquire, store and retain data necessary for the provision of that credit. If that bank has a separate contract with an advertiser to provide email addresses of anyone applying for credit then the necessity exception doesn't apply there."

Which is what Experian and friends have been hoping you wouldn't notice for a long time.

Up until GDPR the only way to stop them selling your data to advertisers was an explicit DPA section 11 notice and they used all kinds of scare tactics to dissuade those including "this may affect your credit rating" (which they also used to frighten people into not being on the closed electoral register)

These "credit rating agencies" actually make more money selling your data to marketers than they do from their supposed core business, so it's going to be interesting to see how many prosecutions result from GDPR breaches as they scramble to make up lost income by ignoring the laws.

11
0
Silver badge

Re: Should result in summary judgement...

"If ICANN are pressing ahead with this challenge then one of two things has happened."

Past experience of dealing with the people involved is that they make up facts to suit themselves as they go along and don't take kindly to 3rd parties showing evidence that they were saying the exact opposite some months back (or made the exact statements they denied knowledge of, etc)

Trump may be a sociopathic delusional con artist but the reason he's managed to get to that position is that this kind of personality has managed to find itself in charge of increasingly large tracts of business during the last 40 years.

I wouldn't be at all surprised if their plan is to bring up the Chewbacca defense.

7
1
aks

Re: Should result in summary judgement...

Gathering data and making it available to others are two different issues.

Making it available to the interested party for them to challenge and correct is sensible. Making it public is not.

I wonder whether the UK government's policy of making the electoral register available is covered by GDPR. Until now, it has been made available to anybody who pays for it, after mandating its collection under threat of severe penalty to the individual if they refuse to supply it.

2
1

Re: Should result in summary judgement...

"I wonder whether the UK government's policy of making the electoral register available is covered by GDPR"

It's not a government policy, it's a national law.

0
0

At the heart of the issue is the fact that the Whois service was developed 20 years ago...

https://tools.ietf.org/html/rfc812

https://xkcd.com/1995

7
2
Bronze badge

Re: At the heart of the issue is the fact that the Whois service was developed 20 years ago...

RFC 812 was obseleted twice, RFC3912 (the current whois Spec Published Sept 2004) states

The WHOIS protocol has no provisions for strong security. WHOIS lacks mechanisms for access control, Integrity, and confidentiality. Accordingly, WHOIS-based services should only be used for information which is non-sensitive and intended to be accessible to everyone. The absence of such security mechanisms means this protocol would not normally be acceptable to the IETF at the time of this writing.

2
0
Len
Holmes

Quite smart to do it in Germany

Considering Germany has probably some of the strictest privacy laws in the EU (apparently a lot of criticism of the GDPR in Germany is that it doesn't go far enough) it is quite clever to start this case in Germany. If ICANN's position holds up in a German court it will likely hold up in any EU court and perhaps even the CJEU.

20
1
Silver badge

Re: Quite smart to do it in Germany

No, it's foolish because it's a slam dunk instant fail in Germany.

ICANN will lose, instantly with no appeal.

In other EU countries they might have stood a chance, but Germany have suffered the consequences of unnecessary data collection. Millions dead leaves a long shadow.

12
0
Silver badge

Re: Quite smart to do it in Germany

"but Germany have suffered the consequences of unnecessary data collection. Millions dead leaves a long shadow."

It does make me wonder if the ICANN people don't know their history and were working to the stereotype image of Germans being sticklers for the rules/law and hoped to bend the interpretation in a logical sounding way.

1
0

GDPR, by having the audacity to imply that humans are not a commodity to be bought and sold like so much grain, may have committed an act of war in the eyes of the internet's corporate powers.

29
0
Anonymous Coward

ICANN not understand how you wrote this article !!!???

BBC are reporting on ICANN and their problems with an article that completely misses the issues and frames them as the victims !!!!

http://www.bbc.co.uk/news/technology-44290019

Must have a friend at the BBC or more likely yet, someone else who has been bamboozled by ICANN's version of reality !!!???

No wonder the BBC is attacked on all sides when it cannot be bothered to get the facts straight before publishing an article.

35
0
Anonymous Coward

Ambulance Chasing Intellectual Property Lawyers

Organize their own GDPR False-Flag / Black-Ops tea-party.... This is just sick reporting... But you can bet some official has already bought it, and is phoning the EU right now to complain: 'won't someone think of the poor police and journalists' letting hackers simply escape. Talk about Fake-News reporting:

"Whois... used by the police and journalists to check the legitimacy of websites... Police will be robbed of ready access to vital data drastically impeding their efforts shut down illicit activity. The regulatory rubric EU has created will make it harder than ever to catch computer hackers"

3
0
Anonymous Coward

Re: ICANN not understand how you wrote this article !!!???

If you are being attacked by all sides surely you're doing something right.

The article could also just be ICANN's viewpoint. We might not agree with it but BBC is supposed to be neutral. Supposedly.

2
4
Silver badge

Re: ICANN not understand how you wrote this article !!!???

BBC are reporting on ICANN and their problems with an article that completely misses the issues and frames them as the victims !!!!

To be fair, the BBC news site is edited down to such a bare minimum of facts and seems to be written with the intent of being understandable to anyone with an I.Q in the single digit range it's not a surprise it misses most pertinent facts or is vaguely anywhere close to the truth and not new for the fluffy mushroom heads and those that have dodgy living arrangements with seven bearded mining little folk.

7
1

Re: ICANN not understand how you wrote this article !!!???

Thanks for that link. I can't remember reading a lazier piece of tech journalism than that. In fact, for all the good it will do, I'm going to write to them about it.

6
0
Silver badge

Re: ICANN not understand how you wrote this article !!!???

I have my doubts about the BBC on a lot of things, these days, but I fear it is a growing awareness of the crapitude of news media, rather than any change at the BBC.

And when it is the frothing anti-EU loonies running the country, I find it hard to blame the BBC for being a bit circumspect.

(The other angle is that, on technical issues, it only takes one journalist to skew things; no names, but there are people writing for The Register who have an obvious political bias on some issues.)

4
1
Silver badge

Re: ICANN not understand how you wrote this article !!!???

"BBC are reporting on ICANN and their problems with an article that completely misses the issues and frames them as the victims !!!!"

That looks like a lightly regurgitated press release, not actual journalism.

9
0
Silver badge

Re: ICANN not understand how you wrote this article !!!???

That's disgracefully one sided.

2
0
Silver badge

Re: ICANN not understand how you wrote this article !!!???

Link to complain about a BBC news article.

http://www.bbc.co.uk/news/contact-us/editorial

2
0
Silver badge

Re: ICANN not understand how you wrote this article !!!???

"That looks like a lightly regurgitated press release, not actual journalism."

You mean news outlets* are supposed to do anything beyond regurgitating press releases in the 21st century? What a novel idea...! Has anyone told them...?

* Present company excepted. Ish.

2
0

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Forums

Biting the hand that feeds IT © 1998–2018