2013 RAA is illegal, says EU privacy watchdog
Marc Perkel
marc at CHURCHOFREALITY.ORG
Mon Jul 8 11:27:22 EEST 2013
Just passing this on from Cindy Cohn - EFF lawyer
-------- Original Message --------
Subject: Re: [Lawyers] Need a plaintiff?
Date: Mon, 8 Jul 2013 09:25:15 -0700
From: Cindy Cohn <cindy at eff.org>
To: Marc Perkel <marc at perkel.com>
Great. did you see this:
The letter goes on to sharply criticize ICANN for allowing itself to be
used by governments (and big copyright interests) to circumvent their
own legislative processes. It says:
The fact that these data may be useful for law enforcement
(including copyright enforcement by private parties) does not equal
a necessity to retain these data after termination of the contract.
…
the Working Party reiterates its strong objection to the
introduction of data retention by means of a contract issued by a
private corporation in order to facilitate (public) law enforcement.
2013 RAA is illegal, says EU privacy watchdog
<http://domainincite.com/13645-2013-raa-is-illegal-says-eu-privacy-watchdog>
Kevin Murphy <http://domainincite.com/about>, July 8, 2013, Domain
Registrars <http://domainincite.com/category/domain-registrars>
*European privacy regulators have slammed the new 2013 Registrar
Accreditation Agreement, saying it would be illegal for registrars based
in the EU to comply with it.*
The Article 29 Working Party, which comprises privacy regulators from
the 27 European Union nations, had harsh words for the part of the
contract that requires registrars to store data about registrants for
two years after their domains expire.
In a letter (pdf
<http://domainincite.com/docs/20130606_Letter_to_ICANN.pdf>) to ICANN
last month, Article 29 states plainly that such provisions would be
illegal in the EU:
The fact that these personal data can be useful for law enforcement
does not legitimise the retention of these personal data after
termination of the contract. Because there is no legal ground for
the data processing, the proposed data retention requirement
violates data protection law in Europe.
The 2013 RAA allows any registrar to opt out of the data retention
provisions if it can prove that to comply would be illegal its own
jurisdiction.
The Article 29 letter has been sent to act as blanket proof of this for
all EU-based registrars, but it’s not yet clear if ICANN will treat it
as such.
The letter goes on to sharply criticize ICANN for allowing itself to be
used by governments (and big copyright interests) to circumvent their
own legislative processes. It says:
The fact that these data may be useful for law enforcement
(including copyright enforcement by private parties) does not equal
a necessity to retain these data after termination of the contract.
…
the Working Party reiterates its strong objection to the
introduction of data retention by means of a contract issued by a
private corporation in order to facilitate (public) law enforcement.
If there is a pressing social need for specific collections of
personal data to be available for law enforcement, and the proposed
data retention is proportionate to the legitimate aim pursued, it is
up to national governments to introduce legislation
So why is ICANN trying to get many of its registrars to break the law?
While it’s tempting to follow the Article 29 WP’s reasoning and blame
law enforcement agencies and the Governmental Advisory Committee,
whichpushed
<http://domainincite.com/6630-gac-slams-registrars-over-silly-crime-domain-moves> for
the new RAA to be created in the first place, the illegal data retention
provisions appear to be entirely ICANN’s handiwork.
The original law enforcement demands (pdf
<http://domainincite.com/docs/LEA%20Recommendations.pdf>) say registrars
should “securely collect and store” data about registrants, but there’s
no mention of the period for which it should be stored.
And while the GAC has expressly supported the LEA recommendations since
2010, it has always said that ICANN should comply with privacy laws in
their implementation.
The GAC does not appear to have added any of its own recommendations
relating to data retention.
ICANN can’t claim it was unaware that the new RAA might be illegal for
some registrars either. The Article 29 WP told it so
<http://domainincite.com/10606-european-privacy-watchdog-says-icanns-whois-demands-are-unlawful> last
September, causing ICANN to introduce the idea of exemptions
<http://domainincite.com/10734-icann-says-eu-registrars-could-be-exempt-from-stringent-new-whois-rules>.
However, the European Commission’s GAC representative then seemed to
dismiss
<http://domainincite.com/10734-icann-says-eu-registrars-could-be-exempt-from-stringent-new-whois-rules> the
WP’s concerns during ICANN’s public meeting in Toronto last October.
Perhaps ICANN was justifiably confused by these mixed messages.
According to Michele Neylon, chair of the Registrars Stakeholder Group,
it has yet to respond to European registrars’ inquiries about the
Article 29 letter, which was sent June 6.
“We hope that ICANN staff will take the letter into consideration, as it
is clear that the data protection authorities do not want create extra
work either for themselves or for registrars,” Neylon said.
“For European registrars, and non-European registrars with a customer
base in the EU, we look forward to ICANN staff providing us with clarity
on how we can deal with this matter and respect EU and national law,” he
said.
On Jul 8, 2013, at 9:14 AM, Marc Perkel <marc at perkel.com
<mailto:marc at perkel.com>> wrote:
> Good luck with that. I'm heading to South Africa on Friday to ICANN 47
> meeting. Robin Gross has me filling in.
>
> On 7/8/2013 9:06 AM, Cindy Cohn wrote:
>> Hi Marc,
>>
>> I'm wrangling plaintiffs. Thanks for the offer but we've got a good
>> list now and I think we'll stick with it.
>>
>> BTW, the order doesn't appear to reach Verizon wireless, which is a
>> joint venture with Vodaphone, only Verizon landlines. We don't think
>> that's all they are getting, but it doesn't make you any different
>> than several other groups we already have.
>>
>> And the case is already pretty busy and complex without adding a new
>> legal argument into the mix.
>>
>> Cindy
>>
>>>
>>>> *From: *Marc Perkel <marc at perkel.com <mailto:marc at perkel.com>>
>>>> *Subject: **Need a plaintiff?*
>>>> *Date: *July 7, 2013 10:20:37 PM PDT
>>>> *To: *Cindy Cohn <cindy at eff.org <mailto:cindy at eff.org>>
>>>> *Cc: *Shari Steele <ssteele at eff.org <mailto:ssteele at eff.org>>
>>>>
>>>> Don't know if you are planning to sue Verizon over NSA but if you
>>>> need a plaintiff I'm available. What's unique about me is that I'm
>>>> the founder of the Church of Reality. The Religious Freedom
>>>> Restoration Act sets the standard of review to strict scrutiny,
>>>> which is probably higher than other plaintiffs. And - I have "The
>>>> Sacred Principle of Personal Privacy" as one of our sacred
>>>> principles. And I'm a Verizon cell phone customer.
>>>>
>>>> Interested?
>>>>
>>>>
>>>>
>>>
>>
>>
>> *******************************************************
>> Cindy Cohn ----Cindy at eff.org <mailto:Cindy at eff.org>
>> Legal Director----www.eff.org <http://www.eff.org/>
>> Electronic Frontier Foundation
>> 815 Eddy Street
>> San Francisco, CA 94109
>> (415) 436-9333 x108
>> (415) 436-9993 (fax)
>> PLEASE NOTE OUR NEW ADDRESS as of April 12, 2013
>>
>>
>> Join EFF! https://supporters.eff.org/donate
>>
>>
>>
>>
>>
>>
>>
>
*******************************************************
Cindy Cohn ----Cindy at eff.org <mailto:Cindy at eff.org>
Legal Director----www.eff.org <http://www.eff.org/>
Electronic Frontier Foundation
815 Eddy Street
San Francisco, CA 94109
(415) 436-9333 x108
(415) 436-9993 (fax)
PLEASE NOTE OUR NEW ADDRESS as of April 12, 2013
Join EFF! https://supporters.eff.org/donate
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ncsg.is/pipermail/ncsg-discuss/attachments/20130708/1313bf5d/attachment.htm>
More information about the Ncsg-discuss
mailing list