EPDP policy issues

[Mueller, Milton L]

Kathy,
Thanks for your helpful intervention. I especially liked your discussion of this:

a)      Is a name “personal data”?
b)      Is an address “personal data”?
c)       Is a cell phone “personal data”?
d)      Is an email “personal data”?

Thinking about this problem – what is personal data – is what led me to start modifying my position on this issue. In a digital world there is no hard, well-defined nugget of data that is “personal” and everything else is not. Your “personality” is reflected in a lot of _activity_ on the net, and anyone who can gather and correlate all of those footprints knows a lot of personal info about you. True, your name and location, where you live, or your SSN or national identity number of drivers’ license, provide a stronger basis for putting all these correlations into an actionable identity. And that data is out there in a number of places, whois is relatively small part of that problem. A very small part, in fact

This is one of the reasons I don’t like Stephanie’s proposed approach (I will try to answer her message separately). Instead of a simple self-designation as legal or natural (company or individual), they want to try to force registrars into an elaborate process of eliminating personal data from the record. But anything can be personal data. OR some things that seem to be personal are not so personal. I think such a process is going to make registering a domain complicated and expensive and ultimately will not protect much. Worse, such a process will also be a camel’s nose under the tent process in which registrars assume more and more responsibility for determining the accuracy of registration data and for verifying the identity of everyone who registers.

Let’s keep it simple and under the registrants’ control. The more you involve third party rules and regulations in the registration process, the more complicated and expensive it becomes, and the privacy gains of such processes are miniscule, they are mostly hypothetical and theoretical.

So I think it is simplest to just say to the registrant, if you’re a company and don’t mind (or even want) your data to be published, check this box. If you’re not, or you do mind, don’t check it.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ncsg.is/pipermail/ncsg-discuss/attachments/20210425/9921c894/attachment.htm>