European Commission proposal on accuracy of registration data raises numerous questions
Proposed new EU directive on the security of network and information systems is unclear in many respects
On 16 December 2020, the European Commission published a draft of its proposal for a revised Directive on Security of Network and Information Systems. Known as NIS2, the proposed directive would replace the existing NIS Directive, introduced in 2016. Although the proposal is expected to undergo substantial amendment before becoming law, the directive seems likely to have significant implications for SIDN as operator of the .nl domain, and for the providers of .nl domain name registration services, our registrars. It is therefore well worth taking a closer look.
Implemented in the Netherlands by the Wbni
The proposed directive has numerous noteworthy aspects. The current NIS was incorporated into Dutch law in 2018 by the Networks and Information Systems (Security) Act, abbreviated in Dutch to Wbni. The Wbni provides the legal basis for SIDN's designation as an 'operator of essential services' in relation to our .nl activities, and thus for supervision by the Radiocommunications Agency (nowadays 'Dutch Authority for Digital Infrastructure'). In that particular respect, however, the wording of the proposal would leave the situation essentially unchanged.
Registrant data
On the other hand, the proposal includes new requirements regarding the registrant data that registries and registrars must hold, and regarding third-party access to such data. The requirements in question are contained in Article 23 (now Article 28) of the proposal. In a nutshell, European member states would be required to ensure that registries and registrars:
'collect and maintain accurate and complete domain name registration data';
ensure that such data is sufficient for the registrant to be identified and contacted;
have in place and publish policies and procedures to ensure that the data is 'accurate and complete';
publish any such data that is not personal data as soon as possible following registration;
'provide access to specific domain name registration data upon lawful and duly justified requests of legitimate access seekers, in compliance with Union data protection law', 'without undue delay' and in accordance with their published policies and procedures.
The actual wording of the considerations underpinning this part of the proposal is provided at the end of this blog. I recommend taking the time to read it carefully.
Many unclear aspects
The proposal raises significant questions. Not least because many of the terms used are not clearly defined. What, exactly, do 'accurate' and 'complete' mean? And what is implied by 'lawful and duly justified requests of legitimate access seekers'?
What problem is the Commission looking to resolve?
However, before considering those questions, it is pertinent to ask what problem the European Commission is seeking to address and whether the proposed requirements are actually helpful in that regard. And whether the public interest served by resolution of that problem is sufficient to justify the effort required of the domain name industry to comply with the requirements. Unfortunately, the proposal is largely silent on those matters.
Identification requirement
Let us therefore consider the meaning of 'accurate and complete'. The proposal's current wording could be interpreted as meaning that, when a domain name is registered, it will be necessary to confirm a registrant's identity. And that it will subsequently be necessary to periodically verify that the registration data remains correct. If so, the requirements may be characterised as onerous in relation to registrations that cost only a few euros a year. However, it is unclear whether that interpretation is correct, or whether much less onerous checks will suffice.
Data publication
The proposal also implies the provision of a 'Whois-style' service for the publication of registration data. However, given that the published data should not include any personal data, it is unclear what data the Commission does want published. At present, each ccTLD registry decides what data to publish, and there are considerable differences across the industry.
Access to data
Then there is the topic of giving certain parties access to registration data, presumably the unpublished data, namely the personal registration data. The proposal is that access to such data (or, depending on who is seeking access, a portion of it) must be granted in response to 'lawful and duly justified requests of legitimate access seekers'. It would appear that 'requests of legitimate access seekers' means not only court orders, but also requests from parties other than those with a legal right to demand access. This aspect of the proposal seems to tie in with the e-evidence proposals. (1) However, the Commission has also taken note of the SSAD system developed within ICANN for the gTLDs (which doesn't apply to country-code domains). The explanatory information accompanying the proposal gives a number of examples of 'legitimate access seekers', but the examples fall well short of defining clear parameters.
European Commission's frustrations
In its current form, the proposal is too unclear for practical implementation and is therefore unworkable. It seems in part to reflect the European Commission's frustrations concerning the policy discussions taking place within ICANN in connection with the restrictions placed on the Whois by the GDPR. That would explain why the proposal states explicitly that the domain name requirements will apply to non-EU-based entities that provide services to EU residents.
Deterrent fines
Finally, I should mention that the proposal makes provision for fines for those who fail to follow the rules. Although the size of those fines is to be left up to individual member states, the draft directive does require them to be sufficient to serve as a deterrent.
Impact on the domain name industry
It will probably be quite a while before the wording of NIS2 Directive is finalised. In the meantime, we can expect it to be improved, hopefully significantly. Nevertheless, it seems unlikely that the registration data requirements will be removed altogether. Consequently, the definitive version is bound to have implications for the domain name industry.
Wording of Article 23 of the proposed directive
(Article 23 later became Article 28)
Databases of domain names and registration data
For the purpose of contributing to the security, stability and resilience of the DNS, Member States shall ensure that TLD registries and the entities providing domain name registration services for the TLD shall collect and maintain accurate and complete domain name registration data in a dedicated database facility with due diligence subject to Union data protection law as regards data which are personal data.
Member States shall ensure that the databases of domain name registration data referred to in paragraph 1 contain relevant information to identify and contact the holders of the domain names and the points of contact administering the domain names under the TLDs.
Member States shall ensure that the TLD registries and the entities providing domain name registration services for the TLD have policies and procedures in place to ensure that the databases include accurate and complete information. Member States shall ensure that such policies and procedures are made publicly available.
Member States shall ensure that the TLD registries and the entities providing domain name registration services for the TLD publish, without undue delay after the registration of a domain name, domain registration data which are not personal data.
Member States shall ensure that the TLD registries and the entities providing domain name registration services for the TLD provide access to specific domain name registration data upon lawful and duly justified requests of legitimate access seekers, in compliance with Union data protection law. Member States shall ensure that the TLD registries and the entities providing domain name registration services for the TLD reply without undue delay to all requests for access. Member States shall ensure that policies and procedures to disclose such data are made publicly available.
Relevant considerations from the proposal
(59) Maintaining accurate and complete databases of domain names and registration data (so called ‘WHOIS data’) and providing lawful access to such data is essential to ensure the security, stability and resilience of the DNS, which in turn contributes to a high common level of cybersecurity within the Union. Where processing includes personal data such processing shall comply with Union data protection law.
(60) The availability and timely accessibility of these data to public authorities, including competent authorities under Union or national law for the prevention, investigation or prosecution of criminal offences, CERTs, (CSIRTs, and as regards the data of their clients to providers of electronic communications networks and services and providers of cybersecurity technologies and services acting on behalf of those clients, is essential to prevent and combat Domain Name System abuse, in particular to prevent, detect and respond to cybersecurity incidents. Such access should comply with Union data protection law insofar as it is related to personal data.
(61) In order to ensure the availability of accurate and complete domain name registration data, TLD registries and the entities providing domain name registration services for the TLD (so-called registrars) should collect and guarantee the integrity and availability of domain names registration data. In particular, TLD registries and the entities providing domain name registration services for the TLD should establish policies and procedures to collect and maintain accurate and complete registration data, as well as to prevent and correct inaccurate registration data in accordance with Union data protection rules.
(62) TLD registries and the entities providing domain name registration services for them should make publically available domain name registration data that fall outside the scope of Union data protection rules, such as data that concern legal persons. TLD registries and the entities providing domain name registration services for the TLD should also enable lawful access to specific domain name registration data concerning natural persons to legitimate access seekers, in accordance with Union data protection law. Member States should ensure that TLD registries and the entities providing domain name registration services for them should respond without undue delay to requests from legitimate access seekers for the disclosure of domain name registration data. TLD registries and the entities providing domain name registration services for them should establish policies and procedures for the publication and disclosure of registration data, including service level agreements to deal with requests for access from legitimate access seekers. The access procedure may also include the use of an interface, portal or other technical tool to provide an efficient system for requesting and accessing registration data. With a view to promoting harmonised practices across the internal market, the Commission may adopt guidelines on such procedures without prejudice to the competences of the European Data Protection Board.
See, for example, the ongoing EPDP2 consultation: https://www.icann.org/public-comments/epdp-2-policy-recs-board-2021-02-08-en
