Registrants in favour of registration data verification
But SIDN Panel members do have privacy concerns
Verification of domain name registrants' details is a topical theme within our industry. We have recently announced a ban on proxy services, and back in December the EU passed the second Network Information Security Directive (NIS2). Under the directive, new data verification requirements will apply to domain name registrations from the end of 2024. The practical implications of those requirements will be clarified in the period ahead. Against that background, we asked the SIDN Panel for their views on verification last week. The high response rate of nearly 30 per cent and the open feedback tell us that this is an issue that people care about, but that presents certain dilemmas.
New directive
NIS2 is a wide-ranging cybersecurity directive, some of whose provisions relate specifically to domain name registration data. What Article 28 of the directive actually says is that the data must be 'accurate and complete'. That goes for at least the registrant's name, e-mail address and phone number. All registries for domains in the EU (e.g. SIDN for the .nl domain) will additionally have to publish their data verification procedures on their websites. So SIDN and the .nl registrars will have to do that for .nl. We therefore wanted to find out how registrants feel about these developments.
A good idea, with a lot of support
First of all, the great majority of registrants – more than 83 per cent in our survey – are in favour of improved verification. Only 5 per cent of our respondents are opposed. Most of them see verification as helping to prevent fraud:
"I think it would be good to make registrant identity verification mandatory. Although fake webshops and the like are fairly uncommon in the Netherlands, verification could help to suppress them further. That would reinforce trust in .nl because, in the event of fraud, it's good to have the reassurance of knowing that the person recorded as the registrant is real."
Respondent panel
The EU directive also has widespread support:
"Some of my customers are in other parts of the EU. They are typically private individuals running small businesses. The verification arrangements will need to be workable for them and practical, even if you live in, say, the French countryside."
Web designer and SIDN Panel member
Business data and personal data
However, things become more difficult when people are asked about verifying their own identities. Many registrants have their doubts. Sole traders in particular highlighted negative experiences, such as unwanted contact from people who got their details from the Chamber of Commerce. Our survey respondents were much less concerned about the verification of business details (78 per cent didn't see that as a problem) than about personal data verification (not a problem for 53 per cent). Many respondents felt that sole traders should be treated like private individuals. Of our respondents, 17 per cent said that verification requirements could deter them from registering a domain name.
No clear preferred verification method
When asked how registration data should be verified, registrants were not very positive about any of the existing verification methods. The biggest obstacle is that most registrations are made for business purposes, and eHerkenning has yet to catch on as a means of electronically identifying business users. A sizeable group of respondents (31 per cent) suggested using a new method, such as Yivi. Others favoured the use of micro-payments for verification. Many of the people we asked would prefer it if the service provider didn't retain any data when verifying someone's identity:
"If a hosting service provider has to check your identity, it should involve a system that just gives the service provider confirmation that your details are correct, without the details themselves being shared. Otherwise, your data will be recorded at yet another location, and if your data gets out, no one will know where the leak was."
Respondent panel
What happens next
We're currently waiting for the NIS2 directive to be translated into national legislation. That's likely to be late 2023 or early 2024. As soon as we know more, we'll update you via our website and newsletter.
Interested in joining our panel?
As the organisation behind the .nl domain, we often ask internet users, domain name registrants and entrepreneurs for their views on subjects relating to the internet and its use, and to security, privacy and domain names. Would you be interested in sharing your views with us, maybe anonymously? Use the link to see what Panel membership involves and apply to join.
