Diploma Thesis
Total Page:16
File Type:pdf, Size:1020Kb
Diploma Thesis to be awarded the degree of Magister Juris at the University of Graz, Austria <The Future of WHOIS> An analysis of the Policy Development Process under the GDPR with a focus on the litigation ICANN v. EPAG submitted by Ing. Matthias Markus Hudobnik Name of the supervisor: Univ.-Prof. i.R. Mag. Dr. Wolfgang Benedek Department: Institute of International Law and International Relations Graz, June 2019 Authors Declaration Unless otherwise indicated in the text or references, or acknowledged above, this diploma thesis is entirely the product of my own scholarly work. Any inaccuracies of fact or faults in reasoning are my own and accordingly I take full responsibility. This thesis has not been submitted either in whole or part, for a degree at this or any other university or institution. This is to certify that the printed version is equivalent to the submitted electronic one. _________________________________ Ing. Matthias Markus Hudobnik Graz, June 2019 Preface and Acknowledgements The idea to write about WHOIS1 and the GDPR started in March 2017 during my participation in the NextGen@ICANN program at the ICANN58 meeting in Copenhagen, where I was first confronted with this topic. I have remained interested ever since. Subsequently I participated in further meetings: as a Fellow in the European Dialogue on Internet Governance (EuroDIG) 2017 in Tallinn and the 11th European Summer School on Internet Governance (EuroSSIG) in Meissen; as an Ambassador in the NextGen@ICANN60 program in Abu Dhabi; as a Fellow in the EuroDIG 2018 in Tbilisi, as well as the ICANN63 meeting in Barcelona, and the RIPE77 meeting in Amsterdam. Furthermore, I have joined all the relevant working groups and mailing lists, and also participated in ICANN’s GDPR webinars, as well as ICANN’s online courses to get a wealth of insight into this complex policy process within the Internet ecosystem. In June 2019, I will present a paper relating to my diploma thesis about the future of WHOIS, at the 34th International Conference on ICT Systems Security and Privacy Protection in Lisbon. First of all, I would like to express my sincere gratitude to Univ.-Prof. i.R. Mag. Dr. Wolfgang Benedek for being my supervisor and supporter for many years. His professional guidance, passion, patience, and immense knowledge have been a tremendous support through my personal journey. Besides my supervisor, I would like to thank Matthias C. Kettemann for questioning my ideas, providing constructive feedback, and pushing me forward. It has been a great honor and pleasure discussing Internet Governance issues with him! I also would like to thank Clément Genty, not only for the strong connection, but also for his useful feedback, the numerous talks, and discussions about Internet Governance and important topics beyond as well as my dudes from the GFW & Könige – I love you guys! A special thank you goes to Jess including M & D for always enduring my moods, nagging and providing me with both feedback and moral support over the course of drafting this diploma thesis. Talking with her about matters related to the topic of this diploma thesis helped me immensely to keep on track, and she always found time to proof-read my thesis and gave me valuable feedback. Thank you so much for everything! Last but certainly not least, I would like to thank my family. Your endless love and support have made me who I am today! 1 Is pronounced as ‘who is’ e. g., the domain holder or in charge of it and is not seen as an ‘acronym.’ Table of contents 1 Introduction ............................................................................................................................... 1 1.1 Outline of the diploma thesis ........................................................................................... 3 1.2 Methodology of the diploma thesis .................................................................................. 3 2 Definitions and background ..................................................................................................... 5 2.1 What is ICANN? .................................................................................................................. 5 2.2 What is the WHOIS system? ............................................................................................. 6 2.2.1 History ........................................................................................................................ 8 2.2.2 Technical overview .................................................................................................. 12 2.2.3 Policy agreements ................................................................................................... 13 2.3 Definitions of the parties involved ................................................................................. 16 2.3.1 Generic Top-Level Domain registry operator ......................................................... 17 2.3.2 Registrar ................................................................................................................... 18 2.3.3 Registrant................................................................................................................. 18 2.3.4 Reseller .................................................................................................................... 18 2.3.5 Internet Corporation for Assigned Names and Numbers ...................................... 18 2.3.6 Registry/Registrar Data Escrow Agent ................................................................... 18 2.3.7 Emergency Back-End Registry Operator ................................................................ 19 3 Description and application of the General Data Protection Regulation ............................. 19 3.1 General provisions and principles .................................................................................. 19 3.1.1 Territorial scope ....................................................................................................... 19 3.1.2 Definitions of various terms .................................................................................... 20 3.1.3 Data processing principles ..................................................................................... 21 3.1.4 Legal grounds and lawfulness of processing ........................................................ 22 3.2 European Data Protection Board/Article 29 Data Protection Working Party .............. 24 4 Compliance Models ................................................................................................................. 25 4.1 GDPR Compliance Models and community input ......................................................... 25 4.1.1 Data collection, processing, and retention ............................................................ 26 4.1.2 Scope of applicability .............................................................................................. 32 4.1.3 Layered/tiered access to public WHOIS data ........................................................ 34 _____________________________________________________________________________________________________________ i 4.1.4 Layered/tiered access to non-public WHOIS data ................................................ 40 4.1.5 Conclusion ............................................................................................................... 44 4.2 Temporary Specification for gTLD Registration Data .................................................... 49 4.2.1 Expedited Policy Development Process on the Temporary Specification for gTLD Registration Data .................................................................................................................... 52 4.2.2 Conclusion ............................................................................................................... 61 5 Case, ICANN v. EPAG Domainservices GmbH ....................................................................... 64 5.1 ICANN’s Motion for the Issuance of a Preliminary Injunction ....................................... 64 5.1.1 EPAG’s protective letter .......................................................................................... 68 5.2 Court Order from the Regional Court of Bonn on Application for Preliminary Injunction 70 5.3 ICANN’s Immediate Appeal ............................................................................................. 72 5.3.1 Lawfully collection of Admin-C and Tech-C data as well as lack of obligation to collect personal data ............................................................................................................... 72 5.3.2 Lawfully collection of Admin-C and Tech-C data even if it is personal data ........ 73 5.3.3 EPAG’s Comments on ICANN’s Immediate Appeal ............................................... 77 5.4 Court Order from the Regional Court of Bonn in the Preliminary Injunction Proceedings ................................................................................................................................. 83 5.5 ICANN’s Supplemental Submission to the Higher Regional Court of Cologne ............ 84 5.5.1 EPAG’s Comments on ICANN’s Supplemental Submission .................................. 87 5.6 Order from the Higher Regional Court of Cologne Regarding ICANN’s Immediate Appeal 88 5.7 ICANN’s Plea of Remonstrance ...................................................................................... 89 5.7.1 EPAG’s Comments on ICANN’s Plea of Remonstrance ........................................