ICANN is finding the going tough to get approval for its solution to deal with the domain name registrant data it requires to be collect for gTLDs by registrars, as per their Registrar Accreditation Agreement, and registries, and which complies with the European Union’s General Data Protection Regulation (GDPR).
ICANN’s solution to deal with the data protection regulation, a “Temporary Specification” that is only in place for 12 months, was only confirmed 8 days before the GDPR came into force on 25 May. One registrar to take issue with the Temporary Specification was the German EPAG. EPAG, and their parent company Tucows, took the view ICANN’s temporary specification wasn’t compliant with the GDPR. They had problems with 3 core issues: the collection, transfer, and public display of the personal information of domain registrants and the other contractually-mandated contacts.
To force them to comply, ICANN took EPAG to court, with the first filing taking place on the day the GDPR came into force. And now for the fourth time ICANN has been rebuffed. The latest was when ICANN received a ruling from the German Higher Regional Court in Cologne (“Appellate Court”) that rejected their request for review (“plea of remonstrance”) that was filed by ICANN on 17 August. ICANN’s plea was filed to continue the immediate appeal in the ICANN v. EPAG injunction proceedings. ICANN initiated such proceedings against EPAG, to seek assistance in interpreting the GDPR in order to protect the data collected in WHOIS. The Appellate Court again has determined that it would not issue an injunction against EPAG.
The first rebuff was on 30 May when the Regional Court determined that it would not issue an injunction against EPAG. Then on 13 June ICANN appealed and on 18 July the Regional Court decided not to change its original determination not to issue an injunction against EPAG. The matter was referred to the Higher Regional Court in Cologne for appeal. Next on 3 August ICANN announced a German appeal court (Appellate Court of Cologne) had issued a decision on the injunction proceedings ICANN initiated against EPAG determining that it would not issue an injunction against EPAG.
In making its ruling, the Appellate Court found that the preliminary injunction proceeding does not provide the appropriate framework for addressing the nature of the contractual disputes at issue, and that a decision in preliminary proceedings does not appear to be urgently needed. Again, the Appellate Court did not address the merits of the underlying issues with respect to the application of GDPR as it relates to WHOIS.
ICANN is continuing to evaluate its next steps in light of this ruling, including possible additional filings before the German courts, as part of its public interest role in coordinating a decentralised global WHOIS for the generic top-level domain system.
