You can't hide when it comes to .nz domain names

.nz domain name privacy overview

When a person buys online they usually don’t have to reveal their identity unless say, for example, they are buying a warranty with the goods. 

But when it comes to buying a domain name licence on the other hand it’s important a person is contactable for renewal purposes and if technical issues arise. For many though, it may not be obvious that the details provided for registration are then placed on an online searchable register.

When you register a domain name (and are granted a domain name licence) the details that you use will appear in the public-facing .nz Query Service (WHOIS). Why is this? 

One of the reasons for the publication of personal details associated with domain names is that it is considered to be in the public interest. 

Did you know that the independent advisory group who recently reviewed the .nz rules recommended that names of registrants (domain name holders) should still be available through the .nz query search? 

The group noted that it is essential in this digital age that people interact online and that the act of ensuring transparency as to who is the registrant of a domain account in itself promotes accountability for activity related to that domain name.

Currently, a person registering a domain name provides their name, address (including country), phone number and email. Individuals, and those not using the domain name to any significant extent in trade, can apply a privacy option, meaning that only their name and email address will be displayed publicly. This is called the 'IRPO' option (Individual Registrant Privacy Option).

What we find

For the most part, IRPO is used correctly. When monitoring registrant data compliance we on the odd occasion find that instead of giving names the following words are used to register the domain name - “private”, “personal”, “not disclosed”, “none” or “anonymous” instead of individual or business names - this is a no-no.

We also do find that entities that are doing significant trade sometimes apply for the privacy option when the option isn’t available for those in business. It’s designed for individuals. 

When we find these things we do outreach work to the registrant and registrar to correct these mistakes. 

What we do 

As the regulator, the Domain Name Commission provides education on .nz policy and, where required, enforces it. Part of our compliance program has been to improve registrant details.

Our compliance program last year included reaching out to Registrars (who provide services directly to registrants) seeking improvements to recording registrant’s names, which resulted in a significant reduction in invalid registrant names being listed because of a misunderstanding of the privacy option. 

This work supports the goal of improving accountability online. 

What the future holds

The Privacy Commissioner NZ submitted on the .nz rules review and was generally supportive of there being a register publically available of registrant details, noting that the collection and use of the information needed to be necessary and proportionate. 

An option is currently being considered as part of a change to .nz rules that the privacy option be extended to withhold email addresses from the ‘public register’. Emails would still be collected, but would only be distributed in compliance with privacy law. Instead of the WHOIS publication of email addresses, there would be a contact form through which people could contact registrants.

The review of the privacy settings of domain details aims to strike a balance between privacy and accountability and to promote the public interest. 

Privacy Week Tip: Domain holders should enter their domain name in the WHOIS and check their listed details. Contact your service provider if you are not listed as the rights’ holder or need to change your details.