Proposed change to .nz policy around WHOIS information

This consultation closed 7 June 2016.

DNCL is consulting on a proposed change that could see registrants able to have their personal details withheld from the .nz WHOIS. Registrants’ full contact details have always been publicly displayed in the WHOIS, but this status quo is no longer appropriate.

Submissions closed 7 June 2016. Note: an update about the WHOIS review (published after the close of the third consultation) was published in July 2016. This can be found at https://dnc.org.nz/whoisupdate.   

FAQs

Information about the proposed change can be found below, in the accompanying media release and in these FAQs. The FAQs address some common questions about the process and approach proposed. If you’ve got a question that isn’t covered in the FAQs you can get in touch by using this form.

Background

The WHOIS is a publicly available search service that lets people find information about a domain name listed in the .nz register.  WHOIS searches can be undertaken by anyone at any time in a number of places including on the DNCL website – http://dnc.org.nz.  Information about the domain name is returned, including its registration status and registrant and registrar details (if registered).

Under .nz policies, certain information must be supplied when a .nz domain name is registered. This includes registrant name and contact details, admin name and contact details, and technical name and contact details. This information is made publicly available when a WHOIS search is done on a .nz domain name.

Registrants must be contactable at the details they supply. This is so they can be contacted about their domain name if any issues regarding its registration, technical operation or use arise.

Making the details publicly available also serves a public good. Being able to identify registrants (and having the ability to contact them regarding their domain name) keeps them accountable and helps to preserve the health and integrity of the .nz register. Part of the reason the .nz register experiences very low levels of malicious activity, for example, is because registrations cannot be made anonymously and that registrants are identifiable. This allows people to see who is associated with a particular website or email.

DNCL’s WHOIS review

Over the past few months DNCL has been reviewing the .nz WHOIS policy. As part of the review, two public consultations have been run on why a WHOIS service is required and what information should be displayed and to whom. Details about these consultations, including all submissions received, can be found at https://dnc.org.nz/WHOIS-review

A core focus of DNCL’s review has been to consider whether the WHOIS information that is currently collected and disclosed in a WHOIS search remains appropriate. 

Submissions received largely supported collecting registrant details and making these publicly available in the WHOIS. There is a purpose and value in doing so; notably that registrants can be contacted if there are any issues with their domain name.

Some concerns about registrant privacy and security were raised during the public consultations. DNCL acknowledges these concerns and notes that there is currently a range of measures undertaken to protect information held in the .nz register. For example, WHOIS queries are rate limited, and historical registrant information is not published. DNCL will continue to work with NZRS on measuring and managing access to .nz information to ensure registrant information is protected from misuse.

Summary of proposed change

The WHOIS will remain a publicly available register. However, it is proposed that there should be a process for individuals to have their details withheld from publication under certain circumstances, including where their personal safety may be at risk if their personal contact details were displayed.

For example, it may be that a person has a Protection Order and the potential risk to them means there is no public good in displaying their contact details. In cases like these, an application by a registrant to withhold information would be expected to be successful. An application to withhold information by a registrant who uses their domain name as a website to criticise anonymously, however, is likely to be declined. 

There are many situations between these two extremes where a decision may be finely balanced but a robust and consistent approach will be taken to evaluating applications and it is proposed that an appeal process also be implemented.

Withheld information would extend to a registrant’s contact details only, not their name. This is because being able to identify the registrant of a domain name is considered a key part of maintaining the integrity of the .nz register. There are other options available for people who wish to maintain an anonymous online presence – such as registering in a Top Level Domain that offers full registrant privacy.

DNCL has drafted a proposed process for withholding registrant information in the WHOIS. This is detailed below. Feedback is now sought on whether this option should be introduced into .nz and on the approach proposed.

Submissions will be published at https://dnc.org.nz/consultation-whois-review-process as they are recieved. Individuals making submissions may request that their personal details be withheld from publication.

 

Comments can be sent by email to policies@dnc.org.nz, or by post to PO Box 11881 Wellington 6142. Submissions should be received by 7 June 2016.

 

Proposed Process

  1. The default position remains that all .nz registrant information is public.
  1. Individuals can apply to DNCL to have their contact details withheld from the public WHOIS. They must show that circumstances exist which outweigh the general need for information about .nz domain names to be public – for example, genuine concerns around personal safety.
  1. Withheld information extends to contact details but does not extend to withholding the name of the registrant.
  1. Applicants will complete an application form that includes:
    1. Their full and correct details
    2. Which details they wish to be withheld, why they want them withheld and why this outweighs the default position of it being public
    3. Any relevant supporting documents or statements supporting their application including copies of any protection, trespass or restraining orders
    4. Why their interests can’t be protected in any other way
    5. What other measures they have taken to protect their information
  1. There will be no charge to submit an application.
  1. DNCL will consider the application with a particular focus on whether there is a reasonable and genuine issue and whether it is judicious to allow the request.
  1. DNCL will decide on the request within 7 business days of receiving all relevant information.
  1. Applications can be made for new or existing domain names.  The evaluation process for both is the same but the approach varies to reflect the first come, first served nature of the .nz register and ensure a registrant does not miss out on a name they want due to working through this process.
  1. Where the application is for a new domain name:
    1. The applicant will complete a form on the DNCL website that requests the registration of a new .nz domain name (including accepting .nz terms and conditions) along with requesting that registrant contact information be withheld.
    2. DNCL will process a one month registration using DNCL’s details as the contact information.  This domain name will be under the Domain Name Commission registrar ID and will not be set to renew at the conclusion of the one month period.
    3. If the request to withhold details is granted by DNCL the registrant will be advised of the outcome, provided with the Unique Domain Authentication Identifier (UDAI) for the domain name and directed to transfer the domain name to a registrar of their choice.  At this point, they will have to sign up to the registrar’s terms and conditions and pay a renewal fee like any other registration.  The registrant will have to do this before the end of the one month registration period.
    4. Contact details which are withheld will continue to reflect those of the Domain Name Commission including an email in the form of identifier@privacy.dnc.org.nz that will be set to automatically forward to the registrant’s email.
    5. If the request to withhold details is not granted the applicant may choose to appeal (refer details on appeal later). 
    6. Should the appeal be successful, and the request to withhold information granted, then the process in 9c and 9d above is followed.
    7. If the appeal is not successful and the request to withhold information is declined, the registrant can choose to maintain the registration of the domain name.  They will need to transfer the domain name to a registrar of their choice before the end of the initial registration period and update the contact details to their correct information. 
  1. Where the application is for an existing domain name:
    1. The applicant will complete a form on the DNCL website that requests their contact information be withheld.  This will be evaluated in the same manner as those for new registrations.  The timeframe for evaluating may be extended in the first three months of this process being implemented if the initial level of applications is high.
    2. If the request to withhold details is granted, DNCL will direct the registrar of the domain name to make changes to update the contact information to reflect DNCL’s details.  DNCL will not take any direct action on the registration record.
    3. If the request is declined there is no impact on the registration record but the applicant can choose to appeal.
  1. There is an appeal process which applies to both new and existing registrations:
    1. An appeal panel will be established consisting of appropriately qualified practitioners, appointed following a public application process.
    2. One panellist will review the application and their decision is binding on both the applicant and on DNCL.
    3. The panellist will be appointed ‘first cab off the rank’ subject to any conflicts of interest or time constraints.
    4. The appeal panellist will have 10 working days to make a determination (this timeframe allows for the domain name to be transferred to a registrar before the one month registration term is completed).
    5. If an appeal results in the application to withhold information being granted then the approach in 9c and 9d, or 10b, will be followed.
  1. There will be mechanisms to ensure that any correspondence to the DNCL privacy details is redirected to the registrant.  This will mean there is no impact should a domain name with withheld information be subject to a complaint under the Dispute Resolution Service.
  1. Registrants will be regularly asked to confirm that the circumstances that led to them getting their information withheld still apply.  Following a suitable notice period, DNCL may remove permission to withhold information where it can be shown that the registrant’s situation has changed. 
  1. Names that have had registrant contact details withheld will be identifiable by the contact details held on the register that reflect DNCL’s details.  A third party can make an application to the DNCL requesting the true details of the registrant be disclosed to them.  They would need to clearly set out why they need the information and why it is not sufficient for them to contact the registrant through the redirections in place.
  1. DNCL will consider requests for the release of the information on a case by case basis.  DNCL will advise the registrant and seek their response to the request made but the decision by DNCL will be final. 
     

Submissions:

Office of the Privacy Commissioner pdf

New Zealand Bankers Association html

NZIPA pdf

Aimee Whitcroft html

AJ Park pdf

Baldwins pdf

New Zealand Law Society pdf

Dylan Wagstaff html

Helen Lynch html

Michele Neylon html

Malcolm Hunt html

Colin Jackson html

LIANZA pdf

Michael Fincham html

Ewen McNeill html

Rita Hunt html

Timo Reitnauer pdf

Ian Simpson html

Hiria Te Rangi html

Amit Anjara html

Jonathan Spence html

John Howell html

Jed Laundry html

Daniel Millar html

Matthew Brown html

3-10 (details withheld) html

Colin Coghill html

Morgan Wilson html

Michael Sutton pdf

Matt Taylor html

3-9 (details withheld) html

Jason Ryan html

3-8 (details withheld) html

Don Stokes html

Jonathan Brewer html

Laura Bell html

Tom Beard html

Robert Coup html

Stephanie Robertson html

Amanda Kennedy html

Annabel Henderson Morrell html

Richard McKenzie html

Merrin Macleod html

Andrew Chilton html

David Thompson (amended 11.45am, 12 May 2016) html

3-7 (details withheld) html

Alan Christensen html

3-6 (details withheld) html

Pete Mundy html

Jethro Carr html

3-5 (details withheld) html

3-4 (details withheld) html

Keir Rice html

Beau Butler html

Stephen Judd html

3-3 (details withheld) html

3-2 (details withheld) pdf

Steve Phillips html

Andrew Evans html

Maire Smith html

Rob Isaac html

Mike Forbes html

Dan Newman html

Richard Clark html

3-1 (details withheld) html