Whois could be killed off in EU

GDPR prevents Whois from working

Europe’s data protection authorities have effectively killed off the current service, noting that it breaks the law and so will be illegal come 25 May, when GDPR comes into force.

ICANN now has a little over a month to come up with a replacement to the decades-old service that covers millions of domain names and lists the personal contact details of domain registrants, including their name, email and telephone number. ICANN has already acknowledged it has no chance of doing so.

The company warns that without being granted a special temporary exemption from the law, the system will fracture. “Registries and registrars would likely implement varying levels of access to data depending on their interpretations of the law”, ICANN warns.

Göran Marby, ICANN president and CEO.said that  he was disappointed that the EU fails to even mention its request for a moratorium on enforcement of the law until it implements a model. Without a moratorium on enforcement, WHOIS will become fragmented and “we must take steps to mitigate this issue. As such, we are studying all available remedies, including legal action in Europe to clarify our ability to continue to properly coordinate this important global information resource. We will provide more information in the coming days.”

ICANN has apprently made a mistake thinking that all it had to do was tell the EU that it needed an “enforcement moratorium” and it would all be fine. However the EU’s data protection advisory group told the site that there’s no provision in the GDPR for an “enforcement moratorium”, and the EU’s data protection advisory group does not really understand how ICANN can keep asking for something that does not exist.

“The GDPR does not allow national supervisory authorities nor the European Data Protection Board to create an ‘enforcement moratorium’ for individual data controllers. Data protection is a fundamental right of individuals, who may submit complaints to their national data protection authority whenever they consider that their rights under the GDPR have been violated”, the EU told ICANN.