#REDACTED FOR PRIVACY FULL#
#REDACTED FOR PRIVACY PROFESSIONAL#

With the WHOIS details not readily available, we now have to find other data elements to ensure that our monitoring and reaction times remain at the level expected by our clients. Although WHOIS data was never useful for uncovering the identity of infringers – who are smart enough not to use their own details – it allowed us to discern patterns and to act by anticipation against domain names registered for, but not yet used for, infringing purposes. Luc Seufer (LS): While the apocalyptic scenario painted by some vocal actors has not happened, it is certainly more difficult to enforce our clients’ rights as efficiently as before.

#REDACTED FOR PRIVACY FULL#

As the available WHOIS data becomes older and as more registrars disable access to it, it will become more difficult to determine the identity of domain name registrants – only then will the full impact of the GDPR on WHOIS be more fully appreciated. It also appears that the number of multi-domain name UDRP complaints has dropped as brand owners struggle to identify registrants and correlate commonly owned domain names. Importantly, since WHOIS data started becoming unavailable, we have seen notable increases in domain name-related phishing campaigns. Therefore, some WHOIS data is still available for many domain names. Several popular services (ie, Domain Tools) still make older data available to subscribers and not all registrars have complied with ICANN’s Temporary Specification yet. This has resulted in a 12% loss of operational efficiency in the performance of our brand enforcement activities.ĭavid Steele (DS): I actually think that it is still too early to tell whether the full impact is as negative as feared.

As a result, we have had to adjust our enforcement strategies and processes to adapt to a post-GDPR world. In fact, after the GDPR came into effect, we found that our WHOIS queries returned little or no public registrant data, so our team has had to request non-public WHOIS data from registrars and registries directly, with limited success. This has affected brand protection efforts as brand owners and enforcement teams can no longer obtain the names and contact information that they need from public WHOIS databases. Following the GDPR, many domain name registries and registrars have opted to redact registrant contact information from public display in their WHOIS records. Only a tiny percentage of information is now available to the public and this has had a considerable knock-on effect for brand protection professionals. These bad actors continue to grow and thrive under the new framework, harming the very consumers that the GDPR was intended to protect, including through the sale of online counterfeit goods, phishing and other fraudulent activities.ĭavid Cooper (DC): While there has not been a total WHOIS blackout, our predictions regarding the absence of vital registrant data have largely come true. So-called ‘thin’ WHOIS data is not sufficient, while ‘thick’ WHOIS data is not available because the bad actors are not going to provide consent. Brand owners have had difficulties obtaining disclosure of the now-redacted registrant details and disclosure rates have been low despite their legitimate interest. Unfortunately, the decrease of information through redaction caused by GDPR implementation has enabled bad actors to thrive because they are protected by restrictions on WHOIS access – permission is now needed to identify individual information – which has made it much more difficult to find and track down infringers and counterfeiters.

Ms Plaut sat on the Phase 1 Expedited Policy Development Process (EPDP) Team on behalf of the Intellectual Property Constituency and now sits on the Implementation Review Team for the EPDP work generated from Phase 1 to finalise the policy to go into effect.

#REDACTED FOR PRIVACY PROFESSIONAL#

General Counsel and Privacy Officer Diane Plaut – a certified privacy professional – has lead and advised our commercial organisation to ensure that we have a fully comprehensive and legally compliant data protection framework and has educated our clients through articles and webinars on the law, what is happening within ICANN and the resulting practical commercial implications. At Corsearch, we ourselves have invested significantly. The amount of time and resources that companies and law firms have had to commit in order to comply has been significant. Stephen Stolfi (SS): Yes, it has had a negative impact, but we are productively embracing it as a company, appreciating the legal importance of the GDPR, but trying to balance and address the challenges that it brings to enforcement efforts and IP interests. Looking at the impact of the GDPR on WHOIS access as it currently stands, has it been as negative as first feared and why?

Redacted for privacy