As most of you know, the EU's GDPR privacy regulation takes effect May 25. This has caused ICANN to reexamine its requirements for registries and registrars on displaying WhoIs domain registration data, which CAs use to validation domain ownership or control by domain owners to issue SSL/TLS certificates.
The subject has been a difficult one, and the deadline is fast approaching. ICANN has released a Proposed Interim Plan for GDPR Compliance, and is asking for comments: https://www.icann.org/news/blog/data-protection-privacy-update-seeking-input-on-proposed-interim-model-for-gdpr-compliance Here is the draft interim plan: https://www.icann.org/en/system/files/files/proposed-interim-model-gdpr-compliance-summary-description-28feb18-en.pdf I have invited Francisco Arias, Sr. Director, GDD Technical Services for ICANN, to be on our Thursday teleconference call and provide a high level overview of the Interim Plan. Francisco has told me that the Plan posted to the ICANN website is only a draft and may change. He also said the Plan includes the concept of allowing certain parties, such as law enforcement and others, to have continued access to WhoIs data after the GDPR takes effect, but the Interim Plan does not yet include specific access to the data for CAs. Francisco suggested the Forum and its members should post comments (including a request for continued data access in the Interim Plan) to the address for comments on the Interim Plan, g...@icann.org<mailto:g...@icann.org>. I will certainly post a request for continued access for the CA/Browser Forum members, but others may also want to do so. On our call, Francisco will also be asking for CA volunteers to work on a pilot program using RDAP for differentiated access to domain registration data instead of WhoIs, as only RDAP can really provide different levels of access. I will leave it to Francisco to describe the pilot project and how CAs can volunteer. Again, the time frame is very short. I also invited Andrew Sullivan of Oracle/DYN to be on our call, as he has been following these ICANN discussions for many months, and previously briefed us on what was happening. I should note that I have been participating in an ICANN policy committee GNSO-RDS-PDP-Drafting Team 3 to explain the need for CAs to have continuing access to WhoIs data, and I believe that point of view was included in their report. Unfortunately, it turns out that Drafting Team 3 is working on part of a long term plan for data access and the Team's recommendations were not received or considered by the ICANN group that is drafting the Interim Plan - so we need to make the case again. My basic suggestion was that ICANN should use the list of trusted roots/CAs in CCADB, https://ccadb.org/resources, and instruct registries/registrars to give the CAs on that list continuing access to registration data via whitelist (and then let the CAs themselves sort out how they comply with GDPR rules, which for most will not apply to the majority of their certificate customers who are either outside the EU or not natural persons). Finally - I include a link to a recent article on this situation. Note: I am NOT endorsing the point of view in the article, but it provides a lot of information and may be useful to members. http://www.circleid.com/posts/20180330_icann_cannot_expect_the_dpas_to_re_design_whois/
_______________________________________________ Public mailing list Public@cabforum.org https://cabforum.org/mailman/listinfo/public
