UK domain name registry attacked on personal data plan

The web site co-ordinating the campaign, Nominet-No.co.uk, argues that Nominet will be breaching data protection laws by displaying more details about those who registered domain names in the past, because these individuals registered the names in the expectation that, while Nominet could hold their addresses, only their names would appear in the publicly accessible WHOIS database.

For instance, no name appears on the Nominet-No web site; but Nominet.org.uk’s WHOIS pages show that it is registered to Colin Clarke. Under Nominet’s plans, Clarke’s full contact details, including his home and e-mail addresses, will also appear on-line.

Nominet says it has come under pressure to make the contact details publicly available, in line with other country code Top Level Domains registries around the world. The registries for the generic TLDs – such as .com or .biz – already make these details available.

The Nominet-No site points to a provision which could, until recently, be found in Nominet’s terms and conditions:

"The Register of .UK Domain Names will include the names of the Applicant and the Administrative Contact and other details relating to them. This information (if it refers to individuals) is 'personal data' for the purposes of data protection legislation. NOMINET UK may allow other organisations and members of the public to access the data for the purpose of obtaining information about the registration of the Domain Name or any other related purpose."

Nominet-No argues that this means that the Register will only display “the names.” However, while Nominet’s practice until now has been to display only the names, it would likely argue that the words “and other details relating to them” gave it authority to display additional information – such as home or e-mail addresses. The Data Protection Act effectively puts an obligation on Nominet to tell those registering domain names anything which is necessary to guarantee fair processing of their personal data. The debate is whether or not Nominet complies with this or should have been more explicit.

Nominet has updated its terms and conditions, clarifying any ambiguity. In its explanation of the proposed change to the WHOIS records, it argues that it is entitled to display the additional information on the basis of its terms and conditions – but in doing so it refers only to the new wording, not that to which most individuals agreed when registering their domain names over the past few years. Those who registered domain names under the old conditions will only become subject to the new conditions upon transfer or renewal of their domain names.

See:

• www.Nominet.org.uk
• www.Nominet-No.co.uk