I think it makes a lot of sense for a domain registrar to keep basic information in the long-term, about who registered what. I find it odd that this has become a point of contention.
Paraphrased:
Yes, of course you can keep registration data for your own legitimate usage. Contact information for the lifetime of the domain is fine.
Storing it for 2 years after expiry is not necessarily problematic, but you need to document why you legitimately need it.
You can't make private contact information public without consent.
However, you can disclose it to 3rd parties who make a legitimate request, but you should record the request.
GDPR is a negative development for openness, tranparancy and interconnectivity.
Well its certainly beneficial for privacy. There are very few social media sites in the world where publishing other people's contact details without their permissions is allowed. Its banned here. Its banned on Reddit. And a ton of other sites. There is really very little difference.
How would you feel if all HN submitters had to list a personal phone number? Why is running a website any different?
Less clear why ICANN needs to store that data too, I think it's right that they should have to properly justify that. ICANN has made up rules however they liked forever and ignored warnings about privacy for over a decade, and about GDPR specifically for years, so I have to admit I have little compassion for their self-created problem here.
GDPR does not limit the collection of data that has a legitimate business use as long as it is used for that business use only and removed when the use no longer exists. Otherwise how could you do billing?
Plus, things keep moving so fast (almost arbitrarily sometimes) that I wonder whether it's worthwhile. Fundamentally, the issue is this:
US intellectual property lawyers are very well organized and have the backing of big corporations. As a result, they have a disproportionate influence in US organizations - in this case, ICANN.
With each new proposal, each new rule, each new policy, these (very smart) IP lawyers find ways around it to suit their main goals. And because ICANN, unfortunately, has no moral or ethical center, it tends to bend its own policies to accommodate whoever is the most powerful and/or loudest on any given issue. In this case, the American IP lawyers are very driven to retain the existing system.
But in this particular case of Whois they have come up against a brick wall of decided European law.
And they have been trying to find ways around it, pressuring ICANN into a series of policy positions that are very clever but can't go anywhere because the law is settled.
Plus the data regulators are the people in charge of deciding how it is interpreted. And they, naturally, have a fairly strict interpretation of GDRP.
It's worth noting btw that European governments have often ignored the data regulators in favor of their own corporations (just take a look at the whole Privacy Shield debate). But in the case of GDPR, the data regulators are in the driving seat. At least for now.
So I could give a detailed rundown of what ICANN has proposed, and how it has changed, and how it is going to change again. But in truth it doesn't matter - ICANN and the IP lawyers will try on any new interpretation they can think of to get what they want - access to the contact details of every domain name - and they will discard any or all of them as soon as they no longer further that goal.
What's really happening is that ICANN has, for the first time, hit a situation where it doesn't get to decide for itself what happens.
As such this Whois/GDPR process is shining a spotlight on the dangerously flawed policy-making process of this critical organization where it keeps insisting on transparently bad policies, keeps putting forward arguments that don't make sense, and keeps trying to bend its own processes to fit with a pre-determined conclusion.
And the Europeans look at it, say No, and the whole facade comes crumbling down. And that is causing massive temporal dissonance at the organization in charge of the internet's naming and numbering systems.
That's what this article is about. And it's unlikely to be the last.
Well then I'm not surprised, if they keep coming back to the point where information is public... no matter what additional things you think of, if the fundamental issue is not solved, I cannot see how it would ever be compliant with any privacy law (either GDPR or even the DPA from 1995).