Confused about GDPR and Who is

Question

Exactly how does it work with GDPR and Who is? I live in the Netherlands and have a .com domain at Namecheap. According to the Namecheap support, my data becomes public in Who is if I disable their Who is Guard. However, I read online that Who is data of EU citizens will not be made public How does this work? I know that Who is Guard is nowadays free at Namecheap, but I'm curious. This can also be useful to know if I ever want to transfer my domain to another registrar.

Answer 1

The subject of your question is complicated, and can not be resumed in a few sentences.

In summary, GDPR is still new to many entities, and there is still some phases of adaptation. ICANN (who controls what gTLDs can or can not do) took a lot of time to accept that GDPR won't go away and had to finally take it into account. It created a "temporary specification" for which you can get details at https://www.icann.org/resources/pages/gtld-registration-data-specs-en. Which is why, for now, if you look at any gTLD registry whois reply, you will mostly see no personal data, no more emails, names, addresses, etc. But this is "temporary". Of course not everyone is happy with that: LEAs, IP lawyers and others want very much to go back to the old model... It may (it will) appear in fact, because whois will slowly be phased out by RDAP (which is mandatory in the gTLD world since August 2018), and RDAP being built on a saner design, can allow (where whois couldn't) far more easily to put tiered access, that is to have an authentication layer and hence change the amount of results given (with or without personal data, and how much) depending on who queries. But we are far from a working model on that stage.

For ccTLDs, each registry has to decide what to do, things are not clear cut. You will find some that err towards the side of "let us not show anything, or almost anything at all", for example .de (you do not even see the registration date anymore...), and then others do completely the opposite, like .IS (http://domainincite.com/22939-iceland-breaks-ranks-on-whois-will-publish-emails : "Iceland’s ccTLD has become what I believe is the first registry to state that it will continue to publish email addresses in public Whois records after the General Data Protection Regulation comes into effect.")

So you can find various articles explaining how the GDPR killed whois, such as:

• WHOIS The First Casualty Of GDPR?
• Will May 2018 be the death of Whois?
• How all 33 European ccTLDs are handling GDPR

Now you raise another important point about "privacy products" from some registrars.

In many (but not all) TLDs, and at least in gTLDs, you have a registry/registrar model: one registry, multiple registrars.

A customer goes to one registrar, gives it all its data (including personal one, and paying for the domain), the registrar stores it locally, also sends it or part of it to the registry, that stores it on its side.

This model may then has the consequence (at least because ICANN decided so, but there is mostly no technical reason for that, as the last thin registry in gTLD world will "soon" be thick like all the others) that there is in fact two whois servers (or RDAP ones for that matter) for a given domain name: one at registry side, one at registrar side.

Of course each server replies with data that is stored locally, but that explains why each one may not answer with the same data. Because if you take/buy some registrar (or third party) "privacy" service here is what happens:

• you give your personal data to the registrar; it is stored in its database
• the registrar sends to the registry ANOTHER set of personal data, a blank "privacy" one; in that way of doing things, the registry never sees the "real" data (which has its own set of consequences, because with that the registry can not even know who is the real registrant)
• so if you query the registry whois/RDAP server you will get "privacy" data at most and not the real one,
• and if you contact the registrar whois/RDAP server, while technically it has locally the real data, because you enabled that privacy service, the registrar will reply with this privacy data instead of the real one.

And then as said above, on top of a given set of data that should have been given, recent changes due to GDPR, "scrub" the data and basically creates almost empty results.

This is indeed something to take into account if you want to transfer domains between registrars. A previous ICANN rule for example, in gTLDs, mandated registrars to get formal and explicitly positive acknowledgment (through some specific emails called FOA for Form Of Authorization) from registrant/admin contact before being able to go forward with a transfer request. This data was mostly taken out of whois by registrars, but of course now that the whois reply is almost devoid of substance, this can not work anymore (and hence transfers go back to their previous model were the sole possession of the "authInfo" value for the domain was enough to prove ownership of it and hence start transfers).

Typically registrars will ask you to provide new contact data if you decide to do a transfer as they won't be able to collect it from current setup. When a transfer happens, nothing changes at the registry level, except who is the registrar. As soon as the transfer completes, the new registrar is (mostly) free to change all data, including contacts (but see new ICANN regulations that treat a registrant change mostly the same as a registrar change, with various checks and periods), and then apply again, or not (depending on what the registrar provides and what the customers chose) some privacy service as explained above.

Going back to:

I live in the Netherlands and have a .com domain at Namecheap. According to the Namecheap support, my data becomes public in Who is if I disable their Who is Guard.

Specifically in .COM, this is still a thin registry, which means the registry DOES NOT have the contact data (the registrar NEVER sends it to the registry). This will change, it is planned (but postponed more than once, the issue is obviously intertwined with everything discussed previously), but it is like that today. So if you do a whois query for a .COM at the registry you will never see contact data, no matter what service you enable or disable at the registrar level because the registry has no contact data at all for the domain.

Now at the registrar level, they are "free" to do what they want, I mean they can have their own interpretation of GDPR, how much it applies to them or not, etc.

At least on one of their page they say this:

When you register a domain, ICANN requires registrars to provide them with your contact information (such as name, email, address, and phone number). This is then added to the Whois database. This database lists the owners of every domain name online, and it can be searched by anyone on the Internet.

It is not very clear to me or maybe slightly wrong: I do not know who is "them" in first sentence, but if that is meant to be ICANN then it is completely wrong, ICANN has no operational role in day to day registrations, so they have no data. Also there is no "Whois database" even if everyone makes this error. whois is a protocol to query data. The database queried by it sits at a registry or registrar, and is not a "whois database" in the same way that you use HTTP to contact webservers but that does not make websites suddenly "HTTP databases". But even outside of that, it can not really be "searched". whois is a query protocol (RDAP too, and has extensions for real search capabilities but it is yet to happen for anyone to implement that for obvious technical and non technical consequences of that), you ask details about a specific domain. You can not ask details about a specific registrant name, or address or phone numbers or whatever. There are various services online providing such kind of "reverse searches" (like: give me the list of domain names owned by "Foo Bar Inc."), and how they do it? They do whois queries, store results (in a "database" also), and hence can provide searches in it, but with various limitations (whois is ratelimited, their data will never be fresh, multiple TLDs are against that, see https://www.domainpulse.com/2019/06/25/domaintools-appeals-to-seek-to-continue-flouting-nz-whois-terms-of-use/, etc.)

So I have no idea what happens if you do not use "WhoisGuard". Your provider should be able to clearly explain the situation for you, and if not or if you are not happy with its answer, it will certainly be a good time to shop around for another one.