Re: [regext] Privacy and HR considerations for draft-ietf-regext-verificationcode

[Andrew Newton <[e-mail]>]

I am admittedly not as versed on EPP as others in the wg, but is this
true? From your privacy text:

"This document describes an extension designed to share the data of (or
generated by) a registrant with the Verification Service Provider (VSP),
which is a third party."

The intro section of the draft states:

" The Verification Service Provider (VSP) is a certified party to
   verify that data is in compliance with the policies of a locality.  A
   locality MAY require the client to have data verified in accordance
   with local regulations or laws utilizing data sources not available
   to the server.  The VSP has access to the local data sources and is
   authorized to verify the data.  Examples include verifying that the
   domain name is not prohibited and verifying that the domain name
   registrant is a valid individual, organization, or business in the
   locality.  The data verified, and the objects and operations that
   require the verification code to be passed to the server, is up to
   the policies of the locality.  The verification code represents a
   marker that the verification was completed."

I thought the token was passed by the EPP client (registrar) to the
EPP server (registry), the purpose of which is to show that the
verification occurred before the transaction.

-andy

On Fri, Dec 14, 2018 at 10:37 AM Gurshabad Grover
<[e-mail]> wrote:
>
> Hi,
>
> Thank you for your comments on the proposed Human Rights Considerations
> section. Please find the draft text below (with an accompanying Privacy
> Considerations section which will also be useful); hope it is a good
> starting point for consensus.
>
> Privacy Considerations
> ----------------------
> This document describes an extension designed to share the data of (or
> generated by) a registrant with the Verification Service Provider (VSP),
> which is a third party. The scope of information shared with and stored
> by the VSP is dependent on the policies and regulations of the locality
> and the VSP. The extension has no built-in mechanisms for registrants to
> express preference for what information should shared with the VSP. In
> certain cases, this will lead to the exposure of registrants' sensitive
> personal information directly linked to the identities of the
> individual, such as contained in the contact mapping object, without
> user control. This may impact users' expectation of confidentiality of
> their information. This personal information may be further correlated
> with other data sources available to the VSP.
>
> If a service provider seeks to implement or offer this extension, it
> MUST inform the registrant about about the exact information to be
> shared with the VSP.
>
> Human Rights Considerations
> ---------------------------
> The use of this extension may have negative implications for the human
> rights of potential or actual registrants, depending on the
> implementation and policies used by the registrar and the VSP.
>
> * In particular, the extension might be employed as, or contribute to, a
> domain name filtering and censorship mechanism. This can negatively
> impact registrants' freedom of expression, and may further impede their
> freedom of assembly and association, and social and economic rights.
>
> * Depending on the information shared with the VSP and data sources
> already available to it, the extension may also allow the VSP to
> discriminate against registrants based on registrants' personal
> characteristics, beliefs, or opinions. Even when such restrictions are
> not applied, knowledge of the information being shared with the VSP
> could create chilling effects on registrants' freedom of expression, and
> freedom of association and assembly.
>
> * The VSP may be a third party entrusted to carry out sensitive legal
> decisions. Due to the lack of mechanisms in this extension that can
> facilitate appeal and redressal of a rejection, the registrants' right
> to legal transparency and remedy will also be impacted in such a situation.
>
> Implementers should consider the potential human rights impacts of
> offering and normalising this extension when advertising support for it
> in EPP.
>
> /.
>
> Thanks to Mallory, Niels and Adam for their feedback off-list. The text
> above may not reflect their opinion.
>
> Thank you.
> Gurshabad
>
> _______________________________________________
> regext mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/regext