[regext] Privacy and HR considerations for draft-ietf-regext-verificationcode

[Gurshabad Grover <[e-mail]>]

Hi,

Thank you for your comments on the proposed Human Rights Considerations
section. Please find the draft text below (with an accompanying Privacy
Considerations section which will also be useful); hope it is a good
starting point for consensus.

Privacy Considerations
----------------------
This document describes an extension designed to share the data of (or
generated by) a registrant with the Verification Service Provider (VSP),
which is a third party. The scope of information shared with and stored
by the VSP is dependent on the policies and regulations of the locality
and the VSP. The extension has no built-in mechanisms for registrants to
express preference for what information should shared with the VSP. In
certain cases, this will lead to the exposure of registrants' sensitive
personal information directly linked to the identities of the
individual, such as contained in the contact mapping object, without
user control. This may impact users' expectation of confidentiality of
their information. This personal information may be further correlated
with other data sources available to the VSP.

If a service provider seeks to implement or offer this extension, it
MUST inform the registrant about about the exact information to be
shared with the VSP.

Human Rights Considerations
---------------------------
The use of this extension may have negative implications for the human
rights of potential or actual registrants, depending on the
implementation and policies used by the registrar and the VSP.

* In particular, the extension might be employed as, or contribute to, a
domain name filtering and censorship mechanism. This can negatively
impact registrants' freedom of expression, and may further impede their
freedom of assembly and association, and social and economic rights.

* Depending on the information shared with the VSP and data sources
already available to it, the extension may also allow the VSP to
discriminate against registrants based on registrants' personal
characteristics, beliefs, or opinions. Even when such restrictions are
not applied, knowledge of the information being shared with the VSP
could create chilling effects on registrants' freedom of expression, and
freedom of association and assembly.

* The VSP may be a third party entrusted to carry out sensitive legal
decisions. Due to the lack of mechanisms in this extension that can
facilitate appeal and redressal of a rejection, the registrants' right
to legal transparency and remedy will also be impacted in such a situation.

Implementers should consider the potential human rights impacts of
offering and normalising this extension when advertising support for it
in EPP.

/.

Thanks to Mallory, Niels and Adam for their feedback off-list. The text
above may not reflect their opinion.

Thank you.
Gurshabad