Minutes of the Meeting of the CIRA Board of Directors held via teleconference on May 7, 2008, at 3:30 p.m. Ottawa time.
Directors attending: Paul Andersen, Annette Cyr, John Demco (ex-officio and Secretary), Heather Dryden (ex-officio), Christopher Goodfellow, Robert Ford, Byron Holland (ex-officio), Ron Kawchuk, Lynne Mackan-Roy (Vice-Chair), Ross Rader, Bill Reid, Debi Rosati (Chair), Jeff Rybak, Rick Sutcliffe
Regrets: Richard Anderson
Guests: Albert Chang (CIRA), Michael Stewart (CIRA)
Recording Secretary: Lynn Gravel (CIRA)
1. Approval of Agenda
Be it resolved that the agenda be adopted as presented.
(Moved: L. Mackan-Roy, seconded: R. Rader)
R. Ford joined the meeting
2. WHOIS Status and Issue Update
B. Holland provided the Board of Directors with a summary of WHOIS issues and referenced Section 6 of CIRA’s Privacy Policy which permits disclosure of Individual Registrant’s information to third parties through two mechanisms: a Court Order or pursuant to PIPEDA:
6. Disclosure
…We will disclose personal information, other than via the WHOIS, as stated below, and the “Registration Information Access Rules and Procedures”, as explained above, only:
(a) in the event that a law enforcement agency, court of competent jurisdiction, tribunal, judicial board, administrative body, judicial commission, or any other judicial body of competent jurisdiction requests personal information by way of an order, ruling, decision, subpoena, warrant, or judgment; or
(b) pursuant to the Personal Information Protection and Electronic Documents Act S.C. 2000, c. 5;…”
B. Holland noted that in some limited instances a Court Order is unreasonably expensive and time consuming and exposes CIRA to undue liability and risks, and that staff is of the view that it is imperative to properly document the implementation process for Section 6 (b) of the Privacy Policy [permitted disclosure pursuant to PIPEDA].
B. Holland proposed that as part of the implementation of the Privacy Policy and WHOIS, and to ensure compliance with PIPEDA, a procedure be documented which allows disclosure under certain limited and specific circumstances. It was noted that since this procedure is consistent with Section 6 (b) of CIRA’s Privacy Policy, no changes to the Privacy Policy or other CIRA policies would be required. B. Holland advised the board that this was strictly an issue of implementation. Furthermore, PIPEDA required that a process be in place for the disclosure of information and Section 6(b) of the Privacy Policy [permitted disclosure pursuant to PIPEDA] was meaningless without a documented procedure.
B. Holland noted that under this proposed mechanism, CIRA would disclose the name of the Registrant and the contact details for the administrative and technical contact only to requestors who are clearly able to establish that they have a legitimate reason for access to this information and backed by supporting documentation. Supporting documentation would consist of independent or third party proof or validation showing that the requestor has a legitimate reason for access to WHOIS information. Staff foresees two categories of issues: 1) the domain name violates an intellectual property right of the requestor; and 2) the domain name gives rise to a personal claim such as identity theft. Registrants would be advised of this process and consent to it in advance.
Certain members of the Board of Directors raised concerns that this process implied a policy change inconsistent with a previous Board’s original intent and that the process favoured one group over the others. For example, it involved giving administrative process driven disclosure to intellectual property rights holders in advance of other groups such as law enforcement.
M. Stewart stated that he believed this was not a policy change per se. Instead, the proposed change accomplished two goals: defining a process for the existing Section 6(b) of the Privacy Policy, and mitigating the risks posed in Section 6(a). As Section 6(b) provides that CIRA will disclose personal information pursuant to PIPEDA, he felt it was necessary to establish a process for disclosure in order to make this section meaningful. Furthermore, PIPEDA required that a process be in place. Staff believes that the original intent, as is, is valid and reasonable, but that PIPEDA demands a process for disclosure to support Section 6(b).
Staff also noted that they were working in parallel with other groups, namely, law enforcement, with respect to the circumstances in which CIRA will disclose Registrant information. In this regard, the processes for disclosure of WHOIS information for private parties and for law enforcement were working in parallel, and one group was not being favoured over the other.
A. Chang, L. Gravel, B. Holland and M. Stewart withdrew from the meeting and the Board of Directors held an in camera session.
J. Rybak joined the in camera session.
Following the in camera session, A. Chang, L. Gravel, B. Holland and M. Stewart rejoined the meeting.
Concern was expressed that there was not enough time to properly review the implementation procedure with CIRA’s numerous stakeholders. Furthermore, certain of the Board members were of the recollection that it had been decided that Registrant Information would only be disclosed pursuant to a Court Order, irrespective of Section 6(b) of the Privacy Policy, and the requirement of PIPEDA for a disclosure notification and process. In their view, the disclosure of Registrant information without a Court Order was a policy change, which required CIRA to go through the Policy Development Process.
Staff noted that this position contradicted the wording in Section 6(b) of the Privacy Policy. Staff highlighted that the Board had agreed to a Privacy Policy which included Section 6(b) [permitted disclosure under PIPEDA]. Accordingly, it was necessary to document the procedure for disclosure in advance in order to make this section meaningful, and to be compliant with PIPEDA which required that a documented procedure be in place. Given this contradiction, certain members of the Board of Directors discussed deleting Section 6(b), as this was contrary to the intention of a previous Board that Registrant information would only be disclosed pursuant to a Court Order. Staff was requested to look into what would be required in order to delete Section 6(b) of the Privacy Policy, and to report back to the Board.
There was considerable debate between the Board and staff over staff’s proposed implementation procedure where certain of the Board members were of the view that staff was moving too quickly. R. Ford and other Directors suggested that the scheduled June 10th “go live” date for the WHOIS implementation be delayed to complete discussions with Industry Canada and the RCMP. It was suggested that the timelines are now very short and important implementation issues have been raised which need to be properly flushed out and debated. A discussion was held on the advantages and disadvantages of delaying implementation. Several directors and B. Holland commented against delaying implementation given the impact that would have on the WHOIS rollout and CIRA’s credibility, especially given the prior delays. Staff indicated that they felt the discussions with Industry Canada and the RCMP could be properly completed in time for the currently scheduled June 10th implementation. The Board of Directors proposed that staff proceed with the implementation of the new WHOIS on June 10, 2008, with expedited public consultations conducted at the same time on the issue of disclosure of Registrant information. Staff noted that if this was the plan, this meant that there could not be any disclosure exceptions in the interim for any particular stakeholder, and that the discussions with groups such as law enforcement would have to be deferred and be part of the public consultations.
3. Adjournment
The meeting was adjourned at 6:00 p.m. and it was agreed to reconvene on May 9, 2008 at a time to be determined.
