The purpose of this advisory is to assist ICANN-accredited registrars in understanding what has been referred to as the "15-day period" relating to Whois data-accuracy requirements. Recent discussion concerning recommended changes to ICANN Whois policies indicate that the current requirements may be frequently misunderstood. The following advisory is intended to promote a clearer understanding of the current requirements.
Subsection 184.108.40.206 of the current (May 2001) Registrar Accreditation Agreement requires that registrars include in the registration agreements they enter with their customers a provision that permits the registrar to cancel a domain-name registration in either of three circumstances:
- The customer's "willful provision of inaccurate or unreliable information";
- The customer's "willful failure promptly to update information provided to" the registrar; or
- The customer's "failure to respond for over fifteen calendar days to inquiries by Registrar concerning the accuracy of contact details".
In their registration agreements with registrars, customers promise to provide "accurate and reliable contact details and promptly correct and update them during the term of the . . . registration." (Subsection 220.127.116.11 of the Registrar Accreditation Agreement.) Conditions (1) and (2) above authorize registrars to cancel domain-name registrations for willful breaches of these promises.
Condition (3) above, it should be noted, is only triggered when the customer fails to respond to an inquiry; it is not triggered when the customer responds to the inquiry but does not complete any corrections to inaccurate or out-of-date Whois data within 15 days. Unlike conditions (1) and (2), which require willful transgressions on the part of the customer, condition (3) is triggered without a showing that the customer's failure to respond is willful, in recognition that the ability to prove willfulness can be frustrated by a customer's refusal to engage in dialog with the registrar.
Subsection 18.104.22.168 of the Registrar Accreditation Agreement does not require a registrar to cancel a registration in the event a customer fails to respond within 15 days. The accreditation agreement's approach of requiring the registrar to retain the right to cancel if the customer fails to respond in 15 days, but not requiring the registrar to exercise that right is intended to give the registrar the flexibility to use good judgment to determine what action should be taken upon a customer's failure to respond to an inquiry about a Whois inaccuracy. This approach recognizes that the appropriate course of conduct for a registrar that does not receive a response from a customer with inaccurate data varies depending on a variety of factors – including the materiality and severity of the inaccuracy, the customer's past conduct with respect to correcting inaccuracies, the extent of harm to third parties, etc.
Where an inaccuracy is minor (e.g., an incorrect postal code), appears inadvertent (e.g., transposed digits), and harms no third party (e.g., readily available means of contacting and locating the customer are provided by the data that is given), a registrar can appropriately conclude that much more than 15 days should be allowed before the registration is cancelled. In such cases the registrar, which after all seeks to promote good relations with its customer, has no motivation to act precipitously. On the other hand, where a registrar encounters a severe Whois inaccuracy being exploited by a registrant to evade responsibility for fraudulent activity being carried out through use of the domain name, prompt action by the registrar is appropriate. Under the approach of the Registrar Accreditation Agreement, the registrar is given discretion to act as appropriate in light of the particular circumstances of each case.
In determining how long to wait for a customer response to an inquiry about a Whois inaccuracy before canceling the registration, a registrar should take guidance from subsection 3.7.8 of the Registrar Accreditation Agreement. That subsection defines the registrar's obligation to correct inaccurate Whois data:
"Registrar shall, upon notification by any person of an inaccuracy in the contact information associated with a Registered Name sponsored by Registrar, take reasonable steps to investigate that claimed inaccuracy. In the event Registrar learns of inaccurate contact information associated with a Registered Name it sponsors, it shall take reasonable steps to correct that inaccuracy."
This requirement that registrars "take reasonable steps" is intended to reinforce the flexibility afforded to registrars that do not receive responses from their customers. As noted above, the time that a registrar should wait for a response from its customer varies according to the nature of the inaccuracy and the circumstances from which it arose. This contractual approach is based on the conclusion that a requirement of reasonable action by the registrar is better than a fixed timetable, while assuring that the registrar has the ability to cancel after 15 days of no response in very serious cases.
These features of the Registrar Accreditation Agreement were previously discussed in the 10 May 2002 "Registrar Advisory Concerning Whois Data Accuracy", which states in part:
"Once a registrar receives notification of an inaccuracy, Subsection 3.7.8 requires the registrar to take "reasonable steps" to investigate and correct the reported inaccuracy. The term "reasonable steps" is not defined within the agreement; precisely what constitutes reasonable steps to investigate and correct a reported inaccuracy will vary depending on the circumstances (e.g., accepting unverified "corrected" data from a registrant that has already deliberately provided incorrect data may not be appropriate). At a minimum, "reasonable steps" to investigate a reported inaccuracy should include promptly transmitting to the registrant the "inquiries" concerning the accuracy of the data that are suggested by RAA Subsection 22.214.171.124. The inquiries should be conducted by all commercially practicable means available to the registrar: by telephone, e-mail, and postal mail."
Under this guidance, ICANN reviews registrar compliance based on a standard of reasonable conduct by the registrar in the circumstances. Where, for example, a registrar appears to "to routinely ignore reports of inaccurate and incomplete contact data in its Whois database", ICANN has taken enforcement action by presenting the registrar a formal notice of breach. See Letter from Louis Touton to Bruce Beckwith (3 September 2002). Where such a notice of breach is presented, subsection 5.3.4 of the Registrar Accreditation Agreement gives the registrar 15 working days to cure the breach before proceedings to terminate the accreditation can proceed. This 15-working-day period, however, is a different one than the 15-calendar-day period after which cancellation of a registration becomes possible under a registration agreement due to a customer's failure to respond to the registrar's inquiry about Whois inaccuracies.
In summary, registrars have the right to cancel a registration if a customer fails to respond within 15 days to an inquiry concerning Whois data accuracy, but registrars also have flexibility to decide when to use that right depending on factors including whether the inaccuracy appears intentional and whether third parties are being harmed by maintaining the registration with inaccurate data. Registrars are obligated to take reasonable action to correct reported Whois inaccuracies, but are not bound to a fixed timetable.