ICANN Publish Data Retention Waiver Details

ICANN has published details of the process that registrars signing the 2013 RAA will need to follow in order to be granted a waiver.

Under the 2013 contract registrars will have to collect and retain a lot more data in relation to their customers, which could be in conflict with national laws governing data protection and data privacy.

The process that ICANN has outlined will require the registrar to get a legal opinion from a “nationally recognised law firm” (no, I’ve no idea what that is either) or written guidance OR ruling from a governmental body in their jurisdiction. Of course if another registrar has already been granted a waiver in the same jurisdiction they’ll be able to rely on that.

Assuming that ICANN’s legal team accept the waiver request as being legitimate it’ll then be posted to ICANN’s public site for 30 days.

Here’s the full process they’re planning to use:

Registrar submits request using form provided at icann.org.
Registrar Relations team member reviews request for completeness
If complete, request moves forward.
If not complete, request is sent back to registrar for further information.
Registrar Relations team member determines whether an identical request (same RAA provisions, same jurisdiction) has been approved for another registrar or is currently under review.
If a previous, identical request was approved, RR team member will approve request after obtaining confirmation with legal counsel, and proceed to step 8 below.
If a previous, identical request was rejected, RR team member will forward new and previously rejected request to legal counsel to determine whether new issues have been raised or information presented (or whether there has been a change in law) that warrant reconsideration. Proceed to next step.
If identical request is currently under review, the consideration of the requests will be combined, if practical.
If request has never been evaluated before, it proceeds to next step.
Registrar Relations team, in consultation with legal counsel as appropriate, will evaluate the request and may consider the merits of the submitted documents (on their face or with additional research) and, additionally, may consult with relevant experts (such as privacy law experts, legal authorities, GAC members, law enforcement representatives, etc.). ICANN may request additional information from the registrar.
Preliminary Determination:
If the waiver request is preliminarily approved, ICANN will provide a summary of the determination (including the involved law(s) and RAA provision(s) to the registrar. Proceed to step 6
If the waiver request is preliminarily rejected, ICANN will provide a written explanation of the preliminary determination to the registrar with an invitation to either discuss the matter or provide rebutting information within two weeks. If new information is provided, it will be reconsidered as described in Step 4. Otherwise, proceed to Step 6.
ICANN will post the preliminary determination to its website. The post will also include the preliminary determination date and the date upon which the preliminary determination will become final if not modified or rescinded. Once posted, the determination may also be flagged for inclusion in myicann.org. If approval was granted based on prior determination (Step 3(a) above), nothing new will be posted to icann.org.
After 30 days have lapsed since posting, unless modified or rescinded, the preliminary determination will become final. ICANN will notify the registrar accordingly.
ICANN’s Registrar Relations staff will notify the Compliance team of the approved waiver and record same.
Registrars will be required to periodically reaffirm that the pertinent law has not materially changed and that the conflict still exists. If feasible, RR team might send reminder notices. If ICANN becomes aware of a change of law, it may affirmatively address the matter with any registrar who was granted a waiver.

So, being optimistic, the minimum amount of time it would take to process a request is probably 45 – 60 days, though it could easily be longer.

It’ll be interesting to see how this process works “in action” and how long it actually takes.