EUROPEAN COMMISSION Brussels, 11.1.2022 COM(2022) 1 final REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL On the implementation, functioning and effectiveness of the .eu Top-Level Domain from April 2019 to April 2021



Table of Contents 1.Introduction 2.Executive summary 3.The .eu legal framework 4.The .eu Registry 4.1.EURid 4.2.Financial results 4.3.Contractual compliance 4.4.Selection of the next .eu Registry 5.The .eu domain 5.1.General trends 5.2.Impact of the COVID-19 pandemic 5.3.Impact of the United Kingdom’s withdrawal from the EU 5.4.Relation with registrars 5.5.Marketing and communication 5.6.Multilingualism 6.Trust and security 6.1.Stability, security and business continuity 6.2.Security features for .eu domain names

6.3.Data quality and prevention of abusive registrations 6.4.Cooperation in the fight against cybercrime 6.5.Protection of Intellectual Property (‘IP’) Rights 7.Community and international engagement 8.Environmental impact 9.Conclusion

1.Introduction This report concerns the .eu internet domain, the country code Top-Level Domain (ccTLD) of the European Union, and its variants in Cyrillic and Greek scripts, as administered and managed by the non-profit organisation EURid (hereafter ‘the .eu Registry’) on the basis of a Service Concession Contract with the European Commission. Pursuant to Article 8 of Regulation (EC) No 733/2002 of 22 April 2002 on the implementation of the .eu Top-Level Domain, the Commission is required to submit a report on the implementation, functioning and effectiveness of the .eu domain to the European Parliament and the Council every two years. This report covers the period from 1 April 2019 to 31 March 2021 (hereafter ‘the period covered’). 2.Executive summary With 3.7 million registered .eu domain names in April 2021, the .eu domain is the eighth largest ccTLD worldwide. In line with the global and European domain name market, the growth of .eu flattened. The negative growth due to a continued saturation and consolidation of the domain name market and the impact of the UK withdrawal from the EU was compensated by the rise of demand for domain names during the COVID-19 pandemic, driven by organisations and companies switching to online presence. Over the period covered, the .eu Registry allowed EU citizens to register a .eu domain name independently of their place of residence. It expanded European linguistic diversity and multilingualism across the .eu domain by launching .ευ, marking the completion of the efforts to support all EU non-Latin scripts in the .eu TLD. The .eu Registry continued to work on ensuring a trustworthy .eu environment by launching the Abuse Prevention Early Warning System (APEWS), the Know-Your-Customer project (KYC) , and the registrar lock service in 2020. It conducted systematic checks on COVID-19 related domain name registrations during the pandemic. Partnerships were strengthened with law enforcement and other public authorities at both the national and European levels in the fight against illegal activities involving .eu domain names. In 2021, the .eu Registry and the European Union Intellectual Property Office (EUIPO) launched a joint Action Plan to combat abusive and speculative domain name registrations. Overall, the .eu Registry maintained a highly resilient and robust technical infrastructure, ensuring a 100% availability of the .eu domain, also during the Distributed Denial-of-Service (DDoS) attack on the .eu Registry’s platforms and services in spring 2020. 3.The .eu legal framework The .eu TLD is governed by Regulation 733/2002 of the European Parliament and of the Council of 22 April 2002 on the implementation of the .eu Top Level Domain and Regulation (EC) No 874/2004 laying down the public policy rules concerning the implementation and functions of the .eu top-level domain and the principles governing registration. On 18 April 2019, Regulation (EU) 2019/517 of the European Parliament and of the Council of 19 March 2019 on the implementation and functioning of the .eu top level domain entered into force. The regulation will apply from 13 October 2022 and is complemented by Commission Delegated Regulation (EU) 2020/1083 and Commission Implementing Regulation (EU) 2020/857.

4.The .eu Registry 4.1.EURid The European Registry for Internet Domains (EURid) is the .eu Registry operator, responsible for the organisation, administration and management of the .eu domain and its variants in other scripts. EURid was awarded a first service concession contract by the Commission in 2004 and a second contract in 2014, later extended until 12 October 2022. EURid is an association without lucrative purpose established under Belgian law, with its head office in Diegem. EURid’s stated mission is to "create a trusted .eu space for the end-user in a sustainable way through operational excellence, while offering outstanding quality of service to its accredited registrars". EURid has two founding members, DNS Belgium (the .be registry) and the Istituto di Informatica e Telematica (the .it registry), nine other members and a Strategic Board comprised of 13 representatives. At the end of the period covered, EURid had 56 employees. EURid received the CENTR Registry of the Year award in 2019. 4.2.Financial results In the period covered by this report, the .eu Registry’s financial situation was comparable to the previous years. The revenues and costs were respectively € 12.5 million and € 11.6 million for the accounting year 2019, and € 12.3 million and € 11.0 million for the accounting year 2020. The reserves reached € 6 million at the end of 2020. Following approval of the accounts and reserves, the surplus transferred to the European Union budget under the terms of the Service Concession Contract was € 533,775 for the accounting year 2019 and € 2,119,017 for 2020. The transferred surplus for the accounting year 2020 was substantially higher due to a reduction of both costs and reserves. 4.3.Contractual compliance The Commission closely scrutinises the .eu Registry’s financial situation and contractual compliance and exercises its supervisory role by reviewing the yearly audited accounts, the half-yearly and yearly financial reports, the budget proposals, and the strategy and operational plans of the .eu Registry. Financial, operational and other matters are discussed at half-yearly meetings and in ad hoc meetings. Following an ad hoc audit in 2018 on administrative and financial aspects of the .eu management, the .eu Registry implemented all its recommendations in the period covered in this report, aimed at improving the Registry's policy and rules concerning procurement, absence of conflicts of interest, financial management and other issues. Since 2019, the .eu Registry’s activities are assessed on a yearly basis by external auditors selected by the .eu Registry following an open procurement. The 2019 and 2020 audits acknowledged the robustness and redundancy of the .eu Registry technical infrastructure, and the Registry followed up on the auditors’ recommendations by refining relevant policies and procedures. 4.4.Selection of the next .eu Registry On 1 March 2021 the Commission launched the call for the selection of the next Registry of the .eu Top-Level Domain, in accordance with Regulation (EU) 2019/517 and Commission Delegated Regulation (EU) 2020/1083, resulting in the designation of EURid as the next .eu Registry for the period 2022-2027 on 25 October 2021. 5.The .eu domain 5.1.General trends With 3.7 million registered .eu domain names by the end of the first quarter 2021, the .eu domain ranked as the twelfth largest TLD, the eighth largest ccTLD worldwide and the sixth largest member of CENTR (see figure 1). Figure 1: 10 largest ccTLD members of CENTR by the end of Q1 2021

During the period covered, the negative growth due to a continued saturation and consolidation of the domain name market and the impact of the withdrawal of the UK from the EU, was compensated by the rise of demand for domain names during the COVID-19 pandemic. As a result, the .eu portfolio experienced a negative growth of -2% in 2019 but caught up in 2020 with a positive growth of 2.2% comparable to the global and European domain name market. Overall the .eu Registry maintained a slightly positive growth in the period covered in this report (see figure 2). Figure 2: .eu registrations by quarter till the end of Q1 2021 (Source EURid) From all EU countries, Germany had the largest share of .eu registrations at the end of the first quarter of 2021 (see figure 3). In the period covered the three countries showing the highest growth were Portugal (124.2%), Ireland (78.7%) and Latvia (33.3%). Figure 3: Top 10 EU countries with highest number of .eu registrations end of Q1 2021 (Source EURid) 5.2.Impact of the COVID-19 pandemic Despite the disruptive effect of the pandemic, the .eu Registry maintained the same level of service, leaving the .eu domain unaffected. As a side effect of the pandemic, the domain name market saw a higher demand, driven by organisations and companies switching to online presence. However, the pandemic also saw an increase of malicious or otherwise criminal online activities. In order to protect the .eu domain from abusive or malicious registrations linked to COVID-19, the Commission and the .eu Registry agreed to introduce extra verification measures on existing and newly registered domain names against a set of COVID-related keywords such as ‘corona’ or ‘vaccine’, translated in all EU languages. Nearly 9000 checks were executed from April 2020 till the end of Q1 2021, leading to the suspension of more than 6500 domain names. 5.3.Impact of the United Kingdom’s withdrawal from the EU From 1 January 2021, United Kingdom (UK) residents and undertakings and organisations established in the UK were not eligible anymore to hold a .eu domain name. In 2019 and 2020, the Commission and the .eu Registry regularly informed UK registrants and their registrars about their forthcoming loss of eligibility. On 1 January 2021, the .eu Registry suspended the still remaining UK domain names, stopping the domain names to resolve into a website or support email services. The impact of UK’s withdrawal from the EU has been substantial on the .eu domain. From an initial 240,000 domain names registered in the UK (2018), the figure dropped to 190,000 at the end of Q1 2019, and on 1 January 2021 all still remaining domain names (81,000) were suspended. 5.4.Relation with registrars The .eu Registry continued to strengthen and improve its relation with registrars, who are instrumental in marketing the .eu domain names and interacting with individual registrants. The 2019 registrar satisfaction survey showed that 97% of the registrars are overall satisfied with the .eu Registry. At the end of the first quarter of 2021, there were 718 accredited registrars; a number that remained relatively stable over the past years. The increase of new accredited registrars following outreach actions of the .eu Registry compensated for the decline of registrars due to increased concentration in this sector. The .eu Registry continued to count on the advice of its Registrar Advisory Board, providing the Registry with input on policy matters and initiatives to support the .eu. 5.5.Marketing and communication In line with its mandate to help enhance the Union identity, promote Union values online and to establish the .eu as a brand clearly linked to the EU, the .eu Registry undertook the following marketing and communication activities:

–An Action Plan launched in 2020 to support SMEs to boost their online presence, in cooperation with FundingBox, the European Enterprise Network (EEN), EUIPO and SMEunited. –Two awareness campaigns per year with trust.eurid.eu as landing page where end-users can find information about the registration of.eu domain names and the security and branding features that distinguish the .eu product. –The partnership with .eu accredited registrars via the .eu Registry Co-funded Marketing Programme, through which registrars receive reimbursements of up to 100 % of the eligible costs of promotional actions for .eu domain names. In the period covered, the Programme co-financed 134 campaigns. –The continuation of the Reduction Scheme for registrars, offering registrars a reduction on the fees for new registrations. By the end of 2020, 330 registrars were subscribed to the Reduction Scheme, accounting for 98% of all new .eu registrations. –The continuation of the yearly Web Awards to acknowledge innovation and excellence among users of .eu domain names. –The involvement in the Codeweek and the development of the SAFEonLINE Art Competition, aiming to complement the .eu Registry’s educational and awareness activities in the field of online security with a uniquely creative outlook. –The structured management of the .eu Registry social media presence, in particular through its Twitter account and YouTube channel, which reached over 3 million view in 2020. 5.6.Multilingualism The .eu Registry remains a frontrunner on European linguistic diversity and multilingualism, and offers one of the largest IDN spaces in the world. At the end of the first quarter of 2021, there were over 42.000 IDN registered, and 1300 and 2700 domain names registered respectively under the .ею, the equivalent of .eu in Cyrillic script and .ευ, the equivalent in Greek script (see figure 4). The launch of the .ευ extension on 14 November 2019 marked the successful completion of a lengthy process within ICANN to have the two .eu extensions in non-Latin scripts approved. Following industry best practices to prevent possible confusing similarity issues between .ευ and other TLDs, the .eu Registry launched in parallel a transition period to migrate all existing domain names in Greek script to the new extension .ευ, to be finalised on 13 November 2022. Figure 4: IDN registrations till the end of Q1 2021 (source: EURid) 6.Trust and security 6.1.Stability, security and business continuity The .eu Registry provided for a 100% availability of the .eu, .ею and .ευ domains during the period covered by this report, mainly due to a high quality, distributed, redundant and up to date DNS infrastructure. Two authoritative name servers are deployed in Amsterdam and Ljubljana, supported by three external Anycast service providers for redundancy and resilience purpose. The Registry’s administrative processes are supported through redundant technical infrastructure in Amsterdam and Luxembourg. In Q4 2019, BIPT, the Belgian federal regulatory body responsible for regulating the electronic communications market in Belgium concluded that the .eu Registry is an Operator of Essential Services (OES) according to the NIS Directive, as transposed in Belgian law. The .eu Registry’s previous reliance on ISO and its cybersecurity certifications already laid the foundation to comply with its new legal obligations under NIS. The .eu Registry experienced a heavy Distributed Denial-of-Service (DDoS) attack in spring 2020, targeting its platforms and websites. With the exception of short time intervals, the registration and Whois lookup services remained available thanks to the cooperation between the .eu Registry and its connectivity partners, managing to stop malicious traffic on the borders of the network. The .eu domain itself was unaffected by this attack. 6.2.Security features for .eu domain names At the end of Q1 2021, there were over 577,000 DNSSEC signed .eu domain names, representing nearly 16% of the overall .eu portfolio. The percentage is increasing gradually thanks to the combination of fee discounts and webinars for registrars raising the awareness about the importance of DNSSEC. 2020 also saw the introduction of the registrar lock service, an extra protection layer to prevent accidental or non-authorised and possible malicious changes of the ownership of .eu domain names.

6.3.Data quality and prevention of abusive registrations Maintaining accurate, complete and up-to-date registration data is essential to maintain the security, safety and stability of the .eu domain. The .eu Registry therefore continued its efforts to improve the quality of its registration data through the WHOIS Quality project, leading to the suspension of 27,000 domain names in the period covered in the report. To maximise the effect of measures taken, the .eu Registry deployed, where possible, automated processes to speed up the data checking processes, and registrar and registrant friendly methods to lower the barriers for its use. The Abuse Prevention and Early Warning System (APEWS) was launched in the second half of 2020, to evaluate patterns of domain name registration based on an innovative machine learning methodology developed in cooperation with the University of Leuven. APEWS predicts whether a domain name may potentially be used in an abusive manner, resulting in delaying the delegation of suspicious registrations and triggering a verification procedure, requiring domain name holders to confirm their registration data, followed by a manual review leading to the delegation or the suspension of the domain name. In the period covered in this report, 11,000 registrations were checked via the APEWS system. APEWS is well recognised by industry peers and received the ECO 2019 award. In Q1 2021, the Know-Your-Customer (KYC) project was launched, allowing registrants to provide evidence of their identity using automated systems via the EURid portal, including the option of using their eID. This offers a potentially powerful, fast and user-friendly option for identification and authentication purposes. The .eu Registry will continue developing this project, also taking into account the development of a trusted and secure European eID. 6.4.Cooperation in the fight against cybercrime The .eu Registry continued to provide regular assistance to law enforcement and other relevant authorities aiding them in the fight against illegal activities involving .eu domain names. This encompassed cooperation with the Belgian Federal Ministry of Economic Affairs, the Belgian Customs (Cybersquad) and the Belgian Public Prosecutor’s Office, engaging in regular dialogue with the Computer Emergency Response Team for the EU (CERT-EU), and cooperating with Europol by exchanging statistical data and trends, running joint projects aimed at combatting cybercrime, and holding joint workshops. The .eu Registry also cooperated with industry associations and other organisations involved in the fight against abusive registration. An example is the partnership the .eu Registry signed in Q1 2021 with the Global Cybercrime Alliance, a non-profit that builds programs, partnerships and tools to contribute to a safer and more trustworthy internet environment. 6.5.Protection of Intellectual Property (‘IP’) Rights The .eu Registry continued its fruitful cooperation with EUIPO to notify trade mark holders when a .eu domain name is registered that is identical to a registered EU trademark. In 2020, the two organisations intensified their collaboration to support trade mark and domain name applicants and owners, particularly SMEs. In July 2021, a joint Action Plan was launched following the recommendation of the EC Report on the cooperation between the .eu Registry with EUIPO and other Union agencies with a view of combating abusive and speculative domain name registrations . The .eu Alternative Dispute Resolution (ADR) provides the possibility to submit a complaint online in any of the official languages of the EU via the two ADR providers, the WIPO Arbitration and Mediation Center and the Czech Arbitration Court (CAC). In the period covered in the report, the discount on the basic .eu ADR procedure fee was continued. 170 complaints were filed and 131 disputes were resolved; 87 by CAC and 44 by WIPO. 7.Community and international engagement During the reporting period, the .eu Registry continued to engage with the internet’s international community, in particular through the following actions and activities: –As an active participant in ICANN meetings, the .eu Registry has been chairing the ccNSO Strategic and Operating Committee since 2015, aiming at providing advice and input to ICANN on the yearly and long-term Strategic and Operational Plans. –The .eu Registry provided its expertise to develop a Disaster Recovery and Business Continuity Playbook for small ccTLD operators within ICANN. This work was well received, in particular because small registries have limited resources to develop such plans. –The .eu Registry launched the Dynamic Coalition on Data and Trust in June 2020 within the IGF . The Coalition aims to encourage proactive interventions and effective industry self-regulation to raise standards of data quality, combat poor data and disinformation, and to raise public trust in the Internet. The focus in 2020 was on industry responses to the COVID-19 crisis. –The .eu Registry cooperated with UNESCO, the .ru ccTLD registry and the regional registry organisations through the ICANN Universal Acceptance working group to promote and support online multilingualism, leading to the yearly IDN World Report. –The .eu Registry continued the .eu Academy through which experts of the .eu Registry gave trainings and courses on registry matters, Internet Governance and cyber-security matters to industry peers, government representatives and at various European universities. –The .eu Registry supported EuroDIG sessions and the Youth IGF for which it contributed to revamping their TV channel. –In 2020 the Youth Committee was established, an advisory body that provides advice and youth's perspective on the .eu Registry’s approach to Internet Governance, as well as on its initiatives and policies.