EUROPEAN COMMISSION Brussels, 18.12.2015 COM(2015) 680 final REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the implementation, functioning and effectiveness of the .eu Top-Level Domain (Text with EEA relevance)



REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the implementation, functioning and effectiveness of the .eu Top-Level Domain (Text with EEA relevance) 1.Background In April 2015, the .eu Top-Level Domain (TLD) celebrated its 9th anniversary. Over the past nine years, the .eu country code TLD profiled itself as an innovative and modern extension, very much able to catch up both with the TLDs which have been in the domain environment since the late nineties and to compete with the new generic Top-Level Domains (gTLDs) that have been introduced in 2014. At the end of the first quarter of 2015 (Q1 2015), the .eu TLD was the sixth largest country code TLD (ccTLD) in the world. With almost four million registrations, the .eu TLD has become a valued option for Europeans when choosing a domain name for their Internet presence. In line with Article 8 of Regulation (EC) No 733/2002 on the implementation of the .eu TLD, the Commission is required to submit a report to the European Parliament and the Council one year after the adoption of the Regulation and every two years thereafter. This report to the European Parliament and the Council concerns the implementation, effectiveness and functioning of the .eu TLD over the past two years, in particular during the period from 1 April 2013 to 31 March 2015. 2.The .eu legal framework and basic principles The .eu TLD was established by the following legal acts: –Regulation (EC) No 733/2002 of the European Parliament and of the Council of 22 April 2002 on the implementation of the .eu Top Level Domain (as amended); –Commission Regulation (EC) No 874/2004 of 28 April 2004 laying down public policy rules (PPR) concerning the implementation and functions of the .eu TLD and the principles governing registration (as amended). In the reporting period, Commission Regulation (EU) No 516/2015 amended Regulation (EC) No 874/2004 by introducing technical checks to prevent possible visual confusion between registered .eu domain names, particularly considering the .eu Internationalised Domain Names (IDNs) supported since December 2009, to: ensure that the Registry verifies the validity of the registration applications prior to, not only subsequently to, the domain name registration, allow the Registry to introduce extra characters supported by the IDNA2008 protocol and to update the list of domain names reserved by the EU and Iceland, Liechtenstein and Norway. In May 2013, in accordance with Regulation (EC) No 733/2002, the Commission published a call for expression of interest for the selection of the .eu TLD Registry. The call was closed on 20 June 2013. The only application received was from EURid. The evaluators concluded that the EURid proposal met the minimum requirements for each of the selection criteria. The Commission Decision designating EURid as the .eu TLD Registry was published on 12 April 2014. 3.Registration and use of .eu domain names In the period covered by this report, the .eu ccTLD continued to grow steadily in line with the other European ccTLDs. In 2014 the .eu annual growth was exceptionally high (5.3%). The .eu ccTLD had a total of almost 3.9 million registrations at the end of Q1 2015, representing a 4.3 % net increase of .eu registrations since the last report and making the .eu ccTLD the fourth most popular in the EU.

The average renewal rate of .eu domain names remains 80%, which is a very healthy rate compared with the industry average of 73%. The domain name landscape has changed dramatically in the past two years because of the introduction of new gTLDs following the opening of the gTLD space by the Internet Corporation for Assigned Names and Numbers (ICANN). At the time of drafting this report, 684 new gTLDs had been delegated. Overall, their registrations account for 6.3 million domain names, the top one being .xyz with a bit over 1 million registrations. However, the new gTLD market has not reached all expectations because user demand has been much lower than expected. At the ccTLD level the impact has been marginal so far, but for various reasons – including market saturation, increased competitiveness, more power at the registrar level as some of them have become registries and vice versa. It is estimated that ccTLD growth will slow and might even be reversed as of 2017. Considering the historical trend, the current market situation and the prediction for future growth, the goal is to maintain a growth rate in registrations of around 4% per year. 4.Internationalised Domain Names (IDNs) 4.1..eu IDNs The introduction of IDNs at the top level, is a matter that falls within the competence of ICANN. On 16 November 2009, ICANN launched the IDN ccTLD Fast Track Process to facilitate the introduction of Internet Top Level Domain extensions representing country codes (e.g. .gr, .bg, .eu) using non-Latin characters (e.g. Cyrillic, Greek, Arabic and Chinese characters). Based on submissions to the Commission from Cyprus, Greece and Bulgaria of their preferred versions of the .eu suffix, EURid submitted an application to ICANN to open registration for the Cyrillic and Greek versions of the .eu TLD on 5 May 2010. The Greek .ευ and Cyrillic .ею strings were deemed to be confusingly similar to the existing ASCII ccTLD string (.eu), therefore their introduction entered a lengthy evaluation process. While evaluation of the Cyrillic (.ею) string was successfully completed, the Greek (.ευ) string did not pass the technical evaluation step of the process on the grounds that it is “either visually identical to or visually confusable with at least three ISO 646-BV strings “.eu”, “.ev”, and “.ey””. The Commission instructed EURid to put on hold the possible request of delegation of the Cyrillic string (.ею) until the issues linked to the Greek string (.ευ) had been resolved. In the period covered by this report Commission and EURid developed the .eu IDN high-level implementation plan. Submitted by EURid on September 2014, the plan outlines the approach to be followed when launching .eu in Greek and Cyrillc (e.g. allowing only Greek.Greek), as well as arrangements for managing the legacy of the current system (non-Latin.ASCII). On 20 January 2014 EURid, after agreeing with the Commission on the strategy to be followed, submitted a request for the re-evaluation of the .ευ string to the Extended Process Similarity Review Panel (EPSRP) and sent a letter to the ICANN Board to underline concerns about and point out inconsistencies in the current IDN ccTLD implementation plan and the EPSRP guidelines published by ICANN in November 2013. The response from ICANN did not adequately address several of the points raised. The outcome of the EPSRP evaluation was shared with EURid on 10 October 2014 and posted on the ICANN site for public comment on 17 October 2014. The Panel did not find .ευ to be confusingly similar to the “.ev” and “.ey”, but did find it confusingly similar to “.EV” and “.EY”. The guidelines of the linguistic panel did not include any procedure that the linguist panel should apply in case a requested string is considered confusingly similar to another string in upper-case, but not in lower-case letters. In several meetings with ICANN, Commission and EURid representatives underlined the weakness and superficiality of the overall string similarity evaluation process, which is extremely strict for the ccTLD environment, but much more liberal for the new gTLD space, where applications for strings like .hotel and .hotels or .car and .cars were deemed not to be confusingly similar and given the green light. At the time of drafting this report, the ICANN Board has instructed the ICANN staff and ccNSO to further review the Fast Track process to provide guidance in cases of similarity against strings in upper-case, but not in lower-case strings. Multilingualism is rooted in the European Union Treaties and encouraging, promoting and facilitating multilingualism is one of the guiding principles for the EU institutions. To that end making the .eu ccTLD available in other European scripts is an important policy goal. 5.Functioning of the Registry 5.1.The Registry EURid is a Europe-wide non-profit organisation with its head office in Diegem (Belgium) and regional offices in Stockholm, Prague and Pisa. It comprises two founding members: DNS Belgium (the .be registry) and the Istituto di Informatica e Telematica (the .it registry), and eight associate members: ARNES (the .si registry), CZ.NIC (the .cz registry), Business Europe (a confederation of 39 industry-related federations from 33 countries), ECTA Internet Committee (European Community Trademark Association), EMOTA (European Multi-channel and Online Trade Association), IAB Europe (Interactive Advertising Bureau), CECUA (Confederation of European Computer Users) and UEAPME (European Association of Craft, Small and Medium-sized Enterprises). The main EURid servers are located in Belgium (Brussels) and in The Netherlands (Amsterdam).

5.2.Relations with registrars By law, the .eu Registry itself does not act as registrar. The top priority for EURid remains to provide quality service to its 751 accredited registrars. EURid evaluates .eu registrar satisfaction on a regular basis. The latest registrar satisfaction survey for the .eu domain was carried out in Q4 2013 – Q1 2014. Of 176 EURid top registrars, 103 responded. 97% were satisfied or extremely satisfied. EURid continues to operate a round-the-clock support service for its registrar community. The Registry has launched its own registration platform, which went live on 15 September 2014 after intensive and structured communication with the .eu registrar community. With the new registration platform, new domain name statuses were introduced, along with changes to Domain Availability Service (DAS), Whois, Extensible Provisioning Protocol (EPP) and domain name expiry and renewal dates. 5.3.International Relations In the reporting period EURid engaged regularly and proactively in the Internet ecosystem. That included proactive participation in the Council of European National Top Level Domain Registries (CENTR) meetings and workshops; the chairmanship of the CENTR-IGF working group which led to the successful submission of the regional organisations workshops at the annual IGF meetings in 2013 and 2014; participation in ICANN meetings and involvement in the ccNSO working groups on IDN Policy Development Process; chairmanship of the ICANN ccNSO Strategy and Operating Plan working group since 2014; the partnership with UNESCO; cooperation with ICANN for sharing EURid best practices among Middle East registries and registrars; yearly classes on Internet governance at the College of Europe in Bruges and at the Scuola S. Anna in Pisa. Since March 2014, EURid representatives have also been actively involved in the IANA Stewardship Transition and ICANN Accountability processes. 5.4.Marketing and awareness activities Over the past two years EURid has conducted multiple marketing activities at two levels: establishing a sound partnership with its registrars to promote the .eu TLD via the Co-funded Marketing Programme and other incentive schemes. Under the Programme, the Registry deposits €0.75 for every new and €0.30 for every renewed .eu domain name into a co-funded marketing account created for each registrar. In 2013 and 2014 respectively, 94 and 86 proposals of various kinds were submitted. The Programme has become increasingly successful amongst registrars and has been imitated by other registries. In 2013, it received the CENTR Award for best registry marketing action; direct marketing to raise awareness of .eu through dedicated online display actions and a regular billboard campaign at the Brussels Airport with one of EURid's top testimonials, the tennis player Flavia Pennetta. All campaigns land on the Registry’s dedicated marketing website (ambitionhasanaddress.eurid.eu) where Internet users can see testimonials from companies and individuals that have chosen a .eu domain name to present themselves and/or their products online. During 2014 EURid launched the .eu Web Awards to acknowledge the best .eu websites in five categories. The awards ceremony in Brussels on 19 November 2014 was a major success for profiling .eu. Given its success, the Registry is organising a second edition. 5.5.Financial situation The Registry is an autonomous external organisation but the Commission scrutinises its financial situation closely, in line with the legal framework and the Service Concession Contract. Complete, on-the-spot accounting reviews are performed by an independent financial auditor. The Commission exercises its supervisory role by means of reviews of the auditors’ remarks, quarterly and annual financial reports, quarterly progress reports, budget proposals, and strategy and marketing plans. Financial matters are discussed regularly with the Registry at quarterly and service-level meetings. At the start of .eu TLD operations, revenues generated by the large number of domain registrations were significantly higher than the Registry's costs. The consequent annual surpluses were transferred to the EU budget. In order to limit the surpluses and recognise the declining costs incurred per domain name due to the increasing volume of registrations, the Registry has gradually reduced the various fees for registrars. Since January 2013, in order to fulfil its contractual obligation to work at cost, the Registry decided to change the renewal and term extension fee of a domain name from €4.00 to €3.75. The key financial aspects of the Registry remained stable in 2013 and 2014, with the revenues and costs both around €13 million a year. Consequently, the net financial result was more balanced than in previous years with surpluses of €535,017 and €76,953 for accounting years of 2013 and 2014 respectively to the benefit of the European Union budget. The Commission scrutinised closely changes in the Registry's budgeted and actual costs in particular as regards marketing (€2.8 million in 2013 and €3.0 million in 2014).and human resources (€4.7 million in 2013 and €4.4 million in 2014). The increase in marketing costs in 2014 is due to the high number of registrations, and therefore increased contributions to the co-funded marketing fund and new awareness initiatives linked to the fact that residents of Iceland, Liechtenstein and Norway became eligible to register .eu domains. 5.6.Business continuity, resilience and quality 5.6.1.Business continuity

EURid performed a so-called disaster recovery spot test on several components of its infrastructure. The test showed that the assumed redundancy on the telephony systems did not work as designed and needed corrections. More specifically, core switching infrastructure behaved correctly during a simulated failure and services remained available, the front-end switches that connect front-end servers to the firewalls and the Internet behaved correctly during a controlled failover, but some services became unavailable due to implementation assumptions that did not work in practice. The assumptions were corrected and new tests showed that the failover functioned as designed. The entire registration software was rewritten in 2014 and went into production in September that year. An audited Business Continuity Plan (BCP) exercise was held in December. The test was done on December 16th and was audited by PwC who concluded that "all tests related to the scope of the BCP Test, executed during the different timeslots, passed successfully.” 5.6.2.Security In September 2010, EURid completed implementation of the Domain Name Security Extensions (DNSSEC) protocol for the .eu TLD. DNSSEC is a protocol to verify the authenticity of the display name server responses (websites) up to the Internet root zone in what is called a ‘chain of trust’. It is designed to protect Internet users from forged DNS data, but can only reach its full potential if all the zones in the hierarchical DNS tree are signed. A DNSSEC reduction (€0.02 discount on the domain name fee per correctly signed domain name per month) was introduced in 2013 to further support the implementation of DNSSEC at the registrar level. 5.6.3.Whois quality plan EURid has been applying measures to counter phishing and other types of malicious online behaviour on a daily basis. In particular, domain names are checked for compliance with the eligibility criteria and new registrations are screened for suspicious patterns or other anomalies. Under Article 4 of the registrar .eu accreditation agreement, registrars must ensure that each domain name holder complies with the EU Regulations (as amended), the .eu Registration Policy and the .eu Terms and Conditions, as published on the Registry website. Since 2013, EURid has sought to improve the quality of .eu Whois data and encouraged the cooperative compliance of registrars with their contractual obligations. To that end the Registry launched the Whois Quality Plan project to check the Whois database and fix any inaccuracies. 5.7.2013 Audit and Technical Verification of the Registry Under its Service Concession Contract with EURid, the Commission may arrange for an “audit to be carried out, either by an outside body of its choice, or by the Commission departments themselves. The object of such an audit shall be to verify the Contractor’s compliance with the contract”. An audit was carried out by the Commission between Q3 and Q4 2013. Based on the results of the audit and technical verification, Commission audit services were of the opinion that the Registry manager – EURid Asbl/vzw – was in compliance with the Service Concession Contract for the organisation, administration and management of the .eu TLD. At the same time, the auditors identified a series of areas for improvement, including: establishing an effective conflict of interest internal policy (which EURid had in place, but was further refined and tightened up); evaluating the need for having subsidiaries in three other Member States (this was an obligation required under the original Service Concession Contract. EURid had already committed to assess the value of subsidiaries when responding to the 2013 call for expression of interest for the selection of the .eu TLD Registry); introducing a formal procurement policy (since the audit EURid has made its internal procedure official and mandatory for expenses above a specific threshold); carrying out regular reviews of the reserve-building process (EURid is doing this on a yearly basis in close cooperation with the Commission services). 5.8.Legal proceedings and disputes concerning domain names 5.8.1.Cases before the General Court and the Court of Justice of the European Union General Court: none Court of Justice of the European Union (CJEU): one preliminary ruling.

In 2011 the Brussels Court of Appeal referred the lensworld.eu case (Pie Optiek vs. Bureau Gevers) to the CJEU for a preliminary ruling. The CJEU judgment was rendered on 19 July 2012. The Court of Appeal rendered its final decision on 3 October 2013, rejecting Pie Optiek’s claim against EURid as inadmissible. The court concluded that Gevers had made a mistake and ordered it to pay €70.000 damages to Pie Optiek, mostly court-related expenses. No appeal was filed; the judgment of the Brussels Court of Appeal has become definitive. 5.8.2.Alternative Dispute Resolution procedure Any disputes between .eu domain name holders or claims against .eu Registry decisions,can be submitted to the Alternative Dispute Resolution (ADR) provider, which is the Czech Arbitration Court (CAC). The ADR procedure applies without prejudice to any court proceeding. Complaints can be submitted online in any official EU language. ADR against EURid concerning single character domain names The ADR proceeding 06814 was initiated against EURid in respect of the domain names e.eu, f.eu, y.eu. According to the applicable rules, a .eu domain name should contain at least two characters. The Complainant contested EURid’s rejection of the requests for registration. In his decision of 18 November 2014, the ADR panelist rejected the complaint. The Complainant did not appeal and the case has been closed. Reducing the ADR fee (agreement between Czech Arbitration Court and EURid) On 27 June 2012, CAC and EURid announced a special fee reduction to make the .eu ADR process even more accessible. The €1,300 fee for a basic proceeding, i.e. to dispute one to five domain names before a single-member panel, was cut by €700 in a new fee structure valid for a period of six months starting from 1 July 2012. The ADR fees were cut further in 2014, with the total reduction per filing of an ADR complaint rising to €1,000 as of 1 January 2015. The €1,000 discount is granted per each filed complaint irrespective of the number of domain names in dispute and the type of panel requested. 5.8.3.Other court proceedings In the reporting period EURid was a party in the following cases: Depmarc Depmarc challenged EURid's rejection of its Sunrise applications for 36 domain names based on Dutch trade names. The Claimant asked the Court to order EURid to transfer the domain names to Depmarc. The case was settled by means of a settlement agreement and on 14 November 2013 the Court declared it closed. Of the 36 domain names, 30 for which there were no next applications accepted in the Sunrise queue, were released for general registration on 11 March 2014. The other 6 domain names for which the next applications in the Sunrise queue were accepted have been activated in the name of the applicant.

Dotace The Sunrise application by the Czech company Dotace was rejected by the validator (and EURid) for lack of sufficient proof of a prior right to “Dotace”. The CAC confirmed EURid's rejection of the dotace.eu domain name in its decision (Case 04281). The domain name applicant subsequently appealed before the Brussels Court of First Instance. When the Claimant refused to sign a settlement agreement, EURid filed a claim for vexatious court proceedings in order to be able to re-activate the proceedings and get a final outcome. In its judgment of 24 October 2014, the Court of First Instance ruled entirely in favour of EURid. 6.EMAS registration and CO2 compensation On 23 May 2012, EURid became the first EMAS-certified registry in Europe (registration number BE-VL-000016). The final assessment of the 9 objectives and 41 actions of the 2012-2014 EMAS programme showed that 95% of the objectives had been achieved, including the main one: fully compensating for EURid's CO2 emissions. In Q1 2015, following annual audits, EURid started the process of renewing its EMAS registration and extending it to its Pisa branch. Since 2013, EURid has validated its CO2 emissions and purchased certified CO2 credits to compensate them. 7.Conclusions The .eu TLD model has been implemented successfully and is operating effectively. Over the past two years, the .eu TLD has strengthened its position as one of the biggest and most popular TLDs in Europe and the world. It remains successful despite the continued, albeit slower, growth of the 28 Member States ccTLDs and the increased availability of gTLDs, with which the Registry has been able to cope thanks to the quality label associated with the .eu TLD. Five years after EURid’s application for the .eu string in Greek and Cyrillic, ICANN has not approved the Greek .ευ on the grounds that it is confusingly similar to other strings in upper case. The Commission has repeatedly urged ICANN to complete this process as soon as possible. It has stressed that the rules for a ‘permanent’ IDN application procedure should be set out so as to avoid undue delay. This is one of the public policy issues that the Commission will continue to raise in the Governmental Advisory Committee, which provides public policy advice to ICANN, as well as in other ICANN constituent bodies. The financial situation of the Registry remained stable during the reporting period. The Commission monitors the use of the ADR system provided by the CAC, which allows for the protection of registrants' rights in all EU languages. Following recommendations by auditors, EURid has reduced fees to improve access to the system for individuals and SMEs who have reasons to believe that their .eu names have been improperly registered by third parties. The DNS environment has recently undergone one of the its biggest changes of the past two decades. Hundreds of new gTLDs have been launched in the market sometimes creating confusion among registrants and registrars. At the same time, the advent of social media has led to a dropping-off of interest in domain names, as younger Internet end users and dynamic new companies prefer to communicate their online presence via the faster social media avenues. The .eu TLD and its Registry have shown that they are able to cope very well with the challenges to date, although the environment is expected to be even more competitive in the future. The Commission has a regular and constructive dialogue with the Registry to investigate and identify possible ways of dealing with the new DNS landscape while keeping the .eu space secure, reliable and worthwhile for current and future stakeholders.

ANNEXES



Annex 1: World's top TLDs as of 31 March 2015

Source: EURid’s Quarterly Progress Report, Q1 2015 ANNEX 2: .eu registrations by quarter

ANNEX 3: ADR complaints filed by year Complaints filed in 2013 Complaints filed in 2014 January 6 5 February 5 5 March 4 4 April 4 1 May 2 6 June 7 5 July 6 4 August 2 7 September 3 7 October 6 7 November 4 7 December 3 4 TOTAL 52 62 ADR cases terminated in 2013: 57 (of which 47 complaints accepted) 2013 Complaint Rejected Complaint Accepted Complaint defective Settlement TOTAL January 6 6 February 3 3 March 4 1 5 April 1 1 May 7 7 June 2 6 8 July 5 2 7 August 1 3 1 5 September 1 1 2 October 6 1 7 November 2 1 3 December 3 3 TOTAL 3 47 4 3 57 ADR cases terminated in 2014: 57 (of which 43 complaints accepted) 2014 Complaint Rejected Complaint Accepted Complaint defective Settlement TOTAL January 6 1 7 February 1 1 March 1 4 5 April 1 1 2 May 7 7 June 1 1 July 4 1 5 August 5 2 7 September 2 1 3 October 1 3 1 5 November 2 2 1 5 December 8 1 9 TOTAL 5 43 8 1 57

ANNEX 4: Total number of .eu domain names by country of registrant Source: EURid’s Quarterly Progress Report, Q1 2015

ANNEX 5: .eu domains per 1,000 inhabitants