EUROPEAN COMMISSION Brussels, 19.2.2020 COM(2020) 63 final REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL On the implementation, functioning and effectiveness of the .eu Top-Level Domain from April 2017 to April 2019



Table of Contents 1.Introduction 2.Executive summary 3.The .eu legal framework 3.1.Current framework 3.2.New framework 4.The .eu Registry 4.1.Financial and contractual compliance 5.The .eu domain 5.1.General trends 5.2.The .eu brand 5.3.Marketing and communication 5.4.Multilingualism 5.5.Impact of the United Kingdom’s intended withdrawal from the EU 6.Trust and security 6.1.Secure domain names 6.2.Mitigation of abusive registrations

6.3.Cooperation in the fight against cybercrime 6.4.Alternative Dispute Resolution 6.5.Stability, security and business continuity 7.International relations 8.Environmental impact 9.Conclusion

1.Introduction This report concerns the .eu ccTLD (country code Top-Level Domain), the internet domain of the European Union, and its variants in other scripts, as administered and managed by the non-profit organisation EURid (European Registry for Internet Domains) acting as the registry of this domain (hereafter ‘.eu Registry’) on the basis of a service concession contract with the Commission. Pursuant to Article 8 of Regulation (EC) No 733/2002 of 22 April 2002 on the implementation of the .eu Top-Level Domain (hereafter ‘.eu Regulation’), the Commission is required to submit a report on the implementation, functioning and effectiveness of the .eu domain to the European Parliament and the Council every two years. This report covers the period from 1 April 2017 to 31 March 2019 (hereafter ‘the period covered’). 2.Executive summary With 3.7 million registered domain names, the .eu domain remained the seventh largest ccTLD worldwide. The growth stagnated during the period covered due to the maturity of the domain name market. The performance of the .eu domain however remained on par with other ccTLDs despite a significant decrease in .eu registrations caused by the United Kingdom’s intended withdrawal from the European Union and the suspension of domain names due to stricter checks on registration data. Confronted with growing competition, the .eu Registry focused increasingly on quality of service and security, rather than on price. This proved successful: the renewal rate of .eu domain names remained high and grew from 78.6 % to 80 % in the period covered in this report. Furthermore, the .eu Registry continued to promote DNSSEC, a security extension of the DNS (Domain Name System), implemented cybersecurity measures, deployed new initiatives to prevent abusive registrations, and collaborated with law enforcement and other public authorities at both the national and European levels in the fight against illegal activities involving .eu domain names. The .eu Registry maintained a highly resilient and robust technical infrastructure to ensure that the .eu namespace remained available for all internet users. Supporting European linguistic diversity and expanding multilingualism across the .eu domain remained a priority. At the end of the period covered, the expectation was that the .ευ string in Greek script could be launched end of 2019. This milestone would mark the successful completion of efforts to support all non-Latin scripts in the European Union. In general, the .eu domain continues to function in an effective way, facilitating access to the Digital Single Market in a secure and trustworthy way and allowing Europeans to display their European identity online. 3.The .eu legal framework 3.1.Current framework The .eu domain was implemented by the .eu Regulation (as amended), and Regulation (EC) No 874/2004 laying down the public policy rules concerning the implementation and functions of the .eu top-level domain and the principles governing registration (as amended). 3.2.New framework

In 2017, the Commission evaluated the .eu regulatory framework under the Regulatory Fitness and Performance Programme (REFIT) review process and subsequently undertook a revision. Following a public consultation and an Impact Assessment, and having received positive feedback from the Regulatory Scrutiny Board, the Commission made a legislative proposal to replace the existing .eu Regulation(s). This proposal was ultimately adopted into law as Regulation (EU) 2019/517 of the European Parliament and of the Council on the implementation and functioning of the .eu top level domain and amending and repealing Regulation (EC) No 733/2002 and repealing Commission Regulation (EC) No 874/2004 (‘revised .eu Regulation’). The revised .eu Regulation provides the legal flexibility for the .eu domain to adapt to market changes, modernises its governance structure, and expands the eligibility criteria for .eu domain names to enable EU citizens to register a domain name, regardless of their place of residence. The revised .eu Regulation entered into force on 18 April 2019. It will apply from 13 October 2022, on which date Regulations 733/2002 and 874/2004 will be repealed, except for the provisions expanding the eligibility criteria, which apply from 19 October 2019. 4.The .eu Registry Following a tendering process, the non-profit organisation European Registry for Internet Domains (EURid) was selected and awarded a service concession contract in 2004 to become the .eu Registry operator, responsible for the organisation, administration and management of the .eu domain and its variants in other scripts. After a new tendering process, EURid was awarded a second contract in 2014. This contract was extended from 1 April 2019 until 12 October 2022. EURid is an association without lucrative purpose, established under Belgian law with its head office in Brussels. Three companies, owned by EURid, act as regional offices, established in Italy, the Czech Republic and Sweden. EURid’s mission is to "create a trusted .eu space for the end-user in a sustainable way through operational excellence, while offering outstanding quality of service to its accredited registrars". The association EURid has two founding members, DNS Belgium (the .be registry) and the Istituto di Informatica e Telematica (the .it registry), nine other members and a Strategic Board comprised of 13 representatives. A general manager and a management team of eight persons lead the organisation. At the end of the period covered, EURid had 56 full-time employees, working across seven departments and located in its four regional offices. The majority of employees work in the external relations team and the technical department. 4.1.Financial and contractual compliance As an external organisation, EURid manages the .eu domain in an autonomous way. Nevertheless, the Commission closely scrutinises EURid’s financial situation and contractual compliance in line with the provisions of the .eu regulatory framework and the Service Concession Contract. The Commission exercises its supervisory role by reviewing the yearly audited accounts, the half-yearly and yearly financial reports, the budget proposals, and the strategy and operational plans of the .eu Registry. Financial matters are discussed at half-yearly meetings and in ad hoc meetings. In the period covered by this report, EURid’s financial situation was comparable to the previous two years, with around € 13 million revenues and € 11 million costs per year. Following approval of the accounts and reserves, the surplus transferred to the European Union under the terms of the Service Concession Contract was € 2,863,036 and € 1,347,883 for the accounting years 2017 and 2018 respectively. At the end of 2018, EURid maintained financial reserves for depreciation (€ 0.5 million), investments (€ 0.6 million), social liabilities (€ 2.4 million), legal liabilities (€ 1.2 million), and working capital (€ 0.2 million), and added a new reserve for the ends of contracts (€ 0.9 million). In 2018, the Commission performed an audit on various administrative and financial aspects of the .eu Registry management. The audit led to a series of recommendations that are being implemented in 2019 according to an action plan agreed between the Commission and EURid. In particular, they cover the review of EURid's procurement policy; the review of EURid's conflict of interest policy; a clarification of the rules and approach on building reserves; the development of a consistent approach in contracting external consultants; a review of the efficiency and effectiveness of the regional offices; an evaluation of the marketing and awareness raising activities, and the organisation of a yearly contractual compliance audit. 5.The .eu domain 5.1.General trends With 3.7 million registered .eu domain names by the end of the first quarter 2019, the .eu domain is the eleventh largest TLD and remains the seventh largest ccTLD worldwide. The volume of registrations accounts for approximately 1% of the global domain name market, comprising more than 350 million domain names distributed among 1,486 TLDs. Whilst 2017 ended with an annual growth of 1.5 %, 2018 saw a negative growth of 3.4 %. Two atypical developments – in comparison to other ccTLDs – account for the negative growth: the United Kingdom’s intended withdrawal from the European Union (explained in section ‘Impact of the United Kingdom’s intended withdrawal from the EU’), and the suspension of approximately 58,000 domain names during 2018 as a result of stricter eligibility checks. In general, the .eu domain performance aligns with the performance of other ccTLDs, challenged collectively by low growth rates in the domain names market during the two-year timeframe of this report. A number of reasons account for these low growth rates. The trends described in the previous report persist, such as the maturity of key national markets and increased competition due to the advent of new gTLDs (generic TLDs). Over the period covered in this report, substitutes have also gained market share, such as social media accounts for individuals and businesses, and applications (apps) for the mobile market, particularly in emerging markets,. By country of registration, Germany, the Netherlands, France, Poland and Italy were the main .eu domain markets at the end of the first quarter of 2019. In the period covered in this report the United Kingdom declined from fourth to sixth position, while Portugal’s share of .eu registrations almost doubled, demonstrating that domain names can still enjoy double-digit growth. 5.2.The .eu brand In recent years, the domain name marketplace and, in particular, well-established TLDs have been confronted with a significant rise in competition, due to the introduction of new gTLDs such as .hotel or .shop. Competition has become fierce and many new registries are offering very low prices, adopting aggressive marketing towards registrars and re-sellers. EURid’s response has been to focus on quality and security rather than on price, and to continue to promote .eu as a trustworthy brand with European coverage. This strategy proved successful: the renewal rate of .eu domain names (generally an indicator for customer trust and loyalty) remained high and grew from 78.6 % to 80 % in the period of this report.

5.3.Marketing and communication In line with its strategic aim to focus on quality and security rather than on price, EURid undertook the following marketing and communication activities: –Publication of trust.eurid.eu, a new landing page on EURid's website, to highlight the .eu domain name as a brand that connotes trust and security, achieved through measures that ensure a high level of cybersecurity and actively reduce the risks of domain name abuse. –Organisation of two successful online awareness campaigns in 2018. The countries where the campaigns took place (Poland, Germany, France and Spain amongst others), were selected on the basis of their .eu growth rate and the support of registrars running .eu promotion campaigns. –Partnership with .eu-accredited registrars was strengthened via EURid’s Co-funded Marketing Programme, through which registrars can receive reimbursements of up to 100 % of the eligible cost of promotional actions for .eu domain names. In 2017 and 2018, the Programme co-financed more than 120 campaigns. –Registrars continued to use EURid's Reduction Scheme, by which they enjoy a reduction on new registration fees. Registrars appreciate the stability of the Scheme, which enables them to promote the .eu domain on a regular basis throughout the year. 327 registrars subscribed to this scheme, accounting for 93.3 % of the total .eu portfolio and 97 % of all new domain names in 2019. –To acknowledge innovation and excellence amongst registrants of .eu domain names, EURid organises Web Awards on a yearly basis. The winners of the Web Awards receive a prize package that includes a three-month billboard campaign at Brussels airport. Participation in the Awards peaked in 2018 with more than 200 nominations and close to 10,000 votes. –EURid continued to streamline its social media presence, in particular through its twitter account and YouTube channel. Key partners for .eu marketing activities are the registrars, who make the .eu domain names available and interact with the registrants. In the period between 2017 and 2019, EURid continued its efforts to improve the quality of service provided to accredited registrars and to simplify the registration process. At the end of the first quarter of 2019, the .eu domain had 715 accredited registrars. The number of registrars remained relatively stable over the past years, despite increased concentration in the market. According to the last biennial registrar satisfaction survey in late 2017, ratings for the quality of the relationship with EURid was 93% overall, consistent with the high score in the previous survey. Registrars generally gave high ratings for reliability and found .eu domain names easy to sell and representing a good investment. As a clear sign of appreciation, EURid won the CENTR ‘Registry of the Year Award’ in 2017 and 2018, on the basis of a survey in which more than 100 registrars voted. 5.4.Multilingualism EURid continued its efforts to support European linguistic diversity and expand multilingualism across the .eu domain. At the end of the first quarter of 2019, there were nearly 39.000 IDN (Internationalised Domain Names) registered, placing the .eu domain among the twenty largest IDN spaces in the world. After the introduction in June 2016 of the .ею extension (the equivalent of .eu in Cyrillic script), a three-year transition period was initiated, with the aim of enforcing a ‘no mixing of script’ policy for all domain names. This policy, mandated by ICANN (Internet Corporation of Assigned Names and Numbers), requires that both the domain name and its extension should be written in the same script. At the end of the first quarter of 2019, there were approximately 1900 domain names registered under the .ею extension. Before and during the period covered by this report, EURid worked intensively to have the .ευ extension (the equivalent of .eu in Greek script) approved by ICANN. The .ευ application encountered difficulties in the evaluation stage due to a finding that the string was potentially confusingly similar to .eu and to upper case presentations of other two-letter strings. At the end of the period covered, the expectation was that the .ευ string in Greek script would be launched end of 2019. This milestone would mark the successful completion of efforts to support all non-Latin scripts in the European Union. 5.5.Impact of the United Kingdom’s intended withdrawal from the EU According to the .eu Regulation, as amended, holders of a .eu domain name need to be residents in or citizens of an EU Member State, Iceland, Liechtenstein or Norway, or undertakings or organisations established in these countries. Following the notification by the United Kingdom on 29 March 2017 of its intention to withdraw from the Union, the Union negotiated and concluded with the United Kingdom an agreement setting out the arrangements for its withdrawal (hereafter ‘the Withdrawal Agreement’) in accordance with Article 50 of the Treaty on European Union (TEU). The Withdrawal Agreement provides for a transition period during which Union law applies to and in the United Kingdom. Therefore, during this transition period, United Kingdom residents and citizens as well as undertakings and organisations established in the United Kingdom will continue to be eligible to hold a .eu domain name. This transition period will start on the withdrawal date and end on 31 December 2020, unless the Union and the United Kingdom agree by 1 July 2020 to a one-time extension of that transition period for up to one or two years. As from the end of that transition period, Union law ceases to apply to and in the United Kingdom. Therefore, United Kingdom residents who are not citizens of an EU Member State, Iceland, Liechtenstein or Norway and undertakings and organisations that are established in the United Kingdom but not in an EU Member State, Iceland, Liechtenstein or Norway will no longer be eligible under EU law to hold a .eu domain name, in the same way as residents, undertakings and organisations of other third countries. This consequence would apply from the withdrawal date in the event that the Withdrawal Agreement did not enter into force.

With the notice on the ‘Withdrawal of the United Kingdom and EU Rules on .eu Names’ of 28 March 2018, updated on 18 July 2019, the Commission warned the .eu domain name holders residing or established in the United Kingdom of the consequences of the United Kingdom’s withdrawal from the EU, subject to the provisions of the Withdrawal Agreement coming into force as regards the transition period. In addition, the Commission and EURid agreed on an action plan to mitigate the effects of the possible scenario of a Withdrawal Agreement not entering into force, and to manage the transition to the United Kingdom’s status as a third country, comprising of communication to registrars and registrants and transition measures for registered domain names belonging to United Kingdom residents. The impact of the United Kingdom’s intended withdrawal from the EU on the .eu domain began to be felt in 2018. For United Kingdom’s residents, the possibility of losing eligibility for the registration of .eu domain names triggered cancelations, non-renewals and a decrease in new registrations. In addition, some United Kingdom-based registrars ceased to offer the .eu domain. As a result, the number of .eu registrations in United Kingdom fell from around 240,000 to around 190,000 by the end of the first quarter of 2019; a decrease of 24 %. 6.Trust and security 6.1.Secure domain names DNSSEC, a security extension of the DNS has been deployed and promoted in the .eu domain since 2013. DNSSEC ensures that users communicate with the correct website, preventing ‘man in the middle’ type attacks by fake websites. For DNSSEC to function properly, both the domain at the top level and individual domain names need to have a digital signature (‘be signed’). Following the signing of the .eu top level itself in 2010, EURid has been promoting DNSSEC signing among .eu domain names. Since 2015, EURid has offered a fee discount per correctly signed domain name. At the end of the first quarter of 2019, around 540,000 domain names (15% of the .eu domain names) were correctly signed with DNSSEC. Regular increase in the number of DNSSEC-signed domain names over the period covered demonstrated that these discount measures motivated registrars to deploy DNSSEC and to offer it to their registrants. While .eu ranks among the best ccTLD registries in terms of DNSSEC adoption, it is clear that further effort is needed to increase the enrolment of .eu domain names. In general, EURid supports its registrar community in adopting cybersecurity standards through webinars and meetings and regular briefings about DNSSEC and other security measures. 6.2.Mitigation of abusive registrations The prevention of abusive domain name registrations, used for copyright infringements, the selling of counterfeit goods, phishing, cyberattacks, and the distribution of malware, continues to be a key priority for the .eu domain. This is implemented by verifying the validity of registration data against .eu eligibility criteria and the screening of new registrations for suspicious patterns or anomalies. As a preventive measure, EURid performs daily checks on new registrations. If dubious data are detected, registrants are invited to update or correct their information – with the risk of suspension of their domain name if they fail to do so. In 2017 and 2018 respectively 20,126 and 58,966 domain names were suspended. In 2017, the University of Leuven developed a system for EURid that predicts which .eu domain names might be used for abusive purpose, based on historical data and self-learning algorithms. This system, still in development, is aimed at preventing malicious domain names from becoming active in the first instance. 6.3.Cooperation in the fight against cybercrime EURid continued to provide regular assistance to law enforcement and other relevant authorities both at the national and European level, aiding them in the fight against illegal activities associated with .eu domain names. At the national level, EURid collaborated actively with the Belgian Federal Ministry of Economic Affairs, the Belgian Customs (Cybersquad), and the Belgian Public Prosecutor’s Office. At the European level, EURid continued engaging in regular dialogue with the Computer Emergency Response Team for the EU (CERT-EU) and further expanded cooperation with EUROPOL by exchanging statistical data and trends, running joint projects aimed at combatting cybercrime and holding joint workshops. In June 2018, EURid and the International Anti-Counterfeiting Coalition signed a Memorandum of Understanding to engage in joint efforts to fight cybercrime in the .eu domain. EURid also continued its cooperation with EUIPO (European Union Intellectual Property Office) to notify trademark holders when a .eu domain name is registered that is identical to a registered EU trademark. 6.4.Alternative Dispute Resolution In June 2017, EURid expanded the options for initiating an Alternative Dispute Resolution (ADR), by signing an agreement with the World Intellectual Property Organisation (WIPO) to become a new provider of the .eu ADR in addition to the existing provider, the Prague-based Arbitration Court (Czech Arbitration Court). A characteristic of the .eu ADR is the possibility to submit a complaint online in any of the official languages of the EU. In the period of this report, 127 complaints were filed and 130 disputes were resolved. 6.5.Stability, security and business continuity EURid has maintained a highly resilient and robust technical infrastructure to ensure that, at all times, the .eu namespace is visible and performing well for all internet users. This has resulted uninterrupted access to .eu domain names for users connecting to these domain names during the period covered by this report (uptime of 100 %). Two domain name servers in Amsterdam and Luxembourg form the core of EURid’s technical infrastructure, complemented by a mix of self-managed servers (Amsterdam, Ljubljana, London, and Prague) and external “anycast” providers such as DENIC, NetNod and Dyn/Oracle, providing name servers across the world in order to support the .eu zone file. Establishing and maintaining a high standard for its information and network security remained an important element of EURid’s policy to continue providing secure and high-quality services to .eu-accredited registrars and the public. EURid obtained an ISO 22301 certification in 2017 for its business continuity management and was recertified for the information security standard ISO/IEC 27001 in 2019. In addition, EURid evaluated and adapted its Responsible Disclosure Policy in 2018 and continued its collaboration with an external company to assess and improve cyber security and reduce threats.