WRITTEN QUESTION E-3543/01

by Cristiana Muscardini (UEN) to the Commission

(8 January 2002)

Subject: Privacy and electronic mail

Users of computer services are being offered an increasing number of on-line opportunities. One of the latest, offered by a company specialising in the registration of domain names, consists in providing a personalised electronic mailbox for anyone registering a domain with a given name (namely, www.forename.surname).

Without wishing to criticise the imagination which goes into devising more and more opportunities for gifts, I have doubts about the legality of registering a name on the internet, unbeknown to the person concerned, and with anyone being able to gain access to that person's mailbox.

Will the Commission therefore state:

1. whether, in its view, such offers constitute an infringement of the right to privacy?

2. whether there are rules which apply to the electronic mail sector?

3. if not, what it intends to do in order to protect the right to privacy in this specific area?

Answer given by Mr Liikanen on behalf of the Commission

(23 April 2002)

The new Top Level Domain .name provides registration of domain names for personal names of individuals. The Registry is administered by a company based in the United Kingdom and subject to the United Kingdom Data Protection Act 1998. The Registry operates the .name Top Level Domain under an agreement with the Internet Corporation for Assigned Names and Numbers (ICANN). Domain names can be registered through accredited registrars (called official providers within the .name organisation) and are subject to eligibility rules which can be found at (http://www.nic.name).

These rules provide that any person can register his or her own personal name, the personal name of a fictional character provided that the registrant can demonstrate trademark or service mark rights over that name, or their personal name with added numeric characters to differentiate them from other personal names. The name registered must be the legal name of the registrants or a name by which he or she is commonly known such as a pseudonym. In case of non-compliance with the eligibility requirements a dispute resolution policy is available.

The registration of a domain name can take place in a format firstname.lastname.name or lastname.firstname.name and a corresponding e-mail address can be available as an additional service. This additional service consists in automatic forwarding of e-mail sent to the .name address to a separate designated e-mail account operated by another company. This automatic forwarding does not change in itself the security of the designated account. Given the contractual relationship related to the registration of a domain name it may indeed be said that there is higher security related to the .name address than to some of the very popular free e-mail accounts.

The registration of domain names as a gift appears to be a service offered by at least one registrar. Given the information currently available, it could be questioned as to whether such a service is consistent with the current .name Top Level Domain eligibility policy.

On the basis of the Directive 95/46/EC of the Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(1) (data protection directive), the individual concerned by the registration of his/her name or his/her pseudonym, the beneficiary/recipient, has the right to be provided with certain information about the processing of such personal data relating to him or her, the data must be processed fairly and lawfully and on a legitimate basis (unambiguous consent, performance of a contract, compliance with a legal obligation, etc) and he or she has the right of access to and the rectification or erasure of such personal data as well as the right to object to such processing to the extent that the processing concerned identified him or her and not any other person.

The answer to question 1 depends therefore on the concrete way in which such service is offered and used. The provision and use of such service could be considered consistent with the right to privacy and data protection if it is ensured that the beneficiary/recipient has the control over the processing of his/her personal data concerning the registration of his/her name as a domain name and that during and after the registration process the data cannot be abused. It would for example be necessary to ensure that the data are not used for marketing purposes before the individual had the opportunity to express his/her consent or opposition to its use as his/her domain name, and for marketing if such use is at stake.

The answer to question 2 also depends on the use made of the e-mail address: If the e-mail address is only created for use by the beneficiary/recipient of the domain name, which would obviously depend on his/her consent, no special rules in addition to the provisions of Directive 95/46/EC as explained above apply for the registration process.

In cases of complaints, in addition to the procedures foreseen by the Community data protection Directives, it could be expected that anybody who had a problem with a registration would give serious consideration to the alternate dispute resolution procedures available related to domain names.

The Commission will keep following developments in this area.

(1) OJ L 281, 23.11.1995.