Summary

  • In its 26 October Bali communiqué, the GAC asks that registrars handle privacy/proxy customer-data requests on their merits even when the provider is unaffiliated, with a response to urgent requests within 24 hours.
  • ICANN's current public rules describe duties for affiliated providers; a wider accreditation program remains in implementation, with completion expected in 2027.

The registrar's name is on the door. The customer's details may be in somebody else's filing cabinet. For a person seeking registration data, that corporate seam can become a remarkably convenient place for a request to die.

The GAC's Bali communiqué, issued on 26 October, aims directly at that seam. It says registrars should be required to assess legitimate requests for privacy or proxy customer data on their merits, including where the provider is unaffiliated. Urgent requests should receive a response within 24 hours. Registrars should also ensure that downstream privacy and proxy services comply with the forthcoming Consensus Policy, even where the business relationship is at arm's length. The committee is asking for obligations; it has not enacted them.

The distinction between the two services is material. ICANN's public explainer says a privacy-service customer remains the registered domain holder while alternative contact details are displayed. With a proxy service, the provider is the holder of record and licenses use to the customer. A request sent to a registrar can therefore concern underlying information held and controlled through different arrangements. A single inbox does not magically produce the data or the authority to disclose it.

The same ICANN page describes the 2013 registrar agreement's requirements for affiliated privacy/proxy providers: published terms, contact points and handling procedures. ICANN is building a broader accreditation program under which registrars will be unable knowingly to accept registrations involving unaccredited providers once the program is fully implemented. Its implementation table puts expected completion in 2027. Bali's demand arrives before that finish line.

The useful policy test is a request's journey: who receives it, who confirms that it is legitimate, who can reach the provider, who makes the disclosure decision, and who sends a timed answer? A 24-hour response is an accountability clock, not an automatic order to release customer data. If the forthcoming rules leave that chain to private improvisation, the registrar's public address will be a signpost pointing at a closed door.

Original records: GAC Bali communiqué; ICANN privacy/proxy explainer; ICANN implementation status.