Summary

  • On 17 May 2018, ICANN's Board adopted a Temporary Specification that changed gTLD registration-data duties in time for the GDPR's 25 May application date. Contracted registries and registrars had to follow it, but only through a recurring 90-day reaffirmation cycle capped at one year.
  • The expiry condition mattered as much as the emergency power. It forced the durable rules through the GNSO's expedited policy process, Board adoption, an interim policy and, eventually, the Registration Data Policy effective in August 2025.

The clock began before the rules did. On 17 May 2018, the ICANN Board approved the Temporary Specification for gTLD Registration Data. The specification took effect on 25 May, the same day the European Union's General Data Protection Regulation became applicable. Eight days separated institutional decision from operational obligation.

Without a common change, ICANN faced a conflict inside its contracted system. Registrars and registries were already required to collect, publish, transfer and retain registration data under ICANN agreements and policies. The GDPR changed the lawful treatment of personal data. If each contracted party improvised, the result would not be one adjusted registration-data system but a patchwork of incompatible disclosures, redactions and transfers.

The Board did not claim an unlimited privacy mandate. It used the temporary-policy procedure embedded in the Registry Agreement and Registrar Accreditation Agreement. The Board recorded two necessary findings: immediate establishment was required to maintain the stability or security of registrar services, registry services, the DNS or the Internet, and the changes were as narrowly tailored as feasible. The procedure also required a two-thirds Board vote.

The specification had direct operational effects. It preserved collection of registration data while restricting most personal data from public display. It retained routes by which a person with a legitimate and proportionate purpose could request non-public data from a registrar or registry. It also required anonymized email or web-form contact paths. These were not suggestions awaiting later consensus. Within the contractual scope, they displaced conflicting agreement requirements from the effective date.

Yet the instrument carried its own limit. Its first term was 90 days. If the Board wanted it to remain in force, it had to reaffirm the specification every 90 calendar days, and the total temporary period could not exceed one year. The Board's 21 August 2018 resolution shows the clock operating: it again found the measure necessary and narrowly tailored, then extended it for another 90 days.

That architecture split authority instead of concentrating it. The Board could create and renew the bridge. Registries and registrars implemented the resulting duties and remained responsible for disclosure decisions under applicable law. But the Board's emergency instrument could not perpetuate itself. A lasting consensus policy required the Generic Names Supporting Organization's policy machinery.

The GNSO Council initiated an Expedited Policy Development Process on 19 July 2018. Its team was asked whether the Temporary Specification should become consensus policy as written or with modifications, while complying with the GDPR and other relevant data-protection law. The team published its Phase 1 Final Report on 20 February 2019. The Board adopted the recommendations, with specified exceptions, on 15 May 2019.

The handoff still was not instantaneous. An Interim Registration Data Policy, effective in May 2019, required contracted parties to continue implementing measures consistent with the Temporary Specification while the detailed policy was built. The final Registration Data Policy was published in February 2024, entered a transition period that August, and became effective on 21 August 2025. Its official record also notes a May 2026 update concerning urgent lawful-disclosure requests.

That long implementation period does not convert the original emergency act into permanent Board law. The authority changed form. Temporary contractual force ended; Board-adopted GNSO recommendations supplied consensus-policy authority; an interim instrument preserved continuity; implementation translated recommendations into operative requirements.

The distinction matters whenever urgency is used to justify governance shortcuts. ICANN's 2018 mechanism was strong enough to change contractual duties before a legal deadline, but it was paired with findings, a supermajority requirement, regular reaffirmation, a hard outer limit and an immediate route into community policy development. Its legitimacy did not depend on pretending that the emergency had solved every disclosure dispute. It depended on making the emergency power executable and temporary at the same time.

Sources