MENU
  • Enom.com
  • Resellers

Enom Blog

News
Category

  • The GDPR: what it is and why it matters to you

    October 30, 2017

    Announcement, Featured, GDPR, Industry Insight, News

     Like

    Views: 6352

    Update: March 6, 2018

    Previously, we had announced plans to apply GDPR-related requirements and processes only to domains registered by EU-local individuals. We have since changed our approach and now plan to extend these heightened privacy and security requirements to all registrants and reseller partners. This streamlined solution ensures that our platform is secure and GDPR-compliant, and recognizes that there are privacy laws worldwide, beyond the GDPR, which must be respected.


    “Data privacy by design, data privacy by default.” You may have heard this phrase recently, on Twitter or in blog posts, but where does it come from? What does it really mean? Most importantly, how does it affect your customers and their domain names?

    What is the GDPR?

    The European Union’s General Data Protection Regulation (“GDPR”), coming into effect in May 2018, lays out a new set of rules for how the personal data of people living within the EU (“EU-local individuals”)* should be handled. It sets out the protection of personal data as nothing less than a fundamental human right, alongside other rights such as freedom of expression, freedom of thought, and the right to a fair trial. The GDPR is complex and far-reaching, and we’ll look at a few of the most impactful areas in this blog post. You can also keep an eye out for updates on our dedicated GDPR page.

    Data privacy by design, data privacy by default

    How many times have you bought a concert ticket online or RSVP’d to an event, only to find your inbox unexpectedly filling up with the concert venue’s newsletters and invitations to other events that are only tangentially related? Wouldn’t it be great if service providers had to get permission to use your contact information for anything other than what you’d provided it for in the first place?

    That type of clear, informed consent is one of the basic requirements in the GDPR. Any business taking in your personal data not only has to explain what they need it for, they’re also simply not allowed to require you to provide more information than the absolute minimum they need to get the job done. What’s more, they can’t use your info for any purpose other than that to which you agreed to in the first place. This puts you in charge of how your info is used from the very start — by design and by default — instead of making you unsubscribe after the fact.

    Direct mail campaigns aren’t as popular as they used to be, but I still get a few pieces of paper mail each week, and I’m always both amused and a little scared at how companies I’ve never heard of get my contact information. A friend of mine used to put the name of the service provider in the second line of his address every time he signed up for something new, and he was amazed to find that his credit card and telephone providers shared his info with any number of sales companies.

    Online marketers these days use email rather than postal mail, of course, but the underlying issue of your personal data being shared by someone you trusted with it remains, and the GDPR takes aim at this problem as well. Not only should companies’ use of your data remain within the limits of what you consented to, but the data needs to be stored securely, accessed only for the reasons already agreed upon, and cannot be shared with third parties outside the bounds of this regulation and what you consented to.

    Quick, transparent reporting on data security breaches

    We all know mistakes happen, and security best practices are constantly evolving. Living in the world means accepting some measure of risk, and it seems that every few days there’s a news story about a major data breach affecting hundreds of thousands of people — but usually by the time we hear about it, the breach happened months ago, leaving sensitive information exposed to the world and the affected people unaware. The GDPR addresses this with a timeframe around breach notifications, requiring that people whose information has been compromised are notified as soon as possible. This notice must include an explanation of what happened, what’s being done to fix it, and what the affected people should do to protect themselves. This type of information empowers each person to respond the way they think is best in each circumstance in order to protect their own privacy.

    The right to be forgotten

    I once created an account with a subscription box service, the kind that would send me new makeup every month. Only after I signed up did I discover that they were all sold out… I wouldn’t get anything for at least six months, if not longer — I can’t wait that long for new lipstick! I canceled the account, but couldn’t get them to stop emailing me, asking me to reactivate, choose my colours, pick my brands. Why can’t they just forget all about me? Or, for a perhaps more serious example, how often do we hear stories about people who lose out on job opportunities for which they would be very well-suited, just because of youthful indiscretions that still come up high in online search results?

    That’s another important aspect of the GDPR: the right to be forgotten. Under these new rules, people can go back to service providers and revoke the consent to use their data, requiring the provider to remove all records and essentially erase them, giving them a fresh start. Now, this may not be without consequences (some services can’t be provided without personal information) and may not always be applicable (sometimes personal information has to be kept for reasons of public interest or relating to legal claims), but it’s certainly a lot more effective than sending an “unsubscribe” email, blocking the sender’s email address, and hoping for the best.

    How does this apply to the domains world?

    You might be thinking, “I’m not even in the EU! Why does it matter?” Are you a reseller with clients in the EU? Does your business have the potential to process the data of EU-locals? You now need to ensure that you’re obtaining permission from these customers to use their personal data, and meeting the updated requirements surrounding its handling. This should involve a talk with your lawyer(s). Though we’re making an effort to provide resources and context, the information we’re providing should not be considered legal advice. Seeking professional, legal counsel from someone who is familiar with your specific situation is critical.

    If you’re an Enom reseller, you’ll also need to familiarize yourself with the platform-wide changes we’ll be making (I recommend subscribing to receive GDPR updates). Among other changes, we’re working on amending our Agreements with our resellers, including Privacy Agreements, to allow resellers full access to the info in the Control Panel without any concerns around GDPR violations.

    While the rules outlined in the GDPR apply only to EU-local individuals*, changes to how data is collected and handled may happen on a global scale as companies modify their existing practices to ensure they are compliant with these new regulations. We will try to minimize any disruption to our domain management and registration processes for registrants and resellers.

    Going back to the “data privacy by design and by default” idea, what it means is that all these regulations around protecting personal information can’t just be afterthoughts, they need to be “baked in”, part of the system that’s on unless you turn it off. We’ll be empowering our clients to understand what information we hold and how it’s used, to give consent to us for that use, and to request erasure of data in cases where consent cannot be provided.  

    Changes we’re making at Enom

    These data privacy protections touch almost every aspect of the domain onboarding process and lifecycle. We’re working through our detailed plans now, and will soon be able to share more information about our implementation; today I will share some highlights. As we work through this project, we’re keeping two things in mind: our need to operate within the bounds of legal requirements, and our commitment to keeping domain purchase and management as straightforward, simple, and instantaneous as possible for the end-user.

    Thinking about consent, we’ll implement a post-purchase consent process, similar to the Registrant Verification request we send when a new domain is registered. We may combine the two into a single request if both verification and consent are needed at the same time. Watch for details on this process in upcoming blog posts and our GDPR page.

    We already store your data securely, but we’re doing some internal review to see how we can strengthen our protections to keep information safe. Thinking back to the example of the marketing company who shared info with third-party companies, I want to make it clear that Tucows does not share personal data beyond what’s needed to provide the service that the client ordered. We never sell our client’s personal information, and we certainly aren’t going to start now.

    Although in a perfect world every domain would stay with Tucows forever, I know that, realistically, some people want to use other Registrars, or don’t want to renew every domain they have registered until the end of time. And when they’re no longer our client, they may not be comfortable with Tucows storing their personal data. That’s where the right to be forgotten comes in; we’ll be reviewing our data retention procedures, and putting in place a method for people to request erasure of personal data from our platform. As I said earlier, this is not without consequences, but in some cases (like my ill-fated makeup box subscription) it’s necessary.

    Conclusion and Next Steps

    I hope that this overview of the GDPR and the changes we’re looking at making has been helpful, and explains why this new regulation is important not only for our European clients, but for our resellers worldwide. I know it’s a lot of information, and that you have many questions. We’ll be reaching out to resellers on implementation details soon, and keeping you informed as we move through this process. Until then, check out our blog and GDPR page for more details as May 25 2018 approaches!

    *Initially, this post employed the terms “EU citizens” and “EU customers” in place of “EU-local individuals.” The term “EU-local individuals” was introduced to provide clarity.


    Learn more about the GDPR:

    GDPR Updates – Understand Enom’s approach to the policy

    • GDPR-Related Contract Changes (Published on Mar. 5, 2018)
    • The GDPR’s Right to Be Forgotten (Published on Jan. 18, 2018)
    • Consent and the GDPR (Published on Dec. 21, 2017)
    • How will the GDPR impact Whois? (Published on Nov. 9, 2017)

    GDPR Resources – View third-party resources on a specific GDPR topic

    • Right-to-be-forgotten-related resources (Published on Feb. 1, 2018)
    • Consent-related resources (Published on Jan. 4, 2018)
    • Whois-related resources (Published on Dec. 7, 2017)
    • GDPR Basics & Best Practices Resources (Published on Nov. 9, 2017)

    Read More

  • Telcos want control of the Internet. Together we can still stop them.

    July 12, 2017

    News

     Like

    Views: 2865

    Time is running out to protect the Internet as we know it. Today is a day to rally. A day to talk, to reach out and especially to act.

    It’s the last chance to fight to keep fair and equal access to the Internet. The day we exercise our freedom of speech to maintain the same right online. The day we hold high the principle of common carriage; the principal that service providers must serve the general public without discrimination. A principle that started with blacksmiths, innkeepers and ship owners and is today part of our social contracts with public airlines, railroads, buses, taxicabs, freight and phone companies and yes, Internet service providers. The latter, because as Public Knowledge said so succinctly:

    “Networks are so vital to the functioning of society that the maintenance of such networks cannot be left to the market solely.”

    The Internet is the world’s principal source of information. We deserve access to all lawful content unedited, unfiltered, uncensored, unfettered. We want real journalism, not an echo chamber. We want to hear all voices, not only the ones who’ve paid to speak.

    We don’t want a two-tiered system controlling online communication. We are not alone.

    At Tucows, Enom’s parent company, we believe the Internet is the greatest agent for positive change the world has even seen. We are thrilled and humbled by what can be achieved when billions of people have access to information and a vehicle to communicate, collaborate and co-create. We are increasingly wary of large corporations that are willing to compromise customer experiences and impede progress to protect market share. We are similarly concerned about politicians that legislate on the Internet without truly understanding the world they are affecting.

    So today we ask you to join our voice to protect the open Internet, by asking the FCC to preserve net neutrality. It’s easy. We promise.

    Read More

  • Symantec and Google avert SSL meltdown

    June 7, 2017

    Announcement, Featured, News, SSL

     Like

    Views: 4019

    Google shook up the SSL industry back in March of this year when they released a proposal addressing “a series of failures by Symantec Corporation to properly validate certificates.” The outlined restrictions would effectively withdraw the Chrome browser’s trust in all certificates issued by Symantec. They notably included the removal of the green browser address bar, the primary visual indicator of Symantec-issued Extended Validation (EV) certificates.

    Though aimed at developers, the announcement sent waves of concern and uncertainty through the entire SSL industry and beyond. Symantec’s initial response defended their validation processes. However, details surrounding the alleged mis-issuance of thousands of certificates had already been released. It appeared that in the end, certificate holders were likely to suffer from the results of this power struggle.

    Since then, what was initially an explosive public debate has turned into a nuanced and constructive conversation, wherein both major players have taken on a more diplomatic stance. Both parties now seem committed to finding a way forward that will minimize the impact on Symantec customers and their end-users.

    Two months following the release of the initial proposal, Google and Symantec, with input from the rest of the Internet community, seem to have arrived at a common solution. On May 19, 2017, Google proposed an updated plan that would require Symantec to implement some significant changes to the way they operate their Certificate Authority (CA). In return, Google would continue to support Symantec certificates in their Chrome browser.

    Symantec responded to the new proposal last week, and while a few details still need to be ironed out, there appears to be general agreement on how to move forward. The good news is that most of the heavy lifting will fall to Symantec and, to some extent, the browser developers, instead of the certificate holders.

    Here’s what we can expect to see if this updated proposal is enacted:

    • Symantec would essentially rebuild its internal infrastructure from scratch over the next two years to create a new platform for certificate validation and issuance.
    • Until their modernized internal platform is ready, and its associated root keys are accepted across all major browsers, Symantec would work with 3rd-party CAs to perform the validation process. It’s important to note that the root keys tied to the previous platform would remain in place, allowing browsers to easily determine whether a certificate was issued from the old or new platform.
    • Partnering with trusted sub-CAs would allow Symantec to continue to issue Extended Validation (EV) certificates, and enable Chrome and other browsers to maintain trust for EV certificates and continue to display the green address bar.
    • Newly-issued certificates would be valid for longer than the 9-month period originally suggested by Google, though the exact length of the validation period is still being discussed.
    • Existing certificates, issued prior to June 1, 2016, might be gradually phased out and may eventually require revalidation. It is unclear at this time however, if this requirement is feasible, given the vast number of certificates that would need to go through the revalidation process.

    There’s still plenty of discussion about the details, but the nature of the conversation suggests that a solution, one which averts a major SSL meltdown, will be reached sooner rather than later. We’ll keep you updated as the fine points are finalized. The good news is that at present, there’s reason to remain confident in your existing SSL Lineup and selling practices.

    Read More

  • Enom 3 months after the Tucows acquisition

    May 8, 2017

    Announcement, Featured, News, Roadmap

     Like

    Views: 3695

    It’s hard to believe it has been 3 months. Since the acquisition, we have been working diligently (and harder than we have ever worked in our lives). We wanted to take a moment to give you a quick update on the work being done, and it’s also important for us to share our vision for the future.

    Enom and OpenSRS now form the largest wholesale registrar in the world. The 2 brands under the Tucows umbrella have nearly 40 years of combined industry experience. The acquisition of Enom shows that Tucows continues to believe and invest in the wholesale domain space.

    Engineering work

    We have started multiple engineering initiatives focused on improving the Enom platform such as more convenient login and credentials management. You will see more features rolling out over the coming months, such as a new end-user access portal. We are committed to putting our customers first so, as a reseller, you should expect us to get involved with you. We are interested in getting your input over the next couple months so we learn more about what your needs are and empower you to be successful.

    Customer service

    At Tucows, we strongly believe in great customer service. We have been actively working on improving service for all Enom customers, including new support tools and systems that better connect your needs with our solutions. Expect us to further invest in our customer service for Enom so we can serve you even better.

    Our collective experience at your service

    Now being the 2nd largest domain registrar worldwide, with two excellent brands and a combined team of great people with many years of experience, we have a unique chance to develop our wholesale services platform with tools that are tailored to our customers needs and are easy to use.

    Remote offices

    Tucows will continue to run the Kirkland office. With more than 80 people, Kirkland will continue to house a significant portion of the talent responsible for the domains business.

    Search for new talent

    We are currently hiring customer service advisors and an UX designer to join our Kirkland office. As a talent looking to join Tucows in Kirkland, expect to work for a passionate team that values your career development and opportunity to have an impact. We are dedicated to the best solutions for our customers, creating tools and services that you can be proud of. We have free Friday lunches, are dog-friendly, and are located across from Houghton Beach in Eastside Seattle’s only waterfront town.

    We’ll keep you up to date as the work progresses on our end.

    The Tucows team

    Read More

  • A new chapter for eNom

    January 20, 2017

    Announcement, Featured, News

     23

    Views: 7037

    For the past 20 years, eNom has enabled businesses and consumers to define and establish their online presence. As one of the early wholesale registrars, we provide the technological infrastructure to support a network of approximately 28,000 active resellers and 14 million domains under management.

    Today, a new chapter begins. We’ve entered into an agreement for Tucows Inc. to acquire eNom from Rightside. For years, eNom and OpenSRS have been the two leading registrars primarily focused on the needs of resellers. We feel that this acquisition will keep resellers where they will be well understood, well valued and well served and will create tremendous value through efficiency and scale.

    For our valued customers and resellers, rest assured that Tucows will be here for you just as we have been for the last two decades. Also be assured that you will not see any immediate changes. You will continue to operate on the eNom platform through the eNom API and have access to all TLDs, products, account management and support. It will be business as usual for the foreseeable future.

    We thank you for your partnership, and we are confident that this next chapter will be a successful one for the eNom brand as well as for eNom customers and resellers.

    For more information about this acquisition, please read the OpenSRS blog post and the Tucows’ press release.

    Read More

1 2 … 4 Next »

FEATURED POSTS

  • Colleagues review ICANN's temporary specification requirements.

    What Domain Resellers Should Know About ICANN’s Temporary Specification

    September 18, 2018

  • keys on surface.

    Enom’s Tiered Access Directory (gated Whois)

    June 19, 2018

  • What you should know about ICANN’s May 25th Legal Action

    May 29, 2018

  • A Guide to Choosing the Right SSL Certificate

    May 24, 2018

CATEGORIES

  • Advice
  • Announcement
  • Developers
  • DNS
  • Featured
  • Fun
  • GDPR
  • Industry Insight
  • New TLDs
  • News
  • Premium Domains
  • Promotion
  • Resellers
  • Roadmap
  • SSL
  • Uncategorized
  • WTB

ARCHIVES

  • February 2019
  • January 2019
  • December 2018
  • November 2018
  • September 2018
  • August 2018
  • June 2018
  • May 2018
  • April 2018
  • March 2018
  • February 2018
  • January 2018
  • December 2017
  • November 2017
  • October 2017
  • September 2017
  • August 2017
  • July 2017
  • June 2017
  • May 2017
  • April 2017
  • March 2017
  • February 2017
  • January 2017
  • December 2016
  • November 2016
  • October 2016
  • September 2016
  • August 2016
  • July 2016
  • June 2016
  • May 2016
  • April 2016
  • March 2016
  • January 2016
  • December 2015
  • November 2013
Support

Report Abuse
Help Center
Contact Us

Resources

WHOIS Lookup
Maintenance Alerts
Developers
Products & Services

Domain Name Search
Premium Domains
Web Hosting
SSL Certificates
Website Builder
Basic Email
Bulk Tools

© 2019 Enom Blog |