Increased regulation of the .is national domain needs explanation

Viðskiptaráð has submitted a response on the proposed changes to the legislation on Icelandic national domains. According to the proposal, a specific bill is to be introduced amending the current legislation, aimed at promoting the safe and efficient use of the Icelandic national domain, improving its reputation, curbing cybercrime, strengthening consumer protection and promoting fair pricing.

As outlined in the proposal, registration of domains under the national domain '.is' has for many years been in the hands of the company Internet á Íslandi hf. (ISNIC). The company is the sole designated registrar of the Icelandic national domain under the international internet governance system, and it therefore alone allocates domains under '.is'.

In 2021, specific legislation on Icelandic national domains was enacted for the first time, Act No. 54/2021. When the act was passed, the approach taken was that the registry's operations would remain largely unchanged and the authorities' oversight powers would be kept moderate. The act also provided for the State Treasury's right of first refusal on the sale of shares in the company. Transactions involving ownership stakes in the company have since taken place without the State choosing to exercise its right of first refusal. The proposal in fact states that the authorities considered this option but decided not to exercise the right.

Grounds for substantially increased regulation unclear

According to the proposal, experience of implementing the current legislation has revealed various matters that the authorities consider could be improved. Among other things, reference is made to the fact that pricing of '.is' domains is higher than in neighbouring countries, that there is a lack of rules on the registration and use of domains, that action is needed against proxy registrations and the fraudulent misuse of domains, and that remedies for resolving disputes need to be improved. It is also proposed to strengthen the police's powers regarding domains linked to criminal activity, and consideration is being given to setting specific rules on the registry's obligations towards resellers.

Viðskiptaráð agrees that it is important for a clear framework to apply to the Icelandic national domain. It is also natural for the authorities to monitor whether the legal framework for important digital infrastructure is adequate, not least when it comes to cybersecurity and defences against criminal activity. However, it is not evident from the proposal that the current framework has been shown to be inadequate, or that experience of its implementation gives grounds for the substantial increase in regulation and public oversight being proposed. The activity is already subject to a specific legal framework, and ISNIC is subject to the public oversight of Fjarskiptastofa, in addition to which the activity is governed by international rules and standards. The proposal refers generally to various matters that could be improved, but provides limited detail on their scope, what problems they have caused in practice, or why the current rules and remedies have proved inadequate.

It is also essential for the authorities to bear in mind the nature of the activity in question. The administration of national domains is largely based on technical rules and international standards that need to be able to evolve alongside rapid technological change and new security threats. Overly detailed statutory regulation of the activity could reduce the registry's scope to respond swiftly to such developments, and could also increase the cost and complexity of registering '.is' domains. It is also worth noting that users have numerous other top-level domains available to them, and that Iceland-specific obligations could have a negative effect on the competitive position of the '.is' top-level domain relative to other top-level domains, which could lead to its being phased out in the longer term.

The proposal also represents a considerable departure from the approach enacted in 2021. At that time, a deliberate decision was made to continue letting a private entity handle the activity, with public oversight kept moderate. Now, only a few years later, a substantially increased regulatory burden and greater oversight of various aspects of the activity are being proposed, including pricing, registration rules and terms, dispute resolution and dealings with resellers.

In Viðskiptaráð's view, it needs to be made clear what experience of implementing the current legislation calls for such a significantly changed approach. The issues identified in the proposal are diverse and differ in nature, and do not necessarily call for the same remedies. Before proceeding with increased regulation, each issue therefore needs to be analysed separately, evidence presented on the scale of the problem at hand, and it must be shown that the current rules and remedies are inadequate. It also needs to be assessed whether the intended objectives can be achieved by less restrictive means. Otherwise, there is a risk of more extensive regulation being introduced than is warranted, without its necessity having been demonstrated.

Directly controlling pricing is a cause for concern

It is particularly notable that provisions on domain pricing are proposed. In support of this, the proposal chiefly refers to the fact that the price of '.is' domains is higher than in neighbouring countries and that the registry holds a monopoly position. Viðskiptaráð considers that such a comparison alone can scarcely justify direct government intervention in pricing. Price differences between countries can have various explanations, such as differing market size, operating costs, service levels and security requirements. Before introducing price controls or comparable public intervention, a detailed analysis of price formation is therefore needed, along with an assessment of whether it actually provides grounds for intervention.

When assessing pricing, it should be borne in mind that although ISNIC is the sole registry for '.is' domains, '.is' does not stand alone as an option for users. Companies and individuals have numerous other top-level domains available to them, such as '.com', '.net' and '.org'. The fact that a single entity handles registration of '.is' domains does not therefore in itself lead to the conclusion that pricing is exempt from all competitive discipline, since competition for domain registration is inherently international in nature, and users can respond to unfavourable pricing or terms by choosing other top-level domains.

Consideration also needs to be given to the incentives created by pricing. Too low an annual fee, for example, could increase negative incentives, make bulk domain registrations easier and lower the cost of using domains for fraudulent purposes. Price controls aimed solely at achieving a lower price could therefore have unforeseen consequences, and could even work against the objectives of security and efficiency that the proposal is intended to promote.

Pre-emptive rights and constitutional issues

When increased public intervention in ISNIC's operations is being proposed, it cannot be overlooked that the legislature has already created a specific means for the state to secure direct involvement in the activity through a pre-emptive right. The enactment of such a right was an unusual and onerous step into a private-law activity. The proposal states that, whenever transactions involving shares in the company have taken place, the authorities have assessed whether it would be advisable to exercise the Treasury's pre-emptive right, but the conclusion has been not to do so, partly because of the cost involved.

That decision carries particular significance in light of the changes now being proposed. Given that the state, on the one hand, has chosen not to exercise its statutory right to acquire the activity, but on the other hand intends, only a short time later, to significantly increase its involvement in the company's operational decisions, including potentially its pricing, questions arise as to the limits of such intervention.

This applies in particular if the proposed pricing provisions involve direct price controls that could significantly affect the company's revenue potential, value and operating assumptions. In Viðskiptaráð's view, when preparing the bill, a specific assessment therefore needs to be made of the compatibility of such provisions with the freedom to conduct business and the right to property under Articles 72 and 75 of the Constitution. That assessment must also have regard to proportionality and take into account the legitimate expectations that previous legislation and government decisions may have created. A general reference to the public interest cannot, on its own, relieve the authorities of the obligation to demonstrate the necessity and proportionality of such intervention.

A clear distinction should be drawn between different objectives

Viðskiptaráð also considers it important to distinguish between the different objectives set out in the proposal. The need for adequate powers to respond to cybercrime or to ensure the security of important digital infrastructure does not automatically mean that there is a need for increased public control over pricing or other commercial decisions of the registry. If there are shortcomings in the police's powers to respond to the use of domains in criminal activity, it is reasonable to examine these specifically. The same applies if a genuine problem is demonstrated regarding proxy registrations or a lack of effective means of resolving disputes. However, each such issue calls for an independent assessment of the necessity and proportionality of the remedies applied.

Proportionality should be observed in further developing the proposal

Viðskiptaráð emphasises that the importance of the '.is' domain as digital infrastructure cannot, on its own, justify any form of public intervention in the registry's activities. In the Chamber's view, it is important for the authorities to demonstrate a clear need for each additional obligation that is proposed to be imposed on the activity. Furthermore, the fact that only one entity handles registration of '.is' domains cannot automatically justify onerous, Iceland-specific regulation and oversight, nor does it in itself give the authorities grounds for interfering with the company's operational management.

Before further steps are taken in the preparation of the bill, an assessment should therefore be made of the scale of the problems it is intended to solve, whether and to what extent the current remedies are inadequate, and whether the objectives of the legislation can be achieved by less restrictive means.

This article was automatically translated from the Icelandic original.