Since its creation, the Internet Corporation for Assigned Names and Numbers (ICANN) has been responsible for the establishment, oversight and implementation of policy for the internet domain name system (DNS), including delegation of responsibilities to DNS registries and registrars. In 1999, the Uniform Dispute Resolution Policy (UDRP) was created within ICANN, with the goal of providing an alternative to costly litigation for resolving disputes concerning cybersquatting in generic top-level domains (gTLDs). In 2004, ICANN created a dispute resolution policy for inter-registrar domain name transfers. In 2011, ICANN adopted the new gTLD programme with a view to expanding the DNS with the introduction of new gTLDs. With the introduction of new gTLDs, ICANN has introduced additional rights protection mechanisms to prevent and remedy cybersquatting. In 2016, ICANN started a review of all of its rights protection mechanisms through an ICANN working group, which initially aimed at completing the first review phase in the first half of 2018. The first review phase is currently scheduled to complete early 2020.
General overview of the UDRP
The UDRP sets out the legal framework for the resolution of disputes between a domain name registrant and a third party over the abusive registration and use of domain names in gTLDs and country code top-level domains (ccTLDs) that have adopted the UDRP on a voluntary basis. All ICANN-accredited registrars that are authorised to register names in the gTLDs (and ccTLDs) have agreed to abide by and implement the UDRP. Any person or entity who registers a domain name in the gTLDs and ccTLDs in question is required to consent to the terms and conditions of the UDRP policy.
Since the adoption of the UDRP, over 70,000 complaints have been filed with the dispute resolution providers authorised by ICANN. The procedural rules for the UDRP have been reviewed recently and the new version of the rules is in effect for all UDRP proceedings in which a complaint is submitted to a provider on or after 31 July 2015. The UDRP itself is also up for review by an ICANN working group. However, the UDRP review will be part of a second phase, after the review of the other rights protection mechanisms has been completed.
Under the UDRP, any person or company in the world can file a domain name complaint concerning a gTLD alleging the abusive registration of a domain name against a domain name registrant.
The complainant can obtain the cancellation or transfer of, or other changes to, the domain name registration if he or she demonstrates that:
- the domain name is identical or confusingly similar to the trademark or service mark in which the complainant has rights;
- the registrant has no rights or legitimate interests in respect of the domain name; and
- the domain name has been registered and is being used in bad faith.
Complaints on the basis of the UDRP can be filed either in a court of proper jurisdiction or with an approved dispute resolution service provider that will appoint an administrative panel (ie, administrative proceedings). The remedies available to a complainant before an administrative panel are limited to the cancellation or transfer of the domain name registration to the complainant. Administrative proceedings are mandatory, meaning that any domain name registrant must accept the competence of the ICANN-accredited dispute resolution service providers to rule on a UDRP complaint.
This does not prevent the domain name registrant or the complainant from submitting the dispute to a court of competent jurisdiction for independent resolution before such mandatory administrative proceeding is commenced or after such proceeding is concluded. If the disputed domain name is or becomes the subject of other legal proceedings during administrative proceedings, the administrative panel may suspend, terminate or continue the administrative proceedings. In most cases, administrative panels consider that the UDRP dispute can be evaluated separately from ongoing court proceedings and decide to continue the administrative proceedings. If proceedings are terminated on the basis of other pending proceedings, this normally does not prevent the filing of a future UDRP complaint pending resolution or discontinuation of such court proceeding. It is in the administrative panel’s discretion to determine what weight to ascribe to previous court decisions. Similarly, courts are not bound by the administrative panel’s determinations. Correspondingly, administrative panels are not bound by similar decisions by previous administrative panels. The UDRP does not operate on a strict doctrine of binding precedent. However, because it is important for the overall credibility of the UDRP system that filing parties can reasonably anticipate the result of their case, the WIPO Arbitration and Mediation Center publishes a Jurisprudential Overview to assist in predictability. The latest edition, the Jurisprudential Overview 3.0, was published on 23 May 2017 after a review of thousands of WIPO panel decisions issued since the 2011 WIPO Overview 2.0. The Overview summarises consensus panel views on a range of common and important substantive and procedural issues and includes express references to almost 1,000 representative decisions from over 265 WIPO panellists.
Court proceedings immediately following the administrative panel’s determination are generally considered a de novo hearing of the case under national law. To allow for a useful hearing under national law, the domain name registrar will wait to implement the decision of an administrative panel to cancel or transfer a domain name for a period of 10 business days following the communication of the panel’s decision. The registrar will then implement the decision unless the domain name registrant communicates during that 10-business-day period official documentation (such as a copy of a complaint, file-stamped by the clerk of the court) that the domain name registrant has commenced a lawsuit against the complainant in a competent jurisdiction. If the registrar receives such documentation in a timely fashion, the registrar will not implement the administrative panel’s decision, and will take no further action until it receives satisfactory evidence of a resolution between the parties; satisfactory evidence that the lawsuit has been dismissed or withdrawn; or a copy of an order from such court dismissing the lawsuit or ordering that the domain name registrant does not have the right to continue to use the disputed domain name.
Pending administrative proceedings, court proceedings or arbitration, the registrar must ‘lock’ the domain name. This means that the disputed domain name may not be administered by another registrar or transferred to any party other than the complainant. In administrative proceedings, the lock will remain for a period of 15 business days after such proceedings are concluded. During court proceedings or arbitration, the disputed domain name may be transferred provided that the party to whom the domain name registration is being transferred agrees, in writing, to be bound by the decision of the court or arbitrator. The domain name registrant may also change registrars during a pending court action or arbitration, provided that the domain name shall continue to be subject to the proceedings commenced against the domain name registrant in accordance with the terms of this policy. In such event, the dispute shall remain subject to the domain name dispute policy of the registrar from which the domain name registration was transferred.
The updated UDRP rules include the following modifications:
- a complainant is no longer required to transmit a copy of the complaint to the domain name registrant;
- the registrar with which the domain name was registered must lock the domain name within two days following the receipt of the complaint from the UDRP provider. Within that time frame, the registrar must provide useful information such as the registrant’s contact details, which may have been hidden by a privacy service;
- a domain name registrant may request a four-day extension of the deadline to respond to a complaint, which will be automatically granted by the UDRP provider; and
- parties must follow specific steps in case they want to settle during the UDRP proceedings.
These amendments to the UDRP rules were designed to reduce the risk of cyberflight during an UDRP proceeding. A registrant can no longer change ownership of a domain name with intent to escape the dispute.
Competent dispute resolution providers
ICANN has accredited the following dispute resolution service providers (DRSPs) for handling administrative UDRP proceedings: the WIPO Mediation and Arbitration Center, the National Arbitration Forum (the Forum), the Czech Arbitration Court (CAC), the Asian Domain Name Dispute Resolution Centre (ADNDRC) and the Arab Center for Dispute Resolution (ACDR).
These DRSPs handle disputes regarding second-level domain name registrations in all new gTLDs and the following gTLDs: .aero, .asia, .biz, .cat, .com, .coop, .info, .jobs, .mobi, .museum, .name, .net, .org, .pro, .tel and .travel. Some of these gTLDs – the sponsored TLDs such as .aero, .biz and .jobs – apply registration criteria that differ from the UDRP and have additional policies for dealing with disputes about the registration criteria, such as the Restrictions Dispute Resolution Policy for .biz.
Timing and costs of administrative proceedings
Administrative proceedings last for approximately 75 days. The filing costs range from US$550 to US$1,700 in the case of a complaint regarding one to five domain names with the designation of a single-member panel. Higher costs may apply depending on the number of domain names at issue and the choice to appoint a three-member panel.
These costs do not include attorneys’ fees.
Some DRSPs such as the WIPO and the CAC provide for a partial refund in the event of the withdrawal of a complaint (that is if the complainant fails to remedy any deficiencies identified by the DRSP regarding the formal requirements of the complaint) or the termination of the proceedings prior to the appointment of a panel.
The prevailing party does not get a refund of his or her costs.
Impact of the EU General Data Protection Regulation (GDPR) on UDRP proceedings
As a consequence of the introduction of the GDPR in the European Union on 25 May 2018, publicly accessible WHOIS information has been severely restricted. The fact that certain domain name registration data, such as the domain name holder’s name, phone number, postal address and email address, is no longer directly available certainly creates challenges for initiating and conducting UDRP proceedings. Without the identity and contact information of the registrant, it becomes more difficult to prove elements such as (i) the lack of rights or legitimate interest in the domain name by the registrant; (ii) knowledge of the trademark rights by the registrant based on his or her location; (iii) a pattern of bad faith registrations by the registrant, etc. Difficulties also arise for the consolidation of complaints against multiple domain names registered by the same domain name holder. Although the overarching consolidation standard itself remains unchanged, complainants will increasingly have to rely on other indicia of common control in the absence of identity and contact information of the domain name holders in WHOIS.
The lack of information on the identity of the domain name holder does not foreclose the ability to actually file a UDRP complaint. Comparable to UDRP cases filed against a WHOIS privacy or proxy service, a complainant may file a UDRP complaint containing only the information that is available to him or her, even if this information is listed as ‘redacted’ in WHOIS. Such a ‘doe’ complaint can later be amended on the basis of the information provided by the registrar after the mandatory verification. If a complainant determines after registrar verification that the domain name holder does have a right or legitimate interest, or did not register or use the domain name in bad faith, he or she can still withdraw the UDRP complaint. In such a case, WIPO will refund the unused (US$1,000) panel fee, which is comparable to cases where parties settle prior to a WIPO panel being appointed. The CAC will withhold a processing fee equal to the CAC’s administrative fee and return the remainder of the UDRP fees to the respective parties when a complaint is withdrawn or a proceeding is terminated before the panel has been appointed.
Dispute resolution in new gTLDs
The UDRP applies to all new gTLDs. In addition, ICANN has developed new procedures to prevent and combat cybersquatting and to deal with other disputes in relation to the registration requirements for specific types of gTLDs and with a view to preserving the public interest commitments of new gTLD registries.
Preventing cybersquatting during the launch of new gTLDs: the Trademark Clearinghouse
The launch of every new gTLD must be preceded by a process whereby brand owners have the opportunity to protect their trademarks at the second level (ie, as a domain name) in such TLD. The Trademark Clearinghouse was established for this purpose. The Trademark Clearinghouse is a database holding validated trademark information in relation to domain names and provides a centralised location for storage and authentication of trademark information. The Trademark Clearinghouse supports both the sunrise period and the trademark claims service that precede the launch of a new gTLD. The sunrise period is a period of a minimum of 30 days allowing trademark holders to register their validated trademarks as domain names in a new gTLD before others are allowed to register domain names. The trademark claims service provides notice to potential registrants of existing trademark rights that are validated in the Trademark Clearinghouse, as well as notice to rights holders of relevant names registered. The trademark claims service must be offered for a minimum of 90 days.
New gTLD registries may offer additional rights protection mechanisms.
New mechanisms to combat cybersquatting in new gTLDs: Uniform Rapid Suspension System (URS) and trademark PDDRP
As explained by its name, the URS is a rights protection mechanism allowing the rapid suspension of domain names. It offers a low-cost, fast path to relief for rights holders in clear-cut cases of infringement. These cases are brought before ICANN-accredited URS providers. Currently, the Forum, MFSD and the ADNDRC are the only approved DRSPs for handling URS complaints.
The complainant in URS proceedings must demonstrate that:
- the registered domain name is identical or confusingly similar to a word mark for which the complainant holds a valid national or regional registration and that is in current use; that has been validated through court proceedings; or that is specifically protected by a statute or treaty in effect at the time the URS complaint is filed;
- the registrant has no legitimate right or interest to the domain name; and
- the domain was registered and is being used in bad faith.
The burden of proof is clear and convincing evidence.
When submitting a URS complaint, the disputed domain name will be locked within 24 hours, meaning all changes to the registration data, including transfer and deletion of the domain, will be blocked. However, the name will continue to resolve to the website. After the filing of the complaint, the respondent has 14 days to file a response. In the absence of extraordinary circumstances, a decision must be issued no later than five days after this period or after the response is filed.
If the complainant prevails, the domain name shall remain suspended for the remainder of the registration period or until it is transferred following subsequent UDRP proceedings and will resolve to a web page explaining why the domain name has been suspended.
The costs of a URS procedure (excluding attorneys’ fees) vary between US$360 and US$500 in function of the DRSP and the number of disputed domain names.
The trademark post-delegation dispute resolution procedure (PDDRP)
A rights holder can bring a complaint under the trademark PDDRP if it believes a new gTLD registry operator is actively engaging in or contributing to infringing behaviour. Infringing behaviour can either relate to the use of the gTLD itself or to the use of domain names in the new gTLD.
In relation to the use of the gTLD, a complainant must assert and prove, by clear and convincing evidence, that the registry operator’s affirmative conduct in its operation or use of its gTLD string that is identical or confusingly similar to the complainant’s mark, causes or materially contributes to the gTLD doing one of the following:
- taking unfair advantage of the distinctive character or the reputation of the complainant’s mark;
- impairing the distinctive character or the reputation of the complainant’s mark; or
- creating a likelihood of confusion with the complainant’s mark.
An example of infringement at the top level is where a TLD string is identical to a trademark and the registry operator holds itself out as the beneficiary of the mark.
In relation to the use of domain names in the new gTLD, complainants are required to prove, through clear and convincing evidence, that through the registry operator’s affirmative conduct:
- there is a substantial pattern or practice of specific bad faith intent by the registry operator to profit from the sale of trademark-infringing domain names; and
- the registry operator’s bad faith intent to profit from the systematic registration of domain names within the gTLD that are identical or confusingly similar to the complainant’s mark, which:
- takes unfair advantage of the distinctive character or the reputation of the complainant’s mark;
- impairs the distinctive character or the reputation of the complainant’s mark; or
- creates a likelihood of confusion with the complainant’s mark.
It is not sufficient to show that the registry operator is on notice of possible trademark infringement through registrations in the gTLD. The registry operator is not liable under the PDDRP solely because infringing names are in its registry; the registry operator knows that infringing names are in its registry; or the registry operator did not monitor the registrations within its registry.
A registry operator is not liable under the PDDRP for any domain name registration that is registered by a person or entity that is unaffiliated with the registry operator; is registered without the direct or indirect encouragement, inducement, initiation or direction of any person or entity affiliated with the registry operator; and provides no direct or indirect benefit to the registry operator other than the typical registration fee (which may include other fees collected incidental to the registration process for value-added services such as enhanced registration security).
An example of infringement at the second level is where a registry operator has a pattern or practice of actively and systematically encouraging registrants to register second-level domain names and to take unfair advantage of the trademark to the extent and degree that bad faith is apparent. Another example of infringement at the second level is where a registry operator has a pattern or practice of acting as the registrant or beneficial user of infringing registrations to monetise and profit in bad faith.
The appointed expert panel in a trademark PDDRP may recommend a variety of graduated enforcement tools against the registry operator, ranging from remedial measures for the registry to employ to ensure against allowing future infringing registrations to the termination of a registry agreement in extraordinary circumstances.
The WIPO, the Forum and the ADNRC are competent DRSPs for handling trademark PDDRP complaints. The administrative costs, excluding the fees of the expert panel, amount to approximately US$1,700. Trademark PDDRP proceedings are expected to be handled within two months. Either party shall have a right to seek a de novo appeal within 20 days after an expert determination is issued. To date, no complaint has been filed under the trademark PDDRP.
Dispute resolution in relation to registration requirements and public interest commitments
Restricted Registry Dispute Resolution Policy (RRDRP)
Some new gTLDs are defined to serve a community defined by the gTLD registry operator and apply registration restrictions that are outlined in the registry agreement between the registry operator and ICANN. The RRDRP is intended to address circumstances in which a community-based new gTLD registry operator deviates from these registration restrictions.
Complainants who assert being a harmed established institution as a result of the community-based gTLD registry operator not complying with the registration restrictions set out in the registry agreement have standing to file a complaint under the RRDRP. For a claim to be successful, the claims must prove by a preponderance of evidence that:
- the community invoked by the objector is a defined community;
- there is a strong association between the community invoked and the gTLD label or string;
- the TLD operator violated the terms of the community-based restrictions in its agreement; and
- there is measurable harm to the complainant and the community named by the objector.
The expert panel may recommend a variety of graduated enforcement tools against the registry operator if the expert panel determines that the registry operator allowed registrations outside the scope of its promised limitations. In extraordinary circumstances where the registry operator acted with malice, the expert panel may recommend the termination of a registry agreement.
An expert determination must be rendered within 45 to 60 days from the appointment of the expert panel. Either party shall have a right to seek a de novo appeal of the expert determination within 20 days following the expert determination.
The Forum is currently the sole DRSP that is appointed, and no case has yet been referred to it.
The Public Interest Commitment Dispute Resolution Policy (PICDRP)
The PICDRP addresses complaints that a registry may not be complying with the public interest commitments in its registry agreement. Unlike other dispute resolution mechanisms created by ICANN, no DRSP has been appointed. The PICDRP is organised under the auspices of ICANN, and ICANN appoints a PICDRP standing panel. On 14 March 2017, a three-member PICDRP panel issued its first decision, finding that the registry operator of the .feedback gTLD failed to operate the TLD in a transparent manner consistent with general principles of openness and non-discrimination. The panel found the following violations:
- announcements of policy changes were made in the news media instead of through the registry’s website and without adherence to the 90-day notice requirement established by the registration and launch policies of the .feedback gTLD;
- the registry operator also failed to adhere to the notice requirement for a change in policy when it introduced an ‘early access, free speech partner programme’ during the sunrise period;
- there was lack of transparency in relation to applicable fees and in relation to the policy applicable to the registry’s free .feedback website, which enabled the registration of domain names in the name of trademark holders without the trademark holders’ consent; and
- the self-allocation or reserving of domain names that correspond to the trademark holders’ mark during the sunrise period constitutes a failure to adhere to the registry operator’s registration and launch policies.
Following the PICDRP panel’s decision, ICANN issued a notice of breach of the registry agreement to the .feedback registry operator, requiring the registry operator to cure the breaches by 15 April 2017, failing which ICANN may commence the registry agreement termination process. Ultimately, the breaches were cured before the deadline.