Hacker News Reader

Whois can perfectly have only technical data.

- domain expiry

- domain registration date

- nameservers

Everything else is not needed and as such would comply with GDPR.

If you want EV certs you definitively need more information than that, part of the idea is that there is public verifiable information that only the owner can change.

But does it need to be personal information?

I think the short answer: It depends.

In some cases it's not enough to register the domain on a legal entity, it needs to be a person, and that person needs to exist in the company and needs to be contactable. You cannot get around this with EV certifications.

There are multiple ways to deliver gated access to registrant data only to those who need to know (like EV cert issuers). See e.g. RDAP, a JSON/REST successor protocol to WHOIS, which displays different amounts of data depending on if you're logged in and what data your account has access to.

Reply on news.ycombinator.com