Version 2.2, 18. July, 2023
1. General
Under section 18(3) and (4) of the Danish Act on Internet Domains (lov om internetdomæner), registrants are entitled to be anonymous in Punktum dk’s whois database, provided that their data is exempt from publication under other legislation.
This means that any natural person with name and address protection in the Danish CPR register (or a similar public register abroad) and an unlisted or ex-directory telephone number with their telephone provider may become anonymous in Punktum dk’s whois database.
Under section 18(5) of the Danish Act on Internet Domains, data exempt from publication may be disclosed to the Complaints Board for Domain Names and other parties so entitled under other legislation.
In continuation of this, Punktum dk has established the following procedure for the disclosure of data on natural persons who are anonymous in Punktum dk’s whois database.
Requests from natural or legal persons or authorities for disclosure of anonymous personal data from Punktum dk’s whois database must be submitted in writing, either by letter to:
Punktum dk A/S, Ørestads Boulevard 108, 11. sal, 2300 København S, or via our contact form.
Punktum dk is entitled to refuse to handle requests which cannot be verified by Punktum dk. The requisitioner’s request must contain the following information:
- who is requesting the data,
- what is the purpose of the request, and
- what is the background of the request.
Making a request anonymously or asking Punktum dk not to inform the registrant who made the request is not possible.
Punktum dk may stipulate its handling of the matter on the condition that the requisitioner provides more information than the information stated above to determine whether the requisitioner has a legal interest in obtaining the data.
2. Disclosure of data to certain public authorities
Disclosure of data to the public authorities specified below may comprise of the following data: personal data on the registrant, proxy and billing contact (payer) by specification of name and address. In exceptional cases, Punktum dk may also disclose information on the telephone number, user ID and email address of the registrant, proxy and billing contact (payer) if a reason for the request is given.
The Danish Complaints Board for Domain Names
Under section 18(5)(number 1) of the Danish Act on Internet Domains, personal data associated with specified domain names and user IDs may be disclosed to the Danish Complaints Board for Domain Names when a request is made as part of the Board’s handling of a complaint.
Upon the disclosure of data in such cases, Punktum dk will notify the persons affected.
Police and prosecuting authority
Under section 8 of the Danish Data Protection Act (databeskyttelsesloven), personal data associated with specified domain names and user IDs may be disclosed to the police or the prosecuting authority when the police or the prosecuting authority requires such data in connection with the investigation of criminal offences.
Upon the disclosure of data in such cases, Punktum dk will not notify the persons affected.
The Ministry of Culture
Under Article 6(e) of the General Data Protection Regulation, personal data associated with specified domain names and user IDs may be disclosed to the Ministry of Culture when the request is based on the provisions of the Danish Act on Legal Deposit (pligtafleveringsloven).
Upon the disclosure of data in such cases, Punktum dk will not notify the persons affected.
SKAT (Danish tax authorities)
Personal data associated with specified domain names and user IDs will be disclosed to SKAT (the Danish Tax Authorities) when the request is based on the provisions stipulated in section 8 C of the Danish Tax Control Act (skattekontrolloven) and/or section 75(1) of the Danish VAT Act (momsloven). Upon the disclosure of data in such cases, Punktum dk will notify the persons affected unless the requisitioner specifically requests otherwise.
The Danish Data Protection Agency
Under section 29 of the Danish Data Protection Act (databeskyttelsesloven), personal data associated with specified domain names and user IDs may be disclosed to the Danish Data Protection Agency when a request is made as part of the Danish Data Protection Agency’s handling of a complaint.
Upon the disclosure of data in such cases, Punktum dk will notify the persons affected unless the requisitioner specifically requests otherwise.
Other public authorities
For public authorities other than those specified above, Punktum dk may disclose personal data associated with specified domain names and user IDs if such disclosure is provided under the terms of other legislation, including the Danish Data Protection Act.
Upon the disclosure of data in such cases, Punktum dk will notify the persons affected unless, as part of the case handling, the requisitioner deems that such notification is not appropriate and specifically requests that Punktum dk does not notify the persons affected.
3. Disclosure of data to all others
Disclosure of personal data to parties other than the public authorities specified above may comprise the following data: personal data on the registrant, proxy and billing contact (payer) by specification of name and address. Thus, information about email addresses, telephone numbers and user IDs is not disclosed.
When Punktum dk receives a request for the disclosure of anonymous personal data, Punktum dk initially assesses whether the requisitioner has a legal interest in the matter. A legal interest is the requisitioner’s special, qualified interest in disclosure of the personal data, including, for example, the requisitioner’s creditable interest in having a case against the registrant of a given domain name tried by the courts. In that connection, Punktum dk does not make a legal assessment of the requisitioner’s claims for any infringement, for example on a given website, made by the registrant of the domain name.
If Punktum dk assesses that the requisitioner does not have a legal interest in disclosure of the data, Punktum dk will reject the request and take no further action.
If Punktum dk assesses that the requisitioner has a legal interest in disclosure of the data, Punktum dk will submit the request to the person whose data is requested to obtain this person’s position on whether the personal data may be disclosed. In the letter, the registrant is invited to submit any objections within a time limit of 14 days.
If the registrant accepts disclosure of the personal data to the requisitioner, the data concerned will be disclosed to the requisitioner.
If the registrant objects to such disclosure or if the time limit of 14 days is not complied with, Punktum dk decides whether or not the personal data shall be disclosed based on a weighing up of interests under article 6 (f) of General Data Protection Regulation. Punktum dk’s decision is made on the basis of the information provided by the requisitioner and the registrant in the case. Punktum dk will inter alia include the following aspects in the weighing up of interests:
- An assessment of why the registrant does not want the personal data to be disclosed. If there are weighty reasons as to why anonymity should be maintained, this speaks in favour of not disclosing the personal data without a prior discovery order.
- An assessment of the reason for the registrant’s name and address protection in the CPR register. If there are weighty reasons for the protection, this speaks in favour of not disclosing the personal data without a prior discovery order.
- An assessment of whether it is possible to for wait for a discovery order. If the matter is non- urgent, this speaks in favour of not disclosing the personal data.
- An assessment of whether the infringement still exists. If the infringement no longer exists, this speaks in favour of not disclosing the personal data without a prior discovery order.
- An assessment of the nature of the infringement and the consequences for the requisitioner if the data is not disclosed.
Both the requisitioner and the registrant whose personal data is requested must, as far as possible, be informed of the outcome of the case no later than four weeks after Punktum dk received an adequate request for disclosure.
Where Punktum dk decides that personal data will not be disclosed, and where the requisitioner needs the data to clarify who can be sued, the requisitioner may request a discovery order against Punktum dk in order to have the data disclosed. The discovery order may be requested under section 299 of the Danish Administration of Justice Act (retsplejeloven) in combination with section 343(1) of the Danish Administration of Justice Act, which – pursuant to applicable case law – provides the statutory basis for obtaining an order of the court requiring disclosure of data from a third party, although this is not done for use in pending court proceedings.
4. How to appeal
Punktum dk’s decisions under this procedure may be brought before the Danish Complaints Board for Domain Names.
The present Procedure for the disclosure of data on natural persons who are anonymous in Punktum dk’s whois database has been drawn up in Danish and English. In the event of any discrepancy between the two versions, the Danish version shall apply.