Hey UDRP panelists, we need to talk about Whois privacy

Have some panelists still not gotten the memo?

Yesterday, I wrote about Whois privacy and UDRP complaints. I took issue with World Intellectual Property Organization panelist Warwick Rothnie’s decision not to find reverse domain name hijacking, in part because the Respondent’s identity was protected by a privacy service.

Well, another day, and another decision (PDF) by Rothnie not to find reverse domain name hijacking, in part based on Whois privacy.

I’m not going to judge whether or not Rothnie should have found RDNH in the case of KSuite.com. However, I am going to judge part of his reasoning.

Overall, Rothnie found in favor of the domain owner because the domain was registered well before the Complainant had any trademark rights in the term. But on the issue of RDNH, his first rationale for not finding RDNH was:

First, the Respondent may have chosen to conceal its identity behind a privacy service. That is not illegal or necessarily evidence of some sort of inappropriate behaviour. Having chosen that course, however, the Respondent can hardly complain about someone else’s inability to identify it. All the more so where, as here, the nature of the website to which the disputed domain name resolved changed following the Complainant revealing its interest and there were also changes (of some sort) in the WhoIs Record and the nameservers.

I’m going to argue this is factually incorrect. The Whois record clearly shows the Respondent’s organization name. The other fields are indeed blocked, but they state “Redacted for GDPR privacy”.

This is not choosing to conceal your identity. This is how Whois works thanks to GDPR.

And, as is the process when a UDRP is filed now, WIPO relayed the registrant’s information:

The Center sent an email communication to the Complainant on May 20, 2025, providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant filed an amendment to the Complaint on both May 21 and May 22, 2025.

So, even though the registrant’s identity was public in this case, the Complainant was certainly aware of the registrant’s identity when it filed the amended complaint. That is the point at which the panelist needs to consider whether the case should have been filed.

Does WIPO need to retrain its panelists about how things work with GDPR?