On May 29, 2018, the German Regional Court of Bonn ruled on the principle of data minimization under Regulation (EU) 2016/679 (GDPR), which requires companies to limit the processing of personal data to what is necessary in light of the purpose of the processing. The decision focuses on the amount of personal data that domain registrars may collect upon domain name registration. It underscores the importance of ensuring that processing is limited to only that data which a company actually requires to meet its business need.

Only a few days after GDPR became effective, the Regional Court of Bonn ruled on the new EU-wide data privacy regulations. The Internet Corporation for Assigned Names and Numbers (“ICANN”) sought to force the German domain registrar EPAG to gather not only information on domain name registrants, but also on the administrative contact responsible for administrative questions and the technical contact responsible for any technical questions on behalf of the registrant in connection with the new domain. With GDPR in force, EPAG did not agree to collect this additional information as it did not appear to be necessary.

In order to force EPAG to continue collecting and processing this additional information, ICANN filed a motion for a preliminary injunction with the Regional Court of Bonn on May 25, 2018. ICANN argued that receiving the information on the administrative and the technical contact is necessary in order to properly handle any technical, legal, or administrative issues in connection with the domain name. However, in its decision of May 29, 2018, case file 10 O 171/18, the Court held that ICANN had not provided evidence that there was a sufficient need to collect and process administrative or technical contact information in compliance with Art. 6 (1) of GDPR. According to the Court, such additional information was not necessary to properly identify and contact the person responsible for content published on a website, as any issues with a website could be solved by contacting the registrant. Therefore, the Court found that collecting this additional information contradicted the principle of data minimization set out in Art. 5 (1) of GDPR.

While it remains to be seen how other European courts will interpret this provision of GDPR, this early decision in Germany demonstrates the importance of assigning a specific business purpose to each and every instance of collecting, using, and storing personal data.