Dear All, Please see the message below sent by Alan Greenberg that includes the information needed for the discussion on GDPR that will be held on today's ALAC call. This information is being sent via email due to the unavailability of an Adobe Connect Meeting Room. Kind regards, ICANN Policy Staff in support of the At-Large Community E-mail: staff@atlarge.icann.org<mailto:staff@atlarge.icann.org> Website: atlarge.icann.org<https://atlarge.icann.org/> Facebook: facebook.com/icann<https://www.facebook.com/icannatlarge>atlarge<https://www.facebook.com/icannatlarge> Twitter: @<https://twitter.com/ICANNAtLarge>ICANNAtLarge<https://twitter.com/ICANNAtLarge> [unknown.png] From: ALAC [mailto:alac-bounces@atlarge-lists.icann.org] On Behalf Of Alan Greenberg Sent: Tuesday, March 27, 2018 11:50 AM To: ALAC <alac@atlarge-lists.icann.org> Subject: [ALAC] GDPR on today's ALAC Agenda Attached and in the body of this message are the notes for today's discussion of GDPR on the ALAC Call. ----------------------------- ALAC Meeting - 27 March 2018 - GDPR Discussion The ALAC and At-Large are divided on whether the proposed Interim Model meets the requirements of the GDPR and specifically whether the rationales for collecting various data items are specified in sufficient detail and are sufficiently compelling. There are also differing views on whether the transport of data to Registries in compliance with "thick WHOIS" rules is GDPR compliant. In the absence of concerns over privacy, ICANN has previously determined that the thick WHOIS model is the one that should be used and we should not re-litigate that here. We have similarly decided that single points of failure must be avoided and all data must be escrowed in case of any of multiple forms of failure. All data items have proven useful in the past (that was the result of ICANN's earlier work). Whether it can be justified in the current situation is the question. All of these issues will need to be judged by DPAs and to the extent that they make clear statements, we will have to abide by them. The ALAC has the responsibility to look at all issues from and end-user perspective. We also have concerns for registrant issues, but where they differ we support users. 1. Must registrars continue to collect the contact details for administrative and technical contacts and transmit them to the registry and escrow provider? 2. Should anonymized e-mail addresses should be substituted for the e-mail addresses for registrant, administrative, and technical contacts in public WHOIS? 3. Should registries and registries be permitted to optionally apply the model on a global basis? 4. Should the model apply to contact details supplied by registrants who are legal persons? 5. Which elements of WHOIS data should be published in public WHOIS while an accreditation program for layered/tiered access is being developed? 6. How many levels should the "tiered" access mechanism support? 7. Bulk access - should it be allowed?
