ALAC Comment on IPC/BC Access Model
Folks As we said in the ALAC Statement on the GDPR – now being voted upon – one of the outstanding critical issues will be accreditation of those who are given access to personal information from the Whois database. The IPC/BC community within the GNSO has developed a ‘Draft Accreditation and Access Model for non-public Whois Data’ which they are putting forward for discussion. Indeed, they recently held a webinar on the model – at the usually impossible time for Australia. They have also set up a mailing list on the issue and the documents they used for the webinar are supposed to be available for those on the mailing list. (I haven’t seen them as yet) The first thing to note about that model is that is that it is very much the creature of the IPC/BC constituency. The NCSG were not consulted and are developing their response to the accreditation model. My understanding is that the Registries/Registrars also did not provide input into that model. We should also comment - either through a Google Doc or on the wiki, but - in a very short space of time - we should be developing at least some response to the IPC/BC proposal. No response to their model could otherwise be taken as tacit community consent to its proposals. My two major issues with the model are as below. Please feel free to comment as well. My basic issue with their Access Model is that it confuses data ‘use’ with the ‘purpose’ of collection. Under basic data protection law, personal information can only be collected for specified and legitimate purposes of the data collector (ICANN and registrars) and not further processed in ways inconsistent with the legitimate purpose(s). The ALAC has suggested that feedback from the European DPAs will assist in determining the purposes consistent with ICANN and the Registries purpose in collection of that data. The purpose suggested in the Interim Model is not as broad as suggested by this Access Model and, in my view, preferable. (See Annex A, Access Model). The Access Model proposed suggests that, once parties are accredited, they would gain access to all the Whois Information. In my view, any access to personal information should be in limited circumstances only - that blanket access not be given. In a law enforcement context, search warrants generally need some kind of judicial sanction, based on apprehension of possible criminality, before premises can be searched and/or persons apprehended. While an access request test probably would not be quite that stringent, I could not support access seekers being given blanket permission to access personal information generally; there should be a requirement for reasonable grounds to suspect unlawful or harmful action in specific circumstances (carefully defined) before access given. Holly
Good morning Holly, I agree with you about the purpose: you should remember that in San Juan, I said that the purpose definition of the interim model is so broad and merit to be reconsidered. The IPC/BC one is worse. As for access for accredited parties, it was my understanding that it should be conditioned by a documented suspicion of unlawful or harmful action or behavior. I noted that this is not the intention. ----------------------------------------------------------------------------- Tijani BEN JEMAA Executive Director Mediterranean Federation of Internet Associations (FMAI) Phone: +216 98 330 114 +216 52 385 114 -----------------------------------------------------------------------------
Le 8 avr. 2018 à 06:41, Holly Raiche <h.raiche@internode.on.net> a écrit :
Folks
As we said in the ALAC Statement on the GDPR – now being voted upon – one of the outstanding critical issues will be accreditation of those who are given access to personal information from the Whois database.
The IPC/BC community within the GNSO has developed a ‘Draft Accreditation and Access Model for non-public Whois Data’ which they are putting forward for discussion. Indeed, they recently held a webinar on the model – at the usually impossible time for Australia. They have also set up a mailing list on the issue and the documents they used for the webinar are supposed to be available for those on the mailing list. (I haven’t seen them as yet)
The first thing to note about that model is that is that it is very much the creature of the IPC/BC constituency. The NCSG were not consulted and are developing their response to the accreditation model. My understanding is that the Registries/Registrars also did not provide input into that model. We should also comment - either through a Google Doc or on the wiki, but - in a very short space of time - we should be developing at least some response to the IPC/BC proposal. No response to their model could otherwise be taken as tacit community consent to its proposals.
My two major issues with the model are as below. Please feel free to comment as well.
My basic issue with their Access Model is that it confuses data ‘use’ with the ‘purpose’ of collection. Under basic data protection law, personal information can only be collected for specified and legitimate purposes of the data collector (ICANN and registrars) and not further processed in ways inconsistent with the legitimate purpose(s). The ALAC has suggested that feedback from the European DPAs will assist in determining the purposes consistent with ICANN and the Registries purpose in collection of that data. The purpose suggested in the Interim Model is not as broad as suggested by this Access Model and, in my view, preferable. (See Annex A, Access Model).
The Access Model proposed suggests that, once parties are accredited, they would gain access to all the Whois Information. In my view, any access to personal information should be in limited circumstances only - that blanket access not be given. In a law enforcement context, search warrants generally need some kind of judicial sanction, based on apprehension of possible criminality, before premises can be searched and/or persons apprehended. While an access request test probably would not be quite that stringent, I could not support access seekers being given blanket permission to access personal information generally; there should be a requirement for reasonable grounds to suspect unlawful or harmful action in specific circumstances (carefully defined) before access given.
Holly _______________________________________________ ALAC mailing list ALAC@atlarge-lists.icann.org https://atlarge-lists.icann.org/mailman/listinfo/alac
At-Large Online: http://www.atlarge.icann.org ALAC Working Wiki: https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALA...)
Thanks Tijani Hopefully, we can work on a response to the IPC/BC model soon. I worry that it is the only model for access under debate - we need to make this a broader conversation Holly On 8 Apr 2018, at 4:39 pm, Tijani BEN JEMAA <tijani.benjemaa@benjemaa.com> wrote:
Good morning Holly,
I agree with you about the purpose: you should remember that in San Juan, I said that the purpose definition of the interim model is so broad and merit to be reconsidered. The IPC/BC one is worse. As for access for accredited parties, it was my understanding that it should be conditioned by a documented suspicion of unlawful or harmful action or behavior. I noted that this is not the intention.
----------------------------------------------------------------------------- Tijani BEN JEMAA Executive Director Mediterranean Federation of Internet Associations (FMAI) Phone: +216 98 330 114 +216 52 385 114 -----------------------------------------------------------------------------
Le 8 avr. 2018 à 06:41, Holly Raiche <h.raiche@internode.on.net> a écrit :
Folks
As we said in the ALAC Statement on the GDPR – now being voted upon – one of the outstanding critical issues will be accreditation of those who are given access to personal information from the Whois database.
The IPC/BC community within the GNSO has developed a ‘Draft Accreditation and Access Model for non-public Whois Data’ which they are putting forward for discussion. Indeed, they recently held a webinar on the model – at the usually impossible time for Australia. They have also set up a mailing list on the issue and the documents they used for the webinar are supposed to be available for those on the mailing list. (I haven’t seen them as yet)
The first thing to note about that model is that is that it is very much the creature of the IPC/BC constituency. The NCSG were not consulted and are developing their response to the accreditation model. My understanding is that the Registries/Registrars also did not provide input into that model. We should also comment - either through a Google Doc or on the wiki, but - in a very short space of time - we should be developing at least some response to the IPC/BC proposal. No response to their model could otherwise be taken as tacit community consent to its proposals.
My two major issues with the model are as below. Please feel free to comment as well.
My basic issue with their Access Model is that it confuses data ‘use’ with the ‘purpose’ of collection. Under basic data protection law, personal information can only be collected for specified and legitimate purposes of the data collector (ICANN and registrars) and not further processed in ways inconsistent with the legitimate purpose(s). The ALAC has suggested that feedback from the European DPAs will assist in determining the purposes consistent with ICANN and the Registries purpose in collection of that data. The purpose suggested in the Interim Model is not as broad as suggested by this Access Model and, in my view, preferable. (See Annex A, Access Model).
The Access Model proposed suggests that, once parties are accredited, they would gain access to all the Whois Information. In my view, any access to personal information should be in limited circumstances only - that blanket access not be given. In a law enforcement context, search warrants generally need some kind of judicial sanction, based on apprehension of possible criminality, before premises can be searched and/or persons apprehended. While an access request test probably would not be quite that stringent, I could not support access seekers being given blanket permission to access personal information generally; there should be a requirement for reasonable grounds to suspect unlawful or harmful action in specific circumstances (carefully defined) before access given.
Holly _______________________________________________ ALAC mailing list ALAC@atlarge-lists.icann.org https://atlarge-lists.icann.org/mailman/listinfo/alac
At-Large Online: http://www.atlarge.icann.org ALAC Working Wiki: https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALA...)
Hi Holly Thanks a lot - very good to raise this issue. I assume the draft you refer to is https://www.icann.org/en/system/files/files/gdpr-comments-ipbc-whois-access-... ? I haven’t read it yet... Bastiaan -- Envoyé de mon iPhone
On 8 Apr 2018, at 07:41, Holly Raiche <h.raiche@internode.on.net> wrote:
Folks
As we said in the ALAC Statement on the GDPR – now being voted upon – one of the outstanding critical issues will be accreditation of those who are given access to personal information from the Whois database.
The IPC/BC community within the GNSO has developed a ‘Draft Accreditation and Access Model for non-public Whois Data’ which they are putting forward for discussion. Indeed, they recently held a webinar on the model – at the usually impossible time for Australia. They have also set up a mailing list on the issue and the documents they used for the webinar are supposed to be available for those on the mailing list. (I haven’t seen them as yet)
The first thing to note about that model is that is that it is very much the creature of the IPC/BC constituency. The NCSG were not consulted and are developing their response to the accreditation model. My understanding is that the Registries/Registrars also did not provide input into that model. We should also comment - either through a Google Doc or on the wiki, but - in a very short space of time - we should be developing at least some response to the IPC/BC proposal. No response to their model could otherwise be taken as tacit community consent to its proposals.
My two major issues with the model are as below. Please feel free to comment as well.
My basic issue with their Access Model is that it confuses data ‘use’ with the ‘purpose’ of collection. Under basic data protection law, personal information can only be collected for specified and legitimate purposes of the data collector (ICANN and registrars) and not further processed in ways inconsistent with the legitimate purpose(s). The ALAC has suggested that feedback from the European DPAs will assist in determining the purposes consistent with ICANN and the Registries purpose in collection of that data. The purpose suggested in the Interim Model is not as broad as suggested by this Access Model and, in my view, preferable. (See Annex A, Access Model).
The Access Model proposed suggests that, once parties are accredited, they would gain access to all the Whois Information. In my view, any access to personal information should be in limited circumstances only - that blanket access not be given. In a law enforcement context, search warrants generally need some kind of judicial sanction, based on apprehension of possible criminality, before premises can be searched and/or persons apprehended. While an access request test probably would not be quite that stringent, I could not support access seekers being given blanket permission to access personal information generally; there should be a requirement for reasonable grounds to suspect unlawful or harmful action in specific circumstances (carefully defined) before access given.
Holly _______________________________________________ ALAC mailing list ALAC@atlarge-lists.icann.org https://atlarge-lists.icann.org/mailman/listinfo/alac
At-Large Online: http://www.atlarge.icann.org ALAC Working Wiki: https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALA...)
Thanks Bastiaan The link you sent doesn’t resolve but I think it’s the same document. My strong suggestion - leadership team - is to put this issue on the policy wiki - given that we have said this is an important issue, we should comment on it Over to staff and the leadership team! Holly On 9 Apr 2018, at 1:19 am, Bastiaan Goslings <bastiaan.goslings@ams-ix.net> wrote:
Hi Holly
Thanks a lot - very good to raise this issue.
I assume the draft you refer to is https://www.icann.org/en/system/files/files/gdpr-comments-ipbc-whois-access-... ?
I haven’t read it yet...
Bastiaan
-- Envoyé de mon iPhone
On 8 Apr 2018, at 07:41, Holly Raiche <h.raiche@internode.on.net> wrote:
Folks
As we said in the ALAC Statement on the GDPR – now being voted upon – one of the outstanding critical issues will be accreditation of those who are given access to personal information from the Whois database.
The IPC/BC community within the GNSO has developed a ‘Draft Accreditation and Access Model for non-public Whois Data’ which they are putting forward for discussion. Indeed, they recently held a webinar on the model – at the usually impossible time for Australia. They have also set up a mailing list on the issue and the documents they used for the webinar are supposed to be available for those on the mailing list. (I haven’t seen them as yet)
The first thing to note about that model is that is that it is very much the creature of the IPC/BC constituency. The NCSG were not consulted and are developing their response to the accreditation model. My understanding is that the Registries/Registrars also did not provide input into that model. We should also comment - either through a Google Doc or on the wiki, but - in a very short space of time - we should be developing at least some response to the IPC/BC proposal. No response to their model could otherwise be taken as tacit community consent to its proposals.
My two major issues with the model are as below. Please feel free to comment as well.
My basic issue with their Access Model is that it confuses data ‘use’ with the ‘purpose’ of collection. Under basic data protection law, personal information can only be collected for specified and legitimate purposes of the data collector (ICANN and registrars) and not further processed in ways inconsistent with the legitimate purpose(s). The ALAC has suggested that feedback from the European DPAs will assist in determining the purposes consistent with ICANN and the Registries purpose in collection of that data. The purpose suggested in the Interim Model is not as broad as suggested by this Access Model and, in my view, preferable. (See Annex A, Access Model).
The Access Model proposed suggests that, once parties are accredited, they would gain access to all the Whois Information. In my view, any access to personal information should be in limited circumstances only - that blanket access not be given. In a law enforcement context, search warrants generally need some kind of judicial sanction, based on apprehension of possible criminality, before premises can be searched and/or persons apprehended. While an access request test probably would not be quite that stringent, I could not support access seekers being given blanket permission to access personal information generally; there should be a requirement for reasonable grounds to suspect unlawful or harmful action in specific circumstances (carefully defined) before access given.
Holly _______________________________________________ ALAC mailing list ALAC@atlarge-lists.icann.org https://atlarge-lists.icann.org/mailman/listinfo/alac
At-Large Online: http://www.atlarge.icann.org ALAC Working Wiki: https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALA...)
That link worked for me - March 23rd, Version 1.2. I haven't looked at it yet either, but I have asked Staff to set up a Wiki policy page. Alan At 08/04/2018 04:30 PM, Holly Raiche wrote:
Thanks Bastiaan
The link you sent doesnt resolve but I think its the same document. My strong suggestion - leadership team - is to put this issue on the policy wiki - given that we have said this is an important issue, we should comment on it
Over to staff and the leadership team!
Holly On 9 Apr 2018, at 1:19 am, Bastiaan Goslings <<mailto:bastiaan.goslings@ams-ix.net>bastiaan.goslings@ams-ix.net> wrote:
Hi Holly
Thanks a lot - very good to raise this issue.
I assume the draft you refer to is <https://www.icann.org/en/system/files/files/gdpr-comments-ipbc-whois-access-accreditation-process-1-2-23mar18-en.pdf>https://www.icann.org/en/system/files/files/gdpr-comments-ipbc-whois-access-accreditation-process-1-2-23mar18-en.pdf ?
I havent read it yet...
Bastiaan
-- Envoyé de mon iPhone
On 8 Apr 2018, at 07:41, Holly Raiche <<mailto:h.raiche@internode.on.net>h.raiche@internode.on.net> wrote:
Folks
As we said in the ALAC Statement on the GDPR now being voted upon one of the outstanding critical issues will be accreditation of those who are given access to personal information from the Whois database.
The IPC/BC community within the GNSO has developed a Draft Accreditation and Access Model for non-public Whois Data which they are putting forward for discussion. Indeed, they recently held a webinar on the model at the usually impossible time for Australia. They have also set up a mailing list on the issue and the documents they used for the webinar are supposed to be available for those on the mailing list. (I havent seen them as yet)
The first thing to note about that model is that is that it is very much the creature of the IPC/BC constituency. The NCSG were not consulted and are developing their response to the accreditation model. My understanding is that the Registries/Registrars also did not provide input into that model. We should also comment - either through a Google Doc or on the wiki, but - in a very short space of time - we should be developing at least some response to the IPC/BC proposal. No response to their model could otherwise be taken as tacit community consent to its proposals.
My two major issues with the model are as below. Please feel free to comment as well.
My basic issue with their Access Model is that it confuses data use with the purpose of collection. Under basic data protection law, personal information can only be collected for specified and legitimate purposes of the data collector (ICANN and registrars) and not further processed in ways inconsistent with the legitimate purpose(s). The ALAC has suggested that feedback from the European DPAs will assist in determining the purposes consistent with ICANN and the Registries purpose in collection of that data. The purpose suggested in the Interim Model is not as broad as suggested by this Access Model and, in my view, preferable. (See Annex A, Access Model).
The Access Model proposed suggests that, once parties are accredited, they would gain access to all the Whois Information. In my view, any access to personal information should be in limited circumstances only - that blanket access not be given. In a law enforcement context, search warrants generally need some kind of judicial sanction, based on apprehension of possible criminality, before premises can be searched and/or persons apprehended. While an access request test probably would not be quite that stringent, I could not support access seekers being given blanket permission to access personal information generally; there should be a requirement for reasonable grounds to suspect unlawful or harmful action in specific circumstances (carefully defined) before access given.
Holly _______________________________________________ ALAC mailing list <mailto:ALAC@atlarge-lists.icann.org>ALAC@atlarge-lists.icann.org https://atlarge-lists.icann.org/mailman/listinfo/alac
At-Large Online: <http://www.atlarge.icann.org/>http://www.atlarge.icann.org ALAC Working Wiki: <https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALAC)>https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALAC)
Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Disposition: inline X-Microsoft-Exchange-Diagnostics:
1;YTOPR01MB0396;27:YEkXwqIBV+GhRZmgfsC8ZtL0XlvoTp1BKuDW3N2gjqxAivMyhcJE6NqWMxrt5tA/HlE+wOO+0Rs15wJQ2E2GIyrktzg/ak+RBadp3ssVvyGFUbnoISD6os9OmEz/0he1 X-Microsoft-Antispam-Message-Info:
pA3vtw6Vr/0THDpT7aO0JwJOmkUNlU37bm8guJL99UfxxR2JyIJWqcMNHRcYHfuDFCAX0HtDfqCIlsePDCJeWs5ZJmIzuMsfzCePohyXUygjY4madHC9jRVP8b9uPWvdOk/fVFbnTVvgEYxye1guuyoJtVMYwQiGLp+xi/8kQyzw5VrXzgV/mvpy6YszBSlI/k3BCNNdOQbRaIsYJjbBUdEeQ8Vfvd3eltaGzjvzAKqtjp3OLrPE9Nr5TckpT40eIPuyryf2QOWWxtZRo6nXAvk7gUuOLXwzuwprfMFYnlGA4I0AuSdrqmVFtXnGkPwVLppbfWOc9sXUWBrTE8dDgaOJBqOV1uVZIJkxT1CqKkmw1rMJFw/JZ1GX6irgPmP4nMlqFGPV791NBlb0KRn+EQMd0xwUYW6fPoi0hivHMIU=
_______________________________________________ ALAC mailing list ALAC@atlarge-lists.icann.org https://atlarge-lists.icann.org/mailman/listinfo/alac
At-Large Online: http://www.atlarge.icann.org ALAC Working Wiki: https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALA...)
Dear Holly and all, I think it’s of the essence that the ALAC is able to provide feedback and help shape whatever model is suggested. ICANN Org has been emphatic in that they will provide support to a community wide exercise that aims to shape a proposed model but it will not provide support to isolated efforts. I have read different points of view regarding this proposed model and it feels like it doesn’t really have the support the BC/IPC thinks it has, hence the importance of having input from the ALAC and the rest of the community. Maybe the BC/IPC proposal is a good starting point but we have to keep in mind it is just that: a starting point that should allow community wide feedback and go through a community wide process to find consensus on the end outcome. Kind regards León Enviado desde mi iPhone El abr. 8, 2018, a la(s) 3:30 p. m., Holly Raiche <h.raiche@internode.on.net> escribió:
Thanks Bastiaan
The link you sent doesn’t resolve but I think it’s the same document. My strong suggestion - leadership team - is to put this issue on the policy wiki - given that we have said this is an important issue, we should comment on it
Over to staff and the leadership team!
Holly
On 9 Apr 2018, at 1:19 am, Bastiaan Goslings <bastiaan.goslings@ams-ix.net> wrote:
Hi Holly
Thanks a lot - very good to raise this issue.
I assume the draft you refer to is https://www.icann.org/en/system/files/files/gdpr-comments-ipbc-whois-access-... ?
I haven’t read it yet...
Bastiaan
-- Envoyé de mon iPhone
On 8 Apr 2018, at 07:41, Holly Raiche <h.raiche@internode.on.net> wrote:
Folks
As we said in the ALAC Statement on the GDPR – now being voted upon – one of the outstanding critical issues will be accreditation of those who are given access to personal information from the Whois database.
The IPC/BC community within the GNSO has developed a ‘Draft Accreditation and Access Model for non-public Whois Data’ which they are putting forward for discussion. Indeed, they recently held a webinar on the model – at the usually impossible time for Australia. They have also set up a mailing list on the issue and the documents they used for the webinar are supposed to be available for those on the mailing list. (I haven’t seen them as yet)
The first thing to note about that model is that is that it is very much the creature of the IPC/BC constituency. The NCSG were not consulted and are developing their response to the accreditation model. My understanding is that the Registries/Registrars also did not provide input into that model. We should also comment - either through a Google Doc or on the wiki, but - in a very short space of time - we should be developing at least some response to the IPC/BC proposal. No response to their model could otherwise be taken as tacit community consent to its proposals.
My two major issues with the model are as below. Please feel free to comment as well.
My basic issue with their Access Model is that it confuses data ‘use’ with the ‘purpose’ of collection. Under basic data protection law, personal information can only be collected for specified and legitimate purposes of the data collector (ICANN and registrars) and not further processed in ways inconsistent with the legitimate purpose(s). The ALAC has suggested that feedback from the European DPAs will assist in determining the purposes consistent with ICANN and the Registries purpose in collection of that data. The purpose suggested in the Interim Model is not as broad as suggested by this Access Model and, in my view, preferable. (See Annex A, Access Model).
The Access Model proposed suggests that, once parties are accredited, they would gain access to all the Whois Information. In my view, any access to personal information should be in limited circumstances only - that blanket access not be given. In a law enforcement context, search warrants generally need some kind of judicial sanction, based on apprehension of possible criminality, before premises can be searched and/or persons apprehended. While an access request test probably would not be quite that stringent, I could not support access seekers being given blanket permission to access personal information generally; there should be a requirement for reasonable grounds to suspect unlawful or harmful action in specific circumstances (carefully defined) before access given.
Holly _______________________________________________ ALAC mailing list ALAC@atlarge-lists.icann.org https://atlarge-lists.icann.org/mailman/listinfo/alac
At-Large Online: http://www.atlarge.icann.org ALAC Working Wiki: https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALA...)
_______________________________________________ ALAC mailing list ALAC@atlarge-lists.icann.org https://atlarge-lists.icann.org/mailman/listinfo/alac
At-Large Online: http://www.atlarge.icann.org ALAC Working Wiki: https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALA...)
Thanks Leon I absolutely agree. I hand it to the IPC/BC community. They put in the time and effort for what is, for them, an important issue. But as you say, it is only a starting point. It is always easier to think things through when someone has already put pen to paper - so to speak. And in all fairness to them, they did announce their model publicly and organised webinars to talk through their viewpoint. So if we don’t respond, and their model is adopted, we really have ourselves to blame. So I am happy that Alan will ask staff to set up a wiki so we can work through what we want to say. Holly On 9 Apr 2018, at 7:54 am, León Felipe Sánchez Ambía <leonfelipe@sanchez.mx> wrote:
Dear Holly and all,
I think it’s of the essence that the ALAC is able to provide feedback and help shape whatever model is suggested. ICANN Org has been emphatic in that they will provide support to a community wide exercise that aims to shape a proposed model but it will not provide support to isolated efforts.
I have read different points of view regarding this proposed model and it feels like it doesn’t really have the support the BC/IPC thinks it has, hence the importance of having input from the ALAC and the rest of the community.
Maybe the BC/IPC proposal is a good starting point but we have to keep in mind it is just that: a starting point that should allow community wide feedback and go through a community wide process to find consensus on the end outcome.
Kind regards
León
Enviado desde mi iPhone
El abr. 8, 2018, a la(s) 3:30 p. m., Holly Raiche <h.raiche@internode.on.net> escribió:
Thanks Bastiaan
The link you sent doesn’t resolve but I think it’s the same document. My strong suggestion - leadership team - is to put this issue on the policy wiki - given that we have said this is an important issue, we should comment on it
Over to staff and the leadership team!
Holly On 9 Apr 2018, at 1:19 am, Bastiaan Goslings <bastiaan.goslings@ams-ix.net> wrote:
Hi Holly
Thanks a lot - very good to raise this issue.
I assume the draft you refer to is https://www.icann.org/en/system/files/files/gdpr-comments-ipbc-whois-access-... ?
I haven’t read it yet...
Bastiaan
-- Envoyé de mon iPhone
On 8 Apr 2018, at 07:41, Holly Raiche <h.raiche@internode.on.net> wrote:
Folks
As we said in the ALAC Statement on the GDPR – now being voted upon – one of the outstanding critical issues will be accreditation of those who are given access to personal information from the Whois database.
The IPC/BC community within the GNSO has developed a ‘Draft Accreditation and Access Model for non-public Whois Data’ which they are putting forward for discussion. Indeed, they recently held a webinar on the model – at the usually impossible time for Australia. They have also set up a mailing list on the issue and the documents they used for the webinar are supposed to be available for those on the mailing list. (I haven’t seen them as yet)
The first thing to note about that model is that is that it is very much the creature of the IPC/BC constituency. The NCSG were not consulted and are developing their response to the accreditation model. My understanding is that the Registries/Registrars also did not provide input into that model. We should also comment - either through a Google Doc or on the wiki, but - in a very short space of time - we should be developing at least some response to the IPC/BC proposal. No response to their model could otherwise be taken as tacit community consent to its proposals.
My two major issues with the model are as below. Please feel free to comment as well.
My basic issue with their Access Model is that it confuses data ‘use’ with the ‘purpose’ of collection. Under basic data protection law, personal information can only be collected for specified and legitimate purposes of the data collector (ICANN and registrars) and not further processed in ways inconsistent with the legitimate purpose(s). The ALAC has suggested that feedback from the European DPAs will assist in determining the purposes consistent with ICANN and the Registries purpose in collection of that data. The purpose suggested in the Interim Model is not as broad as suggested by this Access Model and, in my view, preferable. (See Annex A, Access Model).
The Access Model proposed suggests that, once parties are accredited, they would gain access to all the Whois Information. In my view, any access to personal information should be in limited circumstances only - that blanket access not be given. In a law enforcement context, search warrants generally need some kind of judicial sanction, based on apprehension of possible criminality, before premises can be searched and/or persons apprehended. While an access request test probably would not be quite that stringent, I could not support access seekers being given blanket permission to access personal information generally; there should be a requirement for reasonable grounds to suspect unlawful or harmful action in specific circumstances (carefully defined) before access given.
Holly _______________________________________________ ALAC mailing list ALAC@atlarge-lists.icann.org https://atlarge-lists.icann.org/mailman/listinfo/alac
At-Large Online: http://www.atlarge.icann.org ALAC Working Wiki: https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALA...)
_______________________________________________ ALAC mailing list ALAC@atlarge-lists.icann.org https://atlarge-lists.icann.org/mailman/listinfo/alac
At-Large Online: http://www.atlarge.icann.org ALAC Working Wiki: https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALA...)
participants (5)
-
Alan Greenberg -
Bastiaan Goslings -
Holly Raiche -
León Felipe Sánchez Ambía -
Tijani BEN JEMAA