As discussed on today’s BC call, we submitted 4 process questions to ICANN today, regarding the proposed models for GDPR compliance. (see attached and below) Thanks to volunteers who quickly drafted these questions: Margie Milam, Mary Ellen Callahan, Alex Deacon, Tim Chen, and Faisal Shah. We will also be drafting comments on the models before 29-Jan, and these will be circulated for BC member review. Date: Thursday, January 18, 2018 at 6:09 PM To: "gdpr@icann.org" <gdpr@icann.org> Subject: Process questions from the Business Constituency (BC), regarding model for GDPR compliance The BC appreciates the opportunity to provide comment on ICANN’s proposed models for compliance with the European Union’s General Data Protection Regulation (GDPR). We thank the community for the immense efforts in responding to ICANN’s call for Community-Proposed Models for GDPR Compliance and ICANN org for this opportunity to submit comment and begin a more robust discussion on this important topic. Our feedback will be divided into two discrete areas: First, procedural questions, to be followed by a separate submission regarding substantive observations and comments on ICANN’s proposed models. The BC would appreciate ICANN org’s detailed replies to these questions, which will help clarify our understanding of how ICANN arrived at these proposals<https://www.icann.org/en/system/files/files/interim-models-gdpr-compliance-1...> and enable and inform more precise feedback from us: 1. In publishing its ICANN-Proposed Compliance Models for Community Discussion<https://www.icann.org/en/system/files/files/interim-models-gdpr-compliance-1...>, ICANN org states: “We are seeking your input on the proposals. From that input either variations or modifications to one of these models will be identified at the end of January for the path forward. To ensure we reach this goal, we need your feedback by 29 January 2018.” From this, it is unclear whether the ICANN community is meant to provide feedback to ICANN’s three models only, or also to the additional five community-proposed models for GDPR compliance. The BC would like additional clarity on whether there will be any evaluation of the five community-proposed models through this current process. If not, will these be reviewed and considered by both ICANN and the community? 2. Contrary to stated ICANN processes and procedures ICANN org has opened a short window of time for comments (17 days), and comments don’t appear to be publicly displayed. Will ICANN both extend the comment deadline and make comments publicly accessible? 3. As ICANN org states, “one of these models will be identified at the end of January for the path forward.” Comments are due January 29, so is ICANN assuming it will take only 2 days to thoroughly consider community input before it makes a final decision? 4. In describing the approach for developing its proposed interim compliance model, ICANN org states that: “[t]he selected model will not replace the multistakeholder policy development and implementation activities that are underway, including ... updates to ICANN’s Procedure for Handling WHOIS Conflicts with Privacy Law …” The BC requests additional clarification on what development and/or implementation activities are underway for this cited policy. And, more importantly, we request an explanation as to why no part of this policy has been followed by ICANN to-date in addressing compliance with the GDPR. The BC looks forward to your prompt response on our questions, preferably in advance of the January 29th deadline for comments on the proposed models. Sincerely, Steve DelBianco Vice chair for policy coordination ICANN Business Constituency