Attached and below is the Business Constituency (BC) comment for Board consideration of EPDP Phase 2 Policy Recommendations. Members of the ICANN Board of Directors: The BC maintains its position that the EPDP Phase 2 Final Report fails to deliver a System for Standardized Access (SSAD) that meets the needs of its users. (see Minority Statement of the Business Constituency and the Intellectual Property Constituency on the EPDP Phase 2 Final Report<https://www.bizconst.org/assets/docs/positions-statements/2020/2020_07July_2...>) On a substantive level, the SSAD proposed by the Final Report lacks a centralized disclosure mechanism and provides no meaningful framework regarding when disclosure should occur, leaving this determination up to the discretion of over two thousand separate contracted parties. It also fails to provide guidance to contracted parties as to how to address data accuracy and distinctions between legal and natural persons. The SSAD is also inflexible, lacking the ability to evolve with updates in data privacy laws, including pending legislation that may have a significant impact on obligations to disclose registrant data. On a procedural level, the SSAD proposed by the Final Report lacks the support of its intended users, lacks consensus among EPDP members and the ICANN community at large, and ultimately fails to serve the public interest by failing to support the security and stability of the Internet. Together with the views held by the Intellectual Property Constituency, Government Advisory Committee, the At-Large Advisory Committee, and the Security and Stability Advisory Committee, we have collectively noted that the EPDP work to date falls dramatically short of ICANN’s goal and that the Board must intervene in order realign the system for standardized access with the interests of the community and the public. To be clear, the Board must not hide behind majority approval within the GNSO Council as a proxy for community consensus given the strong opposition to the SSAD amongst its intended users within the EPDP. Nor should the Board use the GNSO Council’s vote as an excuse to move forward in dereliction of ICANN’s core value of protecting the global public interest. The inability of Internet users to identify with whom they are doing business with online, and the increasingly pervasive inability of law enforcement, cybersecurity, and legal professionals to identify criminal actors online through their domain name registration data, severely undermines the security and stability of the Internet. This comment is not made lightly and is not offered to the Board as hyperbole; if the Board approves the SSAD in its current form, then BC members will not use it and will recommend that other commercial entities also not use it. Furthermore, a decision by the Board to move forward in spite of all of the stated community opposition to the SSAD will serve as a strong signal to national regulators that more concerted intervention and direct regulation through administrative, legislative and judicial means are all necessary within the domain name industry. Put another way, the EPDP’s experimentation in providing legitimate access to non-public registration data will be viewed as a failure of the multistakeholder model, and it will be taken entirely out of the community’s hands. The Board has repeatedly insisted that it has done all it can to drive consensus and the law is the law. Indeed, it is. But rather than preventing ICANN from acting on a system of standardized access, the law as written presently in the GDPR and as contemplated in NIS2 do not require that data protection must conflict with public safety and cybersecurity needs. The European Commission has clearly provided ICANN with a roadmap for striking a balance between these interests, stating: “ICANN and the community can develop a unified access model that applies to all registries and registrars and provides a stable, predictable, and workable method for accessing non-public gTLD registration data for users with a legitimate interest or other legal basis as provided for in the General Data Protection Regulation.” This is precisely the Business Constituency’s aim - to support privacy protection for personal data, and to strike a balance between the individual right of privacy and other legitimate interests. Yet, instead of engaging in the work to outline the parameters of these interests, the Phase 2 Final Report merely provides for a central location to submit requests. It is a mere ticketing service that does not provide any meaningful access or disclosure function; as such, the SSAD will almost certainly become a black hole. Expensive window dressing that no one actually uses. We view the Board’s inaction to date as an abdication of leadership. This letter is a last attempt to urge the Board to correct this misstep, and to fulfill its obligations to the community and the public interest. This can only be done by remanding the SSAD recommendations back to the EPDP for further work to properly define a model for access to registration data that ensures that disclosure is proportionate and limited to the legitimate interest of the requesting party. Anything less is nothing at all. -- This comment was drafted by John Berard and Andy Abrams, and was approved in accord with our charter. Steve DelBianco Vice chair for policy coordination ICANN Business Constituency