Ayden, staff has not selected anything, that is not within our remit. We investigated the options and implemented the option that was selected by the EPDP leadership team. Also note that the request for GDPR training was not confirmed by the EPDP Team until its meeting on 28 August (see action items). Best regards, Marika From: Ayden Férdeline <icann@ferdeline.com> Reply-To: Ayden Férdeline <icann@ferdeline.com> Date: Tuesday, September 11, 2018 at 12:39 To: Marika Konings <marika.konings@icann.org> Cc: "darcy.southwell@endurance.com" <darcy.southwell@endurance.com>, Rafik Dammak <rafik.dammak@gmail.com>, Council GNSO <council@gnso.icann.org> Subject: [Ext] Re: [council] EPDP Weekly update Thank you for the response, Marika. I have shared two emails on the EPDP team list over the past 24 hours regarding the GDPR training, neither of which you responded to. I suspect if you posted this same message there, there would be a high level of disagreement between EPDP members and ICANN org over the approach that you seem to think was endorsed by the EPDP team. Check the transcript. On 7 August I initially requested GDPR training, and a week later, Stephanie Perrin made the request too. As you might recall, the Council also discussed this matter when drafting the charter for the EPDP. The need for training had been raised by Martin, myself, and supported by others. Why, then, was the request only actioned when requested by RySG a month later? It is true that the EPDP team was made aware of the names of two providers on the call of 6 September. We were not, however, consulted on the course itself or its contents, and no details were forthcoming. Again, check the Adobe Connect chat and the questions that were ignored and the short responses given. I personally visited the website of ITgovernance after its name was circulated and no where on the homepage or on their GDPR training page did I find this £20 course. I don’t see it there today either. I saw and continue to see more comprehensive options. We attempted to clarify with ICANN staff that we were getting a course that would offer at least “three-four hours” of training but received no response. Ultimately staff have selected one which is supposed to take 45 minutes but can be breezed through in 15. As for the course being shared with the EPDP team leadership, perhaps that was so, but they did not share it with EPDP members and neither member of the leadership team are themselves GDPR experts. Perhaps they should have consulted with EDPD members before this course was procured. I had actually suggested to the Council liaison that this happen, but it did not. The course is not adequate and should never have been purchased. —Ayden On 11 Sep 2018, at 20:17, Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> wrote: To provide some context as Council members consider Ayden's input, a request was made by the RySG, and supported by the EPDP Team, for GDPR training. Several suggestions were made for possible training providers by EPDP Team members. Staff gathered input on these options, including costs and content covered, which was subsequently shared with the EPDP Team leadership who recommended moving forward with the training provided by IT governance (one of the providers recommended by one of the EPDP Team members) followed by a Q & A session with Becky Burr that will allow for members to put forward any additional questions they may have. The recommended approach was shared with the EPDP Team during its meeting on 6 September during which no objections were raised, following which the training was procured and distributed to members, alternates and liaisons. The Q & A session with Becky is scheduled for Wednesday 19 September. Best regards, Marika From: council <council-bounces@gnso.icann.org<mailto:council-bounces@gnso.icann.org>> on behalf of Ayden Férdeline <icann@ferdeline.com<mailto:icann@ferdeline.com>> Reply-To: Ayden Férdeline <icann@ferdeline.com<mailto:icann@ferdeline.com>> Date: Tuesday, September 11, 2018 at 12:03 To: "darcy.southwell@endurance.com<mailto:darcy.southwell@endurance.com>" <darcy.southwell@endurance.com<mailto:darcy.southwell@endurance.com>>, 'Rafik Dammak' <rafik.dammak@gmail.com<mailto:rafik.dammak@gmail.com>>, 'Council GNSO' <council@gnso.icann.org<mailto:council@gnso.icann.org>> Subject: Re: [council] EPDP Weekly update I encourage members of the Council to research the £20 ($25), 45-minute GDPR course that EPDP members have been offered, and to evaluate whether you think this will leave the EPDP team on the right footing to develop a policy that does expose ICANN org and the contracted parties to unwanted liabilities. It is my humble view that the training is inadequate and not suitable for our purposes. The course was procured without EPDP team consultation and is intended for frontline individual contributors who occasionally come across personal data, not for those designing a policy or system. I think ICANN org has done us a great disservice in procuring this course. It’s not disappointing; I think the more accurate descriptor would be "reckless." Ayden On Tue, Sep 11, 2018 at 19:45, Darcy Southwell <darcy.southwell@endurance.com<mailto:darcy.southwell@endurance.com>> wrote: Thanks, Rafik. Have a couple of questions from your update: • What is the deadline for EPDP members to complete the training? • You noted the project is behind, and I see the items highlighted in yellow as "manageable delay/issue." You agree that these are manageable? I wasn’t sure from your update. Thanks, Darcy From: council [mailto:council-bounces@gnso.icann.org] On Behalf Of Rafik Dammak Sent: Monday, September 10, 2018 10:31 AM To: Council GNSO <council@gnso.icann.org<mailto:council@gnso.icann.org>> Subject: [council] EPDP Weekly update hi all, please find the EPDP update of last week. Happy to answer questions. Best Regards, Rafik