Fw: [Gnso-epdp-team] Report on Small team on roles & responsibilities in preparation for EPDP Team Meeting #25
Hi all, I am forwarding the below message along for information purposes as there has been a suggestion raised that a matter may need to be brought back to the Council to consider revising the EPDP charter. It might be premature to be forwarding this along, and nothing may come of it, but I figure the Council should be aware that the idea has been floated. Kind regards, Ayden ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Tuesday, 13 November 2018 12:09, Thomas Rickert <epdp@gdpr.ninja> wrote:
Hello Marika, all, yesterday, the call of the small roles & responsibilities team had its call.
We thank JJ and Erika from ICANN Org for attending the call.
I will only be able to attend the first 90 mins of the call and I do not know whether it is possible to squeeze in a report and discussion of the outcome of our call while I am in attendance. Therefore, I would like to give a brief update in writing.
The plan for the meeting was to discuss
- what roles GDPR offers and if these are sufficiently described in the language I offered for the report - discussion of Rationale for joint controller vs. other scenarios - options and limitations of policy work / charter limitations - strategy to implementation
I hoped we could make sufficient progress during the call so that the small team could suggest a solid path forward to the EPDP plenary.
JJ reported to us that ICANN Org has a 10 page memo in the making in which concerns and ICANN’s views on the roles are described. He said that we should not jump to the conclusion that a joint controller scenario is given before the roles and responsibilities for the individual processing activities are determined. In his view, it is like putting the cart before the horse if a joint controller scenario is adopted before all parties had a chance to assess the impact on their liabilities and that joint controllership might not adequately reflect the risks the respective parties might want to take.
We then discussed that it is not really a question of what the parties want to choose to best suit their wishes, but a question of what the legal determination of the setup is. Several participants expressed their view that a joint controller scenario is likely present and therefore a joint controller agreement needs to be negotiated to reflect the roles and responsibilities and the required indemnifications etc. need to be put in place to associate the risks appropriately.
There are two issues with this that the EPDP Team and - in particular - the leadership needs to decide.
1. The issue of legal assessment vs. policy work
The question was brought up by Kurt and JJ in particular. They said - rightfully - that our group cannot really give legal advice. We have discussed the unfortunate situation that our policy group needs to do both compliance work as well as policy work in the EPDP plenary on multiple occasions before. We have a charter that requires us to speak to the responsibilities of the parties and this is just not possible without being transparent (in our report) about what concept we think is applicable. So I think the plenary needs to discuss and confirm that we will take position on this (which can be vetted during the public comment period).
If the EPDP Team does not wish to take a position on this question, I think we need to go back to the GNSO Council to ask for a revision of the charter.
2. Timing
We were not given any indication as to how quickly a memo would be shared with the EPDP Team. JJ said that their memo should inform and help our work but it should not stand in the way of our work.
In my view (which was shared by several participants), the EPDP Team must know what ICANN org’s view on the matter is. The SGs and Cs need to be able to take into account the concerns and suggestions that ICANN Org might have to inform their own positioning. Also, I think we cannot detach our work from ICANN org’s position. It would be unfortunate - to say the least - if our group came up with a recommendation for the parties to negotiate a JCA just to find out that ICANN Org will refuse to implement that recommendation. Thus, clarity is required as soon as possible and a report should not be published before the memo has been shared, analyzed, discussed in the EPDP team and potential revisions to the initial report have been made.
In closing, let me be honest with the entire team and express my frustration with the process. We have asked both Board liaisons as well as ICANN staff multiple times to share any legal memos / opinions there are to inform our discussions. Also, we have asked whether there would be concerns by ICANN Org with respect to entering into a joint controller agreement or data processing agreements in several meetings. We were not given any indication whatsoever that there could be problems. It is unfortunate to only learn about ICANN’s memo and that there are concerns a few days before the planned publication of our report.
Kind regards, Thomas
Am 12.11.2018 um 16:25 schrieb Marika Konings <marika.konings@icann.org>:
Dear All,
Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 13 November at 14.00 UTC.
- In relation to agenda item #3, please find attached an updated version of the proposed language for inclusion in the Initial Report in which staff has aimed to capture some of the input that was received in response to the Initial Report through the google doc, as well as input received on the mailing list.
- In relation to agenda item #4, please find attached a table which provides an overview of the changes proposed by EPDP Team members that staff didn’t feel comfortable applying because e.g. either the proposed change is not clear, the proposed change affects previously agreed preliminary agreements / text, or is a substantive change that requires further discussion / consideration by the full EPDP Team (see https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyGQ... for all comments received to date). In certain cases, staff has proposed a path forward, but would appreciate EPDP Team/commenter feedback before applying this change. Note that a number of comments were made in relation to preliminary recommendations and/or text that is still under consideration. It is the expectation that this input will be raised in the context of those discussions.
FYI, staff expects to share an updated version of the Initial Report later today so you can see how other input has been addressed (non-substantial issues) as well as how other aspects are coming together as a result of the EPDP Team work over the last couple of meetings.
Best regards,
Caitlin, Berry and Marika
======================
[][EPDP Meeting #25 Agenda] Tuesday, 13 November 2018
- Roll Call & SOI Updates (5 minutes)
- Welcome and Updates from EPDP Team Chair (5 minutes)
- Initial Report finalization status, incl. items remaining to be addressed and schedule for the week ahead
- Confirm status and next steps in relation to natural vs. legal and geographic status
- Review of outstanding action items
- Other updates, if applicable
- Data Redaction (see attached)
Objective of discussion:
- Confirm language for inclusion in the Initial Report in relation to data redaction as well as email communication
- Review latest version of language for inclusion in relation to data redaction
- Consider charter questions:
f2) Should standardized requirements on registrant contact mechanism be developed? f3) Under what circumstances should third parties be permitted to contact the registrant, and how should contact be facilitated in those circumstances? And related draft recommendation: In relation to facilitating email communication between third parties and the registrant, the EPDP Team recommends that [current requirements in the Temporary Specification that specify that a Registrar MUST provide an email address or a web form to facilitate email communication with the relevant contact, but MUST NOT identify the contact email address or the contact itself, remain in place. [[[Other to be decided]]].
- Confirm next steps, if any
- Commence review & discussion of comments / input received on Initial Report
Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report
- Commence review of proposed changes / comments on the Initial Report (see list attached)
- Confirm approach for addressing these
- Confirm next steps, if any
- Wrap and confirm next meeting to be scheduled for Wednesday 14 November / Thursday 15 November at 14.00 UTC (dependent on progress made).
- Confirm action items
- Confirm questions for ICANN Org, if any
Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org
Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our [interactive courses](https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_...) and visiting the [GNSO Newcomer pages](https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...).
<Data Redaction - up 12 November 2018.docx><Initial Report changes for discussion - upd 12 November 2018.docx>_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Thank you Ayden, this is indeed something worth being VERY aware of. Best, Martin Silva Valent Partner @ Silva.legal
On 13 Nov 2018, at 08:30, Ayden Férdeline <icann@ferdeline.com> wrote:
Hi all,
I am forwarding the below message along for information purposes as there has been a suggestion raised that a matter may need to be brought back to the Council to consider revising the EPDP charter. It might be premature to be forwarding this along, and nothing may come of it, but I figure the Council should be aware that the idea has been floated.
Kind regards, Ayden
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Tuesday, 13 November 2018 12:09, Thomas Rickert <epdp@gdpr.ninja <mailto:epdp@gdpr.ninja>> wrote:
Hello Marika, all, yesterday, the call of the small roles & responsibilities team had its call.
We thank JJ and Erika from ICANN Org for attending the call.
I will only be able to attend the first 90 mins of the call and I do not know whether it is possible to squeeze in a report and discussion of the outcome of our call while I am in attendance. Therefore, I would like to give a brief update in writing.
The plan for the meeting was to discuss
- what roles GDPR offers and if these are sufficiently described in the language I offered for the report - discussion of Rationale for joint controller vs. other scenarios - options and limitations of policy work / charter limitations - strategy to implementation
I hoped we could make sufficient progress during the call so that the small team could suggest a solid path forward to the EPDP plenary.
JJ reported to us that ICANN Org has a 10 page memo in the making in which concerns and ICANN’s views on the roles are described. He said that we should not jump to the conclusion that a joint controller scenario is given before the roles and responsibilities for the individual processing activities are determined. In his view, it is like putting the cart before the horse if a joint controller scenario is adopted before all parties had a chance to assess the impact on their liabilities and that joint controllership might not adequately reflect the risks the respective parties might want to take.
We then discussed that it is not really a question of what the parties want to choose to best suit their wishes, but a question of what the legal determination of the setup is. Several participants expressed their view that a joint controller scenario is likely present and therefore a joint controller agreement needs to be negotiated to reflect the roles and responsibilities and the required indemnifications etc. need to be put in place to associate the risks appropriately.
There are two issues with this that the EPDP Team and - in particular - the leadership needs to decide.
1. The issue of legal assessment vs. policy work
The question was brought up by Kurt and JJ in particular. They said - rightfully - that our group cannot really give legal advice. We have discussed the unfortunate situation that our policy group needs to do both compliance work as well as policy work in the EPDP plenary on multiple occasions before. We have a charter that requires us to speak to the responsibilities of the parties and this is just not possible without being transparent (in our report) about what concept we think is applicable. So I think the plenary needs to discuss and confirm that we will take position on this (which can be vetted during the public comment period).
If the EPDP Team does not wish to take a position on this question, I think we need to go back to the GNSO Council to ask for a revision of the charter.
2. Timing
We were not given any indication as to how quickly a memo would be shared with the EPDP Team. JJ said that their memo should inform and help our work but it should not stand in the way of our work.
In my view (which was shared by several participants), the EPDP Team must know what ICANN org’s view on the matter is. The SGs and Cs need to be able to take into account the concerns and suggestions that ICANN Org might have to inform their own positioning. Also, I think we cannot detach our work from ICANN org’s position. It would be unfortunate - to say the least - if our group came up with a recommendation for the parties to negotiate a JCA just to find out that ICANN Org will refuse to implement that recommendation. Thus, clarity is required as soon as possible and a report should not be published before the memo has been shared, analyzed, discussed in the EPDP team and potential revisions to the initial report have been made.
In closing, let me be honest with the entire team and express my frustration with the process. We have asked both Board liaisons as well as ICANN staff multiple times to share any legal memos / opinions there are to inform our discussions. Also, we have asked whether there would be concerns by ICANN Org with respect to entering into a joint controller agreement or data processing agreements in several meetings. We were not given any indication whatsoever that there could be problems. It is unfortunate to only learn about ICANN’s memo and that there are concerns a few days before the planned publication of our report.
Kind regards, Thomas
Am 12.11.2018 um 16:25 schrieb Marika Konings <marika.konings@icann.org <mailto:marika.konings@icann.org>>:
Dear All,
Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 13 November at 14.00 UTC.
In relation to agenda item #3, please find attached an updated version of the proposed language for inclusion in the Initial Report in which staff has aimed to capture some of the input that was received in response to the Initial Report through the google doc, as well as input received on the mailing list. In relation to agenda item #4, please find attached a table which provides an overview of the changes proposed by EPDP Team members that staff didn’t feel comfortable applying because e.g. either the proposed change is not clear, the proposed change affects previously agreed preliminary agreements / text, or is a substantive change that requires further discussion / consideration by the full EPDP Team (see https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyGQ... <https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyGQ...> for all comments received to date). In certain cases, staff has proposed a path forward, but would appreciate EPDP Team/commenter feedback before applying this change. Note that a number of comments were made in relation to preliminary recommendations and/or text that is still under consideration. It is the expectation that this input will be raised in the context of those discussions.
FYI, staff expects to share an updated version of the Initial Report later today so you can see how other input has been addressed (non-substantial issues) as well as how other aspects are coming together as a result of the EPDP Team work over the last couple of meetings.
Best regards,
Caitlin, Berry and Marika
======================
<>EPDP Meeting #25 Agenda <> Tuesday, 13 November 2018
Roll Call & SOI Updates (5 minutes) Welcome and Updates from EPDP Team Chair (5 minutes) Initial Report finalization status, incl. items remaining to be addressed and schedule for the week ahead Confirm status and next steps in relation to natural vs. legal and geographic status Review of outstanding action items Other updates, if applicable
Data Redaction (see attached)
Objective of discussion: Confirm language for inclusion in the Initial Report in relation to data redaction as well as email communication
Review latest version of language for inclusion in relation to data redaction Consider charter questions: f2) Should standardized requirements on registrant contact mechanism be developed? f3) Under what circumstances should third parties be permitted to contact the registrant, and how should contact be facilitated in those circumstances? And related draft recommendation: In relation to facilitating email communication between third parties and the registrant, the EPDP Team recommends that [current requirements in the Temporary Specification that specify that a Registrar MUST provide an email address or a web form to facilitate email communication with the relevant contact, but MUST NOT identify the contact email address or the contact itself, remain in place. [[[Other to be decided]]]. Confirm next steps, if any
Commence review & discussion of comments / input received on Initial Report
Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report
Commence review of proposed changes / comments on the Initial Report (see list attached) Confirm approach for addressing these Confirm next steps, if any
Wrap and confirm next meeting to be scheduled for Wednesday 14 November / Thursday 15 November at 14.00 UTC (dependent on progress made). Confirm action items Confirm questions for ICANN Org, if any
Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org <mailto:marika.konings@icann.org>
Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses <https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_...> and visiting the GNSO Newcomer pages <https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...>.
<Data Redaction - up 12 November 2018.docx><Initial Report changes for discussion - upd 12 November 2018.docx>_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team>
_______________________________________________ council mailing list council@gnso.icann.org https://mm.icann.org/mailman/listinfo/council
Hi Ayden, Thanks for sharing this. the EPDP team as a whole didn't have a chance to discuss the matter since it was raised less than 24hours ago in small team call and Thomas just shared his summary a few minutes ago. There was no discussion yet at the EPDP team level about revising charter or similar thing. Best, Rafik Le mar. 13 nov. 2018 à 20:30, Ayden Férdeline <icann@ferdeline.com> a écrit :
Hi all,
I am forwarding the below message along for information purposes as there has been a suggestion raised that a matter may need to be brought back to the Council to consider revising the EPDP charter. It might be premature to be forwarding this along, and nothing may come of it, but I figure the Council should be aware that the idea has been floated.
Kind regards, Ayden
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Tuesday, 13 November 2018 12:09, Thomas Rickert <epdp@gdpr.ninja> wrote:
Hello Marika, all, yesterday, the call of the small roles & responsibilities team had its call.
We thank JJ and Erika from ICANN Org for attending the call.
I will only be able to attend the first 90 mins of the call and I do not know whether it is possible to squeeze in a report and discussion of the outcome of our call while I am in attendance. Therefore, I would like to give a brief update in writing.
The plan for the meeting was to discuss
- what roles GDPR offers and if these are sufficiently described in the language I offered for the report - discussion of Rationale for joint controller vs. other scenarios - options and limitations of policy work / charter limitations - strategy to implementation
I hoped we could make sufficient progress during the call so that the small team could suggest a solid path forward to the EPDP plenary.
JJ reported to us that ICANN Org has a 10 page memo in the making in which concerns and ICANN’s views on the roles are described. He said that we should not jump to the conclusion that a joint controller scenario is given before the roles and responsibilities for the individual processing activities are determined. In his view, it is like putting the cart before the horse if a joint controller scenario is adopted before all parties had a chance to assess the impact on their liabilities and that joint controllership might not adequately reflect the risks the respective parties might want to take.
We then discussed that it is not really a question of what the parties want to choose to best suit their wishes, but a question of what the legal determination of the setup is. Several participants expressed their view that a joint controller scenario is likely present and therefore a joint controller agreement needs to be negotiated to reflect the roles and responsibilities and the required indemnifications etc. need to be put in place to associate the risks appropriately.
There are two issues with this that the EPDP Team and - in particular - the leadership needs to decide.
1. The issue of legal assessment vs. policy work
The question was brought up by Kurt and JJ in particular. They said - rightfully - that our group cannot really give legal advice. We have discussed the unfortunate situation that our policy group needs to do both compliance work as well as policy work in the EPDP plenary on multiple occasions before. We have a charter that requires us to speak to the responsibilities of the parties and this is just not possible without being transparent (in our report) about what concept we think is applicable. So I think the plenary needs to discuss and confirm that we will take position on this (which can be vetted during the public comment period).
If the EPDP Team does not wish to take a position on this question, I think we need to go back to the GNSO Council to ask for a revision of the charter.
2. Timing
We were not given any indication as to how quickly a memo would be shared with the EPDP Team. JJ said that their memo should inform and help our work but it should not stand in the way of our work.
In my view (which was shared by several participants), the EPDP Team must know what ICANN org’s view on the matter is. The SGs and Cs need to be able to take into account the concerns and suggestions that ICANN Org might have to inform their own positioning. Also, I think we cannot detach our work from ICANN org’s position. It would be unfortunate - to say the least - if our group came up with a recommendation for the parties to negotiate a JCA just to find out that ICANN Org will refuse to implement that recommendation. Thus, clarity is required as soon as possible and a report should not be published before the memo has been shared, analyzed, discussed in the EPDP team and potential revisions to the initial report have been made.
In closing, let me be honest with the entire team and express my frustration with the process. We have asked both Board liaisons as well as ICANN staff multiple times to share any legal memos / opinions there are to inform our discussions. Also, we have asked whether there would be concerns by ICANN Org with respect to entering into a joint controller agreement or data processing agreements in several meetings. We were not given any indication whatsoever that there could be problems. It is unfortunate to only learn about ICANN’s memo and that there are concerns a few days before the planned publication of our report.
Kind regards, Thomas
Am 12.11.2018 um 16:25 schrieb Marika Konings <marika.konings@icann.org>:
Dear All,
Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 13 November at 14.00 UTC.
- In relation to agenda item #3, please find attached an updated version of the proposed language for inclusion in the Initial Report in which staff has aimed to capture some of the input that was received in response to the Initial Report through the google doc, as well as input received on the mailing list. - In relation to agenda item #4, please find attached a table which provides an overview of the changes proposed by EPDP Team members that staff didn’t feel comfortable applying because e.g. either the proposed change is not clear, the proposed change affects previously agreed preliminary agreements / text, or is a substantive change that requires further discussion / consideration by the full EPDP Team (see *https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyGQ... <https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyGQwEQ/edit?ts=5be6721f>* for all comments received to date). In certain cases, staff has proposed a path forward, but would appreciate EPDP Team/commenter feedback before applying this change. Note that a number of comments were made in relation to preliminary recommendations and/or text that is still under consideration. It is the expectation that this input will be raised in the context of those discussions.
FYI, staff expects to share an updated version of the Initial Report later today so you can see how other input has been addressed (non-substantial issues) as well as how other aspects are coming together as a result of the EPDP Team work over the last couple of meetings.
Best regards,
Caitlin, Berry and Marika
======================
*EPDP Meeting #25 Agenda* Tuesday, 13 November 2018
1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes)
1. Initial Report finalization status, incl. items remaining to be addressed and schedule for the week ahead 2. Confirm status and next steps in relation to natural vs. legal and geographic status 3. Review of outstanding action items 4. Other updates, if applicable
1. Data Redaction (see attached)
Objective of discussion:
1. Confirm language for inclusion in the Initial Report in relation to data redaction as well as email communication
1. Review latest version of language for inclusion in relation to data redaction 2. Consider charter questions:
f2) Should standardized requirements on registrant contact mechanism be developed? f3) Under what circumstances should third parties be permitted to contact the registrant, and how should contact be facilitated in those circumstances? And related draft recommendation: In relation to facilitating email communication between third parties and the registrant, the EPDP Team recommends that [current requirements in the Temporary Specification that specify that a Registrar MUST provide an email address or a web form to facilitate email communication with the relevant contact, but MUST NOT identify the contact email address or the contact itself, remain in place. [[[Other to be decided]]].
1. Confirm next steps, if any
1. Commence review & discussion of comments / input received on Initial Report
Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report
1. Commence review of proposed changes / comments on the Initial Report (see list attached) 2. Confirm approach for addressing these 3. Confirm next steps, if any
1. Wrap and confirm next meeting to be scheduled for Wednesday 14 November / Thursday 15 November at 14.00 UTC (dependent on progress made). 1. Confirm action items 2. Confirm questions for ICANN Org, if any
*Marika Konings* *Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) * *Email: marika.konings@icann.org <marika.konings@icann.org> *
*Follow the GNSO via Twitter @ICANN_GNSO* *Find out more about the GNSO by taking our interactive courses <https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_...> and visiting the GNSO Newcomer pages <https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...>. *
<Data Redaction - up 12 November 2018.docx><Initial Report changes for discussion - upd 12 November 2018.docx> _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
_______________________________________________ council mailing list council@gnso.icann.org https://mm.icann.org/mailman/listinfo/council
Yes, as I said, it may be premature to forward this along, but I think the entire Council should be aware that this proposal has been floated. Again, nothing may come of it, but given the time crunch that the EPDP team is under, and an initial report that is already behind schedule in being published, I think the entire Council needs to be aware of any serious suggestions that could result in further delays. Best wishes, Ayden ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Tuesday, 13 November 2018 12:45, Rafik Dammak <rafik.dammak@gmail.com> wrote:
Hi Ayden,
Thanks for sharing this. the EPDP team as a whole didn't have a chance to discuss the matter since it was raised less than 24hours ago in small team call and Thomas just shared his summary a few minutes ago. There was no discussion yet at the EPDP team level about revising charter or similar thing.
Best,
Rafik
Le mar. 13 nov. 2018 à 20:30, Ayden Férdeline <icann@ferdeline.com> a écrit :
Hi all,
I am forwarding the below message along for information purposes as there has been a suggestion raised that a matter may need to be brought back to the Council to consider revising the EPDP charter. It might be premature to be forwarding this along, and nothing may come of it, but I figure the Council should be aware that the idea has been floated.
Kind regards, Ayden
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Tuesday, 13 November 2018 12:09, Thomas Rickert <epdp@gdpr.ninja> wrote:
Hello Marika, all, yesterday, the call of the small roles & responsibilities team had its call.
We thank JJ and Erika from ICANN Org for attending the call.
I will only be able to attend the first 90 mins of the call and I do not know whether it is possible to squeeze in a report and discussion of the outcome of our call while I am in attendance. Therefore, I would like to give a brief update in writing.
The plan for the meeting was to discuss
- what roles GDPR offers and if these are sufficiently described in the language I offered for the report - discussion of Rationale for joint controller vs. other scenarios - options and limitations of policy work / charter limitations - strategy to implementation
I hoped we could make sufficient progress during the call so that the small team could suggest a solid path forward to the EPDP plenary.
JJ reported to us that ICANN Org has a 10 page memo in the making in which concerns and ICANN’s views on the roles are described. He said that we should not jump to the conclusion that a joint controller scenario is given before the roles and responsibilities for the individual processing activities are determined. In his view, it is like putting the cart before the horse if a joint controller scenario is adopted before all parties had a chance to assess the impact on their liabilities and that joint controllership might not adequately reflect the risks the respective parties might want to take.
We then discussed that it is not really a question of what the parties want to choose to best suit their wishes, but a question of what the legal determination of the setup is. Several participants expressed their view that a joint controller scenario is likely present and therefore a joint controller agreement needs to be negotiated to reflect the roles and responsibilities and the required indemnifications etc. need to be put in place to associate the risks appropriately.
There are two issues with this that the EPDP Team and - in particular - the leadership needs to decide.
1. The issue of legal assessment vs. policy work
The question was brought up by Kurt and JJ in particular. They said - rightfully - that our group cannot really give legal advice. We have discussed the unfortunate situation that our policy group needs to do both compliance work as well as policy work in the EPDP plenary on multiple occasions before. We have a charter that requires us to speak to the responsibilities of the parties and this is just not possible without being transparent (in our report) about what concept we think is applicable. So I think the plenary needs to discuss and confirm that we will take position on this (which can be vetted during the public comment period).
If the EPDP Team does not wish to take a position on this question, I think we need to go back to the GNSO Council to ask for a revision of the charter.
2. Timing
We were not given any indication as to how quickly a memo would be shared with the EPDP Team. JJ said that their memo should inform and help our work but it should not stand in the way of our work.
In my view (which was shared by several participants), the EPDP Team must know what ICANN org’s view on the matter is. The SGs and Cs need to be able to take into account the concerns and suggestions that ICANN Org might have to inform their own positioning. Also, I think we cannot detach our work from ICANN org’s position. It would be unfortunate - to say the least - if our group came up with a recommendation for the parties to negotiate a JCA just to find out that ICANN Org will refuse to implement that recommendation. Thus, clarity is required as soon as possible and a report should not be published before the memo has been shared, analyzed, discussed in the EPDP team and potential revisions to the initial report have been made.
In closing, let me be honest with the entire team and express my frustration with the process. We have asked both Board liaisons as well as ICANN staff multiple times to share any legal memos / opinions there are to inform our discussions. Also, we have asked whether there would be concerns by ICANN Org with respect to entering into a joint controller agreement or data processing agreements in several meetings. We were not given any indication whatsoever that there could be problems. It is unfortunate to only learn about ICANN’s memo and that there are concerns a few days before the planned publication of our report.
Kind regards, Thomas
Am 12.11.2018 um 16:25 schrieb Marika Konings <marika.konings@icann.org>:
Dear All,
Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 13 November at 14.00 UTC.
- In relation to agenda item #3, please find attached an updated version of the proposed language for inclusion in the Initial Report in which staff has aimed to capture some of the input that was received in response to the Initial Report through the google doc, as well as input received on the mailing list.
- In relation to agenda item #4, please find attached a table which provides an overview of the changes proposed by EPDP Team members that staff didn’t feel comfortable applying because e.g. either the proposed change is not clear, the proposed change affects previously agreed preliminary agreements / text, or is a substantive change that requires further discussion / consideration by the full EPDP Team (see https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyGQ... for all comments received to date). In certain cases, staff has proposed a path forward, but would appreciate EPDP Team/commenter feedback before applying this change. Note that a number of comments were made in relation to preliminary recommendations and/or text that is still under consideration. It is the expectation that this input will be raised in the context of those discussions.
FYI, staff expects to share an updated version of the Initial Report later today so you can see how other input has been addressed (non-substantial issues) as well as how other aspects are coming together as a result of the EPDP Team work over the last couple of meetings.
Best regards,
Caitlin, Berry and Marika
======================
[][EPDP Meeting #25 Agenda] Tuesday, 13 November 2018
- Roll Call & SOI Updates (5 minutes)
- Welcome and Updates from EPDP Team Chair (5 minutes)
- Initial Report finalization status, incl. items remaining to be addressed and schedule for the week ahead
- Confirm status and next steps in relation to natural vs. legal and geographic status
- Review of outstanding action items
- Other updates, if applicable
- Data Redaction (see attached)
Objective of discussion:
- Confirm language for inclusion in the Initial Report in relation to data redaction as well as email communication
- Review latest version of language for inclusion in relation to data redaction
- Consider charter questions:
f2) Should standardized requirements on registrant contact mechanism be developed? f3) Under what circumstances should third parties be permitted to contact the registrant, and how should contact be facilitated in those circumstances? And related draft recommendation: In relation to facilitating email communication between third parties and the registrant, the EPDP Team recommends that [current requirements in the Temporary Specification that specify that a Registrar MUST provide an email address or a web form to facilitate email communication with the relevant contact, but MUST NOT identify the contact email address or the contact itself, remain in place. [[[Other to be decided]]].
- Confirm next steps, if any
- Commence review & discussion of comments / input received on Initial Report
Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report
- Commence review of proposed changes / comments on the Initial Report (see list attached)
- Confirm approach for addressing these
- Confirm next steps, if any
- Wrap and confirm next meeting to be scheduled for Wednesday 14 November / Thursday 15 November at 14.00 UTC (dependent on progress made).
- Confirm action items
- Confirm questions for ICANN Org, if any
Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org
Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our [interactive courses](https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_...) and visiting the [GNSO Newcomer pages](https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...).
<Data Redaction - up 12 November 2018.docx><Initial Report changes for discussion - upd 12 November 2018.docx>_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
_______________________________________________ council mailing list council@gnso.icann.org https://mm.icann.org/mailman/listinfo/council
It’s important that we are aware of the situation. Whether this needs to be dealt with or not I hope will be clearer once the ePDP group has had time to digest and discuss it. Regards Michele Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: council <council-bounces@gnso.icann.org> on behalf of Ayden Férdeline <icann@ferdeline.com> Reply-To: Ayden Férdeline <icann@ferdeline.com> Date: Tuesday 13 November 2018 at 12:55 To: Rafik Dammak <rafik.dammak@gmail.com> Cc: Council GNSO <council@gnso.icann.org> Subject: Re: [council] Fw: [Gnso-epdp-team] Report on Small team on roles & responsibilities in preparation for EPDP Team Meeting #25 Yes, as I said, it may be premature to forward this along, but I think the entire Council should be aware that this proposal has been floated. Again, nothing may come of it, but given the time crunch that the EPDP team is under, and an initial report that is already behind schedule in being published, I think the entire Council needs to be aware of any serious suggestions that could result in further delays. Best wishes, Ayden ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Tuesday, 13 November 2018 12:45, Rafik Dammak <rafik.dammak@gmail.com> wrote: Hi Ayden, Thanks for sharing this. the EPDP team as a whole didn't have a chance to discuss the matter since it was raised less than 24hours ago in small team call and Thomas just shared his summary a few minutes ago. There was no discussion yet at the EPDP team level about revising charter or similar thing. Best, Rafik Le mar. 13 nov. 2018 à 20:30, Ayden Férdeline <icann@ferdeline.com<mailto:icann@ferdeline.com>> a écrit : Hi all, I am forwarding the below message along for information purposes as there has been a suggestion raised that a matter may need to be brought back to the Council to consider revising the EPDP charter. It might be premature to be forwarding this along, and nothing may come of it, but I figure the Council should be aware that the idea has been floated. Kind regards, Ayden ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Tuesday, 13 November 2018 12:09, Thomas Rickert <epdp@gdpr.ninja<mailto:epdp@gdpr.ninja>> wrote: Hello Marika, all, yesterday, the call of the small roles & responsibilities team had its call. We thank JJ and Erika from ICANN Org for attending the call. I will only be able to attend the first 90 mins of the call and I do not know whether it is possible to squeeze in a report and discussion of the outcome of our call while I am in attendance. Therefore, I would like to give a brief update in writing. The plan for the meeting was to discuss - what roles GDPR offers and if these are sufficiently described in the language I offered for the report - discussion of Rationale for joint controller vs. other scenarios - options and limitations of policy work / charter limitations - strategy to implementation I hoped we could make sufficient progress during the call so that the small team could suggest a solid path forward to the EPDP plenary. JJ reported to us that ICANN Org has a 10 page memo in the making in which concerns and ICANN’s views on the roles are described. He said that we should not jump to the conclusion that a joint controller scenario is given before the roles and responsibilities for the individual processing activities are determined. In his view, it is like putting the cart before the horse if a joint controller scenario is adopted before all parties had a chance to assess the impact on their liabilities and that joint controllership might not adequately reflect the risks the respective parties might want to take. We then discussed that it is not really a question of what the parties want to choose to best suit their wishes, but a question of what the legal determination of the setup is. Several participants expressed their view that a joint controller scenario is likely present and therefore a joint controller agreement needs to be negotiated to reflect the roles and responsibilities and the required indemnifications etc. need to be put in place to associate the risks appropriately. There are two issues with this that the EPDP Team and - in particular - the leadership needs to decide. 1. The issue of legal assessment vs. policy work The question was brought up by Kurt and JJ in particular. They said - rightfully - that our group cannot really give legal advice. We have discussed the unfortunate situation that our policy group needs to do both compliance work as well as policy work in the EPDP plenary on multiple occasions before. We have a charter that requires us to speak to the responsibilities of the parties and this is just not possible without being transparent (in our report) about what concept we think is applicable. So I think the plenary needs to discuss and confirm that we will take position on this (which can be vetted during the public comment period). If the EPDP Team does not wish to take a position on this question, I think we need to go back to the GNSO Council to ask for a revision of the charter. 2. Timing We were not given any indication as to how quickly a memo would be shared with the EPDP Team. JJ said that their memo should inform and help our work but it should not stand in the way of our work. In my view (which was shared by several participants), the EPDP Team must know what ICANN org’s view on the matter is. The SGs and Cs need to be able to take into account the concerns and suggestions that ICANN Org might have to inform their own positioning. Also, I think we cannot detach our work from ICANN org’s position. It would be unfortunate - to say the least - if our group came up with a recommendation for the parties to negotiate a JCA just to find out that ICANN Org will refuse to implement that recommendation. Thus, clarity is required as soon as possible and a report should not be published before the memo has been shared, analyzed, discussed in the EPDP team and potential revisions to the initial report have been made. In closing, let me be honest with the entire team and express my frustration with the process. We have asked both Board liaisons as well as ICANN staff multiple times to share any legal memos / opinions there are to inform our discussions. Also, we have asked whether there would be concerns by ICANN Org with respect to entering into a joint controller agreement or data processing agreements in several meetings. We were not given any indication whatsoever that there could be problems. It is unfortunate to only learn about ICANN’s memo and that there are concerns a few days before the planned publication of our report. Kind regards, Thomas Am 12.11.2018 um 16:25 schrieb Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>: Dear All, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 13 November at 14.00 UTC. * In relation to agenda item #3, please find attached an updated version of the proposed language for inclusion in the Initial Report in which staff has aimed to capture some of the input that was received in response to the Initial Report through the google doc, as well as input received on the mailing list. * In relation to agenda item #4, please find attached a table which provides an overview of the changes proposed by EPDP Team members that staff didn’t feel comfortable applying because e.g. either the proposed change is not clear, the proposed change affects previously agreed preliminary agreements / text, or is a substantive change that requires further discussion / consideration by the full EPDP Team (see https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyGQ... for all comments received to date). In certain cases, staff has proposed a path forward, but would appreciate EPDP Team/commenter feedback before applying this change. Note that a number of comments were made in relation to preliminary recommendations and/or text that is still under consideration. It is the expectation that this input will be raised in the context of those discussions. FYI, staff expects to share an updated version of the Initial Report later today so you can see how other input has been addressed (non-substantial issues) as well as how other aspects are coming together as a result of the EPDP Team work over the last couple of meetings. Best regards, Caitlin, Berry and Marika ====================== EPDP Meeting #25 Agenda Tuesday, 13 November 2018 1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Initial Report finalization status, incl. items remaining to be addressed and schedule for the week ahead * Confirm status and next steps in relation to natural vs. legal and geographic status * Review of outstanding action items * Other updates, if applicable 1. Data Redaction (see attached) Objective of discussion: 1. Confirm language for inclusion in the Initial Report in relation to data redaction as well as email communication * Review latest version of language for inclusion in relation to data redaction * Consider charter questions: f2) Should standardized requirements on registrant contact mechanism be developed? f3) Under what circumstances should third parties be permitted to contact the registrant, and how should contact be facilitated in those circumstances? And related draft recommendation: In relation to facilitating email communication between third parties and the registrant, the EPDP Team recommends that [current requirements in the Temporary Specification that specify that a Registrar MUST provide an email address or a web form to facilitate email communication with the relevant contact, but MUST NOT identify the contact email address or the contact itself, remain in place. [[[Other to be decided]]]. * Confirm next steps, if any 1. Commence review & discussion of comments / input received on Initial Report Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report * Commence review of proposed changes / comments on the Initial Report (see list attached) * Confirm approach for addressing these * Confirm next steps, if any 1. Wrap and confirm next meeting to be scheduled for Wednesday 14 November / Thursday 15 November at 14.00 UTC (dependent on progress made). * Confirm action items * Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_...> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...>. <Data Redaction - up 12 November 2018.docx><Initial Report changes for discussion - upd 12 November 2018.docx>_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ council mailing list council@gnso.icann.org<mailto:council@gnso.icann.org> https://mm.icann.org/mailman/listinfo/council
Hi, quick update, the EPDP call just finished. The general feeling within the team is to proceed with the initial report indicating the current thinking on the matter regarding the joint controller (EPDP team members will make clarifying questions within the next 24hours to work on the topic) and make a note about the memo from ICANN legal counsel. It is also asking to get that memo asap. I expect there will more updates on EPDP this week. Best, Rafik Le mar. 13 nov. 2018 à 22:15, Michele Neylon - Blacknight < michele@blacknight.com> a écrit :
It’s important that we are aware of the situation. Whether this needs to be dealt with or not I hope will be clearer once the ePDP group has had time to digest and discuss it.
Regards
Michele
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Intl. +353 (0) 59 9183072
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845
*From: *council <council-bounces@gnso.icann.org> on behalf of Ayden Férdeline <icann@ferdeline.com> *Reply-To: *Ayden Férdeline <icann@ferdeline.com> *Date: *Tuesday 13 November 2018 at 12:55 *To: *Rafik Dammak <rafik.dammak@gmail.com> *Cc: *Council GNSO <council@gnso.icann.org> *Subject: *Re: [council] Fw: [Gnso-epdp-team] Report on Small team on roles & responsibilities in preparation for EPDP Team Meeting #25
Yes, as I said, it may be premature to forward this along, but I think the entire Council should be aware that this proposal has been floated. Again, nothing may come of it, but given the time crunch that the EPDP team is under, and an initial report that is already behind schedule in being published, I think the entire Council needs to be aware of any serious suggestions that could result in further delays.
Best wishes, Ayden
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Tuesday, 13 November 2018 12:45, Rafik Dammak <rafik.dammak@gmail.com> wrote:
Hi Ayden,
Thanks for sharing this.
the EPDP team as a whole didn't have a chance to discuss the matter since it was raised less than 24hours ago in small team call and Thomas just shared his summary a few minutes ago. There was no discussion yet at the EPDP team level about revising charter or similar thing.
Best,
Rafik
Le mar. 13 nov. 2018 à 20:30, Ayden Férdeline <icann@ferdeline.com> a écrit :
Hi all,
I am forwarding the below message along for information purposes as there has been a suggestion raised that a matter may need to be brought back to the Council to consider revising the EPDP charter. It might be premature to be forwarding this along, and nothing may come of it, but I figure the Council should be aware that the idea has been floated.
Kind regards, Ayden
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Tuesday, 13 November 2018 12:09, Thomas Rickert <epdp@gdpr.ninja> wrote:
Hello Marika, all,
yesterday, the call of the small roles & responsibilities team had its call.
We thank JJ and Erika from ICANN Org for attending the call.
I will only be able to attend the first 90 mins of the call and I do not know whether it is possible to squeeze in a report and discussion of the outcome of our call while I am in attendance. Therefore, I would like to give a brief update in writing.
The plan for the meeting was to discuss
- what roles GDPR offers and if these are sufficiently described in the language I offered for the report
- discussion of Rationale for joint controller vs. other scenarios
- options and limitations of policy work / charter limitations
- strategy to implementation
I hoped we could make sufficient progress during the call so that the small team could suggest a solid path forward to the EPDP plenary.
JJ reported to us that ICANN Org has a 10 page memo in the making in which concerns and ICANN’s views on the roles are described.
He said that we should not jump to the conclusion that a joint controller scenario is given before the roles and responsibilities for the individual processing activities are determined.
In his view, it is like putting the cart before the horse if a joint controller scenario is adopted before all parties had a chance to assess the impact on their liabilities and that joint controllership might not adequately reflect the risks the respective parties might want to take.
We then discussed that it is not really a question of what the parties want to choose to best suit their wishes, but a question of what the legal determination of the setup is. Several participants expressed their view that a joint controller scenario is likely present and therefore a joint controller agreement needs to be negotiated to reflect the roles and responsibilities and the required indemnifications etc. need to be put in place to associate the risks appropriately.
There are two issues with this that the EPDP Team and - in particular - the leadership needs to decide.
1. The issue of legal assessment vs. policy work
The question was brought up by Kurt and JJ in particular. They said - rightfully - that our group cannot really give legal advice. We have discussed the unfortunate situation that our policy group needs to do both compliance work as well as policy work in the EPDP plenary on multiple occasions before. We have a charter that requires us to speak to the responsibilities of the parties and this is just not possible without being transparent (in our report) about what concept we think is applicable. So I think the plenary needs to discuss and confirm that we will take position on this (which can be vetted during the public comment period).
If the EPDP Team does not wish to take a position on this question, I think we need to go back to the GNSO Council to ask for a revision of the charter.
2. Timing
We were not given any indication as to how quickly a memo would be shared with the EPDP Team. JJ said that their memo should inform and help our work but it should not stand in the way of our work.
In my view (which was shared by several participants), the EPDP Team must know what ICANN org’s view on the matter is. The SGs and Cs need to be able to take into account the concerns and suggestions that ICANN Org might have to inform their own positioning. Also, I think we cannot detach our work from ICANN org’s position. It would be unfortunate - to say the least - if our group came up with a recommendation for the parties to negotiate a JCA just to find out that ICANN Org will refuse to implement that recommendation. Thus, clarity is required as soon as possible and a report should not be published before the memo has been shared, analyzed, discussed in the EPDP team and potential revisions to the initial report have been made.
In closing, let me be honest with the entire team and express my frustration with the process.
We have asked both Board liaisons as well as ICANN staff multiple times to share any legal memos / opinions there are to inform our discussions. Also, we have asked whether there would be concerns by ICANN Org with respect to entering into a joint controller agreement or data processing agreements in several meetings. We were not given any indication whatsoever that there could be problems. It is unfortunate to only learn about ICANN’s memo and that there are concerns a few days before the planned publication of our report.
Kind regards,
Thomas
Am 12.11.2018 um 16:25 schrieb Marika Konings <marika.konings@icann.org>:
Dear All,
Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 13 November at 14.00 UTC.
- In relation to agenda item #3, please find attached an updated version of the proposed language for inclusion in the Initial Report in which staff has aimed to capture some of the input that was received in response to the Initial Report through the google doc, as well as input received on the mailing list. - In relation to agenda item #4, please find attached a table which provides an overview of the changes proposed by EPDP Team members that staff didn’t feel comfortable applying because e.g. either the proposed change is not clear, the proposed change affects previously agreed preliminary agreements / text, or is a substantive change that requires further discussion / consideration by the full EPDP Team (see *https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyGQ... <https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyGQwEQ/edit?ts=5be6721f>* for all comments received to date). In certain cases, staff has proposed a path forward, but would appreciate EPDP Team/commenter feedback before applying this change. Note that a number of comments were made in relation to preliminary recommendations and/or text that is still under consideration. It is the expectation that this input will be raised in the context of those discussions.
FYI, staff expects to share an updated version of the Initial Report later today so you can see how other input has been addressed (non-substantial issues) as well as how other aspects are coming together as a result of the EPDP Team work over the last couple of meetings.
Best regards,
Caitlin, Berry and Marika
======================
*EPDP Meeting #25 Agenda*
Tuesday, 13 November 2018
1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes)
1. Initial Report finalization status, incl. items remaining to be addressed and schedule for the week ahead 2. Confirm status and next steps in relation to natural vs. legal and geographic status 3. Review of outstanding action items 4. Other updates, if applicable
1. Data Redaction (see attached)
Objective of discussion:
1. Confirm language for inclusion in the Initial Report in relation to data redaction as well as email communication
1. Review latest version of language for inclusion in relation to data redaction 2. Consider charter questions:
f2) Should standardized requirements on registrant contact mechanism be developed?
f3) Under what circumstances should third parties be permitted to contact the registrant, and how should contact be facilitated in those circumstances?
And related draft recommendation:
In relation to facilitating email communication between third parties and the registrant, the EPDP Team recommends that [current requirements in the Temporary Specification that specify that a Registrar MUST provide an email address or a web form to facilitate email communication with the relevant contact, but MUST NOT identify the contact email address or the contact itself, remain in place. [[[Other to be decided]]].
1. Confirm next steps, if any
1. Commence review & discussion of comments / input received on Initial Report
Objective of discussion:
(1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration
(2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report
1. Commence review of proposed changes / comments on the Initial Report (see list attached) 2. Confirm approach for addressing these 3. Confirm next steps, if any
1. Wrap and confirm next meeting to be scheduled for Wednesday 14 November / Thursday 15 November at 14.00 UTC (dependent on progress made).
1. Confirm action items 2. Confirm questions for ICANN Org, if any
*Marika Konings*
*Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) *
*Email: marika.konings@icann.org <marika.konings@icann.org> *
*Follow the GNSO via Twitter @ICANN_GNSO*
*Find out more about the GNSO by taking our interactive courses <https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_...> and visiting the GNSO Newcomer pages <https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...>. *
<Data Redaction - up 12 November 2018.docx><Initial Report changes for discussion - upd 12 November 2018.docx> _______________________________________________
Gnso-epdp-team mailing list
Gnso-epdp-team@icann.org
https://mm.icann.org/mailman/listinfo/gnso-epdp-team
_______________________________________________
council mailing list
council@gnso.icann.org
Thanks Rafik – good to know. Marie From: council <council-bounces@gnso.icann.org> On Behalf Of Rafik Dammak Sent: Tuesday, November 13, 2018 4:48 PM To: Michele Neylon :: Blacknight <michele@blacknight.com> Cc: Council GNSO <council@gnso.icann.org> Subject: Re: [council] Fw: [Gnso-epdp-team] Report on Small team on roles & responsibilities in preparation for EPDP Team Meeting #25 Hi, quick update, the EPDP call just finished. The general feeling within the team is to proceed with the initial report indicating the current thinking on the matter regarding the joint controller (EPDP team members will make clarifying questions within the next 24hours to work on the topic) and make a note about the memo from ICANN legal counsel. It is also asking to get that memo asap. I expect there will more updates on EPDP this week. Best, Rafik Le mar. 13 nov. 2018 à 22:15, Michele Neylon - Blacknight <michele@blacknight.com<mailto:michele@blacknight.com>> a écrit : It’s important that we are aware of the situation. Whether this needs to be dealt with or not I hope will be clearer once the ePDP group has had time to digest and discuss it. Regards Michele Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: council <council-bounces@gnso.icann.org<mailto:council-bounces@gnso.icann.org>> on behalf of Ayden Férdeline <icann@ferdeline.com<mailto:icann@ferdeline.com>> Reply-To: Ayden Férdeline <icann@ferdeline.com<mailto:icann@ferdeline.com>> Date: Tuesday 13 November 2018 at 12:55 To: Rafik Dammak <rafik.dammak@gmail.com<mailto:rafik.dammak@gmail.com>> Cc: Council GNSO <council@gnso.icann.org<mailto:council@gnso.icann.org>> Subject: Re: [council] Fw: [Gnso-epdp-team] Report on Small team on roles & responsibilities in preparation for EPDP Team Meeting #25 Yes, as I said, it may be premature to forward this along, but I think the entire Council should be aware that this proposal has been floated. Again, nothing may come of it, but given the time crunch that the EPDP team is under, and an initial report that is already behind schedule in being published, I think the entire Council needs to be aware of any serious suggestions that could result in further delays. Best wishes, Ayden ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Tuesday, 13 November 2018 12:45, Rafik Dammak <rafik.dammak@gmail.com<mailto:rafik.dammak@gmail.com>> wrote: Hi Ayden, Thanks for sharing this. the EPDP team as a whole didn't have a chance to discuss the matter since it was raised less than 24hours ago in small team call and Thomas just shared his summary a few minutes ago. There was no discussion yet at the EPDP team level about revising charter or similar thing. Best, Rafik Le mar. 13 nov. 2018 à 20:30, Ayden Férdeline <icann@ferdeline.com<mailto:icann@ferdeline.com>> a écrit : Hi all, I am forwarding the below message along for information purposes as there has been a suggestion raised that a matter may need to be brought back to the Council to consider revising the EPDP charter. It might be premature to be forwarding this along, and nothing may come of it, but I figure the Council should be aware that the idea has been floated. Kind regards, Ayden ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Tuesday, 13 November 2018 12:09, Thomas Rickert <epdp@gdpr.ninja<mailto:epdp@gdpr.ninja>> wrote: Hello Marika, all, yesterday, the call of the small roles & responsibilities team had its call. We thank JJ and Erika from ICANN Org for attending the call. I will only be able to attend the first 90 mins of the call and I do not know whether it is possible to squeeze in a report and discussion of the outcome of our call while I am in attendance. Therefore, I would like to give a brief update in writing. The plan for the meeting was to discuss - what roles GDPR offers and if these are sufficiently described in the language I offered for the report - discussion of Rationale for joint controller vs. other scenarios - options and limitations of policy work / charter limitations - strategy to implementation I hoped we could make sufficient progress during the call so that the small team could suggest a solid path forward to the EPDP plenary. JJ reported to us that ICANN Org has a 10 page memo in the making in which concerns and ICANN’s views on the roles are described. He said that we should not jump to the conclusion that a joint controller scenario is given before the roles and responsibilities for the individual processing activities are determined. In his view, it is like putting the cart before the horse if a joint controller scenario is adopted before all parties had a chance to assess the impact on their liabilities and that joint controllership might not adequately reflect the risks the respective parties might want to take. We then discussed that it is not really a question of what the parties want to choose to best suit their wishes, but a question of what the legal determination of the setup is. Several participants expressed their view that a joint controller scenario is likely present and therefore a joint controller agreement needs to be negotiated to reflect the roles and responsibilities and the required indemnifications etc. need to be put in place to associate the risks appropriately. There are two issues with this that the EPDP Team and - in particular - the leadership needs to decide. 1. The issue of legal assessment vs. policy work The question was brought up by Kurt and JJ in particular. They said - rightfully - that our group cannot really give legal advice. We have discussed the unfortunate situation that our policy group needs to do both compliance work as well as policy work in the EPDP plenary on multiple occasions before. We have a charter that requires us to speak to the responsibilities of the parties and this is just not possible without being transparent (in our report) about what concept we think is applicable. So I think the plenary needs to discuss and confirm that we will take position on this (which can be vetted during the public comment period). If the EPDP Team does not wish to take a position on this question, I think we need to go back to the GNSO Council to ask for a revision of the charter. 2. Timing We were not given any indication as to how quickly a memo would be shared with the EPDP Team. JJ said that their memo should inform and help our work but it should not stand in the way of our work. In my view (which was shared by several participants), the EPDP Team must know what ICANN org’s view on the matter is. The SGs and Cs need to be able to take into account the concerns and suggestions that ICANN Org might have to inform their own positioning. Also, I think we cannot detach our work from ICANN org’s position. It would be unfortunate - to say the least - if our group came up with a recommendation for the parties to negotiate a JCA just to find out that ICANN Org will refuse to implement that recommendation. Thus, clarity is required as soon as possible and a report should not be published before the memo has been shared, analyzed, discussed in the EPDP team and potential revisions to the initial report have been made. In closing, let me be honest with the entire team and express my frustration with the process. We have asked both Board liaisons as well as ICANN staff multiple times to share any legal memos / opinions there are to inform our discussions. Also, we have asked whether there would be concerns by ICANN Org with respect to entering into a joint controller agreement or data processing agreements in several meetings. We were not given any indication whatsoever that there could be problems. It is unfortunate to only learn about ICANN’s memo and that there are concerns a few days before the planned publication of our report. Kind regards, Thomas Am 12.11.2018 um 16:25 schrieb Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>: Dear All, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 13 November at 14.00 UTC. * In relation to agenda item #3, please find attached an updated version of the proposed language for inclusion in the Initial Report in which staff has aimed to capture some of the input that was received in response to the Initial Report through the google doc, as well as input received on the mailing list. * In relation to agenda item #4, please find attached a table which provides an overview of the changes proposed by EPDP Team members that staff didn’t feel comfortable applying because e.g. either the proposed change is not clear, the proposed change affects previously agreed preliminary agreements / text, or is a substantive change that requires further discussion / consideration by the full EPDP Team (see https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyGQ... for all comments received to date). In certain cases, staff has proposed a path forward, but would appreciate EPDP Team/commenter feedback before applying this change. Note that a number of comments were made in relation to preliminary recommendations and/or text that is still under consideration. It is the expectation that this input will be raised in the context of those discussions. FYI, staff expects to share an updated version of the Initial Report later today so you can see how other input has been addressed (non-substantial issues) as well as how other aspects are coming together as a result of the EPDP Team work over the last couple of meetings. Best regards, Caitlin, Berry and Marika ====================== EPDP Meeting #25 Agenda Tuesday, 13 November 2018 1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Initial Report finalization status, incl. items remaining to be addressed and schedule for the week ahead * Confirm status and next steps in relation to natural vs. legal and geographic status * Review of outstanding action items * Other updates, if applicable 1. Data Redaction (see attached) Objective of discussion: 1. Confirm language for inclusion in the Initial Report in relation to data redaction as well as email communication * Review latest version of language for inclusion in relation to data redaction * Consider charter questions: f2) Should standardized requirements on registrant contact mechanism be developed? f3) Under what circumstances should third parties be permitted to contact the registrant, and how should contact be facilitated in those circumstances? And related draft recommendation: In relation to facilitating email communication between third parties and the registrant, the EPDP Team recommends that [current requirements in the Temporary Specification that specify that a Registrar MUST provide an email address or a web form to facilitate email communication with the relevant contact, but MUST NOT identify the contact email address or the contact itself, remain in place. [[[Other to be decided]]]. * Confirm next steps, if any 1. Commence review & discussion of comments / input received on Initial Report Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report * Commence review of proposed changes / comments on the Initial Report (see list attached) * Confirm approach for addressing these * Confirm next steps, if any 1. Wrap and confirm next meeting to be scheduled for Wednesday 14 November / Thursday 15 November at 14.00 UTC (dependent on progress made). * Confirm action items * Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_...> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...>. <Data Redaction - up 12 November 2018.docx><Initial Report changes for discussion - upd 12 November 2018.docx>_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ council mailing list council@gnso.icann.org<mailto:council@gnso.icann.org> https://mm.icann.org/mailman/listinfo/council
participants (5)
-
Ayden Férdeline -
Marie Pattullo -
Martin Pablo Silva Valent -
Michele Neylon - Blacknight -
Rafik Dammak