Status Update: Privacy and Proxy Services Accreditation Implementation Review Team
Dear Councilors, I wanted to provide you with an update regarding the Privacy and Proxy Services Accreditation Implementation Review Team. Accreditation Agreement IRT members have been working with Staff for some time on the draft accreditation agreement and have gotten to a place where most of the language is supported by a general consensus. However, there is one key issue that remains unresolved – the PSWG insists the contract require Privacy/Proxy providers to respond to “high priority” requests within 24 hours. In Puerto Rico, a small group of registrars met with key PSWG representatives to try to reach a resolution on this issue, and then the entire IRT working group met again to continue attempts to reach a resolution. The discussion has continued on the email list, but remains unresolved. It is the PSWG’s position that disclosure of customer information for “high priority” requests must be done within 24 hours because lives are in danger. They were clear in their statements during the small group meeting in Puerto Rico that these “high priority” requests should ideally be responded to immediately upon receipt but at least within one hour. The PSWG feels they have compromised extensively by agreeing to 24 hours. Registrar members of the IRT are concerned with the contractual language for a few reasons: (1) it creates a presumption of immediate disclosure (assuming the provider doesn’t have to perform any investigation/verification relating to the request, (2) a potential demand to bypass or ignore due process, and 3) creates an unworkable expectation of privacy/proxy providers around the globe, many of whom who do not operate with 24x7 staffing for this type of issue. Some registrar members have also expressed concern that establishing this 24-hour disclosure requirement is stepping beyond the policy recommendations of the PDP and effectively creating new policy. Accreditation Pricing In Puerto Rico, Staff presented its accreditation pricing model, based on simple cost recovery for ICANN. IRT member asked a number of questions about the detail behind the pricing model, and await that detail from Staff. Based on various meetings in Puerto Rico, some IRT members expressed concern that the pricing model simply mirrors the registrar accreditation model and was not based on any sort of actual cost-recovery plan. And as mentioned on the Council list last month and during our Council meetings in Puerto Rico, there is also concern that some affected departments within ICANN org are not aware of the impact this program may have on its needs for personnel or other support. Data Escrow Specification Significant revisions were needed by Staff to adjust the current registrar data escrow specification to fit into this accreditation program. Staff is expected to deliver that draft to the IRT this week. Last week’s meeting was canceled due to the AdobeConnect issues. This week’s meeting was canceled to allow staff time to get the data escrow specification draft done and circulated to the members. Next meeting should be Tuesday, April 10. Staff has indicated the proposed documents will be ready for publication for public comment in late April or Early May. I understand this issue will be listed for discussion on our April 26, 2018, Council meeting agenda. Thanks, Darcy ---------------- Darcy Southwell | Compliance Officer M: +1 503-453-7305 │ Skype: darcy.enyeart
Thanks very much, Darcy, for this update. In view of the public comment opening in late April or early May, it would be timely to have this listed as a discussion item on our 26 April agenda. In particular we might discuss: a) any particular needs to be served by this public comment period in light of the fact that there are outstanding points of disagreement amongst members of the IRT b) next steps after public comment, in view of the outstanding points of disagreement c) how the IRT guidelines might better serve groups in this situation. Best wishes, Heather On Tue, Apr 3, 2018 at 5:35 AM, Darcy Southwell < darcy.southwell@endurance.com> wrote:
Dear Councilors,
I wanted to provide you with an update regarding the Privacy and Proxy Services Accreditation Implementation Review Team <https://community.icann.org/display/IRT/Privacy+and+Proxy+Services+Accreditation+Implementation>.
*Accreditation Agreement*
IRT members have been working with Staff for some time on the draft accreditation agreement and have gotten to a place where most of the language is supported by a general consensus. However, there is one key issue that remains unresolved – the PSWG insists the contract require Privacy/Proxy providers to respond to “high priority” requests within 24 hours. In Puerto Rico, a small group of registrars met with key PSWG representatives to try to reach a resolution on this issue, and then the entire IRT working group met again to continue attempts to reach a resolution. The discussion has continued on the email list, but remains unresolved.
It is the PSWG’s position that disclosure of customer information for “high priority” requests must be done within 24 hours because lives are in danger. They were clear in their statements during the small group meeting in Puerto Rico that these “high priority” requests should ideally be responded to immediately upon receipt but at least within one hour. The PSWG feels they have compromised extensively by agreeing to 24 hours.
Registrar members of the IRT are concerned with the contractual language for a few reasons: (1) it creates a presumption of immediate disclosure (assuming the provider doesn’t have to perform any investigation/verification relating to the request, (2) a potential demand to bypass or ignore due process, and 3) creates an unworkable expectation of privacy/proxy providers around the globe, many of whom who do not operate with 24x7 staffing for this type of issue. Some registrar members have also expressed concern that establishing this 24-hour disclosure requirement is stepping beyond the policy recommendations of the PDP and effectively creating new policy.
*Accreditation Pricing*
In Puerto Rico, Staff presented its accreditation pricing model, based on simple cost recovery for ICANN. IRT member asked a number of questions about the detail behind the pricing model, and await that detail from Staff. Based on various meetings in Puerto Rico, some IRT members expressed concern that the pricing model simply mirrors the registrar accreditation model and was not based on any sort of actual cost-recovery plan. And as mentioned on the Council list last month and during our Council meetings in Puerto Rico, there is also concern that some affected departments within ICANN org are not aware of the impact this program may have on its needs for personnel or other support.
*Data Escrow Specification*
Significant revisions were needed by Staff to adjust the current registrar data escrow specification to fit into this accreditation program. Staff is expected to deliver that draft to the IRT this week.
Last week’s meeting was canceled due to the AdobeConnect issues. This week’s meeting was canceled to allow staff time to get the data escrow specification draft done and circulated to the members. Next meeting should be Tuesday, April 10. Staff has indicated the proposed documents will be ready for publication for public comment in late April or Early May.
I understand this issue will be listed for discussion on our April 26, 2018, Council meeting agenda.
Thanks,
Darcy
----------------
*Darcy Southwell *| Compliance Officer
M: +1 503-453-7305 <(503)%20453-7305> │ Skype: darcy.enyeart
[image: signature_1659676836]
_______________________________________________ council mailing list council@gnso.icann.org https://mm.icann.org/mailman/listinfo/council
All, I wanted to provide you with an update on the Privacy and Proxy Services Accreditation Implementation Review Team in advance of our Council meeting in Panama City. Overall, the IRT is progressing, albeit quite slowly. There have been quite a few concerns raised about GDPR’s impact on this program, while others have expressed significant concern over the delays in going to public comment. Her are the three key items in progress: Accreditation Agreement: Latest version was provided to the IRT on June 13 and is under review by IRT members. The disagreement between IRT members regarding the 24-hour response timeline highlighted for you in April remains. Accreditation Pricing: Accreditation pricing details were provided to the IRT on May 22 with updates were provided June 13. IRT members continue to review. Some IRT members have challenged some of ICANN org’s assumptions (e.g., 250 applicants) and have open questions about certain activities (e.g., “data retention waiver”). Based on staff communications, the proposed fee structure will be published for public comment and ICANN org committed to revisiting the proposed fees persuasive reasons to revisit are raised during public comment. Data Escrow Specification: Latest version was provided to the IRT on June 15 and is under review by IRT members. ICANN org is still preparing the documentation that will be required to support the allowance for registrar-affiliated privacy/proxy providers to meet their data escrow requirements. Regarding public comment timing, that currently hinges on the results of ICANN Legal’s review of the documents for GDPR and other matters, which is expected to be done by the end of June. If few issues are identified, these materials could be ready to go out for public comment by the end of July (following IRT review/discussion of Legal’s comments). But if the review identifies more significant issues that must be resolved prior to public comment, publication could be later than that. Thanks, Darcy From: Darcy Southwell <darcy.southwell@endurance.com> Date: Monday, April 2, 2018 at 12:35 PM To: GNSO Council List <council@gnso.icann.org> Subject: Status Update: Privacy and Proxy Services Accreditation Implementation Review Team Dear Councilors, I wanted to provide you with an update regarding the Privacy and Proxy Services Accreditation Implementation Review Team. Accreditation Agreement IRT members have been working with Staff for some time on the draft accreditation agreement and have gotten to a place where most of the language is supported by a general consensus. However, there is one key issue that remains unresolved – the PSWG insists the contract require Privacy/Proxy providers to respond to “high priority” requests within 24 hours. In Puerto Rico, a small group of registrars met with key PSWG representatives to try to reach a resolution on this issue, and then the entire IRT working group met again to continue attempts to reach a resolution. The discussion has continued on the email list, but remains unresolved. It is the PSWG’s position that disclosure of customer information for “high priority” requests must be done within 24 hours because lives are in danger. They were clear in their statements during the small group meeting in Puerto Rico that these “high priority” requests should ideally be responded to immediately upon receipt but at least within one hour. The PSWG feels they have compromised extensively by agreeing to 24 hours. Registrar members of the IRT are concerned with the contractual language for a few reasons: (1) it creates a presumption of immediate disclosure (assuming the provider doesn’t have to perform any investigation/verification relating to the request, (2) a potential demand to bypass or ignore due process, and 3) creates an unworkable expectation of privacy/proxy providers around the globe, many of whom who do not operate with 24x7 staffing for this type of issue. Some registrar members have also expressed concern that establishing this 24-hour disclosure requirement is stepping beyond the policy recommendations of the PDP and effectively creating new policy. Accreditation Pricing In Puerto Rico, Staff presented its accreditation pricing model, based on simple cost recovery for ICANN. IRT member asked a number of questions about the detail behind the pricing model, and await that detail from Staff. Based on various meetings in Puerto Rico, some IRT members expressed concern that the pricing model simply mirrors the registrar accreditation model and was not based on any sort of actual cost-recovery plan. And as mentioned on the Council list last month and during our Council meetings in Puerto Rico, there is also concern that some affected departments within ICANN org are not aware of the impact this program may have on its needs for personnel or other support. Data Escrow Specification Significant revisions were needed by Staff to adjust the current registrar data escrow specification to fit into this accreditation program. Staff is expected to deliver that draft to the IRT this week. Last week’s meeting was canceled due to the AdobeConnect issues. This week’s meeting was canceled to allow staff time to get the data escrow specification draft done and circulated to the members. Next meeting should be Tuesday, April 10. Staff has indicated the proposed documents will be ready for publication for public comment in late April or Early May. I understand this issue will be listed for discussion on our April 26, 2018, Council meeting agenda. Thanks, Darcy ---------------- Darcy Southwell | Compliance Officer M: +1 503-453-7305 │ Skype: darcy.enyeart
Thanks very much, Darcy, for keeping this IRT on our collective radars. The EPDP has absorbed so much time and attention, but it's important that we don't lose sight of other ongoing efforts. I'm a bit surprised about the delay in going to public comment, as I know you had anticipated that to happen by now and the process of considering comments received to be underway. Has the group discussed how this is likely to affect the overall timeline? On the disagreements in relation to the Accreditation Agreement, are there solutions on the table for how to move beyond these, or is the group at an unresolvable impasse? Many thanks and best wishes, Heather On Wed, Jun 20, 2018 at 1:52 AM, Darcy Southwell < darcy.southwell@endurance.com> wrote:
All,
I wanted to provide you with an update on the Privacy and Proxy Services Accreditation Implementation Review Team <https://community.icann.org/display/IRT/Privacy+and+Proxy+Services+Accreditation+Implementation> in advance of our Council meeting in Panama City. Overall, the IRT is progressing, albeit quite slowly. There have been quite a few concerns raised about GDPR’s impact on this program, while others have expressed significant concern over the delays in going to public comment. Her are the three key items in progress:
- *Accreditation Agreement**:* Latest version was provided to the IRT on June 13 and is under review by IRT members. The disagreement between IRT members regarding the 24-hour response timeline highlighted for you in April remains.
- *Accreditation Pricing**:* Accreditation pricing details were provided to the IRT on May 22 with updates were provided June 13. IRT members continue to review. Some IRT members have challenged some of ICANN org’s assumptions (e.g., 250 applicants) and have open questions about certain activities (e.g., “data retention waiver”). Based on staff communications, the proposed fee structure will be published for public comment and ICANN org committed to revisiting the proposed fees persuasive reasons to revisit are raised during public comment.
- *Data Escrow Specification**:* Latest version was provided to the IRT on June 15 and is under review by IRT members. ICANN org is still preparing the documentation that will be required to support the allowance for registrar-affiliated privacy/proxy providers to meet their data escrow requirements.
Regarding public comment timing, that currently hinges on the results of ICANN Legal’s review of the documents for GDPR and other matters, which is expected to be done by the end of June. If few issues are identified, these materials could be ready to go out for public comment by the end of July (following IRT review/discussion of Legal’s comments). But if the review identifies more significant issues that must be resolved prior to public comment, publication could be later than that.
Thanks,
Darcy
*From: *Darcy Southwell <darcy.southwell@endurance.com> *Date: *Monday, April 2, 2018 at 12:35 PM *To: *GNSO Council List <council@gnso.icann.org> *Subject: *Status Update: Privacy and Proxy Services Accreditation Implementation Review Team
Dear Councilors,
I wanted to provide you with an update regarding the Privacy and Proxy Services Accreditation Implementation Review Team <https://community.icann.org/display/IRT/Privacy+and+Proxy+Services+Accreditation+Implementation>.
*Accreditation Agreement*
IRT members have been working with Staff for some time on the draft accreditation agreement and have gotten to a place where most of the language is supported by a general consensus. However, there is one key issue that remains unresolved – the PSWG insists the contract require Privacy/Proxy providers to respond to “high priority” requests within 24 hours. In Puerto Rico, a small group of registrars met with key PSWG representatives to try to reach a resolution on this issue, and then the entire IRT working group met again to continue attempts to reach a resolution. The discussion has continued on the email list, but remains unresolved.
It is the PSWG’s position that disclosure of customer information for “high priority” requests must be done within 24 hours because lives are in danger. They were clear in their statements during the small group meeting in Puerto Rico that these “high priority” requests should ideally be responded to immediately upon receipt but at least within one hour. The PSWG feels they have compromised extensively by agreeing to 24 hours.
Registrar members of the IRT are concerned with the contractual language for a few reasons: (1) it creates a presumption of immediate disclosure (assuming the provider doesn’t have to perform any investigation/verification relating to the request, (2) a potential demand to bypass or ignore due process, and 3) creates an unworkable expectation of privacy/proxy providers around the globe, many of whom who do not operate with 24x7 staffing for this type of issue. Some registrar members have also expressed concern that establishing this 24-hour disclosure requirement is stepping beyond the policy recommendations of the PDP and effectively creating new policy.
*Accreditation Pricing*
In Puerto Rico, Staff presented its accreditation pricing model, based on simple cost recovery for ICANN. IRT member asked a number of questions about the detail behind the pricing model, and await that detail from Staff. Based on various meetings in Puerto Rico, some IRT members expressed concern that the pricing model simply mirrors the registrar accreditation model and was not based on any sort of actual cost-recovery plan. And as mentioned on the Council list last month and during our Council meetings in Puerto Rico, there is also concern that some affected departments within ICANN org are not aware of the impact this program may have on its needs for personnel or other support.
*Data Escrow Specification*
Significant revisions were needed by Staff to adjust the current registrar data escrow specification to fit into this accreditation program. Staff is expected to deliver that draft to the IRT this week.
Last week’s meeting was canceled due to the AdobeConnect issues. This week’s meeting was canceled to allow staff time to get the data escrow specification draft done and circulated to the members. Next meeting should be Tuesday, April 10. Staff has indicated the proposed documents will be ready for publication for public comment in late April or Early May.
I understand this issue will be listed for discussion on our April 26, 2018, Council meeting agenda.
Thanks,
Darcy
----------------
*Darcy Southwell *| Compliance Officer
M: +1 503-453-7305 <(503)%20453-7305> │ Skype: darcy.enyeart
[image: signature_1659676836]
_______________________________________________ council mailing list council@gnso.icann.org https://mm.icann.org/mailman/listinfo/council
The IRT has met just a handful of times in recent weeks, and the timeline has been dependent on when ICANN would provide final documents for IRT review/comment, so the timeline has not been discussed. It was just yesterday that ICANN provided the updated timeline for publication that I provided below. The IRT is scheduled to meet next on July 3, and I suspect this topic will be discussed. By then, the IRT should have ICANN Legal’s final comments and know whether its comments are minor or significant. Regarding the disagreement in the 24-hour response time, staff’s plan is to publish the accreditation agreement for public comment indicating the two options and requesting community feedback. I hope that’s helpful. Thanks, Darcy From: Heather Forrest <haforrestesq@gmail.com> Date: Wednesday, June 20, 2018 at 4:31 AM To: Darcy Southwell <darcy.southwell@endurance.com> Cc: GNSO Council List <council@gnso.icann.org> Subject: Re: [council] Status Update: Privacy and Proxy Services Accreditation Implementation Review Team Thanks very much, Darcy, for keeping this IRT on our collective radars. The EPDP has absorbed so much time and attention, but it's important that we don't lose sight of other ongoing efforts. I'm a bit surprised about the delay in going to public comment, as I know you had anticipated that to happen by now and the process of considering comments received to be underway. Has the group discussed how this is likely to affect the overall timeline? On the disagreements in relation to the Accreditation Agreement, are there solutions on the table for how to move beyond these, or is the group at an unresolvable impasse? Many thanks and best wishes, Heather On Wed, Jun 20, 2018 at 1:52 AM, Darcy Southwell <darcy.southwell@endurance.com> wrote: All, I wanted to provide you with an update on the Privacy and Proxy Services Accreditation Implementation Review Team in advance of our Council meeting in Panama City. Overall, the IRT is progressing, albeit quite slowly. There have been quite a few concerns raised about GDPR’s impact on this program, while others have expressed significant concern over the delays in going to public comment. Her are the three key items in progress: Accreditation Agreement: Latest version was provided to the IRT on June 13 and is under review by IRT members. The disagreement between IRT members regarding the 24-hour response timeline highlighted for you in April remains. Accreditation Pricing: Accreditation pricing details were provided to the IRT on May 22 with updates were provided June 13. IRT members continue to review. Some IRT members have challenged some of ICANN org’s assumptions (e.g., 250 applicants) and have open questions about certain activities (e.g., “data retention waiver”). Based on staff communications, the proposed fee structure will be published for public comment and ICANN org committed to revisiting the proposed fees persuasive reasons to revisit are raised during public comment. Data Escrow Specification: Latest version was provided to the IRT on June 15 and is under review by IRT members. ICANN org is still preparing the documentation that will be required to support the allowance for registrar-affiliated privacy/proxy providers to meet their data escrow requirements. Regarding public comment timing, that currently hinges on the results of ICANN Legal’s review of the documents for GDPR and other matters, which is expected to be done by the end of June. If few issues are identified, these materials could be ready to go out for public comment by the end of July (following IRT review/discussion of Legal’s comments). But if the review identifies more significant issues that must be resolved prior to public comment, publication could be later than that. Thanks, Darcy From: Darcy Southwell <darcy.southwell@endurance.com> Date: Monday, April 2, 2018 at 12:35 PM To: GNSO Council List <council@gnso.icann.org> Subject: Status Update: Privacy and Proxy Services Accreditation Implementation Review Team Dear Councilors, I wanted to provide you with an update regarding the Privacy and Proxy Services Accreditation Implementation Review Team. Accreditation Agreement IRT members have been working with Staff for some time on the draft accreditation agreement and have gotten to a place where most of the language is supported by a general consensus. However, there is one key issue that remains unresolved – the PSWG insists the contract require Privacy/Proxy providers to respond to “high priority” requests within 24 hours. In Puerto Rico, a small group of registrars met with key PSWG representatives to try to reach a resolution on this issue, and then the entire IRT working group met again to continue attempts to reach a resolution. The discussion has continued on the email list, but remains unresolved. It is the PSWG’s position that disclosure of customer information for “high priority” requests must be done within 24 hours because lives are in danger. They were clear in their statements during the small group meeting in Puerto Rico that these “high priority” requests should ideally be responded to immediately upon receipt but at least within one hour. The PSWG feels they have compromised extensively by agreeing to 24 hours. Registrar members of the IRT are concerned with the contractual language for a few reasons: (1) it creates a presumption of immediate disclosure (assuming the provider doesn’t have to perform any investigation/verification relating to the request, (2) a potential demand to bypass or ignore due process, and 3) creates an unworkable expectation of privacy/proxy providers around the globe, many of whom who do not operate with 24x7 staffing for this type of issue. Some registrar members have also expressed concern that establishing this 24-hour disclosure requirement is stepping beyond the policy recommendations of the PDP and effectively creating new policy. Accreditation Pricing In Puerto Rico, Staff presented its accreditation pricing model, based on simple cost recovery for ICANN. IRT member asked a number of questions about the detail behind the pricing model, and await that detail from Staff. Based on various meetings in Puerto Rico, some IRT members expressed concern that the pricing model simply mirrors the registrar accreditation model and was not based on any sort of actual cost-recovery plan. And as mentioned on the Council list last month and during our Council meetings in Puerto Rico, there is also concern that some affected departments within ICANN org are not aware of the impact this program may have on its needs for personnel or other support. Data Escrow Specification Significant revisions were needed by Staff to adjust the current registrar data escrow specification to fit into this accreditation program. Staff is expected to deliver that draft to the IRT this week. Last week’s meeting was canceled due to the AdobeConnect issues. This week’s meeting was canceled to allow staff time to get the data escrow specification draft done and circulated to the members. Next meeting should be Tuesday, April 10. Staff has indicated the proposed documents will be ready for publication for public comment in late April or Early May. I understand this issue will be listed for discussion on our April 26, 2018, Council meeting agenda. Thanks, Darcy ---------------- Darcy Southwell | Compliance Officer M: +1 503-453-7305 │ Skype: darcy.enyeart _______________________________________________ council mailing list council@gnso.icann.org https://mm.icann.org/mailman/listinfo/council
Thanks, Darcy- very helpful. Travel well, Heather On 21/06/2018 12:23 AM, "Darcy Southwell" <darcy.southwell@endurance.com> wrote:
The IRT has met just a handful of times in recent weeks, and the timeline has been dependent on when ICANN would provide final documents for IRT review/comment, so the timeline has not been discussed. It was just yesterday that ICANN provided the updated timeline for publication that I provided below. The IRT is scheduled to meet next on July 3, and I suspect this topic will be discussed. By then, the IRT should have ICANN Legal’s final comments and know whether its comments are minor or significant.
Regarding the disagreement in the 24-hour response time, staff’s plan is to publish the accreditation agreement for public comment indicating the two options and requesting community feedback.
I hope that’s helpful.
Thanks,
Darcy
*From: *Heather Forrest <haforrestesq@gmail.com> *Date: *Wednesday, June 20, 2018 at 4:31 AM *To: *Darcy Southwell <darcy.southwell@endurance.com> *Cc: *GNSO Council List <council@gnso.icann.org> *Subject: *Re: [council] Status Update: Privacy and Proxy Services Accreditation Implementation Review Team
Thanks very much, Darcy, for keeping this IRT on our collective radars. The EPDP has absorbed so much time and attention, but it's important that we don't lose sight of other ongoing efforts.
I'm a bit surprised about the delay in going to public comment, as I know you had anticipated that to happen by now and the process of considering comments received to be underway. Has the group discussed how this is likely to affect the overall timeline?
On the disagreements in relation to the Accreditation Agreement, are there solutions on the table for how to move beyond these, or is the group at an unresolvable impasse?
Many thanks and best wishes,
Heather
On Wed, Jun 20, 2018 at 1:52 AM, Darcy Southwell < darcy.southwell@endurance.com> wrote:
All,
I wanted to provide you with an update on the Privacy and Proxy Services Accreditation Implementation Review Team <https://community.icann.org/display/IRT/Privacy+and+Proxy+Services+Accreditation+Implementation> in advance of our Council meeting in Panama City. Overall, the IRT is progressing, albeit quite slowly. There have been quite a few concerns raised about GDPR’s impact on this program, while others have expressed significant concern over the delays in going to public comment. Her are the three key items in progress:
- *Accreditation Agreement**:* Latest version was provided to the IRT on June 13 and is under review by IRT members. The disagreement between IRT members regarding the 24-hour response timeline highlighted for you in April remains.
- *Accreditation Pricing**:* Accreditation pricing details were provided to the IRT on May 22 with updates were provided June 13. IRT members continue to review. Some IRT members have challenged some of ICANN org’s assumptions (e.g., 250 applicants) and have open questions about certain activities (e.g., “data retention waiver”). Based on staff communications, the proposed fee structure will be published for public comment and ICANN org committed to revisiting the proposed fees persuasive reasons to revisit are raised during public comment.
- *Data Escrow Specification**:* Latest version was provided to the IRT on June 15 and is under review by IRT members. ICANN org is still preparing the documentation that will be required to support the allowance for registrar-affiliated privacy/proxy providers to meet their data escrow requirements.
Regarding public comment timing, that currently hinges on the results of ICANN Legal’s review of the documents for GDPR and other matters, which is expected to be done by the end of June. If few issues are identified, these materials could be ready to go out for public comment by the end of July (following IRT review/discussion of Legal’s comments). But if the review identifies more significant issues that must be resolved prior to public comment, publication could be later than that.
Thanks,
Darcy
*From: *Darcy Southwell <darcy.southwell@endurance.com> *Date: *Monday, April 2, 2018 at 12:35 PM *To: *GNSO Council List <council@gnso.icann.org> *Subject: *Status Update: Privacy and Proxy Services Accreditation Implementation Review Team
Dear Councilors,
I wanted to provide you with an update regarding the Privacy and Proxy Services Accreditation Implementation Review Team <https://community.icann.org/display/IRT/Privacy+and+Proxy+Services+Accreditation+Implementation>.
*Accreditation Agreement*
IRT members have been working with Staff for some time on the draft accreditation agreement and have gotten to a place where most of the language is supported by a general consensus. However, there is one key issue that remains unresolved – the PSWG insists the contract require Privacy/Proxy providers to respond to “high priority” requests within 24 hours. In Puerto Rico, a small group of registrars met with key PSWG representatives to try to reach a resolution on this issue, and then the entire IRT working group met again to continue attempts to reach a resolution. The discussion has continued on the email list, but remains unresolved.
It is the PSWG’s position that disclosure of customer information for “high priority” requests must be done within 24 hours because lives are in danger. They were clear in their statements during the small group meeting in Puerto Rico that these “high priority” requests should ideally be responded to immediately upon receipt but at least within one hour. The PSWG feels they have compromised extensively by agreeing to 24 hours.
Registrar members of the IRT are concerned with the contractual language for a few reasons: (1) it creates a presumption of immediate disclosure (assuming the provider doesn’t have to perform any investigation/verification relating to the request, (2) a potential demand to bypass or ignore due process, and 3) creates an unworkable expectation of privacy/proxy providers around the globe, many of whom who do not operate with 24x7 staffing for this type of issue. Some registrar members have also expressed concern that establishing this 24-hour disclosure requirement is stepping beyond the policy recommendations of the PDP and effectively creating new policy.
*Accreditation Pricing*
In Puerto Rico, Staff presented its accreditation pricing model, based on simple cost recovery for ICANN. IRT member asked a number of questions about the detail behind the pricing model, and await that detail from Staff. Based on various meetings in Puerto Rico, some IRT members expressed concern that the pricing model simply mirrors the registrar accreditation model and was not based on any sort of actual cost-recovery plan. And as mentioned on the Council list last month and during our Council meetings in Puerto Rico, there is also concern that some affected departments within ICANN org are not aware of the impact this program may have on its needs for personnel or other support.
*Data Escrow Specification*
Significant revisions were needed by Staff to adjust the current registrar data escrow specification to fit into this accreditation program. Staff is expected to deliver that draft to the IRT this week.
Last week’s meeting was canceled due to the AdobeConnect issues. This week’s meeting was canceled to allow staff time to get the data escrow specification draft done and circulated to the members. Next meeting should be Tuesday, April 10. Staff has indicated the proposed documents will be ready for publication for public comment in late April or Early May.
I understand this issue will be listed for discussion on our April 26, 2018, Council meeting agenda.
Thanks,
Darcy
----------------
*Darcy Southwell *| Compliance Officer
M: +1 503-453-7305 <(503)%20453-7305> │ Skype: darcy.enyeart
[image: signature_1659676836]
_______________________________________________ council mailing list council@gnso.icann.org https://mm.icann.org/mailman/listinfo/council
In advance of the July 19 Council meeting, I wanted to provide a brief update on this IRT. All meetings since the June 20 update have been canceled because ICANN Legal continues to review the documents for GDPR compliance. Here’s the latest: ICANN believes it will likely need to add data processing provisions in the privacy/proxy materials—potentially in a policy document. ICANN intends to begin drafting this for discussion with the IRT using Section 4 of the Temporary Specification as a model for adaptation. ICANN staff requested ideas/ recommendations for this initial drafting exercise from the IRT. A data processing addendum may also be needed for the privacy/proxy accreditation agreement. ICANN is also considering how to address data processing in data escrow agreements, and expects to share an update with the IRT by the July 24 meeting. No timeline for publication for public comment has been provided given the current information. Happy to answer any questions. Best, Darcy From: Darcy Southwell <darcy.southwell@endurance.com> Date: Wednesday, June 20, 2018 at 10:23 AM To: Heather Forrest <haforrestesq@gmail.com> Cc: GNSO Council List <council@gnso.icann.org> Subject: Re: [council] Status Update: Privacy and Proxy Services Accreditation Implementation Review Team The IRT has met just a handful of times in recent weeks, and the timeline has been dependent on when ICANN would provide final documents for IRT review/comment, so the timeline has not been discussed. It was just yesterday that ICANN provided the updated timeline for publication that I provided below. The IRT is scheduled to meet next on July 3, and I suspect this topic will be discussed. By then, the IRT should have ICANN Legal’s final comments and know whether its comments are minor or significant. Regarding the disagreement in the 24-hour response time, staff’s plan is to publish the accreditation agreement for public comment indicating the two options and requesting community feedback. I hope that’s helpful. Thanks, Darcy From: Heather Forrest <haforrestesq@gmail.com> Date: Wednesday, June 20, 2018 at 4:31 AM To: Darcy Southwell <darcy.southwell@endurance.com> Cc: GNSO Council List <council@gnso.icann.org> Subject: Re: [council] Status Update: Privacy and Proxy Services Accreditation Implementation Review Team Thanks very much, Darcy, for keeping this IRT on our collective radars. The EPDP has absorbed so much time and attention, but it's important that we don't lose sight of other ongoing efforts. I'm a bit surprised about the delay in going to public comment, as I know you had anticipated that to happen by now and the process of considering comments received to be underway. Has the group discussed how this is likely to affect the overall timeline? On the disagreements in relation to the Accreditation Agreement, are there solutions on the table for how to move beyond these, or is the group at an unresolvable impasse? Many thanks and best wishes, Heather On Wed, Jun 20, 2018 at 1:52 AM, Darcy Southwell <darcy.southwell@endurance.com> wrote: All, I wanted to provide you with an update on the Privacy and Proxy Services Accreditation Implementation Review Team in advance of our Council meeting in Panama City. Overall, the IRT is progressing, albeit quite slowly. There have been quite a few concerns raised about GDPR’s impact on this program, while others have expressed significant concern over the delays in going to public comment. Her are the three key items in progress: Accreditation Agreement: Latest version was provided to the IRT on June 13 and is under review by IRT members. The disagreement between IRT members regarding the 24-hour response timeline highlighted for you in April remains. Accreditation Pricing: Accreditation pricing details were provided to the IRT on May 22 with updates were provided June 13. IRT members continue to review. Some IRT members have challenged some of ICANN org’s assumptions (e.g., 250 applicants) and have open questions about certain activities (e.g., “data retention waiver”). Based on staff communications, the proposed fee structure will be published for public comment and ICANN org committed to revisiting the proposed fees persuasive reasons to revisit are raised during public comment. Data Escrow Specification: Latest version was provided to the IRT on June 15 and is under review by IRT members. ICANN org is still preparing the documentation that will be required to support the allowance for registrar-affiliated privacy/proxy providers to meet their data escrow requirements. Regarding public comment timing, that currently hinges on the results of ICANN Legal’s review of the documents for GDPR and other matters, which is expected to be done by the end of June. If few issues are identified, these materials could be ready to go out for public comment by the end of July (following IRT review/discussion of Legal’s comments). But if the review identifies more significant issues that must be resolved prior to public comment, publication could be later than that. Thanks, Darcy From: Darcy Southwell <darcy.southwell@endurance.com> Date: Monday, April 2, 2018 at 12:35 PM To: GNSO Council List <council@gnso.icann.org> Subject: Status Update: Privacy and Proxy Services Accreditation Implementation Review Team Dear Councilors, I wanted to provide you with an update regarding the Privacy and Proxy Services Accreditation Implementation Review Team. Accreditation Agreement IRT members have been working with Staff for some time on the draft accreditation agreement and have gotten to a place where most of the language is supported by a general consensus. However, there is one key issue that remains unresolved – the PSWG insists the contract require Privacy/Proxy providers to respond to “high priority” requests within 24 hours. In Puerto Rico, a small group of registrars met with key PSWG representatives to try to reach a resolution on this issue, and then the entire IRT working group met again to continue attempts to reach a resolution. The discussion has continued on the email list, but remains unresolved. It is the PSWG’s position that disclosure of customer information for “high priority” requests must be done within 24 hours because lives are in danger. They were clear in their statements during the small group meeting in Puerto Rico that these “high priority” requests should ideally be responded to immediately upon receipt but at least within one hour. The PSWG feels they have compromised extensively by agreeing to 24 hours. Registrar members of the IRT are concerned with the contractual language for a few reasons: (1) it creates a presumption of immediate disclosure (assuming the provider doesn’t have to perform any investigation/verification relating to the request, (2) a potential demand to bypass or ignore due process, and 3) creates an unworkable expectation of privacy/proxy providers around the globe, many of whom who do not operate with 24x7 staffing for this type of issue. Some registrar members have also expressed concern that establishing this 24-hour disclosure requirement is stepping beyond the policy recommendations of the PDP and effectively creating new policy. Accreditation Pricing In Puerto Rico, Staff presented its accreditation pricing model, based on simple cost recovery for ICANN. IRT member asked a number of questions about the detail behind the pricing model, and await that detail from Staff. Based on various meetings in Puerto Rico, some IRT members expressed concern that the pricing model simply mirrors the registrar accreditation model and was not based on any sort of actual cost-recovery plan. And as mentioned on the Council list last month and during our Council meetings in Puerto Rico, there is also concern that some affected departments within ICANN org are not aware of the impact this program may have on its needs for personnel or other support. Data Escrow Specification Significant revisions were needed by Staff to adjust the current registrar data escrow specification to fit into this accreditation program. Staff is expected to deliver that draft to the IRT this week. Last week’s meeting was canceled due to the AdobeConnect issues. This week’s meeting was canceled to allow staff time to get the data escrow specification draft done and circulated to the members. Next meeting should be Tuesday, April 10. Staff has indicated the proposed documents will be ready for publication for public comment in late April or Early May. I understand this issue will be listed for discussion on our April 26, 2018, Council meeting agenda. Thanks, Darcy ---------------- Darcy Southwell | Compliance Officer M: +1 503-453-7305 │ Skype: darcy.enyeart _______________________________________________ council mailing list council@gnso.icann.org https://mm.icann.org/mailman/listinfo/council
participants (2)
-
Darcy Southwell -
Heather Forrest