Hi Alan For some reason, I wasn’t able to comment on the wiki. So this is what I would have said: My one word of caution is back to first principles. WE are so focussed on the GDPR that we forget that other jurisdictions also have privacy legislation that could well oblige the registrar/reseller to not publish personal information/some personal information of the registrant. So I”d rather stay with a position that allows all registrars/resellers - in whatever jurisdiction globally - to respect their national privacy legislation - as is currently allowed under the RAA - the ability to comply with national laws. So that comes close to the view originally agreed upon as you penned it: ‘those who felt that a contracted party could decide whether to do it or not’. Perhaps reword, but accept that contracted parties may well be subject to their own privacy laws in jurisdictions outside of the EU. Holly
On Dec 10, 2018, at 8:44 AM, Cheryl Langdon-Orr <langdonorr@gmail.com> wrote:
Thanks for this Alan, and I am specifically pleased to see the clarification on 'subjectability' to GDPR of so many of the Contracted Parties now clarified by the EU Data Protection Board.
Cheryl Langdon-Orr ... (CLO)
about.me/cheryl.LangdonOrr
<http://about.me/cheryl.LangdonOrr>
On Mon, 10 Dec 2018 at 07:24, Alan Greenberg <alan.greenberg@mcgill.ca <mailto:alan.greenberg@mcgill.ca>> wrote: The first draft of the EPDP Response is now uploaded. It is essentially the same as that presented on the CPWG call on 28 Nov 2018.
One point on which there was significant discussion on the call was whether we should support geographic differentiation - that is, only apply redaction if the geographic location of the registrar/registry and the registrant warrant it or allow contracted parties ot redact for all registrations. When this was previously discussed, there was quite a divide between those who felt we should differentiate, and those who felt that a contracted party could decide whether to do it or not (ie a registrar, for instance) could decide to treat all registrants as if they were in the EU, and similarly a registrar outside of the EU (with no connection there) could also redact all data.
One of the things that has changed is that the European Data Protection Board has recently issued a document making it clear that an organization with NO presence or processing in the EU, offering services through the web, could have EU-based customers and not be subject to the GDPR - IF they do not explicitly target EU customers. Simple availability of a website in the EU does not constitute targeting. That take a large number of contracted parties who many of us had thought would be subject to the GDPR out of the game. See Guidelines 3/2018 on the territorial scope of the GDPR <https://community.icann.org/download/attachments/99484375/edpb_guidelines_3_...>.
On the CPWG when the question as ask about supporting geographic differentiation (oe Registrars/Registries should only redact when GDPR requires it, the overwhelming number agree (via check marks or voiced comments). This position is reflected in answers 86 and 89.
Please add your comments on any of the replies to the wiki - https://community.icann.org/x/1wLuBQ <https://community.icann.org/x/1wLuBQ>.
Alan _______________________________________________ CPWG mailing list CPWG@icann.org <mailto:CPWG@icann.org> https://mm.icann.org/mailman/listinfo/cpwg <https://mm.icann.org/mailman/listinfo/cpwg> _______________________________________________ registration-issues-wg mailing list registration-issues-wg@atlarge-lists.icann.org <mailto:registration-issues-wg@atlarge-lists.icann.org> https://mm.icann.org/mailman/listinfo/registration-issues-wg <https://mm.icann.org/mailman/listinfo/registration-issues-wg> _______________________________________________ CPWG mailing list CPWG@icann.org https://mm.icann.org/mailman/listinfo/cpwg _______________________________________________ registration-issues-wg mailing list registration-issues-wg@atlarge-lists.icann.org https://mm.icann.org/mailman/listinfo/registration-issues-wg