Hadia had posted a proposal that we comment on EPDP Purpose 2 (the one that the Board did not ratify due to comments from the European Data Protection Board. Her comment was similar to one I made in a proposal to the ALAC EPDP Members and Alternates and later discussed during a CPWG call. I have now posted a new comment to be discussed tomorrow (all viewable at https://community.icann.org/x/J4ejBg). Alan ================= Although I agree with Hadia's general proposal, there was significant disagreement when it was discussed among the EPDP Members and Alternates and on the CPWG call, so I do not feel comfortable introducing it at this point, particularly since it was not a specific request in the call for community input. The proposal made to the Members and Alternates that was strongly supported was the following: The ALAC is not in a position to provide detailed guidance on the specific issues to be addressed during phase 2. The ALAC and its representatives on the EPDP of course reserve the right to comment as the work progresses. There are two areas where the ALAC has specific comments: 1. Redacted Data elements: To keep the work of the EPDP at a reasonable level, the ALAC suggests that instead of dealing with redacted data on an element-by-element basis for each class of request any category of requester, that the data elements be grouped together based on similar characteristics and impact. Specifically, the ALAC suggests that the EPDP group fields together in 4 categories: a) Registrant Name and Organization (if redacted) b) Registrant contact fields c) Tech name and contact fields d) Other redacted fields (Registry Domain ID, Registry Registrant ID 2. For OCTO, subject to requirement to keep data confidential, OCTO should have access to any data it requests for research of threat analysis. If ICANN were a typical data controller, it would automatically have such data without any further consideration.