I also think it should be restricted to what GDPR requires. Anything beyond that essentially puts ICANN into the business of making privacy policy without a basis in law, which is beyond the remit of the EPDP.

There may be an interesting discussion to be had about whether ICANN should change WHOIS for policy reasons, but the EPDP is not the place for that conversation.

Greg
On Mon, Oct 29, 2018 at 11:12 PM Jonathan Zuck <JZuck@innovatorsnetwork.org> wrote:
I'm inclined to say restricted if for no other reason than we'll eventually have a bunch of GDPRs that are slightly different.

On 10/29/18, 9:36 PM, "GTLD-WG on behalf of Alan Greenberg" <gtld-wg-bounces@atlarge-lists.icann.org on behalf of alan.greenberg@mcgill.ca> wrote:

    GDPR is applicable to residents of the EU by companies resident there
    and worldwide.

    One of the issues is whether contracted parties should be allowed or
    required to distinguish between those who are resident there and elsewhere.

    There is agreement that such distinction should be allowed, but EPDP
    is divided on whether it should be required. The GAC/BC/IPC want to
    see the distinction made, and at least one very large contracted
    party does already make the distinction. Other contracted parties are
    pushing back VERY strongly saying that there is virtually no way that
    the can or are willing to make the distinction.

    The current (confusing) state of the working document is attached.

    Which side should ALAC come down on?

    - Restrict application to those to whom GDPR applies?
    - Apply universally ignoring residence?

    As usual, quick replies requested.

    Alan

_______________________________________________
CPWG mailing list
CPWG@icann.org
https://mm.icann.org/mailman/listinfo/cpwg
_______________________________________________
GTLD-WG mailing list
GTLD-WG@atlarge-lists.icann.org
https://atlarge-lists.icann.org/mailman/listinfo/gtld-wg

Working Group direct URL: https://community.icann.org/display/atlarge/New+GTLDs