- Gdd-gnso-ppsai-impl - lists.icann.org

Further comments on PPAA WAS RE: Materials, action items from 17 Oct Privacy/Proxy IRT call
by Metalitz, Steven Dec. 1, 2017

Dec. 1, 2017

Here are a few additional suggestions on the PPAA. As before I am focusing primarily on flagging issues not already identified in the various submissions from registrar participants in the IRT; I am sure we will have a chance to go through those as part of the process. Again I might possibly have a few more before the end of the day. Spec 2 (Customer Data Accuracy): in paragraph 6, after “clientTransferProhibited,” insert “by Registrar.” I think this would also address the point Theo raises in his sticky note. Spec 3 (RDDS labeling): Some of section 1 may have been carried over a bit too glibly from the corresponding RAA provision. Many of the elements added in the staff’s redline (after Domain Name) are the “thin Whois” data elements related to the underlying registration, not to provision of the Services. Would an unaffiliated Provider necessarily know all this information (other than by getting it from the registrar or registry Whois)? Additionally, shouldn’t the next group of data elements refer to Customer Name, Customer Organization, etc. rather than Registrant Name, etc.? For a proxy service, all (and for a privacy service, almost all ) of this data pertaining to the Registrant is the Provider’s contact data. What we want here is the obligation of Provider to collect a full set of Customer data so that (among other things) this data can be conveniently loaded into Whois if the p/p Services are terminated (i.e., if Publication occurs), or can be communicated to a requester under appropriate circumstances. Spec 5 (LE Authority Disclosure): for most of this we need the input from PSWG, but pending that I’d suggest that the word “applicable” be inserted before “national” in 4.2.2.2. Spec 6 (IP Disclosure Framework): I’ll respond separately to the registrar comments on this but note that there are a few places where we reference rights holders that are not individuals with respect to where they are incorporated. Such entities might take a legal form other than a corporation (e.g., partnership) so in each place we should say “incorporated or organized.” This has already been done in 2.3.3. This issue occurs in 2.1.6.3, 2.2.7.4, 2.3.6.3, and there may be other places. Also, 3.3.1 might better read: “Provider has already caused Customer contact details to be Published in RDDS as the result of termination of the Services;”. The Provider is not actually the one who publishes Whois data, that is the Registrar (and Registry). I believe RDDS is the more future-proof term than Whois and this is reflected in the definition of Publication in 1.23. [image001] Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | met(a)msk.com<mailto:met@msk.com> Mitchell Silberberg & Knupp LLP | www.msk.com<http://www.msk.com/> 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: Metalitz, Steven Sent: Thursday, November 30, 2017 5:16 PM To: 'Sara Bockey'; 'Darcy Southwell'; 'gdd-gnso-ppsai-impl(a)icann.org' Subject: RE: [Gdd-gnso-ppsai-impl] Materials, action items from 17 Oct Privacy/Proxy IRT call PPSAI colleagues, I offer the following comments and suggested edits regarding the Oct. 20 redline version of the PPAA. I may have a few other suggestions by tomorrow’s deadline, and will definitely have responses later to some of the other proposed edits that have been sent to the list. (And thanks to Theo and colleagues for their comprehensive review of the document!) First, I would reiterate the suggestions made in my Oct. 21 posting to the list, as follows: Subsection 3.5.3.15: strike “should” and insert “shall,” for consistency with parallel provisions throughout this section 3.5. Section 3.7, third line from the bottom: “employee” should be “employ.” Section 3.17.1: I suggest adding the words “as applicable” or “to the extent applicable” at the end of the section. Not every Disclosure or Publication request that Provider receives will fall under the IP or LEA disclosure frameworks. Section 5.7.3: the notice that the suspended Provider must send to customers should specify “that it is unable to offer or provide the Services for any new registrations” (adding the last 4 words). A suspended Provider can (and indeed must) provide the Services to its current customers. [Note that the phrasing “any additional registrations” might be more accurate here, and in the corresponding provision of 5.7.1 --- otherwise it might be possible for a suspended provider to being providing services for the first time to an existing registration whose registrant decides to engage a service.] Here are some additional suggestions: Section 1.43: strike “comprising the Working Group,” insert “representatives of the Service Providers.” This issue is noted on page 2 of the Discussion Items document. Section 3.5.3.3: since this has to do with p/p services and not with registration per se, the references to “initial registration and each renewal registration” should be changed to something like “each initial agreement to provide Services and each renewal or extension of such agreement.” I believe this is also responsive to Theo’s sticky note on the RrSG redline for this section. Section 3.8.1 (specifying what needs to be stated on request forms) should include a cross-reference to section 3.8.2 (requiring publication of links to request forms in some circumstances). Alternatively, perhaps the order of these two sections should be reversed. Section 3.8.5.5 needs some rephrasing. Reveal is not a defined term in the PPAA, and the provider does not itself Publish data in the RDS (the registrar or registry does that), but can cause it to be Published. This may a rare instance in which use of the passive voice may be preferable (“the circumstances under which the Customer’s identity or contact data will be published in the RDDS….”). Section 3.19: substitute “shall” for “should.” In fact the entire document should be reviewed to see where this change is needed. Section 5.3: this is another issue I raised in my Oct. 21 posting: “Section 5.3 does not give ICANN the right to substitute the new version of the agreement, it gives that right to the provider. Furthermore, 5.3 addresses the scenario in which the new agreement is swapped in during the term of the current agreement. The point I was trying to raise on the call (and I am sorry if this was not clear) is ensuring that all renewals of the agreement at the end of the term reflect the most recent version. As currently drafted, section 5.2 seems to give the provider the option of renewing under the terms of the old agreement (“under the terms and conditions of this agreement”), even if it has been superseded by a new form of agreement that is materially different. This could be fixed by adding a subsection 5.2.5 along the following lines: ‘5.2.5: this Agreement has been superseded by a revised form accreditation agreement for the provision of the Services (“Updated PPAA”) that is materially different from this Agreement, in which case the right of renewal provided by this section shall be under the terms and conditions of the Updated PPAA.’” Section 5.7.4: consider inserting at the end of the first sentence “or its invocation of section 5.5.7,” which is another path ICANN could take to deal with the situation of an uncured “endangerment” scenario. Section 7.4.1: shouldn’t the Working Group be the party to receive the notice re revision of the Agreement? This would be consistent with the rest of section 7.4. Glad to try to answer any questions about these. Steve Metalitz [image001] Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | met(a)msk.com<mailto:met@msk.com> Mitchell Silberberg & Knupp LLP | www.msk.com<http://www.msk.com/> 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: Metalitz, Steven Sent: Tuesday, November 07, 2017 11:42 AM To: 'Sara Bockey'; Darcy Southwell; gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org> Subject: RE: [Gdd-gnso-ppsai-impl] Materials, action items from 17 Oct Privacy/Proxy IRT call I agree with a lot of what Darcy says. Let me make sure my view is clearly stated. Most of the items Darcy identifies are completely appropriate for discussion in our team before the documents are finalized. These issues include: perceived discrepancies between the WG Final Report and the implementation documents; loose ends in the Law Enforcement disclosure framework; and clarifying the status of each of the four documents under review. I support addressing these points on our next call so that we can continue to make progress. And based on the postings made to our list over the last couple of weeks, I would certainly be comfortable with some relaxation of the deadline for proposing edits to the accreditation agreement – if necessary, to December 1. My concerns are focused primarily on the suggestion that we can’t move forward until we determine whether our recommendations are GDPR-compliant. To me that sounds like some on the IRT want to suspend work until ICANN’s separate work on GDPR is concluded. If that is not what is meant, then I would ask proponents of that view to clarify just how they think we should proceed at this point. I am also sad to see the IRTP-C issue brought up again. I thought we had reached agreement that the current suspension of ICANN enforcement of this aspect of that policy could be continued until an appropriate group is formed to address it; or put another way, that we could proceed to get our PPSAI implementation plan out for public comment without delaying it until the IRTP-C issue is resolved. That is my recollection, anyway, but if I am mistaken then please show me how. Finally I will repeat my question of whether our call time on 11/14 remains at 1400 UTC or whether it will be moved an hour later to preserve the usual start time in most Northern Hemisphere time zones. Steve [image001] Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | met(a)msk.com<mailto:met@msk.com> Mitchell Silberberg & Knupp LLP | www.msk.com<http://www.msk.com/> 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: Sara Bockey [mailto:sbockey@godaddy.com] Sent: Tuesday, November 07, 2017 11:07 AM To: Darcy Southwell; gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>; Metalitz, Steven Cc: Sara Bockey Subject: Re: [Gdd-gnso-ppsai-impl] Materials, action items from 17 Oct Privacy/Proxy IRT call Well said, Darcy. Agree 100%. sara bockey sr. policy manager | GoDaddy™ sbockey(a)godaddy.com<mailto:sbockey@godaddy.com> 480-366-3616 skype: sbockey This email message and any attachments hereto is intended for use only by the addressee(s) named herein and may contain confidential information. If you have received this email in error, please immediately notify the sender and permanently delete the original and any copy of this message and its attachments. From: Darcy Southwell <darcy.southwell(a)endurance.com<mailto:darcy.southwell@endurance.com>> Date: Tuesday, November 7, 2017 at 8:47 AM To: "gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>" <gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>>, "Metalitz, Steven" <met(a)msk.com<mailto:met@msk.com>>, Sara Bockey <sbockey(a)godaddy.com<mailto:sbockey@godaddy.com>> Subject: Re: [Gdd-gnso-ppsai-impl] Materials, action items from 17 Oct Privacy/Proxy IRT call I agree with Theo. The scope has changed and implementation is impacted by GDPR. While I appreciate that Steve wants to move forward expeditiously, I don’t believe we can do so without jeopardizing the creation of an effective program. Further, in just the last week or so, issues have been raised about implementation language contradicting the policy. The role of an IRT is to implement the consensus policy produced in the PDP and we need to spend sufficient time reviewing and discussing the implementation to ensure we’re not changing policy. Similarly, I think there were questions raised about the proposed framework Public Safety Working Group. In addition to policy creep, I believe concerns were expressed that staff failed to modify the proposed framework based on the feedback from IRT participants. Rather than picking through the documents line by line, it seems like we should step back and have a discussion about the concepts to ensure we’re making progress toward an effective implementation that reflects the policy. There have also been repeated questions raised about the over-engineering of this implementation. Because many of the meetings have focused on reviewing language from a specific section (rather than reviewing issues as whole items), it seems like we haven’t gotten past this issue, and should probably take a fresh look at that to ensure we’re not making this implementation more complicated than it needs to be. We all know that doesn’t lead us to a better implementation. Right now, we have four draft documents for review/input: (1) accreditation agreement, (2) de-accreditation process, (3) applicant guide, and (4) data escrow specification. For many members, these require operational and legal review (at a minimum). Many registrars have commented that 1 December is the earliest they can provide full feedback given the complexity of these documents (although not all have committed to that date). Given these issues, as well as the fact that the privacy/proxy challenge stemming from IRTP-C needs to be added to this IRT for a solution, we need to take a step back and address these critical issues first. This isn’t about derailing the IRT; it’s about ensuring we don’t create an implementation that’s an operational nightmare for providers as well as registrants and end users – and that means addressing these critical issues first. Thanks, Darcy From: <gdd-gnso-ppsai-impl-bounces(a)icann.org<mailto:gdd-gnso-ppsai-impl-bounces@icann.org>> on behalf of theo geurts <gtheo(a)xs4all.nl<mailto:gtheo@xs4all.nl>> Reply-To: <gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> Date: Monday, November 6, 2017 at 12:27 PM To: <gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>>, "Metalitz, Steven" <met(a)msk.com<mailto:met@msk.com>>, Sara Bockey <sbockey(a)godaddy.com<mailto:sbockey@godaddy.com>> Subject: Re: [Gdd-gnso-ppsai-impl] Materials, action items from 17 Oct Privacy/Proxy IRT call Hi Steve, Vicky, Now your argument is logical and makes sense. Yes, as I mentioned before, CPH's will implement privacy services on many different levels to comply with the GDPR, we agree here. My biggest problem with the PPSAI IRT is the changing dynamics. The WG contemplated and discussed and made recommendations based on a very fixed situation. In my opinion, privacy services should not be used as bandaid for data protection problems. Complying with data protection laws was not the driving force during the WG days, and now it is. I think the scope of the IRT has changed and we should deal with this before we move on. We need to think a little smarter and deeper here before we unleash this to many contracted parties who have zero experience with these services and will be required to implement this to comply with data protection laws. So how do we do that? I think a fixed set of procedures and contractual agreements are essential, yet I do not want us to enter into a situation that causes more issues and forces providers into a situation that we need to ask compliance to defer. https://www.icann.org/resources/pages/contractual-compliance-statement-2017…<https://www.icann.org/resources/pages/contractual-compliance-statement-2017…> I think that scenario is unwanted for everyone on the IRT is it not? Thanks, Theo Geurts On 6-11-2017 19:40, Metalitz, Steven wrote: I strongly second Vicky’s comments. The ongoing ICANN work re GDPR is of course very important, but let’s not let it derail progress on the path we have moved so far along toward a P/P service accreditation framework to present to the community. In that regard, I have some sympathy (empathy?) for those requesting a relaxation of the comment deadline in light of so much other activity demanding our attention. May I suggest that we try to get as many proposed edits onto the list before our November 14 call (with much thanks to those who have already done so), with the goal of dealing with them then if possible, but leaving the door open for further edits over the next couple of weeks if necessary. Finally, some ICANN groups are adjusting the scheduling of their calls to reflect the return to standard time in North America and Europe. Is this group doing so as well? If our calls stay at 1400 UTC that is now 9 am EST and 6 am for those on Pacific time. Moving to 1500 UTC would retain the pre-existing local start times, I believe. Steve Metalitz [age001] Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | met(a)msk.com<mailto:met@msk.com> Mitchell Silberberg & Knupp LLP | www.msk.com<http://www.msk.com/> 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: gdd-gnso-ppsai-impl-bounces(a)icann.org<mailto:gdd-gnso-ppsai-impl-bounces@icann.org> [mailto:gdd-gnso-ppsai-impl-bounces@icann.org] On Behalf Of Victoria Sheckler Sent: Tuesday, October 31, 2017 5:55 PM To: gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>; Sara Bockey Subject: Re: [Gdd-gnso-ppsai-impl] Materials, action items from 17 Oct Privacy/Proxy IRT call Please note that ICANN’s work on GDPR’s on a separate track and that one thing we know almost for sure is that the adoption of rational, predictable rules for privacy/proxy will be more important post-GDPR than it ever was. So please let’s get those rules in place as expeditiously as possible. On 30-10-2017 11:32, Sara Bockey wrote: Caitlin, Thanks for the revised docs. A few items at first glance that need to be revised, as I believe they have been discussion/raised before. I will take a closer look and follow up with additional edits, but in the meantime… 1. Edit the definitions of Proxy Service and Privacy Service to match the definitions provided in the Final Report/2013 RAA * The definitions of Privacy Service and Proxy Service reflect those in the 2013 RAA. * In this context, the 2013 RAA also defines “Registered Name” as a domain name within the domain of a gTLD, about which a gTLD Registry Operator (or an Affiliate or subcontractor thereof engaged in providing Registry Services) maintains data in a Registry Database, arranges for such maintenance, or derives revenue from such maintenance, and “Registered Name Holder” is defined as the holder of a Registered Name. * It’s noted that ICANN staff has replace “Registered Name Holder” with “Customer” in many instances, but I question the logic in that since it is inconsistent with the RAA. 1. Edit Sections 3.5.3.3. thru 3.5.3.6 to take into consideration GDPR requirements regarding consent. * Consent must be explicitly given for each purpose and can be withdrawn at any time and not a requirement for registration or use of the service. Therefore, 3.5.3.3. – 3.5.3.6 (at a minimum) are not compatible and must be revise. 1. Edit section 3.12.2, as it still contains new language that has been added since the IRT agreement on language in August. The first sentence in its entirety should be removed. * The section should start with “Well founded…” Additionally, the following sections need revision or at a minimum further discuss by the IRT 1. Edit Section 3.14 to remove the language re no automation. This is not feasible. This language must be removed: * Provider shall not use high-volume, automated electronic processes (for example, processes that do not utilize human review) for sending Requests or responses to Requests to Requesters or Customers in performing any of the steps in the processes outlined in the Intellectual Property Disclosure Framework Specification. 1. Edit Section 3.15 – Labeling – to remove excessive language. * Provider shall ensure that each Registered Name for which Provider is providing the Services is clearly labeled as such in the Registration Data Directory Service, as specified in the Labeling Specification attached hereto, and shall otherwise comply with the requirements of the Labeling Specification attached hereto. This language is duplicative and not necessary. Let’s not add unnecessary words to this already long document. If there are doing to be extra works, perhaps mention complying with applicable local laws in light of GDPR. sara bockey sr. policy manager | GoDaddy™ sbockey(a)godaddy.com<mailto:sbockey@godaddy.com> 480-366-3616 skype: sbockey This email message and any attachments hereto is intended for use only by the addressee(s) named herein and may contain confidential information. If you have received this email in error, please immediately notify the sender and permanently delete the original and any copy of this message and its attachments. From: <gdd-gnso-ppsai-impl-bounces(a)icann.org><mailto:gdd-gnso-ppsai-impl-bounces@icann.org> on behalf of Caitlin Tubergen <caitlin.tubergen(a)icann.org><mailto:caitlin.tubergen@icann.org> Reply-To: "gdd-gnso-ppsai-impl(a)icann.org"<mailto:gdd-gnso-ppsai-impl@icann.org> <gdd-gnso-ppsai-impl(a)icann.org><mailto:gdd-gnso-ppsai-impl@icann.org> Date: Wednesday, October 25, 2017 at 4:44 AM To: "gdd-gnso-ppsai-impl(a)icann.org"<mailto:gdd-gnso-ppsai-impl@icann.org> <gdd-gnso-ppsai-impl(a)icann.org><mailto:gdd-gnso-ppsai-impl@icann.org> Subject: [Gdd-gnso-ppsai-impl] Materials, action items from 17 Oct Privacy/Proxy IRT call Dear Colleagues, Thanks so much for your participation on today’s Privacy/Proxy IRT call. For those who could not attend, I encourage you to review the recording and materials on the wiki, https://community.icann.org/display/IRT/24+October+2017<https://community.icann.org/display/IRT/24+October+2017>. During the call, we discussed an overview of the changes to the draft PPAA. Please note that ICANN proposed a deadline of Tuesday, 14 November for all comments, concerns, and edits to the draft PPAA. The changes from the last iteration, provided to the IRT in July, have been highlighted in the attached issues list. Please respond to the list if you would like to request a longer review period. During ICANN60, we will be presenting an overview of the P/P program’s status to the community. Attached, please find the slide deck for the presentation. To highlight a few notes from the IRT’s discussion this morning, we received feedback to: 1. Edit the definition of Working Group in Section 1.43, to specify that the Provider Stakeholder Group, if formed, shall only appoint the provider representatives of the Working Group, and the GNSO may appoint other members of the community. 1. Add back in the previously-deleted Code of Conduct language in Section 3.5.1. 1. Add back in the previously-deleted review provision in Section 7 of the Customer Data Accuracy Program Specification. If you believe the above items do not reflect the intent of the Working Group’s recommendations, please reply to the list by 14 November 2017. Thank you, and safe travels to those of you attending ICANN 60! Kind regards, Caitlin Tubergen Registrar Services and Engagement Senior Manager ICANN 12025 Waterfront Drive, Suite 300 Los Angeles, CA 90094 Office: +1 310 578 8666 Mobile: +1 310 699 5326 Email: caitlin.tubergen(a)icann.org<mailto:caitlin.tubergen@icann.org> _______________________________________________ Gdd-gnso-ppsai-impl mailing list Gdd-gnso-ppsai-impl(a)icann.org<mailto:Gdd-gnso-ppsai-impl@icann.org> https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl<https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl> _______________________________________________ Gdd-gnso-ppsai-impl mailing list Gdd-gnso-ppsai-impl(a)icann.org<mailto:Gdd-gnso-ppsai-impl@icann.org> https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl<https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl> _______________________________________________ Gdd-gnso-ppsai-impl mailing list Gdd-gnso-ppsai-impl(a)icann.org<mailto:Gdd-gnso-ppsai-impl@icann.org> https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl<https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl> _______________________________________________ Gdd-gnso-ppsai-impl mailing list Gdd-gnso-ppsai-impl(a)icann.org<mailto:Gdd-gnso-ppsai-impl@icann.org> https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl<https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl>

1 0

RrSG comments on the current drafts.
by Theo Geurts Dec. 1, 2017

Dec. 1, 2017

Dear IRT members. Attached the comments from several RrSG members. Thank you for the comments and support and the valuable discussions: Key-Systems, Volker Greimann Netearth One, Chris Pelling Nordreg, Benny Samuelsen One.com, Rieke Poppe 1und1, Thomas Keller Astutium, Rob Golding Godaddy, Sara Bockey, thank you for assisting me with the reviews. DNS Africa, Vlad Dinculescu Best regards, Theo Geurts

2 1

Materials, action items from 14 Nov IRT Call
by Caitlin Tubergen Nov. 16, 2017

Nov. 16, 2017

Dear Colleagues, Thanks so much for your participation on Tuesday’s Privacy/Proxy IRT call. For those who could not attend, I encourage you to review the recording and materials on the wiki, https://community.icann.org/display/IRT/14+November+2017. On the call, the group agreed to a deadline for Friday, 1 December for all IRT members to provide feedback on the most recent draft PPAA (from 20 October). Accordingly, please use this time to review the draft and provide feedback via the list. The next IRT meeting will be Tuesday, 5 December at 1500UTC. Please let me know if you have any questions. Thank you! Kind regards, Caitlin Tubergen Registrar Services and Engagement Senior Manager ICANN 12025 Waterfront Drive, Suite 300 Los Angeles, CA 90094 Office: +1 310 578 8666 Mobile: +1 310 699 5326 Email: caitlin.tubergen(a)icann.org

1 0

Re: [Gdd-gnso-ppsai-impl] [Ntfy-gdd-gnso-ppsai-impl] Privacy and Proxy Services Accreditation Program IRT Meeting
by theo geurts Nov. 14, 2017

Nov. 14, 2017

I won't be able to attend. Thanks, Theo Geurts On 14-11-2017 00:09, ICANN Policy Calendar wrote: > > ICANN Policy Calendar has invited you to Privacy and Proxy Services > Accreditation Program IRT Meeting > > Title: > > > > Privacy and Proxy Services Accreditation Program IRT Meeting > > Location: > > > > 15:00 UTC > > When: > > > > Tue 14 Nov 2017 16:00 – 17:30 > > > > > Organizer: > > > > ICANN Policy Calendar <PolicyCalendar(a)icann.org> > > Description: > > > > ****Due to Daylight Savings time change, we are changing the start > time to 15:00 UTC**** Dear Colleagues, Please find below the remote > participation details for the Privacy and Proxy Services Accreditation > Program IRT Meetings which will now be held WEEKLY on Tuesdays, > starting on 29 November 2016 at 15:00 UTC for 1 hour 30 minutes. Adobe > Connect link: https://participate.icann.org/ppirt Participant code: > 4824695647 Dial-In Phone Numbers: US: +1-719-457-6209 Canada, Calgary: > +1 403 407 5793 Canada, Montreal: +1 514 669 5928 Canada, Toronto: +1 > 647 426 9172 Canada, Vancouver: +1 604 222 7836 Argentina (toll free): > 0800 800 1223 Argentina, Buenos Aires: +54 (0) 11 5172 6003 Australia > (toll free): 1 800 804 786 Australia, Brisbane: +61 (0) 7 3015 0535 > Australia, Melbourne: +61 (0) 3 8687 0553 Australia, Sydney: +61 (0) 2 > 8017 6064 Austria (toll free): 0800 8866 3413 Austria, Vienna: +43 (0) > 1 25302 1785 Bahrain (toll free): 800 04212 Bahrain, Manama: +973 1619 > 8739 Belarus (toll free): 8 820 0011 0341 Belgium (toll free): 0800 > 39279 Belgium, Brussels: +32 (0) 2 400 6928 Brazil (toll free): 0800 > 887 0233 Brazil, Rio de Janeiro: +55 21 4560 0072 Brazil, Sao Paulo: > +55 11 4935 7169 Bulgaria (toll free): 00800 111 4950 Bulgaria, Sofia: > +359 (0) 2 491 6045 Canada (toll free): 1 855 950 3717 Chile (toll > free): 171 800 835 783 Chile, Santiago: +56 (0) 2 2666 0696 China > (national): +400 613 8103 China, Beijing: +86 10 5667 0003 China, > Shanghai: +86 21 2039 7081 Colombia (toll free): 01 800 755 0102 > Colombia, Bogota: +57 1 508 8137 Croatia (toll free): 0800 805 940 > Cyprus (toll free): 800 97424 Czech Republic (toll free): 800 701 532 > Czech Republic, Prague: +420 225 986 554 Denmark (toll free): 80 70 35 > 86 Denmark, Copenhagen: +45 32 72 78 10 Egypt (toll free): 0800 000 > 0593 Estonia (toll free): 800 011 1589 Estonia, Tallinn: +372 622 6551 > Fiji (toll free): 00800 3322 Finland (toll free): 0800 772 236 > Finland, Helsinki: +358 (0) 9 2310 1677 France (national): 0811 655 > 100 France (toll free): 0800 946 531 France, Paris: +33 (0) 1 70 37 16 > 56 Germany (national): 01801 003 899 Germany (toll free): 0800 588 > 9170 Germany, Frankfurt: +49 (0) 69 2222 10612 Germany, Munich: +49 > (0) 89 2030 31207 Greece (toll free): 00800 128 913 Greece, Athens: > +30 211 181 3824 Hong Kong: +852 3018 9111 Hong Kong (toll free): 800 > 901 787 Hungary (toll free): 068 001 9673 Hungary, Budapest: +36 1408 > 8953 Iceland (toll free): 800 9847 India, Bangalore: +91 (0) 80 6127 > 6710 India, Chennai: +91 (0)44 6688 6061 India, Delhi: +91 (0) 11 6641 > 1394 India, Mumbai: +91 (0)22 6187 5028 Indonesia (toll free): 007 803 > 321 8927 Ireland (national): 1890 907 630 Ireland (toll free): 1800 > 937 649 Ireland, Dublin: +353 (0) 1 526 9421 Israel (toll free): 1809 > 213 168 Israel, Tel Aviv: +972 (0)3 721 7943 Italy (toll free): 800 > 146 094 Italy, Milan: +39 02 3600 8006 Italy, Rome: +39 06 8750 0676 > Japan (mobile): 0120 632 611 Japan (toll free): 0120 305 211 Japan, > Osaka: +81 (0) 6 4560 2410 Japan, Tokyo: +81 (0) 3 4560 1270 > Kazakhstan (toll free): 8800 333 7554 Latvia (toll free): 8000 4418 > Latvia, Riga: +371 6601 3627 Lithuania (toll free): 8800 31449 > Lithuania, Vilnius: +370 5205 5468 Luxembourg: +352 2088 1749 > Luxembourg (toll free): 800 28433 Malaysia (toll free): 1 800 816 152 > Malaysia,Kuala Lumpur: +60 (0) 3 7724 8010 Mexico (toll free): 01 800 > 733 4102 Mexico, Guadalajara: +52 33 4162 4504 Mexico, Mexico City: > +52 55 8421 0326 Mexico, Monterrey: +52 81 4162 5648 Morocco (toll > free): 0800 091 296 Morocco, Casablanca: +212 (0) 520 48 0022 > Netherlands (toll free): 0800 020 2597 Netherlands, Amsterdam: +31 (0) > 20 716 8345 New Zealand (toll free): 0800 452 947 New Zealand, > Auckland: +64 (0) 9 929 1825 New Zealand, Christchurch: +64 (0) 3 974 > 2596 New Zealand, Wellington: +64 (0) 4 909 4674 Nigeria, Lagos: +234 > 1 277 3944 Norway (toll free): 800 56081 Norway, Oslo: +47 21 00 48 15 > Panama (toll free): 00800 223 1390 Panama, Panama City: +507 8 335 913 > Peru, Lima: +51 (0) 1 700 9571 Philippines (toll free): 1 800 111 013 > 99 Philippines, Manila: +63 (0)2 395 3426 Poland (toll free): 00 800 > 121 4356 Poland, Warsaw: +48 22 295 3570 Portugal (toll free): 800 784 > 442 Portugal, Lisbon: +351 21 316 4093 Qatar (toll free): 00 800 100 > 491 Romania (toll free): 0800 801 035 Romania, Bucharest: +40 (0) 21 > 529 3992 Russia (toll free): 8 800 500 9241 Russia, Moscow: +7 495 646 > 9181 Saudi Arabia (toll free): 800 844 6641 Saudi Arabia (toll free): > 800 850 0219 Singapore: +65 6622 1957 Singapore (toll free): 800 616 > 3192 Slovakia (toll free): 0800 002 002 Slovakia, Bratislava: +421 > (0)2 3321 5498 Slovenia (toll free): 0800 81193 Slovenia, Ljubljana: > +386 1600 8695 South Africa (toll free): 0800 999 434 South Africa, > Johannesburg: +27 (0)11 589 8321 South Korea (toll free): 00798 6136 > 1454 South Korea, Seoul: +82 (0) 2 6007 0079 Spain (toll free): 900 > 828 035 Spain, Barcelona: +34 93 800 1946 Spain, Madrid: +34 91 114 > 6653 Sweden (toll free): 0200 125 588 Sweden, Stockholm: +46 (0) 8 > 5065 3956 Switzerland (toll free): 0800 740 360 Switzerland, Geneva: > +41 (0) 22 595 4795 Switzerland, Zurich: +41 (0) 44 580 7207 Taiwan > (toll free): 0800 666 596 Taiwan, Taipei: +886 (0) 2 2650 7329 > Thailand (toll free): 001 800 6136 1473 Turkey (toll free): 00800 4488 > 26642 Turkey, Istanbul: +90 212 375 50 49 UAE (toll free): 8000 3570 > 2662 UK (03): +44 (0)330 336 6002 UK (toll free): 0800 358 6385 > Ukraine (toll free): 0800 500 896 Uruguay (toll free): 0004 019 0152 > USA /Canada (toll free): 1-866-398-2885 Venezuela (toll free): 0 800 > 162 7451 Vietnam (toll free): 1800 9226 Costa Rica (toll free): 800 > 542 5328 France (national): 0821 231 671 India (toll free): 1800 200 > 9415 Indonesia, Jakarta: +62 21 2188 9084 Ireland (national): 0818 270 > 271 Japan (national): 0570 085 744 Serbia (toll free): 0800 190 712 UK > (national): 0844 473 5010 UK (national): 0845 545 0015 Venezuela, > Caracas: +58 212 720 2164 > > Attachments: > > > > Comment: > > > > Attendees: > > > > > ntfy-gdd-gnso-ppsai-impl(a)icann.org <ntfy-gdd-gnso-ppsai-impl(a)icann.org> > > Amy Bivins <amy.bivins(a)icann.org> > > pp_imp_staff(a)icann.org <pp_imp_staff(a)icann.org> > > Owen Smigelski <owen.smigelski(a)icann.org> > > Graeme Bunton <graemeb(a)gmail.com> > > Russ Weinstein <russ.weinstein(a)icann.org> > > Related Link: > > > > > > _______________________________________________ > Ntfy-gdd-gnso-ppsai-impl mailing list > Ntfy-gdd-gnso-ppsai-impl(a)icann.org > https://mm.icann.org/mailman/listinfo/ntfy-gdd-gnso-ppsai-impl

2 1

Review SPECIFICATION 2: CUSTOMER DATA ACCURACY PROGRAM SPECIFICATION
by theo geurts Nov. 14, 2017

Nov. 14, 2017

Hi all, A question to the IRT and staff. SPECIFICATION 2: CUSTOMER DATA ACCURACY PROGRAM SPECIFICATION I think I understand most of the requirements here. What am I not sure of, as it is fuzzy, what is a provider supposed to do when Registrant activates a privacy service for a domain name that is*already* registered, has*not *been transferred and has *not* received updates? Currently, I think the language says the provider shall do *nothing* except turning on the privacy service. Do we agree this is how it should work? Thanks, Theo Geurts Below the current language in the agreement. Except as provided for in Section 3 below, within fifteen (15) days of (i) the registration of a Registered Name for which Provider is providing the Services, (ii) the transfer of the sponsorship of a Registered Name for which Provider is providing the Services, or (iii) any change in the Customer information associated with a Registered Name for which Provider is providing the Services, Provider will, with respect to the Customer account holder contact information related to such Registered Name:

3 2

Materials, action items from 17 Oct Privacy/Proxy IRT call
by Caitlin Tubergen Nov. 6, 2017

Nov. 6, 2017

Dear Colleagues, Thanks so much for your participation on today’s Privacy/Proxy IRT call. For those who could not attend, I encourage you to review the recording and materials on the wiki, https://community.icann.org/display/IRT/24+October+2017. During the call, we discussed an overview of the changes to the draft PPAA. Please note that ICANN proposed a deadline of Tuesday, 14 November for all comments, concerns, and edits to the draft PPAA. The changes from the last iteration, provided to the IRT in July, have been highlighted in the attached issues list. Please respond to the list if you would like to request a longer review period. During ICANN60, we will be presenting an overview of the P/P program’s status to the community. Attached, please find the slide deck for the presentation. To highlight a few notes from the IRT’s discussion this morning, we received feedback to: Edit the definition of Working Group in Section 1.43, to specify that the Provider Stakeholder Group, if formed, shall only appoint the provider representatives of the Working Group, and the GNSO may appoint other members of the community. Add back in the previously-deleted Code of Conduct language in Section 3.5.1. Add back in the previously-deleted review provision in Section 7 of the Customer Data Accuracy Program Specification. If you believe the above items do not reflect the intent of the Working Group’s recommendations, please reply to the list by 14 November 2017. Thank you, and safe travels to those of you attending ICANN 60! Kind regards, Caitlin Tubergen Registrar Services and Engagement Senior Manager ICANN 12025 Waterfront Drive, Suite 300 Los Angeles, CA 90094 Office: +1 310 578 8666 Mobile: +1 310 699 5326 Email: caitlin.tubergen(a)icann.org

7 7

Re: [Gdd-gnso-ppsai-impl] Materials, action items from 17 Oct Privacy/Proxy IRT call
by Darcy Southwell Oct. 24, 2017

Oct. 24, 2017

My apologies, but I won’t be able to attend today’s call due to travel obligations. Safe travels to all going to Abu Dhabi. Darcy From: <gdd-gnso-ppsai-impl-bounces(a)icann.org> on behalf of Caitlin Tubergen <caitlin.tubergen(a)icann.org> Reply-To: <gdd-gnso-ppsai-impl(a)icann.org> Date: Friday, October 20, 2017 at 6:21 PM To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Subject: [Gdd-gnso-ppsai-impl] Materials, action items from 17 Oct Privacy/Proxy IRT call Dear Colleagues, Thanks so much for your participation on last week’s Privacy/Proxy IRT call. For those who could not attend, I encourage you to review the recording and materials on the wiki, https://community.icann.org/display/IRT/17+October+2017. During the call, we discussed: (1) The attached PP Data Escrow Specification. The IRT members on the call were OK with the proposed Specification, as it is similar to what registrars use today. (2) The attached updated PPAA (PPAA_redline_10Oct). During the call, we discussed: · the definition of Working Group in section 1.43. Some members of the IRT proposed that if there is a Provider Stakeholder Group in the future, the Provider Stakeholder Group should only be permitted to appoint the Service Provider representatives of the Working Group, rather than all members of the Working Group. Other members of the IRT noted that because the contract is between ICANN and the Service Provider, the definition of Working Group should mirror the Working definition in the RA/RAA. We tried to strike a balance between these positions in the updated draft PPAA_redline_17Oct. · Section 3.12.2 – some members of the IRT expressed concern that the IRT had previously agreed to remove the “monitored 24 hours a day, seven days a week” language from 3.12.1 and 3.12.2 but to keep the “respond within 24 hours” language under 3.12.2. Please note the “monitored 24 hours a day, seven days a week” language has been removed from the latest draft, PPAA_redline_17Oct. · Section 5.2 the renewal provision – a member of the IRT asked if language should be added that Providers cannot renew under an old form of the PPAA if a new version or global amendment goes into effect. This concern seems to be addressed in Section 5.3 of the agreement, which deals with ICANN’s right to substitute an updated agreement. Additionally, if the P/P Consensus Policy were ever changed/amended, the Policy would supersede the corresponding provisions in the PPAA. · Section 5.5.2.4 – Section 5.5 provides reasons under which ICANN can terminate the Service Provider’s Agreement. A member of the IRT noted that “a pattern and practice of trafficking in or use of domain names identical or confusingly similar to a trademark or service mark of a third party in which the Customer has no rights or legitimate interest, which trademarks have been registered and are being used in bad faith” is a reason for termination of the agreement but is not something addressed in the application/background screening. Further to that feedback, the updated application (v6) adds this question as part of the background screening questions. On Tuesday, 24 Oct, we will continue discussing the PPAA. I have attached a list that details the changes to the PPAA. If you have any specific concerns prior to the call, please feel free to respond to the list. Kind regards, Caitlin -- Caitlin Tubergen Registrar Services and Engagement Senior Manager ICANN 12025 Waterfront Drive, Suite 300 Los Angeles, CA 90094 Office: +1 310 578 8666 Mobile: +1 310 699 5326 Email: caitlin.tubergen(a)icann.org _______________________________________________ Gdd-gnso-ppsai-impl mailing list Gdd-gnso-ppsai-impl(a)icann.org https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl

1 0

Materials, action items from 17 Oct Privacy/Proxy IRT call
by Caitlin Tubergen Oct. 21, 2017

Oct. 21, 2017

Dear Colleagues, Thanks so much for your participation on last week’s Privacy/Proxy IRT call. For those who could not attend, I encourage you to review the recording and materials on the wiki, https://community.icann.org/display/IRT/17+October+2017. During the call, we discussed: The attached PP Data Escrow Specification. The IRT members on the call were OK with the proposed Specification, as it is similar to what registrars use today. The attached updated PPAA (PPAA_redline_10Oct). During the call, we discussed: the definition of Working Group in section 1.43. Some members of the IRT proposed that if there is a Provider Stakeholder Group in the future, the Provider Stakeholder Group should only be permitted to appoint the Service Provider representatives of the Working Group, rather than all members of the Working Group. Other members of the IRT noted that because the contract is between ICANN and the Service Provider, the definition of Working Group should mirror the Working definition in the RA/RAA. We tried to strike a balance between these positions in the updated draft PPAA_redline_17Oct. Section 3.12.2 – some members of the IRT expressed concern that the IRT had previously agreed to remove the “monitored 24 hours a day, seven days a week” language from 3.12.1 and 3.12.2 but to keep the “respond within 24 hours” language under 3.12.2. Please note the “monitored 24 hours a day, seven days a week” language has been removed from the latest draft, PPAA_redline_17Oct. Section 5.2 the renewal provision – a member of the IRT asked if language should be added that Providers cannot renew under an old form of the PPAA if a new version or global amendment goes into effect. This concern seems to be addressed in Section 5.3 of the agreement, which deals with ICANN’s right to substitute an updated agreement. Additionally, if the P/P Consensus Policy were ever changed/amended, the Policy would supersede the corresponding provisions in the PPAA. Section 5.5.2.4 – Section 5.5 provides reasons under which ICANN can terminate the Service Provider’s Agreement. A member of the IRT noted that “a pattern and practice of trafficking in or use of domain names identical or confusingly similar to a trademark or service mark of a third party in which the Customer has no rights or legitimate interest, which trademarks have been registered and are being used in bad faith” is a reason for termination of the agreement but is not something addressed in the application/background screening. Further to that feedback, the updated application (v6) adds this question as part of the background screening questions. On Tuesday, 24 Oct, we will continue discussing the PPAA. I have attached a list that details the changes to the PPAA. If you have any specific concerns prior to the call, please feel free to respond to the list. Kind regards, Caitlin -- Caitlin Tubergen Registrar Services and Engagement Senior Manager ICANN 12025 Waterfront Drive, Suite 300 Los Angeles, CA 90094 Office: +1 310 578 8666 Mobile: +1 310 699 5326 Email: caitlin.tubergen(a)icann.org

2 1

Materials, action items from 10 Oct Privacy/Proxy IRT call
by Caitlin Tubergen Oct. 18, 2017

Oct. 18, 2017

Dear Colleagues, Thanks so much for your participation on last week’s Privacy/Proxy IRT call. For those who could not attend, I encourage you to review the recording and materials on the wiki, https://community.icann.org/display/IRT/10+October+2017. During the call, we discussed: The draft de-accredited Provider Transition Procedure, specifically in reference to how unresolved abuse complaints should be handled. In the updated (and attached) version, please refer to section 2.7, where a requirement for the terminating provider to transfer unresolved abuse complaints to the gaining provider upon termination has been added. This was a suggestion proposed by a member of the IRT. (Note: there is not a requirement for the gaining provider to process the abuse complaints on a shortened timeline.) Please let us know if you have any further feedback on the De-Accredited Provider Transition Procedure. The draft applicant guidebook/application: in the draft we discussed (version 4), the background check questions were changed to mirror the questions in the registrar accreditation application. Note to IRT: Please let us know if you believe this is in line with the WG’s recommendations. In the updated draft, we reverted to the language in the IP Framework (per feedback from some members of the IRT), and we added a question, per IRT feedback, asking applicants to inform ICANN if its principals/officers have previously been employed by an entity whose ICANN accreditation was involuntarily terminated by ICANN. Please see section 3.6 and section 6.10. A high-level overview of the changes to the updated PPAA draft: we will be discussing the updates in greater details in upcoming calls. For our call on Tuesday, October 17, we will be presenting the Data Escrow Specification (attached). You will have additional time to review and provide feedback on the Data Escrow Specification following the call. Following a summary of the Data Escrow Specification, we will be working through the updated PPAA. If there is anything in particular you would like to flag before the call, please respond via the list. Thank you! Best, Caitlin -- Caitlin Tubergen Registrar Services and Engagement Senior Manager ICANN 12025 Waterfront Drive, Suite 300 Los Angeles, CA 90094 Office: +1 310 578 8666 Mobile: +1 310 699 5326 Email: caitlin.tubergen(a)icann.org

3 3

Re: [Gdd-gnso-ppsai-impl] Materials, action items from today's Privacy/Proxy IRT call
by Sara Bockey Oct. 17, 2017

Oct. 17, 2017

Hi Caitlin, I found our previous discussion on 3.12.1 and 3.12.2 – see item 1(a)-(d) below. It was noted that 3.12.2 would be acceptable if no changes were made to it. However, as noted today, it has indeed been changed. Hope this helps. Sara sara bockey sr. policy manager | GoDaddy™ sbockey(a)godaddy.com 480-366-3616 skype: sbockey This email message and any attachments hereto is intended for use only by the addressee(s) named herein and may contain confidential information. If you have received this email in error, please immediately notify the sender and permanently delete the original and any copy of this message and its attachments. From: <gdd-gnso-ppsai-impl-bounces(a)icann.org> on behalf of Amy Bivins <amy.bivins(a)icann.org> Reply-To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Date: Tuesday, September 5, 2017 at 11:27 AM To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Subject: [Gdd-gnso-ppsai-impl] Materials, action items from today's Privacy/Proxy IRT call Hi, All, Thanks for your attendance and participation on today’s Privacy/Proxy IRT call. If you were unable to attend, I encourage you to review the recording and materials posted on the wiki, https://community.icann.org/display/IRT/5+September+2017 Please provide any additional input you have on the topics discussed today (summary provided below) no later than next Monday, 11 September. Also, please identify any additional PPAA sections that you would like to discuss. We are nearing the end of the PPAA issues list. Once we complete this, if no further topics are raised, we will move on to other unresolved items in preparation for proceeding to public comment. Summary of today’s topics, questions and action items (updated issues list, with complete IRT input, attached): 1. 24/7 monitoring of abuse contact (See PPAA draft Section 3.13.1) * IRT member proposal: Remove requirement that abuse contact be monitored 24/7, as this was not in the Final Report * Background: this provision was modeled on the RAA; Section 3.13.2, provides that “Well-founded reports of Illegal Activity submitted to Provider’s designated Abuse contact must be reviewed within 24 hours by an individual who is empowered by Provider to take necessary and appropriate actions in response to the report, including reports of Abuse submitted by Persons and their representatives pursuant to the Intellectual Property Disclosure Framework Specification.” * IRT input received: Multiple IRT members supported deletion of the 24/7 monitoring requirement from Section 3.13.1. Some IRT members initially asked what the requirement would be instead, but upon consulting Section 3.13.2, said that this would be adequate so long as Section 3.13.2 does not change. * IRT action items: Please review sections 3.13.1 and 3.13.2 and provide any further input to the list. If no additional (or no contrary) input is received, the 24/7 monitoring requirement will be deleted from Section 3.13.1 in the next PPAA draft. * De-accreditation process proposal (attached) * Staff provided overview of this process proposal, which was modeled on registrar process, with modifications to accommodate Final Recommendations surrounding Customer notice and other factors. * Initial IRT feedback indicated that requiring terminating providers to notify customers may not be effective, as providers engaged in bad acts or that are out of business may not comply. * Alternative suggestions: i. Have ICANN access data escrow deposits for the purposes of identifying impacted customers (potential data protection issues here); ii. Have registrars attempt to notify customers with any information the registrar has available (issues surrounding unavailability of data); iii. Underlying issue—doing our best to notify customers vs absolute certainty that customers will be notified (may not be possible) * Additional IRT input is requested on all aspects of this proposal, particularly the issues raised on today’s call, surrounding customer notices (and possible ICANN access to escrow data for that purpose). 1. Next steps on data retention * Staff provided summary of IRT input to date and proposed course of action—keep requirements in PPAA draft as-is, pending completion of community’s work on GDPR issues, to avoid over-stepping or conflicts. Update PPAA requirements with anything new from GDPR work if GDPR work is completed prior to end of this IRT, or allow for amendments to PPAA immediately upon completion of GDPR work to account for results of community process. * IRT feedback: PPAA should ultimately incorporate results of GDPR work (apparent consensus here) i. Could language be added to PPAA in the meantime to allow for retention for longest period permitted under applicable law? ii. Could waivers previously granted to registrars under RAA be extended to PPs in same jurisdictions without need for new waiver applications? (1 IRT member was cautious about this approach) As always, if you would like to raise any other issues or feedback, please feel free to send to the list at anytime. I’ll send an agenda and relevant materials for next week’s meeting to the list by the end of this week. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

1 0