Dear Colleagues, This is a reminder that the PP IRT will meet tomorrow, Thursday, 30 August, at 1600 UTC. A draft markup of the PPAA is attached. This markup is for discussion purposes only-it is not a final proposal and remains subject to revision. The draft is being circulated, without further delay, to continue the conversation. It has not been approved by senior management and is for discussion only. We would like to begin discussing the following topics tomorrow (but please feel free to comment before then on the list): 1. Some suggested edits track what's in the Temporary Specification for gTLD Registration Data. For example, section 3.5.3.3. How should we approach drafting provisions modeled on the Temp Spec, given that its language is subject to change in the near future? 2. The disclosure frameworks seem to be written from the position that there's no discretion for the Provider to not provide the underlying customer data if the conditions in the framework are met. Is this the intent? This could potentially cause issues under the GDPR, because this doesn't seem to leave room to balance the interests of the data subjects with the legitimate interest of the parties requesting personal data. 3. The disclosure frameworks raise additional GDPR-related questions that are similar to questions raised in the Draft Framework Elements of a Potential Unified Access Model<https://www.icann.org/en/system/files/files/framework-elements-unified-acces...> paper published by ICANN org. For example, what would the requirements be for logging requests for disclosure made under the frameworks (or even requests not governed by the frameworks)? 4. Do you see any other issues that you believe must be addressed related to GDPR that were not addressed in this markup? 5. Following the completion of the IRT's review of this draft accreditation agreement and related matters, we believe are ready to proceed to public comment. Do you believe there is any reason why the IRT should not proceed to public comment? 6. We have heard questions from various members of the community about how the proposed accreditation program requirements will operate within the current Temp Spec RDDS environment. These proposed program requirements do not address how PP registrations interact with a gated access model or how they might be impacted, if at all, by the results of the EPDP. Is this an issue that the IRT believes should be explored at this stage? If any member of the IRT wishes to raise any comments or points about this topic, you are encouraged to do so during the IRT call or via the list. One area that may need further attention in the agreement is specifically defining what data is to be collected and for what purpose. In addition, the new Specification 8 contains some data processing requirements, but additional discussion is needed on the appropriate controller arrangements that are needed between ICANN, the registrar and the Provider. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins@icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>