Notes, Action Items From Today's PP IRT Call
Dear Colleagues, Thank you for your active participation on today's Privacy/Proxy IRT call. For those who could not attend, I encourage you to review the recording, which is posted on the wiki, https://community.icann.org/display/IRT/13+February+2018. Today, we discussed three topics: (1) the updated de-accreditation procedure; (2) the updated Policy document; and (3) the ongoing discussion on the list re: the LEA framework specification, specifically the processes of discussing the disagreement about the timing of a provider's "actioning" of a "high priority" request. Please review the attached materials, summary below and/or the recording and provide any further input on these topics by the end of this week. IRT feedback is specifically requested on the five recommendations received from IRT members related to the LEA Framework Specification. This will be discussed next week. IRT Input on De-Accreditation Process * Recommendation 1: In Section 2.2.4, edit to note that this right of transfer is subject to the ICANN transfer policy. * Proposed response: This edit will be made unless we receive input to the contrary that warrants further discussion. * Recommendation 2: In Section 2.5, delete references to specific methods of contact. * Proposed response: This edit will be made unless we receive input to the contrary that warrants further discussion. * Recommendation 3: In Section 3, should there be more specifics about what this notice should require? Section 2.4 could be referenced, for example. * Proposed response: Absent further input on Section 2.4, a reference to Section 2.4 will be added. IRT Input on Draft Policy Document * Recommendation 1: Eliminate use of "Person" in definitions. * Proposed response 1: This topic has been raised before, but did not appear to have widespread support by members of the IRT. The word "Person" was used to ensure consistency across definitions and for clarity and conciseness. As a result, it seems preferable to retain the use of the word "Person," absent feedback that indicates it is the consensus view of the IRT to eliminate the use of the word "Person." * Proposed response 2: One IRT member suggested that the word "Person" could be added to the definitions section of this document for added clarity. This edit will be made unless we receive input to the contrary that warrants further discussion. * Recommendation 2: Implementation of RDDS requirements, as a matter of policy, should be done through high-level WHOIS policy rather than piecemeal in this Policy document, as this could be lost over time as/when/if other WHOIS requirements are updated. * Proposed response: Additional IRT feedback is requested on this topic, and staff will also consult about this topic. There are many different ICANN policies that concern WHOIS/RDDS (https://www.icann.org/resources/pages/registrars/consensus-policies-en). The CL&D Policy does specifically concern labeling, which is what the requirement here is about, https://www.icann.org/resources/pages/rdds-labeling-policy-2017-02-01-en. LEA Framework Discussions The IRT has been discussing the draft LEA Disclosure Framework Specification periodically for approximately nine months. Most elements of this draft framework appear to be settled, but disagreement remains on one specific point: how and when a provider must "action" a "high priority" request. PSWG members of the IRT have proposed that high priority requests be actioned within 24 hours. IRT members, particularly registrars, contend that this time period is unreasonable. The most recent feedback received on this on the list for proposed edits to the current draft (which currently requires that a high priority request be actioned within 24 hours) is as follows: * Recommendation 1: Where a disclosure request has been categorized as High Priority, Provider shall use its best efforts towards actioning the request within 24 hours on business days or as close as possible to this, or "actioning the request within 24 hours for up to 90% (or some other level determined acceptable by Providers) of incidences." * Recommendation 2: Add "without limitations" back to section 4.2.2. What's listed under 4.2.2 should be non-limiting examples for when disclosure can be reasonably refused. * Recommendation 3: Define the word "Action" as follows (or similar): "As used in this subsection, "action" means (i) to disclose to the LEA requestor, or (ii) to refuse to disclose to the LEA requestor, citing one or more of the reasons listed in 4.2.2"?; or to add, after "action," "in accordance with subsection 4.2," which includes both the options listed (as well as the option of extending the deadline, "in exceptional circumstances," see 4.2.4). * Recommendation 4: Where a disclosure request is categorized as High Priority, LEA will make every effort to contact the Provider directly to discuss the matter, and should it be determined that Provider has useful information, Provider shall use its best efforts to action the request within 24 hours, noting that a court order/subpoena may still be required prior to release of any information. Registrar will not be required to take any action in contravention of applicable law. * Recommendation 5: Edit to state that "Provider shall use reasonable efforts to respond to the request as soon as possible" as opposed to Provider shall use its best efforts to action the request within 24 hours. IRT Action Item: IRT feedback is specifically requested on these five recommendations. This will be discussed once more, on Tuesday, with the goal of determining whether agreement can be reached or not on any further changes to the current draft. If agreement cannot be reached on Tuesday, the various positions will be specifically noted in the call for public comments. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins@icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>
Hi Amy, Re: IRT Input on Draft Policy Document Recommendation 2: I don't think this language is needed because we aren't revising the underlying WHOIS policy (i.e. adding or removing fields). If memory serves, the Provider is simply adding the labeling to the existing registrant organization field. Therefore there is nothing the registry/registrar does to "facilitate" other than following existing poliy. Thanks, Greg From: Gdd-gnso-ppsai-impl [mailto:gdd-gnso-ppsai-impl-bounces@icann.org] On Behalf Of Amy Bivins Sent: Tuesday, February 13, 2018 9:54 AM To: gdd-gnso-ppsai-impl@icann.org Subject: [Gdd-gnso-ppsai-impl] Notes, Action Items From Today's PP IRT Call Dear Colleagues, Thank you for your active participation on today's Privacy/Proxy IRT call. For those who could not attend, I encourage you to review the recording, which is posted on the wiki, https://community.icann.org/display/IRT/13+February+2018. Today, we discussed three topics: (1) the updated de-accreditation procedure; (2) the updated Policy document; and (3) the ongoing discussion on the list re: the LEA framework specification, specifically the processes of discussing the disagreement about the timing of a provider's "actioning" of a "high priority" request. Please review the attached materials, summary below and/or the recording and provide any further input on these topics by the end of this week. IRT feedback is specifically requested on the five recommendations received from IRT members related to the LEA Framework Specification. This will be discussed next week. IRT Input on De-Accreditation Process * Recommendation 1: In Section 2.2.4, edit to note that this right of transfer is subject to the ICANN transfer policy. * Proposed response: This edit will be made unless we receive input to the contrary that warrants further discussion. * Recommendation 2: In Section 2.5, delete references to specific methods of contact. * Proposed response: This edit will be made unless we receive input to the contrary that warrants further discussion. * Recommendation 3: In Section 3, should there be more specifics about what this notice should require? Section 2.4 could be referenced, for example. * Proposed response: Absent further input on Section 2.4, a reference to Section 2.4 will be added. IRT Input on Draft Policy Document * Recommendation 1: Eliminate use of "Person" in definitions. * Proposed response 1: This topic has been raised before, but did not appear to have widespread support by members of the IRT. The word "Person" was used to ensure consistency across definitions and for clarity and conciseness. As a result, it seems preferable to retain the use of the word "Person," absent feedback that indicates it is the consensus view of the IRT to eliminate the use of the word "Person." * Proposed response 2: One IRT member suggested that the word "Person" could be added to the definitions section of this document for added clarity. This edit will be made unless we receive input to the contrary that warrants further discussion. * Recommendation 2: Implementation of RDDS requirements, as a matter of policy, should be done through high-level WHOIS policy rather than piecemeal in this Policy document, as this could be lost over time as/when/if other WHOIS requirements are updated. * Proposed response: Additional IRT feedback is requested on this topic, and staff will also consult about this topic. There are many different ICANN policies that concern WHOIS/RDDS (https://www.icann.org/resources/pages/registrars/consensus-policies-en). The CL&D Policy does specifically concern labeling, which is what the requirement here is about, https://www.icann.org/resources/pages/rdds-labeling-policy-2017-02-01-en. LEA Framework Discussions The IRT has been discussing the draft LEA Disclosure Framework Specification periodically for approximately nine months. Most elements of this draft framework appear to be settled, but disagreement remains on one specific point: how and when a provider must "action" a "high priority" request. PSWG members of the IRT have proposed that high priority requests be actioned within 24 hours. IRT members, particularly registrars, contend that this time period is unreasonable. The most recent feedback received on this on the list for proposed edits to the current draft (which currently requires that a high priority request be actioned within 24 hours) is as follows: * Recommendation 1: Where a disclosure request has been categorized as High Priority, Provider shall use its best efforts towards actioning the request within 24 hours on business days or as close as possible to this, or "actioning the request within 24 hours for up to 90% (or some other level determined acceptable by Providers) of incidences." * Recommendation 2: Add "without limitations" back to section 4.2.2. What's listed under 4.2.2 should be non-limiting examples for when disclosure can be reasonably refused. * Recommendation 3: Define the word "Action" as follows (or similar): "As used in this subsection, "action" means (i) to disclose to the LEA requestor, or (ii) to refuse to disclose to the LEA requestor, citing one or more of the reasons listed in 4.2.2"?; or to add, after "action," "in accordance with subsection 4.2," which includes both the options listed (as well as the option of extending the deadline, "in exceptional circumstances," see 4.2.4). * Recommendation 4: Where a disclosure request is categorized as High Priority, LEA will make every effort to contact the Provider directly to discuss the matter, and should it be determined that Provider has useful information, Provider shall use its best efforts to action the request within 24 hours, noting that a court order/subpoena may still be required prior to release of any information. Registrar will not be required to take any action in contravention of applicable law. * Recommendation 5: Edit to state that "Provider shall use reasonable efforts to respond to the request as soon as possible" as opposed to Provider shall use its best efforts to action the request within 24 hours. IRT Action Item: IRT feedback is specifically requested on these five recommendations. This will be discussed once more, on Tuesday, with the goal of determining whether agreement can be reached or not on any further changes to the current draft. If agreement cannot be reached on Tuesday, the various positions will be specifically noted in the call for public comments. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins@icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>
Amy, Why do we not mirror the RAA 2013 language here? Person sounds somewhat off. Could be a legal term? Theo On 13-2-2018 18:53, Amy Bivins wrote:
Dear Colleagues,
Thank you for your active participation on today’s Privacy/Proxy IRT call. For those who could not attend, I encourage you to review the recording, which is posted on the wiki, https://community.icann.org/display/IRT/13+February+2018.
Today, we discussed three topics: (1) the updated de-accreditation procedure; (2) the updated Policy document; and (3) the ongoing discussion on the list re: the LEA framework specification, specifically the processes of discussing the disagreement about the timing of a provider’s “actioning” of a “high priority” request. *Please review the attached materials, summary below and/or the recording and provide any further input on these topics by the end of this week.*
**
*IRT feedback is specifically requested on the five recommendations received from IRT members related to the LEA Framework Specification. This will be discussed next week.*
**
*IRT Input on De-Accreditation Process*
* *Recommendation 1:* In Section 2.2.4, edit to note that this right of transfer is subject to the ICANN transfer policy. o *Proposed response:* This edit will be made unless we receive input to the contrary that warrants further discussion. * *Recommendation 2:* In Section 2.5, delete references to specific methods of contact. o *Proposed response:* This edit will be made unless we receive input to the contrary that warrants further discussion. * *Recommendation 3:* In Section 3, should there be more specifics about what this notice should require? Section 2.4 could be referenced, for example. o *Proposed response:* Absent further input on Section 2.4, a reference to Section 2.4 will be added.
*IRT Input on Draft Policy Document*
* *Recommendation 1: *Eliminate use of “Person” in definitions.** o *Proposed response 1: *This topic has been raised before, but did not appear to have widespread support by members of the IRT. The word “Person” was used to ensure consistency across definitions and for clarity and conciseness. As a result, it seems preferable to retain the use of the word “Person,” absent feedback that indicates it is the consensus view of the IRT to eliminate the use of the word “Person.”** o *Proposed response 2: *One IRT member suggested that the word “Person” could be added to the definitions section of this document for added clarity. This edit will be made unless we receive input to the contrary that warrants further discussion.** * *Recommendation 2: *Implementation of RDDS requirements, as a matter of policy, should be done through high-level WHOIS policy rather than piecemeal in this Policy document, as this could be lost over time as/when/if other WHOIS requirements are updated.** o *Proposed response: *Additional IRT feedback is requested on this topic, and staff will also consult about this topic. There are many different ICANN policies that concern WHOIS/RDDS (https://www.icann.org/resources/pages/registrars/consensus-policies-en). The CL&D Policy does specifically concern labeling, which is what the requirement here is about, https://www.icann.org/resources/pages/rdds-labeling-policy-2017-02-01-en.**
**
*LEA Framework Discussions*
The IRT has been discussing the draft LEA Disclosure Framework Specification periodically for approximately nine months. Most elements of this draft framework appear to be settled, but disagreement remains on one specific point: how and when a provider must “action” a “high priority” request. PSWG members of the IRT have proposed that high priority requests be actioned within 24 hours. IRT members, particularly registrars, contend that this time period is unreasonable. The most recent feedback received on this on the list for proposed edits to the current draft (which currently requires that a high priority request be actioned within 24 hours) is as follows:
* *Recommendation 1*: Where a disclosure request has been categorized as High Priority, Provider shall use its best efforts towards actioning the request within 24 hours on business days or as close as possible to this, or “actioning the request within 24 hours for up to 90% (or some other level determined acceptable by Providers) of incidences.” * *Recommendation 2*: Add “without limitations” back to section 4.2.2. What’s listed under 4.2.2 should be non-limiting examples for when disclosure can be reasonably refused. * *Recommendation 3*: Define the word “Action” as follows (or similar): “As used in this subsection, “action” means (i) to disclose to the LEA requestor, or (ii) to refuse to disclose to the LEA requestor, citing one or more of the reasons listed in 4.2.2”?; or to add, after “action,” “in accordance with subsection 4.2,” which includes both the options listed (as well as the option of extending the deadline, “in exceptional circumstances,” see 4.2.4). * *Recommendation 4: *Where a disclosure request is categorized as High Priority, LEA will make every effort to contact the Provider directly to discuss the matter, and should it be determined that Provider has useful information, Provider shall use its best efforts to action the request within 24 hours, noting that a court order/subpoena may still be required prior to release of any information. Registrar will not be required to take any action in contravention of applicable law. * *Recommendation 5*: Edit to state that “Provider shall use reasonable efforts to respond to the request as soon as possible” as opposed to Provider shall use its best efforts to action the request within 24 hours.
*IRT Action Item: *IRT feedback is specifically requested on these five recommendations. This will be discussed once more, on Tuesday, with the goal of determining whether agreement can be reached or not on any further changes to the current draft. If agreement cannot be reached on Tuesday, the various positions will be specifically noted in the call for public comments.
Best,
Amy
*Amy E. Bivins*
Registrar Services and Engagement Senior Manager
Registrar Services and Industry Relations
Internet Corporation for Assigned Names and Numbers (ICANN)
Direct: +1 (202) 249-7551
Fax: +1 (202) 789-0104
Email: amy.bivins@icann.org <mailto:amy.bivins@icann.org>
www.icann.org <http://www.icann.org>
_______________________________________________ Gdd-gnso-ppsai-impl mailing list Gdd-gnso-ppsai-impl@icann.org https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl
Hi Theo, We've discussed this previously in the IRT, but the reason that "person" was used was simply because the RAA language is a bit "wordy," for lack of a better term. "Person" was created as a proposed defined term in the PPAA to make the agreement more concise, so that every time a customer or other entity is referenced, multiple-word phrases such as "individual and/or entity" don't need to be used. It seems like a small change but adds up in terms of space, given the length of the agreement and the frequency that these terms are used. Amy From: theo geurts [mailto:gtheo@xs4all.nl] Sent: Wednesday, February 14, 2018 2:11 PM To: gdd-gnso-ppsai-impl@icann.org; Amy Bivins <amy.bivins@icann.org> Subject: [Ext] Re: [Gdd-gnso-ppsai-impl] Notes, Action Items From Today's PP IRT Call Amy, Why do we not mirror the RAA 2013 language here? Person sounds somewhat off. Could be a legal term? Theo On 13-2-2018 18:53, Amy Bivins wrote: Dear Colleagues, Thank you for your active participation on today's Privacy/Proxy IRT call. For those who could not attend, I encourage you to review the recording, which is posted on the wiki, https://community.icann.org/display/IRT/13+February+2018[community.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_display_IRT_13-2BFebruary-2B2018&d=DwMD-g&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=uerz4ckt1v4Qhbv-TplkjKTey9bgtdWrvLyZDu0mXuk&m=nL5XRdABcyq9GoWlKjBKYu8JaXXQxQ3muLNjX-vzdkc&s=ImKDNa-hX1XtpVTSzYcqT84P77gDc75Z4RQPuYImWwU&e=>. Today, we discussed three topics: (1) the updated de-accreditation procedure; (2) the updated Policy document; and (3) the ongoing discussion on the list re: the LEA framework specification, specifically the processes of discussing the disagreement about the timing of a provider's "actioning" of a "high priority" request. Please review the attached materials, summary below and/or the recording and provide any further input on these topics by the end of this week. IRT feedback is specifically requested on the five recommendations received from IRT members related to the LEA Framework Specification. This will be discussed next week. IRT Input on De-Accreditation Process * Recommendation 1: In Section 2.2.4, edit to note that this right of transfer is subject to the ICANN transfer policy. * Proposed response: This edit will be made unless we receive input to the contrary that warrants further discussion. * Recommendation 2: In Section 2.5, delete references to specific methods of contact. * Proposed response: This edit will be made unless we receive input to the contrary that warrants further discussion. * Recommendation 3: In Section 3, should there be more specifics about what this notice should require? Section 2.4 could be referenced, for example. * Proposed response: Absent further input on Section 2.4, a reference to Section 2.4 will be added. IRT Input on Draft Policy Document * Recommendation 1: Eliminate use of "Person" in definitions. * Proposed response 1: This topic has been raised before, but did not appear to have widespread support by members of the IRT. The word "Person" was used to ensure consistency across definitions and for clarity and conciseness. As a result, it seems preferable to retain the use of the word "Person," absent feedback that indicates it is the consensus view of the IRT to eliminate the use of the word "Person." * Proposed response 2: One IRT member suggested that the word "Person" could be added to the definitions section of this document for added clarity. This edit will be made unless we receive input to the contrary that warrants further discussion. * Recommendation 2: Implementation of RDDS requirements, as a matter of policy, should be done through high-level WHOIS policy rather than piecemeal in this Policy document, as this could be lost over time as/when/if other WHOIS requirements are updated. * Proposed response: Additional IRT feedback is requested on this topic, and staff will also consult about this topic. There are many different ICANN policies that concern WHOIS/RDDS (https://www.icann.org/resources/pages/registrars/consensus-policies-en[icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resources_pages_registrars_consensus-2Dpolicies-2Den&d=DwMD-g&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=uerz4ckt1v4Qhbv-TplkjKTey9bgtdWrvLyZDu0mXuk&m=nL5XRdABcyq9GoWlKjBKYu8JaXXQxQ3muLNjX-vzdkc&s=hxAO1N33w-qOQNXMrTHw4Ih_XcanWR-cuVHJFnZkMos&e=>). The CL&D Policy does specifically concern labeling, which is what the requirement here is about, https://www.icann.org/resources/pages/rdds-labeling-policy-2017-02-01-en[icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resources_pages_rdds-2Dlabeling-2Dpolicy-2D2017-2D02-2D01-2Den&d=DwMD-g&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=uerz4ckt1v4Qhbv-TplkjKTey9bgtdWrvLyZDu0mXuk&m=nL5XRdABcyq9GoWlKjBKYu8JaXXQxQ3muLNjX-vzdkc&s=vqMwgzrBLEFw7SMcYOaN8yORc2BGLouH3I5grIeGsqs&e=>. LEA Framework Discussions The IRT has been discussing the draft LEA Disclosure Framework Specification periodically for approximately nine months. Most elements of this draft framework appear to be settled, but disagreement remains on one specific point: how and when a provider must "action" a "high priority" request. PSWG members of the IRT have proposed that high priority requests be actioned within 24 hours. IRT members, particularly registrars, contend that this time period is unreasonable. The most recent feedback received on this on the list for proposed edits to the current draft (which currently requires that a high priority request be actioned within 24 hours) is as follows: * Recommendation 1: Where a disclosure request has been categorized as High Priority, Provider shall use its best efforts towards actioning the request within 24 hours on business days or as close as possible to this, or "actioning the request within 24 hours for up to 90% (or some other level determined acceptable by Providers) of incidences." * Recommendation 2: Add "without limitations" back to section 4.2.2. What's listed under 4.2.2 should be non-limiting examples for when disclosure can be reasonably refused. * Recommendation 3: Define the word "Action" as follows (or similar): "As used in this subsection, "action" means (i) to disclose to the LEA requestor, or (ii) to refuse to disclose to the LEA requestor, citing one or more of the reasons listed in 4.2.2"?; or to add, after "action," "in accordance with subsection 4.2," which includes both the options listed (as well as the option of extending the deadline, "in exceptional circumstances," see 4.2.4). * Recommendation 4: Where a disclosure request is categorized as High Priority, LEA will make every effort to contact the Provider directly to discuss the matter, and should it be determined that Provider has useful information, Provider shall use its best efforts to action the request within 24 hours, noting that a court order/subpoena may still be required prior to release of any information. Registrar will not be required to take any action in contravention of applicable law. * Recommendation 5: Edit to state that "Provider shall use reasonable efforts to respond to the request as soon as possible" as opposed to Provider shall use its best efforts to action the request within 24 hours. IRT Action Item: IRT feedback is specifically requested on these five recommendations. This will be discussed once more, on Tuesday, with the goal of determining whether agreement can be reached or not on any further changes to the current draft. If agreement cannot be reached on Tuesday, the various positions will be specifically noted in the call for public comments. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins@icann.org<mailto:amy.bivins@icann.org> www.icann.org[icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.icann.org&d=DwMD-g&c...> _______________________________________________ Gdd-gnso-ppsai-impl mailing list Gdd-gnso-ppsai-impl@icann.org<mailto:Gdd-gnso-ppsai-impl@icann.org> https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl
participants (3)
-
Amy Bivins -
DiBiase, Gregory -
theo geurts