May 2022 - GNSO-Accuracy-ST

Proposed Agenda - Registration Data Accuracy Scoping Team meeting #32 on Thursday 2 June at 14.00 UTC
by Marika Konings May 31, 2022

May 31, 2022

Dear All, Please find below the proposed agenda for the next Registration Data Accuracy Scoping Team meeting which is scheduled for Thursday 2 June at 14.00 UTC. As a reminder: 1. EXTENDED: Scoping Team members to provide an update to their respective stakeholders group with respect to last week’s discussion about the draft EDPB communication, particularly with respect to scenario 2 and a data protection impact assessment (DPIA) of Scenario 2. Please provide any proposed updates by Wednesday, 1 June. https://docs.google.com/document/d/1rCBaQ175p_VrP6DtxLUuuoO9Uv5C2qp_/edit 1. ❗️❗️❗️FINAL EXTENSION: Scoping Team members to review all comments received on the write-up and propose compromise language in comments form (where applicable) in advance by COB, Tuesday, 31 May. Please note this is the group's final opportunity to raise concerns with this document. https://docs.google.com/document/d/13sP-2z7rusEYrDyntrgm-tcIavPMJndU/edit [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/13sP-2z7rusEY…>. ❗️❗️❗️ 1. ❗️❗️❗️FINAL EXTENSION: Scoping Team members to review the newly-circulated write up of C.2.2 and propose edits/comments in comment form by COB, Tuesday, 31 May. https://docs.google.com/document/d/1CYs9mLHsKcZevmZtFrQBDXbv_nkQ5PKe/edit [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1CYs9mLHsKcZe…>. ❗️❗️❗️ Best regards, Caitlin, Berry and Marika Registration Data Accuracy Scoping Team – Meeting #32 Thursday 2 June at 14.00 UTC 1. Welcome & Chair Updates (5 minutes) 2. Scenarios for EDPB - see update from ICANN org (https://mm.icann.org/pipermail/gnso-accuracy-st/2022-May/000444.html) (15 minutes) * Continue review of Scoping Team input (see https://docs.google.com/document/d/1rCBaQ175p_VrP6DtxLUuuoO9Uv5C2qp_/edit) * Confirm next steps 1. Write up for Section 2.1.2 – Measurement of whether current goals are met (see https://docs.google.com/document/d/1CYs9mLHsKcZevmZtFrQBDXbv_nkQ5PKe/edit) (15 minutes) * Review input received * Confirm next steps 1. Write up for assignments #1 & #2 (see https://docs.google.com/document/d/13sP-2z7rusEYrDyntrgm-tcIavPMJndU/edit) (30 minutes) * Continue review of input received * Confirm next steps 1. Confirm action items & next meeting (Thursday 9 June at 14.00 UTC)

1 0

Notes and action items - RDA Scoping Team Meeting #31 - 26 May 2022
by Caitlin Tubergen May 26, 2022

May 26, 2022

Dear RDA Scoping Team members, Please find below the notes and action items from today’s meeting. The next meeting will be Thursday, 2 June at 14:00 UTC. Best regards, Marika, Berry, and Caitlin -- Action Items 1. EXTENDED: Scoping Team members to provide an update to their respective stakeholders group with respect to last week’s discussion about the draft EDPB communication, particularly with respect to scenario 2 and a data protection impact assessment (DPIA) of Scenario 2. Please provide any proposed updates by Wednesday, 1 June. https://docs.google.com/document/d/1rCBaQ175p_VrP6DtxLUuuoO9Uv5C2qp_/edit 2. ❗️❗️❗️FINAL EXTENSION: Scoping Team members to review all comments received on the write-up and propose compromise language in comments form (where applicable) in advance by COB, Tuesday, 31 May. Please note this is the group's final opportunity to raise concerns with this document. https://docs.google.com/document/d/13sP-2z7rusEYrDyntrgm-tcIavPMJndU/edit. ❗️❗️❗️ 3. ❗️❗️❗️FINAL EXTENSION: Scoping Team members to review the newly-circulated write up of C.2.2 and propose edits/comments in comment form by COB, Tuesday, 31 May. https://docs.google.com/document/d/1CYs9mLHsKcZevmZtFrQBDXbv_nkQ5PKe/edit. ❗️❗️❗️ --- Registration Data Accuracy Scoping Team – Meeting #31 Thursday 26 May at 14.00 UTC 1. Welcome & Chair Updates (5 minutes) * Registration for ICANN74 has been open, and the availability to sign up for sessions is now available. Please remember to register in advance and for individual sessions. In-person slots will be limited, so please sign up for the sessions in advance. 2. Scenarios for EDPB - see update from ICANN org (https://mm.icann.org/pipermail/gnso-accuracy-st/2022-May/000444.html) (15 minutes) * Continue review of Scoping Team input (see https://docs.google.com/document/d/1rCBaQ175p_VrP6DtxLUuuoO9Uv5C2qp_/edit [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1rCBaQ175p_Vr…>) * There does not appear to be any new comments added as of our last meeting. * There is still no feedback from the GAC, IPC, BC – this is concerning * This is one of the most important things the group has been asked to consider during its deliberations. * Previous attempts by ICANN org to the Belgian DPA or EDPB have not resulted in actionable guidance that moved policy deliberations forward. * At a certain point in time, it’s important to make these interventions count. Accordingly, it’s important to make these deliberations count and position ICANN for success. * Alan G. – will flesh out * The original date was 23 May, we extended it to 27 May. How much time does the group need? * Proposal: this group will meet in person at ICANN74. Believe this is very important – accordingly, do we dedicate the meeting in the Hague to this communication? * Do not agree with this approach – do not believe this will be sent to the EPDB in the next two weeks. ICANN org still has a lot of work to do in terms of a DPIA, so the timing is not that critical. The Council instructions ask important questions that the group has yet to tackle – what should accuracy look like in the future? * Org spoke with the GAC earlier – for a variety of reasons, the instructions are still that ICANN needs to work through the EC and the Belgian DPA – the plan is to start those conversations quite soon; however, that does not mean there has to be a completed letter or DPIA at this time. Timing – would like to get started on this soon, but there will be parallel preparatory work done along the way. * In terms of making the most constructive use of face-to-face time: one issue the group has struggled with is what does accuracy mean? If we, in this group, cannot come to an agreement of what accuracy is – that would be a very important item for this group to opine on both to ICANN and the DPA. * In terms of making use of face-to-face time – one issue the group has not reached consensus on is what the term accuracy even means. * This is not the right question – we need to know what levels of accuracy are needed with respect to various elements in the RDDS * The two definitions that we had – binary (either inaccurate or accurate) or there are degrees of accuracy * On the last call, the group should support ICANN, but it is ultimately their work. Do not know if it is within the scope of this group to do this work. We have not seen a DPIA or received a request from ICANN. If members need more help giving generalized feedback to ICANN, a few more days should be helpful. In terms of the definition, the write-up shows the agreed upon description of accuracy and the proposals to gather more data to inform the current description. Believe we should focus on this before going to assignments 3 and 4. * * Confirm next steps 1. Write up for assignments #1 & #2 (see https://docs.google.com/document/d/13sP-2z7rusEYrDyntrgm-tcIavPMJndU/edit [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/13sP-2z7rusEY…>) (30 minutes) * Continue review of input received * When we talk about the description, this refers to existing requirements in the RAA * Manju provided a definition, and it may be helpful to try to coalesce around that * The concept of accuracy revolves around what kind of accuracy are we trying to require noting there are certain uncertainties. As an example of a change we might make in the future is instead of verifying one of two fields, they may be required to verify all field – this is just an example. * If people are not available to attend, there are alternates that can attend in their stead. There is a timeline, here, however – urge representatives to have alternates attend. * Probably best to keep this to describing current RAA definition. * Have to keep in mind the purpose of the collection when defining data protection terms * Do not believe Melina agrees with the addition of “degree of correctness,” but this is how contracted parties understand it – as it has to be measured against a specific standard * When looking at the assignment, everyone seems to agree what is written in the document – everyone agreed that this is what is provided for in the contracts and how it is enforced. The assignment asked for a current definition, and it appears that everyone agrees there is no current definition. * The problem with this definition is that it includes absolute terms – if we say something is free from PCBs, we assume there are no PCBs in it, if something is true, it is not false. However, correctness has flexibility depending on what the standard is. In this case, there seems to be a contradiction. * To go to Alan’s point, if something is complete and accurate, do we really need to verify it? That may be the cause of confusion here. One way to reconcile this – look to the identity space. There are three levels of identify assurance levels, you have been identity-proofed, but to what degree have you been identity-proofed? Using the terms true, complete, and free of error can scale. If GAC reps were here, would be asking them the question about identity verification since those definitions support a degree or range. * What is a specified standard? BC reps are concerned with actual registrant accuracy – in other words, is the data accurate for that particular registrant? There are many instances of identity theft, and this is a big problem. * This is not for assignments 1 and 2 – that is for later assignments. There is a difference b/w what members want accuracy to look like vs. what it does look like. In reading the definition, read the first and second part together – accuracy is generally […], but registration data accuracy is being defined […]. * Would it be possible to engage with the BC to see if the definition provides a current vs. future state – is this something the BC could live with – but under the specified standard, the BC finds it unacceptable for the following reason. The specified standard gives the group the flexibility to scale this to the future. What this specified standard is will become clearer through best practices through – and this allows it to grow and evolve over time. * Where does the second sentence originate from? * This text originally came from the RySG and NCSG added some language * There is a distinction between the absolute text – the group talks about validation and verification are not specifically defined * Is it possible to note how the group understands what these terms to mean – validation and verification rather than cite a specific source * Propose not to agonize over the definitions – just cite what is in the RAA * Confirm next steps * Due to lack of homework, the same assignments will be extended (for the final time) until next week 1. Write up for Section 2.1.2 – Measurement of whether current goals are met (see https://docs.google.com/document/d/1CYs9mLHsKcZevmZtFrQBDXbv_nkQ5PKe/edit [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1CYs9mLHsKcZe…>) (15 minutes) * Review input received * Confirm next steps 1. Confirm action items & next meeting (Thursday 2 June at 14.00 UTC)

1 0

Post call | Registration Data Accuracy Scoping Team | Thursday, 26 May 2022
by Terri Agnew May 26, 2022

May 26, 2022

Dear all, All recordings for the Registration Data Accuracy Scoping Team held on Thursday, 26 May 2022 can be found on the agenda wiki page <https://community.icann.org/x/UA51Cw> (attendance included) and the GNSO Master Calendar <https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> . These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-accuracy-st/> and the main wiki page<https://community.icann.org/x/hQIuCg>. Thank you! Kind Regards, Terri

1 0

Meeting invitation | Registration Data Accuracy Scoping Team | Thursday, 02 June 2022 at 14:00 UTC
by Terri Agnew May 26, 2022

May 26, 2022

Dear all, The Registration Data Accuracy Scoping Team meeting is scheduled on Thursday, 02 June 2022 at 14:00 UTC for 90 minutes. Please click the link below to join the webinar: https://icann.zoom.us/j/94504686990?pwd=MWc2eXZENk9yN0RqOUUzaGx2eGV0QT09<https://urldefense.com/v3/__https:/icann.zoom.us/j/94504686990?pwd=MWc2eXZE…> Passcode: Vc#0B7$pu8 For Audio only: Or One tap mobile : US: +13017158592,,94504686990#,,,,*4631547480# or +13126266799,,94504686990#,,,,*4631547480# Webinar ID: 945 0468 6990 Passcode: 4631547480 International numbers available: https://icann.zoom.us/u/akRu7JTFd <https://urldefense.com/v3/__https:/icann.zoom.us/u/akRu7JTFd__;!!PtGJab4!pY…> If this is your first time with Zoom, please take a look here: Welcome to Zoom <https://urldefense.com/v3/__https:/gnso.icann.org/sites/default/files/polic…> Members, participants, alternates and observers all have different access and participation directions, please read below! ALL: Before joining the call * Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> * Visit the Wiki agenda page: https://community.icann.org/x/Ug51Cw * Check your time zone: https://tinyurl.com/mryna7dx ONLY for Members and Alternates * Please join via the above Main Zoom Webinar link and staff will promote you to panelist. * Please select Everyone, when posting to the chat in order for everyone to see and so it is captured in the recording. * Alternate replacement confirmations – In order to keep track of alternate replacements, use the google form <https://urldefense.com/v3/__https:/forms.gle/GZqMAi4kKDaVP5o66__;!!PtGJab4!…> to communicate who the alternate is replacing and for which period. This information will be publicly posted so that the Team is aware at any time who is active. Alternate Assignment –wiki page<https://community.icann.org/x/-wC7Cg>. Only for Observers: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Terri

1 0

**starting in 15 minutes | Meeting invitation | Registration Data Accuracy Scoping Team | Thursday, 26 May 2022 at 14:00 UTC
by Terri Agnew May 26, 2022

May 26, 2022

Dear all, The Registration Data Accuracy Scoping Team meeting is scheduled on Thursday, 26 May 2022 at 14:00 UTC for 90 minutes. Please click the link below to join the webinar: https://icann.zoom.us/j/94504686990?pwd=MWc2eXZENk9yN0RqOUUzaGx2eGV0QT09<https://urldefense.com/v3/__https:/icann.zoom.us/j/94504686990?pwd=MWc2eXZE…> Passcode: Vc#0B7$pu8 For Audio only: Or One tap mobile : US: +13017158592,,94504686990#,,,,*4631547480# or +13126266799,,94504686990#,,,,*4631547480# Webinar ID: 945 0468 6990 Passcode: 4631547480 International numbers available: https://icann.zoom.us/u/akRu7JTFd <https://urldefense.com/v3/__https:/icann.zoom.us/u/akRu7JTFd__;!!PtGJab4!pY…> If this is your first time with Zoom, please take a look here: Welcome to Zoom <https://urldefense.com/v3/__https:/gnso.icann.org/sites/default/files/polic…> Members, participants, alternates and observers all have different access and participation directions, please read below! ALL: Before joining the call * Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> * Visit the Wiki agenda page: https://community.icann.org/x/UA51Cw * Check your time zone: https://tinyurl.com/2p8eap4f [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/2p8eap4f__;!!PtGJab4!7zTZ97T…> ONLY for Members and Alternates * Please join via the above Main Zoom Webinar link and staff will promote you to panelist. * Please select Everyone, when posting to the chat in order for everyone to see and so it is captured in the recording. * Alternate replacement confirmations – In order to keep track of alternate replacements, use the google form <https://urldefense.com/v3/__https:/forms.gle/GZqMAi4kKDaVP5o66__;!!PtGJab4!…> to communicate who the alternate is replacing and for which period. This information will be publicly posted so that the Team is aware at any time who is active. Alternate Assignment –wiki page<https://community.icann.org/x/-wC7Cg>. Only for Observers: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Terri

1 0

**REMINDER** Meeting invitation | Registration Data Accuracy Scoping Team | Thursday, 26 May 2022 at 14:00 UTC
by Julie Bisland May 25, 2022

May 25, 2022

Dear all, The Registration Data Accuracy Scoping Team meeting is scheduled on Thursday, 26 May 2022 at 14:00 UTC for 90 minutes. Please click the link below to join the webinar: https://icann.zoom.us/j/94504686990?pwd=MWc2eXZENk9yN0RqOUUzaGx2eGV0QT09<https://urldefense.com/v3/__https:/icann.zoom.us/j/94504686990?pwd=MWc2eXZE…> Passcode: Vc#0B7$pu8 For Audio only: Or One tap mobile : US: +13017158592,,94504686990#,,,,*4631547480# or +13126266799,,94504686990#,,,,*4631547480# Webinar ID: 945 0468 6990 Passcode: 4631547480 International numbers available: https://icann.zoom.us/u/akRu7JTFd <https://urldefense.com/v3/__https:/icann.zoom.us/u/akRu7JTFd__;!!PtGJab4!pY…> If this is your first time with Zoom, please take a look here: Welcome to Zoom <https://urldefense.com/v3/__https:/gnso.icann.org/sites/default/files/polic…> Members, participants, alternates and observers all have different access and participation directions, please read below! ALL: Before joining the call * Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> * Visit the Wiki agenda page: https://community.icann.org/x/UA51Cw * Check your time zone: https://tinyurl.com/2p8eap4f [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/2p8eap4f__;!!PtGJab4!7zTZ97T…> ONLY for Members and Alternates * Please join via the above Main Zoom Webinar link and staff will promote you to panelist. * Please select Everyone, when posting to the chat in order for everyone to see and so it is captured in the recording. * Alternate replacement confirmations – In order to keep track of alternate replacements, use the google form <https://urldefense.com/v3/__https:/forms.gle/GZqMAi4kKDaVP5o66__;!!PtGJab4!…> to communicate who the alternate is replacing and for which period. This information will be publicly posted so that the Team is aware at any time who is active. Alternate Assignment –wiki page<https://community.icann.org/x/-wC7Cg>. Only for Observers: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Terri

1 0

Reminder - Homework Due on Thursday
by Michael Palage May 24, 2022

May 24, 2022

Hello All, The use of the High Important “Red Flag”” associated with this email was intention so hopefully everyone will not only read this message, but more importantly take the necessary actions to come prepared for Thursday’s plenary meeting. I believe the Accuracy Scoping Team is being presented with a unique opportunity to provide feedback to ICANN Org prior to its outreach to the European Commission and engagement with the European Data Protection Board. I would encourage every member to engage with their respective stakeholder groups to ensure that we are able to provide ICANN with constructive feedback. If we succeed in helping ICANN Org obtain actionable guidance from the European Data Protection Board, this will be key to the future success of this group in connection with Assignments 3 and 4. Best regards, Michael

1 0

Proposed agenda - Registration Data Accuracy Scoping Team meeting #31 on Thursday 26 May at 14.00 UTC
by Marika Konings May 24, 2022

May 24, 2022

Dear All, Please find below the proposed agenda for the next Registration Data Accuracy Scoping Team meeting which is scheduled for Thursday 26 May at 14.00 UTC. As a reminder: * Scoping Team members to provide an update to their respective stakeholders group with respect to last week’s discussion about the draft EDPB communication, particularly with respect to scenario 2 and a data protection impact assessment (DPIA) of Scenario 2. Please provide any proposed updates by Friday, 27 May. https://docs.google.com/document/d/1rCBaQ175p_VrP6DtxLUuuoO9Uv5C2qp_/edit [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1rCBaQ175p_Vr…> * Scoping Team members to review all comments received on the write-up and propose compromise language in comments form (where applicable) in advance of next week's call (by Wednesday, 25 May). https://docs.google.com/document/d/13sP-2z7rusEYrDyntrgm-tcIavPMJndU/edit [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/13sP-2z7rusEY…> * Scoping Team members to review the newly-circulated write up of C.2.2 and propose edits/comments in comment form by Wednesday, 25 May.https://docs.google.com/document/d/1CYs9mLHsKcZevmZtFrQBDXbv_nkQ5PKe/ed… [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1CYs9mLHsKcZe…> by Wednesday, 25 May. Best regards, Caitlin, Berry and Marika Registration Data Accuracy Scoping Team – Meeting #31 Thursday 26 May at 14.00 UTC 1. Welcome & Chair Updates (5 minutes) 2. Scenarios for EDPB - see update from ICANN org (https://mm.icann.org/pipermail/gnso-accuracy-st/2022-May/000444.html) (15 minutes) * Continue review of Scoping Team input (see https://docs.google.com/document/d/1rCBaQ175p_VrP6DtxLUuuoO9Uv5C2qp_/edit) * Confirm next steps 1. Write up for assignments #1 & #2 (see https://docs.google.com/document/d/13sP-2z7rusEYrDyntrgm-tcIavPMJndU/edit) (30 minutes) * Continue review of input received * Confirm next steps 1. Write up for Section 2.1.2 – Measurement of whether current goals are met (see https://docs.google.com/document/d/1CYs9mLHsKcZevmZtFrQBDXbv_nkQ5PKe/edit) (15 minutes) * Review input received * Confirm next steps 1. Confirm action items & next meeting (Thursday 2 June at 14.00 UTC)

1 0

ICANN74 schedule now published
by Terri Agnew May 23, 2022

May 23, 2022

https://www.icann.org/en/announcements/details/schedule-for-icann74-policy-… Dear all, This is the first ever ICANN meeting in hybrid format. Whilst some steps will seem familiar, others are brand new, please read the below carefully before creating your schedule. I MUST REGISTER TODAY FOR ICANN74 INFORMATION Sign into my ICANN Account, or create an account here<https://account.icann.org/login>. Register for ICANN74 by clicking in the ICANN SERVICES menu and selecting Meeting Registration Click on the ICANN74 Registration link. Click here<https://gnso.icann.org/sites/default/files/policy/2021/presentation/instruc…> for detailed instructions. The deadline to register for in-person participation is 8 June 2022 at 23:59 UTC. Before creating my schedule I must read this page carefully, to understand what’s new in the hybrid meeting format: https://74.schedule.icann.org/attend IN-PERSON PRIORITY SEATING GNSO Councilors who confirmed they will be traveling to the Hague: · If you have registered on the ICANN74 Website<https://74.schedule.icann.org/>, you will see the indication that your GNSO Council sessions have already been added to your schedule. GNSO PDP/EPDP/ST/SG/C Members: · If you signed up via the google survey as an active PDP/EPDP/ST/SG/C member, you will automatically be signed up to that session. · If you have not yet signed up to attend ICANN74, have not responded to the surveys sent by gnso-secs, and you will be attending on-site, please only select sessions that you will be attending as an active member or participant CAN I CREATE MY MEETING SCHEDULE NOW? * Please choose carefully when signing up for sessions—seating space is limited and the goal is to prioritize the sessions you will actively participate in * Upon accessing the schedule, I will be asked to confirm whether I’m attending remotely or on-site. * If I’m participating remotely, all good, please proceed to access to the ICANN74 schedule: https://74.schedule.icann.org/. * If I’m participating on-site, I must only attend the sessions in which I am an active participant. Please read the https://74.schedule.icann.org/attend page if you are unsure. Please proceed to access to the ICANN74 schedule: https://74.schedule.icann.org/. * Please remember, for security purposes, participation links will be posted 24-hours prior to the session start times. There will be no calendar invitations sent, as the meeting schedule allows you to download all sessions of interest to you, to your individual calendars Review the Participation Tools and update Zoom * All sessions will use Zoom rooms. Access details are available 24hrs prior on the ICANN74 Meeting Schedule<https://74.schedule.icann.org/>. * Visit the Participation Tools page<https://74.schedule.icann.org/participation-tools> for links to download the latest version of Zoom for access to the ICANN74 sessions. * Please see the ICANN Meeting Virtual Participation How-To Guide<https://74.schedule.icann.org/attend> for more information on how to get the most out of the virtual meeting tools. Links to Bookmark ICANN74 Meeting Schedule<https://74.schedule.icann.org/> GNSO ICANN74 Wiki Page<https://community.icann.org/x/vhN1Cw> GNSO Session agendas<https://community.icann.org/x/vBN1Cw> For all GNSO meeting-related queries (RP or others), please email us at: gnso-secs(a)icann.org and we will be more than happy to assist! Kind regards, GNSO SO/AC Support team

1 0

Notes and action items - RDA Scoping Team Meeting #30 - 19 May 2022
by Caitlin Tubergen May 19, 2022

May 19, 2022

Dear RDA Scoping Team Members, Please find below the notes and action items from today’s meeting. The next meeting will be Thursday, 26 May at 14:00 UTC. Best regards, Marika, Berry, and Caitlin -- Action Items 1. Brian G. to inquire with ICANN org colleagues if there is any update or further information that can be provided regarding the status of the DPA during the next meeting on Thursday, 26 May. 2. Scoping Team members to provide an update to their respective stakeholders group with respect to today's discussion about the draft EDPB communication, particularly with respect to scenario 2 and a data protection impact assessment (DPIA) of Scenario 2. Please provide any proposed updates by Friday, 27 May. https://docs.google.com/document/d/1rCBaQ175p_VrP6DtxLUuuoO9Uv5C2qp_/edit 3. Policy Support Staff to incorporate changes agreed to during today's call into the write-up of assignments 1 and 2 by Friday, 20 May. 4. Scoping Team members to review all comments received on the write-up and propose compromise language in comments form (where applicable) in advance of next week's call (by Wednesday, 25 May). https://docs.google.com/document/d/13sP-2z7rusEYrDyntrgm-tcIavPMJndU/edit 5. Scoping Team members to review the newly-circulated write up of C.2.2 and propose edits/comments in comment form by Wednesday, 25 May. https://docs.google.com/document/d/1CYs9mLHsKcZevmZtFrQBDXbv_nkQ5PKe/edit by Wednesday, 25 May. Registration Data Accuracy Scoping Team – Meeting #30 Thursday 19 May at 14.00 UTC 1. Welcome & Chair Updates (5 minutes) * ICANN74 tentative agenda (see https://community.icann.org/x/KRR1Cw) & registration for session * If any members plan to attend ICANN74 in person, please register and reserve your spot for the session – please check your email, as the information has been sent to the list. 2. Scenarios for EDPB - see update from ICANN org (https://mm.icann.org/pipermail/gnso-accuracy-st/2022-May/000444.html) (15 minutes) * Review Scoping Team input (see https://docs.google.com/document/d/1rCBaQ175p_VrP6DtxLUuuoO9Uv5C2qp_/edit [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1rCBaQ175p_Vr…>) * There was a comment from ICANN org, and it seems to change the overall area for discussion and may change earlier comments from others. Can the group get clarification? Specifically, the document starts off with scenarios with EDPB, and some of the scenarios don’t seem to need permission – that seems to change the scope of the document. The document seems to be going in two different directions – what is this document for? * ICANN was instructed to go and think about scenarios and steps that it could take in furtherance of registration data accuracy – Org looked at what it can do under the current agreements and policies. If the group wants ICANN to look at scenarios that are outside of what it can do under the current agreements and policies, ICANN can do that, but started with what it believes it can do. * This does not address the concern as this was driven by the board’s request to see what could possibly be done in the future. * The ultimate consumer of the data is not the registrars and not ICANN org, so the gold standard is to ask the requestors what they want and need. Asking ICANN org to come up with scenarios should be a proxy for asking what the ultimate consumers of the data should want. Looking at the contract, it’s understandable why that is a focus, but it is, at most, secondary, as it doesn’t describe what could or should be done. * Not suggesting that ICANN should act beyond its current remit – the document was confusing because there is a number of scenarios, and there are scenarios for processing of non-personal data, but it’s good to understand that only the scenarios that involve the processing of personal data would be sent to the EDPB. The second scenario seems the most relevant here. * There are 4 scenarios in the document: * Scenario 1: Analyze publicly available registration data for syntactical and operational accuracy (as was done previously in the WHOIS ARS program). * Scenario 2: Analyze a sample of full registration data provided by registrars to ICANN org. * Scenario 3: Proactive Contractual Compliance audit of registrar compliance with registration data validation and verification requirements. * Scenario 4: Registrar registration data accuracy survey (voluntary). * Do any members believe there are any scenarios missing from this list? * Two scenarios were added by a member: * Restarting the ARS with the same sampling methodolgy as before, but requiring Registrars to provide the full set of contact information (clearly in an automated way). ICANN would have to specify how long the information would be kept and in detail how and by whom it would be processed. * A complete or partial retrieval of contact info on a registrar by registra basis (essentially an accuracy audit) with anaylsis similar to that used in the ARS. * These example scenarios that were added seem to fall under Scenario 2. The first is ARS and the second is similar to ARS – both involve ICANN processing data that is sent to it. * One scenario the group had talked about is instead of doing a survey of all of the data, the group talked about doing a survey on domain names that are subject to DAAR reporting. If the group does not provide the specificity of a sample of registration data, the EDPB may say that ICANN trying to survey all 200+ MM names would probably not suffice under Art. 6; however, if there is a narrower scoping, that may be more acceptable. There could be more scoping on the sampling. * Supportive of ICANN meeting its compliance needs, but concerned with the group getting too in the weeds with what ICANN needs to do to meet its needs, and the community does not direct ICANN compliance – ICANN needs to evaluate its own legitimate interests. The group should be careful about telling ICANN what it needs to do since these are questions from ICANN, not the community. * It would be shortsighted to miss the opportunity to ask questions of the EDPB based upon work and subject matter that this group has been deliberating for the last eight months. * The group needs to appreciate its roles and responsibilities as parties – there is a lot of work going on these types of issues. Not saying not to ask questions; rather, thank you, ICANN, for asking these questions. However, this seems to be an ICANN internal risk evaluation. This group can say what we think ICANN’s role is and what is needed to process data properly, but wanted to make the point that ICANN should be careful about saying what Compliance’s job is. (in other words, support this outreach, without directing) * What happens if we, this team, agree on a set of questions the team would like asked? If we forward these to ICANN org as part of their engagement with the EPDB but not presupposing on behalf of ICANN org, and ICANN org chooses not to include them. The question is – is ICANN not including the questions, does this team send its own communication to the EDPB? * Perhaps deal with this if it happens. This is a confrontation b/w the team, ICANN org, and the GNSO. ARS is not a compliance issue, so we are not looking at this from a compliance perspective. GDPR does not allow ICANN to do what it did before. Four years into this process, ICANN org has chosen not to go to the EPDB to see if it can continue its work is its choice. We should ask these questions. * We are still dealing with the same data from registrars, and now we are looking at a small subset of what we are doing to discuss the data. ICANN is meant to specify business processes. It is unclear what role ICANN wants to play. EDPB will likely give ICANN the same response – do your homework – write up the processes and your role. EPDB is not legal counsel for ICANN. These are questions for ICANN to answer, and those who believe we should not direct ICANN to answer specific questions are spot on. * As part of the last guidance of “do your homework,” do you believe having a DPA b/w ICANN and CPs is a prerequisite to that homework assignment before the EPDB can further opine? * The first thing that would need to be done is to do a DPIA, and would ask ICANN org if there is a DPIA. * Within this communication, ICANN notes it is planning to do a DPIA on at least one of the scenarios – scenario 2 * Given the discussion about the broad breadth of scenario 2, could ICANN consult with the community about the specificity of scenario 2 before a DPIA is undertaken? * In sending this request to this team, ICANN is looking for this team’s input on these scenarios. Hoping to get some input or specific links to compliance would be helpful to include. * Believe the two added scenarios are very different – one is a sample based on randomness or DAAR and the other is a registrar audit that could, in theory, request all of the data. The terms that would ultimately have to go into the RAA to allow those would be quite different. The group will have to a lot of homework on this. Because the impacts on privacy may be different depending on what the group does, the group will need to be very specific. * The group has veered from the assignment – focus on the scenarios that ICANN has requested input on and not get into too much detail here. A DPIA would be great, but that is a different assignment than reviewing scenarios that are to be sent to the EDPB. * Perhaps the group pause on this analysis today and each group go back with respect to Scenario 2 with a further level of detail, acknowledging that ICANN org is doing a DPIA on Scenario 2 * It could also be useful to know the status with respect to controllership agreements – that could change the whole picture. We know there is supposed to be negotiations with respect to the Phase 1 implementations and this would be useful in understanding the overall picture. * Action Item: ICANN org to report back on the status of the DPA negotiations. * This seems tangential to the discussion of accuracy. Controllership is not relevant to accuracy. This does not give the group a picture of the status of accuracy. Who the controller is does not inform on the accuracy levels – these two questions should be separate. * If the group is going to look at what actions ICANN org can take, then the controllership questions are relevant to the EDPB. * Encourage all members to go back to their respective stakeholder groups and update them on today’s conversation, specifically the potential DPIA on Scenario 2. * The original deadline was 23 May – is more time needed, and if so, how much more time is needed? * One more week would be helpful. This concept of engagement with the EDPB was introduced to the group at ICANN73. * In terms of timing, the questions are being drafted and the discussion and input on the scenarios is an important part of that – goal is to submit these as soon as possible, though there is some prep work that needs to get done so they are received in the most effective manner and that may involve conversations with members of the EC. It seems that asking the questions is part of the DPIA in a sense, but to the extent that it makes sense to go to the EDPB with a DPIA in hand is a reasonably good suggestion and could be done rather quickly. * What definition of accuracy would the group like to use – is it the existing definition in the RAA or is it a new definition? * Scenario 2 – the response or input we get could be broad enough to cover Org for edge or sub-scenarios * The DPIA should flow easily from the chosen scenario(s) * Confirm next steps 1. Write up for assignments #1 & #2 (see https://docs.google.com/document/d/13sP-2z7rusEYrDyntrgm-tcIavPMJndU/edit[d…<https://urldefense.com/v3/__https:/docs.google.com/document/d/13sP-2z7rusEY…>) (30 minutes) * Review input received * Suggest removing “of particular relevance” * No objection to removing this from the group * Agreement to strike this comment - how certain Registry Operators as part of ICANN's compliance audit have had to provide proof of Registrant verification. If we are looking to provide a complete and accurate snapshot of our work I think it would be prudent to include in this section * To mirror what is found in other sections, pulling out and highlighting certain sections may place more weight on them than is intended. Viewing the information in full, on the other hand, is preferable. All of the information from Compliance was helpful – proposal to remove bullets and cite the full compliance response. * Agree that the full document should be cited; however, an obscure pointer to the document is unhelpful – it’s preferred to include the salient references. * Could the group consider leaving the bullets as they are but including the full compliance response as an annex, rather than just a link? * The language should be high-level – there is a reference in the second bullet to V1 and V2 – these should be stricken for the sake of readability * Are there any objections to striking references to V1 and V2? * There may be confusion here since V1 and V2 may come from the original question that was asked. Perhaps removing these references may be sufficient to avoid this confusion. * Suggestion to keep the word willfully as that is part of the RAA. * Suggestion to defer this discussion until next week. * Please look at the document and weigh in before the next call, particularly if there is a middle ground proposal. * Also shared a write up for C.2.2. – please put questions or concerns in the form of comments. * Confirm next steps 1. Write up for Section 2.1.2 – Measurement of whether current goals are met (see https://docs.google.com/document/d/1CYs9mLHsKcZevmZtFrQBDXbv_nkQ5PKe/edit [docs.google.com]<https://docs.google.com/document/d/1CYs9mLHsKcZevmZtFrQBDXbv_nkQ5PKe/edit%2…>) (15 minutes) * Review input received * Confirm next steps 1. Confirm action items & next meeting (Thursday 26 May at 14.00 UTC)

1 0