May 2022 - GNSO-Accuracy-ST

Post call | Registration Data Accuracy Scoping Team | Thursday, 19 May 2022
by Terri Agnew May 19, 2022

May 19, 2022

Dear all, All recordings for the Registration Data Accuracy Scoping Team held on Thursday, 19 May 2022 can be found on the agenda wiki page <https://community.icann.org/x/Tg51Cw> (attendance included) and the GNSO Master Calendar <https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> . These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-accuracy-st/> and the main wiki page<https://community.icann.org/x/hQIuCg>. Thank you! Kind Regards, Terri

1 0

Meeting invitation | Registration Data Accuracy Scoping Team | Thursday, 26 May 2022 at 14:00 UTC
by Terri Agnew May 19, 2022

May 19, 2022

Dear all, The Registration Data Accuracy Scoping Team meeting is scheduled on Thursday, 26 May 2022 at 14:00 UTC for 90 minutes. Please click the link below to join the webinar: https://icann.zoom.us/j/94504686990?pwd=MWc2eXZENk9yN0RqOUUzaGx2eGV0QT09<https://urldefense.com/v3/__https:/icann.zoom.us/j/94504686990?pwd=MWc2eXZE…> Passcode: Vc#0B7$pu8 For Audio only: Or One tap mobile : US: +13017158592,,94504686990#,,,,*4631547480# or +13126266799,,94504686990#,,,,*4631547480# Webinar ID: 945 0468 6990 Passcode: 4631547480 International numbers available: https://icann.zoom.us/u/akRu7JTFd <https://urldefense.com/v3/__https:/icann.zoom.us/u/akRu7JTFd__;!!PtGJab4!pY…> If this is your first time with Zoom, please take a look here: Welcome to Zoom <https://urldefense.com/v3/__https:/gnso.icann.org/sites/default/files/polic…> Members, participants, alternates and observers all have different access and participation directions, please read below! ALL: Before joining the call * Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> * Visit the Wiki agenda page: https://community.icann.org/x/UA51Cw * Check your time zone: https://tinyurl.com/2p8eap4f ONLY for Members and Alternates * Please join via the above Main Zoom Webinar link and staff will promote you to panelist. * Please select Everyone, when posting to the chat in order for everyone to see and so it is captured in the recording. * Alternate replacement confirmations – In order to keep track of alternate replacements, use the google form <https://urldefense.com/v3/__https:/forms.gle/GZqMAi4kKDaVP5o66__;!!PtGJab4!…> to communicate who the alternate is replacing and for which period. This information will be publicly posted so that the Team is aware at any time who is active. Alternate Assignment –wiki page<https://community.icann.org/x/-wC7Cg>. Only for Observers: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Terri

1 0

**Starting in 15 minutes | Meeting invitation | Registration Data Accuracy Scoping Team | Thursday, 19 May 2022 at 14:00 UTC
by Terri Agnew May 19, 2022

May 19, 2022

**Starting in 15 minutes Dear all, The Registration Data Accuracy Scoping Team meeting is scheduled on Thursday, 19 May 2022 at 14:00 UTC for 90 minutes. Please click the link below to join the webinar: https://icann.zoom.us/j/94504686990?pwd=MWc2eXZENk9yN0RqOUUzaGx2eGV0QT09<https://urldefense.com/v3/__https:/icann.zoom.us/j/94504686990?pwd=MWc2eXZE…> Passcode: Vc#0B7$pu8 For Audio only: Or One tap mobile : US: +13017158592,,94504686990#,,,,*4631547480# or +13126266799,,94504686990#,,,,*4631547480# Webinar ID: 945 0468 6990 Passcode: 4631547480 International numbers available: https://icann.zoom.us/u/akRu7JTFd <https://urldefense.com/v3/__https:/icann.zoom.us/u/akRu7JTFd__;!!PtGJab4!pY…> If this is your first time with Zoom, please take a look here: Welcome to Zoom <https://urldefense.com/v3/__https:/gnso.icann.org/sites/default/files/polic…> Members, participants, alternates and observers all have different access and participation directions, please read below! ALL: Before joining the call * Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> * Visit the Wiki agenda page: https://community.icann.org/x/Tg51Cw * Check your time zone: https://tinyurl.com/bdfzehsp [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/bdfzehsp__;!!PtGJab4!9F6r5S4…> ONLY for Members and Alternates * Please join via the above Main Zoom Webinar link and staff will promote you to panelist. * Please select Everyone, when posting to the chat in order for everyone to see and so it is captured in the recording. * Alternate replacement confirmations – In order to keep track of alternate replacements, use the google form <https://urldefense.com/v3/__https:/forms.gle/GZqMAi4kKDaVP5o66__;!!PtGJab4!…> to communicate who the alternate is replacing and for which period. This information will be publicly posted so that the Team is aware at any time who is active. Alternate Assignment –wiki page<https://community.icann.org/x/-wC7Cg>. Only for Observers: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Terri

1 0

**REMINDER** Meeting invitation | Registration Data Accuracy Scoping Team | Thursday, 19 May 2022 at 14:00 UTC
by Julie Bisland May 18, 2022

May 18, 2022

Dear all, The Registration Data Accuracy Scoping Team meeting is scheduled on Thursday, 19 May 2022 at 14:00 UTC for 90 minutes. Please click the link below to join the webinar: https://icann.zoom.us/j/94504686990?pwd=MWc2eXZENk9yN0RqOUUzaGx2eGV0QT09<https://urldefense.com/v3/__https:/icann.zoom.us/j/94504686990?pwd=MWc2eXZE…> Passcode: Vc#0B7$pu8 For Audio only: Or One tap mobile : US: +13017158592,,94504686990#,,,,*4631547480# or +13126266799,,94504686990#,,,,*4631547480# Webinar ID: 945 0468 6990 Passcode: 4631547480 International numbers available: https://icann.zoom.us/u/akRu7JTFd <https://urldefense.com/v3/__https:/icann.zoom.us/u/akRu7JTFd__;!!PtGJab4!pY…> If this is your first time with Zoom, please take a look here: Welcome to Zoom <https://urldefense.com/v3/__https:/gnso.icann.org/sites/default/files/polic…> Members, participants, alternates and observers all have different access and participation directions, please read below! ALL: Before joining the call * Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> * Visit the Wiki agenda page: https://community.icann.org/x/Tg51Cw * Check your time zone: https://tinyurl.com/bdfzehsp [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/bdfzehsp__;!!PtGJab4!9F6r5S4…> ONLY for Members and Alternates * Please join via the above Main Zoom Webinar link and staff will promote you to panelist. * Please select Everyone, when posting to the chat in order for everyone to see and so it is captured in the recording. * Alternate replacement confirmations – In order to keep track of alternate replacements, use the google form <https://urldefense.com/v3/__https:/forms.gle/GZqMAi4kKDaVP5o66__;!!PtGJab4!…> to communicate who the alternate is replacing and for which period. This information will be publicly posted so that the Team is aware at any time who is active. Alternate Assignment –wiki page<https://community.icann.org/x/-wC7Cg>. Only for Observers: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Terri

1 0

Proposed Agenda - Registration Data Accuracy Scoping Team meeting #30 on Thursday 19 May at 14.00 UTC
by Marika Konings May 17, 2022

May 17, 2022

Dear All, Please find below the proposed agenda for the next Registration Data Accuracy Scoping Team meeting which is scheduled for Thursday 19 May at 14.00 UTC. As a reminder: * Please review the EDPB Scenarios document and provide any further input / suggestions / questions prior to the meeting (see https://docs.google.com/document/d/1rCBaQ175p_VrP6DtxLUuuoO9Uv5C2qp_/edit) * Please review the input that has been provided on the write up for assignments #1 and #2 and indicate if you support or have concerns about suggestions put forward to facilitate review during Thursday’s meeting, if you have not done so yet (see https://docs.google.com/document/d/13sP-2z7rusEYrDyntrgm-tcIavPMJndU/edit) * Please review the proposed write up for section 2.1.2 and flag in the form of comments any concerns and/or suggested edits you may have (see https://docs.google.com/document/d/1CYs9mLHsKcZevmZtFrQBDXbv_nkQ5PKe/edit) Best regards, Caitlin, Berry and Marika Registration Data Accuracy Scoping Team – Meeting #30 Thursday 19 May at 14.00 UTC 1. Welcome & Chair Updates (5 minutes) * ICANN74 tentative agenda (see https://community.icann.org/x/KRR1Cw) & registration for session 2. Scenarios for EDPB - see update from ICANN org (https://mm.icann.org/pipermail/gnso-accuracy-st/2022-May/000444.html) (15 minutes) * Review Scoping Team input (see https://docs.google.com/document/d/1rCBaQ175p_VrP6DtxLUuuoO9Uv5C2qp_/edit) * Confirm next steps 1. Write up for assignments #1 & #2 (see https://docs.google.com/document/d/13sP-2z7rusEYrDyntrgm-tcIavPMJndU/edit) (30 minutes) * Review input received * Confirm next steps 1. Write up for Section 2.1.2 – Measurement of whether current goals are met (see https://docs.google.com/document/d/1CYs9mLHsKcZevmZtFrQBDXbv_nkQ5PKe/edit) (15 minutes) * Review input received * Confirm next steps 1. Confirm action items & next meeting (Thursday 26 May at 14.00 UTC)

1 0

For your review - section C.2.2. Measurement of whether current goals are met
by Marika Konings May 16, 2022

May 16, 2022

Dear All, As discussed, the staff support team has created proposed language for section C.2.2.” Measurement of whether current goals are met” which can be found here: https://docs.google.com/document/d/1CYs9mLHsKcZevmZtFrQBDXbv_nkQ5PKe/edit. This is for the moment a standalone document, but once review has been finalized it will be integrated into the write up for assignments #1 and #2. Please include any comments or proposed edits you may have IN COMMENT FORM ONLY. Thanks, Caitlin, Berry and Marika From: GNSO-Accuracy-ST <gnso-accuracy-st-bounces(a)icann.org> on behalf of Caitlin Tubergen <caitlin.tubergen(a)icann.org> Date: Thursday, 12 May 2022 at 19:37 To: "gnso-accuracy-st(a)icann.org" <gnso-accuracy-st(a)icann.org> Subject: [GNSO-Accuracy-ST] Notes and action items - RDA Scoping Team Meeting #29 - 12 May 2022 Dear RDA Scoping Team members, Please find below the notes and action items from today’s meeting. Best regards, Marika, Berry, and Caitlin -- 1. Support Staff to translate today’s discussion of proposals into text for the write-up. 2. Support Staff to convert the draft message to the EDPB into a Google Doc [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1rCBaQ175p_Vr…> for further feedback from the group. Support Staff to include the feedback already provided by individuals. (Note: ideally, the group can provide a unified response to ICANN org regarding how this communication to the EPDB could assist in the Scoping Team's work.) 3. 🚨🚨 Important note: Scoping Team members to provide feedback to the draft write-up [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/13sP-2z7rusEY…> IN COMMENTS FORM ONLY. 🚨🚨 Registration Data Accuracy Scoping Team – Meeting #29 Thursday 12 May at 14.00 UTC 1. Welcome & Chair Updates (5 minutes) * Project Change Request submitted to the GNSO Council (see https://mm.icann.org/pipermail/council/2022-May/025662.html) - For those interested, please review the link above. * ICANN74 session scheduled for Tuesday 14 June from 11.15 – 12.30 UTC (13.15 – 14.30 local time) - Pre-registration is required, and details regarding this will be published shortly. 1. Gap Analysis Data Collection Proposals that do not involve access to registration data (30 minutes)(see https://docs.google.com/document/d/1sScP8MwgDCg4yvFNAYwQVql7DQob60vX/edit [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1sScP8MwgDCg4…>) - The work is currently focused on proposals that do not involve access to non-public registration data. - One proposal being explored is to do an ICANN compliance audit – with that in mind, the group posed some initial questions to compliance - Two colleagues from compliance have joined the call today to answer the group’s questions - At the end of the review of these proposals, the group should consider if there is a recommendation for a consideration of the proposal and why or why not. a. Proposal D - Registrar Audit * Opportunity to discuss further with ICANN Compliance · Compliance developed a written response, which includes multiple options: · Auditing without personal information – this would be limited to requesting information regarding the processes registrars use for the verification and validation requirement · Based on input from the EDPB or similar authorities, Compliance would be more certain what it is allowed to do. It is correct that you can get redacted data in response to a complaint or inquiry (3.4) but not related to a compliance audit. Further information is necessary in terms of what could be asked for in an audit. · If Compliance sends an inquiry or questionnaire, this is not a true audit. A true audit is when data is verified against substantive information. · Based on this information from Compliance, would an audit like this be helpful for the group in Assignments 3 and 4? · In doing these audits, does ICANN send tailored questions based on the respective business model that the registrar is operating (retail, wholesale, etc.)? If there is only one template, how are differences accounted for? · When audit questions are sent to contracted parties, the questions are not tailored to specific business models. · Follow-up questions may be sent based on the registrar’s initial responses. For example, if there is an obligation to send a reminder to a registrant regarding the expiration of a domain, and a registrar says, “our resellers do this,” Compliance would say – please show examples of this. Compliance would not contact the reseller directly since ICANN does not have a contractual relationship with the reseller. · Does Compliance attempt any verification that the registrar is indeed telling the truth? · Under the current scenario, compliance is not in a position to measure the accuracy of data; what they could do is audit registrars to confirm if their obligations are being followed under the Accuracy Spec. Not sure how this would be helpful for assignments 3 and 4 – the measurement of accuracy. At most, this seems tangential to the task at hand. · If a DPA is asked whether ICANN has the authority to measure accuracy, then you have to follow the purpose you have stated. Data commissioners have been clear that ICANN does not have a mandate to do criminal investigation. It seems that this group is attempting to get greater accuracy in the data – it will be difficult to find a purpose here. · Just because a name has been taken out of the zone, the harmed individual may still want to seek redress and seek the underlying information · This group has not discussed criminal investigation. Registrars have made it clear that they have no need for the information in RDDS. It is clear that under the current understanding of GDPR regulations and the contract, ICANN does not have the authority to ask for information other than in pursuing a complaint. · In the course of Compliance doing its work, does Compliance end up in a dead end – is there something that would position compliance to do its job better? · During audits, prior to GDPR, Compliance would validate and verify every field in the RDDS b/c Compliance had access to it – phone number, mailing address, etc. · As auditors, Compliance audits the data it has access to. · What the group is talking about is what suggestions the group can make – the previous question from the chair was a leading question. The group hasn’t identified gaps yet. · In the previous era, during an audit, ICANN might choose to verify data it had access to. Would like to presume that ICANN was not frivolously wasting time by verifying data – if they used to audit data and now they cannot, that is a substantive change. This is important information to this group. · ICANN was previously in denial of all data protection law, so past procedures cannot be presumed to have been justified. · GDPR does not prevent ICANN from doing its job, but the job is not impossible. · Do any members believe there is value in pursuing this proposal further? · Interpreting silence as no interest in moving forward with this proposal * Proposal A - Registrar Survey * Went into this thinking it could be a useless endeavor, but after working with the small team, think this could produce value. Maybe it would not be the highest value, but believe it should be considered * This is really dependent on the quality of responses – would need to be one person per company * Is there a way to create uniform clear messages for registrars to respond to? * Could the survey focus on the steps registrars take to ensure the data is accurate? Perhaps it’s a two-part survey, where questions from the first round could help inform the second round of questions. * Proposal E – Review of Accuracy Complaints * Looking at existing complaints is only a small piece of the puzzle; however, do not have a suggestion of what data the group could get out of this * If there some notation that could be put in the report to put a pin in this and come back after assignments 3 and 4 * There does not appear to be strong support to move forward with these initiatives * The group can indicate that these are proposals that were considered, but the group is not sure if these proposals would produce valuable data for assignments 3 and 4. If the group, based on all of the proposals, is not sure if this is worth the effort, the Council could say – there is nothing to move forward with at this stage. How can the group get to assignment 3 since it was designed to be informed by a factual analysis that includes data. * There is nothing to say the group cannot bring something back to the table, but as of right now, it seems like review of accuracy complaints is a dead end. * Confirm next steps * Support Staff will translate today’s discussion into text for the write-up. 3. Scenarios for EDPB * See update from ICANN org (https://mm.icann.org/pipermail/gnso-accuracy-st/2022-May/000444.html) * Scoping Team feedback by 23 May * There have been some individual responses; is there interest for the group to work on a common response? That would be ideal from org’s perspective. * Have a hard time understanding why we would ask European data authorities about scenarios 1 and 4. Everyone has access to public data, and 4 does not require access to PII. * Confirm next steps * Support Staff to put email up in Google doc and include comments that were added in the Google doc and encourage everyone to come to a common conclusion. If anyone is willing to take up the pen to draft a response from the group’s perspective, that would also be welcome. 1. Write up for assignments #1 & #2 (see https://docs.google.com/document/d/13sP-2z7rusEYrDyntrgm-tcIavPMJndU/edit[d…<https://urldefense.com/v3/__https:/docs.google.com/document/d/13sP-2z7rusEY…>) (15 minutes) * Review input received * Consider possible recommendations * Confirm next steps 1. ICANN org responses to recent set of questions (see https://mm.icann.org/pipermail/gnso-accuracy-st/2022-April/000398.html) (If follow up questions are identified prior to the meeting) * Reactions / follow up questions * Confirm next steps 1. Confirm action items & next meeting (Thursday 19 May at 14.00 UTC)

1 0

Re: [GNSO-Accuracy-ST] [EXTERNAL] Re: Update and ask for feedback re.scenarios for EDPB
by Elizabeth Bacon May 13, 2022

May 13, 2022

Hi all, Registries agree with the registrar’s comments that time is best spent focusing on specific narrow scenarios and appreciate ICANN's energy and effort to find ways to allow them to effectively measure accuracy against contractual requirements. Thanks, Beth From: GNSO-Accuracy-ST <gnso-accuracy-st-bounces(a)icann.org> on behalf of Sarah Wyld <swyld(a)tucows.com> Date: Friday, May 13, 2022 at 12:53 PM To: Roger D Carney via GNSO-Accuracy-ST <gnso-accuracy-st(a)icann.org> Subject: [EXTERNAL] Re: [GNSO-Accuracy-ST] Update and ask for feedback re.scenarios for EDPB CAUTION: This email came from outside your organization. Don’t trust emails, links, or attachments from senders that seem suspicious or you are not expecting. ________________________________ Thanks Becky. We appreciate the efforts put in to develop these scenarios and find a solution for ICANN Org to be able to measure against existing contractual requirements for Accuracy. In line with your suggestion to narrowly focus the request, we think it would be best to keep to scenarios which require the processing of personal data, as that is within the scope and remit of the data protection authorities. Thank you, -- Sarah Wyld, CIPP/E Policy & Privacy Manager Pronouns: she/they swyld(a)tucows.com<mailto:swyld@tucows.com> [cid:image004.png@01D866C8.3A23D9B0] From: Becky Burr via GNSO-Accuracy-ST<mailto:gnso-accuracy-st@icann.org> Sent: May 10, 2022 9:50 AM To: Volker Greimann<mailto:volker.greimann@centralnic.com>; Brian Gutterman<mailto:brian.gutterman@icann.org> Cc: gnso-accuracy-st(a)icann.org<mailto:gnso-accuracy-st@icann.org>; Elena Plexida<mailto:elena.plexida@icann.org> Subject: Re: [GNSO-Accuracy-ST] Update and ask for feedback re.scenarios for EDPB IMHO (and not speaking for the Board) we should not ask the EDPB to consider scenarios that members of the Scoping team, SOs, or ACs believe will not produce reliable information about the nature and volume of inaccuracy that may exist in the data set. J. Beckwith Burr HARRIS, WILTSHIRE & GRANNIS LLP 1919 M Street NW/8th Floor Washington DC 20036 202.730.1316 (P) 202.352.6367 (M) From: GNSO-Accuracy-ST <gnso-accuracy-st-bounces(a)icann.org> on behalf of Volker Greimann <volker.greimann(a)centralnic.com> Sent: Tuesday, May 10, 2022 2:47:48 AM To: Brian Gutterman Cc: gnso-accuracy-st(a)icann.org; Elena Plexida Subject: Re: [GNSO-Accuracy-ST] Update and ask for feedback re. scenarios for EDPB Hi Brian, I think you may be overextending the reach of section 3.4.3 a bit there. This section clearly points out: "Registrar shall deliver copies of such data, information and records to ICANN in respect to limited transactions or circumstances that may be the subject of a compliance-related inquiry" So in other words, this section does not apply if it is not a compliance matter. No compliance case = no data under 3.4.3 Also note the further restrictions contained in the section that essentially note that registrars may supply redacted data if they believe data protection laws prevent them from disclosing unredacted data: "In the event Registrar believes that the provision of any such data, information or records to ICANN would violate applicable law or any legal proceedings, ICANN and Registrar agree to discuss in good faith whether appropriate limitations, protections, or alternative solutions can be identified to allow the production of such data, information or records in complete or redacted form, as appropriate." Finally, note that ICANN is prohibited from disclosing any parts of the data obtained in this way unless required to do so, essentially rendering any data obtained useless for the purposes of this group: "ICANN shall not disclose the content of such data, information or records except as expressly required by applicable law, any legal proceeding or Specification or Policy." In other words, 3.4.3 is a specifically tailored tool designed exclusively for ICANN compliance to investigate compliance matters and is not suited for the purpose of measuring accuracy overall. Best, -- Volker A. Greimann General Counsel and Policy Manager KEY-SYSTEMS GMBH T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net<http://www.key-systems.net> Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358. This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached. On Mon, May 9, 2022 at 7:49 PM Brian Gutterman <brian.gutterman(a)icann.org<mailto:brian.gutterman@icann.org>> wrote: Dear Colleagues of the Accuracy Scoping Team, As you are aware, at ICANN73 the ICANN Board requested that ICANN org<https://mm.icann.org/pipermail/gnso-accuracy-st/2022-March/000336.html> prepare a number of specific scenarios for which it will consult the European Data Protection Board on whether or not ICANN org has a legitimate purpose that is proportionate, i.e. not outweighed by the privacy rights of the individual data subjects, to request that contracted parties provide access to registration data records. In follow-up to those discussions, my ICANN org colleagues have provided this update and request for feedback for the Accuracy Scoping Team. ICANN org’s approach to this exercise is set out in greater detail below. Understanding that the team has identified additional input from regulators as potentially useful for its work, we request your feedback, to ensure that this exercise is seeking out information that would further your efforts. As we’ve seen with previous engagements, we want to caution that feedback or guidance received from regulators, if any, would not be immediate. While ICANN org will pursue this as expeditiously as practicable, we would encourage the team to keep the uncertain timeline for a response in mind. If you could please provide your feedback by 23 May that would be appreciated. Current Status ICANN org will be reaching out to the European Commission for help with introducing the issue of registration data accuracy and, in particular, steps that can be taken within the boundaries of the GDPR, to the level of the European Data Protection Board. The European Commission previously committed to facilitate exchanges, whereas the Belgian DPA told us our issues were better addressed at the EDPB level. We are hopeful that the Commission will help. ICANN org has also considered steps that could be taken now, under the current agreements and policies, with regard to requesting registration data from registrars for the purposes of assessing accuracy. The Registrar Accreditation Agreement, at Section 3.3.4, states (emphasis added): “During the Term of this Agreement and for two (2) years thereafter, Registrar shall make the data, information and records specified in this Section 3.4 available for inspection and copying by ICANN upon reasonable notice. In addition, upon reasonable notice and request from ICANN, Registrar shall deliver copies of such data, information and records to ICANN in respect to limited transactions or circumstances that may be the subject of a compliance-related inquiry; provided, however, that such obligation shall not apply to requests for copies of the Registrar's entire database or transaction history.” Thus, while ICANN org can request targeted records from registrars, a registrar is not required to provide ICANN org with access to its entire registration database, irrespective of whether or not this would be acceptable under the GDPR. As a result, ICANN org believes that any efforts in furtherance of registration data accuracy at this stage would involve evaluating (Scenario 1) publicly-available registration data (the benefits of which may be limited, given that much of the registrant contact data is now redacted), or (Scenario 2) some subset of full registration data provided by registrars. Under this Scenario 2, ICANN org would need to identify the appropriate mechanism for choosing a sample of registration data to analyze. To ensure this sampling falls within the RAA’s restrictions concerning a registrar’s provision of records to ICANN org, a sample should be related to “limited transactions or circumstances that may be the subject of a compliance-related inquiry.” One approach would be to identify a specific subset of registration data that may be of particular interest or concern. If the team has specific views on this aspect of the scenario, your feedback is welcomed. Alternatively, as explained by Contractual Compliance’s presentation to your team, ICANN org could (Scenario 3) conduct an audit concerning registrars’ compliance with registration data validation and verification requirements in the RAA’s WHOIS Accuracy Program Specification, or (Scenario 4) conduct a voluntary survey of registrars concerning registration data accuracy. A survey, as discussed by the scoping team, could request that registrars provide information about their registration data validation and verification processes, including information about how many domains have registration data that is validated and verified, how many domains have data that is currently in the verification process, how many domains are suspended due to non-verification, and for a rate of email bounces for WHOIS Data Reminder Policy Notices sent out during a set time period. Notably, these scenarios 3 and 4 would assess registrars’ compliance with procedures designed to ensure the contactability of registrants, but compliance with these procedures does not necessarily guarantee that all the data is “accurate.” To summarize, the scenarios ICANN org is exploring at this stage are: Scenario 1: Analyze publicly available registration data for syntactical and operational accuracy (as was done previously in the WHOIS ARS program). Scenario 2: Analyze a sample of full registration data provided by registrars to ICANN org. Scenario 3: Proactive Contractual Compliance audit of registrar compliance with registration data validation and verification requirements. Scenario 4: Registrar registration data accuracy survey (voluntary). In parallel to this initial outreach to the European Commission, ICANN org will assess the data protection implications of the scenarios identified above, with the aim of submitting data protection-related questions concerning any of the above scenarios to regulators for guidance. Feedback received from the accuracy scoping team will help to inform ICANN’s outreach concerning the data protection implications of further steps ICANN org could take in furtherance of registration data accuracy, so that we can better understand the information the accuracy scoping team would find beneficial for its work. If you believe other scenarios should be considered or identify other issues that may be relevant to this analysis, please let us know. We are requesting that you please provide your feedback no later than 23 May so that we have it available before we complete our initial analysis. Best, Brian _______________________________________________ GNSO-Accuracy-ST mailing list GNSO-Accuracy-ST(a)icann.org<mailto:GNSO-Accuracy-ST@icann.org> https://mm.icann.org/mailman/listinfo/gnso-accuracy-st<https://mm.icann.org/mailman/listinfo/gnso-accuracy-st> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://www.icann.org/privacy/policy>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://www.icann.org/privacy/tos>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

1 0

Update and ask for feedback re. scenarios for EDPB
by Brian Gutterman May 13, 2022

May 13, 2022

Dear Colleagues of the Accuracy Scoping Team, As you are aware, at ICANN73 the ICANN Board requested that ICANN org<https://mm.icann.org/pipermail/gnso-accuracy-st/2022-March/000336.html> prepare a number of specific scenarios for which it will consult the European Data Protection Board on whether or not ICANN org has a legitimate purpose that is proportionate, i.e. not outweighed by the privacy rights of the individual data subjects, to request that contracted parties provide access to registration data records. In follow-up to those discussions, my ICANN org colleagues have provided this update and request for feedback for the Accuracy Scoping Team. ICANN org’s approach to this exercise is set out in greater detail below. Understanding that the team has identified additional input from regulators as potentially useful for its work, we request your feedback, to ensure that this exercise is seeking out information that would further your efforts. As we’ve seen with previous engagements, we want to caution that feedback or guidance received from regulators, if any, would not be immediate. While ICANN org will pursue this as expeditiously as practicable, we would encourage the team to keep the uncertain timeline for a response in mind. If you could please provide your feedback by 23 May that would be appreciated. Current Status ICANN org will be reaching out to the European Commission for help with introducing the issue of registration data accuracy and, in particular, steps that can be taken within the boundaries of the GDPR, to the level of the European Data Protection Board. The European Commission previously committed to facilitate exchanges, whereas the Belgian DPA told us our issues were better addressed at the EDPB level. We are hopeful that the Commission will help. ICANN org has also considered steps that could be taken now, under the current agreements and policies, with regard to requesting registration data from registrars for the purposes of assessing accuracy. The Registrar Accreditation Agreement, at Section 3.3.4, states (emphasis added): “During the Term of this Agreement and for two (2) years thereafter, Registrar shall make the data, information and records specified in this Section 3.4 available for inspection and copying by ICANN upon reasonable notice. In addition, upon reasonable notice and request from ICANN, Registrar shall deliver copies of such data, information and records to ICANN in respect to limited transactions or circumstances that may be the subject of a compliance-related inquiry; provided, however, that such obligation shall not apply to requests for copies of the Registrar's entire database or transaction history.” Thus, while ICANN org can request targeted records from registrars, a registrar is not required to provide ICANN org with access to its entire registration database, irrespective of whether or not this would be acceptable under the GDPR. As a result, ICANN org believes that any efforts in furtherance of registration data accuracy at this stage would involve evaluating (Scenario 1) publicly-available registration data (the benefits of which may be limited, given that much of the registrant contact data is now redacted), or (Scenario 2) some subset of full registration data provided by registrars. Under this Scenario 2, ICANN org would need to identify the appropriate mechanism for choosing a sample of registration data to analyze. To ensure this sampling falls within the RAA’s restrictions concerning a registrar’s provision of records to ICANN org, a sample should be related to “limited transactions or circumstances that may be the subject of a compliance-related inquiry.” One approach would be to identify a specific subset of registration data that may be of particular interest or concern. If the team has specific views on this aspect of the scenario, your feedback is welcomed. Alternatively, as explained by Contractual Compliance’s presentation to your team, ICANN org could (Scenario 3) conduct an audit concerning registrars’ compliance with registration data validation and verification requirements in the RAA’s WHOIS Accuracy Program Specification, or (Scenario 4) conduct a voluntary survey of registrars concerning registration data accuracy. A survey, as discussed by the scoping team, could request that registrars provide information about their registration data validation and verification processes, including information about how many domains have registration data that is validated and verified, how many domains have data that is currently in the verification process, how many domains are suspended due to non-verification, and for a rate of email bounces for WHOIS Data Reminder Policy Notices sent out during a set time period. Notably, these scenarios 3 and 4 would assess registrars’ compliance with procedures designed to ensure the contactability of registrants, but compliance with these procedures does not necessarily guarantee that all the data is “accurate.” To summarize, the scenarios ICANN org is exploring at this stage are: Scenario 1: Analyze publicly available registration data for syntactical and operational accuracy (as was done previously in the WHOIS ARS program). Scenario 2: Analyze a sample of full registration data provided by registrars to ICANN org. Scenario 3: Proactive Contractual Compliance audit of registrar compliance with registration data validation and verification requirements. Scenario 4: Registrar registration data accuracy survey (voluntary). In parallel to this initial outreach to the European Commission, ICANN org will assess the data protection implications of the scenarios identified above, with the aim of submitting data protection-related questions concerning any of the above scenarios to regulators for guidance. Feedback received from the accuracy scoping team will help to inform ICANN’s outreach concerning the data protection implications of further steps ICANN org could take in furtherance of registration data accuracy, so that we can better understand the information the accuracy scoping team would find beneficial for its work. If you believe other scenarios should be considered or identify other issues that may be relevant to this analysis, please let us know. We are requesting that you please provide your feedback no later than 23 May so that we have it available before we complete our initial analysis. Best, Brian

5 5

Notes and action items - RDA Scoping Team Meeting #29 - 12 May 2022
by Caitlin Tubergen May 13, 2022

May 13, 2022

Dear RDA Scoping Team members, Please find below the notes and action items from today’s meeting. Best regards, Marika, Berry, and Caitlin -- 1. Support Staff to translate today’s discussion of proposals into text for the write-up. 2. Support Staff to convert the draft message to the EDPB into a Google Doc<https://docs.google.com/document/d/1rCBaQ175p_VrP6DtxLUuuoO9Uv5C2qp_/edit> for further feedback from the group. Support Staff to include the feedback already provided by individuals. (Note: ideally, the group can provide a unified response to ICANN org regarding how this communication to the EPDB could assist in the Scoping Team's work.) 3. 🚨🚨 Important note: Scoping Team members to provide feedback to the draft write-up<https://docs.google.com/document/d/13sP-2z7rusEYrDyntrgm-tcIavPMJndU/edit> IN COMMENTS FORM ONLY. 🚨🚨 Registration Data Accuracy Scoping Team – Meeting #29 Thursday 12 May at 14.00 UTC 1. Welcome & Chair Updates (5 minutes) * Project Change Request submitted to the GNSO Council (see https://mm.icann.org/pipermail/council/2022-May/025662.html) * For those interested, please review the link above. * ICANN74 session scheduled for Tuesday 14 June from 11.15 – 12.30 UTC (13.15 – 14.30 local time) * Pre-registration is required, and details regarding this will be published shortly. 1. Gap Analysis Data Collection Proposals that do not involve access to registration data (30 minutes)(see https://docs.google.com/document/d/1sScP8MwgDCg4yvFNAYwQVql7DQob60vX/edit [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1sScP8MwgDCg4…>) * The work is currently focused on proposals that do not involve access to non-public registration data. * One proposal being explored is to do an ICANN compliance audit – with that in mind, the group posed some initial questions to compliance * Two colleagues from compliance have joined the call today to answer the group’s questions * At the end of the review of these proposals, the group should consider if there is a recommendation for a consideration of the proposal and why or why not. a. Proposal D - Registrar Audit * Opportunity to discuss further with ICANN Compliance * Compliance developed a written response, which includes multiple options: * Auditing without personal information – this would be limited to requesting information regarding the processes registrars use for the verification and validation requirement * Based on input from the EDPB or similar authorities, Compliance would be more certain what it is allowed to do. It is correct that you can get redacted data in response to a complaint or inquiry (3.4) but not related to a compliance audit. Further information is necessary in terms of what could be asked for in an audit. * If Compliance sends an inquiry or questionnaire, this is not a true audit. A true audit is when data is verified against substantive information. * Based on this information from Compliance, would an audit like this be helpful for the group in Assignments 3 and 4? * In doing these audits, does ICANN send tailored questions based on the respective business model that the registrar is operating (retail, wholesale, etc.)? If there is only one template, how are differences accounted for? * When audit questions are sent to contracted parties, the questions are not tailored to specific business models. * Follow-up questions may be sent based on the registrar’s initial responses. For example, if there is an obligation to send a reminder to a registrant regarding the expiration of a domain, and a registrar says, “our resellers do this,” Compliance would say – please show examples of this. Compliance would not contact the reseller directly since ICANN does not have a contractual relationship with the reseller. * Does Compliance attempt any verification that the registrar is indeed telling the truth? * Under the current scenario, compliance is not in a position to measure the accuracy of data; what they could do is audit registrars to confirm if their obligations are being followed under the Accuracy Spec. Not sure how this would be helpful for assignments 3 and 4 – the measurement of accuracy. At most, this seems tangential to the task at hand. * If a DPA is asked whether ICANN has the authority to measure accuracy, then you have to follow the purpose you have stated. Data commissioners have been clear that ICANN does not have a mandate to do criminal investigation. It seems that this group is attempting to get greater accuracy in the data – it will be difficult to find a purpose here. * Just because a name has been taken out of the zone, the harmed individual may still want to seek redress and seek the underlying information * This group has not discussed criminal investigation. Registrars have made it clear that they have no need for the information in RDDS. It is clear that under the current understanding of GDPR regulations and the contract, ICANN does not have the authority to ask for information other than in pursuing a complaint. * In the course of Compliance doing its work, does Compliance end up in a dead end – is there something that would position compliance to do its job better? * During audits, prior to GDPR, Compliance would validate and verify every field in the RDDS b/c Compliance had access to it – phone number, mailing address, etc. * As auditors, Compliance audits the data it has access to. * What the group is talking about is what suggestions the group can make – the previous question from the chair was a leading question. The group hasn’t identified gaps yet. * In the previous era, during an audit, ICANN might choose to verify data it had access to. Would like to presume that ICANN was not frivolously wasting time by verifying data – if they used to audit data and now they cannot, that is a substantive change. This is important information to this group. * ICANN was previously in denial of all data protection law, so past procedures cannot be presumed to have been justified. * GDPR does not prevent ICANN from doing its job, but the job is not impossible. * Do any members believe there is value in pursuing this proposal further? * Interpreting silence as no interest in moving forward with this proposal * Proposal A - Registrar Survey * Went into this thinking it could be a useless endeavor, but after working with the small team, think this could produce value. Maybe it would not be the highest value, but believe it should be considered * This is really dependent on the quality of responses – would need to be one person per company * Is there a way to create uniform clear messages for registrars to respond to? * Could the survey focus on the steps registrars take to ensure the data is accurate? Perhaps it’s a two-part survey, where questions from the first round could help inform the second round of questions. * Proposal E – Review of Accuracy Complaints * Looking at existing complaints is only a small piece of the puzzle; however, do not have a suggestion of what data the group could get out of this * If there some notation that could be put in the report to put a pin in this and come back after assignments 3 and 4 * There does not appear to be strong support to move forward with these initiatives * The group can indicate that these are proposals that were considered, but the group is not sure if these proposals would produce valuable data for assignments 3 and 4. If the group, based on all of the proposals, is not sure if this is worth the effort, the Council could say – there is nothing to move forward with at this stage. How can the group get to assignment 3 since it was designed to be informed by a factual analysis that includes data. * There is nothing to say the group cannot bring something back to the table, but as of right now, it seems like review of accuracy complaints is a dead end. * Confirm next steps * Support Staff will translate today’s discussion into text for the write-up. 3. Scenarios for EDPB * See update from ICANN org (https://mm.icann.org/pipermail/gnso-accuracy-st/2022-May/000444.html) * Scoping Team feedback by 23 May * There have been some individual responses; is there interest for the group to work on a common response? That would be ideal from org’s perspective. * Have a hard time understanding why we would ask European data authorities about scenarios 1 and 4. Everyone has access to public data, and 4 does not require access to PII. * Confirm next steps * Support Staff to put email up in Google doc and include comments that were added in the Google doc and encourage everyone to come to a common conclusion. If anyone is willing to take up the pen to draft a response from the group’s perspective, that would also be welcome. 1. Write up for assignments #1 & #2 (see https://docs.google.com/document/d/13sP-2z7rusEYrDyntrgm-tcIavPMJndU/edit[d…<https://urldefense.com/v3/__https:/docs.google.com/document/d/13sP-2z7rusEY…>) (15 minutes) * Review input received * Consider possible recommendations * Confirm next steps 1. ICANN org responses to recent set of questions (see https://mm.icann.org/pipermail/gnso-accuracy-st/2022-April/000398.html) (If follow up questions are identified prior to the meeting) * Reactions / follow up questions * Confirm next steps 1. Confirm action items & next meeting (Thursday 19 May at 14.00 UTC)

2 1

Post call | Registration Data Accuracy Scoping Team | Thursday, 12 May 2022
by Terri Agnew May 12, 2022

May 12, 2022

Dear all, All recordings for the Registration Data Accuracy Scoping Team held on Thursday, 12 May 2022 can be found on the agenda wiki page <https://community.icann.org/x/TA51Cw> (attendance included) and the GNSO Master Calendar <https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> . These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-accuracy-st/> and the main wiki page<https://community.icann.org/x/hQIuCg>. Thank you! Kind Regards, Terri

1 0