Dear All, Please find below the notes and action items from today’s Registration Data Accuracy Scoping Team meeting. Best regards, Caitlin, Berry and Marika -- Action Items 1. Leadership team to further consider proposal to pull the hard data out of the gap analysis input received to allow for review and discussion by the Scoping Team during upcoming leadership meeting. 2. RDA Scoping Team to review ICANN org’s recent memo on the Whois Accuracy Reporting System (Whois ARS) and identify any follow up questions. Please see email here: https://mm.icann.org/pipermail/gnso-accuracy-st/2022-January/000236.html. 3. Still Outstanding: By Wednesday, 2 February, Scoping Team to consider what is needed and from whom to obtain information identified as necessary to measure whether current goals are met. Additionally, scoping team members to begin identifying specific ways in which measurement can be undertaken.(see https://docs.google.com/document/d/11msexuoqWSUsFj8ZjVvWF-XHpcMJntWH/edit?pli=1#<https://docs.google.com/document/d/11msexuoqWSUsFj8ZjVvWF-XHpcMJntWH/edit?pli=1>). Notes & Action items Registration Data Accuracy Scoping Team meeting on 27 January 2022 1. Welcome & Chair Updates (5 minutes) * Assignment 1 write up * Staff support team has started working on a write up of assignment #1 and #2, reflecting deliberations to date. * Intent is to have a report on these assignments to the GNSO Council by ICANN73. * Group is close on completing assignment #1 and hopefully progress can be made on assignment #2 in the coming weeks. 1. Gap Analysis (10 minutes) * Finalize review of input: https://docs.google.com/document/d/11msexuoqWSUsFj8ZjVvWF-XHpcMJntWH/edit<https://urldefense.com/v3/__https:/docs.google.com/document/d/11msexuoqWSUsFj8ZjVvWF-XHpcMJntWH/edit__;!!PtGJab4!r_-svEbvWWgmlFzJnSKLRxlvWc0ydXljTRQZepcSHUeS1WxP5FS9Dn0UbahbaeOOnK1I1tI$> * Scoping team input * Confirm next steps * BC input was provided since last review of the gap analysis – see https://docs.google.com/document/d/11msexuoqWSUsFj8ZjVvWF-XHpcMJntWH/edit?pl... Discussion on entry 1. * How is the BC statement a goal of accuracy? Isn’t this information that belongs on a web-site? * Given that this has been a difficult area for discussion, what if there would be a differentiation between those who make the information available and those who do not? If you ask for the information, you are either provided that info or you are not. You can make your decision on whether you want to do business with them based on that response. If that information would be available for people to view (whether information is shared) would that help? If one needs to reach out proactively before making that decision, instead of being able to view that web-site, may not happen. Registrant information is critical to those who protect the internet, even if most registrants may not look for that information. * How could this change under current GDPR guidance? * There is value to having data for research but under GDPR this has become more difficult. Not necessarily related to the accuracy conversation. Availability may not be part of the scope of this effort. * Focus seems to be on access to data not the accuracy of the data. * Per phase 1 report, registrants have the option to publish their data so those looking to build trust and provide a mechanism for people to see who is behind a site they have the ability to do so. * SSL certs may give more sense of comfort of who you are doing business with instead of Whois data. * Although contactability is not the same as accuracy, there is a correlation – if you don’t have accurate data, you are not able to contact someone. * Upcoming ICANN meeting will also talk about compromised vs. malicious registrations – in both those cases the accuracy of the data plays a role, either to be able to warn the registrant or to be able to assess that there may be an issue if the data is inaccurate. * First need to gather evidence that there is an issue with accuracy that justifies policy work. Need to focus on accuracy, not the purposes of Whois. * Need to be able to assess what the status is of accuracy post-GDPR as before that it was the #1 complaint received by ICANN Compliance. * Documenting and fact finding sooner rather than later is key. * We cannot see accuracy as distant from purposes – need to look at it holistically. If you have context of contactability, you need to assess whether the data is accurate to serve that purpose. Instructions also note that EPDP purposes can be considered. * GDPR should not be blamed for inaccessibility of data – it puts into place safeguards for data processing, it does not prohibit processing of personal data. It only relates to natural persons. * Lack of access to data does not prove that data is more accurate, still complaints. * If inaccurate data is hindering contactability, that is a problem and in scope of group’s work, but this should not be seen as the same as access to the data. Being able to contact the registrant, either via a web form or email is already required and revisiting that requirement is out of scope, but if a registrant is not contactable as a result of inaccurate data that is within scope. In addition, there is also a requirement to have an abuse contact. * Current use of web-forms does not guarantee delivery, is dependent on registrar to deliver. This is an access / disclosure issue, not an accuracy issue. Discussion on entry 2. * Note that ARS was undertaken until 2018 so updated info is available. Discussion on entry 3. * Should data be validated before disclosure – is the intent that the data is formatted properly, or is the suggestion to have it verified? This would delay the disclosure process. Is that something that has been considered as in the case of verification the registrant has 15 days to respond. It would also call attention to the registrant that his/her information is being queried. If a registrar has a 30 day turnaround time, it may not impact the overall timeline for disclosure? But good point that would need further consideration if it is to be further pursued. Discussion on entry 4. * None GAC input questions * By how and by whom can it be measured: what is the relevance of SAC058? Even though it is not recent, it is still considered valid by the GAC. * Have been doing best to find reports and data to corroborate arguments, such as most recent ARS report and the Interisle study, but there are then questions raised about the validity of these. Need to have constructive discussion on what data is accepted / recognized. Would also like to see data that points to the contrary. * Section 7.3.2 of RAA – example was perceived by some as contrary, but need to take everything into account including ICANN Bylaw requirement. Some would like some follow up discussion on the holistic aspect. Not about dictating an outcome, but it is about taking an open approach and making sure that whole picture is known. For example, there may be specific accuracy requirements in certain legislations that are not known. * Suggestion – now that homework has been completed on the gap analysis, would it be possible for the staff team to go through and pick out the specific references to evidence / reports of data. Put the data in front of everyone and talk about it. Action item: Leadership team to further consider proposal to pull the hard data out of the gap analysis input received to allow for review and discussion by the Scoping Team during upcoming leadership meeting. 1. Measurement of accuracy (60 minutes) – (20 minutes) * Review ICANN Org Memo – ARS Overview<https://community.icann.org/download/attachments/184996761/ICANN%20Org%20Mem...> * Overview of memo provided by ICANN org * Q & A * Different layers to it, understanding a snapshot, what are the measures to put in place to improve or assure that registration data is accurate. Both important aspects of the scoping team’s work – what are the accuracy levels currently, what are the current requirements and are those being met, are there ways to improve on it. * Regarding the costs – each of these ARS studies averaged 200,000 – 250,000 USD. While that is not insignificant but if you compare this to other expenses it may not be outrageous or prohibitive as many did see value in ARS. * ICANN org does need to be in compliance with GDPR and work with its CPs to make sure that data can be processed in a legal fashion. Most recently adjustments have been made in the context of DAAR for access to data, so there is precedent for having this type of negotiations. * There is a lot of flux in data protection legislation such as for example international transfers but a lot is being done in the business world to adjust to those new regimes. Why are hands being thrown up instead of trying to find work arounds? * If there are further questions from the group on the memo, please put these in writing so that ICANN org can take these back. * Lack of data processing terms and conditions between ICANN org and CP is an hinderance. Action item: Team members to review ARS memo and identify any further follow up questions they may have. * Review input received on google doc<https://urldefense.com/v3/__https:/docs.google.com/document/d/11msexuoqWSUsF...>, see page 25 - How and by whom can it be measured whether current goal(s) of existing accuracy requirements are met? * Confirm next steps 1. Confirm action items & next meeting (Thursday 3 February at 14.00 UTC)