- Gnso-epdp-legal - lists.icann.org

Post Call | EPDP-Phase 2A - Legal Sub-team call | Tuesday, 13 April 2021 at 14:00 UTC
by Andrea Glandon April 13, 2021

April 13, 2021

Dear all, All recordings for the EPDP-Phase 2A - Legal Sub-team call held on Tuesday, 13 April 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/OIaUCQ> (attendance included) and the GNSO Master Calendar [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…>. These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) As a reminder only members or alternates replacing members as primary can join the call. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-legal/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. Kind regards, Andrea

1 0

Proposed agenda - EPDP Phase 2A Legal Committee Meeting #12
by policy＠bacinblack.com April 12, 2021

April 12, 2021

Dear EPDP Phase 2A Legal Committee, Please find below the proposed agenda for tomorrow’s Legal Committee Meeting. EPDP Phase 2A Legal Committee – Meeting #12 Proposed Agenda Tuesday 13 April 2021 at 14.00 UTC 1. Roll Call & SOI Updates 2. Review Legal Guidance Received ( <https://go.icann.org/3mq0Dmi> https://go.icann.org/3mq0Dmi) a. Question 4 (regarding options for contact address masking) * Legal Committee Discussion * Follow-up questions/clarifications necessary? * Confirm next steps 3. Legal natural Comparison Discussion a. Legal natural - write up legal guidance comparison: https://docs.google.com/document/d/1DeGhK8hSKPbGG9Iao7IQIk9cvK-RK5Am21ELHpb… b. Legal vs. Natural write-up: https://docs.google.com/document/d/1OF_bSxXaiGwK_-jWVC8oq-weXMaX7iEVCWWTMhw… c. Prep for plenary 4. Wrap and confirm action items and homework (if any) a. Confirm action items and homework b. Next Legal Committee meeting will be Wednesday, 14 April at 14:00 UTC (if needed)

1 0

Legal natural - write up legal guidance comparison
by policy＠bacinblack.com April 12, 2021

April 12, 2021

Dear Legal Committee, As discussed during last week's meeting, the Staff Support Team has attempted to compare and contrast the current version of the legal/natural guidance write up with the responses received from Bird & Bird to be able to identify where there is consistency as well as areas for possible enhancement. The idea is that this table would also facilitate further consideration by the full EPDP Team on if/how the guidance write up should be modified (see questions in column 3). Please focus your review on column 1 and 2 in order to identify if there are any parts of the Bird & Bird responses that should be called out. Do note that as there is overlap between some of the scenarios, any guidance flagged for scenario 1 is also applicable for the same language in scenario 2 and 3 (but may not have been specifically repeated). Of course, if there are any further questions that should be considered by the full EPDP Team, please feel free to suggest those as well. Legal natural - write up legal guidance comparison: https://docs.google.com/document/d/1DeGhK8hSKPbGG9Iao7IQIk9cvK-RK5Am21ELHpb9 21Y/edit#heading=h.gjdgxs Legal vs. Natural write-up: https://docs.google.com/document/d/1OF_bSxXaiGwK_-jWVC8oq-weXMaX7iEVCWWTMhw9 Jyg/edit#heading=h.gjdgxs Thank you. Caitlin, Marika and Berry Berry Cobb GNSO Policy Consultant Principal | <http://bacinblack.com/> BAC in Black Consulting Mob: +1 (720) 839-5735 <https://twitter.com/berrycobb> <https://www.linkedin.com/in/berrycobb/>

1 0

Post Call | EPDP-Phase 2A - Legal Sub-team call | Thursday, 08 April 2021 at 14:00 UTC
by Terri Agnew April 8, 2021

April 8, 2021

Dear all, All recordings for the EPDP-Phase 2A - Legal Sub-team call held on Thursday, 08 April 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/NIaUCQ> (attendance included) and the GNSO Master Calendar [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…>. These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) As a reminder only members or alternates replacing members as primary can join the call. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-legal/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. Kind regards, Terri

1 0

Proposed agenda - EPDP Phase 2A Legal Committee Meeting #10
by Caitlin Tubergen April 7, 2021

April 7, 2021

Dear EPDP Phase 2A Legal Committee, Please find below the proposed agenda for tomorrow’s Legal Committee Meeting. EPDP Phase 2A Legal Committee – Meeting #11 Proposed Agenda Thursday 8 April 2021 at 14.00 UTC 1. Roll Call & SOI Updates 2. Review Legal Guidance Received (https://go.icann.org/3mq0Dmi) * Question 1 (comparison of legal risks – consent v. self-identification) * Legal Committee Discussion * Follow-up questions/clarifications necessary? · Confirm next steps * Question 2 (level of risk, likelihood of enforcement actions, fines, counseling, etc. flowing from subsequent inadvertent publication of personal data) * Legal Committee Discussion * Follow-up questions/clarifications necessary? * Confirm next steps 3. Revisit Melina’s proposed question * Legal Committee Discussion – is question still necessary in light of advice already received * Is there legal committee agreement to send this question? * Confirm next steps Would you change or add anything else on your analysis under points 1, 2 and 3 if an additional step is introduced after distinguishing between natural and legal persons, as described in the 2-step approach below? In particular, could you please assess the level of risk (if any) of such approach: a. Step one, allow self-identification of registrant as either natural and legal person. If natural, then full redaction of data remains in place, if legal go to step 2. b. Step 2, Further distinguishing between data of legal persons which contain personal information and data which contain non-personal information. Publish only non- personal information. Please advise on potential further steps that could be taken on how to safely implement such an approach to minimize liability for wrongful disclosure (if different than the steps described above). 4. Wrap and confirm action items and homework (if any) 1. Confirm action items and homework 2. Next Legal Committee meeting will be Tuesday, 13 April at 14:00 UTC

1 0

Updated legal v. natural questions (Melina)
by Caitlin Tubergen April 1, 2021

April 1, 2021

Dear Legal Committee, Thank you to Laureen for working with Melina to edit the highlighted questions in the attached document; as a reminder, the other questions in this document have already been submitted to Bird & Bird – please only review the highlighted questions. We have provided the questions below for ease of reference: 4. Would you change or add anything else on your analysis under points 1, 2 and 3 if an additional step is introduced after distinguishing between natural and legal persons, as described in the 2-step approach below? In particular, could you please assess the level of risk (if any) of such approach: a. Step one, allow self-identification of registrant as either natural and legal person. If natural, then full redaction of data remains in place, if legal go to step 2. b. Enable registrant to further confirm that its provided data contains only non-personal information. c. Step 2, Further distinguishing between data of legal persons which contain personal information and data which contain non-personal information. Publish only non-personal information. Please advise on potential further steps that could be taken on how to safely implement such an approach to minimize liability for wrongful disclosure (if different than the steps described above). Please review Laureen and Melina’s edits and reply via the mailing list by COB Friday, 19 March if you have any proposed edits or concerns. Best regards, Berry, Caitlin, and Marika

4 3

Re: [Gnso-epdp-legal] Updated legal v. natural questions (Melina)
by Caitlin Tubergen March 18, 2021

March 18, 2021

Dear Legal Committee, Apologies for the double email. Please find the slightly adjusted version from Melina below: Would you change or add anything else on your analysis under points 1, 2 and 3 if an additional step is introduced after distinguishing between natural and legal persons, as described in the 2-step approach below? In particular, could you please assess the level of risk (if any) of such approach: a. Step one, allow self-identification of registrant as either natural and legal person. If natural, then full redaction of data remains in place, if legal go to step 2. b. Step 2, Further distinguishing between data of legal persons which contain personal information and data which contain non-personal information. Publish only non-personal information. Please advise on potential further steps that could be taken on how to safely implement such an approach to minimize liability for wrongful disclosure (if different than the steps described above). Please review the edits from the above version and reply via the mailing list by COB Friday, 19 March if you have any proposed edits or concerns. Best regards, Berry, Marika, and Caitlin From: Gnso-epdp-legal <gnso-epdp-legal-bounces(a)icann.org> on behalf of Caitlin Tubergen via Gnso-epdp-legal <gnso-epdp-legal(a)icann.org> Reply-To: Caitlin Tubergen <caitlin.tubergen(a)icann.org> Date: Thursday, March 18, 2021 at 9:05 AM To: "gnso-epdp-legal(a)icann.org" <gnso-epdp-legal(a)icann.org> Subject: [Gnso-epdp-legal] Updated legal v. natural questions (Melina) Dear Legal Committee, Thank you to Laureen for working with Melina to edit the highlighted questions in the attached document; as a reminder, the other questions in this document have already been submitted to Bird & Bird – please only review the highlighted questions. We have provided the questions below for ease of reference: 4. Would you change or add anything else on your analysis under points 1, 2 and 3 if an additional step is introduced after distinguishing between natural and legal persons, as described in the 2-step approach below? In particular, could you please assess the level of risk (if any) of such approach: a. Step one, allow self-identification of registrant as either natural and legal person. If natural, then full redaction of data remains in place, if legal go to step 2. b. Enable registrant to further confirm that its provided data contains only non-personal information. c. Step 2, Further distinguishing between data of legal persons which contain personal information and data which contain non-personal information. Publish only non-personal information. Please advise on potential further steps that could be taken on how to safely implement such an approach to minimize liability for wrongful disclosure (if different than the steps described above). Please review Laureen and Melina’s edits and reply via the mailing list by COB Friday, 19 March if you have any proposed edits or concerns. Best regards, Berry, Caitlin, and Marika

1 0

Post Call | EPDP-Phase 2A - Legal Sub-team call | Tuesday, 16 March 2021 at 14:00 UTC
by Andrea Glandon March 16, 2021

March 16, 2021

Dear all, All recordings for the EPDP-Phase 2A - Legal Sub-team call held on Tuesday, 16 March 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/w4OBCQ> (attendance included) and the GNSO Master Calendar [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…>. These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) As a reminder only members or alternates replacing members as primary can join the call. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-legal/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. Kind regards, Andrea

1 0

Legal Committee Approved and Outstanding questions
by Caitlin Tubergen March 16, 2021

March 16, 2021

Dear Legal Committee, As a reminder, we will discussing Melina’s questions during tomorrow’s meeting. The questions<https://docs.google.com/document/d/1CqczmN_ShkDFgx05q8AyUX5iDM2u5dul/edit> are pasted here for ease of reference (and highlighted in the Google doc in yellow): Would you change or add anything else on your analysis under points 1, 2 and 3 if an additional step is introduced after distinguishing between natural and legal persons, as described in the 2-step approach below? In particular, could you please assess the level of risk (if any) of such approach: a. Distinguishing at first level between natural and legal persons. If natural, then publish no data, if legal go to step 2. b. Further distinguishing between data of legal persons which contain personal information and data which contain non-personal information. Publish only non-personal information. Additionally – and this could be optional – give the possibility to legal persons to publish personal information if they wish so. This aims at protecting, for instance, a case where there is a one person company and their corporate address is the same as the home address. The registrant should have the option on whether they want their home address published. Please advise on further steps to be taken on how to correctly implement such approach (if different than the steps described under points 2-3). -- Additionally, as there were no objections to Becky’s updated Feasibility question<https://docs.google.com/document/d/1UCP86uPZJBA_oh_4lfa6GwisfqnXUgbi5kdq-VO…>, the below question will be sent to Bird & Bird and the EPDP Team (as an FYI). Questions Regarding Feasibility of Unique Contacts B&B’s Memo data 4 February 2020 regarding email contact information discussed two options: (a) a “pseudonymous email contact” where the same unique string is used for multiple registrations by the data subject; and (b) an “anonymous email contact” where a separate unique email string is used for each such registration. B&B opined that publication of either (a) or (b) would be treated as publication of personal data on the web because the purpose of making this masked email address available is to allow 3rd parties to directly contact the data subject and because third parties with legitimate and proportionate interests would have access to the underlying data. Upon review, the EPDP Legal Team has proposed to describe options (a) and (b) going forward as follows: * The phrase "pseudonymous email contact” (option (a)) should be replaced with the phrase "Registrant-based email contact," defined as: “an email for all domains registered by a unique registrant, which is intended to be pseudonymous data when processed by third party users (i.e., non-contracted parties). (The question of whether the email should be common across ICANN-accredited Registrars requires a policy determination TBD.) * The phrase "anonymous email contact" (option (b)) should be replaced with the phrase "Registration-based email contact," defined as “a separate single use email for each domain name registered by a unique registrant, which is intended to be virtually or “essentially” anonymous data when processed by third party users (i.e., non-contracted parties).” In answering the questions below, please assume, for discussion purposes, that third-party users of Registration-based email contact information cannot identify the data subject without disproportionate effort so that the risk of identification appears in reality to be insignificant. 1. Based on your experience and applicable precedent, please compare the level of risk, likelihood of enforcement actions, fines, counseling, etc. associated with (a) publication on the web or (b) automated disclosure of (i) a Registrant-based email contact on the one hand and (ii) a Registration-based email contact on the other? In responding to this question please consider: * Whether the assumed fact that the risk of data subject identification by a third party (i.e., non-contracted party) through a Registration-based email contact appears to be insignificant would render such emails effectively “anonymous” with respect to such third parties under the Breyer standard? * If not, how would the choice of email contact (Registrant-based or Registration-based) affect the outcome of the legitimate interests balancing test under Article 6(1)(f)? To what extent would the use of a Registration-based email contact reduce the impact of publication on the interests or fundamental rights and freedoms of the data subject? Does the answer to these questions change if the primary purpose for publishing a masked email is to support statistical research and analytics, and not to communicate with the data subject? Thank you. Best regards, Berry, Marika, and Caitlin

1 0

Reminder of Action Items
by Caitlin Tubergen March 11, 2021

March 11, 2021

Dear Legal Committee, Please find a reminder of action items<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> below. 1. Becky has updated the Feasibility of Unique Contacts questions (text begins after the table): https://docs.google.com/document/d/1UCP86uPZJBA_oh_4lfa6GwisfqnXUgbi5kdq-VO…. Please review the updated question and provide any strong objection within 24 hours. 1. Reminder to please propose edits/concerns to Melina’s yellow highlighted questions by the end of the week: https://docs.google.com/document/d/1CqczmN_ShkDFgx05q8AyUX5iDM2u5dul/edit. Thank you. Best regards, Berry, Marika, and Caitlin

1 0