October 2018 - Gnso-epdp-team

Please review - action items and outstanding items
by Marika Konings 30 Oct '18

30 Oct '18

Dear EPDP Team, Following this week’s EPDP Team meetings, please find below and attached the outstanding action items and related deadlines, outstanding charter questions (not yet discussed) and punch list of items in relation to the data elements workbooks. Please take note that Staff’s provision of an updated and comprehensive data matrix and updated Initial Report draft is dependent on timely delivery of input on the below items. If you believe anything is missing from the list below, please let us know. Thank you for all your support - safe travels home! Caitlin, Berry and Marika =================== EPDP Team Action items ICANN63 Action item #1 – CPH to confirm whether or not purpose A strikethrough language can be removed by Thursday 25 October. (COMPLETED – deletion of strikethrough language confirmed) Action item #2 - Each group (SG/C/AC) to express the group's views and/or proposed edits on small team #1 responses to charter questions and preliminary recommendations with the mailing list by Monday 29 October. (see https://docs.google.com/document/d/1U6POLQhFNGu1Bo1k0rCluiaVZ27-OKIPpU8K8N1…). Action item #3 - Each group (SG/C/AC) to express the group's views and/or proposed edits on the revised responses of the small team #2 charter question responses with the mailing list by Monday 29 October. (see https://docs.google.com/document/d/1d49LseyUovDVy7NEEUFZk4BtVP_muyLQJR9JRbP…). Action item #4 – Each group (SG/C/AC) to review latest versions of data elements workbooks and flag any issues that need to be reviewed prior to publication of Initial Report by Friday 2 November. (see https://community.icann.org/x/5AC8BQ). Action item #5 – Each group (SG/C/AC) to review the responsible parties overview for all purposes and identify which designations need to be further considered by Monday 29 October. (see https://docs.google.com/document/d/1-rdfchOwpANFVKOtnM_9bPp-zT4JAvTN8dJqebd…) Note: Staff’s provision of an updated and comprehensive data matrix and updated Initial Report draft is dependent on timely delivery of the above feedback. Outstanding Charter Questions (not discussed yet or addressed through ongoing work) q) Sun-setting WHOIS Contractual Requirements q1) After migration to RDAP, when can requirements in the Contracts to use WHOIS protocol be eliminated? q2) If EPDP Team’s decision includes a replacement directory access protocol, such as RDAP, when can requirements in the Contracts to use WHOIS protocol be eliminated? b) Collection of registration data by registrar: b3) How shall legitimacy of collecting data be defined (at least for personal data collected from European registrants and others in jurisdictions with data protection law)? k) ICANN's responsibilities in processing data k2) In addition to any specific duties ICANN may have as data controller, what other obligations should be noted by this EPDP Team, including any duties to registrants that are unique and specific to ICANN’s role as the administrator of policies and contracts governing gTLD domain names? l) Registrar's responsibilities in processing data l4) What are the registrar's responsibilities to the data subject with respect to data processing activities that are under ICANN’s control? m) Registry's responsibilities in processing data m4) What are the registry's responsibilities to the data subject based on the above? Outstanding items in data elements workbooks Purpose B Punch List: * Confirm staff-suggested responses for Purpose Rationale questions * Confirm data elements (note: Purpose B data elements are dependent on the completion of all other workbooks, as Purpose B only references data already collected) Purpose C Punch List: * Confirm staff-suggested response for Purpose Rationale questions * Confirm staff-suggested note re: definition of optional (footnote 2 in workbook) * Confirm data elements Purpose E (Registrar Data Escrow) Punch List: * Confirm Collection Processing Activity (Purpose does not necessarily require collection) * Confirm data elements Purpose F Punch List: * Confirm staff-suggested response for Purpose Rationale questions * Confirm data elements Purpose M Punch List: * Determine inclusion/exclusion of RDDRP, PDDRP, and PICDRP RPMs within the purpose statement (adjust PAs if excluded) * Confirm staff-suggested responses for Purpose Rationale questions * Confirm Processing Activities structure, especially Disclosure and Retention * Confirm Data Elements Purpose N Punch List: * Determine if Purpose Statement is an ICANN Purpose (note Collection PA indicates ICANN as a Joint Controller) * Confirm Processing Activities structure, especially Disclosure and Retention * Confirm Data Element (Other Data) Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

6 8

Location and timing of the next f2f meeting
by Kavouss Arasteh 30 Oct '18

30 Oct '18

Dear Kurt I hope you are well As I informed you at various occasion s I do not wish in no way I miss the next f2f meeting at all Moreover, I have a commitment from 05-13 January 2019 ion Busan Republic of Korea Please kindly note that I CAN NOT Travel to USA as we are under General BAN . Please defend my rights today as I am only under AUDIO BRIDGE Regards Kavouss

2 1

Comment on Small Team #1 doc
by Alan Greenberg 30 Oct '18

30 Oct '18

ALAC Comments on Small Team #1 Charter Responses H3 says that the distinction between natural and legal persons should be allowed but does not address whether the distinction should be required. It should say that it will also be required subject to the implementation subject to the details in the Proposed Preliminary Policy Recommendation. Alan

1 0

Re: [Gnso-epdp-team] [Ext] Re: Please review - action items and outstanding items
by Marika Konings 29 Oct '18

29 Oct '18

Thanks, Matt. In relation to action item #2, would it be possible for the RrSG to provide specific suggestions to how the language could be improved in line with your comments? Best regards, Caitlin, Berry and Marika From: Matt Serlin <matt(a)brandsight.com> Date: Monday, October 29, 2018 at 3:50 PM To: Marika Konings <marika.konings(a)icann.org>, EPDP <gnso-epdp-team(a)icann.org> Subject: [Ext] Re: [Gnso-epdp-team] Please review - action items and outstanding items Dear all, Below are RrSG comments/feedback on each of the requested action items due today: Action Item #2 (legal v. natural persons) – based on the discussions we had in Barcelona, it was our understanding this language was going to continue to be refined due to the many objections raised to it within the larger group. While we do not object to research being done to get additional insights, it’s not clear what specifics we will be soliciting, what the timing of that research will be or ultimately what we will do once we receive that research. There was discussion about further defining the “organization name” field and we believe that should continue to be developed and discussed amongst the group. We also continue to be concerned about the applicability of this distinction to currently registered domain names and the feasibility of how this would be implemented by registrars. Action Item #3 (geographic basis) – we agree with the comments added into the working draft by Kristina and strongly support the comment on the last paragraph of the document by either being deleted or to insert Kristina’s text as noted. Best regards, RrSG ePDP representatives From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Thursday, October 25, 2018 at 7:52 AM To: EPDP <gnso-epdp-team(a)icann.org> Subject: Re: [Gnso-epdp-team] Please review - action items and outstanding items Dear All, Please note an updated link for action item #3 as on the original link the redlines were not visible. Do also note that this version now includes the additional changes that Kristina referred to during the meeting. See https://drive.google.com/a/icann.org/file/d/1tamJeyaq4nC8HHQelSeln_BB8fnVlz… [drive.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__drive.google.com_a_ica…>. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Thursday, October 25, 2018 at 1:29 PM To: EPDP <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Please review - action items and outstanding items Dear EPDP Team, Following this week’s EPDP Team meetings, please find below and attached the outstanding action items and related deadlines, outstanding charter questions (not yet discussed) and punch list of items in relation to the data elements workbooks. Please take note that Staff’s provision of an updated and comprehensive data matrix and updated Initial Report draft is dependent on timely delivery of input on the below items. If you believe anything is missing from the list below, please let us know. Thank you for all your support - safe travels home! Caitlin, Berry and Marika =================== EPDP Team Action items ICANN63 Action item #1 – CPH to confirm whether or not purpose A strikethrough language can be removed by Thursday 25 October. (COMPLETED – deletion of strikethrough language confirmed) Action item #2 - Each group (SG/C/AC) to express the group's views and/or proposed edits on small team #1 responses to charter questions and preliminary recommendations with the mailing list by Monday 29 October. (see https://docs.google.com/document/d/1U6POLQhFNGu1Bo1k0rCluiaVZ27-OKIPpU8K8N1… [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…>). Action item #3 - Each group (SG/C/AC) to express the group's views and/or proposed edits on the revised responses of the small team #2 charter question responses with the mailing list by Monday 29 October. (see https://drive.google.com/a/icann.org/file/d/1tamJeyaq4nC8HHQelSeln_BB8fnVlz… [drive.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__drive.google.com_a_ica…>). Action item #4 – Each group (SG/C/AC) to review latest versions of data elements workbooks and flag any issues that need to be reviewed prior to publication of Initial Report by Friday 2 November. (see https://community.icann.org/x/5AC8BQ). Action item #5 – Each group (SG/C/AC) to review the responsible parties overview for all purposes and identify which designations need to be further considered by Monday 29 October. (see https://docs.google.com/document/d/1-rdfchOwpANFVKOtnM_9bPp-zT4JAvTN8dJqebd… [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…>) Note: Staff’s provision of an updated and comprehensive data matrix and updated Initial Report draft is dependent on timely delivery of the above feedback. Outstanding Charter Questions (not discussed yet or addressed through ongoing work) q) Sun-setting WHOIS Contractual Requirements q1) After migration to RDAP, when can requirements in the Contracts to use WHOIS protocol be eliminated? q2) If EPDP Team’s decision includes a replacement directory access protocol, such as RDAP, when can requirements in the Contracts to use WHOIS protocol be eliminated? b) Collection of registration data by registrar: b3) How shall legitimacy of collecting data be defined (at least for personal data collected from European registrants and others in jurisdictions with data protection law)? k) ICANN's responsibilities in processing data k2) In addition to any specific duties ICANN may have as data controller, what other obligations should be noted by this EPDP Team, including any duties to registrants that are unique and specific to ICANN’s role as the administrator of policies and contracts governing gTLD domain names? l) Registrar's responsibilities in processing data l4) What are the registrar's responsibilities to the data subject with respect to data processing activities that are under ICANN’s control? m) Registry's responsibilities in processing data m4) What are the registry's responsibilities to the data subject based on the above? Outstanding items in data elements workbooks Purpose B Punch List: * Confirm staff-suggested responses for Purpose Rationale questions * Confirm data elements (note: Purpose B data elements are dependent on the completion of all other workbooks, as Purpose B only references data already collected) Purpose C Punch List: * Confirm staff-suggested response for Purpose Rationale questions * Confirm staff-suggested note re: definition of optional (footnote 2 in workbook) * Confirm data elements Purpose E (Registrar Data Escrow) Punch List: * Confirm Collection Processing Activity (Purpose does not necessarily require collection) * Confirm data elements Purpose F Punch List: * Confirm staff-suggested response for Purpose Rationale questions * Confirm data elements Purpose M Punch List: * Determine inclusion/exclusion of RDDRP, PDDRP, and PICDRP RPMs within the purpose statement (adjust PAs if excluded) * Confirm staff-suggested responses for Purpose Rationale questions * Confirm Processing Activities structure, especially Disclosure and Retention * Confirm Data Elements Purpose N Punch List: * Determine if Purpose Statement is an ICANN Purpose (note Collection PA indicates ICANN as a Joint Controller) * Confirm Processing Activities structure, especially Disclosure and Retention * Confirm Data Element (Other Data) Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

**REMINDER** Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 30 October 2018 at 13:00 UTC
by Julie Bisland 29 Oct '18

29 Oct '18

Dear all, Non-members can follow the EPDP call taking place on Tuesday’s and Thursday’s at 13:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/ow68BQ Thank you. Kind Regards, Julie

1 0

Proposed Agenda for EPDP Team meeting - 30 October 2018
by Caitlin Tubergen 29 Oct '18

29 Oct '18

Dear All, Please find below the proposed agenda for our EPDP Team Meeting on Tuesday, 30 October at 1300 UTC. Best regards, Marika, Berry and Caitlin EPDP Meeting #21 Agenda Tuesday, 30 October 2018 Roll Call & SOI Updates (5 minutes) Welcome and Updates from EPDP Team Chair (5 minutes) Recap of ICANN63 meetings Update on F2F planning Review of outstanding action items Other updates, if applicable Purpose M Data Elements Workbook (Resolution of Disputes) Objective of discussion: Determine inclusion/exclusion of RDDRP, PDDRP, and PICDRP RPMs within the purpose statement (adjust PAs if excluded) Confirm staff-suggested responses for Purpose Rationale questions Confirm Processing Activities structure, especially Disclosure and Retention Confirm Data Elements Review Purpose M Data Elements Workbook (see https://community.icann.org/download/attachments/96207076/Purpose%20M%20-%2…) Confirm content of purpose M Data Elements Workbook Confirm next steps, if any Purpose N Data Elements Workbook (Validation of gTLD registration policy eligibility criteria) Objective of discussion: Determine if Purpose Statement is an ICANN Purpose (note Collection PA indicates ICANN as a Joint Controller) Confirm Processing Activities structure, especially Disclosure and Retention Confirm Data Element (Other Data) Review Purpose N Data Elements Workbook (see https://community.icann.org/download/attachments/96207076/Purpose%20N%20-%2…) Confirm content of purpose N Data Elements Workbook Confirm next steps, if any Wrap and confirm next meeting to be scheduled for Thursday 1 October at 13.00 UTC. Confirm action items Confirm questions for ICANN Org, if any

3 2

FW: [gnso-secs] Fwd: Re: Next face-to-face meeting
by Terri Agnew 26 Oct '18

26 Oct '18

Sent on behalf of Ayden. ---------- Forwarded message ---------- From: Ayden Férdeline<icann(a)ferdeline.com<mailto:icann@ferdeline.com>> Date: On Fri, Oct 26, 2018 at 11:33 Subject: Fwd: Re: [Gnso-epdp-team] Next face-to-face meeting To: Kurt Pritz <kurt(a)kjpritz.com<mailto:kurt@kjpritz.com>> Cc: GNSO EPDP <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Hi Kurt, Thanks for sharing this information with us. I tend to think the second week of January would be the best time for this meeting to take place, as we will then be able to review the public comments that have been received on our initial report. Depending on the location of the face-to-face, a meeting in December may be too soon for those who need to apply for a visa. Personally, I am unavailable 3-13 December because of another commitment. But I appreciate we all have many commitments at the moment and it may not be possible to accommodate all of our schedules. Kind regards, Ayden Férdeline On 26 Oct 2018, at 07:48, Kurt Pritz <kurt(a)kjpritz.com<mailto:kurt@kjpritz.com>> wrote: Hi Everyone: Thank you again for your time, effort and thought during the ICANN meeting. While others were visiting the various great sites that Barcelona has to offer, we were all not visiting the various great sites that Barcelona has to offer. Yesterday, I met with Nick Tomasso who heads the ICANN meetings team to develop some options for the next face-to-face meeting. At various times during the past week, many of you approached me with the following points: * Our results are significantly better in a face-to-face format * The proverbial clock is ticking * We should strive to maintain the momentum we have, therefore * We should hold our next meeting as soon as possible. With that in mind, Nick said he could support the following two options, a meeting * In the first or second week in December * In the second or third week of January [Meetings less than 90 days away require Göran's approval, but Nick believes he can obtain this. Nick is checking on venues with which he is familiar in Brussels now, although the meeting location is not certain.] I am of two minds on this but do have an opinion and would appreciate your feedback over the next few days so that I can get back to Nick the first of next week. 1) The January meeting is more or less timed for us to take into account the first round of public comment. 2) Te December meeting allows us to keep working after the initial report is issued (or to wrap up the initial report in the worse case). I think the December meeting is the better option for us. We are not going to stand down after the initial report is issued. There is a lot of work to be done. It is better, I think, to meet and consider unsettled issues, rather than meet to discuss the effect of public comment. If we are serious about finishing on time, I don't think we can stop. So despite the inconvenience (and it will be very inconvenient for me), I think we should meet sooner rather than later. Of course, this all depends on the ICANN meetings team pulling this off, which is no small feat, Let me know your thoughts, I will write to Nick on Tuesday. Best regards, Kurt

1 0

Proposed Agenda for Thursday's EPDP Team meeting
by Marika Konings 24 Oct '18

24 Oct '18

Dear All, Please find below the proposed agenda for Thursday’s EPDP Team Meeting which is scheduled from 8.30 – 10.15. Best regards, Caitlin, Berry and Marika EPDP Team Meeting – 25 October 2018 1. Data redaction (see attached) 2. Review updated timeline to produce Initial Report (see attached) 3. Review Working methods going forward 4. Outstanding action items / charter questions Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Small team #1 draft responses and preliminary recommendations for review
by Marika Konings 24 Oct '18

24 Oct '18

Dear EPDP Team, In preparation for tomorrow’s EPDP Team meeting which will take place from 17.00 – 18.30 (see https://63.schedule.icann.org/meetings/901653), a sub set of small team #1 (legal vs. natural) got together and collaborated on the proposed EPDP Team responses and preliminary recommendations in relation to this topic which you will find below for your consideration. Best regards, Caitlin, Berry and Marika =============== Small Team #1 – Legal vs. Natural Person h) Applicability of Data Processing Requirements – Draft responses h3) Should Contracted Parties be allowed or required to treat legal and natural persons differently, and what mechanism is needed to ensure reliable determination of status? We seem to have agreed that yes, contracted parties should be allowed to treat legal and natural persons differently but the mechanism by which this should or can be done should be further explored. h4) Is there a legal basis for Contracted Parties to treat legal and natural persons differently? We agreed that under GDPR there is a legal basis. While the focus of this EPDP is GDPR compliance, we did note that not all jurisdictions have this same distinction so we have to make sure our policy recommendations are flexible enough to take this into account. h5) What are the risks associated with differentiation of registrant status as legal or natural persons across multiple jurisdictions? (See EDPB letter of 5 July 2018). The main risk seems to be that while legal persons don’t have the same protections under GDPR, natural persons employed by a legal person (and who may be designated as the registrant, admin or technical contact) are still natural persons with rights/protection under GDPR. This risk may be minimized through educational resources as recommended below. [further flesh out risks: James Bladel to provide proposed language] Proposed Preliminary Policy Recommendation for inclusion in the Initial Report The EPDP Team recommends that: * The distinction between legal and natural persons is useful and necessary for GDPR and some other data protection laws. * However, the EPDP Team recognizes that there are challenges in making this distinction in the context of domain name registrations as well as the potential implementation of any new functionality that would apply to pre-existing registrations. * Additionally, other jurisdictions may have other categories of protected groups that would need to be factored in. * The EPDP Team recommends that GDD staff who will be tasked with the implementation of these policy recommendations commence research by investigating how ccTLDs and contracted parties currently distinguish between natural and legal persons to inform the EPDP Team. * Following the receipt of the research, the EPDP Team will explore in a timely manner how this distinction can be made in the context of domain name registrations in a satisfactory way. * The EPDP Team should also consider the timeline needed to implement, which could follow a phased approach whereby implementation would start immediately following completion of the further work and agreement on a satisfactory manner to distinguish between legal and natural persons for new registrations while existing registrations would be phased in upon renewal or by other means. * The EPDP Team should also consider which data fields (if any) need to be added to accomplish this distinction. This could require further liaising with the IETF if data fields in RDAP need to be added or changed. * The EPDP Team recommends that, as a best practice, registries, registrars and ICANN each develop (educational) resources available that help registrants understand the distinction between a domain name that is registered by a natural person vs. legal person / entity. These resources and communications should also encourage legal persons to provide non-personal information for their email address and other contact information. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

2 1

For your review - Responsible parties in relation to data processing
by Marika Konings 24 Oct '18

24 Oct '18

Dear EPDP Team, To facilitate your review of the responsible parties in relation to data processing, please find attached a summary overview of the current designations in the different data elements workbooks. We’ve also included the definitions from the GDPR of the different roles as well as a further explanation of the concept of joint controllers and their obligations. It would be helpful if you could flag any concerns you have in relation to the current designations so that these can be further reviewed by the EPDP Team. Please indicate which designations, if any, should be further considered by Monday 28 October at the latest so that these can be further discussed during next week’s EPDP Team meetings. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0