October 2018 - Gnso-epdp-team

***REMINDER*** Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP Small Team #3 call/ Wednesday, 10 October 2018 at 13:00 UTC
by Julie Bisland Oct. 9, 2018

Oct. 9, 2018

Dear all, Non-members can follow the EPDP Small Team Meeting #3 Wednesday, 10 October 2018 at 13:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/8AO8BQ Thank you. Kind Regards, Andrea Glandon

1 0

Re: [Gnso-epdp-team] Fwd: Responses to EPDP Questions
by Alan Greenberg Oct. 9, 2018

Oct. 9, 2018

Farzaneh, I find this comparison offensive. Any access to personal information of domain name registrants will need to be compliant with data protection laws. You may not agree with others on where the balance point is, but presuming that any collection or access (which will implicitly be limited to those with specific needs) will be unlawful is incorrect. Alan At 09/10/2018 03:05 AM, farzaneh badii wrote: >Only some groups' priority is to have access to personal information >of domain name registrants. Other groups priorities are: protecting >registrants personal information and compliance with data protection laws!

2 1

Fwd: Responses to EPDP Questions
by Marika Konings Oct. 9, 2018

Oct. 9, 2018

Dear All, Please find below additional responses from ICANN Org to a number of outstanding questions. We’ll get these posted shortly on the related wiki page. Best regards, Caitlin, Berry and Marika ————————————— The EPDP Team previously requested a summary of ICANN org’s contacts and engagements with the EPDP and DPAs. ICANN org provided a response, which is provided again below for reference: QUESTION: Can ICANN summarize in some searchable form the contacts and engagements with the EDPB and/or other DPAs in relation to the Temporary Specification for gTLD Registration Data? RESPONSE: ICANN org has been open and transparent with our engagements with the EDPB and DPAs. All of the formal written communications from EDPB and DPAs are published on ICANN correspondence. In addition, we’ve had informal verbal conversations with the EDPB and DPAs to educate, inform, and ask for guidance. Summaries of those informal conversations are published in blogs. To assist the EPDP Team in its work, ICANN org will provide the EPDP Team with a compiled list of correspondence received and blogs published thus far, including the topic of each correspondence/blog. As follow-up to the above response, attached is a summary of correspondence between ICANN org and the EPDP/DPAs, as well as announcements and blogs relating to ICANN org’s GDPR-related efforts. The document is marked as draft so that the EPDP Team can review and provide suggestions for re-organization or re-structuring of the content to best meet the EPDP Team’s needs. QUESTION: For which ICANN policies is admin/tech contact information currently a required data element and/or referenced in the policy? RESPONSE: Administrative and technical contact information is referenced in the following ICANN policies and procedures: * Registry Registration Data Directory Services Consistent Labeling and Display Policy<https://www.icann.org/resources/pages/rdds-labeling-policy-2017-02-01-en>. Output requirements for administrative and technical contact information. * Thick WHOIS Transition Policy for .COM, .NET, .JOBS<https://www.icann.org/resources/pages/thick-whois-transition-policy-2017-02…>. Guidance to registry operators for handling output of administrative and technical contact information where no data exists in the SRS during the period when registrars begin sending Thick WHOIS data to registry operators for all new registrations. * Rules for Uniform Domain Name Dispute Resolution Policy<https://www.icann.org/resources/pages/udrp-rules-2015-03-11-en>. Notifications of complaints include administrative and technical contacts information. * WHOIS Data Reminder Policy<https://www.icann.org/en/resources/registrars/consensus-policies/wdrp>. WDRP notices may be presented to the registrant either directly or through the administrative contact. * Transfer Policy<https://www.icann.org/resources/pages/transfer-policy-2016-06-01-en>. Administrative contact along with the registered name holder have the authority to approve or deny a transfer request. Because of this role, the administrative contact is referenced in parts of the transfer process as well as in the Registrar Transfer Dispute Resolution Policy. * Uniform Rapid Suspension System (URS) Rules<http://newgtlds.icann.org/en/applicants/urs/rules-28jun13-en.pdf>. Notifications of complaints include administrative and technical contacts information. QUESTION: We have spent most of this meeting exploring the role of compliance at ICANN, in order to support a proposal that ICANN has an implicit contract with the registrant and that therefore 6 1 b applies as a grounds for processing. This would also facilitate ICANN operating a UAM on behalf of those who want the data. It might also explain Goran’s initiative in seeking some kind of recognition by EU authorities that ICANN has a kind of quasi-regulator status, as the authority vested with the responsibility to manage the DNS. Given that all of this is outside the current configuration of ICANN as data controller, which would be more clear had we done a DPIA and had we adequate data maps to work with….can we either get back to our Charter questions that we were mandated to address by the GNSO, or get a full explanation of what is going on and why we continue to be focused on the access question. RESPONSE: This request appears to be directed at the EPDP Team and not ICANN org as ICANN org does not dictate the direction of the EPDP Team’s discussion. QUESTION: Why hasn’t a Data Protection Impact Assessment been carried out to clarify data flows and ICANN’s relationship with the data subject in light of its acknowledged role as a joint controller and Article 35 of the GDPR? RESPONSE: This question was also asked during the Data Protection/Privacy Update Webinar hosted by ICANN org on 8 October 2018. John Jeffrey, ICANN’s General Counsel and Secretary provided the following response: “This is something that has been considered since the very beginning. One of the issues is when to do that in a way that is most timely and useful and how to do that. We continue to evolve the thinking of how the interpretation of GDPR applies to WHOIS. We have a number of questions which have been addressed directly to the DPAs and the EDPB and we’ve have an ongoing discussion with the EC about how to interpret the GDPR. We believe that those are a better format at this point than doing the assessment, but we continue to evaluate whether that assessment would be the right thing to do and when.” The presentation for the webinar is posted here<https://www.icann.org/en/system/files/files/presentation-data-protection-pr…>, and the Adobe Connect recording is here<https://participate.icann.org/p29vt2uxodx/>. The question and response start at 0:27:00 in the Adobe Connect recording.

5 5

Request for independent legal counsel to assist the EPDP
by Stephanie Perrin Oct. 9, 2018

Oct. 9, 2018

Hello everyone, please find attached a request to hire outside counsel with expertise in data protection law, to assist us with the analysis on the EPDP. The RySG, RrSG, and NCSG representatives on the EPDP are all in support of this proposal, which as you know was foreseen in the Charter and in our earlier GNSO discussions. Thank you. Stephanie Perrin

4 3

Small team #3 background information
by Marika Konings Oct. 9, 2018

Oct. 9, 2018

Dear All, In preparation for the small team #3 meeting on Wednesday, please find attached two background documents. The first one captures the charter questions, relevant EDBP advice, relevant Temporary Specification sections and related questions to ICANN Org. The second document captures the input provided by the EPDP Team to date through the triage surveys and early input. As a reminder, please make sure that max. one rep per group has been assigned to this small team (see https://docs.google.com/document/d/1ChEYy-cZmT3qTD62-HsoVmddD96m6cbkSOv5dmA…) The small team #3 meeting is scheduled for Wednesday 10 October from 13.00 – 15.00 UTC (call details have been circulated separately). Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Proposed Agenda - EPDP Team meeting #18 Tuesday 9 October at 13.00 UTC
by Marika Konings Oct. 8, 2018

Oct. 8, 2018

Dear All, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 9 October at 13.00 UTC. Best regards, Caitlin, Berry and Marika EPDP Meeting #18 Agenda Tuesday, 9 October 2018 1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Additional travel support for ICANN63 * Request for independent legal counsel to assist the EPDP * Lawful basis memo – any other input that should be recorded in the latest version? * ICANN63 High Interest Topic Session Planning * Review of outstanding action items * Other updates, if applicable 1. Review outstanding questions in relation to charter question c) Transfer of data from Registrar to Registry (blue signifies has not been discussed yet): * c1) What data should registrars be required to transfer to the registry? * c2) What data is required to fulfill the purpose of a registry registering and resolving a domain name? * c3) What data is transferred to the registry because it is necessary to deliver the service of fulfilling a domain registration versus other legitimate purposes as outlined in part (a) above? * c4) Is there a legal reason why registrars should not be required to transfer data to the registries, in accordance with previous consensus policy on this point? * c5) Should registries have the option to require contact data or not? * c6) Is there a valid purpose for the registrant contact data to be transferred to the registry, or should it continue to reside at the registrar? (note: the two highlighted in blue are the primary focus of today’s discussion, but the others are related and should be used to provide context to the transfer topic as necessary) Objective of discussion: (1) Review outstanding charter questions and review data elements workbook for purpose A with focus on what data elements need to be transferred from registrar to registry (2) Agree on data elements needed to be transferred as well as responses to outstanding charter questions * Review data elements workbook for Purpose A * Deliberate on outstanding questions * Agree on proposed response to charter questions 1. Update on status of remaining data elements workbooks & open items Objective of discussion: (1) Confirm status of data elements workbooks (2) Identify volunteers to address any open items * Review status of remaining data elements workbooks & open items * Identify volunteers to address any open items & confirm timeline 1. Wrap and confirm next meeting to be scheduled for Thursday 11 October at 13.00 UTC. * Confirm action items * Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

2 1

Re: [Gnso-epdp-team] FW: EPDP questions for ICANN Org
by Margie Milam Oct. 8, 2018

Oct. 8, 2018

Hi Caitlin- Thank you for the information below. I'd like to propose that we schedule time to talk to OCTO in Barcelona, to explore how WHOIS was used before the Temp Spec was adopted, in OCTO's activities. The response below does not address that issue. For example, did OCTO use WHOIS in its law enforcement training and outreach activities, or engagement with the cybersecurity community, or to facilitate or respond to large scale botnet attacks, such as Conficker or Avalanche? Thanks , Margie On 10/2/18, 8:52 PM, "Gnso-epdp-team on behalf of Caitlin Tubergen" <gnso-epdp-team-bounces(a)icann.org on behalf of caitlin.tubergen(a)icann.org> wrote: Dear All, Below, please find the recent EPDP questions and answers from ICANN Org. Thank you. Best regards, Marika, Berry and Caitlin ** QUESTION: With respect to ICANN’s references to dispute resolution policies within the Temporary Specification, is there a reason only the URS and UDRP were included and not other dispute resolution procedures such as RDDRP, PDDRP and PICDRP? RESPONSE: The RDDRP, PDDRP, and PICDRP <https://newgtlds.icann.org/en/program-status/pddrp> are dispute resolution procedures where the gTLD registry operators themselves are the respondents. Under the Registrar Transfer Dispute Resolution Policy <https://www.icann.org/resources/pages/tdrp-2016-06-01-en> the respondents are registrars. This is different from URS and UDRP proceedings where individual domain registrants are the respondents. (Note: gTLD registry agreements may also contain other dispute resolution procedures, for example, .NAME has an “Eligibility Requirements Dispute Resolution Policy” <https://www.icann.org/resources/pages/appendix-11-2013-07-08-en>.) QUESTION: With respect to data retention: For how long and why, should data escrow agents retain old deposits (if at all) in order to fulfill their contractually-required obligations? For how long and why, should data be retained by registries and registrars from the perspective of ICANN Org for purpose A (Establish the rights of a Registered Name Holder in a Registered Name and ensuring that the Registered Name Holder may exercise its rights in respect of the Registered Name)? RESPONSE: Under the Registrar Data Escrow Specification deposits older than one year must be destroyed, unless a longer period is agreed to by the registrar and the escrow agent. Also, under the base agreement for new gTLDs each escrow deposit must be kept for one year. Legacy gTLD agreements vary; for example the .ASIA, .BIZ, .INFO, and .ORG agreements specify that at least four weeks of deposits must be kept. The purpose of safeguarding a set of prior deposits is to protect registrants in the event a registry or registrar fails or is terminated and the database needs to be reconstituted. In situations where the registration database has to be reconstituted and deposits have not been made in a number of months, safeguarding multiple deposits increases the likelihood that at least one reliable deposit will be available. Also, having multiple deposits increases the likelihood that a reliable deposit is available in the event that the compliance/termination process is contested by the registry operator or registrar. Perhaps registry operators and registrars with operational experience could provide input as to how far back deposits should be kept to ensure that registration databases can be reconstituted when needed. QUESTION: Apart from ICANN Org Compliance, do any other ICANN departments require access to registration data and, as such, might require a specific purpose? If so, please describe in detail sufficient to provide a legal basis for such data processing. RESPONSE: This question seems to be asking about any use by ICANN Org of registration data that is now masked pursuant to the Temporary Specification. One example of an ICANN Org activity that previously used WHOIS data elements that may now be redacted pursuant to the Temporary Specification is the WHOIS Accuracy Reporting System, which is currently under review as discussed with the EPDP Team on 26 September 2018. If additional information is needed it would be helpful if the EPDP Team could please clarify if the question is for information related to such past uses of now-masked registration data, or to any current ICANN Org (apart from Contractual Compliance) uses of non-public data, or to any future uses of non-public registration data that may be needed in order to implement GNSO-recommended policies. Also, in discussions that the EPDP Team has had regarding purposes, ICANN Office of the CTO (OCTO) has been mentioned. To inform the EPDP Team’s continued discussion on this topic, ICANN Org would like to clarify that ICANN OCTO does not require personal data in domain name registration data for its work. For example, OCTO’s Domain Abuse Activity Reporting (DAAR) project <https://www.icann.org/octo-ssr/daar> uses only the registrar and nameserver information. QUESTION: ICANN Org to provide EPDP Team with copy of agreements with UDRP/URS providers in to demonstrate GDPR compliance in relation to data protection / transfer of data including relevant data protection policies that dispute resolution providers have in place. RESPONSE: ICANN has used Memoranda of Understanding to govern the relationship with each of the selected URS providers, in which each of the URS providers agree to implement the URS services in accordance with the procedures laid out in the New gTLD Applicant Guidebook, as they might be amended from time to time. Copies of the MOUs are available here: https://newgtlds.icann.org/en/applicants/urs. ICANN does not have agreements or MOUs with UDRP providers. Additional discussion on why ICANN has taken this approach with UDRP providers is available here: https://www.icann.org/en/system/files/files/uniformity-process-19jul13-en.p…. In light of the recent changes in data protection laws and the requirements in the Temporary Specification requiring contracted parties to give full registration data to the dispute resolution providers when presented with a complaint if the contact details are not published in WHOIS, ICANN is in discussions with the dispute resolution providers to more fully understand the safeguards they have put in place for the processing of personal data. For example, WIPO has updated its FAQ page concerning the GDPR as it relates to the UDRP: http://www.wipo.int/amc/en/domains/gdpr/, and other providers have reviewed/are in the process of reviewing their supplemental rules in light of changes in privacy laws. ICANN will publish any updates to a provider’s supplemental rules on its website.

1 0

***REMINDER*** Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 09 October 2018 at 13:00 UTC
by Julie Bisland Oct. 8, 2018

Oct. 8, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesday's and Thursday's at 13:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> **Agenda has been posted. Please visit Agenda wiki page prior to the call: https://community.icann.org/x/KwWrBQ Thank you. Kind Regards, Andrea Glandon

1 0

Re: [Gnso-epdp-team] Updated lawful basis memo
by Caitlin Tubergen Oct. 8, 2018

Oct. 8, 2018

Dear All, Following up on the below email, you will note we highlighted disagreements that were raised on the call, e.g., members of the BC believe that transmitting data from the registrar to the escrow provider for the purposes of escrow should be lawful under 6(1)(b) instead of 6(1)(f). We did this, in part, to confirm our understanding of issues raised but also to record disagreements so that we may include this document in the Initial Report. Accordingly, if you would like to note your group’s disagreement on any of the lawful bases, please do let us know. Thank you. Best regards, Marika, Berry and Caitlin From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Caitlin Tubergen <caitlin.tubergen(a)icann.org> Date: Monday, October 8, 2018 at 8:12 AM To: "Gnso-epdp-team(a)icann.org" <Gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Updated lawful basis memo Dear All, Following up on an action item from Tuesday’s call, please find the updated Lawful Basis memo, which now includes updated processing activities/rationales as well as notations when disagreement on the identified lawful basis was expressed. Please note the following when reviewing the document: If you believe any of the newly-identified processing activities require the workbook data elements to be updated, please provide requested edits and the accompanying rationale to the list. If no updates are provided, we will assume the previously-designated data elements are sufficient for the updated processing activities. At least one member of the EPDP Team requested to add a new processing activity to Purpose M; specifically, Margie noted an additional processing activity is transmission of registration information to the entity who files a UDRP/URS complaint. It is staff’s understanding that the UDRP Provider interacts directly with the registrar in order to obtain/confirm relevant registered name holder data, and the registrar, in turn, provides the relevant data to the Provider (who will then forward the info to the complainant or complainant’s counsel). As the disclosure of registration data to a UDRP/URS provider is already noted in the memo, it doesn’t appear that this additional processing activity is necessary, particularly because Purpose B may cover a situation where a trademark holder may contact the registrar directly for disclosure of non-public data. If this is either an inaccurate representation of the request for a new processing activity under M, or an inaccurate description of how data is conjunction with a UDRP/URS proceeding, please let us know. If any members believe a processing activity(ies) is missing, please reply to the list. Thank you. Best regards, Marika, Berry and Caitlin

1 0

ICANN63: GNSO Sessions How to Get Organized and Remote Participation Details
by Julie Bisland Oct. 8, 2018

Oct. 8, 2018

Dear all, The one-stop wiki page for all your Remote Participation queries is now available. This wiki page covers remote participation details for all GNSO open and public meetings. In addition to this, ICANN meetings' team has put together an updated ICANN meeting website which allows you to download all GNSO-related meetings to your inbox calendar in one go. 2 LINKS TO BOOKMARK NOW: ICANN63 Meeting Schedule<https://63.schedule.icann.org/> GNSO Remote Participation Wiki Page<https://community.icann.org/x/nxVpBQ> Step 1 - Create a profile and your personalized ICANN63 schedule Go to the Meeting Schedule webpage and create a profile and login. Every session on the schedule can be selected and added to your individual schedule by clicking the Add box to the bottom right of each meeting, this adds it to your individual schedule which you can then email to yourself or add to your calendar. See next step. Step 2 - There are two ways to import your schedule into Outlook: once you've added all your chosen meetings to "My Schedule" go to Export. 1. Importing creates a one-time snapshot of your schedule and copies it into Outlook. If you subsequently make changes to your Pathable calendar, they will not be reflected in Outlook. 2. Subscribing creates a live feed of your schedule in Outlook. Outlook checks for changes every few hours and updates your calendar appropriately. * For Outlook calendars: http://support.pathable.com/knowledgebase/articles/81449-moving-your-schedu…<https://urldefense.proofpoint.com/v2/url?u=http-3A__support.pathable.com_kn…> * For Google calendars: http://support.pathable.com/knowledgebase/articles/1313-moving-your-schedul…<https://urldefense.proofpoint.com/v2/url?u=http-3A__support.pathable.com_kn…> Step 3 All Adobe Connect rooms (which can be found on the session information on the ICANN63 Meeting Schedule<https://63.schedule.icann.org/> and on the <https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> GNSO Remote Participation Wiki Page<https://community.icann.org/x/nxVpBQ>) will provide audio streaming only, Adobe Connect room microphones will not be enabled. If you cannot join an Adobe Connect room for a session, and will need to dial in with your phone, please refer to the <https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> GNSO Remote Participation Wiki Page<https://community.icann.org/x/nxVpBQ> for the audio pass codes and dial in numbers. Please also follow the previous steps if you wish to take part in the session over the phone. Step 4 Please download the mobile app by searching for "ICANN63" in your app stores. Nathalie Peregrine and Terri Agnew will be onsite in Barcelona to assist you directly. For all GNSO meeting related queries (RP or others), please email us at: gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> and we will be more than happy to assist! Kind regards, GNSO SO/AC Support team Julie Bisland Secretariat Operations Coordinator for the GNSO Internet Corporation for Assigned Names and Numbers (ICANN) Email: julie.bisland(a)icann.org<mailto:julie.bisland@icann.org> Skype ID: 79613b691cb8a6c1 Find out more about the GNSO by visiting the GNSO Newcomer pages<https://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy…>

1 0