November 2018 - Gnso-epdp-team

Proposed modified language for Preliminary Recommendation #2
by Marika Konings Nov. 20, 2018

Nov. 20, 2018

Dear EPDP Team, As discussed during today’s meeting, please find below the proposed rewording for Preliminary Recommendation #2. As noted, the first part reflects language that has been taken verbatim from the EPDP Team’s charter. The last sentence hopefully reflects today’s discussion and is something that most of you willing to live with for the purpose of the Initial Report. Preliminary Recommendation #2 Per the EPDP Team Charter, the EPDP Team is committed to considering a system for Standardized Access to non-public Registration Data once the gating questions in the charter have been answered. This will include addressing questions such as: * What are the legitimate purposes for third parties to access registration data? * What are the eligibility criteria for access to non-public Registration data? * Do those parties/groups consist of different types of third-party requestors? * What data elements should each user/party have access to? In this context, amongst others, disclosure in the course of intellectual property infringement and DNS abuse cases will be considered. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

2 1

ICANN Org Response to question re. Organization field
by Marika Konings Nov. 20, 2018

Nov. 20, 2018

Dear EPDP Team, Hereby the ICANN Org response to the following question: Question: 1.) Has ICANN given any thought to scenarios where the „Organization“ field might contain personal information? 2.) As the Organization field shall be populated on an optional basis, has ICANN given any thought to a consent requirement or, where another legal basis than Art. 6 I a GDPR was considered, what legal basis shall be applicable based on what rationale? Response: The organization field, which is an optional field, was one of the topics of discussion among the community during the development of the Cookbook. See sections 5.4 and 5.5 of the Cookbook<https://www.icann.org/en/system/files/files/gdpr-compliance-interim-model-0…>. Additionally, the 5 July 2018 letter<https://www.icann.org/en/system/files/correspondence/jelinek-to-marby-05jul…> from the European Data Protection Board states: “The GDPR does not apply to the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.” Recital 14 of the GDPR states: “This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.” Registrars have always been obligated to inform and obtain consent from the registrants regarding what data elements are collected, what data elements are published, what data elements are optional, and the intended uses and recipients of the data. (See for example Section II.J.7.b<https://www.icann.org/resources/unthemed-pages/raa-1999-11-10-en#IIJ7b> in the 1999 RAA and Section 3.7.7.4<https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en#3.7…> of the 2013 RAA.) The Temporary Specification relies on 6(1)(f) as the legal basis for the mandatory publication of certain fields, including registrant organization. As noted in our original response, the registrant organization field refers to a legal person and not a natural person. The registrant may give consent for publication of additional fields, for example, the registrant name field. In considering the applicability of the possible legal bases and after consultations with the community, it was determined that 6(1)(f) was the most appropriate legal basis to support the stated goal of complying with the GDPR while maintaining the existing WHOIS to the greatest extent possible. This response will get added to the Q&A section on the wiki: https://community.icann.org/x/ahppBQ. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

3 2

Proposed Revised Rec. 21
by Rosette, Kristina Nov. 20, 2018

Nov. 20, 2018

All, Thomas and I developed proposed revised Rec. 21 language. I posted it in chat, but copy it below for convenience: Rec. 21: The EPDP Team recommends that ICANN Org enters into the required agreements such as a Data Processing Agreement (GDPR Art. 28) or Joint Controller Agreement (Art. 26), as appropriate, with the non-Contracted Party entities involved in registration data processing such as data escrow providers and EBERO providers. These agreements are expected to set out the relationship obligations and instructions for data processing between the different parties. Kristina Rosette Senior Corporate Counsel, IP - Domains rosettek(a)amazon.com<mailto:rosettek@amazon.com> | 703.407.1354

3 3

ICANN org question response
by Caitlin Tubergen Nov. 20, 2018

Nov. 20, 2018

Dear EPDP Team, In response to a question posed by the EPDP Team to ICANN org on Thursday, 8 November, please find the following response: QUESTION: Is making the natural vs legal distinction in WHOIS within the picket fence, i.e., a suitable topic for policy discussion? RESPONSE : Yes, access to gTLD registration data generally is one of the allowed topics for consensus policy as set forth in ICANN Bylaws and registry and registrar agreements. (That list of topics is referred to by some as “the picket fence”). Please refer to Annex G-1 and G-2 of the ICANN Bylaws as well as Specification 1 Section 1.3.4 of the Base Registry Agreement and the Consensus Policies and Temporary Policies Specification of the Registrar Accreditation Agreement, which provide that: “maintenance of and access to accurate and up-to-date information concerning domain name registrations” is one of the topics on which ICANN may enforce consensus policies. Thank you. Best regards, Marika, Berry and Caitlin

4 6

Letter to council and others
by Kurt Pritz Nov. 20, 2018

Nov. 20, 2018

Dear Keith: Rafik and I are writing to let you know that the EPDP Team studying the processing of registration data will not release its initial report today, 19 November. This date had been previously identified as a likely date for publication, mostly based upon the timeline and process requirements for getting to the finish line on 25 May 2019 . However, the Team has made considerable progress and we anticipate publishing the report as early as Wednesday, 21 November and are making plans to hit that date. In the event that certain issues remain unresolved, publication might be delayed (partially due to the US holiday) until early the following week. These issues include complex topics regarding whether ICANN and contracted parties are “joint controllers” where new information has become available only in the past few days and we need team agreement to move forward. We are striving to meet the 21 November date so that the comment period does not end in the midst of the year-end holiday week. In the case of either scenario, careful planning can still ensure closure by 25 May. While this is an apparent “delay,” I would not characterize the current schedule as that. It is important to understand that the delivery schedule for the Initial Report was set by the time left after all other “required” processes such as comment period, GNSO and Board consideration periods and other steps were taken into account. Also remember that the EPDP Team is dealing with a myriad of complex policy and legal issues that have flummoxed attempts at progress on this topic for 20 years. It is difficult to schedule an effort that is simultaneously addressing report objectives to: review the Temporary Specification, create new policy, and answer 50+ charter questions. Concessions, compromises and thoughtful solutions are in many instances developed by the hour. As late as this past weekend, the Team reviewed drafts and raised substantive issues that required difficult and contentious discussion, but they have got through most of them with suitable language. The full Team met for multi-hour meetings on Tuesday, Thursday and Friday last week and has set the same schedule for Monday and Tuesday this week. We’ve had 28 teleconferences and 40+ hours of face-to-face meeting time in 3 ½ months When published, the Initial Report will not reflect agreement on all issues but there has been apparent unanimity on many important issues and the report describes areas of difference in sufficient detail so that the public can adequately understand and opine on them. The report will be overly wordy in spots and provide much detail as it seeks to adequately describe a significant level of complexity to its audience. Remember that this report started with a blank sheet of paper, the EPDP Team, and not much time. We will also be launching a new type of comment forum, designed to: clearly link comments to specific sections of the Initial Report, encourage commenters to provide reasoning or rationale for their opinions, enable the sorting of comments so that the EPDP Team can more easily read all the comments on any one topic. We look forward to more communication on this topic to you in the near future. Sincerely, Kurt and Rafik

1 0

ICANN Org's contractual compliance personal data processing activities
by Marika Konings Nov. 20, 2018

Nov. 20, 2018

Dear EPDP Team, On behalf of ICANN Org: During the 19 September 2018 EPDP Q&A Session<https://participate.icann.org/p2ay385gtib/> with Becky Burr, there was a request for more information regarding what ICANN org does with personal data as it relates to ICANN contractual compliance. Additionally, on 4 October 2018, ICANN org received a question<https://community.icann.org/display/EOTSFGRD/2018-10-04+EPDP+Team+call+%2317> from the EPDP Team regarding data retention procedures. In response to these two items, please see the attached a summary of ICANN org’s contractual compliance personal data processing activities. This response will get added to the Q&A section on the wiki :https://community.icann.org/x/ahppBQ. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Proposed Agenda - Meeting #29
by Berry Cobb Nov. 19, 2018

Nov. 19, 2018

Dear all, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 20 November at 14.00 UTC for two hours. Best regards, Caitlin, Berry and Marika ========================= EPDP Meeting #29 Agenda Tuesday, 20 November 2018 1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes) a) Review of outstanding action items b) Other updates, if applicable 3. Finalize outstanding items: a) Purpose O – see proposed language for addressing this in the Initial Report b) Additional language re. responsibilities section (Thomas) c) Additional language re. UDRP (Margie) – see updated version circulated on Monday 19 November d) Revised language for Preliminary Recommendation #2 – see revised version circulated on Monday 19 November by staff 4. Next steps for publication: a) Public comment forum – Google form b) Community Webinar c) Letter to EDPB d) Confirm publication date target 5. Wrap and confirm next meeting to be scheduled for Wednesday 21 November 2018 a) Confirm action items b) Confirm questions for ICANN Org, if any

1 0

Proposed language re. Purpose O (Research)
by Marika Konings Nov. 19, 2018

Nov. 19, 2018

Dear EPDP Team members, Per the action item from today’s meeting, please find hereby proposed language for inclusion in the Initial Report to document the discussions to date in relation to Purpose O (Research): Proposed new language to be added after line 645 in the 18 Nov version (https://drive.google.com/file/d/1zLpveft7yV85jirZpXjaczKfJyvXynZg/view) The EPDP Team considered whether a Purpose for Processing Registration Data should be added to address the needs and benefits provided by DNS security and stability research intending to publish reports on threats to the operational stability, reliability, security, global interoperability, resilience, and openness of the DNS (see https://mm.icann.org/pipermail/gnso-epdp-team/2018-November/000897.html) The EPDP Team is considering this question to enable ICANN to continue publishing reports in relation to the Accuracy Reporting System as well as the use of data by ICANN’s Office of the Chief Technology Officer (OCTO). Community and ICANN Org input is sought on whether the other purposes listed below already enable this work, whether an additional research purpose should be added, or if such a purpose in not necessary in any case. Please share with the list as soon as possible if you have any concerns about this addition in the body of the report. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Notes and action from EPDP Team Meeting #28
by Marika Konings Nov. 19, 2018

Nov. 19, 2018

Dear EPDP Team, Please find below the notes and action items from today’s EPDP Team meeting. Best regards, Caitlin, Berry and Marika ======================== EPDP Team Meeting #28 Tuesday, 19 November 2018 Notes and Action Items High-level Notes/Actions: Action item #1: Kurt to write to GNSO Council and inform them of timing of publication of Initial Report, reasons for it and how EPDP Team still intends to meet the overall timeline. Action item #2: Staff to update executive summary to make clear references to where full context of discussion can be found. Action item #3: Thomas and Kristina to suggest updated wording for #13 and #21 to capture discussions (COMPLETED). Action item #4: staff to circulate proposed rewording of rec #2 re. further work on the a system for Standardized Access to non-public Registration Data to the mailing list (COMPLETED) Action item #5: EPDP Team to provide further input on Purpose O and how to deal with it in the context of the Initial Report on the mailing list prior to the next meeting. Action item #6: Staff to develop draft language that reflects proposed approach by Margie in relation to Purpose O. Action item #7 EPDP Team to review proposed addition to Responsibilities in Processing Data section circulated by Thomas and share any feedback on the mailing list prior to the next meeting. Action item #8: Margie to review input received on proposed addition to UDRP section to address concerns re. reference to fees and whether this is work for the EPDP Team to undertake and propose updates to address this input. Action item #9: Staff to share proposed format for public comment forum prior to next meeting. Questions for ICANN Org from the EPDP Team: None Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/DQnVBQ. 1. Roll Call & SOI Updates (5 minutes) * Attendance will be taken from Adobe Connect * Remember to mute your microphones when not speaking and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) a. Review of outstanding action items - see https://community.icann.org/x/NwSNBQ b. Other updates, if applicable * Note that notifications to make travel arrangements for next F2F meeting should be received shortly * Will discuss new approach during today's meeting for public comment forum later in the meeting - use of google form to facilitate input as well as review by EPDP Team Timing of publication of Initial Report * What are the next steps with regards to publication of the Initial Report? May slip a few days. * Does current version describe issue in sufficient detail? * Any additional time will impact overall timeline so needs to be considered carefully. * Perfect shouldn't become the enemy of the good * Version published earlier today captures non-substantive edits as a result of comments submitted between Friday and Sunday. Additional edits as a result of today's meeting will be applied as soon as possible following this meeting. * Should EPDP Team consider just publishing the Executive Summary and not the rest of the report? Consider freezing as is, and issue executive summary and ask for input on that. Note that there are minimum requirements for what needs to be included in the Initial Report. * Instruct readers to focus on executive summary, but for transparency reasons the rest of the document should be included. * What are the requirements for Initial Report publication? Could executive summary be posted first and then followed by the detailed info, or would that impact the duration of the public comment period? Could impact duration as community could request additional time for info posted late. * Consider renaming executive summary to Initial Report Executive Summary. Consider including links to substantive discussions. Could recommendations be removed from the other part of the report? Keep recommendations with the rest of the report as it will provide the context. * Important to be able to provide full context, even if some just review the executive summary. Make executive summary available as a separate download. * Objective is to obtain high quality feedback - means that full context of deliberations is important. * When will changes be frozen? * No new comments to be made on the report - deal with comments that have been provided by COB on Sunday 18 Nov. Once EPDP Team has gone through these comments, final version will be shared with EPDP Team. Publish Initial Report by next week Monday or Tuesday at the latest. * Note that publishing next Monday or Tuesday will put the end of the public comment forum on 26 or 27 December. Action item #1: Kurt to write to GNSO Council and inform them of delay of publication of Initial Report, reasons for it and how EPDP Team still intends to meet the overall timeline. Action item #2: Staff to update executive summary to make clear references to where full context of discussion can be found. 3. Continue review & discussion of comments / input received on Initial Report Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report a. Commence review of proposed changes / comments on the Initial Report (see latest version attached) b. Confirm approach for addressing these c. Confirm next steps, if any * See list shared prior to the meeting * a1 - this footnote was product of last meeting. Does this conflict with recommendation #2? Is accuracy is part of the charter? This was identified as a parking lot item - it may not change anything, but just to note that it is expected to be discussed further in phase 2. Accuracy means something different in the context of GDPR than it does in the context of ICANN accuracy policies. Consider changing to "The topic of accuracy is expected to be further considered". Update accordingly: The topic of accuracy as related to GDPR compliance is expected to be considered further. * b1 - this appears redundant is it is already captured in the legal/natural person discussion in quite some detail. Not clear what value this language adds. This would need to be further discussed - should be submitted during public comment forum. Input is already sought on this topic through the questions that are included in relation to legal / natural. Current wording may raise expectations that a recommendation is forthcoming which may not be an accurate reflection of conversations to date. No changes to be made. * c1 - consider adding "some parties have asserted that". * d1 - check wording from GDPR. Leave for now as is. Recital 14 of GDPR: This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person. Leave as is. * e2 - would need to identify who those members with expertise are before this can be put in. This distinction is not made in other parts either. Leave as is. * f2 - flagged for EPDP Team to either consider now or later - not necessarily prior to publication (this applies to all ICANN Org comments). Consider adding a footnote with ICANN Org comment and note that it will be further discussed. * g2 - * h2 - doesn't this recommendation just note that an appropriate agreement needs to be in place? * i2 - language of rec 21 is ambiguous - leaves open what the right type of agreement is. Not clear what intent was. Objective is to capture that ICANN Org is to enter into an appropriate agreement. Remove reference to CP from recommendation #21 and just limit it to third parties that might be required. Thomas & Kristina to suggest proposed rewording for recommendation #21. Recommendation #13 to cover contractual relationships with contracted parties and #21 to focus on third parties. Proposed revised Rec. 21: The EPDP Team recommends that ICANN Org enters into the required agreements such as a Data Processing Agreement (GDPR Art. 28) or Joint Controller Agreement (Art. 26), as appropriate, with the non-Contracted Party entities involved in registration data processing such as data escrow providers and EBERO providers. These agreements are expected to set out the relationship obligations and instructions for data processing between the different parties. * RrSG comments will be submitted in response to the public comment forum - do not need to be considered now prior to publication of Initial Report. * s - note that additional comments/input on this recommendation were also provided on the mailing list. Recommendation #2 was result of a compromise reached in Barcelona. Consider updating this language to reflect language from the charter which outlines the aspects of work remaining under the charter. Some indication needed in the report that IP interests are covered. Consider adding in a commitment a for instance, not limited to, not definitive list, defer discussion to what is included to later date. Possible alternative: The EPDP Team commits to develop policy to allow for responses to lawful third party disclosure requests for non-public registration data. The work will encompass, amongst others, disclosure in the course of intellectual property infringements and abuse cases. Need to commit to follow a process, not an outcome. Possible alternative to add to staff proposed language 'this will include consideration of IP and abuse cases'. Relying on the charter language may be helpful with the addition of what will be part of this consideration. Not all agree with addition - charter language should be sufficient. * Talk about lawful disclosure, refer to future. Action item #3: Thomas and Kristina to suggest updated wording for #13 and #21 to capture discussions (COMPLETED). Action item #4: staff to circulate proposed rewording of rec #2 to the mailing list (staff proposed language 4. Other items to be finalized: Purpose O – how to address in Initial Report * See language circulated by Benedict and Margie’s proposed approach for dealing with it in the Initial Report (“important issue that should be called out in the Initial Report. The Purpose O discussion should be written to note the concern regarding ICANN ‘s ability to continue publishing for the reports from the Accuracy Reporting System in the manner that was possible before May 25th, and to note OCTO’s use of the data before May 25th, and to ask the question of whether the purposes listed in the report enable or should enable this continued use by OCTO and by ICANN”). Action item #5: EPDP Team to provide further input on Purpose O and how to deal with it in the context of the Initial Report on the mailing list prior to the next meeting. Action item #6: Staff to develop draft language that reflects proposed approach by Margie. Additional language re. responsibilities section (Thomas) * See proposed addition posted by Thomas to the mailing list to reflect the discussion during meeting #27 of this topic. Action item #7 EPDP Team to review proposed addition and share any feedback on the mailing list prior to the next meeting. Additional language re. UDRP (Margie) * See updated language circulated by Margie on Friday and subsequent feedback. Action item #8: Margie to review input received on proposed addition to UDRP section and propose updates to address this input. 5. Next steps for publication: Public comment forum – Google form Action item #9: Staff to share proposed format for public comment forum prior to next meeting. Community Webinar * Leadership considering hosting a webinar in conjunction with the publication of the Initial Report to present the report and preliminary recommendations, as well as provide guidance on how input is expected to be provided. Letter to EDPB * Leadership team is working on a draft letter to the EDPB to convey the Initial Report and call out the specific questions that have been flagged in the Initial Report. All items to be further discussed during the next meeting, scheduled for Tuesday 20 November at 14.00 UTC. 6. Wrap and confirm next meeting to be scheduled for Tuesday 20 November at 14.00 UTC. a) Confirm action items b) Confirm questions for ICANN Org, if any changes. Apologies to those who are not affected by DST. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Recordings, Attendance & AC Chat / GNSO Temp Spec gTLD RD EPDP / Monday, 19 November 2018
by Julie Bisland Nov. 19, 2018

Nov. 19, 2018

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Monday, 19 November 2018 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/DQnVBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-19nov18… AC Recording: https://participate.icann.org/p66lwfqfhwa/<https://participate.icann.org/p66lwfqfhwa/?OWASP_CSRFTOKEN=a7f49856259ae408…> <https://participate.icann.org/p12a7q93n35/?OWASP_CSRFTOKEN=663c37463e43b07a…>** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Julie

1 0