November 2018 - Gnso-epdp-team

Recordings, Attendance & AC Chat / GNSO Temp Spec gTLD RD EPDP / Friday, 16 November 2018
by Andrea Glandon Nov. 16, 2018

Nov. 16, 2018

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Friday, 16 November 2018 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/7wfVBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-16nov18… AC Recording: https://participate.icann.org/p12a7q93n35/ <https://participate.icann.org/p12a7q93n35/?OWASP_CSRFTOKEN=663c37463e43b07a…>** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

Re: [Gnso-epdp-team] [Ext] Purpose O (Research) - informal small group
by Benedict Addis Nov. 16, 2018

Nov. 16, 2018

* Team copied * Dear Thomas, Thank you for speaking with me yesterday about the Research purpose. In answer to your second question, I have clarified in the document that the registry will pseudonymise registration data before it is transmitted to ICANN. Regarding your first question, I have spoken to both current and former members of the OCTO team. They have provided the following additional input: "Octo used registration data as part of LE [Law Enforcement] training. Like other opsec [operational security] practitioners we used reg[istration] data when collaborating with public/private sector investigators. We also used it when we were invited to work with Compliance on a particular complaint." and "[we] used full whois when we initiated our own investigations but that activity was self-directed not explicitly part of SSR role and remit. I also used whois to report phishing and brand infringements against ICANN. Lastly I used whois as part of research into bulk registrations and other consensus policy or registrar practices that had undesirable or unintended consequences." I should note that prior to 25th May, OCTO used public whois data. Since then, this work is on hold. Lastly, I’m sorry that this document is reaching you at the 11th hour. I have been waiting for guidance from ICANN before sending it, which was requested over a month ago. Best, Benedict. > On 5 Nov 2018, at 21:36, Thomas Rickert <thomas(a)rickert.net> wrote: > > Thanks, Benedict! > > Let me reiterate my input, which I think needs to make its way into the document or in a covering note. To be clear, I am not questioning that we need to look into ways to enable ICANN to do research, but I am still unclear as to what their requirements are do to research. > > * > More input from those conducting the research is required, especially on the questions: > What data is actually required for research purposes? > Would it not be sufficient to have pseundonymized data? > * > > Best, > Thomas > > >> Am 05.11.2018 um 22:29 schrieb Berry Cobb <mail(a)berrycobb.com <mailto:mail@berrycobb.com>>: >> >> Hi Benedict, <> >> >> Thank you for the update. I think it will be important to get this to the list for the full group’s consideration. Afterwards, I’ll make a few cosmetic updates and post on the wiki. >> >> Thank you. >> >> B >> >> >> Berry Cobb >> GNSO Policy Consultant >> @berrycobb >> >> From: Benedict Addis [mailto:bee@theale.co.uk <mailto:bee@theale.co.uk>] >> Sent: Monday, November 5, 2018 15:38 >> To: Berry Cobb >> Cc: farzaneh badii; Marika Konings; Thomas Rickert; Anderson, Marc; Emily Taylor; matt(a)brandsight.com <mailto:matt@brandsight.com>; Amr Elsadr; Kurt Pritz; Caitlin Tubergen >> Subject: Re: [Ext] Purpose O (Research) - informal small group >> >> Dear Berry, >> >> Thanks for your message, and thank you everyone for your time. >> >> I’ve updated the workbook to incorporate the feedback from Farzaneh and Thomas. >> >> Essentially, I have clarified that the registry will pseudoymise registration data before it is transmitted to ICANN. >> >> Best, >> Benedict. >

3 2

Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Monday, 19 November 2018 at 14:00 UTC for 3 hours
by Terri Agnew Nov. 16, 2018

Nov. 16, 2018

Monday, 19 November 2018 at 14:00 UTC for 3 hours **Please note: This is a placeholder meeting invite, it will be confirmed at the end of Friday’s meeting, whether or not this meeting goes ahead. Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays at 14:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u Agenda wiki pages: Monday, 19 November 2018 at 14:00 UTC: https://community.icann.org/x/DQnVBQ Thank you. Kind Regards, Terri

2 1

Notice of EPDP team face-to-face meeting/ 16-18 January 2019/ Toronto Canada
by Terri Agnew Nov. 16, 2018

Nov. 16, 2018

Dear all, The EPDP team working on the Temporary Specification for gTLD Registration Data will meet for its third face-to-face meeting in Toronto, Canada from the 16th to the 18th January 2019. Members and liaisons should schedule their travel to arrive on Tuesday, 15 January 2019 with a departure Friday, 18 January 2019 early evening, or Saturday, 19 September 2019 in the morning. This is a three-day meeting with sessions starting at 09:00 local time and ending at 18:00 local time. Please plan travel to attend all sessions. ICANN's Constituency Travel team will be contacting members and liaisons shortly, please respond to them promptly in order to finalise travel details. If members are unable to attend, they must liaise with their alternates and the ICANN Support Team urgently in order to secure adequate representation at the face-to-face meeting. Members must assign an appointed Alternate via the Alternate Assignment form [goo.gl]<https://urldefense.proofpoint.com/v2/url?u=https-3A__goo.gl_forms_xtfYf9mWF…>. There will be a welcome reception early Tuesday evening and a EPDP team dinner on Wednesday evening. Breakfast is included in the hotel room rate and lunches will be served at the meeting venue. By the date of this meeting, it is planned that we will have identified the key issues for discussion so we think it is well-timed. Thank you for the time and sacrifice required by this effort generally and especially for the travel and work required for this meeting. Further information, including remote listening, will be available and provided closer to the meeting time. For any assistance or additional questions, please contact to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org>. With kind regards, Terri --- Terri Agnew Operations Support - GNSO Lead Administrator Internet Corporation for Assigned Names and Numbers (ICANN) Email: terri.agnew(a)icann.org<mailto:terri.agnew@icann.org> Skype ID: terri.agnew.icann Find out more about the GNSO by visiting: https://learn.icann.org/ [learn.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO [twitter.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Follow the GNSO on Facebook: https://www.facebook.com/icanngnso/ [facebook.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.facebook.com_icann…> http://gnso.icann.org/en/ [gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_en_&d=Dw…>

1 0

ICANN Org Feedback on Roles and Responsibilities Memo
by Trang Nguyen Nov. 16, 2018

Nov. 16, 2018

Dear EPDP Team, Attached, please find ICANN org’s feedback on the roles and responsibilities memo that Thomas circulated on 7 November. This document is not an official ICANN org or Board position but is intended to provide additional input from ICANN org into the ongoing deliberations of the EPDP Team about whether or not Article 26 of the European Union’s General Data Protection Regulation (GDPR) applies to processing activities concerning gTLD registration data. The document sets out key points to add to the discussion on the Roles and Responsibilities Memo. These points provide additional viewpoints to help assess whether or not Article 26 of the GDPR applies to various gTLD registration data processing activities. The points are not intended to be exhaustive; other issues may arise and should be further discussed among the EPDP Team, and ICANN org looks forward to participating in further discussions. Dan and Trang ICANN org liaisons

3 2

Legal vs Natural and Redactions
by Hadia Abdelsalam Mokhtar EL miniawi Nov. 16, 2018

Nov. 16, 2018

Marika, On Legal vs Natural, you can definitely say that the ALAC supports making the distinction mandatory. In the sentence "They further are of the view that this critical issue falls squarely within the scope of the EPDP, as it is already addressed in the Temporary Specification.", "is already addressed" is somewhat misleading as it might be construed to imply that the Temp Spec already requires the distinction. However, the Temp Spec does reference the issue in "Annex: Important Issues for Further Community Action" and the EPDP Charter explicitly asks whether the distinction should be required so there is no question the issue is within scope. On redactions, the ALAC supports the proposal that Rec #3, redactions only apply to registrants who are natural persons where anonymized e-mail addresses or a web form be provided, and that for legal persons, the original addresses be provided. This is in line with the EDPB letter of 05 July. In fact, the letter goes further in that it is not restricted to legal persons and says that all registrants could use non-personal e-mail address which would therefore not need to be anonymized. Hadia on behalf of myself and Alan

10 14

Proposed Agenda - EPDP Team Meeting #27 - 16 November 2018
by Caitlin Tubergen Nov. 16, 2018

Nov. 16, 2018

Dear EPDP Team, Below, please find the agenda for our next EPDP meeting on Friday, 16 November at 1400 UTC. Thank you. Best regards, Marika, Berry, and Caitlin EPDP Meeting #27 Agenda Friday, 16 November 2018 Roll Call & SOI Updates (5 minutes) Welcome and Updates from EPDP Team Chair (5 minutes) Review of outstanding action items Other updates, if applicable Continue review & discussion of comments / input received on Initial Report Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report Commence review of proposed changes / comments on the Initial Report Confirm approach for addressing these Confirm next steps, if any Confirm / discuss any input on the Thomas’s Responsibilities text (if any) Wrap and confirm next meeting to be scheduled for Monday 19 November at 14.00 UTC. Confirm action items Confirm questions for ICANN Org, if any

1 0

List of preliminary recommendations and related meetings
by Marika Konings Nov. 16, 2018

Nov. 16, 2018

Dear All, Per the RySG request, please find below the list of preliminary recommendations as currently included in this version of the Initial Report (https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyG…) and the related meeting during which this topic was discussed/agreed, to the best of our recollection. We hope this is helpful. Best regards, Caitlin, Berry and Marika ======================= Preliminary Recommendation #1 Result of ongoing deliberations on purposes (LA F2F meeting as well as subsequent meetings) Preliminary Recommendation #2 ICANN63 F2F meeting in the context of deliberations on Purpose B Preliminary Recommendation #3 LA F2F meeting Preliminary Recommendation #4 Result of ongoing deliberations on data elements workbooks Preliminary Recommendation #5 Result of ongoing deliberations on data elements workbooks Preliminary Recommendation #6 Result of ongoing deliberations on data elements workbooks (Escrow) and input during triage re. need for appropriate agreements Preliminary Recommendation #7 To be deleted – was result of deliberations during EPDP Team meeting #22 Preliminary Recommendation #8 Result of ongoing deliberations on data elements workbooks (Compliance) Preliminary Recommendation #9 ICANN63 F2F meeting, Meeting #25 Preliminary Recommendation #10 ICANN63 F2F meeting Preliminary Recommendation #11 Meeting #25 Preliminary Recommendation #12 Result of ongoing deliberations on data elements workbooks, Meeting #23 Preliminary Recommendation #13 Small team #3, ICANN63 F2F meeting Preliminary Recommendation #14 Result of ongoing deliberations on data elements workbooks, Meeting #24, #25, #26 Preliminary Recommendation #15 To be deleted – result of small team deliberations during LA F2F meeting Preliminary Recommendation #16 Triage Survey, Meeting #5 Preliminary Recommendation #17 Triage Survey, Meeting #5 Preliminary Recommendation #18 Triage Survey, Meeting #5 Preliminary Recommendation #19 LA F2F Meeting Preliminary Recommendation #20 Triage Survey, Meeting #5 Preliminary Recommendation #21 Triage Survey, Meeting #5 Preliminary Recommendation #22 LA F2F Meeting Preliminary Recommendation #23 ICANN63 F2F meeting Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 1

Notes and action items - EPDP Team Meeting #26
by Caitlin Tubergen Nov. 15, 2018

Nov. 15, 2018

Dear EPDP Team, Below, please find notes and action items from today’s EPDP team meeting. As a reminder, any comments or concerns on the draft Initial Report are due COB TODAY, 15 November. Thank you. Best regards, Marika, Berry and Caitlin EPDP Team Meeting #26 15 November 2018 High-Level Action Items: EPDP Team to review Thomas’ proposed language concerning the responsibilities of the parties in processing data in advance of tomorrow’s meeting. EPDP Team to note any additional concerns with draft preliminary recommendations by COB today. Support Staff to map preliminary recommendation to meeting dates so the EPDP Team can trace the origin of specific recommendations. Support Staff to redraft language for third party beneficiary recommendation indicating there is a diversity of opinion on that issue.. Notes These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/uQXVBQ Proposed Agenda: 1. Roll Call & SOI Updates (5 minutes) Attendance will be taken from Adobe Connect Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) a. Review of outstanding action items b. Other updates, if applicable The Leadership Team is meeting with the PCST Team today, and the meeting location should decided at that meeting. Results of this discussion will be communicated to the EPDP Team as soon as available. The Leadership Team is looking into using a different tool for public comment submission in an effort to organize and analyze comments more efficiently. Regarding Charter questions k, l, and m about data processing terms - no volunteers came forward to draft text, but Support Staff sent draft language for review to the list yesterday. Feedback from EPDP Team: If the team recommends ICANN and CPH to enter into joint controller agreements, the schedule of responsibilities could be included in the JCA and could be left to implementation. This Team does not need to specify that CPH needs to comply with GDPR. The Team is tasked with addressing potential inconsistencies with the Temp Spec and the law. Regarding Amr's recommendation with respect to legal vs. natural, Amr has amended the Initial Report language. Benedict's proposal requires Rrs to allow registrants to make a declaration of if they are a legal or natural person. The CPH position - distinction b/w natural and legal persons is not necessary for GDPR compliance and as such, is not appropriate for this time. How can the team resolve this issue equitably? Perhaps Benedict's recommendations can be included in the report, noting disagreement. 3. Thomas Rickert to review proposed language for Responsible Parties for inclusion in the Initial Report. The google doc shows previous language with some amendments based on recent discussions. In confirming the team is aligned on responsible parties language: First question - can the team speak to the legal question of responsible parties classification? Based on our last call, there appeared to be consensus that the team can make this classification. Feedback: It's unclear how to move this recommendation to policy language. In the triage phase, the team noted ICANN and CPH need to have GDPR compliant contracts in place. Second question - what language should be included in the Initial Report to reflect the current state of deliberations? The Team could consider leaving the language vague until we receive ICANN's reasoning as to why it thinks it is not a joint controller. If the Team is convinced a joint controller situation is present, it should draft recommendations accordingly. The EPDP Team's classification of joint controllership is not new and has been discussed on multiple occasions. The necessary piece is that contracted parties enter into negotiation with ICANN, but the specificity should be left to the negotiating parties. First, the principle question is whether the joint controllership situation is applicable or not? Consider adding language - enter into written agreements as set out below (rather than using the term joint controller agreement) The Team did a lot of work to complete the worksheets, and responsible parties seems to be the one area where the team achieved consensus. It seems that the work the team did led to joint controller agreements, and the results of this work should be documented in the Initial Report. A joint controller agreement does not mean a joint controllership for every single purpose - the agreement would break down the roles and responsibilities. The missing piece in this memo is the joint controllership will reflect the work done in the workbooks and will apportion roles and responsibilities according to the EPDP Team's work. Proposed revision regarding the first sentence is in the chat - The EPDP Team recommends that ICANN and CPH enter into an appropriate data processing agreement which may be a joint controller agreement. Based on the information and the deliberations the EPDP Team had on this topic and pending further input and legal advice, the EPDP Team recommends that ICANN negotiates and enters into a JCA with the contracted parties. The table defines the term ICANN purpose. There is a reference to a single JCA - is that a single JCA b/w ICANN, all registries and registrars? That is a question for the Team to decide. Thomas recommends basic parameters are in all JCAs or a standard JCA, but there would be exceptions to reflect special scenarios. The definition of ICANN purposes should not reference billing. Billing was referenced as this is a processing activity that is b/w a contracted party and its customer, and ICANN is not involved. Surprised by ICANN's forthcoming reasoning about joint controllership, especially in reference to publication of WHOIS data. This language needs to be taken back to the RySG. The red herring of billing information should be removed as this data is not published in WHOIS. If the purposes are solely for ICANN, is ICANN the sole controller as opposed to the joint controller? Billing could be taken out. The reason it was included was because this purpose is included in the Temp Spec, but the Team agreed to remove it as registrars do not use this information for this purpose. How would the processing look different if one of the parties was removed - if it would be different, this would support a joint controllership. It may be helpful to have a webinar specifically on this issue early in the public comment period. How do resellers fit into the joint controllership scenario? Under some purposes, contracted parties are processors - escrow, RPMs Please read through the tables regarding the allocation of responsibilities. Give everyone 24 hours to provide feedback in advance of tomorrow's call. Some of the arguments and rationale are a bit confusing. Some of the language may indicate that back-end ROs are also controllers, but they are processors. a. EPDP Team to discuss approach and bring up concerns, if any b. Confirm next steps, if any 4. Commence review & discussion of comments / input received on Initial Report The Support Team has captured the Initial Report comments (from the Google Doc) Some comments are cosmetic/grammatical changes, so those changes have been applied. In cases of uncertainty of substance changes, those comments were included for further discussion. For purposes of this discussion, if the commenter can explain their rationale and proposed change, we will open it up for discussion. Is it still our intention to publish the report on 19 November. The answer is yes. The fact that we're still discussing substantive edits is a cause for concern. What is the process for the Team to agree on what ends up getting included and what doesn't? Where there is agreement - the recommendation will be included (noting disagreement). The proposed changes from the RrSG: this was not discussed within the context of if these comments need to be included before the report can be published. The RrSG members need to consult with their group to see if these could be included in the submitted public comments or if they can be dealt with now. On behalf of the registries, Kristina put in a request to include the particular meeting reference when something was agreed upon. The effort to go through where the EBERO recommendation, for example, came from. What may be in notes and recollection may not match the words of the recommendation. In the interest of getting you what you need, is there a way to highlight the recommendations you need further information on? No, it is all of the recommendations. Item O on this list does show where the recommendations came from. Some recommendations resulting from Small Team efforts or are derivatives of several calls; accordingly, it may be difficult to pinpoint the exact meeting where the recommendation derived. There may not be agreement on recommendation 7. Some recommendations in the report seem to have come out of nowhere. It would be helpful to flag any recommendation issues specifically by tomorrow. Recommendation regarding third party beneficiaries - any objection to taking this out of the initial report? This language does serve a purpose within the contract - do not support removing the language, even though it is poorly worded. This may need to be revisited to clean up the language. There should not be third party beneficiary restrictions in consensus policies Action item: Staff to propose language for third party beneficiary recommendation There should be a distinction b/w recommendations agreed to in plenary vs. small teams RPM WG confirmed it is expected to review UDRP in its next phase of work. If the EPDP Team notes anything in relation to data processing activities with respect to RPMs, it would be helpful to share with the RPM WG. There does not seem to be agreement about what optional means, so the Team is asking for clarification with respect to liability with the EPDB. Agreement to leave language as is. Recommendation 7 – should this be deleted? Should the first sentence be added, or should the whole recommendation be deleted? The discussions have not risen to the level of a consensus policy recommendation, but the language could be included in the report. The Team is not limited making recommendations about contractual requirements. Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report a. Commence review of proposed changes / comments on the Initial Report b. Confirm approach for addressing these c. Confirm next steps, if any 5. Wrap and confirm next meeting to be scheduled for Thursday 15 November at 14.00 UTC. a. Confirm action items b. Confirm questions for ICANN Org, if any

1 0

Recordings, Attendance & AC Chat / GNSO Temp Spec gTLD RD EPDP / Thursday, 15 November 2018
by Andrea Glandon Nov. 15, 2018

Nov. 15, 2018

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Thursday, 15 November 2018 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/YAPVBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-15nov18… <https://urldefense.proofpoint.com/v2/url?u=https-3A__audio.icann.org_gnso_g…> AC Recording: https://participate.icann.org/p680y04ux08/<https://participate.icann.org/p680y04ux08/?OWASP_CSRFTOKEN=663c37463e43b07a…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0