November 2018 - Gnso-epdp-team

Re: [Gnso-epdp-team] [Ext] RE: Language for inclusion in the Initial Report - Natural/legal person and geographic basis
by Marika Konings Nov. 12, 2018

Nov. 12, 2018

Laureen, please note that the GAC’s proposed changes were made on the old version, not the one that was circulated earlier today. The version circulated today, see attached here again, contains language proposed by the BC/IPC for which it was indicated that the GAC might want to sign up to that language as well. As there seem to be parallels between the language the GAC has put forward and the one suggested by the BC/IPC, can you please confirm whether you want to see the GAC input added separately or whether you want to add the GAC name to the existing paragraph? Thank you for confirming. Best regards, Caitlin, Berry and Marika p.s. we just noted that for some reason the addition of the EDPB language in relation to this issue on page 1 is not marked in redline, but it is new language that was added in response to the input provided. From: "Kapin, Laureen" <LKAPIN(a)ftc.gov> Date: Monday, November 12, 2018 at 11:58 AM To: Marika Konings <marika.konings(a)icann.org>, "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Cc: "Ashley Heineman (AHeineman(a)ntia.doc.gov)" <AHeineman(a)ntia.doc.gov> Subject: [Ext] RE: Language for inclusion in the Initial Report - Natural/legal person and geographic basis Dear colleagues, I’m attaching the additional views of the GAC on the natural/legal distinction. Apologies for the delay. Laureen Kapin Counsel for International Consumer Protection Office of International Affairs Federal Trade Commission (202) 326-3237 lkapin(a)ftc.gov From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> On Behalf Of Marika Konings Sent: Monday, November 12, 2018 10:45 AM To: gnso-epdp-team(a)icann.org Subject: [Gnso-epdp-team] Language for inclusion in the Initial Report - Natural/legal person and geographic basis Dear All, With the aim of finalizing the proposed language in relation to natural/legal person and geographic basis, please find attached the proposed language for inclusion in the Initial Report . The leadership team & staff tried to address all input and find the right balance in conveying the different points of view without turning this into a lengthy debate between the different perspectives. Do note that for the parts highlighted in yellow, groups can still indicate if they want to have their name associated with a certain position. Thank you for all your input. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

REMINDER-- Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 13 November 2018 at 14:00 UTC
by Andrea Glandon Nov. 12, 2018

Nov. 12, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays at 14:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/VgPVBQ Thank you. Kind Regards, Andrea

1 0

EPDP Team Preliminary Recommendation #8 - Redaction of RNH Organization Field
by Amr Elsadr Nov. 10, 2018

Nov. 10, 2018

Hi, I would like to once again raise the issue of the optional “Organization” field listed in the draft initial report, and ask that it be changed from “Non-redacted” to either “Redacted”, or at a minimum, indicate that there is no consensus on the EPDP Team on whether this data element should be redacted or not. The Outstanding Issues document dated 6 November circulated by staff described recommendation #8 on data redaction as follows: > "The current language aims to reflect the EPDP Team discussion during ICANN63. What aspects need to be further considered? It is the expectation that further information obtained during the public comment period may help to further inform this discussion." I don’t believe this is entirely accurate, as the text rationalizing recommendation #8 in the draft initial report did not capture the discussion that took place on the last day of our F2F meetings at ICANN 63. There is a bullet in the draft initial report specifically addressing this data element, yet it makes no mention of the concerns raised about how non-redacted information may, in combination with other data elements, result in a data subject becoming identifiable. This is a nuance in GDPR compliance, which the EPDP needs to address and has been previously discussed. As a reminder, in Barcelona, the NCSG referenced the legal advice provided by WSGR to the GNSO RDS PDP WG on this issue, which reads as follows: > "Data elements are considered to be personal data if they relate to an identified or identifiable natural person (i.e., an individual). This depends on the context and the particular data element involved, and data that may not seem identifiable on their face may still be considered to be personal data (e.g., a 16-digit number may actually be a credit card number). Given the growth of computing power, much data that was earlier not considered to be personal has become viewed as personal data, so the concept is fluid. Under current data protection law (i.e., the Directiveand national implementations of it), the data of legal persons is covered in only a few jurisdictions, while under the GDPR, it will not be covered by data protection law at all (see Recital 14). The GDPRgives as example of the data of legal persons, their name and form as well as their contact details, which it states, are not covered. However, the key factor is not just whether the name of the registrant is that of a natural or legal person, but how the different data fields, when taken together, relate to an individual." Additionally, Recital 26 of the GDPR states that: > "The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly." Although a data element identifying an Organization name does not in itself identify a natural person, it certainly relates to one. Additionally, in combination with other non-redacted data elements such as “Country” and “State/province”, it can very likely contribute to a data subject becoming more identifiable. The current text in the draft initial report addressing the “Organization” data element only indicates that the EPDP Team has questions regarding liability, should a RNH choose to provide PII within the “Organization” field. The NCSG's concerns are clearly broader than this scenario, and we ask that (at a minimum) the concern outlined here be included in the report, referencing the above sources, and indicating that this is an issue on which there is still no consensus. Thanks. Amr

1 0

Proposed Agenda - EPDP Team Call #24 - Thursday, 8 Nov
by Caitlin Tubergen Nov. 10, 2018

Nov. 10, 2018

Dear All, Please find below the proposed agenda for the next EPDP Team meeting, which is scheduled for Thursday 8 November at 14.00 UTC. Best regards, Marika, Berry and Caitlin EPDP Meeting #24 Agenda Thursday, 8 November 2018 Roll Call & SOI Updates (5 minutes) Welcome and Updates from EPDP Team Chair (5 minutes) Review of outstanding action items Other updates, if applicable Review of Responsible Parties Recommendations (Thomas)* Review and discuss draft recommendations Confirm next steps, if any Review proposed updates to staff-suggested Natural vs. Legal persons text Review and discuss draft approach Confirm next steps, if any Review of Consolidated Data Elements Matrix Objective of discussion: Address any possible inconsistencies Confirm data elements matrix for inclusion in the Initial Report Confirm staff-suggested responses for Purpose Rationale questions Confirm Processing Activities structure, especially Disclosure and Retention Confirm Data Elements Review Data Elements Matrix Discuss inconsistencies identified by staff and proposed resolution Confirm next steps, if any Wrap and confirm next meeting to be scheduled for Tuesday 13 November at 14.00 UTC. Confirm action items Confirm questions for ICANN Org, if any *Please note if the responsible parties draft recommendations are not ready for tomorrow’s call, we will discuss redaction in its place.

3 4

For your review - updated language natural vs. legal
by Marika Konings Nov. 10, 2018

Nov. 10, 2018

Dear All, Per action item #2 from today’s meeting (Support Staff will rework language for natural vs. legal persons and send to the mailing list so that EPDP Team members can include and/or correct their own viewpoints. Please propose edits by tomorrow, Friday, 9 November.), please find attached the updated language. On pages 1-3 you can find the clean version, on pages 4-6 the redline, for those interested. For those that expressed an interest to add their view points to this language, please share your proposed additions by Friday 9 November COB. These additions are expected to be added to the yellow highlighted part of the text. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

6 5

For your review - revised language re. Geographic application
by Marika Konings Nov. 9, 2018

Nov. 9, 2018

Dear All, Please find attached for your review the proposed language in relation to geographic application for inclusion in the Initial Report, based on the input that has been received to date. Staff accepted the redlines of the previous version so the redlines on page 1-2 are the edits that have been made based on the discussions to date as well as edits suggested (in the subsequent pages you can find the original draft as well as input received). Please share any further comments you made have with the mailing list by Monday 12 November at the latest. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

5 8

Re: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report
by Marika Konings Nov. 9, 2018

Nov. 9, 2018

Milton, Lindsay, thank you for your input. Staff has made some proposed updates to reflect your feedback (see redlines on first two pages of the attached document). Hopefully this addresses accurately where things currently stand from all perspectives. Best regards, Caitlin, Berry and Marika From: Lindsay Hamilton-Reid <lindsay.hamilton-reid(a)fasthosts.com> Date: Wednesday, November 7, 2018 at 3:13 PM To: "Mueller, Milton L" <milton(a)gatech.edu> Cc: Marika Konings <marika.konings(a)icann.org>, Kurt Pritz <kurt(a)kjpritz.com>, "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Ext] Re: [Gnso-epdp-team] NCSG reactions to (part of) the interim report +1 Milton. In addition to Milton’s email below, these points have been made repeatedly by the NCSG and the CPH. The Interim Report should reflect the differences in opinion and that there is no consensus on this point and many others. Many thanks Lindsay Sent from my iPhone On 7 Nov 2018, at 21:05, Mueller, Milton L <milton(a)gatech.edu<mailto:milton@gatech.edu>> wrote: Marika NCSG cannot accept big portions of the proposed text regarding the legal/natural persons distinction. We note that the text disregards statements from the contracted parties and NCSG. We would respectfully ask you to revise the text in a way that respects and reflects clearly stated and strongly held positions of at least three stakeholder groups. To be specific, the CPH has stated, in regard to the legal/natural persons and geographic distinctions: “Contracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations.” NCSG shares this opposition to requiring distinctions between legal and natural persons and geographic distinctions. In our comment on small team 1 we stated: “The main risk is that the difficulty of distinguishing between the two at the point of registration could lead to the unintended publication of the private data of many natural persons.” This assessment of risk is not reflected in the report. We also proposed deleting the entire paragraph on research because researching how various entities make this distinction basically assumes that making this distinction is a live option for the ePDP. In terms of consensus requirements, all indications are that it is not a real option. It is abundantly clear that no requirement for a distinction between legal and natural persons will survive a consensus recommendation process. At least three stakeholder groups – ¾ of the GNSO and roughly half of the ePDP – are rejecting it as an option. We think the report should move the process forward by explicitly recognizing this fact. Instead, we have Kurt stating on list that there was “an agreement” to do research on the feasibility of differentiating between natural and legal persons. This statement can only come from completely disregarding the interventions NCSG members made in Barcelona, on the latest call, and in an email sent Tuesday to the list by Amr elSadr. To quote from Amr’s email regarding Kurt’s statement regarding research: “I don’t believe that [research on legal/natural] was, in any way, reflective of a consensus to proceed with this recommendation among the Small Team members. To me, it was only an acknowledgement that this view was expressed, discussed, and subsequently required consideration by the whole team.” Kurt has not responded to this email. We will raise these concerns on the call tomorrow. In general, I think the team is in danger of losing sight of its primary mission, which is to quickly bring Whois into compliance with GDPR and to turn the temp spec into a legitimate policy. It seems that some people are seizing on the debate over the temp spec to impose new requirements on contracted parties. I understand that the chair and staff are trying their best to move things along, but we are disturbed by an apparent tendency to ignore or disregard clear position statements from SGs. One of the most important jobs of the ePDP chair is to recognize where consensus exists and where it does not. Some proposals are just not real options: they will never survive a council vote or a consensus call in the ePDP. It is unthinkable that the chair or staff would substitute their own preferences for the rough consensus of the working group. Let’s recognize the parameters of what people can live with and move forward from there. Eliminating options is progress, too. Milton Mueller, on behalf of NCSG From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Marika Konings Sent: Monday, November 5, 2018 11:49 PM To: Kurt Pritz <kurt(a)kjpritz.com<mailto:kurt@kjpritz.com>>; gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 Following on from Kurt’s message, please find hereby the proposed language for inclusion in the Initial Report. Attached is the document that would be linked so that those interested would be able to review the different perspectives and proposals put forward. h3) Should Contracted Parties be allowed or required to treat legal and natural persons differently, and what mechanism is needed to ensure reliable determination of status? h4) Is there a legal basis for Contracted Parties to treat legal and natural persons differently? h5) What are the risks associated with differentiation of registrant status as legal or natural persons across multiple jurisdictions? (See EDPB letter of 5 July 2018). The EPDP Team discussed these questions extensively (see [include link to attached document which includes the different proposals]) and although the EPDP Team agrees that Contracted Parties should be allowed to treat legal and natural persons differently, the EPDP Team did not agree on whether this should be required and/or what further steps could or should be undertaken to determine what mechanism is needed to ensure reliable determination of status. The EPDP Team further agrees under GDPR there is a legal basis to treat legal and natural persons differently, but does not agree on whether that means Contracted Parties should be required to do so, or whether the challenges and legal risks involved in doing so result in leaving this optional. Similarly, the EPDP Team discussed the implication of other data protection regimes which could have different requirements that impact both natural and/or legal persons that would need to be factored in. The EPDP Team identified a number of risks, including: * While legal persons don’t have the same protections under GDPR, natural persons employed by a legal person (and who may be designated as the registrant, admin or technical contact) are still natural persons enjoying rights and protections under GDPR. Some noted that this risk may be minimized through clear explanatory language beneath each field when filling in data fields within domain name registrations. * There may be situations in which it can be difficult to separate the data of natural persons from that of legal persons. This can be the case, for example, if the legal person is a sole proprietorship, if the name of a person appears in the company’s name, if the business address is a natural person’s residence, or if an email address is assigned to a single individual (“john.doe(a)company.example.com<mailto:john.doe@company.example.com>” as opposed to “info(a)company.example.com<mailto:info@company.example.com>. The EPDP has discussed whether this risk may be somewhat mitigated through educational resources. Some in the EPDP Team expressed caution, as a stated necessity to rely on educational resources may not be considered to be compatible with the concepts of privacy by default or privacy by design i.e. where additional ‘educational resources’ are deemed necessary, the process itself is likely not established or presented in a sufficiently clear manner. To help further inform the EPDP Team’s deliberations on this topic as the team works towards a Final Report, the EPDP Team would like to request that GDD staff, who will design the implementation of these policy recommendations, commences research by investigating how ccTLDs and contracted parties currently distinguish between natural and legal persons to inform the EPDP Team. In addition, the EPDP Team would like to request input on the following questions in relation to this topic: * Are there examples from other industries or areas, e.g. ccTLDs, where a mechanism has been successfully developed and implemented to distinguish between natural and legal person, factoring in some of the challenges identified above? * Should the EPDP Team decide to recommend requiring distinguishing between natural and legal persons, how should implementation be carried out, especially considering legacy registrations? * Should the EPDP Team decide to recommend that further research is undertaken, beyond the information that GDD staff may encounter, what and how should this research be carried out? * (For the EDPB) If registrars allow registrants to self-identify at the time as a natural or legal person, who will be held liable if the registrant incorrectly self-identifies and personal information is publicly displayed? Apart from self-identification, are there any other ways in which risk of liability could be mitigated by registrars? The research requested and input on these charter questions will help the EPDP Team further analyze if it is possible and desirable to make this distinction in the context of domain name registrations, in a manner that is commercially reasonable, implementable and does not result in unreasonable liability for contracted parties. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Kurt Pritz <kurt(a)kjpritz.com<mailto:kurt@kjpritz.com>> Date: Monday, November 5, 2018 at 7:45 PM To: "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 Hi Everyone: After all of this thought and writing, I think we have two paths forward that are relatively straightforward to describe. Rather than recap the arguments made here, I will just go right into my recommendations for next step and why. The Support Team will follow this with a better summation of what has transpired and how that leads to the recommendations below. It is clear that camps within our the team are at loggerheads with regard to how geographic basis and natural v legal persons should be handled within the proposed policy recommendations. Current situation and recent developments: Coming out of the small group meeting #1 during a teleconference, there was an agreement in principle that it was necessary to perform research in order to inform the policy discussion regarding the feasibility of differentiating between legal and natural persons. That agreement survived its initial introduction into the whole team where the comments centered around: (1) the adjectives used to describe the sense of urgency concerning the work, and (2) sharpening the detail regarding steps to be taken after the research. (There was never an agreement about how to proceed regarding differentiation of data subjects based on geographical considerations.) Starting Friday, substantial markups to the legal v natural agreement on doing research initiated this current three-day email chain. Preferred Recommendation (there are two): Go back to the agreement in principle that was reached in the small team with representatives from all groups to undertake research to determine if, how and to what extent we can distinguish between legal and natural persons. Then extend that research on to the geographic basis issue. A small group of us can contribute to the terms of reference for this research after the initial report is issued. Here is my rationale for this recommendation: 1) The various arguments laid out in all these emails on this list make the case themselves for the need to do research. For example, if the ICO says that processors can rely on data subject-provided information, does that mean that personal information mistakenly disclosed can be published without liability? We don’t know. We are setting up this and other questions for DPAs. Isn’t that … research? There are other scenarios in the emails that will take research to sort through: whether ccTLD experiences are relevant, or whether a registrant boarding a train and leaving the EU for China while another registrant boarding a ferry for Marseilles will both be protected by GDPR. All this takes research to sort out. Nearly all of the emails on this list have to do with scenarios in support of one position or another - but all need to be studied in order for us to determine if and how distinctions can be made. 2) Many of the arguments laid out are conclusory or without authority. I don’t think the research can have a preordained outcome. To make one point for each line of thinking: a) In the case of natural vs legal data subjects, some seek to build in in an implementation plan without knowing if or to what degree a solution is implementable b) In the case of Geographical distinctions between registrants, some are stating that such a distinction is categorically unimplementable without authority or evidence provided. I think the “truth will out” on these questions and we should not try to push research or our arguments to a pre-ordained outcome. 3) This will provide time to take the effects of existing laws in other jurisdictions into account - if that is deemed desirable. 4) This will take this discussion out of the critical path of finishing our reports, without leaving a blank. 5) The results of the research still must be considered by this team (or its successor) and a consensus derived. Research informs policy; it does not create policy. 6) If we agree to this approach, we can start the research now. If we temporize, there will be little done that will resolve this issue set over the next few months. Taking action in an attempt to understand all the complexity is the responsible thing to do. 7) These are complicated questions and research-based policy-making is required to answer them. How do we meet the timeline and still act in a thorough, detailed manner? By launching research and, in the meantime, going back to the rest of our questions. Whatever our policy conclusions are, even if we are deadlocked in several months time, we should be informed by information garnered from DPAs and other sources. The only other recommendation: MemorialIze the differences between the two sides on each of the two issues, explaining the arguments for each and asking for public comment on these issues. Here is my rationale for and against this recommendation: 1) It will allow us to publish the initial report and, properly framed, can garner specific public comment. However, other factors really argue against maintaining the current status and not taking some action: 2) In the time allotted for public comment, no commenter will be able to perform any meaningful research either. There might be reference to a study that partially informs our work, but not a dispositive study. At the end of the comment period, we are likely to be in the same place. 3) It is hard to see how the public comment will differ from our discussion, in this list, to date. 4) Even if we take the preferred research path above, we can still conduct the comment period on the current position of the parties. 5) If we have no outcome on this issue, the result, to me, is unknown and represent a risk to all parties at the table. Conclusion I thought is was remarkable that we came together and agreed to undertake this research on this difficult topic. It was a significant, meaningful compromise that embodied our reason for being here. I don’t see anything in all the emails that indicate another compromise is possible unless that discussion is informed with significant, new information. I believe the appropriate path for this group is to recognize the differences cannot be resolved without something new and to take this path. Talk to you soon and best regards, Kurt On Nov 5, 2018, at 4:38 PM, Mark Svancarek (CELA) via Gnso-epdp-team <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> wrote: Sorry for being dense, I still have questions. 1. It is not surprising that the addition of a new process step would generate short term inefficiencies. It’s 5 years later – are the verification rates improved from 2014? 2. How would an optional “let me self-identify as a corporation” capability be likely to cause verification disruptions? /marksv From: James M. Bladel <jbladel(a)godaddy.com<mailto:jbladel@godaddy.com>> Sent: Monday, November 5, 2018 13:28 To: Mark Svancarek (CELA) <marksv(a)microsoft.com<mailto:marksv@microsoft.com>>; gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: Contracted Parties and Small Teams #1 and #2 Mark – Shortly following the launch of the 2013 RAA’s requirements for WHOIS Verification, registrars noted that approx. 800,000 domains had been suspended in the first few months. The number continued to climb for a few years, and most were categorized as “false positives” Here’s some coverage of that data at the time. https://domainnamewire.com/2014/06/24/over-800000-domain-names-suspended-du… [na01.safelinks.protection.outlook.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__na01.safelinks.protect…> Any program that depends on Registrant self-categorization, self-declaration, or receipt & acting upon a notice has a huge error factor. For GoDaddy in 2014, the RAA verification rate was in the high 70% or low 80%, meaning that service to tens of thousands of customers was delayed or disrupted. It’s this experience that causes Contracted Parties (but particularly Registrars) to be skeptical of any requirement to just “send an email” or “have the Registrant check a box.” It doesn’t scale. J. ------------- James Bladel GoDaddy From: "Mark Svancarek (CELA)" <marksv(a)microsoft.com<mailto:marksv@microsoft.com>> Date: Monday, November 5, 2018 at 15:14 To: "James M. Bladel" <jbladel(a)godaddy.com<mailto:jbladel@godaddy.com>>, "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: RE: Contracted Parties and Small Teams #1 and #2 James, can you clarify this: “many of whom could lose access to their registrations.” From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Monday, November 5, 2018 10:57 To: gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 ePDP Colleagues and WG Leadership - This morning, Registry and Registrar representatives met to discuss the status of potential recommendations from Small Group #1 (Legal vs. Natural) and Small Group #2 (Geographic Regions) in our Draft Initial Report. We concluded that there are some legal bases supporting these distinctions under GDPR and other data protection laws, and note that our Initial Report supports this. However, we reiterate our numerous high-level concerns against making any Consensus Policy recommendations for contractual requirements in these areas. Our concerns involve: * Legal - Aside from GDPR, other data protection laws are less clear on the distinction between legal and natural persons. Future regulations may contain contrary requirements. Furthermore, data of legal entities may contain or consist of personal information of natural persons, which would be entitled to protection under the GDPR and similar data protection regimes. Likewise, the geographic distinctions also create uncertainties. * Technical - Contracted Parties are uniquely situated to assess the current level of the technological means available to us, and it is our stated position that a technical basis to reliably and confidently make such a distinction does not exist. Especially because any distinction schema would be dependent upon Registrant Self-Identification, which is fraught with error. * Commercial - Developing and deploying this technology will involve significant costs, which may be prohibitive for smaller organizations and a barrier to market entry. Regardless of whether the distinction(s) are applied to new registrations or legacy domain names, it would be a logistical nightmare for Contracted Parties, and a source of confusion for Registrants, many of whom could lose access to their registrations. * Asymmetrical Risks vs. Benefits - Contracted Parties would assume all regulatory risks of such an obligations, exclusively for the benefit of unburdened third parties. * Scope - The distinction between Legal and Natural persons, or geographic regions, does not currently exist in the Domain Name System. Therefore, any recommendation mandating this change is outside the scope of the ePDP, and possibly the “picket fence” of Registrar and Registry contracts. As a result, and for the avoidance of doubt, Contracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations. Thank you, J. ------------- James Bladel GoDaddy _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team

7 14

For your review: draft data retention text
by Caitlin Tubergen Nov. 9, 2018

Nov. 9, 2018

Dear EPDP Team: In advance of our meeting on Tuesday, 13 November, we are sharing the draft data redaction text for the Initial Report. The draft language is currently included in the draft Initial Report. This language aims to reflect the deliberations and different positions, but has not been confirmed yet by the EPDP Team. The redlines in the document denote proposed copy edits and clarifications from the EPDP Leadership Team and support staff. In reading through the draft attached text, please keep the following questions in mind: Are there any concerns or issues in relation to the proposed language for inclusion in the Initial Report? If so, please indicate concerns or issues with proposed modification, taking into account the deliberations to date (e.g. if your position is not in line with what is reflected here, please provide language that can be added to reflect your position instead of proposing changes that are unlikely to be supported by the rest of the group based on previous discussions). In relation to registrant contact mechanism, should Temporary Specification requirements remain in place (“Registrar must provide an email address or a web form to facilitate email communication with the relevant contact”)? If not, please provide your rationale and indicate what improvements / changes could be considered. Is the proposed modification by the NCSG acceptable for inclusion in the Final Report? Please come to our next meeting on Tuesday, 13 November prepared to discuss. Thank you. Best regards, Marika, Berry, and Caitlin

1 0

Recordings, Attendance & AC chat / GNSO Temp Spec gTLD RD EPDP / Thursday, 08 November 2018
by Andrea Glandon Nov. 9, 2018

Nov. 9, 2018

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Thursday, 08 November 2018 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/qg68BQ MP3: https://audio.icann.org/gnso/gnso-epdp-temp-spec-gtld-registration-data-08n… AC Recording: https://participate.icann.org/p1il7tmebma/<https://participate.icann.org/p1il7tmebma/?OWASP_CSRFTOKEN=663c37463e43b07a…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

Reminder - input on draft Initial Report due today, Friday 9 November
by Marika Konings Nov. 9, 2018

Nov. 9, 2018

Dear All, As a reminder, please make sure to get to get any remaining comments / proposed edits on the draft Initial Report in by the end of today by adding them to the google doc: https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyG… so the leadership can plan the agenda’s for next week’s meetings accordingly. It will likely be necessary to extend the current meetings and/or add an additional meeting on Wednesday so please make note of that in your agenda. Thanks, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Friday, November 2, 2018 at 9:45 AM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: Re: [Gnso-epdp-team] Proposed approach for reviewing and finalizing the Initial Report - please take note of first deadline for Monday 5 November Dear All, Please note that there was a mix up in the dates / days in the table below, this has now been updated so please use this version as your reference. Also, as requested, please find attached a Word version of the Initial Report. Please do not redline, but use the following form to provide your input https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyG…. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Thursday, November 1, 2018 at 4:23 PM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Proposed approach for reviewing and finalizing the Initial Report - please take note of first deadline for Monday 5 November Dear All, Per our discussion today, please find hereby the proposed approach for reviewing and finalizing the Initial Report. Attached you will find the version of the Initial Report that was presented during the meeting earlier today. Line numbers have been included to facilitate referencing / identifying sections. Please take specific note of the first deadline for Monday 5 November to flag responses to charter questions and/or preliminary recommendations that need to be considered (apart from those that have already been identified). When What By whom Why Monday 5 November Team to flag responses to charter questions and/or preliminary recommendations that need to be considered and why, identifying concerns/issues to be further discussed (as a reminder, all items highlighted in blue will be further considered / reviewed and so need not be raised). This is intended to capture sections requiring additional discussion - specific edits not needed at this point, just a general description of the discussion or re-litigation that is recommended. EPDP Team members To allow leadership team & staff plan meeting schedule and topics to be addressed in upcoming meetings. Tuesday 6 November Put forward list of outstanding issues & call schedule to address outstanding issues Leadership Team / Support Team Plan remaining meetings as well potential additional ones to address issues identified Wednesday 7 November (at the latest) Submit specific substantive comments / edits on the mailing list by: · Identifying the line number and issue of concern · Put forward proposed changes (factoring in the view points of others and discussions held until date – no reopening of previously agreed upon items) · Outline the rationale for proposed change(s) Submit these by using this google doc: https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyG… EPDP Team Groups (SG/C/ACs – not individual comments) Capture and create inventory of specific comments to be reviewed and addressed by the EPDP Team. Thursday 8 November Share list of comments that need further review / discussion. Schedule additional calls as needed to review and discuss substantive comments submitted. Leadership team / Support Team Develop systematic way for reviewing input provided with the objective of finalizing the Initial Report for publication Friday 16 November Publish proposed final version of Initial Report for EPDP Team review. Minor updates (grammatical issues or other) can be flagged off-list to staff for fixing prior to publication. Support Team Allow for ‘final’ review to identify minor issues that should be fixed prior to publication. Monday 19 November Publish Initial Report for public comment Support Team We appreciate that meeting these deadlines will require substantial work from all involved – we hope we can count on your support. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0