November 2018 - Gnso-epdp-team

Recordings, Attendance & AC chat from the GNSO Temp Spec gTLD RD EPDP Small Roles & Responsibilities team held on Thursday, 29 November 2018 at 18:00 and 21:00 UTC
by Terri Agnew Dec. 6, 2018

Dec. 6, 2018

Dear all, Please find the attendance and AC chat attached to this email. The MP3 and AC recording below from the two Small Teams to discuss the letter to the EDPB call held on Thursday, 29 November 2018 at 18:00 and 21:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/bQbuBQ First call MP3: https://audio.icann.org/gnso/gnso-epdp-small-call-1-29nov18-en.mp3 Second call MP3: https://audio.icann.org/gnso/gnso-epdp-small-call-2-29nov18-en.mp3 First call AC Recording: https://participate.icann.org/p1lfb0cr39n Second call AC Recording: https://participate.icann.org/p12zqjemvt2 ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Terri Agnew

10 23

Reminder - items for topic list
by Marika Konings Nov. 30, 2018

Nov. 30, 2018

Dear All, As a reminder, please share any subjects / issues that need to be added to the topic list by Monday 3 December COB at the latest. Attached you will find the latest version which includes updates to reflect the discussion on items #1 and #2 during Tuesday’s EPDP Team meeting as well as further details on the items remaining to be addressed in the data elements workbooks (new #14). Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Recordings, Attendance & AC Chat / EPDP Initial Report Webinar/Thursday, 29 November 2018
by Andrea Glandon Nov. 29, 2018

Nov. 29, 2018

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the EPDP Initial Report Webinar call held on Thursday, 29 November 2018 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/9grVBQ MP3: https://audio.icann.org/gnso/gnso-epdp-initial-29nov18-en.mp3 AC Recording: https://participate.icann.org/p2lxok0x238/ <https://participate.icann.org/p12a7q93n35/?OWASP_CSRFTOKEN=663c37463e43b07a…>** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

Reminder RSVP/ EPDP Initial Report webinar
by Terri Agnew Nov. 28, 2018

Nov. 28, 2018

Dear all, This is a reminder to RSVP if interested in joining the EPDP Initial Report webinar taking place on Thursday, 29 November 2018 at 14:00 UTC. We will be using a different Adobe Connect room from the Tuesday/ Thursday meetings. To RSVP for the join information, please send an email to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> Thank you, Terri Agnew

1 0

Re: [Gnso-epdp-team] F2F in Toronto
by Alan Greenberg Nov. 28, 2018

Nov. 28, 2018

Can you say when that will be, or whether or not it is downtown, near the airport, or elsewhere? Travel requests are supposed to be in by next Tuesday. Alan At 27/11/2018 07:42 PM, Terri Agnew wrote: >Hello, > >The hotel will be announced once the final contract is signed. > >Thanks for your patience, > >Terri > >-----Original Message----- >From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> On Behalf Of >Alan Greenberg >Sent: Tuesday, November 27, 2018 5:54 PM >To: EPDP <gnso-epdp-team(a)icann.org> >Subject: [Gnso-epdp-team] F2F in Toronto > >I have received my travel invitation. Can we please know which hotel >we will be in. It will make a difference on what flights I book. > >Alan > >_______________________________________________ >Gnso-epdp-team mailing list >Gnso-epdp-team(a)icann.org >https://mm.icann.org/mailman/listinfo/gnso-epdp-team

4 3

Updated slides for Thursday's webinar
by Marika Konings Nov. 28, 2018

Nov. 28, 2018

Dear All, Following yesterday’s EPDP Team meeting, leadership and the support team have reviewed and updated the slides for Thursday’s webinar by adding further details about the items that are expected to be discussed further and as such community input is particularly relevant (see new slide #12). Note that the questions for Community input listed on slide 14-17 are for reference – these will not be covered in detail. If you have any further comments or suggestions, please provide these in the form of proposed edits. Thanks, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

F2F in Toronto
by Alan Greenberg Nov. 28, 2018

Nov. 28, 2018

I have received my travel invitation. Can we please know which hotel we will be in. It will make a difference on what flights I book. Alan

2 1

Notes and action items EPDP Team Meeting #30
by Marika Konings Nov. 27, 2018

Nov. 27, 2018

Dear All, Please find below the notes and action items of today’s EPDP Team meeting. Best regards, Caitlin, Berry and Marika EPDP Team Meeting #30 Tuesday, 27 November 2018 Notes and Action Items High-level Notes/Actions: Action item #1: EPDP Team to encourage respective groups to participate in the public comment forum and participate in the webinar scheduled for Thursday 29 November. For sign up to the webinar, please contact gnso-secs(a)icann.org<mailto:gnso-secs@icann.org>. Action item #2: Staff support to schedule a call on Wednesday 28 November for small group of volunteers to compose letter to European Data Protection Board - to pose questions for them that were formed during the discussions leading to the formulation of the Initial Report. Action item #3: EPDP Team to review list of topics requiring resolution for a final report and indicate if any topics / items are missing by Monday 3 December COB. Action item #4: Leadership team to develop schedule of topics described in item above to be addressed per meeting. Action item #5: Staff and leadership team to consider team-suggested updates to be made to the webinar slides to reflect input received during today's meeting. For example, could include having some materials in reserve should there be few questions. Action item #6: EPDP Team to provide input on what points, in addition to those called out in the webinar slides, should be made. Questions for ICANN Org from the EPDP Team: Is there any further information that can be provided in relation to the discussions that have been held with the EDPB and/or DPAs in addition to the blog posts and correspondence that have been shared, such as briefing notes and summaries of meetings? Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/ZwPVBQ Proposed Agenda: 1. Roll Call & SOI Updates * Attendance will be taken from Adobe Connect * Remember to mute your microphones when not speaking and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) a. Publication of Initial Report and public comment forum new style – initial reactions? * Initial Report published for public comment last Wednesday in conjunction with the launch of the public comment forum (google form). See https://www.icann.org/public-comments/epdp-gtld-registration-data-specs-ini…. * Some issues with the word version of the form - staff to check what the issues might be. Action item #1: EPDP Team to encourage respective groups to participate in the public comment forum and participate in the webinar scheduled for Thursday 29 November. For sign up to the webinar, please contact gnso-secs(a)icann.org<mailto:gnso-secs@icann.org>. b. Review of outstanding action items c. Other updates, if applicable * See documents that were distributed prior to this meeting (draft letter to EDPB, slides for webinar and topic list of outstanding items). * Constituency travel should be sending out travel information shortly for January F2F meeting in Toronto. 3. Letter to EDPB (10 minutes): a. Confirm questions per Initial Report b. Confirm next steps * During deliberations, a number of questions were identified for the EDPB which are also documented in the Initial Report. These questions are documented in this letter. Some additional context / background has been provided to ensure that the issue is understood and questions are specific. * Note feedback provided by Thomas and Diane - issue of controller wasn't raised during the deliberations as a question to be asked to the EDPB. * EDPB is meeting next week - important to get letter in before that time. EDPB only meets once a month. * CPH to provide additional input shortly. Are there other avenues through which this input can be provided? Are these questions intended to provide advice? Could the letter flag to the EDPB that there are enough open questions that it may cause concern on their part. Is this the right moment to ask for this input? Does this look half baked without the proper explanation? * Note that the Initial Report foresees the Initial Report to be submitted to the EDPB to request feedback on the applicability of the law in relation to the proposed recommendations. * Also note that delaying sending this letter may mean that input is not received in time for consideration prior to finalizing the report. * Sending this letter doesn't foreclose going back or sending additional requests. * Important to get it right first time. May not get a response as there is no obligation to respond. * Consider forming small drafting team to review / rewrite the letter. One rep per group to volunteer. Volunteers to date: Mark S, Diane Plaut, Stephanie Perrin, Hadia, Amr, Ashley, Margie, Georgios, CP rep, Thomas. Action item #2: Staff support to schedule a call on Wednesday 27 November for small group of volunteers to review / rewrite letter. Question for ICANN Org: is there any further information that can be provided in relation to the discussions that have been held with the EDPB and/or DPAs in addition to the blog posts and correspondence that have been shared, such as briefing notes and summaries of meetings. 4. Review list of topics for further discussion (60 minutes) – see attached a. Any items missing? b. Confirm deadline for reviewing and adding any items missing. c. Commence deliberations on topics for further discussion. * See topic list shared prior to the meeting. * Contains items raised during review of Initial Report as well as flagged in the report as requiring further input. EPDP Team encouraged to review and provide input on whether any items are missing. * Concern in relation to having small teams reviewing public comments - should this be done by the full group? Idea is to see if it is possible to undertake some preparatory work that will help facilitate review by the full group. Could mean that discussions are held twice instead of saving time? All EPDP Team members do have an obligation to review all input received. * See recent EDPB guidance on territorial scope - that may help inform deliberations on geographic basis. * Item #1 - why is removing 'implementation' recommended as that does include the processing of personal data? Were more thinking about implementation of policies at the ICANN level with the use of an IRT - this would require processing of personal data at a future date? Does coordinate belong here? May need to revisit this - current language in Initial Report says 'Coordinate, operationalize, and facilitate policies for resolution of disputes regarding or relating to the registration of domain names (as opposed to the use of such domain names), namely, the UDRP, URS, PDDRP, RRDRP, and future-developed domain name registration-related dispute procedures for which it is established that the processing of personal data is necessary'. Isn't it ICANN's role to coordinate? Is language that is taken from the Bylaws. Proposed to remove "coordinate" from current language so it would read 'Operationalize and facilitate'. Leave current language as is - original comments seems to have been already addressed in the language that is currently in the Initial Report. * Item #2 - recommendations currently do not differentiate between requirements for thin or thick registries. Thin/thick is a topic that hasn't really been tackled head on. Need to look at the implications of the recommendations on a policy like Thick WHOIS. EPDP Team may need to spend a bit of time on what impact, if any, of these policy recommendations on other policies such as Thick Whois. Is there anything that needs to be adjusted as a result of this consideration. Action item #3: EPDP Team to review topic list and indicate if any topics / items are missing by Monday COB Action item #4: Leadership team to develop schedule of topics to be addressed per meeting 5. Preview of Thursday’s webinar (15 minutes): a. Outline & proposed approach b. Confirm next steps, if any * Would it be worth to specifically ask about recommendation #13 during the webinar? Why calling this out over others? Recent input from ICANN Org may warrant spending additional time on this? * What is the breakdown between presentation time and Q & A * Slide 18 – change that EPDP chose the google form * Can comments also be uploaded to google form? That option is available for those who cannot use google forms – they can submit the form directly to staff who will input the information. The google form is intended to facilitate review of comments after the fact, having inputs provided in different ways will make this challenging, also noting the short time available. The google form does provide for general comment boxes to provide input that is not related to the questions. * Should webinar go more into the substance of the recommendations? Time available may not allow to do justice to the substance. People need to read the report. * Purpose is to call attention to the fact that the Initial Report is published, how to read the Initial Report and how to use the public comment forum. Allow time for Q & A. Consider establishing a resource for asking question. * See how to emphasize which subjects are addressed in the recommendations. * Make sure that people are informed about what input is sought. * Consider assigning people to respond to questions. Staff expected to lead on the webinar, but members are free to join – consider having one rep from each group to be available and assist with questions. * Kurt to provide intro for the webinar – if there are any points he should call out, EPDP Team to provide input on those. Action item #5: Staff and leadership team to consider what updates to be made to the webinar slides to reflect input received during today's meeting. For example, could include having some materials in reserve should there be few questions. Action item #6: EPDP Team to provide input on what points, in addition to those called out in the webinar slides, should be made. 6. Wrap and confirm next meeting to be scheduled for Tuesday 4 December 2018 at 14.00 UTC (note, on Thursday 29 November a webinar to present the Initial Report and public comment forum has been scheduled) a. Confirm action items b. Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

2 1

EDPB Guidelines on the Territorial Scope of GDPR
by Amr Elsadr Nov. 27, 2018

Nov. 27, 2018

Hi, As I mentioned on today’s call, the EDPB has published some guidelines on the territorial scope of the GDPR, which I found to be interesting. I hope you all do too. https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-3… Thanks. Amr

1 0

Recordings, Attendance & AC Chat / GNSO Temp Spec gTLD RD EPDP / Tuesday, 27 November 2018
by Andrea Glandon Nov. 27, 2018

Nov. 27, 2018

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Tuesday, 27 November 2018 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/9ArVBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-27nov18… <https://urldefense.proofpoint.com/v2/url?u=https-3A__audio.icann.org_gnso_g…> AC Recording: https://participate.icann.org/p83diti0zo3/ <https://participate.icann.org/p12a7q93n35/?OWASP_CSRFTOKEN=663c37463e43b07a…>** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 04 December 2018
by Andrea Glandon Nov. 27, 2018

Nov. 27, 2018

**REMINDER** Please note that a webinar is planned for Thursday 29 November at 14:00 UTC, replacing the EPDP Team meeting, to provide those interested with an overview of the Initial Report as well as more information on how to submit public comments. To sign up for the webinar, please contact gnso-secs(a)icann.org<mailto:gnso-secs@icann.org>. Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/_ArVBQ Thank you. Kind Regards, Andrea

1 0

Draft Letter to EDPB
by Kurt Pritz Nov. 27, 2018

Nov. 27, 2018

Hi Everyone: I hope you all had a good break from GDPR. Among our next steps is to send a letter to the European Data Protection Board with our questions. After reviewing the questions as posed in the Initial Report, I thought that some background, clarification and additional detail were required so that the EDPB is better able to understand our questions and is also better able to provide helpful responses. In collaboration with the Support team, we drafted the attached letter that we intend to send onto the EDPB shortly. As the EDPB meets monthly and their next meeting is next week, it is important that we send our questions as soon as possible. Thanks in advance for taking time to read and consider this. Best regards, Kurt

4 3

Re: [Gnso-epdp-team] For Final Review - Initial Report - deadline Wednesday 21 November at 18.00 UTC
by Trang Nguyen Nov. 27, 2018

Nov. 27, 2018

Dear EPDP Team, Regarding recommendation #13, as we flagged today in the chat and previously provided in the ICANN feedback document<https://mm.icann.org/pipermail/gnso-epdp-team/2018-November/000895.html>, there are implementation-related issues and concerns that we look forward to continuing to discuss with the Team. For example, the practicality as well as cost of negotiating, monitoring, supporting, and enforcing 1200+ different agreements with potentially different obligations. We’d also like to flag some additional suggestions and questions on recommendation #13. For easy viewing, we extracted recommendation #13 from the draft Initial report and provided the suggestions and questions in the comment fields. To be clear, we do not believe that these items should delay publication of the Initial Report. We look forward to continued discussion with the EPDP Team on this topic. The one thing that we do want to flag for the EPDP Team’s consideration prior to the publication of the Initial Report is the inconsistency in how recommendation #13 is displayed in Section 2 and Section 4 of the Initial Report. Section 2 only contains 2 paragraphs while Section 4 contains these two paragraphs plus several paragraphs of additional text. Since the additional text does not appear in Section 2 of the report, we assume it is not part of the recommendation. If this assumption is correct, it would be helpful to make the separation of the additional text clearer in Section 4 of the report. Dan and Trang ICANN org liaisons From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Tuesday, November 20, 2018 at 11:46 AM To: "Gnso-epdp-team(a)icann.org" <Gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] For Final Review - Initial Report - deadline Wednesday 21 November at 18.00 UTC Dear EPDP Team, We are pleased to share the proposed Initial Report for publication. Thank you again for attending and constructively contributing to the many hours of meetings over the past few days. * Redline – https://drive.google.com/a/icann.org/file/d/171jOv42nahKFnPW1WhSE8ckr6K00i4… [drive.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__drive.google.com_a_ica…> * Clean – https://drive.google.com/a/icann.org/file/d/1OyG6ExIGkemW902jHYF7V88Y8mu-kO… [drive.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__drive.google.com_a_ica…> Note that in the redline version, you will find highlighted in yellow the updates proposed by Thomas for the responsibilities section. He also spotted some inconsistencies in the related tables that have been updated accordingly (as well as the related data elements workbooks sections). Please also note that per Monday’s discussion, the summary has been split out into an Executive Summary and Overview of Preliminary Recommendations. For your convenience, you will also find attached the clean Word version. However, should you spot any minor issues or show stoppers, please use the line number reference in the pdf version to facilitate locating the language. Minor issues (e.g. grammatical, readability) can be sent to staff off list. Due to internal ICANN processing times and deadlines we require feedback by 1800 UTC, tomorrow, 21 November. If you need additional time (not more than two hours), you must notify us before the 1800 cut off. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

5 9

Draft Initial Report webinar slides
by Caitlin Tubergen Nov. 27, 2018

Nov. 27, 2018

Dear EPDP Team, Please find the draft slides for Thursday’s webinar attached. Best regards, Marika, Berry, and Caitlin

1 0

Re: [Gnso-epdp-team] Proposed Agenda - EPDP Team meeting #30
by Margie Milam Nov. 26, 2018

Nov. 26, 2018

Hi Marika – Can you circulate the draft questions for the letter to the EDPB? It is hard to prep for the call without having access to the questions. Thanks! Margie From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Monday, November 26, 2018 at 6:03 AM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Proposed Agenda - EPDP Team meeting #30 Dear All, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 27 November at 14.00 UTC. Best regards, Caitlin, Berry and Marika EPDP Meeting #30 Agenda Tuesday, 27 November 2018 1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Publication of Initial Report and public comment forum new style – initial reactions? * Review of outstanding action items * Other updates, if applicable 1. Letter to EDPB (10 minutes): * Confirm questions per Initial Report * Confirm next steps 1. Review list of topics for further discussion (60 minutes) – see attached * Any items missing? * Confirm deadline for reviewing and adding any items missing. * Commence deliberations on topics for further discussion. 1. Preview of Thursday’s webinar (15 minutes): * Outline & proposed approach * Confirm next steps, if any 1. Wrap and confirm next meeting to be scheduled for Tuesday 4 December 2018 at 14.00 UTC (note, on Thursday 29 November a webinar to present the Initial Report and public comment forum has been scheduled) a) Confirm action items b) Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Proposed Agenda - EPDP Team meeting #30
by Marika Konings Nov. 26, 2018

Nov. 26, 2018

Dear All, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 27 November at 14.00 UTC. Best regards, Caitlin, Berry and Marika EPDP Meeting #30 Agenda Tuesday, 27 November 2018 1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Publication of Initial Report and public comment forum new style – initial reactions? * Review of outstanding action items * Other updates, if applicable 1. Letter to EDPB (10 minutes): * Confirm questions per Initial Report * Confirm next steps 1. Review list of topics for further discussion (60 minutes) – see attached * Any items missing? * Confirm deadline for reviewing and adding any items missing. * Commence deliberations on topics for further discussion. 1. Preview of Thursday’s webinar (15 minutes): * Outline & proposed approach * Confirm next steps, if any 1. Wrap and confirm next meeting to be scheduled for Tuesday 4 December 2018 at 14.00 UTC (note, on Thursday 29 November a webinar to present the Initial Report and public comment forum has been scheduled) * Confirm action items * Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

2 1

**Reminder** Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 27 November 2018
by Julie Bisland Nov. 26, 2018

Nov. 26, 2018

Tuesday, 27 November 2018 at 14:00 UTC for 2 hours Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/9ArVBQ Thank you. Kind Regards, Julie

1 0

Reminder: EPDP Webinar replacing EPDP Team meeting on Thursday 29 November at 14:00 UTC
by Nathalie Peregrine Nov. 26, 2018

Nov. 26, 2018

Dear all, Please note that a webinar is planned for Thursday 29 November at 14.00 UTC, replacing the EPDP Team meeting, to provide those interested with an overview of the Initial Report as well as more information on how to submit public comments. Please inform your respective groups accordingly. To sign up for the webinar, please contact gnso-secs(a)icann.org<mailto:gnso-secs@icann.org>. Kind regards, Nathalie Nathalie Peregrine Manager, Operations Support (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Email: nathalie.peregrine(a)icann.org <nathalie.peregrine(a)icann.org%20> Skype: nathalie.peregrine.icann Find out more about the GNSO by taking our interactive courses<applewebdata://EB3A6F47-9760-400D-A39B-A7EFFC56B467/learn.icann.org/courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>

1 0

Re: [Gnso-epdp-team] Initial Report published
by Marika Konings Nov. 23, 2018

Nov. 23, 2018

Also note that a webinar is planned for Thursday 29 November at 14.00 UTC, replacing the EPDP Team meeting, to provide those interested with an overview of the Initial Report as well as more information on how to submit public comments. Please inform your respective groups accordingly. To sign up for the webinar, please contact gnso-secs(a)icann.org<mailto:gnso-secs@icann.org>. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Caitlin Tubergen <caitlin.tubergen(a)icann.org> Date: Wednesday, November 21, 2018 at 4:16 PM To: "Gnso-epdp-team(a)icann.org" <Gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Initial Report published Dear EPDP Team, Please note the Initial Report is now published for Public Comment<https://www.icann.org/public-comments/epdp-gtld-registration-data-specs-ini…>. Additionally, Kurt and Rafik published the following blog<https://www.icann.org/news/blog/the-epdp-initial-report-on-gtld-registratio…>. On behalf of the Staff Support Team, thank you so much to everyone for your efforts in getting this published! For all of those celebrating Thanksgiving, have a wonderful holiday! Best regards, Marika, Berry and Caitlin

6 5

EPDP Webinar replacing EPDP Team meeting on Thursday 29 November at 14:00 UTC
by Nathalie Peregrine Nov. 22, 2018

Nov. 22, 2018

Dear all, Please note that a webinar is planned for Thursday 29 November at 14.00 UTC, replacing the EPDP Team meeting, to provide those interested with an overview of the Initial Report as well as more information on how to submit public comments. Please inform your respective groups accordingly. To sign up for the webinar, please contact gnso-secs(a)icann.org<mailto:gnso-secs@icann.org>. Kind regards, Nathalie Nathalie Peregrine Manager, Operations Support (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Email: nathalie.peregrine(a)icann.org <nathalie.peregrine(a)icann.org%20> Skype: nathalie.peregrine.icann Find out more about the GNSO by taking our interactive courses<applewebdata://EB3A6F47-9760-400D-A39B-A7EFFC56B467/learn.icann.org/courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>

1 0

Initial Report published
by Caitlin Tubergen Nov. 21, 2018

Nov. 21, 2018

Dear EPDP Team, Please note the Initial Report is now published for Public Comment. Additionally, Kurt and Rafik published the following blog. On behalf of the Staff Support Team, thank you so much to everyone for your efforts in getting this published! For all of those celebrating Thanksgiving, have a wonderful holiday! Best regards, Marika, Berry and Caitlin

3 2

Re: [Gnso-epdp-team] For Final Review - Initial Report - deadline Wednesday 21 November at 18.00 UTC
by Margie Milam Nov. 21, 2018

Nov. 21, 2018

Hi All- One change needed to Rec 8: Please insert a footnote that reads: “The IPC and BC representatives on the EPDP are of the view that there should be no redactions of any data elements for legal entities.” Margie From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Tuesday, November 20, 2018 at 11:47 AM To: "Gnso-epdp-team(a)icann.org" <Gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] For Final Review - Initial Report - deadline Wednesday 21 November at 18.00 UTC Dear EPDP Team, We are pleased to share the proposed Initial Report for publication. Thank you again for attending and constructively contributing to the many hours of meetings over the past few days. * Redline – https://drive.google.com/a/icann.org/file/d/171jOv42nahKFnPW1WhSE8ckr6K00i4…<https://urldefense.proofpoint.com/v2/url?u=https-3A__drive.google.com_a_ica…> * Clean – https://drive.google.com/a/icann.org/file/d/1OyG6ExIGkemW902jHYF7V88Y8mu-kO…<https://urldefense.proofpoint.com/v2/url?u=https-3A__drive.google.com_a_ica…> Note that in the redline version, you will find highlighted in yellow the updates proposed by Thomas for the responsibilities section. He also spotted some inconsistencies in the related tables that have been updated accordingly (as well as the related data elements workbooks sections). Please also note that per Monday’s discussion, the summary has been split out into an Executive Summary and Overview of Preliminary Recommendations. For your convenience, you will also find attached the clean Word version. However, should you spot any minor issues or show stoppers, please use the line number reference in the pdf version to facilitate locating the language. Minor issues (e.g. grammatical, readability) can be sent to staff off list. Due to internal ICANN processing times and deadlines we require feedback by 1800 UTC, tomorrow, 21 November. If you need additional time (not more than two hours), you must notify us before the 1800 cut off. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

3 2

A few more change requests
by Thomas Rickert Nov. 21, 2018

Nov. 21, 2018

All, I spotted a few more inconsistencies. Sorry there are no line numbers in the work sheet section. Best, Thomas APA 3 Change „transfer“ to „disclosure" Certain data elements (domain name and nameservers) would be required to be disclosed. The lawful basis would be 6(1)b, should personal data be involved, for Registrars and 6 (1)(f) of the GDPR for Registries. 6(1)(f) BPA 4 - does not list a legal basis. The rationale does not really fit in here as the life of registration +35 days would be superseded by the retention according to purpose 1. Also, it seems like the retention to restore the domain name is more a purpose 1 issue that would be justified with 6 I b than a SSR issue. Being able to restore a domain name is more a purpose 1 issue than a purpose 2 issue. My suggestion is to delete this or make it TBD. CPA 3 If CPA3 is TBD, the same should logically apply to BPA3 or both should be treated as BPA3. Just mentioning the inconsistency. I think we should not change it as this was a most controversial joint, but BPA3 does not really fit. CPA 4 covered by APA 4 EPA 1 for registrars: lawful basis missing. Add 6 I f) EPA 1 for registries - lawful basis missing. Add 6 I f) MPA 5 and MPA 6 independent controller - DRPs could also be independent controllers- at least we have not really discussed whether they just follow orders or whether they pursue their own purposes of data processing. I would add „processor or independent controller" NPA 1 Lawful basis: 6 I b add _for registrars_ NPA 5 - should rather be N/A Please note that sometimes we use singular and sometimes plural in the tables. Also, the changes in the work sheets would need to be synced with the summary. Thanks, Thomas

1 0

Recordings, Attendance & AC Chat / GNSO Temp Spec gTLD RD EPDP / Tuesday, 20 November 2018
by Julie Bisland Nov. 21, 2018

Nov. 21, 2018

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Tuesday, 20 November 2018 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/ZwPVBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-20nov18… AC Recording: https://participate.icann.org/p9if3ht4vwu/<https://participate.icann.org/p9if3ht4vwu/?OWASP_CSRFTOKEN=a7f49856259ae408…> <https://participate.icann.org/p12a7q93n35/?OWASP_CSRFTOKEN=663c37463e43b07a…>** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Julie

1 0

For Final Review - Initial Report - deadline Wednesday 21 November at 18.00 UTC
by Marika Konings Nov. 20, 2018

Nov. 20, 2018

Dear EPDP Team, We are pleased to share the proposed Initial Report for publication. Thank you again for attending and constructively contributing to the many hours of meetings over the past few days. * Redline – https://drive.google.com/a/icann.org/file/d/171jOv42nahKFnPW1WhSE8ckr6K00i4… * Clean – https://drive.google.com/a/icann.org/file/d/1OyG6ExIGkemW902jHYF7V88Y8mu-kO… Note that in the redline version, you will find highlighted in yellow the updates proposed by Thomas for the responsibilities section. He also spotted some inconsistencies in the related tables that have been updated accordingly (as well as the related data elements workbooks sections). Please also note that per Monday’s discussion, the summary has been split out into an Executive Summary and Overview of Preliminary Recommendations. For your convenience, you will also find attached the clean Word version. However, should you spot any minor issues or show stoppers, please use the line number reference in the pdf version to facilitate locating the language. Minor issues (e.g. grammatical, readability) can be sent to staff off list. Due to internal ICANN processing times and deadlines we require feedback by 1800 UTC, tomorrow, 21 November. If you need additional time (not more than two hours), you must notify us before the 1800 cut off. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

2 1

Re: [Gnso-epdp-team] [Ext] Re: Proposed Revised Rec. 21
by Marika Konings Nov. 20, 2018

Nov. 20, 2018

FYI – staff will make this update accordingly in the final version for posting unless there are any concerns. Best regards, Caitlin, Berry and Marika From: "Rosette, Kristina" <rosettek(a)amazon.com> Date: Tuesday, November 20, 2018 at 3:55 PM To: Marika Konings <marika.konings(a)icann.org> Cc: Thomas Rickert <epdp(a)gdpr.ninja> Subject: RE: [Ext] Re: [Gnso-epdp-team] Proposed Revised Rec. 21 Hi! Thomas and I are both fine with staff’s proposed change. K From: Marika Konings [mailto:marika.konings@icann.org] Sent: Tuesday, November 20, 2018 3:17 PM To: Rosette, Kristina <rosettek(a)amazon.com> Subject: Re: [Ext] Re: [Gnso-epdp-team] Proposed Revised Rec. 21 Kristina, any further feedback on this? For now, staff has not made any update to your original language, but if this is considered a minor change, it could still be applied before publication. Thanks for your feedback. Best regards, Marika From: "Rosette, Kristina" <rosettek(a)amazon.com<mailto:rosettek@amazon.com>> Date: Tuesday, November 20, 2018 at 7:51 AM To: Marika Konings <marika.konings(a)icann.org<mailto:marika.konings@icann.org>> Cc: Trang Nguyen <trang.nguyen(a)icann.org<mailto:trang.nguyen@icann.org>>, "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Ext] Re: [Gnso-epdp-team] Proposed Revised Rec. 21 Still considering it On Nov 20, 2018, at 8:16 AM, Marika Konings <marika.konings(a)icann.org<mailto:marika.konings@icann.org>> wrote: Dear EPDP Team, Are there any concerns about this proposed change? If yes, it can be discussed during the upcoming meeting. If not, staff will go ahead and make this modification. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Trang Nguyen <trang.nguyen(a)icann.org<mailto:trang.nguyen@icann.org>> Date: Monday, November 19, 2018 at 6:31 PM To: "Rosette, Kristina" <rosettek(a)amazon.com<mailto:rosettek@amazon.com>>, "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Proposed Revised Rec. 21 Dear Kristina and EPDP Team, Thank you for the revised recommendation 21 language. ICANN org suggests that the EPDP Team consider removing the word “the” from the language “…ICANN Org enters into the required agreements…” This word presupposes that ICANN must enter into an agreement with every entity “involved in registration data processing” when it has not been determined who all the parties involved in registration data processing are and whether an agreement will be required in all cases. For example, as mentioned this morning, some data escrow providers believe that they are controllers. Dan and Trang ICANN org liaisons From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of "Rosette, Kristina via Gnso-epdp-team" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Reply-To: "Rosette, Kristina" <rosettek(a)amazon.com<mailto:rosettek@amazon.com>> Date: Monday, November 19, 2018 at 8:51 AM To: "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] Proposed Revised Rec. 21 All, Thomas and I developed proposed revised Rec. 21 language. I posted it in chat, but copy it below for convenience: Rec. 21: The EPDP Team recommends that ICANN Org enters into the required agreements such as a Data Processing Agreement (GDPR Art. 28) or Joint Controller Agreement (Art. 26), as appropriate, with the non-Contracted Party entities involved in registration data processing such as data escrow providers and EBERO providers. These agreements are expected to set out the relationship obligations and instructions for data processing between the different parties. Kristina Rosette Senior Corporate Counsel, IP – Domains rosettek(a)amazon.com<mailto:rosettek@amazon.com> | 703.407.1354

1 0

Notes, action items from EPDP Team Meeting #29 - 20 November 2018
by Caitlin Tubergen Nov. 20, 2018

Nov. 20, 2018

Dear EPDP Team, Below, please find the notes and action items from today’s EPDP Team call. Thank you. Best regards, Marika, Berry and Caitlin High-Level Notes/Actions Thomas to propose new language in response to feedback he has received from the team for the Responsible Parties portion of the initial report today. Following receipt of Thomas’s language, Support Staff will circulate final version of the Initial Report to the EPDP Team. The Initial Report will be published for public comment tomorrow, 21 November 2018, unless “showstoppers” are identified that would warrant further discussion. These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/ZwPVBQ 1. Roll Call & SOI Updates Attendance will be taken from Adobe Connect Remember to mute your microphones when not speaking and state your name before speaking for transcription purposes. Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair a) Review of outstanding action items b) Other updates, if applicable Communication from ICANN travel department is forthcoming (likely this week) We are aiming to publish the Initial Report tomorrow (Wed, 21 Nov) so that the comment deadline is before the Christmas holiday. EPDP Team Feedback: It is more important to deal with outstanding items rather than publish to hit a date 3. Finalize outstanding items: a) Purpose O – see proposed language for addressing this in the Initial Report It may be beneficial to publish Purpose O in the initial report to allow the public to weigh in on it. The proposed language is confusing. It may be helpful to note we have not deliberated on this, but we are including for the purpose of receiving feedback. What question is ICANN considering here? As the Purpose O workbook has not been reviewed, it will not be included with the other approved workbooks (due to the differing status) Grave concerns with Purpose O - there are issues in terms of timeliness, issues in terms of unanswered questions with respect to this purpose. This language should not go in except to say - this came in late and the Team has not had adequate time to discuss this. There are concerns that this could necessitate changes to the RA. If so, this is a big red flag that we need to signal to the community. The word "threat" should be removed. This language should still be included in the initial report. This needs wordsmithing, but we have to keep this purpose. In formulating this person, Benedict and Farzaneh asked if OCTO uses personal information, the answer is no. The group has not had time to adequately discuss this. This also includes the accuracy reporting system. The program is on hold. We must include this issue in the initial report. In order to solicit public comment, this needs to be included. What we are talking about a purpose - this should be covered under Purpose B/Purpose 2. This is not a purpose that justifies collection. If it included, make a clear disclaimer that this has not been reviewed, but it will be reviewed prior to the final report. Without knowing ICANN’s needs, the Team cannot make an informed decision about this language. Note: the proposed language will be included in the body of the report, not within the recommendations section We cannot treat ICANN org the same as third parties under Purpose B There is a different interpretation as to whose research this entails - is it just ICANN or other researchers? Two questions: this cannot be put in at the last-minute b/c the Team has not discussed. (1) This is a data quality issue - this is an implementation issue. (2) should ICANN be doing this data quality exercise? Proposed path forward: introduce proposed purpose and ask for public comment. Action Item: Staff will circulate proposed language for the team's review. b) Additional language re. responsibilities section (Thomas) Thomas circulated this language earlier this week. This language aims to shed light on contracting, EBERO How would operationalizing these agreements work? A potential solution is proposed here - clarify that there is a plethora of JCAs. Leave flexibility to the parties who are entering into the agreements. We could make this better if we had more time. Diane offered additional changes. Action item: Thomas to include suggestions made by Diane, put in clarification to Marc, add a note that the drafting of the JCA is not within the scope of this EPDP today. c) Additional language re. UDRP (Margie) – see updated version circulated on Monday 19 November The updated language lays out the perspective of those who believe the changes in the temp spec have not caused any issues There is advocacy in this language. The point about privacy/proxy is that complaints can be filed without access to registration data, so the note about privacy/proxy is irrelevant. Cannot support this language going forward as is. Rather than say "some believe" add the specific parties who believe to this sentence. Primary concern from formatting perspective - the repeated reference to "some". It should say "proponents of pre-filing disclosure believe". Using some to refer to different views/groups is confusing. Action Item: Staff to send a rewrite of this UDRP section to the team following this call. (completed) d) Revised language for Preliminary Recommendation #2 – see revised version circulated on Monday 19 November by staff No objections to this text noted 4. Next steps for publication: a) Public comment forum – Google form See google form shared during the meeting Objective is to facilitate focused input from commenters but also review by EPDP Team following closing of public comment forum. Downloadable form will be available to allow for off-line preparations No sign up is required, only email address needs to be provided. Open fields will also be provided for general input. b) Community Webinar Organize community webinar to present report and explain public comment forum. Proposal to have staff present outline of report and how to submit comments, unless group prefers to do so. If report is published on Wednesday, webinar would be held on Thursday 28 November, if it is published next week, it would be on Thursday 4 December. c) Letter to EDPB d) Confirm publication date target Aim to publish tomorrow, unless show stoppers are identified that would warrant further consideration. 5. Wrap and confirm next meeting to be scheduled for Tuesday 28 November 2018 a) Confirm action items b) Confirm questions for ICANN Org, if any

1 0

Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 27 November 2018
by Julie Bisland Nov. 20, 2018

Nov. 20, 2018

Tuesday, 27 November 2018 at 14:00 UTC for 2 hours Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/9ArVBQ Thank you. Kind Regards, Julie

1 0

FW: FW: [Ext] Fwd: Additional language for roles and responsibilities
by Marika Konings Nov. 20, 2018

Nov. 20, 2018

FYI From: "Plaut, Diane" <Diane.Plaut(a)corsearch.com> Date: Tuesday, November 20, 2018 at 8:55 AM To: Marika Konings <marika.konings(a)icann.org>, Thomas Rickert <epdp(a)gdpr.ninja> Subject: Re: [Gnso-epdp-team] FW: [Ext] Fwd: Additional language for roles and responsibilities Marika- I sent the clarification language and Thomas asked me to re-send it this morning. Diane Plaut General Counsel and Privacy Officer [cid:image001.png@01D3CA70.18FC1D40] Direct +1 646-899-2806  diane.plaut(a)corsearch.com<mailto:diane.plaut@corsearch.com> 220 West 42nd Street, 11th Floor, New York, NY 10036, United States www.corsearch.com [corsearch.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.corsearch.com_&d=Dw…> Join Corsearch on Twitter [twitter.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_corsearch&…> Linkedin [linkedin.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_compa…> Trademarks + Brands [trademarksandbrands.corsearch.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__trademarksandbrands.cor…> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241) Corsearch.USCustomerService(a)corsearch.com<mailto:Corsearch.USCustomerService@corsearch.com> Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession. From: "Plaut, Diane" <Diane.Plaut(a)corsearch.com> Date: Monday, November 19, 2018 at 9:15 AM To: Marika Konings <marika.konings(a)icann.org>, Thomas Rickert <epdp(a)gdpr.ninja> Subject: Re: [Gnso-epdp-team] FW: [Ext] Fwd: Additional language for roles and responsibilities Dear Thomas- I am unable to be on the call today due to a last minute internal matter but suggest the following edited version (minor) that I think more accurately describes our work and the legal picture. Please let me know your thoughts or outputs from the call. Through the course of the EPDP and the work of the EPDP Team to date, the facts have indicated that there may likely exist a joint controller relationship between the parties in issue (the Registrars, Registries and ICANN). The EPDP Team understands that the determination of a joint controller relationship between requires work at a greater level of granularity than in this report. During the further work of the EPDP and negotiations that will subsequently take place between the CPH and ICANN in relation to memorializing this relationship when entering into a Joint Controller Agreement (JCA), the parties shall conduct a detailed review of the individual processing activities and the actions to be taken by the respective parties. A clear demarcation of the processing activities covered by the JCA versus those carried out by either party outside the scope of the JCA shall be documented and reflected both in the private, as well as in the public version of the JCA. The JCA shall ensure that the risks of data processing are shared adequately based on whose interests are concerned. Also, the JCA shall include indemnifications to ensure that no party shall ultimately be liable for another parties’ wrongdoing. The JCA shall recognize that parties are currently using third parties’ services or otherwise work with third parties, such as: - Data Escrow Agents - EBEROs - Registry Service Providers - Registrar as a Service Providers - Resellers - Dispute Resolution Providers - the TMCH. This may or may not include processing of personal data by those third parties. Where personal data is processed by third parties, the respective joint controller will need to ensure that the data processing is carried out in a way compliant with GDPR, and if needed, will enter into Data Processing Agreement(s) with said third party provider/processor. However, conditional to GDPR compliance, nothing in the JCA shall prevent the respective joint controller from engaging third parties and entering into the required agreements without further authorization from the other joint controllers. The EPDP Team considers it out of scope of its work to prescribe in what form JCAs will be entered into, as long as a set of the minimum requirements, as specified in the EPDP Team’s report, are met. It does appear advisable, though, to create one template, which can be amended to reflect situations that are not applicable industry-wide (such as eligibility requirements for registered name holders) and that JCAs are entered into per TLD between ICANN Org, the respective Registry Operator and registrars. A potential way to facilitate contracting would be to make the JCA part of the RRA, so there would be separate tri-party agreements between ICANN Org, the Registry Operator and each registrar. Standardized parts of the JCA should include the information that is legally required to be provided to the data subjects to allow for the use of the same language across all TLDs, as necessary. Diane Plaut General Counsel and Privacy Officer [cid:image001.png@01D3CA70.18FC1D40] Direct +1 646-899-2806  diane.plaut(a)corsearch.com<mailto:diane.plaut@corsearch.com> 220 West 42nd Street, 11th Floor, New York, NY 10036, United States www.corsearch.com [corsearch.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.corsearch.com_&d=Dw…> Join Corsearch on Twitter [twitter.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_corsearch&…> Linkedin [linkedin.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_compa…> Trademarks + Brands [trademarksandbrands.corsearch.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__trademarksandbrands.cor…> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241) Corsearch.USCustomerService(a)corsearch.com<mailto:Corsearch.USCustomerService@corsearch.com> Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession. From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Monday, November 19, 2018 at 7:40 AM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] FW: [Ext] Fwd: Additional language for roles and responsibilities The EPDP Team understands that a joint controller situation between ICANN Org, Registries and Registrars requires work at a greater level of granularity than in this report. During the negotiations, the parties shall conduct a detailed review of the individual processing activities and the actions to be taken by the respective parties. A clear demarcation the processing activities covered by the JCA versus those carried out by either party outside the scope of the JCA shall be documented and reflected both in the private as well as in the public version of the JCA. The JCA shall ensure that the risks of data processing are shared adequately based on whose interests are concerned. Also, the JCA shall include indemnifications to ensure that no party shall ultimately be liable for another parties’ wrongdoing. The JCA shall recognize that parties are currently using third parties’ services or otherwise work with third parties, such as - Data Escrow Agents - EBEROs - Registry Service Providers - Registrar as a Service Providers - Resellers - Dispute Resolution Providers - the TMCH. This may or may not include processing of personal data by those third parties. Where personal data is processed by third parties, the respective joint controller will need to ensure that the data processing is carried out in a way compliant with GDPR. However, conditional to GDPR compliance, nothing in the JCA shall prevent the respective joint controller from engaging third parties and entering into the required agreements without further authorizations from the other joint controllers. The EPDP Team considers it out of scope of its work to prescribe in what form JCAs will be entered into, as long as a set of the minimum requirements as specified in the EPDP Team’s report, are met. It does appear advisable, though, to create one template, which can be amended to reflect situations that are not applicable industry-wide (such as eligibility requirements for registered name holders) and that JCAs are entered into per TLD between ICANN Org, the respective Registry Operator and registrars. A potential way to facilitate contracting would be to make the JCA part of the RRA, so there would be separate tri-partite agreements between ICANN Org, the Registry Operator and each registrar. Standardized parts of the JCA should include the informations that are legally required to be provided to the data subjects to allow for the use of the same language across all TLDs as much as possible.

1 0

UDRP Language - Additional Language to Consider
by Margie Milam Nov. 20, 2018

Nov. 20, 2018

HI – following up on my action item—here is the language I suggest. Have a great weekend everyone! Margie ______________ ….However this proposed addition was not supported by others who pointed out that in the case of privacy/proxy registrations complainants never often do not have access to registrant information pre-filing. Some believe that GDRP redaction is distinguishable from a privacy/proxy registration because a privacy/proxy services is a separate service (associated with a fee) that the registrant chooses, with separate ICANN policies, and a different set of responsibilities. For example, the proxy service is considered the registrant, and under can face liability under RAA Section 3.7.7.3. Similarly, concerns were expressed about how this pre-filing disclosures could be implemented in practice as it could result in information being disclosed to anyone claiming to be interested in filing a UDRP complaint, without any obligation to follow this through. Some believe that this concern can be addressed through policy recommendations to be explored further in this ePDP, such as, * Require the trademark holder to represent that they have a good faith intent to file a UDRP or other dispute resolution mechanism or cybersquatting action * Suggest that Dispute resolution providers be able to audit requests to ensure that the requester filed a UDRP/URS or legal complaint, or in good faith determined that no grounds existed. * Require the TM holder to have a TMCH filing with valid SMD file * Require the TM holder to agree to data processing standards (i.e. model clauses, or similar). * Limitations on the number of records accessible under this purpose

5 6

Proposed modified language for Preliminary Recommendation #2
by Marika Konings Nov. 20, 2018

Nov. 20, 2018

Dear EPDP Team, As discussed during today’s meeting, please find below the proposed rewording for Preliminary Recommendation #2. As noted, the first part reflects language that has been taken verbatim from the EPDP Team’s charter. The last sentence hopefully reflects today’s discussion and is something that most of you willing to live with for the purpose of the Initial Report. Preliminary Recommendation #2 Per the EPDP Team Charter, the EPDP Team is committed to considering a system for Standardized Access to non-public Registration Data once the gating questions in the charter have been answered. This will include addressing questions such as: * What are the legitimate purposes for third parties to access registration data? * What are the eligibility criteria for access to non-public Registration data? * Do those parties/groups consist of different types of third-party requestors? * What data elements should each user/party have access to? In this context, amongst others, disclosure in the course of intellectual property infringement and DNS abuse cases will be considered. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

2 1

ICANN Org Response to question re. Organization field
by Marika Konings Nov. 20, 2018

Nov. 20, 2018

Dear EPDP Team, Hereby the ICANN Org response to the following question: Question: 1.) Has ICANN given any thought to scenarios where the „Organization“ field might contain personal information? 2.) As the Organization field shall be populated on an optional basis, has ICANN given any thought to a consent requirement or, where another legal basis than Art. 6 I a GDPR was considered, what legal basis shall be applicable based on what rationale? Response: The organization field, which is an optional field, was one of the topics of discussion among the community during the development of the Cookbook. See sections 5.4 and 5.5 of the Cookbook<https://www.icann.org/en/system/files/files/gdpr-compliance-interim-model-0…>. Additionally, the 5 July 2018 letter<https://www.icann.org/en/system/files/correspondence/jelinek-to-marby-05jul…> from the European Data Protection Board states: “The GDPR does not apply to the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.” Recital 14 of the GDPR states: “This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.” Registrars have always been obligated to inform and obtain consent from the registrants regarding what data elements are collected, what data elements are published, what data elements are optional, and the intended uses and recipients of the data. (See for example Section II.J.7.b<https://www.icann.org/resources/unthemed-pages/raa-1999-11-10-en#IIJ7b> in the 1999 RAA and Section 3.7.7.4<https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en#3.7…> of the 2013 RAA.) The Temporary Specification relies on 6(1)(f) as the legal basis for the mandatory publication of certain fields, including registrant organization. As noted in our original response, the registrant organization field refers to a legal person and not a natural person. The registrant may give consent for publication of additional fields, for example, the registrant name field. In considering the applicability of the possible legal bases and after consultations with the community, it was determined that 6(1)(f) was the most appropriate legal basis to support the stated goal of complying with the GDPR while maintaining the existing WHOIS to the greatest extent possible. This response will get added to the Q&A section on the wiki: https://community.icann.org/x/ahppBQ. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

3 2

Proposed Revised Rec. 21
by Rosette, Kristina Nov. 20, 2018

Nov. 20, 2018

All, Thomas and I developed proposed revised Rec. 21 language. I posted it in chat, but copy it below for convenience: Rec. 21: The EPDP Team recommends that ICANN Org enters into the required agreements such as a Data Processing Agreement (GDPR Art. 28) or Joint Controller Agreement (Art. 26), as appropriate, with the non-Contracted Party entities involved in registration data processing such as data escrow providers and EBERO providers. These agreements are expected to set out the relationship obligations and instructions for data processing between the different parties. Kristina Rosette Senior Corporate Counsel, IP - Domains rosettek(a)amazon.com<mailto:rosettek@amazon.com> | 703.407.1354

3 3

ICANN org question response
by Caitlin Tubergen Nov. 20, 2018

Nov. 20, 2018

Dear EPDP Team, In response to a question posed by the EPDP Team to ICANN org on Thursday, 8 November, please find the following response: QUESTION: Is making the natural vs legal distinction in WHOIS within the picket fence, i.e., a suitable topic for policy discussion? RESPONSE : Yes, access to gTLD registration data generally is one of the allowed topics for consensus policy as set forth in ICANN Bylaws and registry and registrar agreements. (That list of topics is referred to by some as “the picket fence”). Please refer to Annex G-1 and G-2 of the ICANN Bylaws as well as Specification 1 Section 1.3.4 of the Base Registry Agreement and the Consensus Policies and Temporary Policies Specification of the Registrar Accreditation Agreement, which provide that: “maintenance of and access to accurate and up-to-date information concerning domain name registrations” is one of the topics on which ICANN may enforce consensus policies. Thank you. Best regards, Marika, Berry and Caitlin

4 6

Letter to council and others
by Kurt Pritz Nov. 20, 2018

Nov. 20, 2018

Dear Keith: Rafik and I are writing to let you know that the EPDP Team studying the processing of registration data will not release its initial report today, 19 November. This date had been previously identified as a likely date for publication, mostly based upon the timeline and process requirements for getting to the finish line on 25 May 2019 . However, the Team has made considerable progress and we anticipate publishing the report as early as Wednesday, 21 November and are making plans to hit that date. In the event that certain issues remain unresolved, publication might be delayed (partially due to the US holiday) until early the following week. These issues include complex topics regarding whether ICANN and contracted parties are “joint controllers” where new information has become available only in the past few days and we need team agreement to move forward. We are striving to meet the 21 November date so that the comment period does not end in the midst of the year-end holiday week. In the case of either scenario, careful planning can still ensure closure by 25 May. While this is an apparent “delay,” I would not characterize the current schedule as that. It is important to understand that the delivery schedule for the Initial Report was set by the time left after all other “required” processes such as comment period, GNSO and Board consideration periods and other steps were taken into account. Also remember that the EPDP Team is dealing with a myriad of complex policy and legal issues that have flummoxed attempts at progress on this topic for 20 years. It is difficult to schedule an effort that is simultaneously addressing report objectives to: review the Temporary Specification, create new policy, and answer 50+ charter questions. Concessions, compromises and thoughtful solutions are in many instances developed by the hour. As late as this past weekend, the Team reviewed drafts and raised substantive issues that required difficult and contentious discussion, but they have got through most of them with suitable language. The full Team met for multi-hour meetings on Tuesday, Thursday and Friday last week and has set the same schedule for Monday and Tuesday this week. We’ve had 28 teleconferences and 40+ hours of face-to-face meeting time in 3 ½ months When published, the Initial Report will not reflect agreement on all issues but there has been apparent unanimity on many important issues and the report describes areas of difference in sufficient detail so that the public can adequately understand and opine on them. The report will be overly wordy in spots and provide much detail as it seeks to adequately describe a significant level of complexity to its audience. Remember that this report started with a blank sheet of paper, the EPDP Team, and not much time. We will also be launching a new type of comment forum, designed to: clearly link comments to specific sections of the Initial Report, encourage commenters to provide reasoning or rationale for their opinions, enable the sorting of comments so that the EPDP Team can more easily read all the comments on any one topic. We look forward to more communication on this topic to you in the near future. Sincerely, Kurt and Rafik

1 0

ICANN Org's contractual compliance personal data processing activities
by Marika Konings Nov. 20, 2018

Nov. 20, 2018

Dear EPDP Team, On behalf of ICANN Org: During the 19 September 2018 EPDP Q&A Session<https://participate.icann.org/p2ay385gtib/> with Becky Burr, there was a request for more information regarding what ICANN org does with personal data as it relates to ICANN contractual compliance. Additionally, on 4 October 2018, ICANN org received a question<https://community.icann.org/display/EOTSFGRD/2018-10-04+EPDP+Team+call+%2317> from the EPDP Team regarding data retention procedures. In response to these two items, please see the attached a summary of ICANN org’s contractual compliance personal data processing activities. This response will get added to the Q&A section on the wiki :https://community.icann.org/x/ahppBQ. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Proposed Agenda - Meeting #29
by Berry Cobb Nov. 19, 2018

Nov. 19, 2018

Dear all, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 20 November at 14.00 UTC for two hours. Best regards, Caitlin, Berry and Marika ========================= EPDP Meeting #29 Agenda Tuesday, 20 November 2018 1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes) a) Review of outstanding action items b) Other updates, if applicable 3. Finalize outstanding items: a) Purpose O – see proposed language for addressing this in the Initial Report b) Additional language re. responsibilities section (Thomas) c) Additional language re. UDRP (Margie) – see updated version circulated on Monday 19 November d) Revised language for Preliminary Recommendation #2 – see revised version circulated on Monday 19 November by staff 4. Next steps for publication: a) Public comment forum – Google form b) Community Webinar c) Letter to EDPB d) Confirm publication date target 5. Wrap and confirm next meeting to be scheduled for Wednesday 21 November 2018 a) Confirm action items b) Confirm questions for ICANN Org, if any

1 0

Proposed language re. Purpose O (Research)
by Marika Konings Nov. 19, 2018

Nov. 19, 2018

Dear EPDP Team members, Per the action item from today’s meeting, please find hereby proposed language for inclusion in the Initial Report to document the discussions to date in relation to Purpose O (Research): Proposed new language to be added after line 645 in the 18 Nov version (https://drive.google.com/file/d/1zLpveft7yV85jirZpXjaczKfJyvXynZg/view) The EPDP Team considered whether a Purpose for Processing Registration Data should be added to address the needs and benefits provided by DNS security and stability research intending to publish reports on threats to the operational stability, reliability, security, global interoperability, resilience, and openness of the DNS (see https://mm.icann.org/pipermail/gnso-epdp-team/2018-November/000897.html) The EPDP Team is considering this question to enable ICANN to continue publishing reports in relation to the Accuracy Reporting System as well as the use of data by ICANN’s Office of the Chief Technology Officer (OCTO). Community and ICANN Org input is sought on whether the other purposes listed below already enable this work, whether an additional research purpose should be added, or if such a purpose in not necessary in any case. Please share with the list as soon as possible if you have any concerns about this addition in the body of the report. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Notes and action from EPDP Team Meeting #28
by Marika Konings Nov. 19, 2018

Nov. 19, 2018

Dear EPDP Team, Please find below the notes and action items from today’s EPDP Team meeting. Best regards, Caitlin, Berry and Marika ======================== EPDP Team Meeting #28 Tuesday, 19 November 2018 Notes and Action Items High-level Notes/Actions: Action item #1: Kurt to write to GNSO Council and inform them of timing of publication of Initial Report, reasons for it and how EPDP Team still intends to meet the overall timeline. Action item #2: Staff to update executive summary to make clear references to where full context of discussion can be found. Action item #3: Thomas and Kristina to suggest updated wording for #13 and #21 to capture discussions (COMPLETED). Action item #4: staff to circulate proposed rewording of rec #2 re. further work on the a system for Standardized Access to non-public Registration Data to the mailing list (COMPLETED) Action item #5: EPDP Team to provide further input on Purpose O and how to deal with it in the context of the Initial Report on the mailing list prior to the next meeting. Action item #6: Staff to develop draft language that reflects proposed approach by Margie in relation to Purpose O. Action item #7 EPDP Team to review proposed addition to Responsibilities in Processing Data section circulated by Thomas and share any feedback on the mailing list prior to the next meeting. Action item #8: Margie to review input received on proposed addition to UDRP section to address concerns re. reference to fees and whether this is work for the EPDP Team to undertake and propose updates to address this input. Action item #9: Staff to share proposed format for public comment forum prior to next meeting. Questions for ICANN Org from the EPDP Team: None Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/DQnVBQ. 1. Roll Call & SOI Updates (5 minutes) * Attendance will be taken from Adobe Connect * Remember to mute your microphones when not speaking and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) a. Review of outstanding action items - see https://community.icann.org/x/NwSNBQ b. Other updates, if applicable * Note that notifications to make travel arrangements for next F2F meeting should be received shortly * Will discuss new approach during today's meeting for public comment forum later in the meeting - use of google form to facilitate input as well as review by EPDP Team Timing of publication of Initial Report * What are the next steps with regards to publication of the Initial Report? May slip a few days. * Does current version describe issue in sufficient detail? * Any additional time will impact overall timeline so needs to be considered carefully. * Perfect shouldn't become the enemy of the good * Version published earlier today captures non-substantive edits as a result of comments submitted between Friday and Sunday. Additional edits as a result of today's meeting will be applied as soon as possible following this meeting. * Should EPDP Team consider just publishing the Executive Summary and not the rest of the report? Consider freezing as is, and issue executive summary and ask for input on that. Note that there are minimum requirements for what needs to be included in the Initial Report. * Instruct readers to focus on executive summary, but for transparency reasons the rest of the document should be included. * What are the requirements for Initial Report publication? Could executive summary be posted first and then followed by the detailed info, or would that impact the duration of the public comment period? Could impact duration as community could request additional time for info posted late. * Consider renaming executive summary to Initial Report Executive Summary. Consider including links to substantive discussions. Could recommendations be removed from the other part of the report? Keep recommendations with the rest of the report as it will provide the context. * Important to be able to provide full context, even if some just review the executive summary. Make executive summary available as a separate download. * Objective is to obtain high quality feedback - means that full context of deliberations is important. * When will changes be frozen? * No new comments to be made on the report - deal with comments that have been provided by COB on Sunday 18 Nov. Once EPDP Team has gone through these comments, final version will be shared with EPDP Team. Publish Initial Report by next week Monday or Tuesday at the latest. * Note that publishing next Monday or Tuesday will put the end of the public comment forum on 26 or 27 December. Action item #1: Kurt to write to GNSO Council and inform them of delay of publication of Initial Report, reasons for it and how EPDP Team still intends to meet the overall timeline. Action item #2: Staff to update executive summary to make clear references to where full context of discussion can be found. 3. Continue review & discussion of comments / input received on Initial Report Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report a. Commence review of proposed changes / comments on the Initial Report (see latest version attached) b. Confirm approach for addressing these c. Confirm next steps, if any * See list shared prior to the meeting * a1 - this footnote was product of last meeting. Does this conflict with recommendation #2? Is accuracy is part of the charter? This was identified as a parking lot item - it may not change anything, but just to note that it is expected to be discussed further in phase 2. Accuracy means something different in the context of GDPR than it does in the context of ICANN accuracy policies. Consider changing to "The topic of accuracy is expected to be further considered". Update accordingly: The topic of accuracy as related to GDPR compliance is expected to be considered further. * b1 - this appears redundant is it is already captured in the legal/natural person discussion in quite some detail. Not clear what value this language adds. This would need to be further discussed - should be submitted during public comment forum. Input is already sought on this topic through the questions that are included in relation to legal / natural. Current wording may raise expectations that a recommendation is forthcoming which may not be an accurate reflection of conversations to date. No changes to be made. * c1 - consider adding "some parties have asserted that". * d1 - check wording from GDPR. Leave for now as is. Recital 14 of GDPR: This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person. Leave as is. * e2 - would need to identify who those members with expertise are before this can be put in. This distinction is not made in other parts either. Leave as is. * f2 - flagged for EPDP Team to either consider now or later - not necessarily prior to publication (this applies to all ICANN Org comments). Consider adding a footnote with ICANN Org comment and note that it will be further discussed. * g2 - * h2 - doesn't this recommendation just note that an appropriate agreement needs to be in place? * i2 - language of rec 21 is ambiguous - leaves open what the right type of agreement is. Not clear what intent was. Objective is to capture that ICANN Org is to enter into an appropriate agreement. Remove reference to CP from recommendation #21 and just limit it to third parties that might be required. Thomas & Kristina to suggest proposed rewording for recommendation #21. Recommendation #13 to cover contractual relationships with contracted parties and #21 to focus on third parties. Proposed revised Rec. 21: The EPDP Team recommends that ICANN Org enters into the required agreements such as a Data Processing Agreement (GDPR Art. 28) or Joint Controller Agreement (Art. 26), as appropriate, with the non-Contracted Party entities involved in registration data processing such as data escrow providers and EBERO providers. These agreements are expected to set out the relationship obligations and instructions for data processing between the different parties. * RrSG comments will be submitted in response to the public comment forum - do not need to be considered now prior to publication of Initial Report. * s - note that additional comments/input on this recommendation were also provided on the mailing list. Recommendation #2 was result of a compromise reached in Barcelona. Consider updating this language to reflect language from the charter which outlines the aspects of work remaining under the charter. Some indication needed in the report that IP interests are covered. Consider adding in a commitment a for instance, not limited to, not definitive list, defer discussion to what is included to later date. Possible alternative: The EPDP Team commits to develop policy to allow for responses to lawful third party disclosure requests for non-public registration data. The work will encompass, amongst others, disclosure in the course of intellectual property infringements and abuse cases. Need to commit to follow a process, not an outcome. Possible alternative to add to staff proposed language 'this will include consideration of IP and abuse cases'. Relying on the charter language may be helpful with the addition of what will be part of this consideration. Not all agree with addition - charter language should be sufficient. * Talk about lawful disclosure, refer to future. Action item #3: Thomas and Kristina to suggest updated wording for #13 and #21 to capture discussions (COMPLETED). Action item #4: staff to circulate proposed rewording of rec #2 to the mailing list (staff proposed language 4. Other items to be finalized: Purpose O – how to address in Initial Report * See language circulated by Benedict and Margie’s proposed approach for dealing with it in the Initial Report (“important issue that should be called out in the Initial Report. The Purpose O discussion should be written to note the concern regarding ICANN ‘s ability to continue publishing for the reports from the Accuracy Reporting System in the manner that was possible before May 25th, and to note OCTO’s use of the data before May 25th, and to ask the question of whether the purposes listed in the report enable or should enable this continued use by OCTO and by ICANN”). Action item #5: EPDP Team to provide further input on Purpose O and how to deal with it in the context of the Initial Report on the mailing list prior to the next meeting. Action item #6: Staff to develop draft language that reflects proposed approach by Margie. Additional language re. responsibilities section (Thomas) * See proposed addition posted by Thomas to the mailing list to reflect the discussion during meeting #27 of this topic. Action item #7 EPDP Team to review proposed addition and share any feedback on the mailing list prior to the next meeting. Additional language re. UDRP (Margie) * See updated language circulated by Margie on Friday and subsequent feedback. Action item #8: Margie to review input received on proposed addition to UDRP section and propose updates to address this input. 5. Next steps for publication: Public comment forum – Google form Action item #9: Staff to share proposed format for public comment forum prior to next meeting. Community Webinar * Leadership considering hosting a webinar in conjunction with the publication of the Initial Report to present the report and preliminary recommendations, as well as provide guidance on how input is expected to be provided. Letter to EDPB * Leadership team is working on a draft letter to the EDPB to convey the Initial Report and call out the specific questions that have been flagged in the Initial Report. All items to be further discussed during the next meeting, scheduled for Tuesday 20 November at 14.00 UTC. 6. Wrap and confirm next meeting to be scheduled for Tuesday 20 November at 14.00 UTC. a) Confirm action items b) Confirm questions for ICANN Org, if any changes. Apologies to those who are not affected by DST. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Recordings, Attendance & AC Chat / GNSO Temp Spec gTLD RD EPDP / Monday, 19 November 2018
by Julie Bisland Nov. 19, 2018

Nov. 19, 2018

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Monday, 19 November 2018 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/DQnVBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-19nov18… AC Recording: https://participate.icann.org/p66lwfqfhwa/<https://participate.icann.org/p66lwfqfhwa/?OWASP_CSRFTOKEN=a7f49856259ae408…> <https://participate.icann.org/p12a7q93n35/?OWASP_CSRFTOKEN=663c37463e43b07a…>** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Julie

1 0

FW: [Ext] Fwd: Additional language for roles and responsibilities
by Marika Konings Nov. 19, 2018

Nov. 19, 2018

Dear All, Please see email from Thomas below which may not have made it to the list. Best regards, Caitlin, Berry and Marika Anfang der weitergeleiteten Nachricht: Von: Thomas Rickert <thomas(a)rickert.net<mailto:thomas@rickert.net>> Betreff: Additional language for roles and responsibilities Datum: 18. November 2018 um 21:59:10 MEZ An: "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Kopie: Thomas Rickert <thomas(a)rickert.net<mailto:thomas@rickert.net>> All, As discussed during out last call, please find below an additional paragraph to be inserted after line 1628, i.e. at the end of Recommendation #13. The challenge was to keep the language concise, yet cover the most urgent operational questions that came up, while not stepping over the line and do work outside the picket fence. You will decide whether these parameters were met in the language below, but I hope it will at least serve as a starting point for our discussions. Kind regards, Thomas The EPDP Team understands that a joint controller situation between ICANN Org, Registries and Registrars requires work at a greater level of granularity than in this report. During the negotiations, the parties shall conduct a detailed review of the individual processing activities and the actions to be taken by the respective parties. A clear demarcation the processing activities covered by the JCA versus those carried out by either party outside the scope of the JCA shall be documented and reflected both in the private as well as in the public version of the JCA. The JCA shall ensure that the risks of data processing are shared adequately based on whose interests are concerned. Also, the JCA shall include indemnifications to ensure that no party shall ultimately be liable for another parties’ wrongdoing. The JCA shall recognize that parties are currently using third parties’ services or otherwise work with third parties, such as - Data Escrow Agents - EBEROs - Registry Service Providers - Registrar as a Service Providers - Resellers - Dispute Resolution Providers - the TMCH. This may or may not include processing of personal data by those third parties. Where personal data is processed by third parties, the respective joint controller will need to ensure that the data processing is carried out in a way compliant with GDPR. However, conditional to GDPR compliance, nothing in the JCA shall prevent the respective joint controller from engaging third parties and entering into the required agreements without further authorizations from the other joint controllers. The EPDP Team considers it out of scope of its work to prescribe in what form JCAs will be entered into, as long as a set of the minimum requirements as specified in the EPDP Team’s report, are met. It does appear advisable, though, to create one template, which can be amended to reflect situations that are not applicable industry-wide (such as eligibility requirements for registered name holders) and that JCAs are entered into per TLD between ICANN Org, the respective Registry Operator and registrars. A potential way to facilitate contracting would be to make the JCA part of the RRA, so there would be separate tri-partite agreements between ICANN Org, the Registry Operator and each registrar. Standardized parts of the JCA should include the informations that are legally required to be provided to the data subjects to allow for the use of the same language across all TLDs as much as possible.

2 1

Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 20 November 2018
by Julie Bisland Nov. 19, 2018

Nov. 19, 2018

Tuesday, 20 November 2018 at 14:00 UTC for 2 hours Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/ZwPVBQ Thank you. Kind Regards, Julie

1 0

Proposed Agenda - Meeting #28
by Marika Konings Nov. 19, 2018

Nov. 19, 2018

Dear all, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Monday 19 November at 14.00 UTC for three hours. Best regards, Caitlin, Berry and Marika ========================= EPDP Meeting #28 Agenda Monday, 19 November 2018 1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Review of outstanding action items * Other updates, if applicable 1. Continue review & discussion of comments / input received on Initial Report Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report * Commence review of proposed changes / comments on the Initial Report (see latest version attached) * Confirm approach for addressing these * Confirm next steps, if any 1. Other items to be finalized: * Purpose O – how to address in Initial Report * Additional language re. responsibilities section (Thomas) * Additional language re. UDRP (Margie) 1. Next steps for publication: * Public comment forum – Google form * Community Webinar * Letter to EDPB 1. Wrap and confirm next meeting to be scheduled for Tuesday 27 November at 14.00 UTC. * Confirm action items * Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

2 1

Some badly needed wording fixes as we finalize interim report
by Mueller, Milton L Nov. 19, 2018

Nov. 19, 2018

All, I have been going through the Exec Summary of the interim report and have found some issues. Most of these are grammar or copy editing fixes that I hope we can accept without controversy. One of them has a substantive element, though. Footnote 2, page 4: “the EPDP Team anticipates taking a formal consensus call..” Shouldn’t this be “WILL take a formal consensus call…” To say "anticipates" sounds like we might not do so if it’s not convenient. We are required to take a consensus call Line 150-151: The wording of Preliminary Rec 2 is awkward and ungrammatical. It now reads: “The EPDP Team commits to develop and coordinate policy in the system for standardized access to non-public registration data portion of this EPDP regarding lawful access for legitimate third-party interests regarding abuse or intellectual property to data identified herein that is already collected.” This should be changed to: “The EPDP Team commits to develop and coordinate policy for disclosure of non-public registration data to third parties with legitimate interests.” Page 6, footnote 3. Delete. I thought we had agreed that after agreeing on Preliminary Agreement #3 that new policies on accuracy were out of scope. Page 6, footnote 4. This can be deleted, as the same text is included later on in page 7, lines 170-172 Milton Mueller

5 6

Re: [Gnso-epdp-team] Proposed Agenda - Meeting #28
by Marika Konings Nov. 19, 2018

Nov. 19, 2018

For those interested, you can find here the latest version of the Initial Report in which non-substantive updates were made as a result of the comments that were submitted between Friday and Sunday in the google doc: https://drive.google.com/a/icann.org/file/d/1zLpveft7yV85jirZpXjaczKfJyvXyn…. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Sunday, November 18, 2018 at 8:25 PM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Proposed Agenda - Meeting #28 Dear all, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Monday 19 November at 14.00 UTC for three hours. Best regards, Caitlin, Berry and Marika ========================= EPDP Meeting #28 Agenda Monday, 19 November 2018 1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Review of outstanding action items * Other updates, if applicable 1. Continue review & discussion of comments / input received on Initial Report Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report * Commence review of proposed changes / comments on the Initial Report (see latest version attached) * Confirm approach for addressing these * Confirm next steps, if any 1. Other items to be finalized: * Purpose O – how to address in Initial Report * Additional language re. responsibilities section (Thomas) * Additional language re. UDRP (Margie) 1. Next steps for publication: * Public comment forum – Google form * Community Webinar * Letter to EDPB 1. Wrap and confirm next meeting to be scheduled for Tuesday 27 November at 14.00 UTC. a) Confirm action items b) Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Re: [Gnso-epdp-team] Some badly needed wording fixes as we finalize interim report
by Alex Deacon Nov. 18, 2018

Nov. 18, 2018

Hi Amr, If you recall from our numerous discussions on this topic a main point of contention was around how specific we need to be GDPR compliant. The IPC has always argued that specificity is required - especially when defining which 3rd parties with legitimate interests may be granted access to non-public whois data. When we landed on the current wording for purpose 2 during the face to face meeting in Barcelona, I raised the concern that it was my experience that many do not believe that "security, stability and resiliency" include IP interests. This was confirmed as true by three people in the room. So it was and still is crystal clear to me vague language - including the language recently suggested by Milton - does not cover IP. I'm sure you can appreciate why this is a major concern for us. The compromise language addressed this major issue for the IPC - allowing us to move forward. If we all agree that abuse and intellectual property are legitimate interests then we should state it. As for why are these called out and others are not, the IPC believes they should all enumerated and plans to respond to Question #1 accordingly. I'll also refer you to my email to the list on Sep 12th (seems to long ago!) where I addressed this exact issue. "[...] Also, as you know personal data needs to be collected for specified, explicit and legitimate purposes. (Article 5(1)(b)) so given we removed "including but not limited to" we need to be explicit and not use general language. In addition the principle of transparency mentioned in recital 39 ("In particular, the specific purposes for which personal data are processed should be explicit and legitimate and determined at the time of collection of the personal data") and 58 ("The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand..." are relevant. This principal is further defined in Article 12(1) and Article 13(1). " Thanks. Alex On Sun, Nov 18, 2018 at 10:38 AM Amr Elsadr <aelsadr(a)protonmail.ch> wrote: > Hi, > > I recall that there were questions/concerns raised by this wording of the > recommendation that I don’t believe we ever got around to addressing. I’m > not sure what the purpose is of singling out abuse and intellectual > property in this recommendation. If there is a reason for doing this, it’d > be helpful to understand. > > I would imagine that a recommendation that reads similar to what Milton > suggested would cover both those categories. There are however, other > legitimate interests for which lawful disclosure/access to non-public > registration data is something we will need to work out in the next phase > of the EPDP, apart from abuse and intellectual property. Why do these two > get special status in this recommendation? > > Thanks. > > Amr > > On Nov 18, 2018, at 8:06 PM, Mark Svancarek (CELA) via Gnso-epdp-team < > gnso-epdp-team(a)icann.org> wrote: > > I think the awkwardness can be resolved simply by changing > > “standardized access to non-public registration data portion” > to > “standardized access to [the] non-public registration data portion”. > > Agree with Alex that we should not revise the compromise verbiage beyond > the addition of “the”, above. > > *From:* Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> *On Behalf Of *Alex > Deacon > *Sent:* Sunday, November 18, 2018 10:02 AM > *To:* milton(a)gatech.edu > *Cc:* gnso-epdp-team(a)icann.org > *Subject:* Re: [Gnso-epdp-team] Some badly needed wording fixes as we > finalize interim report > > Milton, All, > > I have to strongly object to Milton's suggestion that the text of Rec #2 > be updated as he suggests. We debated the language for Purpose B (now > purpose 2 of Rec #1) for weeks if not months - reviewing many versions and > numerous iterations. By the time we all got to Barcelona the current > language of purpose #2 is where we ended up and if you remember I expressed > the deep concern the IPC had with the language. > > In order to move forward James B. suggested a compromise - resulting in > what is now Rec #2 - addressing our concern and allowing us to move > forward. I greatly appreciated (and still appreciate) this pragmatic > suggestion from James and was encouraged that there was no objection from > any of us in the room. > > The request that we change the language of Rec #2 essentially undoes this > compromise and puts us back in time many weeks. A major change to the > intent of a recommendation such as this is inappropriate and must not be > allowed. > > Regards, > Alex > > > On Sat, Nov 17, 2018 at 9:14 PM Mueller, Milton L <milton(a)gatech.edu> > wrote: > > All, I have been going through the Exec Summary of the interim report and > have found some issues. Most of these are grammar or copy editing fixes > that I hope we can accept without controversy. One of them has a > substantive element, though. > > Footnote 2, page 4: “the EPDP Team anticipates taking a formal consensus > call..” > Shouldn’t this be “WILL take a formal consensus call…” To say > "anticipates" sounds like we might not do so if it’s not convenient. We are > required to take a consensus call > > Line 150-151: The wording of Preliminary Rec 2 is awkward and > ungrammatical. It now reads: > > “The EPDP Team commits to develop and coordinate policy in the system for > standardized access to non-public registration data portion of this EPDP > regarding lawful access for legitimate third-party interests regarding > abuse or intellectual property to data identified herein that is already > collected.” This should be changed to: > > “The EPDP Team commits to develop and coordinate policy for disclosure of > non-public registration data to third parties with legitimate interests.” > > Page 6, footnote 3. Delete. I thought we had agreed that after agreeing on > Preliminary Agreement #3 that new policies on accuracy were out of scope. > > Page 6, footnote 4. This can be deleted, as the same text is included > later on in page 7, lines 170-172 > > Milton Mueller > _______________________________________________ > Gnso-epdp-team mailing list > Gnso-epdp-team(a)icann.org > https://mm.icann.org/mailman/listinfo/gnso-epdp-team > <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmm.icann.o…> > > >

3 2

Response to ICANN org questions
by Caitlin Tubergen Nov. 18, 2018

Nov. 18, 2018

Dear EPDP Team, Below, please find answers to questions the EPDP Team posed to ICANN org: QUESTION: The Temporary Specification for gTLD Registration Data EPDP Team is currently considering language on a “Purpose M” regarding ICANN’s role in coordinating the development and implementation of policies concerning ICANN’s dispute resolution processes in the context of domain name registrations. Two of the processes currently being considered within scope of this purpose are the PDDRP (Post Delegation Dispute Resolution Process) and the RRDRP (Registry Restrictions Dispute Resolution Process). It would particularly be very helpful and important to the EPDP Team if ICANN could provide clarification on any point within the processes of PDDRPs and RRDRPs where processing of gTLD Registration Data is necessary for the dispute resolution processes to be completed. This clarification should identify which (if any) data elements within gTLD Registration Data are necessary, as well as all parties involved in the processing activities. RESPONSE: The PDDRP rules and the RRDRP rules each require the complainant (a trademark holder in PDDRP proceedings; an established institution in the relevant community in RRDRP proceedings) to “provide the name and address of the current owner of any at-issue domain name registration related to the dispute, to the best of the Complainant’s knowledge[.]” See PDDRP Rules, Section 3(b)(iv); RRDRP Rules, Section 3(b)(iv). The dispute resolution provider is required to serve the respondent (the registry operator) with a copy of the complaint, and to retain information related to the provider’s transmission of the complaint. Thus, these procedures may result in the complainant, provider, and/or respondent’s processing of gTLD registration data. It should be noted that neither of these procedures have been used yet. ICANN org would not process gTLD registration data in proceedings of either of these procedures because they are administered by independent dispute resolution service providers. However, if either procedure is used and ICANN org receives a panel’s decision, then that decision would include gTLD registration data. On another note, the current wording of Purpose M states: “coordinating the development and implementation of policies concerning ICANN’s dispute resolution processes in the context of domain name registrations.” It is unclear how developing and implementation of policy would involve processing of gTLD registration data or personal data. QUESTION: What is the rationale for not redacting organization field in the Temporary Specification? RESPONSE: Including the registrant organization field was determined to be consistent with ICANN org’s stated goal of complying with the GDPR while maintaining the WHOIS system to the greatest extent possible. The name of an organization refers to a legal person and not a natural person and therefore is arguably not covered under the GDPR. Additionally, the organization field is an optional field for registrants so to the extent that the registrant provides the organization name, the Temp Spec allows for publication of that information. Leading up to the development of the Temporary Specification, ICANN org consulted with the community and the DPAs to determine which data elements should continue to be made publicly available. Through the data matrix exercise where ICANN org asked contracted parties and interested stakeholders to identify user types and purposes of data elements required by ICANN policies and contracts, 40 user purposes for the registrant organization field were identified. For reference, Section 5.5.16(i) of the Interim Model for Compliance with ICANN Agreements and Policies in Relation to the European Union’s General Data Protection Regulation (also called the Cookbook) states that “the registrant “organization” would be required to be published (if applicable) so that registrations of legal entities would readily include the name of the entity.” -- Thank you. Best regards, Marika, Berry, and Caitlin

3 2

For review by Sunday 18 November - updated version of Initial Report
by Marika Konings Nov. 17, 2018

Nov. 17, 2018

Dear EPDP Team, Please find hereby the ‘hopefully almost final’ version of the Initial Report for your review: * Redline: https://drive.google.com/a/icann.org/file/d/15fRRL_ORRkspHI9HVNP3v3Zrpz-WBl… * Clean: https://drive.google.com/a/icann.org/file/d/1UOJZmbj99FjTRheqH2K-HKwp_Xxl31… As you will see, with the inclusion of the data element workbooks and the preliminary recommendations & questions in the executive summary, the report has become pretty lengthy (127 pages). To facilitate review by the community, you could consider making the report downloadable in separate parts, for example, by having the executive summary available for separate download and/or making the data element workbooks a separate download. As you review this latest version, please focus your input on any aspects that need to be updated as they are either insufficiently clear for the reader, incorrect or not reflecting accurately who is in support of a certain position. Please try to avoid reopening issues that have already been extensively discussed (you may consider starting a separate list of items that the EPDP Team should turn its attention to after the Initial Report has been published?). We hope that this version addresses all comments submitted to date and issues recently discussed, but if we’ve missed something, please also add this to the google doc comment form: https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyG…. As you add your comments to the google doc form, please be specific about which change you are proposing. Also, as you refer to the line number, please make clear whether this concerns the redline or clean version. Please submit your comments in the google doc table (https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyG…) by Sunday 18 November, end of day, at the latest. Thank you, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

2 2

ICANN org response to EPDP question
by Caitlin Tubergen Nov. 17, 2018

Nov. 17, 2018

Dear EPDP Team, Below, please find ICANN org’s response to a question from today’s EPDP Meeting. Thank you. Best regards, Marika, Berry and Caitlin QUESTION: Is ICANN.org considering doing a DPIA, given the need for them to sort out their role? RESPONSE: A similar question was asked by the EPDP Team on 1 October 2018 to which ICANN org provided a response, which restated John Jeffrey’s comment on an 8 October 2018 webinar. To recap: In general, a DPIA is designed to (a) describe the processing and purpose of processing of personal data, including where applicable the legitimate interest pursued by the controller, (b) assess the processing necessity and proportionality, and (c) help manage the risks to the rights and freedoms of data subjects resulting from the processing. The elements of a DPIA are more fully described in Article 35(7) of the GDPR. Under Article 35(1), a DPIA is only required where a type of processing is “likely to result in a high risk to the rights and freedoms of natural persons”. ICANN org considered conducting a DPIA since early in the discussion of GDPR and gTLD registration data. One of the issues is when to do a DPIA that is most timely and useful--should the DPIA be conducted on the original requirements in the registry and registrar agreements, on the Temporary Specification which is temporary, or on the new requirements being discussed in the EPDP? We continue to evaluate whether that assessment should be performed and, if so, when. We are preparing some FAQs to provide further background on this topic, which we plan to publish next week. We will share with the EPDP Team a link to the FAQs once published.

2 1

Notes, action items from EPDP Team Meeting #27 - 16 November 2018
by Caitlin Tubergen Nov. 16, 2018

Nov. 16, 2018

Dear All, Below, please find the notes and action items from today’s EPDP Team meeting. As a reminder, our next meeting will be Monday, 19 November at 14.00 UTC. Best regards, Marika, Berry and Caitlin EPDP Team Meeting #27 16 November 2018 High-level Action Items Margie to suggest modifications to the UDRP/URS paragraph re: complainant access to registration data pre-filing to the list by COB today so other team members may opine on it. Support staff to note the issue of WHOIS accuracy to be discussed in Phase 2. Thomas to add language to the responsible parties text to recognize recent ICANN memo on the joint controllership topic. Support staff to send updated initial report draft with all relevant supporting documentation and relevant links. Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/uQXVBQ 1. Roll Call & SOI Updates Attendance will be taken from Adobe Connect Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair a. Review of outstanding action items b. Other updates, if applicable Today's goal is to continue going through the outstanding items for the Initial Report. Thomas will also have an opportunity to finish discussing his memo. ICANN Org liaisons may be asked to give a high-level overview of the memo. Benedict delivered Purpose O last night, so this will also be added to the agenda. The PCST (budget committee) decided to hold the third F2F in Toronto, Canada from 16 January - 18 January. Additionally, the team began a discussion about reengaging CBI. 3. Continue review & discussion of comments / input received on Initial Report Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report a. Commence review of proposed changes / comments on the Initial Report The RrSG is meeting today to further discuss their comments, so for the Team's purposes today, we will not be discussing the Registrar issues at this time. Issues highlighted in green were dealt with yesterday. Beginning with Issue k, staff noted that per the PDP manual, recommendations to the GNSO Council can take many shapes or forms, including requests / advice to the GNSO Council. The recommendations, after adoption, are generally segregated to see who is responsible for carrying out the recommendation. If there is not a problem with asking the GNSO Council to do something, there may not be a problem. It would be helpful to go back to Kristina to better understand the issue. It will be important to specifically note when this group's work may impact other policies, including GNSO policies. Under letter m, what is the BC proposing to change? The BC notes problems with the functioning of the URS/UDRP since Complainants no longer have access to data prior to filing UDRP/URS complaints. This issue was highlighted on this list, so Support Staff added some language to the Initial Report to reflect the expressed issues, noting there is not currently consensus whether this should be a recommendation or not. If further clarification is needed, please write to the list. The Team does need to address the concern of unlimited access to non-public data under the guise of filing a UDRP. Action Item: Margie to suggest modifications to the UDRP/URS paragraph to the list so other team members may opine on it. Issue j: this was discussed early on in the context of the triage report. There was confusion regarding what "in another mechanism" means, so the text "determined by the EPDP Team" was added for further clarification. The mechanism may refer to future work in relation to access to full registration data. The team did speak at length about future work regarding standard access framework; however, why is there a mechanism for access to full registration data from the registry operator? If this language is confusing, it could be deleted. Do not see the value this bullet point provides - suggest removing. No disagreement to removing. This work is being addressed, just not at this stage. Preliminary recommendation 24 (letter n) - waiting for Kristina to provide further guidance. Going back to Issue n, it seems that agreement was reached to remove preliminary recommendation 24. (Note: this is now recommendation 21 in the updated report, so searching for exact language is better here.) Because this is confusing, can we discuss very deliberately what changes are proposed? On 14 November, ICANN published a report on the Transfer Policy. Any review of any policy that ICANN undertakes should look at the implications of GDPR. This recommendation may be unnecessary. Is there a way to inform the GNSO they should do this now? There is no value in the recommendation as its written now. The Team needs to consider accurate data and this should not be pushed further down the road and never dealt with. A recommendation, noting the question, is useful. Items T and U - accuracy of registration data. Coming out of the meeting in Los Angeles, we noted we would not diminish the accuracy recommendations. This is a parking lot issue. Registrar proposal - minor wording change, but this small change does not affect the meaning one way or the other, so it's OK to keep the previously-agreed to language. In that spirit, Rrs oppose the BC addition. All attempts to ensure accuracy have to be weighed, including the cost impact. How is accuracy defined here? It may be helpful to describe it here. The accuracy provision says that the data subject must be able to correct data. If the controller believes there are inaccuracies, the controller has the obligation to try to fix it. This is a parking lot issue so does not need to be discussed right now, so long as the report mentions it, that is sufficient. Action item: Support staff to note the issue of WHOIS accuracy will be considered further in Phase 2. Regarding issue v, this is an example of the team deliberating on the issue. The third sentence regarding other relevant parties is ambiguous and seems confusing to implement. b. Confirm approach for addressing these c. Confirm next steps, if any 4. Confirm / discuss any input on the Thomas’s Responsibilities text (if any) ICANN's summary of response to Thomas's memo: Instead of redlining, ICANN org thought it would be easier to read via a separate document. The Team's recommendation for joint controllership is different from what is currently in the Temp Spec. ICANN org's role is to provide information and implementation-related issues and concerns. Question: are there joint controllers or are they sole controllers? The examples the Art. 29 WP gives with respect to joint controllers are usually companies that operate on the same platform. How should the team work together going forward? ICANN org liaisons are flexible and are at the team's disposal to address this both in the initial report and after. The Team needs to get to a defendable solution to put in its Initial Report. Do any changes need to be made to the report at this time? There is a risk that ICANN org liaisons will go back into listening mode, and unless ICANN org liaisons are an active participant in the process, this Team cannot make progress. Who are the authors of the memo so that the Team can make direct contact with the authors? It would be helpful to offer concrete proposals to the community. Despite the Hamilton memo suggesting joint controllership, ICANN, in its cookbook suggests independent controllership. If this memo is not a position paper, what is it? Why did ICANN come to the conclusion that an independent controllership is present? If more analysis is necessary, how can ICANN come to the conclusion that a joint controllership is not present? ICANN memo has one primary driver - there is a fear that we move to a certain construction without knowing to the full extent what the liability could be. Art. 26 was established for scenarios where the data subject is confronted with complex data processing schemes with multiple parties. The Team should set up a dedicated group, including contracted parties, to set up a road map for items that need to be considered in a JCA. The alternatives are joint controllership or sole controllership for ICANN's purposes. There has been factual analysis to support joint controllership. The GDPR does not specify a joint controller agreement is necessary, but rather, a joint controller arrangement is necessary. In this instance, the RA, the RAA, and the RRA is the arrangement. This is something that should have been sorted out in 2017. While this memo is welcome, how can this report be released absent a balanced discussion of the controllership issue? If ICANN has issues with it, what will ICANN add to counter that and how can this be denoted in the report? The frustration is that this memo is coming so late in the day. While a written question may not have been directed to ICANN org, ICANN org was aware of the responsible parties analysis before the specific question was directed. If the Team manages to get to the finish line, we need assurance that this isn't going to be frustrated by an ICANN org determination that opposes the EPDP Team's conclusions. Where everyone agrees is that contracted parties and ICANN all need to sit down and work on a GDPR compliant arrangement. When ICANN says independent controller, is ICANN comfortable with co-controller instead? It's not a matter of what ICANN org is comfortable with, but rather - what is the correct classification under GDPR. If ICANN has any documentation that went into the cookbook regarding sole controllership, please share with the EPDP team. While the implementation may be difficult, the factual determination comes first. It may be best to list all of the places we agree and note the places we do not agree. When making edits on the google doc, please make it clear what line number you are referring to. 5. Wrap and confirm next meeting to be scheduled for Monday 19 November at 14.00 UTC. a. Confirm action items b. Confirm questions for ICANN Org, if any

1 0