November 2018 - Gnso-epdp-team

Recordings, Attendance & AC Chat / GNSO Temp Spec gTLD RD EPDP / Friday, 16 November 2018
by Andrea Glandon Nov. 16, 2018

Nov. 16, 2018

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Friday, 16 November 2018 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/7wfVBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-16nov18… AC Recording: https://participate.icann.org/p12a7q93n35/ <https://participate.icann.org/p12a7q93n35/?OWASP_CSRFTOKEN=663c37463e43b07a…>** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

Re: [Gnso-epdp-team] [Ext] Purpose O (Research) - informal small group
by Benedict Addis Nov. 16, 2018

Nov. 16, 2018

* Team copied * Dear Thomas, Thank you for speaking with me yesterday about the Research purpose. In answer to your second question, I have clarified in the document that the registry will pseudonymise registration data before it is transmitted to ICANN. Regarding your first question, I have spoken to both current and former members of the OCTO team. They have provided the following additional input: "Octo used registration data as part of LE [Law Enforcement] training. Like other opsec [operational security] practitioners we used reg[istration] data when collaborating with public/private sector investigators. We also used it when we were invited to work with Compliance on a particular complaint." and "[we] used full whois when we initiated our own investigations but that activity was self-directed not explicitly part of SSR role and remit. I also used whois to report phishing and brand infringements against ICANN. Lastly I used whois as part of research into bulk registrations and other consensus policy or registrar practices that had undesirable or unintended consequences." I should note that prior to 25th May, OCTO used public whois data. Since then, this work is on hold. Lastly, I’m sorry that this document is reaching you at the 11th hour. I have been waiting for guidance from ICANN before sending it, which was requested over a month ago. Best, Benedict. > On 5 Nov 2018, at 21:36, Thomas Rickert <thomas(a)rickert.net> wrote: > > Thanks, Benedict! > > Let me reiterate my input, which I think needs to make its way into the document or in a covering note. To be clear, I am not questioning that we need to look into ways to enable ICANN to do research, but I am still unclear as to what their requirements are do to research. > > * > More input from those conducting the research is required, especially on the questions: > What data is actually required for research purposes? > Would it not be sufficient to have pseundonymized data? > * > > Best, > Thomas > > >> Am 05.11.2018 um 22:29 schrieb Berry Cobb <mail(a)berrycobb.com <mailto:mail@berrycobb.com>>: >> >> Hi Benedict, <> >> >> Thank you for the update. I think it will be important to get this to the list for the full group’s consideration. Afterwards, I’ll make a few cosmetic updates and post on the wiki. >> >> Thank you. >> >> B >> >> >> Berry Cobb >> GNSO Policy Consultant >> @berrycobb >> >> From: Benedict Addis [mailto:bee@theale.co.uk <mailto:bee@theale.co.uk>] >> Sent: Monday, November 5, 2018 15:38 >> To: Berry Cobb >> Cc: farzaneh badii; Marika Konings; Thomas Rickert; Anderson, Marc; Emily Taylor; matt(a)brandsight.com <mailto:matt@brandsight.com>; Amr Elsadr; Kurt Pritz; Caitlin Tubergen >> Subject: Re: [Ext] Purpose O (Research) - informal small group >> >> Dear Berry, >> >> Thanks for your message, and thank you everyone for your time. >> >> I’ve updated the workbook to incorporate the feedback from Farzaneh and Thomas. >> >> Essentially, I have clarified that the registry will pseudoymise registration data before it is transmitted to ICANN. >> >> Best, >> Benedict. >

3 2

Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Monday, 19 November 2018 at 14:00 UTC for 3 hours
by Terri Agnew Nov. 16, 2018

Nov. 16, 2018

Monday, 19 November 2018 at 14:00 UTC for 3 hours **Please note: This is a placeholder meeting invite, it will be confirmed at the end of Friday’s meeting, whether or not this meeting goes ahead. Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays at 14:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u Agenda wiki pages: Monday, 19 November 2018 at 14:00 UTC: https://community.icann.org/x/DQnVBQ Thank you. Kind Regards, Terri

2 1

Notice of EPDP team face-to-face meeting/ 16-18 January 2019/ Toronto Canada
by Terri Agnew Nov. 16, 2018

Nov. 16, 2018

Dear all, The EPDP team working on the Temporary Specification for gTLD Registration Data will meet for its third face-to-face meeting in Toronto, Canada from the 16th to the 18th January 2019. Members and liaisons should schedule their travel to arrive on Tuesday, 15 January 2019 with a departure Friday, 18 January 2019 early evening, or Saturday, 19 September 2019 in the morning. This is a three-day meeting with sessions starting at 09:00 local time and ending at 18:00 local time. Please plan travel to attend all sessions. ICANN's Constituency Travel team will be contacting members and liaisons shortly, please respond to them promptly in order to finalise travel details. If members are unable to attend, they must liaise with their alternates and the ICANN Support Team urgently in order to secure adequate representation at the face-to-face meeting. Members must assign an appointed Alternate via the Alternate Assignment form [goo.gl]<https://urldefense.proofpoint.com/v2/url?u=https-3A__goo.gl_forms_xtfYf9mWF…>. There will be a welcome reception early Tuesday evening and a EPDP team dinner on Wednesday evening. Breakfast is included in the hotel room rate and lunches will be served at the meeting venue. By the date of this meeting, it is planned that we will have identified the key issues for discussion so we think it is well-timed. Thank you for the time and sacrifice required by this effort generally and especially for the travel and work required for this meeting. Further information, including remote listening, will be available and provided closer to the meeting time. For any assistance or additional questions, please contact to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org>. With kind regards, Terri --- Terri Agnew Operations Support - GNSO Lead Administrator Internet Corporation for Assigned Names and Numbers (ICANN) Email: terri.agnew(a)icann.org<mailto:terri.agnew@icann.org> Skype ID: terri.agnew.icann Find out more about the GNSO by visiting: https://learn.icann.org/ [learn.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO [twitter.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Follow the GNSO on Facebook: https://www.facebook.com/icanngnso/ [facebook.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.facebook.com_icann…> http://gnso.icann.org/en/ [gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_en_&d=Dw…>

1 0

ICANN Org Feedback on Roles and Responsibilities Memo
by Trang Nguyen Nov. 16, 2018

Nov. 16, 2018

Dear EPDP Team, Attached, please find ICANN org’s feedback on the roles and responsibilities memo that Thomas circulated on 7 November. This document is not an official ICANN org or Board position but is intended to provide additional input from ICANN org into the ongoing deliberations of the EPDP Team about whether or not Article 26 of the European Union’s General Data Protection Regulation (GDPR) applies to processing activities concerning gTLD registration data. The document sets out key points to add to the discussion on the Roles and Responsibilities Memo. These points provide additional viewpoints to help assess whether or not Article 26 of the GDPR applies to various gTLD registration data processing activities. The points are not intended to be exhaustive; other issues may arise and should be further discussed among the EPDP Team, and ICANN org looks forward to participating in further discussions. Dan and Trang ICANN org liaisons

3 2

Legal vs Natural and Redactions
by Hadia Abdelsalam Mokhtar EL miniawi Nov. 16, 2018

Nov. 16, 2018

Marika, On Legal vs Natural, you can definitely say that the ALAC supports making the distinction mandatory. In the sentence "They further are of the view that this critical issue falls squarely within the scope of the EPDP, as it is already addressed in the Temporary Specification.", "is already addressed" is somewhat misleading as it might be construed to imply that the Temp Spec already requires the distinction. However, the Temp Spec does reference the issue in "Annex: Important Issues for Further Community Action" and the EPDP Charter explicitly asks whether the distinction should be required so there is no question the issue is within scope. On redactions, the ALAC supports the proposal that Rec #3, redactions only apply to registrants who are natural persons where anonymized e-mail addresses or a web form be provided, and that for legal persons, the original addresses be provided. This is in line with the EDPB letter of 05 July. In fact, the letter goes further in that it is not restricted to legal persons and says that all registrants could use non-personal e-mail address which would therefore not need to be anonymized. Hadia on behalf of myself and Alan

10 14

Proposed Agenda - EPDP Team Meeting #27 - 16 November 2018
by Caitlin Tubergen Nov. 16, 2018

Nov. 16, 2018

Dear EPDP Team, Below, please find the agenda for our next EPDP meeting on Friday, 16 November at 1400 UTC. Thank you. Best regards, Marika, Berry, and Caitlin EPDP Meeting #27 Agenda Friday, 16 November 2018 Roll Call & SOI Updates (5 minutes) Welcome and Updates from EPDP Team Chair (5 minutes) Review of outstanding action items Other updates, if applicable Continue review & discussion of comments / input received on Initial Report Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report Commence review of proposed changes / comments on the Initial Report Confirm approach for addressing these Confirm next steps, if any Confirm / discuss any input on the Thomas’s Responsibilities text (if any) Wrap and confirm next meeting to be scheduled for Monday 19 November at 14.00 UTC. Confirm action items Confirm questions for ICANN Org, if any

1 0

List of preliminary recommendations and related meetings
by Marika Konings Nov. 16, 2018

Nov. 16, 2018

Dear All, Per the RySG request, please find below the list of preliminary recommendations as currently included in this version of the Initial Report (https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyG…) and the related meeting during which this topic was discussed/agreed, to the best of our recollection. We hope this is helpful. Best regards, Caitlin, Berry and Marika ======================= Preliminary Recommendation #1 Result of ongoing deliberations on purposes (LA F2F meeting as well as subsequent meetings) Preliminary Recommendation #2 ICANN63 F2F meeting in the context of deliberations on Purpose B Preliminary Recommendation #3 LA F2F meeting Preliminary Recommendation #4 Result of ongoing deliberations on data elements workbooks Preliminary Recommendation #5 Result of ongoing deliberations on data elements workbooks Preliminary Recommendation #6 Result of ongoing deliberations on data elements workbooks (Escrow) and input during triage re. need for appropriate agreements Preliminary Recommendation #7 To be deleted – was result of deliberations during EPDP Team meeting #22 Preliminary Recommendation #8 Result of ongoing deliberations on data elements workbooks (Compliance) Preliminary Recommendation #9 ICANN63 F2F meeting, Meeting #25 Preliminary Recommendation #10 ICANN63 F2F meeting Preliminary Recommendation #11 Meeting #25 Preliminary Recommendation #12 Result of ongoing deliberations on data elements workbooks, Meeting #23 Preliminary Recommendation #13 Small team #3, ICANN63 F2F meeting Preliminary Recommendation #14 Result of ongoing deliberations on data elements workbooks, Meeting #24, #25, #26 Preliminary Recommendation #15 To be deleted – result of small team deliberations during LA F2F meeting Preliminary Recommendation #16 Triage Survey, Meeting #5 Preliminary Recommendation #17 Triage Survey, Meeting #5 Preliminary Recommendation #18 Triage Survey, Meeting #5 Preliminary Recommendation #19 LA F2F Meeting Preliminary Recommendation #20 Triage Survey, Meeting #5 Preliminary Recommendation #21 Triage Survey, Meeting #5 Preliminary Recommendation #22 LA F2F Meeting Preliminary Recommendation #23 ICANN63 F2F meeting Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 1

Notes and action items - EPDP Team Meeting #26
by Caitlin Tubergen Nov. 15, 2018

Nov. 15, 2018

Dear EPDP Team, Below, please find notes and action items from today’s EPDP team meeting. As a reminder, any comments or concerns on the draft Initial Report are due COB TODAY, 15 November. Thank you. Best regards, Marika, Berry and Caitlin EPDP Team Meeting #26 15 November 2018 High-Level Action Items: EPDP Team to review Thomas’ proposed language concerning the responsibilities of the parties in processing data in advance of tomorrow’s meeting. EPDP Team to note any additional concerns with draft preliminary recommendations by COB today. Support Staff to map preliminary recommendation to meeting dates so the EPDP Team can trace the origin of specific recommendations. Support Staff to redraft language for third party beneficiary recommendation indicating there is a diversity of opinion on that issue.. Notes These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/uQXVBQ Proposed Agenda: 1. Roll Call & SOI Updates (5 minutes) Attendance will be taken from Adobe Connect Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) a. Review of outstanding action items b. Other updates, if applicable The Leadership Team is meeting with the PCST Team today, and the meeting location should decided at that meeting. Results of this discussion will be communicated to the EPDP Team as soon as available. The Leadership Team is looking into using a different tool for public comment submission in an effort to organize and analyze comments more efficiently. Regarding Charter questions k, l, and m about data processing terms - no volunteers came forward to draft text, but Support Staff sent draft language for review to the list yesterday. Feedback from EPDP Team: If the team recommends ICANN and CPH to enter into joint controller agreements, the schedule of responsibilities could be included in the JCA and could be left to implementation. This Team does not need to specify that CPH needs to comply with GDPR. The Team is tasked with addressing potential inconsistencies with the Temp Spec and the law. Regarding Amr's recommendation with respect to legal vs. natural, Amr has amended the Initial Report language. Benedict's proposal requires Rrs to allow registrants to make a declaration of if they are a legal or natural person. The CPH position - distinction b/w natural and legal persons is not necessary for GDPR compliance and as such, is not appropriate for this time. How can the team resolve this issue equitably? Perhaps Benedict's recommendations can be included in the report, noting disagreement. 3. Thomas Rickert to review proposed language for Responsible Parties for inclusion in the Initial Report. The google doc shows previous language with some amendments based on recent discussions. In confirming the team is aligned on responsible parties language: First question - can the team speak to the legal question of responsible parties classification? Based on our last call, there appeared to be consensus that the team can make this classification. Feedback: It's unclear how to move this recommendation to policy language. In the triage phase, the team noted ICANN and CPH need to have GDPR compliant contracts in place. Second question - what language should be included in the Initial Report to reflect the current state of deliberations? The Team could consider leaving the language vague until we receive ICANN's reasoning as to why it thinks it is not a joint controller. If the Team is convinced a joint controller situation is present, it should draft recommendations accordingly. The EPDP Team's classification of joint controllership is not new and has been discussed on multiple occasions. The necessary piece is that contracted parties enter into negotiation with ICANN, but the specificity should be left to the negotiating parties. First, the principle question is whether the joint controllership situation is applicable or not? Consider adding language - enter into written agreements as set out below (rather than using the term joint controller agreement) The Team did a lot of work to complete the worksheets, and responsible parties seems to be the one area where the team achieved consensus. It seems that the work the team did led to joint controller agreements, and the results of this work should be documented in the Initial Report. A joint controller agreement does not mean a joint controllership for every single purpose - the agreement would break down the roles and responsibilities. The missing piece in this memo is the joint controllership will reflect the work done in the workbooks and will apportion roles and responsibilities according to the EPDP Team's work. Proposed revision regarding the first sentence is in the chat - The EPDP Team recommends that ICANN and CPH enter into an appropriate data processing agreement which may be a joint controller agreement. Based on the information and the deliberations the EPDP Team had on this topic and pending further input and legal advice, the EPDP Team recommends that ICANN negotiates and enters into a JCA with the contracted parties. The table defines the term ICANN purpose. There is a reference to a single JCA - is that a single JCA b/w ICANN, all registries and registrars? That is a question for the Team to decide. Thomas recommends basic parameters are in all JCAs or a standard JCA, but there would be exceptions to reflect special scenarios. The definition of ICANN purposes should not reference billing. Billing was referenced as this is a processing activity that is b/w a contracted party and its customer, and ICANN is not involved. Surprised by ICANN's forthcoming reasoning about joint controllership, especially in reference to publication of WHOIS data. This language needs to be taken back to the RySG. The red herring of billing information should be removed as this data is not published in WHOIS. If the purposes are solely for ICANN, is ICANN the sole controller as opposed to the joint controller? Billing could be taken out. The reason it was included was because this purpose is included in the Temp Spec, but the Team agreed to remove it as registrars do not use this information for this purpose. How would the processing look different if one of the parties was removed - if it would be different, this would support a joint controllership. It may be helpful to have a webinar specifically on this issue early in the public comment period. How do resellers fit into the joint controllership scenario? Under some purposes, contracted parties are processors - escrow, RPMs Please read through the tables regarding the allocation of responsibilities. Give everyone 24 hours to provide feedback in advance of tomorrow's call. Some of the arguments and rationale are a bit confusing. Some of the language may indicate that back-end ROs are also controllers, but they are processors. a. EPDP Team to discuss approach and bring up concerns, if any b. Confirm next steps, if any 4. Commence review & discussion of comments / input received on Initial Report The Support Team has captured the Initial Report comments (from the Google Doc) Some comments are cosmetic/grammatical changes, so those changes have been applied. In cases of uncertainty of substance changes, those comments were included for further discussion. For purposes of this discussion, if the commenter can explain their rationale and proposed change, we will open it up for discussion. Is it still our intention to publish the report on 19 November. The answer is yes. The fact that we're still discussing substantive edits is a cause for concern. What is the process for the Team to agree on what ends up getting included and what doesn't? Where there is agreement - the recommendation will be included (noting disagreement). The proposed changes from the RrSG: this was not discussed within the context of if these comments need to be included before the report can be published. The RrSG members need to consult with their group to see if these could be included in the submitted public comments or if they can be dealt with now. On behalf of the registries, Kristina put in a request to include the particular meeting reference when something was agreed upon. The effort to go through where the EBERO recommendation, for example, came from. What may be in notes and recollection may not match the words of the recommendation. In the interest of getting you what you need, is there a way to highlight the recommendations you need further information on? No, it is all of the recommendations. Item O on this list does show where the recommendations came from. Some recommendations resulting from Small Team efforts or are derivatives of several calls; accordingly, it may be difficult to pinpoint the exact meeting where the recommendation derived. There may not be agreement on recommendation 7. Some recommendations in the report seem to have come out of nowhere. It would be helpful to flag any recommendation issues specifically by tomorrow. Recommendation regarding third party beneficiaries - any objection to taking this out of the initial report? This language does serve a purpose within the contract - do not support removing the language, even though it is poorly worded. This may need to be revisited to clean up the language. There should not be third party beneficiary restrictions in consensus policies Action item: Staff to propose language for third party beneficiary recommendation There should be a distinction b/w recommendations agreed to in plenary vs. small teams RPM WG confirmed it is expected to review UDRP in its next phase of work. If the EPDP Team notes anything in relation to data processing activities with respect to RPMs, it would be helpful to share with the RPM WG. There does not seem to be agreement about what optional means, so the Team is asking for clarification with respect to liability with the EPDB. Agreement to leave language as is. Recommendation 7 – should this be deleted? Should the first sentence be added, or should the whole recommendation be deleted? The discussions have not risen to the level of a consensus policy recommendation, but the language could be included in the report. The Team is not limited making recommendations about contractual requirements. Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report a. Commence review of proposed changes / comments on the Initial Report b. Confirm approach for addressing these c. Confirm next steps, if any 5. Wrap and confirm next meeting to be scheduled for Thursday 15 November at 14.00 UTC. a. Confirm action items b. Confirm questions for ICANN Org, if any

1 0

Recordings, Attendance & AC Chat / GNSO Temp Spec gTLD RD EPDP / Thursday, 15 November 2018
by Andrea Glandon Nov. 15, 2018

Nov. 15, 2018

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Thursday, 15 November 2018 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/YAPVBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-15nov18… <https://urldefense.proofpoint.com/v2/url?u=https-3A__audio.icann.org_gnso_g…> AC Recording: https://participate.icann.org/p680y04ux08/<https://participate.icann.org/p680y04ux08/?OWASP_CSRFTOKEN=663c37463e43b07a…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Friday, 16 November 2018 at 14:00 UTC
by Andrea Glandon Nov. 15, 2018

Nov. 15, 2018

Friday, 16 November 2018 at 14:00 UTC for 2 hours Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays at 14:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki pages: Friday, 16 November 2018 at 14:00 UTC: https://community.icann.org/x/7wfVBQ Thank you. Kind Regards, Terri

1 0

Re: [Gnso-epdp-team] Updated data redaction language
by Matt Serlin Nov. 15, 2018

Nov. 15, 2018

Hi Marika, Thanks for sending the updated language…it will be added to the pile ☺ One note though I immediately saw, can you please add the RrSG to the following text: “As such, the NCSG, ISPCP and RySG do not support not redacting this information.” Regards, Matt From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Wednesday, November 14, 2018 at 12:53 PM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Updated data redaction language Dear All, Following yesterday’s discussion, please find attached the updated proposed language for inclusion in the Initial Report in relation to data redaction. Note that this version includes input from Margie and Benedict in relation to the action item from yesterday’s EPDP Team meeting (“Margie to provide language that describes the organizations supporting not redacting the “organization” field. Benedict to provide language to explain systemic risk of not publishing organization field.”). If you have any further comments and/or proposed edits, please share these with the list as soon as possible. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

5 5

Proposed Agenda - EPDP Team Meeting #25
by Marika Konings Nov. 15, 2018

Nov. 15, 2018

Dear All, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 13 November at 14.00 UTC. * In relation to agenda item #3, please find attached an updated version of the proposed language for inclusion in the Initial Report in which staff has aimed to capture some of the input that was received in response to the Initial Report through the google doc, as well as input received on the mailing list. * In relation to agenda item #4, please find attached a table which provides an overview of the changes proposed by EPDP Team members that staff didn’t feel comfortable applying because e.g. either the proposed change is not clear, the proposed change affects previously agreed preliminary agreements / text, or is a substantive change that requires further discussion / consideration by the full EPDP Team (see https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyG… for all comments received to date). In certain cases, staff has proposed a path forward, but would appreciate EPDP Team/commenter feedback before applying this change. Note that a number of comments were made in relation to preliminary recommendations and/or text that is still under consideration. It is the expectation that this input will be raised in the context of those discussions. FYI, staff expects to share an updated version of the Initial Report later today so you can see how other input has been addressed (non-substantial issues) as well as how other aspects are coming together as a result of the EPDP Team work over the last couple of meetings. Best regards, Caitlin, Berry and Marika ====================== EPDP Meeting #25 Agenda Tuesday, 13 November 2018 1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Initial Report finalization status, incl. items remaining to be addressed and schedule for the week ahead * Confirm status and next steps in relation to natural vs. legal and geographic status * Review of outstanding action items * Other updates, if applicable 1. Data Redaction (see attached) Objective of discussion: 1. Confirm language for inclusion in the Initial Report in relation to data redaction as well as email communication * Review latest version of language for inclusion in relation to data redaction * Consider charter questions: f2) Should standardized requirements on registrant contact mechanism be developed? f3) Under what circumstances should third parties be permitted to contact the registrant, and how should contact be facilitated in those circumstances? And related draft recommendation: In relation to facilitating email communication between third parties and the registrant, the EPDP Team recommends that [current requirements in the Temporary Specification that specify that a Registrar MUST provide an email address or a web form to facilitate email communication with the relevant contact, but MUST NOT identify the contact email address or the contact itself, remain in place. [[[Other to be decided]]]. * Confirm next steps, if any 1. Commence review & discussion of comments / input received on Initial Report Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report * Commence review of proposed changes / comments on the Initial Report (see list attached) * Confirm approach for addressing these * Confirm next steps, if any 1. Wrap and confirm next meeting to be scheduled for Wednesday 14 November / Thursday 15 November at 14.00 UTC (dependent on progress made). * Confirm action items * Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

7 6

Language for inclusion in the Initial Report - Natural/legal person and geographic basis
by Marika Konings Nov. 14, 2018

Nov. 14, 2018

Dear All, With the aim of finalizing the proposed language in relation to natural/legal person and geographic basis, please find attached the proposed language for inclusion in the Initial Report . The leadership team & staff tried to address all input and find the right balance in conveying the different points of view without turning this into a lengthy debate between the different perspectives. Do note that for the parts highlighted in yellow, groups can still indicate if they want to have their name associated with a certain position. Thank you for all your input. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

3 2

Personal Information Concerning Legal and Natural Persons
by Amr Elsadr Nov. 14, 2018

Nov. 14, 2018

Hi, In follow-up on action item #2 from yesterday’s call, I’ve made a few edits to the 11 November document on Legal vs Natural Persons. The changes are meant to address what I tried to convey during yesterday’s call; that the real problem we are trying to solve isn’t a distinction between natural and legal persons, but rather how the personal information collected during the registration process is treated, and whether it concerns legal persons or natural persons. In my view, this is the real issue we’ve been trying to tackle, regardless of whether EPDP Team members believe that the distinction should be made via self-identification at the time of registration, or not, as well as whether EPDP Team members believe the distinction should be a requirement on the part of Registrars during the registration process, or optional. The questions we’re asking in the initial report on this issue also seem to me to be soliciting answers to that effect. It isn’t so much of whether the Registrant field in the RDDS indicates a legal or a natural person. The real issue is whether the personal information collected during the registration process concerns a legal or natural person, irrespective of how/if the RNH self-identifies as one or the other. Note that the excerpt from the EDPB letter already included in the document addresses the issue in that manner, so the changes I’m proposing only add consistency and accuracy to how I believe the EPDP Team should be framing the issue. This is also made clear in GDPR Recital 14, which states: > The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person. When I proposed these changes during yesterday’s call, I thought of them as a friendly amendment of sorts - one that only helps to clarify the issue, and make it more visibly specific to the intended audience of the initial report. However, early reactions indicated a possibly different reception than I had anticipated. To be honest, I’m not clear why that is, and would welcome any views expressed along with rationale, whether in support or opposition of the proposed changes. Thanks. Amr

2 2

Responsibilities in Data Processing draft text
by Caitlin Tubergen Nov. 14, 2018

Nov. 14, 2018

Dear EPDP Team, In reviewing outstanding items for the Initial Report, no volunteers came forward to draft text for Charter Questions k2, l4 and m4 regarding responsibilities in processing data. Accordingly, Support Staff drafted the following proposed text: k) ICANN's responsibilities in processing data k2) In addition to any specific duties ICANN may have as data controller, what other obligations should be noted by this EPDP Team, including any duties to registrants that are unique and specific to ICANN’s role as the administrator of policies and contracts governing gTLD domain names? l) Registrar's responsibilities in processing data do registrars undertake solely at ICANN's direction? l4) What are the registrar's responsibilities to the data subject with respect to data processing activities that are under ICANN’s control? m) Registry's responsibilities in processing data m4) What are the registry's responsibilities to the data subject based on the above? Proposed response: The EPDP Team took note of the GDPR requirements and notes that in instances where the EPDP Team has classified ICANN as a Controller, ICANN would be expected to comply with the law. However, the EPDP Team is not recommending additional requirements for ICANN at this time. Similarly, the EPDP Team took note of the GDPR requirements and notes that in instances where the EPDP Team has classified Registries and Registrars as Controllers, or Processors, the Registry and/or Registrar would be expected to comply with the law. However, the EPDP Team is not recommending additional requirements for contracted parties at this time. -- The draft text is also attached for ease of marking up. Please let us know if you have any concerns with the above. Best regards, Marika, Berry and Caitlin

1 0

Updated data redaction language
by Marika Konings Nov. 14, 2018

Nov. 14, 2018

Dear All, Following yesterday’s discussion, please find attached the updated proposed language for inclusion in the Initial Report in relation to data redaction. Note that this version includes input from Margie and Benedict in relation to the action item from yesterday’s EPDP Team meeting (“Margie to provide language that describes the organizations supporting not redacting the “organization” field. Benedict to provide language to explain systemic risk of not publishing organization field.”). If you have any further comments and/or proposed edits, please share these with the list as soon as possible. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Re: [Gnso-epdp-team] [Ext] IPC on UDRP in Initial Report (Part 4, section o))
by Marika Konings Nov. 14, 2018

Nov. 14, 2018

Thanks, Brian. Staff will make note in the draft Initial Report of the IPC’s support for the BC’s suggestion and will reflect that it MAY trigger a change to the UDRP instead of WOULD to factor in that this would likely require further consideration based on the input you provided below. Best regards, Marika From: "King, Brian" <Brian.King(a)markmonitor.com> Date: Wednesday, November 14, 2018 at 1:40 PM To: Marika Konings <marika.konings(a)icann.org>, "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Ext] IPC on UDRP in Initial Report (Part 4, section o)) Hi Marika, The IPC would like to note its support of the BC’s suggestion that pre-filing disclosure “be added to the processing activities for the purpose of coordinating, operationalizing and facilitating policies for resolution of disputes regarding or relating to the registration of domain names (as opposed to the use of such domain names), namely, the UDRP, URS, PDDRP, RRDRP and future-developed domain name registration-related dispute procedures for which it is established that the processing of personal data is necessary.” We do not believe that this would necessarily require a change to the UDRP for a number of reasons, including that 4.a. of the UDRP distinguishes between the assertion that the three UDRP prongs are met, and the subsequent administrative proceeding when the prongs are proved. As one example, this distinction provides opportunity for policy development (e.g. controls and requirements to prevent fishing expeditions) that support pre-filing, post-assertion disclosure in limited circumstances. For completeness, speaking to the point currently included in the Initial Report draft, GDPR redaction is distinguishable from privacy/proxy registrations as the latter has been and can be considered non-dispositive evidence of the bad faith UDRP prong, where the former has not, to my knowledge. To Alan Woods’ sage point in his recent note, the assessment/reasoning for this, in addition to the above-mentioned and BC-mentioned prejudice to brand owners in the UDRP since May 25, is that the lack of pre-filing WHOIS data availability has made the UDRP less effective as evidenced by a 10% decrease in the number of domains per UDRP case filed at WIPO since May 25, and a 21% decrease year-over-year based on my last data pull. Further, 2/3 of the UDRP prongs involve the registrant’s identity, making it extremely difficult and in some cases impossible to draft a good-faith UDRP filing without pre-filing disclosure. Thank you. Brian J. King Director of Internet Policy & Industry Affairs MarkMonitor / Part of Clarivate Analytics Phone: +1 (443) 761-3726 brian.king(a)markmonitor.com<mailto:brian.king@markmonitor.com>

1 0

IPC on UDRP in Initial Report (Part 4, section o))
by King, Brian Nov. 14, 2018

Nov. 14, 2018

Hi Marika, The IPC would like to note its support of the BC's suggestion that pre-filing disclosure "be added to the processing activities for the purpose of coordinating, operationalizing and facilitating policies for resolution of disputes regarding or relating to the registration of domain names (as opposed to the use of such domain names), namely, the UDRP, URS, PDDRP, RRDRP and future-developed domain name registration-related dispute procedures for which it is established that the processing of personal data is necessary." We do not believe that this would necessarily require a change to the UDRP for a number of reasons, including that 4.a. of the UDRP distinguishes between the assertion that the three UDRP prongs are met, and the subsequent administrative proceeding when the prongs are proved. As one example, this distinction provides opportunity for policy development (e.g. controls and requirements to prevent fishing expeditions) that support pre-filing, post-assertion disclosure in limited circumstances. For completeness, speaking to the point currently included in the Initial Report draft, GDPR redaction is distinguishable from privacy/proxy registrations as the latter has been and can be considered non-dispositive evidence of the bad faith UDRP prong, where the former has not, to my knowledge. To Alan Woods' sage point in his recent note, the assessment/reasoning for this, in addition to the above-mentioned and BC-mentioned prejudice to brand owners in the UDRP since May 25, is that the lack of pre-filing WHOIS data availability has made the UDRP less effective as evidenced by a 10% decrease in the number of domains per UDRP case filed at WIPO since May 25, and a 21% decrease year-over-year based on my last data pull. Further, 2/3 of the UDRP prongs involve the registrant's identity, making it extremely difficult and in some cases impossible to draft a good-faith UDRP filing without pre-filing disclosure. Thank you. Brian J. King Director of Internet Policy & Industry Affairs MarkMonitor / Part of Clarivate Analytics Phone: +1 (443) 761-3726 brian.king(a)markmonitor.com<mailto:brian.king@markmonitor.com>

1 0

Proposed Agenda - EPDP Team Meeting #26 - 15 November 2018
by Caitlin Tubergen Nov. 14, 2018

Nov. 14, 2018

Dear EPDP Team, Below, please find the agenda for our next EPDP meeting on Thursday, 15 November. Attached, please find an updated table of comments / input received on the Initial Report. If possible, please review the table in advance of our meeting tomorrow. Thank you. Best regards, Marika, Berry, and Caitlin EPDP Meeting #26 Agenda Thursday, 15 November 2018 Roll Call & SOI Updates (5 minutes) Welcome and Updates from EPDP Team Chair (5 minutes) Review of outstanding action items Other updates, if applicable Thomas Rickert to review proposed language for Responsible Parties for inclusion in the Initial Report. EPDP Team to discuss approach and bring up concerns, if any Confirm next steps, if any Commence review & discussion of comments / input received on Initial Report Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report Commence review of proposed changes / comments on the Initial Report Confirm approach for addressing these Confirm next steps, if any Wrap and confirm next meeting to be scheduled for Thursday 15 November at 14.00 UTC. Confirm action items Confirm questions for ICANN Org, if any

1 0

***REMINDER*** Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Thursday, 15 November 2018 at 14:00 UTC for 3 hours
by Julie Bisland Nov. 14, 2018

Nov. 14, 2018

**Thursday, 15 November 2018 at 14:00 UTC for 3 hours** Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays at 14:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: Thursday, 15 November 2018 at 14:00 UTC: https://community.icann.org/x/YAPVBQ Thank you. Kind Regards, Terri

2 1

Controllership Language for Initial Report
by King, Brian Nov. 14, 2018

Nov. 14, 2018

Hi All, If I still have posting rights to the list, here is some language for your consideration as a first draft of the EPDP's position on ICANN controllership for the Initial Report: The team agrees that ICANN is at least a controller for all purposes identified, and perhaps the sole controller for some or all purposes. The team eagerly awaits the receipt of the legal memorandum about ICANN's controllership role that is currently being drafted. As the memorandum was not received prior to the publication deadline for the Initial Report, the team requests that this memorandum be produced as soon as possible to inform both public comment and the group's views on controllership for the Final Report. I'll defer to Alex and Diane on further IPC input from here. Brian J. King Director of Internet Policy & Industry Affairs MarkMonitor / Part of Clarivate Analytics Phone: +1 (443) 761-3726 brian.king(a)markmonitor.com<mailto:brian.king@markmonitor.com>

3 2

Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / two meetings this week
by Terri Agnew Nov. 13, 2018

Nov. 13, 2018

**Please note the following two meetings this week: Thursday, 15 November 2018 at 14:00 UTC for 3 hours Friday, 16 November 2018 at 14:00 UTC for 2 hours Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays at 14:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u Agenda wiki pages: Thursday, 15 November 2018 at 14:00 UTC: https://community.icann.org/x/YAPVBQ Friday, 16 November 2018 at 14:00 UTC: https://community.icann.org/x/7wfVBQ Thank you. Kind Regards, Terri

1 0

Questions and comments on roles and responsibilities in processing data
by Marika Konings Nov. 13, 2018

Nov. 13, 2018

Dear All, In relation to action item #6 (“EPDP Team members to ask questions or make comments (within 24 hours) in relation to the documentation that Thomas provided in relation to roles and responsibilities in processing data and, in particular, the characterization of ICANN and contracted parties as joint processors”), please review the attached document developed by Thomas with edits from Diane. You may also want to review the compilation of Roles & Responsibilities as documented in the EPDP Purpose workbooks - https://docs.google.com/document/d/1-rdfchOwpANFVKOtnM_9bPp-zT4JAvTN8dJqebd…. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Notes and action items - EPDP Team Meeting #25
by Marika Konings Nov. 13, 2018

Nov. 13, 2018

Dear All, Please find below the notes and action items from today’s EPDP Team meeting. If you have not done so yet, please fill out the doodle poll to schedule an additional meeting / time as soon as possible: https://doodle.com/poll/ytt3fuivqbyfvspi. Best regards, Caitlin, Berry and Marika ======================= EPDP Team Meeting #25 Tuesday, 13 November 2018 Notes and Action Items High-level Notes/Actions: Action item #1: Staff to circulate clean version of the most recent draft Initial Report to the EPDP Team (Completed) Action item #2: EPDP Team to consider whether this change (referring to personal information of natural vs. legal person instead of natural vs. legal) would be appropriate / necessary and provide feedback ahead of Thursday's meeting. Amr to propose language for Initial Report. Action item #3: GAC Team to clarify/confirm their edit to the natural vs. legal document Action item #4: Margie to provide language that describes the organizations supporting not redacting the “organization” field. Benedict to provide language to explain systemic risk of not publishing organization field. Action item #5: Staff to update language to reflect that BC/IPC/ALAC do not support preliminary recommendation #3. Action item #6: EPDP Team members to ask questions or make comments (within 24 hours) in relation to the documentation that Thomas provided in relation to roles and responsibilities in processing data and, in particular, the characterization of ICANN and contracted parties as joint processors. Action item #7: Thomas to provide proposed language for inclusion in the Initial Report in relation to roles & responsibilities in time for Thursday's meeting factoring in EPDP Team’s discussion. (The team will then weigh how to include this language in the Initial Report given the upcoming release of an ICANN memorandum on this topic,) Action item #8: Staff to put out doodle poll to determine whether to schedule an additional meeting for either Wednesday or Friday, or extend the meeting time for Thursday. (Completed – please see https://doodle.com/poll/ytt3fuivqbyfvspi) Questions for ICANN Org from the EPDP Team: What is the rationale for not redacting organization field in the Temporary Specification? When will the ICANN be released memorandum concerning the roles and responsibilities in processing data. The EPDP team encourages ICANN to issue the memo within 48 hours so its position can be referenced in the Initial Report. Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/uQXVBQ Proposed Agenda: 1. Roll Call & SOI Updates (5 minutes) * Attendance will be taken from Adobe Connect * Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) a. Initial Report finalization status, incl. items remaining to be addressed and schedule for the week ahead See latest version circulated yesterday for the EPDP to see the latest status of the Initial Report: https://drive.google.com/file/d/1F_fQ5bEHAS543TdLOmDKxXpcJFF1qQy_/view Includes updates reflecting recent EPDP Team work as well as input provided by EPDP Team (minor updates) See also integrated data element workbooks that have been circulated. Action item #1: Staff to circulate clean version of draft Initial Report to the EPDP Team b. Confirm status and next steps in relation to natural vs. legal and geographic status * See latest version https://mm.icann.org/pipermail/gnso-epdp-team/2018-November/000832.html * Personal information of natural vs. legal person - considering updating this reference accordingly, instead of referring to natural vs. legal. Would that bring it more in line with EDPB advice and GDPR and make it more specific what this concerns? Action item #2: EPDP Team to consider whether this change (referring to personal information of natural vs. legal person instead of natural vs. legal) would be appropriate / necessary and provide feedback ahead of Thursday's meeting. Action item #3: GAC Team to clarify/confirm their edit to the natural vs. legal document c. Review of outstanding action items * See https://community.icann.org/x/NwSNBQ * Note ongoing work and documents that have been circulated for review. d. Other updates, if applicable * Some time to be added to the agenda to discuss small group discussion that took place yesterday in relation to roles / responsibilities. See email that Thomas sent to the mailing list. 3. Data Redaction (see attached) Objective of discussion: 1. Confirm language for inclusion in the Initial Report in relation to data redaction as well as email communication a. Review latest version of language for inclusion in relation to data redaction b. Consider charter questions: 2. Should standardized requirements on registrant contact mechanism be developed? 3. Under what circumstances should third parties be permitted to contact the registrant, and how should contact be facilitated in those circumstances? And related draft recommendation: In relation to facilitating email communication between third parties and the registrant, the EPDP Team recommends that [current requirements in the Temporary Specification that specify that a Registrar MUST provide an email address or a web form to facilitate email communication with the relevant contact, but MUST NOT identify the contact email address or the contact itself, remain in place. [[[Other to be decided]]]. c. Confirm next steps, if any * See latest version circulated to the mailing list together with the agenda * Proposed edits from GAC: 'as they COULD contain personally identifiable information' (add 'could' to that sentence). * Postal code was discussed, but not further recommended to be non-redacted. * Add to first 'add others as appropriate': ISPCP, RySG * Need to distinguish between legal impact of personal data vs. PII. Personal data of an identifiable person may be the correct terminology. If it is referring to the legality, it should refer to personal data, although in this context it can refer to personal identifiable data. PII is American term, personal data is the European term. * A lot of data in the org field is identical to the registrant field. So if we redact the registrant field, how can we not redact the org field? * Not only consider risk of contracted parties, but also consider risk of redacting this information and systemic risk to the system this may created. Consider adding this to the report. Do note that data is captures, just not published. * Why do some propose to treat companies the same way as natural persons? Need to factor in that in certain circumstances, for example small businesses, this information could identify natural persons. * Need to make clear in the second bullet point that there are also those that support having this information published. * Protected organizations such as religious institutions, transgender groups, etc. could be put at risk by publishing this information. * Web form is not sufficient, email address is important. Not able to identify trends in registration across multiple registrations with anonymized email address. Web form does not provide evidence that contact was made / presumption of delivery. * The aim of the webform is to contact the registrant though. If registrars are required by law, court order or some other judicial process to provide the information, then registrars would ordinarily do so. * Input needed with regards to what should be recommended in relation to email communication. * EDPB advice directed guidance to legal persons to not put personal information in email contact. * Document that BC/IPC/ALAC do not support preliminary recommendation #3. Action item #4: Margie to provide language in relation to support for not redacting certain fields. Benedict to provide language to capture risk of not publishing organization field info. Action item #5: Staff to update language to reflect that BC/IPC/ALAC do not support preliminary recommendation #3. Question for ICANN Org: What is the rationale for not redacting organization field in the Temporary Specification? 4. Commence review & discussion of comments / input received on Initial Report Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report a. Commence review of proposed changes / comments on the Initial Report (see list attached) b. Confirm approach for addressing these c. Confirm next steps, if any * Additional agenda item: Update on roles & responsibilities team * See email circulated by Thomas that provides update on call that took place yesterday. * Mapping of responsibilities determines the role that the different parties have, it is not something that parties can decide themselves. Even in a joint controller agreement, you need to document who is responsible for what, for example, informing data subjects, rectifying errors, as well as addressing indemnification. * If ability for EPDP Team to speak to legal issues is questioned, should EPDP just provide its perspective, or should it indicate that it is not in a position to answer this charter question. How to deal with this question time wise? If an Initial Report is put out without being able to digest ICANN Org view, it may be premature and not allow groups to formulate properly their positions. * Urgent for ICANN Org to share this memo as soon as possible. * Can the group determine as a matter of policy that there should be joint controller agreements between ICANN and CP, or is this to be determined by some separate body? Should be fine for EPDP to look at GDPR and come to its own conclusions. It is not about making it as convenient as possible for parties involved, but make it as convenient for EDBP and data subjects. * This is a factual analysis that is being made in line with the work. * Board liaisons have stated that Board would follow EPDP recommendations, unless these would create significant issues for ICANN Org / Community. * Charter asks EPDP Team to identify a data controller and data processer. * Cautious about putting forward a recommendation for a joint controller agreement to have then ICANN Org say that they are not willing to negotiate one. Need to be able to make an informed decision. * Consider framing the issue and inviting public comment and further legal analysis from ICANN and/or external legal advice. * Substantive work has to proceed - controller issue does/should not affect other decisions the EPDP Team has made. * ICANN Org position is not determining - if under law and under structure of GDPR is ICANN is deemed a controller or joint-controller is a matter of legal fact. * No constructive purpose to delay the Initial Report. More time could be devoted to this topic during the public comment period as well as F2F * ICANN Org input could be provided during public comment period. * Could also consider putting a placeholder in the report that squarely puts the ball in ICANN's court? * Consider writing formal note to ICANN Org to ask for input to be provided as soon as possible? * Group could document where its current thinking is at but note that further thinking will go into it? Also refer to existence and potential impact on EPDP's recommendation. * Temp Spec does list ICANN as controller, concern appears to be around notion of joint-controller. Action item #6: EPDP Team members to ask any questions within 24 hours in relation to the documentation that Thomas provided. Action item #7: Thomas to provide proposed language for inclusion in the Initial Report in time for Thursday's meeting factoring in EPDP Team’s discussion. 5. Wrap and confirm next meeting to be scheduled for Wednesday 14 November / Thursday 15 November at 14.00 UTC (dependent on progress made). a. Confirm action items b. Confirm questions for ICANN Org, if any Action item #8: Staff to put out doodle poll to determine whether to schedule an additional meeting for either Wednesday or Friday, or extend the meeting time for Thursday. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Re: [Gnso-epdp-team] Latest version of draft Initial Report
by Marika Konings Nov. 13, 2018

Nov. 13, 2018

As requested, you can view a clean version of the latest version of the draft Initial Report here: https://drive.google.com/a/icann.org/file/d/1JgIu5IjCiEjxz8u5_35dNkMC824oMI…. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Monday, November 12, 2018 at 3:48 PM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Latest version of draft Initial Report Dear All, In order for you to be able to track the progress staff is making on the draft Initial Report, you can review the latest version here: https://drive.google.com/open?id=1F_fQ5bEHAS543TdLOmDKxXpcJFF1qQy_ [drive.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__drive.google.com_open-…>. This version aims to address the input that was received in the google doc from the various groups that was deemed non-controversial as well as updates as a result of recent EPDP Team deliberations and preliminary agreements. In addition, staff added proposed language in relation to EBERO, per the action item from a recent meeting (see lines 891-896 and 1348-1359) as well as to reflect the discussion in relation to disclosure of complainant in the context of UDRP (see lines 1718-1731). As you know, there are still a couple of items that are in the process of being discussed – these will be updated accordingly. Similarly, additional changes may be made as a result of the list of comments for further EPDP Team consideration which was shared with the agenda for the next EPDP Team meeting. Nevertheless, we hope this gives you a good idea of where the Initial Report currently stands. All items for further EPDP Team discussion should have been flagged by now, but should you spot any errors or issues in this version, please add your comments to the google doc: https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyG… [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…>. Thank you, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Recordings, Attendance & AC Chat / GNSO Temp Spec gTLD RD EPDP / Tuesday, 13 November 2018
by Andrea Glandon Nov. 13, 2018

Nov. 13, 2018

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Tuesday, 13 November 2018 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/VgPVBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-13nov18… <https://urldefense.proofpoint.com/v2/url?u=https-3A__audio.icann.org_gnso_g…> AC Recording: https://participate.icann.org/p8im8q14ab7/<https://participate.icann.org/p8im8q14ab7/?OWASP_CSRFTOKEN=663c37463e43b07a…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

**Resent for email archive URL link / Recordings, Attendance & AC chat from the GNSO Temp Spec gTLD RD EPDP Small Roles & Responsibilities team held on Monday, 12 November 2018 at 18:30 UTC
by Terri Agnew Nov. 13, 2018

Nov. 13, 2018

**Resending for email archive Adobe Connect Recording link. Dear all, Please find the attendance and AC chat attached to this email. The MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP Small Roles & Responsibilities call held on Monday, 12 November 2018 at 18:30 UTC These have also been posted on the agenda wiki page: https://community.icann.org/x/uQXVBQ MP3: https://audio.icann.org/gnso/gnso-epdp-temp-spec-gtld-registration-data-sma… AC Recording: https://participate.icann.org/p2o28w0kbub/ ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Terri Agnew

1 0

Latest version of draft Initial Report
by Marika Konings Nov. 12, 2018

Nov. 12, 2018

Dear All, In order for you to be able to track the progress staff is making on the draft Initial Report, you can review the latest version here: https://drive.google.com/open?id=1F_fQ5bEHAS543TdLOmDKxXpcJFF1qQy_. This version aims to address the input that was received in the google doc from the various groups that was deemed non-controversial as well as updates as a result of recent EPDP Team deliberations and preliminary agreements. In addition, staff added proposed language in relation to EBERO, per the action item from a recent meeting (see lines 891-896 and 1348-1359) as well as to reflect the discussion in relation to disclosure of complainant in the context of UDRP (see lines 1718-1731). As you know, there are still a couple of items that are in the process of being discussed – these will be updated accordingly. Similarly, additional changes may be made as a result of the list of comments for further EPDP Team consideration which was shared with the agenda for the next EPDP Team meeting. Nevertheless, we hope this gives you a good idea of where the Initial Report currently stands. All items for further EPDP Team discussion should have been flagged by now, but should you spot any errors or issues in this version, please add your comments to the google doc: https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyG…. Thank you, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Recordings, Attendance & AC chat from the GNSO Temp Spec gTLD RD EPDP Small Roles & Responsibilities team held on Monday, 12 November 2018 at 18:30 UTC
by Terri Agnew Nov. 12, 2018

Nov. 12, 2018

Dear all, Please find the attendance and AC chat attached to this email. The MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP Small Roles & Responsibilities call held on Monday, 12 November 2018 at 18:30 UTC These have also been posted on the agenda wiki page: https://community.icann.org/x/uQXVBQ MP3: https://audio.icann.org/gnso/gnso-epdp-temp-spec-gtld-registration-data-sma… AC Recording: https://participate.icann.org/p2o28w0kbub/<https://participate.icann.org/p2o28w0kbub/?OWASP_CSRFTOKEN=1c3dea44be7d650e…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Terri Agnew

1 0

Re: [Gnso-epdp-team] [Ext] RE: Language for inclusion in the Initial Report - Natural/legal person and geographic basis
by Marika Konings Nov. 12, 2018

Nov. 12, 2018

Laureen, please note that the GAC’s proposed changes were made on the old version, not the one that was circulated earlier today. The version circulated today, see attached here again, contains language proposed by the BC/IPC for which it was indicated that the GAC might want to sign up to that language as well. As there seem to be parallels between the language the GAC has put forward and the one suggested by the BC/IPC, can you please confirm whether you want to see the GAC input added separately or whether you want to add the GAC name to the existing paragraph? Thank you for confirming. Best regards, Caitlin, Berry and Marika p.s. we just noted that for some reason the addition of the EDPB language in relation to this issue on page 1 is not marked in redline, but it is new language that was added in response to the input provided. From: "Kapin, Laureen" <LKAPIN(a)ftc.gov> Date: Monday, November 12, 2018 at 11:58 AM To: Marika Konings <marika.konings(a)icann.org>, "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Cc: "Ashley Heineman (AHeineman(a)ntia.doc.gov)" <AHeineman(a)ntia.doc.gov> Subject: [Ext] RE: Language for inclusion in the Initial Report - Natural/legal person and geographic basis Dear colleagues, I’m attaching the additional views of the GAC on the natural/legal distinction. Apologies for the delay. Laureen Kapin Counsel for International Consumer Protection Office of International Affairs Federal Trade Commission (202) 326-3237 lkapin(a)ftc.gov From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> On Behalf Of Marika Konings Sent: Monday, November 12, 2018 10:45 AM To: gnso-epdp-team(a)icann.org Subject: [Gnso-epdp-team] Language for inclusion in the Initial Report - Natural/legal person and geographic basis Dear All, With the aim of finalizing the proposed language in relation to natural/legal person and geographic basis, please find attached the proposed language for inclusion in the Initial Report . The leadership team & staff tried to address all input and find the right balance in conveying the different points of view without turning this into a lengthy debate between the different perspectives. Do note that for the parts highlighted in yellow, groups can still indicate if they want to have their name associated with a certain position. Thank you for all your input. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

REMINDER-- Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 13 November 2018 at 14:00 UTC
by Andrea Glandon Nov. 12, 2018

Nov. 12, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays at 14:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/VgPVBQ Thank you. Kind Regards, Andrea

1 0

EPDP Team Preliminary Recommendation #8 - Redaction of RNH Organization Field
by Amr Elsadr Nov. 10, 2018

Nov. 10, 2018

Hi, I would like to once again raise the issue of the optional “Organization” field listed in the draft initial report, and ask that it be changed from “Non-redacted” to either “Redacted”, or at a minimum, indicate that there is no consensus on the EPDP Team on whether this data element should be redacted or not. The Outstanding Issues document dated 6 November circulated by staff described recommendation #8 on data redaction as follows: > "The current language aims to reflect the EPDP Team discussion during ICANN63. What aspects need to be further considered? It is the expectation that further information obtained during the public comment period may help to further inform this discussion." I don’t believe this is entirely accurate, as the text rationalizing recommendation #8 in the draft initial report did not capture the discussion that took place on the last day of our F2F meetings at ICANN 63. There is a bullet in the draft initial report specifically addressing this data element, yet it makes no mention of the concerns raised about how non-redacted information may, in combination with other data elements, result in a data subject becoming identifiable. This is a nuance in GDPR compliance, which the EPDP needs to address and has been previously discussed. As a reminder, in Barcelona, the NCSG referenced the legal advice provided by WSGR to the GNSO RDS PDP WG on this issue, which reads as follows: > "Data elements are considered to be personal data if they relate to an identified or identifiable natural person (i.e., an individual). This depends on the context and the particular data element involved, and data that may not seem identifiable on their face may still be considered to be personal data (e.g., a 16-digit number may actually be a credit card number). Given the growth of computing power, much data that was earlier not considered to be personal has become viewed as personal data, so the concept is fluid. Under current data protection law (i.e., the Directiveand national implementations of it), the data of legal persons is covered in only a few jurisdictions, while under the GDPR, it will not be covered by data protection law at all (see Recital 14). The GDPRgives as example of the data of legal persons, their name and form as well as their contact details, which it states, are not covered. However, the key factor is not just whether the name of the registrant is that of a natural or legal person, but how the different data fields, when taken together, relate to an individual." Additionally, Recital 26 of the GDPR states that: > "The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly." Although a data element identifying an Organization name does not in itself identify a natural person, it certainly relates to one. Additionally, in combination with other non-redacted data elements such as “Country” and “State/province”, it can very likely contribute to a data subject becoming more identifiable. The current text in the draft initial report addressing the “Organization” data element only indicates that the EPDP Team has questions regarding liability, should a RNH choose to provide PII within the “Organization” field. The NCSG's concerns are clearly broader than this scenario, and we ask that (at a minimum) the concern outlined here be included in the report, referencing the above sources, and indicating that this is an issue on which there is still no consensus. Thanks. Amr

1 0

Proposed Agenda - EPDP Team Call #24 - Thursday, 8 Nov
by Caitlin Tubergen Nov. 10, 2018

Nov. 10, 2018

Dear All, Please find below the proposed agenda for the next EPDP Team meeting, which is scheduled for Thursday 8 November at 14.00 UTC. Best regards, Marika, Berry and Caitlin EPDP Meeting #24 Agenda Thursday, 8 November 2018 Roll Call & SOI Updates (5 minutes) Welcome and Updates from EPDP Team Chair (5 minutes) Review of outstanding action items Other updates, if applicable Review of Responsible Parties Recommendations (Thomas)* Review and discuss draft recommendations Confirm next steps, if any Review proposed updates to staff-suggested Natural vs. Legal persons text Review and discuss draft approach Confirm next steps, if any Review of Consolidated Data Elements Matrix Objective of discussion: Address any possible inconsistencies Confirm data elements matrix for inclusion in the Initial Report Confirm staff-suggested responses for Purpose Rationale questions Confirm Processing Activities structure, especially Disclosure and Retention Confirm Data Elements Review Data Elements Matrix Discuss inconsistencies identified by staff and proposed resolution Confirm next steps, if any Wrap and confirm next meeting to be scheduled for Tuesday 13 November at 14.00 UTC. Confirm action items Confirm questions for ICANN Org, if any *Please note if the responsible parties draft recommendations are not ready for tomorrow’s call, we will discuss redaction in its place.

3 4

For your review - updated language natural vs. legal
by Marika Konings Nov. 10, 2018

Nov. 10, 2018

Dear All, Per action item #2 from today’s meeting (Support Staff will rework language for natural vs. legal persons and send to the mailing list so that EPDP Team members can include and/or correct their own viewpoints. Please propose edits by tomorrow, Friday, 9 November.), please find attached the updated language. On pages 1-3 you can find the clean version, on pages 4-6 the redline, for those interested. For those that expressed an interest to add their view points to this language, please share your proposed additions by Friday 9 November COB. These additions are expected to be added to the yellow highlighted part of the text. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

6 5

For your review - revised language re. Geographic application
by Marika Konings Nov. 9, 2018

Nov. 9, 2018

Dear All, Please find attached for your review the proposed language in relation to geographic application for inclusion in the Initial Report, based on the input that has been received to date. Staff accepted the redlines of the previous version so the redlines on page 1-2 are the edits that have been made based on the discussions to date as well as edits suggested (in the subsequent pages you can find the original draft as well as input received). Please share any further comments you made have with the mailing list by Monday 12 November at the latest. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

5 8

Re: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report
by Marika Konings Nov. 9, 2018

Nov. 9, 2018

Milton, Lindsay, thank you for your input. Staff has made some proposed updates to reflect your feedback (see redlines on first two pages of the attached document). Hopefully this addresses accurately where things currently stand from all perspectives. Best regards, Caitlin, Berry and Marika From: Lindsay Hamilton-Reid <lindsay.hamilton-reid(a)fasthosts.com> Date: Wednesday, November 7, 2018 at 3:13 PM To: "Mueller, Milton L" <milton(a)gatech.edu> Cc: Marika Konings <marika.konings(a)icann.org>, Kurt Pritz <kurt(a)kjpritz.com>, "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Ext] Re: [Gnso-epdp-team] NCSG reactions to (part of) the interim report +1 Milton. In addition to Milton’s email below, these points have been made repeatedly by the NCSG and the CPH. The Interim Report should reflect the differences in opinion and that there is no consensus on this point and many others. Many thanks Lindsay Sent from my iPhone On 7 Nov 2018, at 21:05, Mueller, Milton L <milton(a)gatech.edu<mailto:milton@gatech.edu>> wrote: Marika NCSG cannot accept big portions of the proposed text regarding the legal/natural persons distinction. We note that the text disregards statements from the contracted parties and NCSG. We would respectfully ask you to revise the text in a way that respects and reflects clearly stated and strongly held positions of at least three stakeholder groups. To be specific, the CPH has stated, in regard to the legal/natural persons and geographic distinctions: “Contracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations.” NCSG shares this opposition to requiring distinctions between legal and natural persons and geographic distinctions. In our comment on small team 1 we stated: “The main risk is that the difficulty of distinguishing between the two at the point of registration could lead to the unintended publication of the private data of many natural persons.” This assessment of risk is not reflected in the report. We also proposed deleting the entire paragraph on research because researching how various entities make this distinction basically assumes that making this distinction is a live option for the ePDP. In terms of consensus requirements, all indications are that it is not a real option. It is abundantly clear that no requirement for a distinction between legal and natural persons will survive a consensus recommendation process. At least three stakeholder groups – ¾ of the GNSO and roughly half of the ePDP – are rejecting it as an option. We think the report should move the process forward by explicitly recognizing this fact. Instead, we have Kurt stating on list that there was “an agreement” to do research on the feasibility of differentiating between natural and legal persons. This statement can only come from completely disregarding the interventions NCSG members made in Barcelona, on the latest call, and in an email sent Tuesday to the list by Amr elSadr. To quote from Amr’s email regarding Kurt’s statement regarding research: “I don’t believe that [research on legal/natural] was, in any way, reflective of a consensus to proceed with this recommendation among the Small Team members. To me, it was only an acknowledgement that this view was expressed, discussed, and subsequently required consideration by the whole team.” Kurt has not responded to this email. We will raise these concerns on the call tomorrow. In general, I think the team is in danger of losing sight of its primary mission, which is to quickly bring Whois into compliance with GDPR and to turn the temp spec into a legitimate policy. It seems that some people are seizing on the debate over the temp spec to impose new requirements on contracted parties. I understand that the chair and staff are trying their best to move things along, but we are disturbed by an apparent tendency to ignore or disregard clear position statements from SGs. One of the most important jobs of the ePDP chair is to recognize where consensus exists and where it does not. Some proposals are just not real options: they will never survive a council vote or a consensus call in the ePDP. It is unthinkable that the chair or staff would substitute their own preferences for the rough consensus of the working group. Let’s recognize the parameters of what people can live with and move forward from there. Eliminating options is progress, too. Milton Mueller, on behalf of NCSG From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Marika Konings Sent: Monday, November 5, 2018 11:49 PM To: Kurt Pritz <kurt(a)kjpritz.com<mailto:kurt@kjpritz.com>>; gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 Following on from Kurt’s message, please find hereby the proposed language for inclusion in the Initial Report. Attached is the document that would be linked so that those interested would be able to review the different perspectives and proposals put forward. h3) Should Contracted Parties be allowed or required to treat legal and natural persons differently, and what mechanism is needed to ensure reliable determination of status? h4) Is there a legal basis for Contracted Parties to treat legal and natural persons differently? h5) What are the risks associated with differentiation of registrant status as legal or natural persons across multiple jurisdictions? (See EDPB letter of 5 July 2018). The EPDP Team discussed these questions extensively (see [include link to attached document which includes the different proposals]) and although the EPDP Team agrees that Contracted Parties should be allowed to treat legal and natural persons differently, the EPDP Team did not agree on whether this should be required and/or what further steps could or should be undertaken to determine what mechanism is needed to ensure reliable determination of status. The EPDP Team further agrees under GDPR there is a legal basis to treat legal and natural persons differently, but does not agree on whether that means Contracted Parties should be required to do so, or whether the challenges and legal risks involved in doing so result in leaving this optional. Similarly, the EPDP Team discussed the implication of other data protection regimes which could have different requirements that impact both natural and/or legal persons that would need to be factored in. The EPDP Team identified a number of risks, including: * While legal persons don’t have the same protections under GDPR, natural persons employed by a legal person (and who may be designated as the registrant, admin or technical contact) are still natural persons enjoying rights and protections under GDPR. Some noted that this risk may be minimized through clear explanatory language beneath each field when filling in data fields within domain name registrations. * There may be situations in which it can be difficult to separate the data of natural persons from that of legal persons. This can be the case, for example, if the legal person is a sole proprietorship, if the name of a person appears in the company’s name, if the business address is a natural person’s residence, or if an email address is assigned to a single individual (“john.doe(a)company.example.com<mailto:john.doe@company.example.com>” as opposed to “info(a)company.example.com<mailto:info@company.example.com>. The EPDP has discussed whether this risk may be somewhat mitigated through educational resources. Some in the EPDP Team expressed caution, as a stated necessity to rely on educational resources may not be considered to be compatible with the concepts of privacy by default or privacy by design i.e. where additional ‘educational resources’ are deemed necessary, the process itself is likely not established or presented in a sufficiently clear manner. To help further inform the EPDP Team’s deliberations on this topic as the team works towards a Final Report, the EPDP Team would like to request that GDD staff, who will design the implementation of these policy recommendations, commences research by investigating how ccTLDs and contracted parties currently distinguish between natural and legal persons to inform the EPDP Team. In addition, the EPDP Team would like to request input on the following questions in relation to this topic: * Are there examples from other industries or areas, e.g. ccTLDs, where a mechanism has been successfully developed and implemented to distinguish between natural and legal person, factoring in some of the challenges identified above? * Should the EPDP Team decide to recommend requiring distinguishing between natural and legal persons, how should implementation be carried out, especially considering legacy registrations? * Should the EPDP Team decide to recommend that further research is undertaken, beyond the information that GDD staff may encounter, what and how should this research be carried out? * (For the EDPB) If registrars allow registrants to self-identify at the time as a natural or legal person, who will be held liable if the registrant incorrectly self-identifies and personal information is publicly displayed? Apart from self-identification, are there any other ways in which risk of liability could be mitigated by registrars? The research requested and input on these charter questions will help the EPDP Team further analyze if it is possible and desirable to make this distinction in the context of domain name registrations, in a manner that is commercially reasonable, implementable and does not result in unreasonable liability for contracted parties. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Kurt Pritz <kurt(a)kjpritz.com<mailto:kurt@kjpritz.com>> Date: Monday, November 5, 2018 at 7:45 PM To: "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 Hi Everyone: After all of this thought and writing, I think we have two paths forward that are relatively straightforward to describe. Rather than recap the arguments made here, I will just go right into my recommendations for next step and why. The Support Team will follow this with a better summation of what has transpired and how that leads to the recommendations below. It is clear that camps within our the team are at loggerheads with regard to how geographic basis and natural v legal persons should be handled within the proposed policy recommendations. Current situation and recent developments: Coming out of the small group meeting #1 during a teleconference, there was an agreement in principle that it was necessary to perform research in order to inform the policy discussion regarding the feasibility of differentiating between legal and natural persons. That agreement survived its initial introduction into the whole team where the comments centered around: (1) the adjectives used to describe the sense of urgency concerning the work, and (2) sharpening the detail regarding steps to be taken after the research. (There was never an agreement about how to proceed regarding differentiation of data subjects based on geographical considerations.) Starting Friday, substantial markups to the legal v natural agreement on doing research initiated this current three-day email chain. Preferred Recommendation (there are two): Go back to the agreement in principle that was reached in the small team with representatives from all groups to undertake research to determine if, how and to what extent we can distinguish between legal and natural persons. Then extend that research on to the geographic basis issue. A small group of us can contribute to the terms of reference for this research after the initial report is issued. Here is my rationale for this recommendation: 1) The various arguments laid out in all these emails on this list make the case themselves for the need to do research. For example, if the ICO says that processors can rely on data subject-provided information, does that mean that personal information mistakenly disclosed can be published without liability? We don’t know. We are setting up this and other questions for DPAs. Isn’t that … research? There are other scenarios in the emails that will take research to sort through: whether ccTLD experiences are relevant, or whether a registrant boarding a train and leaving the EU for China while another registrant boarding a ferry for Marseilles will both be protected by GDPR. All this takes research to sort out. Nearly all of the emails on this list have to do with scenarios in support of one position or another - but all need to be studied in order for us to determine if and how distinctions can be made. 2) Many of the arguments laid out are conclusory or without authority. I don’t think the research can have a preordained outcome. To make one point for each line of thinking: a) In the case of natural vs legal data subjects, some seek to build in in an implementation plan without knowing if or to what degree a solution is implementable b) In the case of Geographical distinctions between registrants, some are stating that such a distinction is categorically unimplementable without authority or evidence provided. I think the “truth will out” on these questions and we should not try to push research or our arguments to a pre-ordained outcome. 3) This will provide time to take the effects of existing laws in other jurisdictions into account - if that is deemed desirable. 4) This will take this discussion out of the critical path of finishing our reports, without leaving a blank. 5) The results of the research still must be considered by this team (or its successor) and a consensus derived. Research informs policy; it does not create policy. 6) If we agree to this approach, we can start the research now. If we temporize, there will be little done that will resolve this issue set over the next few months. Taking action in an attempt to understand all the complexity is the responsible thing to do. 7) These are complicated questions and research-based policy-making is required to answer them. How do we meet the timeline and still act in a thorough, detailed manner? By launching research and, in the meantime, going back to the rest of our questions. Whatever our policy conclusions are, even if we are deadlocked in several months time, we should be informed by information garnered from DPAs and other sources. The only other recommendation: MemorialIze the differences between the two sides on each of the two issues, explaining the arguments for each and asking for public comment on these issues. Here is my rationale for and against this recommendation: 1) It will allow us to publish the initial report and, properly framed, can garner specific public comment. However, other factors really argue against maintaining the current status and not taking some action: 2) In the time allotted for public comment, no commenter will be able to perform any meaningful research either. There might be reference to a study that partially informs our work, but not a dispositive study. At the end of the comment period, we are likely to be in the same place. 3) It is hard to see how the public comment will differ from our discussion, in this list, to date. 4) Even if we take the preferred research path above, we can still conduct the comment period on the current position of the parties. 5) If we have no outcome on this issue, the result, to me, is unknown and represent a risk to all parties at the table. Conclusion I thought is was remarkable that we came together and agreed to undertake this research on this difficult topic. It was a significant, meaningful compromise that embodied our reason for being here. I don’t see anything in all the emails that indicate another compromise is possible unless that discussion is informed with significant, new information. I believe the appropriate path for this group is to recognize the differences cannot be resolved without something new and to take this path. Talk to you soon and best regards, Kurt On Nov 5, 2018, at 4:38 PM, Mark Svancarek (CELA) via Gnso-epdp-team <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> wrote: Sorry for being dense, I still have questions. 1. It is not surprising that the addition of a new process step would generate short term inefficiencies. It’s 5 years later – are the verification rates improved from 2014? 2. How would an optional “let me self-identify as a corporation” capability be likely to cause verification disruptions? /marksv From: James M. Bladel <jbladel(a)godaddy.com<mailto:jbladel@godaddy.com>> Sent: Monday, November 5, 2018 13:28 To: Mark Svancarek (CELA) <marksv(a)microsoft.com<mailto:marksv@microsoft.com>>; gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: Contracted Parties and Small Teams #1 and #2 Mark – Shortly following the launch of the 2013 RAA’s requirements for WHOIS Verification, registrars noted that approx. 800,000 domains had been suspended in the first few months. The number continued to climb for a few years, and most were categorized as “false positives” Here’s some coverage of that data at the time. https://domainnamewire.com/2014/06/24/over-800000-domain-names-suspended-du… [na01.safelinks.protection.outlook.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__na01.safelinks.protect…> Any program that depends on Registrant self-categorization, self-declaration, or receipt & acting upon a notice has a huge error factor. For GoDaddy in 2014, the RAA verification rate was in the high 70% or low 80%, meaning that service to tens of thousands of customers was delayed or disrupted. It’s this experience that causes Contracted Parties (but particularly Registrars) to be skeptical of any requirement to just “send an email” or “have the Registrant check a box.” It doesn’t scale. J. ------------- James Bladel GoDaddy From: "Mark Svancarek (CELA)" <marksv(a)microsoft.com<mailto:marksv@microsoft.com>> Date: Monday, November 5, 2018 at 15:14 To: "James M. Bladel" <jbladel(a)godaddy.com<mailto:jbladel@godaddy.com>>, "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: RE: Contracted Parties and Small Teams #1 and #2 James, can you clarify this: “many of whom could lose access to their registrations.” From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Monday, November 5, 2018 10:57 To: gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 ePDP Colleagues and WG Leadership - This morning, Registry and Registrar representatives met to discuss the status of potential recommendations from Small Group #1 (Legal vs. Natural) and Small Group #2 (Geographic Regions) in our Draft Initial Report. We concluded that there are some legal bases supporting these distinctions under GDPR and other data protection laws, and note that our Initial Report supports this. However, we reiterate our numerous high-level concerns against making any Consensus Policy recommendations for contractual requirements in these areas. Our concerns involve: * Legal - Aside from GDPR, other data protection laws are less clear on the distinction between legal and natural persons. Future regulations may contain contrary requirements. Furthermore, data of legal entities may contain or consist of personal information of natural persons, which would be entitled to protection under the GDPR and similar data protection regimes. Likewise, the geographic distinctions also create uncertainties. * Technical - Contracted Parties are uniquely situated to assess the current level of the technological means available to us, and it is our stated position that a technical basis to reliably and confidently make such a distinction does not exist. Especially because any distinction schema would be dependent upon Registrant Self-Identification, which is fraught with error. * Commercial - Developing and deploying this technology will involve significant costs, which may be prohibitive for smaller organizations and a barrier to market entry. Regardless of whether the distinction(s) are applied to new registrations or legacy domain names, it would be a logistical nightmare for Contracted Parties, and a source of confusion for Registrants, many of whom could lose access to their registrations. * Asymmetrical Risks vs. Benefits - Contracted Parties would assume all regulatory risks of such an obligations, exclusively for the benefit of unburdened third parties. * Scope - The distinction between Legal and Natural persons, or geographic regions, does not currently exist in the Domain Name System. Therefore, any recommendation mandating this change is outside the scope of the ePDP, and possibly the “picket fence” of Registrar and Registry contracts. As a result, and for the avoidance of doubt, Contracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations. Thank you, J. ------------- James Bladel GoDaddy _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team

7 14

For your review: draft data retention text
by Caitlin Tubergen Nov. 9, 2018

Nov. 9, 2018

Dear EPDP Team: In advance of our meeting on Tuesday, 13 November, we are sharing the draft data redaction text for the Initial Report. The draft language is currently included in the draft Initial Report. This language aims to reflect the deliberations and different positions, but has not been confirmed yet by the EPDP Team. The redlines in the document denote proposed copy edits and clarifications from the EPDP Leadership Team and support staff. In reading through the draft attached text, please keep the following questions in mind: Are there any concerns or issues in relation to the proposed language for inclusion in the Initial Report? If so, please indicate concerns or issues with proposed modification, taking into account the deliberations to date (e.g. if your position is not in line with what is reflected here, please provide language that can be added to reflect your position instead of proposing changes that are unlikely to be supported by the rest of the group based on previous discussions). In relation to registrant contact mechanism, should Temporary Specification requirements remain in place (“Registrar must provide an email address or a web form to facilitate email communication with the relevant contact”)? If not, please provide your rationale and indicate what improvements / changes could be considered. Is the proposed modification by the NCSG acceptable for inclusion in the Final Report? Please come to our next meeting on Tuesday, 13 November prepared to discuss. Thank you. Best regards, Marika, Berry, and Caitlin

1 0

Recordings, Attendance & AC chat / GNSO Temp Spec gTLD RD EPDP / Thursday, 08 November 2018
by Andrea Glandon Nov. 9, 2018

Nov. 9, 2018

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Thursday, 08 November 2018 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/qg68BQ MP3: https://audio.icann.org/gnso/gnso-epdp-temp-spec-gtld-registration-data-08n… AC Recording: https://participate.icann.org/p1il7tmebma/<https://participate.icann.org/p1il7tmebma/?OWASP_CSRFTOKEN=663c37463e43b07a…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

Reminder - input on draft Initial Report due today, Friday 9 November
by Marika Konings Nov. 9, 2018

Nov. 9, 2018

Dear All, As a reminder, please make sure to get to get any remaining comments / proposed edits on the draft Initial Report in by the end of today by adding them to the google doc: https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyG… so the leadership can plan the agenda’s for next week’s meetings accordingly. It will likely be necessary to extend the current meetings and/or add an additional meeting on Wednesday so please make note of that in your agenda. Thanks, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Friday, November 2, 2018 at 9:45 AM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: Re: [Gnso-epdp-team] Proposed approach for reviewing and finalizing the Initial Report - please take note of first deadline for Monday 5 November Dear All, Please note that there was a mix up in the dates / days in the table below, this has now been updated so please use this version as your reference. Also, as requested, please find attached a Word version of the Initial Report. Please do not redline, but use the following form to provide your input https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyG…. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Thursday, November 1, 2018 at 4:23 PM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Proposed approach for reviewing and finalizing the Initial Report - please take note of first deadline for Monday 5 November Dear All, Per our discussion today, please find hereby the proposed approach for reviewing and finalizing the Initial Report. Attached you will find the version of the Initial Report that was presented during the meeting earlier today. Line numbers have been included to facilitate referencing / identifying sections. Please take specific note of the first deadline for Monday 5 November to flag responses to charter questions and/or preliminary recommendations that need to be considered (apart from those that have already been identified). When What By whom Why Monday 5 November Team to flag responses to charter questions and/or preliminary recommendations that need to be considered and why, identifying concerns/issues to be further discussed (as a reminder, all items highlighted in blue will be further considered / reviewed and so need not be raised). This is intended to capture sections requiring additional discussion - specific edits not needed at this point, just a general description of the discussion or re-litigation that is recommended. EPDP Team members To allow leadership team & staff plan meeting schedule and topics to be addressed in upcoming meetings. Tuesday 6 November Put forward list of outstanding issues & call schedule to address outstanding issues Leadership Team / Support Team Plan remaining meetings as well potential additional ones to address issues identified Wednesday 7 November (at the latest) Submit specific substantive comments / edits on the mailing list by: · Identifying the line number and issue of concern · Put forward proposed changes (factoring in the view points of others and discussions held until date – no reopening of previously agreed upon items) · Outline the rationale for proposed change(s) Submit these by using this google doc: https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyG… EPDP Team Groups (SG/C/ACs – not individual comments) Capture and create inventory of specific comments to be reviewed and addressed by the EPDP Team. Thursday 8 November Share list of comments that need further review / discussion. Schedule additional calls as needed to review and discuss substantive comments submitted. Leadership team / Support Team Develop systematic way for reviewing input provided with the objective of finalizing the Initial Report for publication Friday 16 November Publish proposed final version of Initial Report for EPDP Team review. Minor updates (grammatical issues or other) can be flagged off-list to staff for fixing prior to publication. Support Team Allow for ‘final’ review to identify minor issues that should be fixed prior to publication. Monday 19 November Publish Initial Report for public comment Support Team We appreciate that meeting these deadlines will require substantial work from all involved – we hope we can count on your support. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Outstanding administrative initial report items - for mailing list discussion
by Caitlin Tubergen Nov. 9, 2018

Nov. 9, 2018

Dear EPDP Team, As noted in support staff’s email of Tuesday, 6 November and the subsequent discussion during Tuesday’s EPDP Team meeting, support staff organized the outstanding issues in the draft Initial Report based on proposed method of review. The EPDP Leadership Team deemed the final group of items as less controversial, and therefore, recommended a confirmation/discussion over the email list so that the more difficult items could be dealt with during our limited EPDP meeting time. Below, please find a short description of the mailing list review items. In short, if you have feedback on any of the below issues, please consider responding to the list, or, alternatively, noting any concerns in the Initial Report Input Google Doc. (For ease of mark up, the corresponding page in the draft Initial Report and the relevant charter question (if any) are noted below.) Please note that bracketed text indicates draft text proposed by support staff. Please provide any feedback by COB Tuesday, 13 November. Topic: Consensus Policy Updates Initial Report Page: 36 Draft preliminary recommendation: [The EPDP Team recommends that as part of the implementation of these policy recommendations, updates are made to the following existing policies / procedures, and any others that may have been omitted, to ensure consistency with these policy recommendations as a number of these refer to administrative and/or technical contact which will no longer be required data elements: • Registry Registration Data Directory Services Consistent Labeling and Display Policy • Thick WHOIS Transition Policy for .COM, .NET, .JOBS • Rules for Uniform Domain Name Dispute Resolution Policy • WHOIS Data Reminder Policy • Transfer Policy • Uniform Rapid Suspension System (URS) Rules] Question to EPDP Team: Does the draft recommendation accurately reflect the EPDP Team’s discussion at ICANN63 that in order to ensure consistency across ICANN policies, ICANN’s Consensus Policies may have to be updated following adoption of the EPDP Team’s policy recommendations? Topic: Policy Implementation Initial Report Page: 36 Draft recommendation/text: [Although the objective is to keep the timeframe for implementation to a minimum, additional time will be necessary to implement these policy recommendations. As such, the EPDP Team is considering how to avoid a gap between the adoption of these policy recommendations by the ICANN Board and the subsequent implementation, noting the impending expiration of the Temporary Specification requirements. The EPDP Team is considering various options, such as the adoption of an interim policy in the form of the Temporary Specification for a set timeframe or recommending that the Temporary Specification requirements remain in place until the completion of implementation of these policy recommendations. The EPDP Team expects to obtain further guidance from ICANN Org on the options in this regard and make a recommendation accordingly in the Final Report.] Question to EPDP Team: The draft recommendation aims to provide an approach for the potential gap between the adoption of these policy recommendations by the ICANN Board and the subsequent implementation, noting the impending expiration of the Temporary Specification requirements. The recommendation is based on previous discussions, e.g., the discussion from the CPH – ICANN Board meeting at ICANN63. Are there any concerns with the proposed text on p. 36? Topic: Policy Change Impact Analysis Initial Report Page: 37 Draft recommendation/text: [If the WG concludes with any recommendations, the EPDP must include a policy impact analysis and a set of metrics to measure the effectiveness of the policy change, including source(s) of baseline data for that purpose (from the EPDP Team Charter: Determine the policy goals for this exercise, within the parameters set by the Temporary Interim Specification. Identify potential policy goals that were omitted in the Temporary Specification and set aside for further Council deliberation. Determine a set of questions which, when answered, provide the insight necessary to achieve the policy goals. Determine the types of data that may assist the WG in better scoping the issues and identify whether it can be collected within the timeframe, and assemble or substitute information that can be analyzed to help answer each question. Determine a set of metrics which can be applied to the data, analysis, and achievement of policy objectives. Collect this data to the extent feasible, and determine a process for ongoing metric analysis and program evaluation to measure success of this policy process.] [Per the EPDP Team’s Charter, the goal of this effort is to determine if the Temporary Specification for gTLD Registration Data should become an ICANN Consensus Policy, as is or with modifications, while complying with the GDPR and other relevant privacy and data protection law. As part of this determination, the EPDP Team is, at a minimum, expected to consider the elements of the Temporary Specification as outlined in the charter and answer the charter questions. The EPDP Team shall consider what subsidiary recommendations it might make for future work by the GNSO which might be necessary to ensure relevant Consensus Policies, including those related to registration data, are reassessed to become consistent with applicable law”. The EPDP Team will further consider a set of metrics to help inform the evaluation to measure success of these policy recommendations, but would welcome input during the public comment period on the set of metrics that should be considered.] Question to EPDP Team: The draft recommendation notes that further consideration to an impact analysis and corresponding proposed metrics will need to be assessed in the next phase of the EPDP Team’s work. Is this proposed text on p. 37 acceptable for inclusion in the Initial Report? Topic: Length of Public Comment Period Initial Report Page: 4 Draft Text: This Initial Report will be posted for public comment for [30 days]. Question to EPDP Team: Is the EPDP Team OK with a 30-day public comment period? Note: the minimum public comment period for an EPDP Initial Report is 30 days, and this minimum period is suggested due to the short timeline the EPDP Team for completing its work. Topic: Sunsetting WHOIS requirements Initial Report Page: 35-36 Charter question(s): q) Sunsetting WHOIS Contractual Requirements q1) After migration to RDAP, when can requirements in the Contracts to use WHOIS protocol be eliminated? q2) If EPDP Team’s decision includes a replacement directory access protocol, such as RDAP, when can requirements in the Contracts to use WHOIS protocol be eliminated? Proposed Text: [At the time of publication of this Initial Report, the EPDP Team elected to prioritize its policy recommendations with respect to the Temporary Specification. The EPDP Team believes addressing eventual migration to RDAP and sunsetting of WHOIS requirements is premature at this time, i.e., before the policy recommendations are finalized. Following receipt of further feedback from the ICANN Community and Data Protection Authorities (if received), the EPDP Team will finalize its recommendations with respect to the Temporary Specification. In the process of this finalization, the EPDP Team will consider drafting implementation guidance regarding the eventual migration to RDAP and consequent sunsetting of WHOIS requirements. While the exact date of the possible elimination of WHOIS requirements will be determined in the policy implementation phase, the EPDP Team notes any current WHOIS requirements negated or made redundant by eventual policy recommendations will no longer be required.] Question to EPDP Team: Is the EPDP Team OK with this proposed text as a response to Charter Questions q1 and q2? Thank you. Best regards, Marika, Berry and Caitlin

1 0

Notes and action items from today's EPDP Team meeting - 8 November 2018
by Caitlin Tubergen Nov. 8, 2018

Nov. 8, 2018

Dear All, Please find below the notes and action items from today’s EPDP Team meeting. Best regards, Marika, Berry and Caitlin EPDP Team Meeting #24 8 November 2018 High-level Notes/Action Items 1. Any EPDP Team members wishing to work with Thomas and the small group on the responsible parties/joint controllership discussion, should reach out to Thomas and complete the small group doodle poll as soon as possible. 2. Support Staff will the rework language for natural vs. legal persons to the mailing list so that EPDP Team members can include and/or correct their own viewpoints. Please propose edits by tomorrow, Friday, 9 November. 3. Berry Cobb described inconsistencies in the data matrices and proposed changes to resolve the consistencies. After receiving feedback in today’s meeting, Berry will summarize the revised changes made to the data elements matrix as a result of this discussion and send the summary of proposed changes to the mailing list shortly. Question to ICANN Org: Is making the natural vs. legal persons distinction in WHOIS within the picket fence, i.e., a suitable topic for policy discussion? Notes These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates Attendance will be taken from Adobe Connect Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair a. Review of outstanding action items Thank you for timely completing all action items from Tuesday’s meeting. Support staff will send open administrative issues within the Initial Report today. Please provide feedback via the Initial Report Input Google Doc by Tuesday, 13 November. b. Other updates, if applicable The Team will announce the F2F location as details become available. Please refer to the Initial Report Input Google Doc to submit any comments or concerns with respect to the draft Initial Report. Support Staff will send an email with outstanding items following this meeting. Please review and note questions or concerns (if any). 3. Review of Responsible Parties Recommendations (Thomas) a. Review and discuss draft recommendations During the last call, Thomas noted there may need to be revisions to the references to responsible parties for the Initial Report. The suggested changes begin on line 900 of the draft Initial Report. The draft recommendation is for ICANN to enter into Joint Controller Agreements (JCA) with the contracted parties. The attachment to Thomas’s email provides more detail about the definitions and the relevant liabilities. Based on this attachment, the table appearing on line 988 would need be be updated to reflect the text in the attachment. The EPDP Team will need to confirm the draft text, the current allocation of responsible parties, and confirm if the EPDP Team would like to liaise with ICANN as to whether ICANN org has concerns about entering into JCAs with contracted parties. Question for EPDP Team: should the EPDP Team assist in the drafting of an JCA or drafting the framework of the JCA? Does the team believe a policy recommendation regarding ICANN and Contracted Parties being joint controllers should be added to the report? EPDP Team Feedback The primary purpose of a JCA is the apportioning of liability. The Team needs to recognize it is apportioning liability, and the utmost care needs to be taken with respect to this. It may be inappropriate for the EPDP Team to draft a specific legal agreement; however, recommending a negotiation b/w ICANN and contracted parties could be an appropriate recommendation. There are parts of this agreement that may be outside the picket fence; however, multi-party negotiations often take a long time, and the extent the Team could provide language or a sample agreement as a starting point could be helpful in this instance. The Team could specify the objectives or guiding principles of the JCA. The Team should not negotiate contract language at this time; the Team's current focus should be on answering the charter questions. The JCA negotiation is best left to attorneys. However, the previous suggestion regarding adding principles or the objective of the JCA into the Initial Report makes sense. With respect to the workbooks, how should the team proceed? The group needs to take one of two approaches: the (1) Thomas approach (adding proposed language to body of Initial report) or (2) ensuring consistency in the workbooks with respect to responsible parties. Joint controller agreements are similar to data processing agreements - if the Team provides a draft it would lay out the processing activities and responsible parties and it could help ICANN apply the Team's policy work. Defining roles and responsibilities is within the Team's charter, and the answers to the relevant charter questions could help inform the eventual JCA. Question to the Team: does the Team support Thomas, Diane and ICANN org fleshing out the memo to draft a policy recommendation? The Team has resistance to drafting a JCA, so perhaps the drafting should be put aside. The question that needs to be answered first and foremost, how far does the question on responsibilities go? Does it end with who should be responsible for what? It may be helpful for the community to have more context within the Initial Report. The Team needs to look at the responsibilities in the workbooks. Regardless to what extent the team may draft a JCA, this would not be a policy recommendation - it will just be an aid to those implementing the policy recommendations. Encourage the team to reread the relevant charter questions and make sure the questions are answered in the Initial Report. b. Confirm next steps, if any Those who would like to assist with the JCA recommendation should send an email to Thomas Rickert and respond to the doodle poll referenced above. 4. Review proposed updates to staff-suggested Natural vs. Legal persons text a. Review and discuss draft approach Support Staff has been rapidly updating this language as suggestions come in. For the next iteration, the language will include direct quotes from both sides. The request for research was agreed to by the small team. This did not suggest contract updates, so the Team may be overthinking this. Rather than declaring where the consensus is, it is clear that some positions will not obtain consensus. In other words, presenting an option that many are not considering should not be included in the Initial Report. Minority opinions should be represented in the discussion, but it should be made clear that some positions may not obtain consensus. The Team should be very clear in the Final Report on what are consensus recommendations and what are not. In order to get the best responses in the public comment period, the views need to be clear. There does not have to be a formal consensus call before the Initial Report is published. Team Members can continue to write their views to the list for inclusion in the Initial Report language. It is inappropriate to make statements regarding consensus at this time. Also, this is within the picket fence as it relates to WHOIS. Question to ICANN: is making natural vs. legal persons distinction in WHOIS within the picket fence? Sweeping statements about issues never reaching consensus is inappropriate. Perhaps we can come to consensus on research the natural vs. legal. More research especially on who bears liability when data subjects identify themselves as legal persons seems logical - especially in posing this question to the EPDB. This policy recommendation could send the group backwards. The CPH is saying this is not currently possible, why do some EPDP members continue to say this distinction is necessary? b. Confirm next steps, if any EPDP Team Members to provide additional feedback on this by tomorrow (Friday, 9 Nov) 5. Review of Consolidated Data Elements Matrix Please refer to the attachments from Berry's email of 7 November. The consolidated matrix combines the similar processing activities, e.g., collection, transfer, disclosure, into one document. The first page shows the processing activities where registrars are asked to collect data. The second page shows the processing activities where registrars are asked to transfer data to registries. This matrix shows what is currently denoted in the workbooks. On the far right, there is a column listed as transmission logic - this analyzes all of the columns to the left. If the item is optional, it is denoted in yellow. If an item is required, it is denoted in green. Data elements that are not required or optional are denoted in red. In reviewing registry escrow, the Team agreed that registries would only escrow the data elements that are transferred to them - in other words, the green and yellow elements in this matrix. Within the current workbook for purpose M, there are many data elements that are requested to go from the registrar to the registry. In the macro sense - this brings up three questions: 1. Post GDPR, is the compliance team's assessment correct that registrars do not need to transfer data to registries for this purpose? 2. At any point when a provider needs to have the registration data revealed, in all cases, the Provider contacts the registrar to acquire that data, so does that mean transfer of certain data elements from registrar to registry is not warranted under Purpose M? 3. In looking at the PDDRP and RRDRP, if one of these RPMs is invoked, does data need to be transferred from the registrar to the registry? Feedback from EPDP Team: For the URS, there is a justified transfer for purposes of the URS. In pre-GDPR complaints, wouldn't the Provider have to go to the registrar for underlying data in a privacy/proxy case? This issue may need to be flagged for the RPMs working group. The matrix may not translate for Initial Report purposes, so a more concise summary could be helpful here. This is done on p. 3. The main intent of these charts to to cross-check and test the logic of the content of the workbooks. In a post-GDPR world, there are cases where the providers are requesting registration data from registries and not registrars, so a draft recommendation for the RPM WG or another PDP to streamline that process. The proposed approach we have listed here is not accurate, so the processing activity of transferring data from a registrar to a registry is correct. It may be reasonable to update the UDRP, and we could include a recommendation that the UDRP be updated to reflect the current realities. For Issue 2, under Purpose A the only two data elements that are transferred are domain name and name servers under 6(1)(b). For the transfer of other data elements, they could be transferred under 6(1)(f). DNSSEC and glue records should be a 6(1)(b). Elements not provided by the registrant are also included in the list elements and should fall into a separate category. For Issue 4, for items flagged as red, we want to confirm some of these may still be necessary – such as registry/registrant ID. There is a notion that the data elements we’re looking at – some are collected by the data subject, while some are generated via the EPP server at the registrar or registry. We are acknowledging that this is the case and some fields marked in red cannot die on the vine as they are used for other policies or inner workings of the DNS. For Issue 3, there are some small inconsistencies for optional data elements. For collection of data by the registrar, for purposes B and C, the Team has identified three optional fields for the tech contact. The tech email is not currently marked as optional, so support staff is suggesting to mark it as optional to ensure consistency across the workbooks. 6. Wrap and confirm next meeting to be scheduled for Tuesday 13 November at 14.00 UTC. a. Confirm action items b. Confirm questions for ICANN Org, if any

1 0

Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 13 November 2018 at 14:00 UTC
by Andrea Glandon Nov. 8, 2018

Nov. 8, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays at 14:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/VgPVBQ Thank you. Kind Regards, Andrea

1 0

Re: [Gnso-epdp-team] Purpose M - UDRP Information
by Marika Konings Nov. 8, 2018

Nov. 8, 2018

Thanks, Margie. Per the action item, could you provide further details as to how this disclosure to the complainant is different from the disclosure that is already foreseen under Purpose B (“Maintaining the security, stability and resiliency of the Domain Name System in accordance with ICANN’s mission through the enabling of lawful access for legitimate third-party interests to data elements collected for other purposes identified herein”)? Also, if this disclosure is deemed consistent with Purpose M, in your view, does this mean the UDRP would need to be modified accordingly as it currently does not foresee a step in which the complainant reaches out to the registrar for this information before filing a UDRP? If so, this would need to be noted accordingly in the Initial Report. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Margie Milam <margiemilam(a)fb.com> Date: Friday, November 2, 2018 at 8:00 PM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Purpose M - UDRP Information Hi- Following up on the action items for this item, please find attached our suggested changes to Purpose M, which include input from the IPC and the BC. We have asked for these additions because it is important to ensure that the complainant is able to fully assess the strength of the claim and the nature of the bad faith of the registrant in order to prove the elements of the dispute resolution process (URS/UDRP). To avoid the filing of ungrounded UDRP complaints, this purpose is fulfilled by making the disclosure before the complaint is filed. Also with regard to the other dispute resolution processes, we note that PDDRPs can be brought based on systemic registrant behavior, and thus there may be instances where this purpose would be relied on to access registrant contact data. Under the PDDRP, the subject matter of the dispute is the gTLD and its use by the operator - including any second-level domain names registered to the registry operator or a related third-party, to the extent the registry operator is complicit in trademark infringement. Similarly RRDRPs are available to complainants to prove a registry is not complying with its registration restrictions, which may require access to registration data, as it relates to the registration restriction. For example, if there is a TLD that is limited to registrants located in a particular geographic region, those elements would need to be accessed for this purpose. There are also registries that have specific RPMs that would fall under this purpose. For example some registries have voluntarily adopted RPMs in their contracts, which would also appear to fall in this Purpose M category (for example, .XXX added a “Rapid Evaluation Service Policy” procedure in their registry agreement to address abusive registrations). Finally, to address Kristina’s concern about potential abuse, there are ways to address this so that it is not grounds for a phishing expedition, such as: * Requiring the trademark holder to represent that they have a good faith intent to file a UDRP or other dispute resolution mechanism or cybersquatting action * Dispute resolution providers should be able to audit requests to ensure that the requester filed a UDRP/URS or legal complaint, or in good faith determined that no grounds existed. Have a great weekend everybody! Margie

7 6

FW: [Ext] RE: Notes and action items from today's EPDP Team meeting
by Marika Konings Nov. 8, 2018

Nov. 8, 2018

Forwarding as this seems to have not have made it to the list. From: "Rosette, Kristina" <rosettek(a)amazon.com> Date: Tuesday, November 6, 2018 at 11:43 PM To: Marika Konings <marika.konings(a)icann.org>, "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Ext] RE: [Gnso-epdp-team] Notes and action items from today's EPDP Team meeting Greetings from Seattle! With apologies for the delay, here’s a link to the Google Doc for the proposed revised Purpose N. https://docs.google.com/document/d/1X4Xx2h_sL8BSQqtxm3ed1sRc7JTtcrDvhQ7Zw7G… [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> I shared it with Milton and Amr, but forgot to send to the list (and didn’t remember until I started listening to the Adobe connect recording of today’s call). Apologies! Please let me know if anyone has any questions or is unclear on the specific proposed changes. K From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Marika Konings Sent: Tuesday, November 06, 2018 8:46 AM To: gnso-epdp-team(a)icann.org Subject: [Gnso-epdp-team] Notes and action items from today's EPDP Team meeting Dear All, Please find below the notes and action items from today’s EPDP Team meeting. Best regards, Caitlin, Berry and Marika EPDP Team Meeting #23 Tuesday, 6 November 2018 Notes and Action Items High-level Notes/Actions: Action item #1: EPDP Team to save the date for the next F2F meeting on January 16-18 2019 (Wednesday-Friday). Support team to send out save the date calendar invite for the F2F meeting Action item #2: EPDP Team to review proposed language in relation to natural vs. legal person for inclusion in the Initial Report and come prepared to discuss this on Thursday's meeting. Action item #3: Support team to draft proposed language for inclusion in the Initial Report reflecting today's discussion regarding provision for Technical contact. Action item #4: Support team to mark language in relation to data retention as agreed in the Initial Report and harmonize data retention periods across data elements workbooks. Action item #5: Thomas to translate slides into policy recommendations and edits to the tables for proposed inclusion in the Initial Report for EPDP Team consideration prior to Thursday’s meeting. Questions for ICANN Org from the EPDP Team: Is indemnification provided by ICANN through a joint controller agreement an option? If EPDP agrees on policy that requires ICANN to indemnify, would the ICANN legal team and Board oppose it? Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates (5 minutes) * Attendance will be taken from Adobe Connect * Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) a. Proposed approach for reviewing and finalizing the Initial Report * See https://community.icann.org/x/5QDVBQ * Important that people provide input as soon as possible - the timeline is determined by the end goal of having new policy recommendations in place by 25 May 2019. Any additional time needed will affect the time available for other phases of the work. b. Update on F2F planning Action item #1: EPDP Team to save the date for the next F2F meeting on January 16-18 2019 (Wednesday-Friday). Support team to send out save the date calendar invite for the F2F meeting c. Proposed next steps in relation to small team #1 and #2 language for inclusion in the Initial Report See email sent by Kurt which was followed by proposed language for inclusion in the Initial Report. Action item #2: EPDP Team to review proposed language in relation to natural vs. legal person for inclusion in the Initial Report and come prepared to discuss this on Thursday's meeting. d. Review of outstanding action items * See https://community.icann.org/x/NwSNBQ e. Other updates, if applicable * Responsible parties for processing - need further info on what should be updated / discussed. To be added to agenda for Thursday's meeting. See also new agenda item 5. 3. Review of outstanding items for Initial Report and proposed approach Objective of discussion: 1. Confirm list of outstanding items to be considered in relation to Initial Report and approach for addressing these a. Review outstanding issues punch list (to be circulated) b. Confirm approach for addressing these c. Confirm next steps, if any * See email sent by Caitlin re. outstanding issues. * Idea is to introduce certain topics via email followed by EPDP Team call, certain topics can hopefully be addressed via email, some items where volunteers are needed. * Objective of the document and table is to track items that have been flagged as requiring further discussion and proposed approach. 4. Commence addressing outstanding items a. Technical contact redaction – any concerns in relation to proposed language for inclusion in the Initial Report? * Possible language to address this issue: In accordance with the EDPB’s guidance that GDPR does not apply to legal persons and personal data identifying individual employees (or third parties) acting on behalf of the registrant should not be made publicly available by default in the context of WHOIS: If the Registered Name Holder elects to provide contact information for a technical contact that differs from the Registered Name Holder, the Registrar is required to obtain consent from the technical contact prior to publication. One suggested method of obtaining this consent is to include this consent in the WHOIS Accuracy Program Specification Section 1.f.i. verification email. * Concerns expressed about relying on consent, especially if it is not provided by the data subject directly. If a RNH provides Tech contact data without consent, isn't the RNH responsible, not the registrar? * Adding on to an existing system could be problematic - something that needs further consideration, but not within the context of the current deliberations. * Previous agreement reached to continue to collect limited set of data elements (optional for RNH to provide) for technical contact, namely name, email and telephone. Concept of optional captured in data elements workbook C based on previous preliminary agreement: Optional data elements for the Registered Name Holder (RNH) to provide, but required for the registrar to offer as data elements the RNH may provide. * How do contracted parties currently handle tech contact info collection? Some registrars have stopped collecting that data - see also EPAG court case. Some are still collecting but have noted this is a potential vulnerability. * Should it also be optional for registrars to provide noting some of the issues? In that case a registrant can choose a registrar that provides this option if this is important for the registrant to provide. * Consent is used by others such as .CAT and ccTLDs so it is not necessarily a path that cannot be pursued. * Note that EDPB advice states: "registrants should be provided with the option of providing contact details for persons other than themselves if they wish to delegate these functions and facilitate direct communication with the persons concerned". In this context it is also noted that "it should be ensured that the individual concerned is informed". Consider asking a clarifying question to the EDPB concerning how this information process should take place and what, if any, additional obligations are there for the registrar, or whether this is purely a registrant responsibility. * The registrant is responsible for breaching the other individual's privacy, if such is the case. However, the registrar is responsible for ensuring that consent was obtained. * Individual registrars may voluntarily take on this risk and offer this option, if this is no longer a requirement. * EDPB advice should alleviate some of the legal concerns - may require further clarification from EDPB. * Document in the Initial Report the possible technical and legal challenges involved and outline the two different positions in relation to whether this should be required or optional for registrars to provide. Indicate that clarifying questions will be asked from the EDPB to further help inform deliberations in relation to this topic. Note that registrars may have legal liability for a RNH providing data about a third party, which is why they want the option. Action item #3: Support team to draft proposed language for inclusion in the Initial Report reflecting today's discussion. b. Data retention – any concerns in relation to proposed language for inclusion in the Initial Report? * Good reasoning to set out data retention period based on all the work that went into the data elements workbooks to discuss retention. * No opposition to include this in the Initial Report. * Consider harmonizing the data retention period across all the data elements workbooks. Action item #4: Support team to mark language in relation to data retention as agreed in the Initial Report and harmonize data retention periods across data elements workbooks. c. Confirm next steps, if any 5. Responsibilities - data processing See slides presented by Thomas Rickert Starting point: * We wanted to make a distinction between ICANN Purposes and other purposes * Reason was to identify which the areas that ICANN should govern and enforce are * We kept the language and called everything „ICANN purposes“ – that causes confusion * We have removed the things that ICANN should not govern – good. * We should make adjustments, though Status Quo / legal background: * Controller, Joint Controller and Processors are mentioned * Let‘s look at the Art. 29 (WP 169) distinctions * Let‘s discuss the micro vs the macro level * Liability issues – two layers * Data subjects claims – joint and several responsibility (indemnifications to balance) * Authorities‘ sanctions (Authorities will go after the wrongdoer) * Let‘s not be afraid of a joint controller scenario Way forward * Let‘s make everything part of a joint controller agreement * Let‘s specify the roles and responsibilities in there * Let‘s make indemnifications match the roles * We can still have parties outsourcing work (EBERO and Escrow e.g.) * Suggestion to change the language referring to "ICANN purposes" but describe that these are purposes that are governed by ICANN through consensus policies. * Determine for whole document that parties are joint-controllers, and document in joint controller agreement for which areas which party is responsible (for example, for Ebero and escrow only one party would be responsible). * Need to clarify the role of the different parties - important aspect of the Initial Report. Need a fair reflection of who asks for what and who does what. Those parties should take responsibility. * Indemnification by ICANN - would ICANN be willing to do this? Would change risk Question for ICANN Org: Is indemnification provided by ICANN through a joint controller agreement an option? (proposed rewording: if EPDP agrees on policy that requires ICANN to indemnify, would the ICANN legal team and Board oppose it?) Action item #5: Thomas to translate slides into language for proposed inclusion in the Initial Report for EPDP Team consideration prior to Thursday’s meeting. 5. Wrap and confirm next meeting to be scheduled for Thursday 8 November at 14.00 UTC. a) Confirm action items b) Confirm questions for ICANN Org, if an Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Updated language for inclusion in the Initial Report re. Technical Contact
by Marika Konings Nov. 7, 2018

Nov. 7, 2018

Dear All, In relation to Action item #3: Support team to draft proposed language for inclusion in the Initial Report reflecting EPDP Team’s discussion regarding provision for Technical contact, please find attached the proposed update to the relevant section in the Initial Report. We hope this accurately reflects the discussion and the different positions expressed for inclusion in the Initial Report. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Input on responsibilities
by Thomas Rickert Nov. 7, 2018

Nov. 7, 2018

All, Please find attached language - that will surely require further tweaking - describing the points I outlined in our call on Tuesday. Please note that I used text we wrote for the eco GDPR Domain Industry Playbook as a basis to save me some drafting work. I am not trying to sell the playbook, though, so we can completely rewrite things. I know that Diane, Dan, Trang and others have offered to work on this, but due to other commitments, I have not been able to consult with them because staff asked me to share something on the list today in preparation of tomorrow’ call. I am sorry for this as I would have preferred to work with a small team on this before bothering the entire group with the input. All the best, Thomas Changes to be made to the initial report as of line 900 EPDP Team Preliminary Recommendation #17 The EPDP Team recommends that ICANN enters into a Joint Controller Agreement (JCA) with the contracted parties. In addition to the legally required components of such agreement, the JCA shall specify the responsibilities of the respective parties for the processing activities as described below. Indemnification clauses shall ensure that the risk for certain data processing is borne by either one or multiple parties that have the primary interest in the processing Rationale and background: The text in the attached document should follow. When the table starting line 988 comes: Instead of ICANN purposes, the following language should be used: Purposes for processing personal data that should be governed by ICANN Org via a Consensus Policy. Note there are additional purposes for processing personal data, which the contracted parties might pursue, such as billing customers, but these are outside of what ICANN and its community should develop policy on or contractually enforce. Then, as a starting point, in the „responsible party“ column, we should just mention the party or parties tagged as controllers or joint controllers, but delete the words joint controller, processors or controllers, so that we only have the responsible parties listed. This, we will need to review as a team.

1 0

NCSG reactions to (part of) the interim report
by Mueller, Milton L Nov. 7, 2018

Nov. 7, 2018

Marika NCSG cannot accept big portions of the proposed text regarding the legal/natural persons distinction. We note that the text disregards statements from the contracted parties and NCSG. We would respectfully ask you to revise the text in a way that respects and reflects clearly stated and strongly held positions of at least three stakeholder groups. To be specific, the CPH has stated, in regard to the legal/natural persons and geographic distinctions: “Contracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations.” NCSG shares this opposition to requiring distinctions between legal and natural persons and geographic distinctions. In our comment on small team 1 we stated: “The main risk is that the difficulty of distinguishing between the two at the point of registration could lead to the unintended publication of the private data of many natural persons.” This assessment of risk is not reflected in the report. We also proposed deleting the entire paragraph on research because researching how various entities make this distinction basically assumes that making this distinction is a live option for the ePDP. In terms of consensus requirements, all indications are that it is not a real option. It is abundantly clear that no requirement for a distinction between legal and natural persons will survive a consensus recommendation process. At least three stakeholder groups – ¾ of the GNSO and roughly half of the ePDP – are rejecting it as an option. We think the report should move the process forward by explicitly recognizing this fact. Instead, we have Kurt stating on list that there was “an agreement” to do research on the feasibility of differentiating between natural and legal persons. This statement can only come from completely disregarding the interventions NCSG members made in Barcelona, on the latest call, and in an email sent Tuesday to the list by Amr elSadr. To quote from Amr’s email regarding Kurt’s statement regarding research: “I don’t believe that [research on legal/natural] was, in any way, reflective of a consensus to proceed with this recommendation among the Small Team members. To me, it was only an acknowledgement that this view was expressed, discussed, and subsequently required consideration by the whole team.” Kurt has not responded to this email. We will raise these concerns on the call tomorrow. In general, I think the team is in danger of losing sight of its primary mission, which is to quickly bring Whois into compliance with GDPR and to turn the temp spec into a legitimate policy. It seems that some people are seizing on the debate over the temp spec to impose new requirements on contracted parties. I understand that the chair and staff are trying their best to move things along, but we are disturbed by an apparent tendency to ignore or disregard clear position statements from SGs. One of the most important jobs of the ePDP chair is to recognize where consensus exists and where it does not. Some proposals are just not real options: they will never survive a council vote or a consensus call in the ePDP. It is unthinkable that the chair or staff would substitute their own preferences for the rough consensus of the working group. Let’s recognize the parameters of what people can live with and move forward from there. Eliminating options is progress, too. Milton Mueller, on behalf of NCSG From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Marika Konings Sent: Monday, November 5, 2018 11:49 PM To: Kurt Pritz <kurt(a)kjpritz.com>; gnso-epdp-team(a)icann.org Subject: Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 Following on from Kurt’s message, please find hereby the proposed language for inclusion in the Initial Report. Attached is the document that would be linked so that those interested would be able to review the different perspectives and proposals put forward. h3) Should Contracted Parties be allowed or required to treat legal and natural persons differently, and what mechanism is needed to ensure reliable determination of status? h4) Is there a legal basis for Contracted Parties to treat legal and natural persons differently? h5) What are the risks associated with differentiation of registrant status as legal or natural persons across multiple jurisdictions? (See EDPB letter of 5 July 2018). The EPDP Team discussed these questions extensively (see [include link to attached document which includes the different proposals]) and although the EPDP Team agrees that Contracted Parties should be allowed to treat legal and natural persons differently, the EPDP Team did not agree on whether this should be required and/or what further steps could or should be undertaken to determine what mechanism is needed to ensure reliable determination of status. The EPDP Team further agrees under GDPR there is a legal basis to treat legal and natural persons differently, but does not agree on whether that means Contracted Parties should be required to do so, or whether the challenges and legal risks involved in doing so result in leaving this optional. Similarly, the EPDP Team discussed the implication of other data protection regimes which could have different requirements that impact both natural and/or legal persons that would need to be factored in. The EPDP Team identified a number of risks, including: * While legal persons don’t have the same protections under GDPR, natural persons employed by a legal person (and who may be designated as the registrant, admin or technical contact) are still natural persons enjoying rights and protections under GDPR. Some noted that this risk may be minimized through clear explanatory language beneath each field when filling in data fields within domain name registrations. * There may be situations in which it can be difficult to separate the data of natural persons from that of legal persons. This can be the case, for example, if the legal person is a sole proprietorship, if the name of a person appears in the company’s name, if the business address is a natural person’s residence, or if an email address is assigned to a single individual (“john.doe(a)company.example.com<mailto:john.doe@company.example.com>” as opposed to “info(a)company.example.com. The EPDP has discussed whether this risk may be somewhat mitigated through educational resources. Some in the EPDP Team expressed caution, as a stated necessity to rely on educational resources may not be considered to be compatible with the concepts of privacy by default or privacy by design i.e. where additional ‘educational resources’ are deemed necessary, the process itself is likely not established or presented in a sufficiently clear manner. To help further inform the EPDP Team’s deliberations on this topic as the team works towards a Final Report, the EPDP Team would like to request that GDD staff, who will design the implementation of these policy recommendations, commences research by investigating how ccTLDs and contracted parties currently distinguish between natural and legal persons to inform the EPDP Team. In addition, the EPDP Team would like to request input on the following questions in relation to this topic: · Are there examples from other industries or areas, e.g. ccTLDs, where a mechanism has been successfully developed and implemented to distinguish between natural and legal person, factoring in some of the challenges identified above? · Should the EPDP Team decide to recommend requiring distinguishing between natural and legal persons, how should implementation be carried out, especially considering legacy registrations? · Should the EPDP Team decide to recommend that further research is undertaken, beyond the information that GDD staff may encounter, what and how should this research be carried out? · (For the EDPB) If registrars allow registrants to self-identify at the time as a natural or legal person, who will be held liable if the registrant incorrectly self-identifies and personal information is publicly displayed? Apart from self-identification, are there any other ways in which risk of liability could be mitigated by registrars? The research requested and input on these charter questions will help the EPDP Team further analyze if it is possible and desirable to make this distinction in the context of domain name registrations, in a manner that is commercially reasonable, implementable and does not result in unreasonable liability for contracted parties. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Kurt Pritz <kurt(a)kjpritz.com<mailto:kurt@kjpritz.com>> Date: Monday, November 5, 2018 at 7:45 PM To: "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 Hi Everyone: After all of this thought and writing, I think we have two paths forward that are relatively straightforward to describe. Rather than recap the arguments made here, I will just go right into my recommendations for next step and why. The Support Team will follow this with a better summation of what has transpired and how that leads to the recommendations below. It is clear that camps within our the team are at loggerheads with regard to how geographic basis and natural v legal persons should be handled within the proposed policy recommendations. Current situation and recent developments: Coming out of the small group meeting #1 during a teleconference, there was an agreement in principle that it was necessary to perform research in order to inform the policy discussion regarding the feasibility of differentiating between legal and natural persons. That agreement survived its initial introduction into the whole team where the comments centered around: (1) the adjectives used to describe the sense of urgency concerning the work, and (2) sharpening the detail regarding steps to be taken after the research. (There was never an agreement about how to proceed regarding differentiation of data subjects based on geographical considerations.) Starting Friday, substantial markups to the legal v natural agreement on doing research initiated this current three-day email chain. Preferred Recommendation (there are two): Go back to the agreement in principle that was reached in the small team with representatives from all groups to undertake research to determine if, how and to what extent we can distinguish between legal and natural persons. Then extend that research on to the geographic basis issue. A small group of us can contribute to the terms of reference for this research after the initial report is issued. Here is my rationale for this recommendation: 1) The various arguments laid out in all these emails on this list make the case themselves for the need to do research. For example, if the ICO says that processors can rely on data subject-provided information, does that mean that personal information mistakenly disclosed can be published without liability? We don’t know. We are setting up this and other questions for DPAs. Isn’t that … research? There are other scenarios in the emails that will take research to sort through: whether ccTLD experiences are relevant, or whether a registrant boarding a train and leaving the EU for China while another registrant boarding a ferry for Marseilles will both be protected by GDPR. All this takes research to sort out. Nearly all of the emails on this list have to do with scenarios in support of one position or another - but all need to be studied in order for us to determine if and how distinctions can be made. 2) Many of the arguments laid out are conclusory or without authority. I don’t think the research can have a preordained outcome. To make one point for each line of thinking: a) In the case of natural vs legal data subjects, some seek to build in in an implementation plan without knowing if or to what degree a solution is implementable b) In the case of Geographical distinctions between registrants, some are stating that such a distinction is categorically unimplementable without authority or evidence provided. I think the “truth will out” on these questions and we should not try to push research or our arguments to a pre-ordained outcome. 3) This will provide time to take the effects of existing laws in other jurisdictions into account - if that is deemed desirable. 4) This will take this discussion out of the critical path of finishing our reports, without leaving a blank. 5) The results of the research still must be considered by this team (or its successor) and a consensus derived. Research informs policy; it does not create policy. 6) If we agree to this approach, we can start the research now. If we temporize, there will be little done that will resolve this issue set over the next few months. Taking action in an attempt to understand all the complexity is the responsible thing to do. 7) These are complicated questions and research-based policy-making is required to answer them. How do we meet the timeline and still act in a thorough, detailed manner? By launching research and, in the meantime, going back to the rest of our questions. Whatever our policy conclusions are, even if we are deadlocked in several months time, we should be informed by information garnered from DPAs and other sources. The only other recommendation: MemorialIze the differences between the two sides on each of the two issues, explaining the arguments for each and asking for public comment on these issues. Here is my rationale for and against this recommendation: 1) It will allow us to publish the initial report and, properly framed, can garner specific public comment. However, other factors really argue against maintaining the current status and not taking some action: 2) In the time allotted for public comment, no commenter will be able to perform any meaningful research either. There might be reference to a study that partially informs our work, but not a dispositive study. At the end of the comment period, we are likely to be in the same place. 3) It is hard to see how the public comment will differ from our discussion, in this list, to date. 4) Even if we take the preferred research path above, we can still conduct the comment period on the current position of the parties. 5) If we have no outcome on this issue, the result, to me, is unknown and represent a risk to all parties at the table. Conclusion I thought is was remarkable that we came together and agreed to undertake this research on this difficult topic. It was a significant, meaningful compromise that embodied our reason for being here. I don’t see anything in all the emails that indicate another compromise is possible unless that discussion is informed with significant, new information. I believe the appropriate path for this group is to recognize the differences cannot be resolved without something new and to take this path. Talk to you soon and best regards, Kurt On Nov 5, 2018, at 4:38 PM, Mark Svancarek (CELA) via Gnso-epdp-team <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> wrote: Sorry for being dense, I still have questions. 1. It is not surprising that the addition of a new process step would generate short term inefficiencies. It’s 5 years later – are the verification rates improved from 2014? 2. How would an optional “let me self-identify as a corporation” capability be likely to cause verification disruptions? /marksv From: James M. Bladel <jbladel(a)godaddy.com<mailto:jbladel@godaddy.com>> Sent: Monday, November 5, 2018 13:28 To: Mark Svancarek (CELA) <marksv(a)microsoft.com<mailto:marksv@microsoft.com>>; gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: Contracted Parties and Small Teams #1 and #2 Mark – Shortly following the launch of the 2013 RAA’s requirements for WHOIS Verification, registrars noted that approx. 800,000 domains had been suspended in the first few months. The number continued to climb for a few years, and most were categorized as “false positives” Here’s some coverage of that data at the time. https://domainnamewire.com/2014/06/24/over-800000-domain-names-suspended-du…<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdomainname…> Any program that depends on Registrant self-categorization, self-declaration, or receipt & acting upon a notice has a huge error factor. For GoDaddy in 2014, the RAA verification rate was in the high 70% or low 80%, meaning that service to tens of thousands of customers was delayed or disrupted. It’s this experience that causes Contracted Parties (but particularly Registrars) to be skeptical of any requirement to just “send an email” or “have the Registrant check a box.” It doesn’t scale. J. ------------- James Bladel GoDaddy From: "Mark Svancarek (CELA)" <marksv(a)microsoft.com<mailto:marksv@microsoft.com>> Date: Monday, November 5, 2018 at 15:14 To: "James M. Bladel" <jbladel(a)godaddy.com<mailto:jbladel@godaddy.com>>, "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: RE: Contracted Parties and Small Teams #1 and #2 James, can you clarify this: “many of whom could lose access to their registrations.” From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Monday, November 5, 2018 10:57 To: gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 ePDP Colleagues and WG Leadership - This morning, Registry and Registrar representatives met to discuss the status of potential recommendations from Small Group #1 (Legal vs. Natural) and Small Group #2 (Geographic Regions) in our Draft Initial Report. We concluded that there are some legal bases supporting these distinctions under GDPR and other data protection laws, and note that our Initial Report supports this. However, we reiterate our numerous high-level concerns against making any Consensus Policy recommendations for contractual requirements in these areas. Our concerns involve: * Legal - Aside from GDPR, other data protection laws are less clear on the distinction between legal and natural persons. Future regulations may contain contrary requirements. Furthermore, data of legal entities may contain or consist of personal information of natural persons, which would be entitled to protection under the GDPR and similar data protection regimes. Likewise, the geographic distinctions also create uncertainties. * Technical - Contracted Parties are uniquely situated to assess the current level of the technological means available to us, and it is our stated position that a technical basis to reliably and confidently make such a distinction does not exist. Especially because any distinction schema would be dependent upon Registrant Self-Identification, which is fraught with error. * Commercial - Developing and deploying this technology will involve significant costs, which may be prohibitive for smaller organizations and a barrier to market entry. Regardless of whether the distinction(s) are applied to new registrations or legacy domain names, it would be a logistical nightmare for Contracted Parties, and a source of confusion for Registrants, many of whom could lose access to their registrations. * Asymmetrical Risks vs. Benefits - Contracted Parties would assume all regulatory risks of such an obligations, exclusively for the benefit of unburdened third parties. * Scope - The distinction between Legal and Natural persons, or geographic regions, does not currently exist in the Domain Name System. Therefore, any recommendation mandating this change is outside the scope of the ePDP, and possibly the “picket fence” of Registrar and Registry contracts. As a result, and for the avoidance of doubt, Contracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations. Thank you, J. ------------- James Bladel GoDaddy _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team

2 1

RESENDING FOR EMAIL ARCHIVE URL LINK PURPOSE / Recording, Attendance & AC chat from the call to discuss Independent legal counsel to assist the EPDP held on Wednesday, 10 October 2018 at 22:00 UTC.
by Terri Agnew Nov. 7, 2018

Nov. 7, 2018

Please note: RESENDING FOR EMAIL ARCHIVE URL LINK PURPOSE ONLY (as the original URL link in email archives does not format properly) Dear all, Please find the attendance and AC chat attached to this email. The AC recording below from the call to discuss Independent legal counsel to assist the EPDP held on Wednesday, 10 October 2018 at 22:00 UTC. AC Recording: https://participate.icann.org/p5oj3aetof9/ ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Terri Agnew

1 0

***REMINDER*** Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Thursday, 08 November 2018 at 14:00 UTC
by Julie Bisland Nov. 7, 2018

Nov. 7, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays at 14:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/qg68BQ Thank you. Kind Regards, Andrea

1 0