November 2018 - Gnso-epdp-team

Initial Report published
by Caitlin Tubergen 21 Nov '18

21 Nov '18

Dear EPDP Team, Please note the Initial Report is now published for Public Comment. Additionally, Kurt and Rafik published the following blog. On behalf of the Staff Support Team, thank you so much to everyone for your efforts in getting this published! For all of those celebrating Thanksgiving, have a wonderful holiday! Best regards, Marika, Berry and Caitlin

3 2

Re: [Gnso-epdp-team] For Final Review - Initial Report - deadline Wednesday 21 November at 18.00 UTC
by Margie Milam 21 Nov '18

21 Nov '18

Hi All- One change needed to Rec 8: Please insert a footnote that reads: “The IPC and BC representatives on the EPDP are of the view that there should be no redactions of any data elements for legal entities.” Margie From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Tuesday, November 20, 2018 at 11:47 AM To: "Gnso-epdp-team(a)icann.org" <Gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] For Final Review - Initial Report - deadline Wednesday 21 November at 18.00 UTC Dear EPDP Team, We are pleased to share the proposed Initial Report for publication. Thank you again for attending and constructively contributing to the many hours of meetings over the past few days. * Redline – https://drive.google.com/a/icann.org/file/d/171jOv42nahKFnPW1WhSE8ckr6K00i4…<https://urldefense.proofpoint.com/v2/url?u=https-3A__drive.google.com_a_ica…> * Clean – https://drive.google.com/a/icann.org/file/d/1OyG6ExIGkemW902jHYF7V88Y8mu-kO…<https://urldefense.proofpoint.com/v2/url?u=https-3A__drive.google.com_a_ica…> Note that in the redline version, you will find highlighted in yellow the updates proposed by Thomas for the responsibilities section. He also spotted some inconsistencies in the related tables that have been updated accordingly (as well as the related data elements workbooks sections). Please also note that per Monday’s discussion, the summary has been split out into an Executive Summary and Overview of Preliminary Recommendations. For your convenience, you will also find attached the clean Word version. However, should you spot any minor issues or show stoppers, please use the line number reference in the pdf version to facilitate locating the language. Minor issues (e.g. grammatical, readability) can be sent to staff off list. Due to internal ICANN processing times and deadlines we require feedback by 1800 UTC, tomorrow, 21 November. If you need additional time (not more than two hours), you must notify us before the 1800 cut off. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

3 2

A few more change requests
by Thomas Rickert 21 Nov '18

21 Nov '18

All, I spotted a few more inconsistencies. Sorry there are no line numbers in the work sheet section. Best, Thomas APA 3 Change „transfer“ to „disclosure" Certain data elements (domain name and nameservers) would be required to be disclosed. The lawful basis would be 6(1)b, should personal data be involved, for Registrars and 6 (1)(f) of the GDPR for Registries. 6(1)(f) BPA 4 - does not list a legal basis. The rationale does not really fit in here as the life of registration +35 days would be superseded by the retention according to purpose 1. Also, it seems like the retention to restore the domain name is more a purpose 1 issue that would be justified with 6 I b than a SSR issue. Being able to restore a domain name is more a purpose 1 issue than a purpose 2 issue. My suggestion is to delete this or make it TBD. CPA 3 If CPA3 is TBD, the same should logically apply to BPA3 or both should be treated as BPA3. Just mentioning the inconsistency. I think we should not change it as this was a most controversial joint, but BPA3 does not really fit. CPA 4 covered by APA 4 EPA 1 for registrars: lawful basis missing. Add 6 I f) EPA 1 for registries - lawful basis missing. Add 6 I f) MPA 5 and MPA 6 independent controller - DRPs could also be independent controllers- at least we have not really discussed whether they just follow orders or whether they pursue their own purposes of data processing. I would add „processor or independent controller" NPA 1 Lawful basis: 6 I b add _for registrars_ NPA 5 - should rather be N/A Please note that sometimes we use singular and sometimes plural in the tables. Also, the changes in the work sheets would need to be synced with the summary. Thanks, Thomas

1 0

Recordings, Attendance & AC Chat / GNSO Temp Spec gTLD RD EPDP / Tuesday, 20 November 2018
by Julie Bisland 21 Nov '18

21 Nov '18

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Tuesday, 20 November 2018 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/ZwPVBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-20nov18… AC Recording: https://participate.icann.org/p9if3ht4vwu/<https://participate.icann.org/p9if3ht4vwu/?OWASP_CSRFTOKEN=a7f49856259ae408…> <https://participate.icann.org/p12a7q93n35/?OWASP_CSRFTOKEN=663c37463e43b07a…>** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Julie

1 0

For Final Review - Initial Report - deadline Wednesday 21 November at 18.00 UTC
by Marika Konings 20 Nov '18

20 Nov '18

Dear EPDP Team, We are pleased to share the proposed Initial Report for publication. Thank you again for attending and constructively contributing to the many hours of meetings over the past few days. * Redline – https://drive.google.com/a/icann.org/file/d/171jOv42nahKFnPW1WhSE8ckr6K00i4… * Clean – https://drive.google.com/a/icann.org/file/d/1OyG6ExIGkemW902jHYF7V88Y8mu-kO… Note that in the redline version, you will find highlighted in yellow the updates proposed by Thomas for the responsibilities section. He also spotted some inconsistencies in the related tables that have been updated accordingly (as well as the related data elements workbooks sections). Please also note that per Monday’s discussion, the summary has been split out into an Executive Summary and Overview of Preliminary Recommendations. For your convenience, you will also find attached the clean Word version. However, should you spot any minor issues or show stoppers, please use the line number reference in the pdf version to facilitate locating the language. Minor issues (e.g. grammatical, readability) can be sent to staff off list. Due to internal ICANN processing times and deadlines we require feedback by 1800 UTC, tomorrow, 21 November. If you need additional time (not more than two hours), you must notify us before the 1800 cut off. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

2 1

Re: [Gnso-epdp-team] [Ext] Re: Proposed Revised Rec. 21
by Marika Konings 20 Nov '18

20 Nov '18

FYI – staff will make this update accordingly in the final version for posting unless there are any concerns. Best regards, Caitlin, Berry and Marika From: "Rosette, Kristina" <rosettek(a)amazon.com> Date: Tuesday, November 20, 2018 at 3:55 PM To: Marika Konings <marika.konings(a)icann.org> Cc: Thomas Rickert <epdp(a)gdpr.ninja> Subject: RE: [Ext] Re: [Gnso-epdp-team] Proposed Revised Rec. 21 Hi! Thomas and I are both fine with staff’s proposed change. K From: Marika Konings [mailto:marika.konings@icann.org] Sent: Tuesday, November 20, 2018 3:17 PM To: Rosette, Kristina <rosettek(a)amazon.com> Subject: Re: [Ext] Re: [Gnso-epdp-team] Proposed Revised Rec. 21 Kristina, any further feedback on this? For now, staff has not made any update to your original language, but if this is considered a minor change, it could still be applied before publication. Thanks for your feedback. Best regards, Marika From: "Rosette, Kristina" <rosettek(a)amazon.com<mailto:rosettek@amazon.com>> Date: Tuesday, November 20, 2018 at 7:51 AM To: Marika Konings <marika.konings(a)icann.org<mailto:marika.konings@icann.org>> Cc: Trang Nguyen <trang.nguyen(a)icann.org<mailto:trang.nguyen@icann.org>>, "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Ext] Re: [Gnso-epdp-team] Proposed Revised Rec. 21 Still considering it On Nov 20, 2018, at 8:16 AM, Marika Konings <marika.konings(a)icann.org<mailto:marika.konings@icann.org>> wrote: Dear EPDP Team, Are there any concerns about this proposed change? If yes, it can be discussed during the upcoming meeting. If not, staff will go ahead and make this modification. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Trang Nguyen <trang.nguyen(a)icann.org<mailto:trang.nguyen@icann.org>> Date: Monday, November 19, 2018 at 6:31 PM To: "Rosette, Kristina" <rosettek(a)amazon.com<mailto:rosettek@amazon.com>>, "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Proposed Revised Rec. 21 Dear Kristina and EPDP Team, Thank you for the revised recommendation 21 language. ICANN org suggests that the EPDP Team consider removing the word “the” from the language “…ICANN Org enters into the required agreements…” This word presupposes that ICANN must enter into an agreement with every entity “involved in registration data processing” when it has not been determined who all the parties involved in registration data processing are and whether an agreement will be required in all cases. For example, as mentioned this morning, some data escrow providers believe that they are controllers. Dan and Trang ICANN org liaisons From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of "Rosette, Kristina via Gnso-epdp-team" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Reply-To: "Rosette, Kristina" <rosettek(a)amazon.com<mailto:rosettek@amazon.com>> Date: Monday, November 19, 2018 at 8:51 AM To: "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] Proposed Revised Rec. 21 All, Thomas and I developed proposed revised Rec. 21 language. I posted it in chat, but copy it below for convenience: Rec. 21: The EPDP Team recommends that ICANN Org enters into the required agreements such as a Data Processing Agreement (GDPR Art. 28) or Joint Controller Agreement (Art. 26), as appropriate, with the non-Contracted Party entities involved in registration data processing such as data escrow providers and EBERO providers. These agreements are expected to set out the relationship obligations and instructions for data processing between the different parties. Kristina Rosette Senior Corporate Counsel, IP – Domains rosettek(a)amazon.com<mailto:rosettek@amazon.com> | 703.407.1354

1 0

Notes, action items from EPDP Team Meeting #29 - 20 November 2018
by Caitlin Tubergen 20 Nov '18

20 Nov '18

Dear EPDP Team, Below, please find the notes and action items from today’s EPDP Team call. Thank you. Best regards, Marika, Berry and Caitlin High-Level Notes/Actions Thomas to propose new language in response to feedback he has received from the team for the Responsible Parties portion of the initial report today. Following receipt of Thomas’s language, Support Staff will circulate final version of the Initial Report to the EPDP Team. The Initial Report will be published for public comment tomorrow, 21 November 2018, unless “showstoppers” are identified that would warrant further discussion. These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/ZwPVBQ 1. Roll Call & SOI Updates Attendance will be taken from Adobe Connect Remember to mute your microphones when not speaking and state your name before speaking for transcription purposes. Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair a) Review of outstanding action items b) Other updates, if applicable Communication from ICANN travel department is forthcoming (likely this week) We are aiming to publish the Initial Report tomorrow (Wed, 21 Nov) so that the comment deadline is before the Christmas holiday. EPDP Team Feedback: It is more important to deal with outstanding items rather than publish to hit a date 3. Finalize outstanding items: a) Purpose O – see proposed language for addressing this in the Initial Report It may be beneficial to publish Purpose O in the initial report to allow the public to weigh in on it. The proposed language is confusing. It may be helpful to note we have not deliberated on this, but we are including for the purpose of receiving feedback. What question is ICANN considering here? As the Purpose O workbook has not been reviewed, it will not be included with the other approved workbooks (due to the differing status) Grave concerns with Purpose O - there are issues in terms of timeliness, issues in terms of unanswered questions with respect to this purpose. This language should not go in except to say - this came in late and the Team has not had adequate time to discuss this. There are concerns that this could necessitate changes to the RA. If so, this is a big red flag that we need to signal to the community. The word "threat" should be removed. This language should still be included in the initial report. This needs wordsmithing, but we have to keep this purpose. In formulating this person, Benedict and Farzaneh asked if OCTO uses personal information, the answer is no. The group has not had time to adequately discuss this. This also includes the accuracy reporting system. The program is on hold. We must include this issue in the initial report. In order to solicit public comment, this needs to be included. What we are talking about a purpose - this should be covered under Purpose B/Purpose 2. This is not a purpose that justifies collection. If it included, make a clear disclaimer that this has not been reviewed, but it will be reviewed prior to the final report. Without knowing ICANN’s needs, the Team cannot make an informed decision about this language. Note: the proposed language will be included in the body of the report, not within the recommendations section We cannot treat ICANN org the same as third parties under Purpose B There is a different interpretation as to whose research this entails - is it just ICANN or other researchers? Two questions: this cannot be put in at the last-minute b/c the Team has not discussed. (1) This is a data quality issue - this is an implementation issue. (2) should ICANN be doing this data quality exercise? Proposed path forward: introduce proposed purpose and ask for public comment. Action Item: Staff will circulate proposed language for the team's review. b) Additional language re. responsibilities section (Thomas) Thomas circulated this language earlier this week. This language aims to shed light on contracting, EBERO How would operationalizing these agreements work? A potential solution is proposed here - clarify that there is a plethora of JCAs. Leave flexibility to the parties who are entering into the agreements. We could make this better if we had more time. Diane offered additional changes. Action item: Thomas to include suggestions made by Diane, put in clarification to Marc, add a note that the drafting of the JCA is not within the scope of this EPDP today. c) Additional language re. UDRP (Margie) – see updated version circulated on Monday 19 November The updated language lays out the perspective of those who believe the changes in the temp spec have not caused any issues There is advocacy in this language. The point about privacy/proxy is that complaints can be filed without access to registration data, so the note about privacy/proxy is irrelevant. Cannot support this language going forward as is. Rather than say "some believe" add the specific parties who believe to this sentence. Primary concern from formatting perspective - the repeated reference to "some". It should say "proponents of pre-filing disclosure believe". Using some to refer to different views/groups is confusing. Action Item: Staff to send a rewrite of this UDRP section to the team following this call. (completed) d) Revised language for Preliminary Recommendation #2 – see revised version circulated on Monday 19 November by staff No objections to this text noted 4. Next steps for publication: a) Public comment forum – Google form See google form shared during the meeting Objective is to facilitate focused input from commenters but also review by EPDP Team following closing of public comment forum. Downloadable form will be available to allow for off-line preparations No sign up is required, only email address needs to be provided. Open fields will also be provided for general input. b) Community Webinar Organize community webinar to present report and explain public comment forum. Proposal to have staff present outline of report and how to submit comments, unless group prefers to do so. If report is published on Wednesday, webinar would be held on Thursday 28 November, if it is published next week, it would be on Thursday 4 December. c) Letter to EDPB d) Confirm publication date target Aim to publish tomorrow, unless show stoppers are identified that would warrant further consideration. 5. Wrap and confirm next meeting to be scheduled for Tuesday 28 November 2018 a) Confirm action items b) Confirm questions for ICANN Org, if any

1 0

Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 27 November 2018
by Julie Bisland 20 Nov '18

20 Nov '18

Tuesday, 27 November 2018 at 14:00 UTC for 2 hours Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/9ArVBQ Thank you. Kind Regards, Julie

1 0

FW: FW: [Ext] Fwd: Additional language for roles and responsibilities
by Marika Konings 20 Nov '18

20 Nov '18

FYI From: "Plaut, Diane" <Diane.Plaut(a)corsearch.com> Date: Tuesday, November 20, 2018 at 8:55 AM To: Marika Konings <marika.konings(a)icann.org>, Thomas Rickert <epdp(a)gdpr.ninja> Subject: Re: [Gnso-epdp-team] FW: [Ext] Fwd: Additional language for roles and responsibilities Marika- I sent the clarification language and Thomas asked me to re-send it this morning. Diane Plaut General Counsel and Privacy Officer [cid:image001.png@01D3CA70.18FC1D40] Direct +1 646-899-2806  diane.plaut(a)corsearch.com<mailto:diane.plaut@corsearch.com> 220 West 42nd Street, 11th Floor, New York, NY 10036, United States www.corsearch.com [corsearch.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.corsearch.com_&d=Dw…> Join Corsearch on Twitter [twitter.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_corsearch&…> Linkedin [linkedin.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_compa…> Trademarks + Brands [trademarksandbrands.corsearch.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__trademarksandbrands.cor…> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241) Corsearch.USCustomerService(a)corsearch.com<mailto:Corsearch.USCustomerService@corsearch.com> Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession. From: "Plaut, Diane" <Diane.Plaut(a)corsearch.com> Date: Monday, November 19, 2018 at 9:15 AM To: Marika Konings <marika.konings(a)icann.org>, Thomas Rickert <epdp(a)gdpr.ninja> Subject: Re: [Gnso-epdp-team] FW: [Ext] Fwd: Additional language for roles and responsibilities Dear Thomas- I am unable to be on the call today due to a last minute internal matter but suggest the following edited version (minor) that I think more accurately describes our work and the legal picture. Please let me know your thoughts or outputs from the call. Through the course of the EPDP and the work of the EPDP Team to date, the facts have indicated that there may likely exist a joint controller relationship between the parties in issue (the Registrars, Registries and ICANN). The EPDP Team understands that the determination of a joint controller relationship between requires work at a greater level of granularity than in this report. During the further work of the EPDP and negotiations that will subsequently take place between the CPH and ICANN in relation to memorializing this relationship when entering into a Joint Controller Agreement (JCA), the parties shall conduct a detailed review of the individual processing activities and the actions to be taken by the respective parties. A clear demarcation of the processing activities covered by the JCA versus those carried out by either party outside the scope of the JCA shall be documented and reflected both in the private, as well as in the public version of the JCA. The JCA shall ensure that the risks of data processing are shared adequately based on whose interests are concerned. Also, the JCA shall include indemnifications to ensure that no party shall ultimately be liable for another parties’ wrongdoing. The JCA shall recognize that parties are currently using third parties’ services or otherwise work with third parties, such as: - Data Escrow Agents - EBEROs - Registry Service Providers - Registrar as a Service Providers - Resellers - Dispute Resolution Providers - the TMCH. This may or may not include processing of personal data by those third parties. Where personal data is processed by third parties, the respective joint controller will need to ensure that the data processing is carried out in a way compliant with GDPR, and if needed, will enter into Data Processing Agreement(s) with said third party provider/processor. However, conditional to GDPR compliance, nothing in the JCA shall prevent the respective joint controller from engaging third parties and entering into the required agreements without further authorization from the other joint controllers. The EPDP Team considers it out of scope of its work to prescribe in what form JCAs will be entered into, as long as a set of the minimum requirements, as specified in the EPDP Team’s report, are met. It does appear advisable, though, to create one template, which can be amended to reflect situations that are not applicable industry-wide (such as eligibility requirements for registered name holders) and that JCAs are entered into per TLD between ICANN Org, the respective Registry Operator and registrars. A potential way to facilitate contracting would be to make the JCA part of the RRA, so there would be separate tri-party agreements between ICANN Org, the Registry Operator and each registrar. Standardized parts of the JCA should include the information that is legally required to be provided to the data subjects to allow for the use of the same language across all TLDs, as necessary. Diane Plaut General Counsel and Privacy Officer [cid:image001.png@01D3CA70.18FC1D40] Direct +1 646-899-2806  diane.plaut(a)corsearch.com<mailto:diane.plaut@corsearch.com> 220 West 42nd Street, 11th Floor, New York, NY 10036, United States www.corsearch.com [corsearch.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.corsearch.com_&d=Dw…> Join Corsearch on Twitter [twitter.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_corsearch&…> Linkedin [linkedin.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_compa…> Trademarks + Brands [trademarksandbrands.corsearch.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__trademarksandbrands.cor…> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241) Corsearch.USCustomerService(a)corsearch.com<mailto:Corsearch.USCustomerService@corsearch.com> Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession. From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Monday, November 19, 2018 at 7:40 AM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] FW: [Ext] Fwd: Additional language for roles and responsibilities The EPDP Team understands that a joint controller situation between ICANN Org, Registries and Registrars requires work at a greater level of granularity than in this report. During the negotiations, the parties shall conduct a detailed review of the individual processing activities and the actions to be taken by the respective parties. A clear demarcation the processing activities covered by the JCA versus those carried out by either party outside the scope of the JCA shall be documented and reflected both in the private as well as in the public version of the JCA. The JCA shall ensure that the risks of data processing are shared adequately based on whose interests are concerned. Also, the JCA shall include indemnifications to ensure that no party shall ultimately be liable for another parties’ wrongdoing. The JCA shall recognize that parties are currently using third parties’ services or otherwise work with third parties, such as - Data Escrow Agents - EBEROs - Registry Service Providers - Registrar as a Service Providers - Resellers - Dispute Resolution Providers - the TMCH. This may or may not include processing of personal data by those third parties. Where personal data is processed by third parties, the respective joint controller will need to ensure that the data processing is carried out in a way compliant with GDPR. However, conditional to GDPR compliance, nothing in the JCA shall prevent the respective joint controller from engaging third parties and entering into the required agreements without further authorizations from the other joint controllers. The EPDP Team considers it out of scope of its work to prescribe in what form JCAs will be entered into, as long as a set of the minimum requirements as specified in the EPDP Team’s report, are met. It does appear advisable, though, to create one template, which can be amended to reflect situations that are not applicable industry-wide (such as eligibility requirements for registered name holders) and that JCAs are entered into per TLD between ICANN Org, the respective Registry Operator and registrars. A potential way to facilitate contracting would be to make the JCA part of the RRA, so there would be separate tri-partite agreements between ICANN Org, the Registry Operator and each registrar. Standardized parts of the JCA should include the informations that are legally required to be provided to the data subjects to allow for the use of the same language across all TLDs as much as possible.

1 0

UDRP Language - Additional Language to Consider
by Margie Milam 20 Nov '18

20 Nov '18

HI – following up on my action item—here is the language I suggest. Have a great weekend everyone! Margie ______________ ….However this proposed addition was not supported by others who pointed out that in the case of privacy/proxy registrations complainants never often do not have access to registrant information pre-filing. Some believe that GDRP redaction is distinguishable from a privacy/proxy registration because a privacy/proxy services is a separate service (associated with a fee) that the registrant chooses, with separate ICANN policies, and a different set of responsibilities. For example, the proxy service is considered the registrant, and under can face liability under RAA Section 3.7.7.3. Similarly, concerns were expressed about how this pre-filing disclosures could be implemented in practice as it could result in information being disclosed to anyone claiming to be interested in filing a UDRP complaint, without any obligation to follow this through. Some believe that this concern can be addressed through policy recommendations to be explored further in this ePDP, such as, * Require the trademark holder to represent that they have a good faith intent to file a UDRP or other dispute resolution mechanism or cybersquatting action * Suggest that Dispute resolution providers be able to audit requests to ensure that the requester filed a UDRP/URS or legal complaint, or in good faith determined that no grounds existed. * Require the TM holder to have a TMCH filing with valid SMD file * Require the TM holder to agree to data processing standards (i.e. model clauses, or similar). * Limitations on the number of records accessible under this purpose

5 6