December 2018 - Gnso-epdp-team

Legal Advice SOW
by Kurt Pritz Dec. 11, 2018

Dec. 11, 2018

Hi Everyone: Attached is a proposed SOW for legal expertise to provide advice on specific questions for our group. It includes 2 sample questions to give potential advisors a sense of the work to be undertaken. We will discuss this briefly during the meeting and you’ll have a brief period of time to review and comment on it before it is sent on to ICANN. Thanks very much to Diane and Stephanie who have gone through several iterations fo this in the last 48 hours. Best regards, Kurt

3 2

Notes, action items - Small Team Joint Controllership Meeting - 10 Dec 2018
by Caitlin Tubergen Dec. 11, 2018

Dec. 11, 2018

Dear All, Please find below the notes from today’s small team call on responsible parties/joint controllership. Thank you. Best regards, Marika, Berry, and Caitlin Notes and Action Items Small Team Meeting on Responsible Parties (Joint Controllership) 10 December 2018, 1400 UTC Purpose of the Small Team: Conduct a bifurcated analysis: Does a joint controller relationship exist? If so, who are the respective parties? What are the implementation issues that spring from those determinations? What potential alternatives exist? The first section of the ICANN memo lays out definitions. One noted issue in the Initial Report is requiring ICANN to enter into JCA - a complication is there are over 1000 registry operators (as one example) - how does the Team envision handling this complexity - template, thousands of agreements, amendments to base agreements, etc.? Irrespective of the responsible parties determination, there will be a lot of implementation work ahead. Instead of thinking of how difficult the implementation will be, the group should focus on GDPR compliance. For example, the Irish DPA requires a written agreement for joint controllers. Please see: http://www.irishstatutebook.ie/eli/2018/act/7/section/79/enacted/en/html#se… If the Team confirms joint controllership exists, will ICANN agree to that? Is a written agreement strictly required, or is it an arrangement? What does an agreement mean in this context? It is up to the community to agree on responsible parties; however, a court could ultimately decide the Team’s determination is incorrect. The significant heavy lifting of developing contractual relationships will be done outside the EPDP. What does the EPDP need to provide in its policy recommendation? Even if there were no formal requirements for a JCA, it is important to lay out the roles and responsibilities. It could be helpful to suggest guidance. Does anyone object to the joint controllership determination? The idea of including the JCA in the RRA needs to be further discussed as ICANN is not a party to the RRA but does approve amendments. First question - do we have a joint controllership? The ICANN org liaisons are not part of the formal consensus call. It may be problematic that registrars are not participating in this small team, despite the fact that this group may determine that registrars are joint controllers. A JCA may be appropriate in some situations, but it may not be the appropriate solution across the board. The work we've done to date has been focused on ICANN purposes, not joint purposes. What's ultimately important is to enter into a GDPR-compliant arrangement, whether that's a JCA or something else. The small team cannot come to consensus on what is binding on the EPDP Team and community at large. If the sub-team cannot align itself, the sub-team can report divergence. However, if the small team comes to agreement, it would be helpful to report conclusions to the plenary. If the Initial Report is wrong in anyone's determination, what are the alternatives? What is needed to make an informed decision? Question for ICANN org - if conclusions are taken back to the whole group, does that allay the concerns of an underrepresented small team? The conversation is OK to continue, so long as the Team has an opportunity to weigh in. There are likely situations such as RDDS, where contracted parties are processors rather than joint controllers. The specifics would be noted in a JCA. Independent purposes do not need to be discussed in the EPDP. The ICANN org cookbook notes that ICANN org is an independent controller. The Temp Spec classifies the parties as controllers, not joint controllers or independent controllers. The Team needs to focus on the policy recommendation. JCAs could spell out liabilities so a brand registry in Asia with generic corporate data would not have the same liability as another entity. ICANN was presented with two legal opinions, noting joint controllership, yet ICANN decided it was not a joint controller. The foundation has been presented in the Initial Report. We would define the responsible parties in the workbooks and update the language of the Temp Spec. Within the joint controller scenario, we would identify the party(ies) who is responsible for audit, disclosing data, etc. This could then be mirrored in a joint controller agreement. Next step: pro forma amendment to the Temp Spec. The EPDP Team could then discuss.

1 0

Additional Information -- Topics related to Consent
by Margie Milam Dec. 10, 2018

Dec. 10, 2018

Hi – Per our discussion, here is information to frame our discussion related to a few of the additional topics we raised: 1. Registrant Consent to Publication - Scope: The EPDP Charter (Part 1(f)) relates to publication of data. Issue: Whether registrars should give the registrant the option to opt in to having their WHOIS Contact Data be published rather than be redacted. This is an issue that would be available to both natural persons and legal persons. Temporary Specification: The Temporary Specification 7.2.1/ Appendix C – Section 2.3 contains this requirement: As soon as commercially reasonable, Registrar MUST provide the opportunity for the Registered Name Holder to provide its Consent to publish the additional contact information outlined in Section 2.3 of Appendix A for the Registered Name Holder. Proposed Policy: Confirm this requirement Rationale: Registrants such as corporations conducting online business may wish to display their information to ensure that their customers can confirm the authenticity of their website and prevent phishing and other impersonations. Domainers may wish to be easily contactable in order to solicit interest in secondary sales of their domain names. Enabling the consent feature is consistent with the accountability principles laid out in GDPR. EPDP Initial Report: Silent on the issue of consent GDPR Legal Basis – Article 7 of GDPR 1. Consent by the Registrant to Publish and/or Disclose for technical contact - Scope: The EPDP Charter (Part 1(f)) relates to publication of data. Issue: Whether registrars should seek consent from those listed as additional contacts (admin/tech) to having their information as reflected in the Contact data be published rather than be redacted. This is an issue that would be available to both natural persons and legal persons. Temporary Specification: The Temporary Specification 7.2.1/ Appendix C – Section 2.3 contains this requirement: Registrar MAY provide the opportunity for the Admin/Tech and/or other contacts to provide Consent to publish additional contact information outlined in Section 2.4 of Appendix A. EPDP Initial Report: Silent on the issue of consent GDPR Legal Basis – Article 7 of GDPR Proposed Policy: Confirm this requirement Rationale: To avoid inadvertently publishing personal data, this option should be available to registrars. Have a great weekend! All the best, Margie

3 2

**Reminder** Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 11 December 2018 at 14:00 UTC
by Julie Bisland Dec. 10, 2018

Dec. 10, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/-wrVBQ Thank you. Kind Regards, Andrea

1 0

Proposed Agenda - EPDP Team Meeting #33
by Marika Konings Dec. 7, 2018

Dec. 7, 2018

Dear All, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 11 December at 14.00 UTC. As you know, there are a couple of items on the topic list for which EPDP Team members have been encouraged to provide specific recommendations and/or proposals for consideration. Please get these to the mailing list as soon as possible, at the latest by Monday 10 December COB. In order to allow for sufficient time for EPDP members to review these recommendations and/or proposals and commence deliberations on the mailing list, these items are expected to be on the agenda for Thursday’s meeting next week. In relation to the agenda below, you are encouraged to share any suggestions and/or questions for EPDP Team consideration in relation to agenda item #4 ahead of Tuesday’s meeting. Best regards, Caitlin, Berry and Marika EPDP Meeting #33 Agenda Tuesday, 11 December 2018 1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Status of letter to EDPB / External Legal Counsel * Review of outstanding action items * Other updates, if applicable 1. Preview of Phase 2 work items (15 minutes): * Review mind map * Confirm understanding of EPDP Team on where it is on meeting requirements to commence phase 2 work. * Confirm next steps, if any 1. Continue review of list of topics for further discussion * Topic List Item #7 – Definition of optional Recommendation #4: the EPDP Team is still considering whether optional also means optional for the registrar to offer the ability to the Registered Name Holder to provide these data elements, or whether it would be required for the registrar to offer this ability. (Initial Report) * Consider current requirements * Consider risk / compliance issues of requiring or not requiring registrars to request RNH to provide optional data elements * Confirm whether data that is optional, but which has been provided by RNH is to be transferred to the registry. * Confirm next steps, if any * Geographic basis * Consider EDPB Guideline (see https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-3…) * How does this guideline impact EPDP Teams position on this topic? What changes, if any, should be considered for the Final Report? * Policy Change Impact Analysis * Review current language in Initial Report * Discuss what other information this section should contain * Volunteers to work on this section? 1. Wrap and confirm next meeting to be scheduled for Thursday 13 December 2018 at 14.00 UTC * Confirm action items * Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Small Team Joint Controllership Questions
by Caitlin Tubergen Dec. 7, 2018

Dec. 7, 2018

Dear All, Attached, please find a document outlining questions to consider for Monday’s small team joint controllership call. Please review the document in advance of our call. Thank you and have a great weekend. Best regards, Marika, Berry, and Caitlin

1 0

GDPR related letters
by Marika Konings Dec. 7, 2018

Dec. 7, 2018

Dear EPDP Team, For your information, please find hereby two letters that were posted earlier today that may be of interest: * Letter from Göran to the Belgium and Ireland DPAs https://www.icann.org/en/system/files/correspondence/marby-to-debeuckelaere… * Letter from Cyrus to the RrSG https://www.icann.org/en/system/files/correspondence/namazi-to-bunton-06dec… Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Recordings, Attendance & AC Chat / GNSO Temp Spec gTLD RD EPDP / Thursday, 06 December 2018
by Andrea Glandon Dec. 6, 2018

Dec. 6, 2018

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Thursday, 06 December 2018 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/_wrVBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-06dec18… AC Recording: https://participate.icann.org/p9mo88vo20t/<https://participate.icann.org/p9mo88vo20t/?OWASP_CSRFTOKEN=db14aa5e6c703b95…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

Notes, action items from EPDP Team Meeting #32 - 6 December 2018
by Caitlin Tubergen Dec. 6, 2018

Dec. 6, 2018

Dear All, Below, please find the notes and action items from today’s EPDP Team call. Thank you. Best regards, Marika, Berry, and Caitlin EPDP Team Call #32 Thursday, 06 December 2018 14:00 UTC High-level Notes/Actions Action Item #1: Kurt to edit the latest version of the EDPB letter and notify the GNSO Council that the EPDP Team will hold off on sending a communication to the EDPB at this time. Action Item #2: EPDP Team to provide any proposed updates to the draft Statement of Work to obtain legal advice on GDPR issues by the end of the week. Action Item #3: EPDP Support Team to send an email to the Team with a list of additional topics for discussion, and EPDP Team members who suggested or who would like to discuss the topics to provide the objective for the discussion in writing to the Team. Action Item #4: EPDP leadership to contact ICANN or facilitate contact with ICANN to gain their participation in the “Purpose O” discussion regarding processing data for ICANN research purposes. Notes These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/ZwPVBQ 1. Roll Call & SOI Updates · Attendance will be taken from Adobe Connect · Remember to mute your microphones when not speaking and state your name before speaking for transcription purposes. · Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) a. Review of outstanding action items EPDP Team to send message to ICANN indicating that, after discussion of ICANN-raised issues with regard to data processing agreements with Dispute Resolution Providers, that no change is required to the current Initial Report recommendation and ask for a detailed explanation if ICANN Org disagrees with that assessment. EPDP Team to develop message to request ICANN Org to: (a) commence development of legally compliant data processing agreements with escrow providers, and (b) create agreements that indicate that data escrow providers are in a processor (rather than controller role) or provide information to the EPDP team why that should not be the case. ICANN to share this work with the EPDP Team to help inform its deliberations. Some Team Members mentioned interest in controller conversation - if you are interested, please be sure to fill out the Doodle Poll so the Support Team can schedule the call. b. Other updates, if applicable Kurt will review the draft EDPB letter, with Hadia and Kavouss' edits, and do a final round of edits. Additional edits to the EDPB letter - First paragraph re: role of ICANN - replace unique identifiers with "domain name system" to avoid confusion with the IANA function Replace stakeholders with "ICANN and its contracted parties" Has the EPDP Team definitively agreed to send this letter? The benefits of sending this letter are in question; however, the previously-identified harms in sending the letter have been mitigated with the edits to the letter. It is wishful thinking to the think the EDPB will provide general comments. The purpose of the letter is to inform the EDPB that the Initial Report has been published. There is no harm in sending the letter, but there is also no value in sending the letter. Sending something more precise would have more benefit, but if the questions are not in a state to be sent, we should not send the letter. Why does the Team need to formally write this letter - it is almost empty? Would it be helpful to notify the GAC EU rep what is going on, or instead, what would make the letter meaningful or still appropriate? There are already representatives from the EU delegation, so that is not necessary. We should include questions in a letter. It may be beneficial to reach out to specific DPAs who are familiar with the issues with specific questions, but this letter is not in a state for that. The letter shows what the Team is working on and helps in managing expectations. Action: Kurt to touch up the latest version of the letter and write to the GNSO Council and notify them that the Team will hold off on sending the letter at this time. Draft SOW for Legal Counsel The scope is provided, as well as two sample questions to demonstrate the types of questions the Team would be asking and the type of expertise we are looking for. Procuring services may not best serve the Team - firstly, the cost could be an issue. Secondly, determining the questions and resourcing the effort could be an issue. The SOW should reference previous guidance ICANN has received from the Art. 29 Working Party, etc. There is a conversation in the chat re: budget implications. If the Team decides this is important, we need to make sure this can be paid for. What is the process for selecting counsel? Where did the example questions come from, and what is the process for adding to this? It would also be helpful to have sanity checks with the methodology. The biggest financial risk is this team seeking legal advice and ICANN seeking separate legal advice and ending up with conflicting legal advice. This should not be deferred as if we decide later that we need counsel, we should start the process now as the process can take a long time. Action Item: EPDP Team Members to provide any proposed updates to the draft SOW by the end of the week. 3. Continue review of list of topics for further discussion a. Purpose O – Research Purpose · This purpose is required within ICANN to support its work. · There are two ways of going about this under GDPR - this could be secondary processing - take personal data collected for another purpose and without getting consent again, Art. VI (4) - recital 50 allows for secondary processing. · The data would not be shared outside of ICANN - it will only be for ICANN's internal work. · This purpose would be for ICANN to collect and use data, and while the data would not be shared with third parties, but the findings would be shared with third parties. · Given ICANN's role, I don't see how we could not have this purpose. · When Purpose O was forwarded to the team, ICANN's previous responses to questions regarding research, and this doesn't seem to be a problem that needs solving as ICANN is not asking for this. · Noting there is not subsequent consent from the data subject, why do we not disclose this processing at the time of collection? Re: pseudonymization, how will this work? · Two ways to approach this - proposed approach is to disclose to the data subject at the time of collection, in spite of the broad exemption under GDPR. There is no sense of global unique identifiers · ARS is not included in this purpose as GDD owns ARS, not OCTO. · Secondary purpose may not apply in this case · Cannot gage whether we need this in the future based on the fact that we do not need/use it right now · Why are reports only on threats mentioned? · We could consider including reports on country uptake. · Previous questions to ICANN Org noted want vs. need. There may be a hidden idea behind this - does this purpose necessitate a new obligation to hash all data and send to ICANN to conduct the new purpose. · Action Item: EPDP Leadership to follow up with OCTO regarding the conversation · Support this specific purpose - this is important for SSR. · Does this address a specific need and is ICANN asking for this? This is probably not appropriate for Phase 1. · If the Team concludes this is a missing purpose, then it is within our scope. · In taking down crime - it is hard to determine the legitimate/false positives because of redaction - be mindful of the unintended consequences of what we are doing. · We want to hear from ICANN directly about the program and get enough into the implementation details that it would not inflict material costs on contracted parties. i. Commence review of Purpose O Workbook ii. Discuss next steps b. WHOIS Accuracy · What is the outcome(s) people are looking for here? · Among the recommendations from the first WHOIS Review Team - noting studies had been done on WHOIS contact data and noting there are significant problems with WHOIS data. One recommendation was ICANN should report on the data. The WHOIS ARS program came out of this. · Names that come back with problems are submitted to Compliance. Roughly 40% or more of data is inaccurate. This is something that needs to be looked at in some depth. · One thing to ascertain is the impact of the inaccuracy - losing a valuable asset b/c of not changing an address within three weeks of moving seems a high impact. · Is this a program that can be retained without undue costs? · One impact of inaccuracy is to not be compliant with GDPR. · Want to make sure we're not putting an onus on contracted parties to do more than they're already doing. · The EPDP Team does not have time to deal with all of these issues. · Additional topics in the list – it would be helpful to provide for the objective in writing. i. Footnote 4 - The topic of accuracy as related to GDPR compliance is expected to be considered further, as well as the WHOIS Accuracy Reporting System. (Initial Report) ii. Discuss objective of the discussions on Whois data accuracy and the Whois Accuracy Reporting System, taking into account the Team's scope as described by the Charter and Temporary Specification. 4. Preview of Phase 2 work items (15 minutes): a. Review mind map (see attached) b. Confirm understanding of EPDP Team on where it is on meeting requirements to commence phase 2 work. c. Confirm next steps, if any 5. Wrap and confirm next meeting to be scheduled for Tuesday 11 December 2018 at 14.00 UTC a. Confirm action items b. Confirm questions for ICANN Org, if any

1 0

Recordings, Attendance & AC chat from the GNSO Temp Spec gTLD RD EPDP Small Roles & Responsibilities team held on Thursday, 29 November 2018 at 18:00 and 21:00 UTC
by Terri Agnew Dec. 6, 2018

Dec. 6, 2018

Dear all, Please find the attendance and AC chat attached to this email. The MP3 and AC recording below from the two Small Teams to discuss the letter to the EDPB call held on Thursday, 29 November 2018 at 18:00 and 21:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/bQbuBQ First call MP3: https://audio.icann.org/gnso/gnso-epdp-small-call-1-29nov18-en.mp3 Second call MP3: https://audio.icann.org/gnso/gnso-epdp-small-call-2-29nov18-en.mp3 First call AC Recording: https://participate.icann.org/p1lfb0cr39n Second call AC Recording: https://participate.icann.org/p12zqjemvt2 ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Terri Agnew

10 23