August 2018 - Gnso-epdp-team

Pro-forma Triage Report
by Kurt Pritz Aug. 21, 2018

Aug. 21, 2018

Hi Everyone: It was requested that we prepare a “pro forma” Triage Report for review and discussion - a version of the Triage report that might be submitted to the Council when the surveys are completed. This represents the work from the first survey, about 30% of the Temporary Specification. So you can see, it will be a fairly long report. The report includes an executive summary, our operating methodology, the summary table of inputs, the issue summaries that were created for each section and an appendix with all written comments. This report hasn’t had sufficient vetting on the leadership-support side yet but I wanted you to see the formatting and level of content as soon as possible. I apologize for the font size in the appendix. We will reorganize the table of all comments in some way that is readable in time for the actual publication. We will continue building this report and amending it in accordance with comments and discussion as we go along. Remember that this report is designed to help but not limit, prejudice or restrict our future work. So let’s spend time to make this good, but not perfect. I hope you find this helpful. Best regards, Kurt

5 8

Triage Report 1-3.pdf
by Kurt Pritz Aug. 18, 2018

Aug. 18, 2018

Hello Everyone: Attached Is the next version of the Triage Report that incorporates the results of surveys 1-3. In this version: 1) the edits (from comments) and additions are in blue; 2) I have not included the appendix, which is the spreadsheets that includes all of your comments. We hope to have a draft final version shortly after receiving your last surveys and plan to send it to the GNSO sometime during the upcoming week. Talk to your own soon, Kurt

1 0

22 August deliverable (Early Input)
by Kurt Pritz Aug. 16, 2018

Aug. 16, 2018

Hi Everyone: We had a question at the start of the meeting asking about a deliverable on 22 February. During the meeting, I stated that here was no deliverable for that date. I was technically correct but mostly wrong. Please recall the Early Input request. According to the requirements of the policy development process, each SO/AC/SG/C was sent a letter, allowing them to provide Early Input by 22 August. (See: https://go.icann.org/2w82uT7 <https://go.icann.org/2w82uT7> This is a distinct effort from the triage surveys we are currently reviewing. While a separate submission from each SG/AC/SG/C is not mandatory, each SO/AC/SG/C was afforded the opportunity to provide input, if they so choose. It is likely that, because you are on this team, you would have been the one tapped to take on this task. I hope this clarifies the matter for you and I apologize for the lapse in memory. Best regards, Kurt

3 4

Notes and action items from today's EPDP Team Meeting - 16 August 2018
by Caitlin Tubergen Aug. 16, 2018

Aug. 16, 2018

Dear All, Below, please find notes and action items from today’s EPDP Team Call. As a reminder, our next meeting will be Tuesday, 21 August, 13:00 UTC. Best regards, Marika, Berry, and Caitlin =============== EPDP Team Meeting - 16 August 2018 High-level Notes/Actions: Goran Marby, CEO of ICANN org, sent a letter to Kurt, asking to share any thoughts the EPDP Team might have regarding a process by which (1) ICANN org can share guidance they receive from the DPAs and European Data Protection Board with the EPDP Working Group; and (2) How the EPDP Working Group will provide input regarding access to ICANN org to use in our interactions with DPAs and European Data Protection Board to obtain legal guidance that will help guide the Working Group in its work. Kurt sent a draft response to the EPDP Team for review. If any members have suggested edits or additional thoughts, please submit them by 01:00 UTC on 17 August (COB Los Angeles time). EPDP Members should complete Part 4 of the Triage Survey by Sunday, 19 August by 19.00 UTC. Note that Part 4 of the Triage Survey includes Section 8 and Appendix C. Kurt distributed a pro-forma draft for the Triage report, which is the EPDP Team’s first deliverable to the GNSO Council. The Leadership Team will continue to populate the content of the Triage report, but EPDP Team Members are encouraged to provide comments now so that they can be incorporated and the report can be delivered shortly after we finish our Survey exercise. Today’s discussion concerned registrar and registry provided services, how GDPR blocked the provision of those services and the work-arounds that were successfully implemented. (“Successfully” meaning that all three services are in operation today.) There was a sense of the group that these functioning services (and the Temporary Specification description of them) should be left as is. There was an issue raised as to whether each of the personal datum transferred during these processes was necessary given the principle of minimization, and it was agreed that this should be raised during the access discussion. Questions for ICANN Org from the EPDP Team: Believing that ICANN org has its own GDPR implementation plan in place, it would be helpful for our group to understand the elements and implementation status of the plan so that the Team can draw comparisons to the EPDP Team’s work. The Council envisioned, via the EPDP Charter, to have direct participation of ICANN org liaisons, within the EPDP Team. As we leave the Triage and head into substantive detail, do the ICANN liaisons see a role or specific set of actions for ICANN supporting the team? All Action Items: Kurt sent a draft response to the EPDP Team for review. If any members have suggested edits or additional thoughts, please submit them by 01:00 UTC on 17 August (COB Los Angeles time). EPDP Members should complete Part 4 of the Triage Survey by Sunday, 19 August by 19.00 UTC. Note that Part 4 of the Triage Survey includes Section 8 and Appendix C. Kurt distributed the draft framework for the triage report, which is the EPDP Team’s first deliverable. The Leadership Team is still reviewing and populating the content of the triage report, but EPDP Team Members are welcome to provide comments or suggestions on the format at this stage. These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates 2. Welcome and Updates from EPDP Team Chair · During today’s meeting, the team will be reviewing Appendices D, E, and G. · We received an email from Göran Marby, CEO of ICANN. Kurt’s draft response was sent to the EPDP Team for review. Action: If EPDP Team Members have comments on Kurt’s draft to Goran, please submit them by 01:00 UTC on 17 August (COB Los Angeles time) – Kurt would like to respond by COB Los Angeles time today. · Draft of first section of triage report – the triage report is a requirement from the charter. The first draft of the triage report was distributed to the team. If we have time at the end of the meeting, the plan is go through the draft triage report with you. Question for ICANN: ICANN, as other companies, may have an overall plan with milestones for GDPR implementation. The Temp Spec has an impact on ICANN Org as well as different departments inside ICANN. If ICANN has already reviewed its own work in certain areas or plans to do so, it would be helpful for our group to understand its thinking in relation to the EPDP’s work. · Part 4 of the Survey is due on Sunday. Due to a conflict, the GAC’s response will miss the due date but delivered prior to the discussion and so can be included in the report. · Re: Goran’s letter – Goran mentions how ICANN Org can share guidance from DPAs with the EPDP Working Group. Does Goran have more in mind that he would like share with us other than what is already posted on the blog? Curious how the EPDP Team can provide input to ICANN Org. Question for ICANN Org: The Council envisioned, via the Charter, to have direct participation of ICANN Org liaisons, within the EPDP Team. Is more needed here? · It seems ICANN is already posting everything it receives. It appears that ICANN Org is already creating an access model, so it may be useful to understand their work and our remit. · Is a report expected from each SO/AC/SG/C by 21 August? · No, in lieu of separate reports from each group, please complete Part 4 of the Survey, and we will continue to build the triage report from that. Correction: after the meeting it was determined that the question referred to the request for Early Input that was sent to community leaders. While not directly on the task list of this Team, the Team members should be aware of the opportunity and the 22 Aug due date. · What is ICANN’s plan with the access model? Will this be implemented, is there a timeline for implementation? Does this mean EPDP Team will not have input? 3. Summary of responses to EPDP Input Survey Part 3 - Results for Appendix D: Uniform Rapid Suspension, Appendix E: Uniform Domain Name Dispute Resolution Policy, Appendix G: Supplemental Procedures to the Transfer Policy · There seems to be agreement on many of these sections, but some serious issues were also raised. 4. Substantive Discussion of Temporary Specification: Part 3 of the Survey can be found at https://www.surveymonkey.com/r/7PWQPP7 Appendix D: Uniform Rapid Suspension Issue Summary: The majority of groups support the text of Appendix D as written or deferred to registrars. Otherwise, the following questions/issues were raised: Should the language "participate in another mechanism" in Section 1.1 be clarified or eliminated? Does the language in section 1.2 (for thin registries) create possible incompatibilities with existing URS procedures? There is currently no processing agreement with an Asian URS providers in place. Is this an issue for the EPDP Team? Does the term "contact details" in Section 2 of Annex D need to be further defined? Should language allowing the Complainant to file an amended URS Complaint once it receives registration data be included in Section 2? Is the review of Appendix D more appropriately addressed by the RPM PDP, and timing, i.e., should the review of Appendix D be deferred until after the EPDP Team deliberates on the access model/framework? Does Section 2 of Appendix D need additional safeguards to ensure against abuse, i.e., a complainant filing "doe complaints" in an attempt to get registration data? EPDP Team feedback: · Registrars are OK with this as the URS is working. Registrars have experience with ccTLDs, which publish no personal information in WHOIS. On question 3 regarding processing agreements, this also includes URS and UDRP providers. This, however, is not an issue for the EPDP Team, but could be addressed somewhere else in ICANN. · The changes made to the URS in the Temporary Specification allow the BC to use the mechanisms ICANN put in place. Waiting for another forum to decide this could result in issues, and if the URS no longer works, it will be a big problem for the BC. · With respect to incompatibilities, the existence of Appendix D allows the URS to go forward in spite of redacted WHOIS. We may have to look at Appendix D because the language is not bad, but it may cause issue with URS procedures, and the question is – should the EPDP Team fix it, or should the RPM Working Group deal with this? Specifically, with respect to “doe complaints”, one issue is under URS procedures, only the Complainant can amend a complaint, not the provider, but the language in the Temp Spec contradicts this. However, the RySG did not have major issues with the wording in Appendix D or E. Tweaks may be needed, but this should happen in the RPM Working Group, not the EPDP Team. · The RPM Working Group is a policy development group, and they are fashioning policy around the benefits and the cost, while the EPDP Team’s role is to make sure the procedure still works in light of the temp spec. · The RPM Working Group may be in a better position to understand the subtleties of the URS, but our job as the EPDP Team is to ensure the URS still works. If, for instance, the Team thinks it is reasonable to change a doe complaint, we should make these changes now. The problem with passing it off to the RPM Working Group is timing – they may not be in a position to make the changes right away, or conversely, they may finish before the EPDP Team has a chance to properly examine all of the issues. If there is a change needed to make these processes actually work, we should make the changes now. · Disagree with the coupling of the Temp Spec with issues related to URS. Not aware of any conflicts with the URS and the Temp Spec. Registries and Registrars seem to indicate there are no problems currently. There is not an access issue here that is not handled by existing procedures. · If contracted parties say this is OK as written, we can move along. If not, we need to fix that. · We could approach this in terms of what we know about the URS now. It would be helpful to be in the loop as to any changes the RPM Working Group foresees in terms of what the URS will look like in the future. As far as our task is concerned, there are a number of reasons why users may request access to registrant contact details. There are other features in the URS that allow complainants to file multiple complaints against the same registrant – the only way to do that would be to have all of the relevant contact details. Our task here is to determine what legitimate interests exist and whether they warrant access to contact details. We should keep an eye on what is happening with respect to the URS review, keeping in mind that it does need to be compliant with GDPR. This should be a two-way communication between the EPDP Team and the RPM WG. · RySG suggestion makes sense – make whatever tweaks we need to make sure that the URS works, knowing the RPM WG can fix it later. If we do not fix it, when the Temp Spec expires, the URS will not work. This language exists to ensure complainants can submit complaints even if they do not have access to the full data set. · From the registrar point of view, the URS and UDRP are working now. Trademark holders can file a complaint, and a balancing of interests takes place. In reference to the RPM WG, it is expected that what the group develops would be in line with data protection laws. · Does ICANN have an overall plan with compliance with GDPR? We should create a parking lot of issues that need to be resolved as a result of GDPR implementation, but that are not a part of the Temp Spec. If we have time, we can get to the issues in the parking lot, but if not, we can leave it to the next PDP. · There is a question regarding the data that is currently being shared as a part of URS, but we can take that up as part of the access discussion. · It is within the remit of the EPDP Team to discuss access to personal information due to URS and UDRP. · Reasonable access is part of this process, and it should not be parked. · It sounds like everyone agrees that the Temp Spec requires reasonable access, but it’s the EPDP Team’s job to define what reasonable access means. · Registrars are already required to provide reasonable access under the Temp Spec. The leap that some members are making in terms of having a policy to define what reasonable access means. Reasonable access is defined based on where the registrar is located is already happening under the Temp Spec. The EPDP Team has to answer gating questions before it can determine what uniform access will be. The sequence is clear in the charter. The question of reasonable access is an open question, not a question the EPDP Team must answer. · All GAC “yes” answers should be read as a qualified yes, since additional text is provided with each yes. We should discuss unified access at a later date, so we should not completely dissociate this issue. · All Members have different opinions on what reasonable is, and it may vary by jurisdiction. The difference in when we are talking about the URS/UDRP – if what we are doing in this group causes ICANN Consensus Policies to break, we need to address this so that the policies continue to be operable. · If members are going to state that access is not an appropriate topic, we should be careful about the words we use. Some are saying the words reasonable access, and others are saying we do not have to talk about access at all. These disconnects in the conversation are resulting in overhead and confusion. Appendix E: Uniform Domain Name Dispute Resolution Policy Issue Summary: The majority of groups support the text of Appendix E as written. Otherwise, the following questions/issues were raised: Should the language "participate in another mechanism" in Section 1.1 be clarified or eliminated? Does the language in section 1.2 create possible incompatibilities with existing UDRP procedures? Does Section 2 of Appendix E require additional safeguards to ensure against abuse, i.e., a complainant filing "doe complaints" in an attempt to get registration data? Should language allowing the Complainant to file an amended UDRP Complaint following receipt of registration data be included in Section 2 of Appendix E? Is the EPDP Team's review of Appendix E more appropriately addressed by the RPM PDP, and timing, i.e., should the review of Appendix E be deferred until after the EPDP Team deliberates on the access model/framework? EPDP Team Feedback: · All participants in the GAC have questions about what “participate in another mechanism” means. · We need more clarification on what “participate in another mechanism” means. · It seems to mean if the RPMs define a new mechanism or another mechanism is proven necessary, this language would allow for the new mechanism. Appendix G: Supplemental Procedures to the Transfer Policy Issue Summary: The following concerns/issues were flagged by groups not in support of the language as written: Does the revised transfer process create new security risks and vulnerabilities such as domain name theft and hijacking, and if so, should the EPDP Team address this as part of the work of this EPDP? Should this Team's consideration be affected by existing efforts to replace/modify the Transfer Policy? Does Section 1.2 of Appendix G, imposing redundant processes on the registrant, overly denigrate the user experience? Is there an alternative? Should the language "to be offered" be removed from Section 1 to avoid confusion? EPDP Team Feedback: · If we rely on the auth-code alone, we are severing the relationship between the gaining registrar and the registrant. An easy solution could be for the gaining registrar to use EPP to communicate with the the losing registrar and ask for the relevant contact information. · The last time the Transfer Policy was discussed in a PDP on whether the FOA was still needed, the decision was it was still needed. The Temp Spec says it is no longer needed, which goes against the conscious decision made in the previous PDP. · What is in the Temp Spec that has been created by the Tech-Ops group, which is comprised of registrars and registries. The language in the Temp Spec was the proposed solution from this group and it is working pretty well. When there is a transfer, there is always an FOA from the Losing Registrar to the registrant. The difference is there is no longer an incoming FOA (the FOA from the Gaining Registrar to the registrant). Regarding security, registrars do see an issue, and it is an old issue. WHOIS is redacted now and it becomes more complex to deal with unauthorized transfers, and this problem is amplified in the revised transfer process. The registrar suggestion is to deal with this outside of this EPDP because it is a very complex problem. · The RrSG put forward many comments and ideas, but the Registrar EPDP Team Members decided to include high-level comments only because registrars believe the Transfer Policy needs to be reviewed, but the review is not within the remit of the EPDP Team. What is in the Temp Spec is working for now, but we would support a review of the entire Transfer Policy at a later time. · If there is always an FOA, why do we need 1.1? · The Losing Registrar FOA is still required, but the FOA is no longer required from the Gaining Registrar. Transfers now work like this: https://www.realtimeregister.com/blog/post-gdpr-gtld-transfers/ · This is an important issue – preventing unauthorized hijacking is deeply important; however, this issue, per the registrars, could be discussed as part of Transfer Policy PDP, not within this EPDP Team. The Transfer Policy issue should be added to the “parking lot”. It is not clear if the Temp Spec is causing any notable problems that the EPDP Team needs to fix. · Transfer of information is very important, and it should be part of this Temp Spec. Unauthorized transfers and security issues should be addressed in this EPDP, and we should not dissociate these issues. · This Transfer Policy is currently working and for purposes of the temporary specification, if there are security concerns with how the Transfer Policy is working, the EPDP Team could examine those when we finish reviewing the Temp Spec. · Now that WHOIS from most registrars is redacted, it makes it harder for criminals to hack accounts since information is no longer displayed. While there are no detailed numbers to share right now, it is likely that domain theft has actually gone down under the revised transfer policy. · If numbers regarding reduced domain theft/hijacking could be provided in the future, it would be very useful for our purposes. · Does this updated process make transfers harder or easier on registrants? · From the registrar perspective, the updated process has resulted in less complaints, the transfer process got easier, and the resellers are happier. 4. Confirmation of action items and questions for ICANN Org, if any Action: Kurt sent a draft response to the EPDP Team for review. If any members have suggested edits or additional thoughts, please submit them by 01:00 UTC on 17 August (COB Los Angeles time). Action: EPDP Members should complete Part 4 of the Triage Survey by Sunday, 19 August by 19.00 UTC. Note that Part 4 of the Triage Survey includes Section 8 and Appendix C. Action: Kurt distributed the draft framework for the triage report, which is the EPDP Team’s first deliverable. The Leadership Team is still reviewing and populating the content of the triage report, but EPDP Team Members are welcome to provide comments or suggestions on the format at this stage. Questions for ICANN Org: If ICANN has already reviewed its own work in certain areas or plans to do so with respect to GDPR compliance implementation, it would be helpful for our group to understand its thinking in relation to the EPDP’s work. The Council envisioned, via the Charter, to have direct participation of ICANN Org liaisons, within the EPDP Team. Is more needed with respect to the EPDP Team’s engagement with ICANN Org? 5. Wrap and confirm next meeting to be scheduled for Tuesday 21 August at 13.00 UTC. (Part 4 Survey results due Sunday, 19 August by 19.00 UTC)

1 0

Recordings, attendance & AC chat from the GNSO Temp Spec gTLD RD EPDP held Thursday, 16 August 2018
by Andrea Glandon Aug. 16, 2018

Aug. 16, 2018

Dear all, Please find the attendance and AC chat attached to this email. The MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Thursday, 16 August 2018 at 13:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/owtpBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-16aug18… <https://urldefense.proofpoint.com/v2/url?u=https-3A__audio.icann.org_gnso_g…> AC Recording: https://participate.icann.org/p9q7tzi7okf/<https://participate.icann.org/p9q7tzi7okf/?OWASP_CSRFTOKEN=e491c17805cccb72…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ [community.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> Thank you. Kind Regards, Andrea Glandon

1 0

Congradulations
by Kavouss Arasteh Aug. 16, 2018

Aug. 16, 2018

Dear Kurt Dear ICANN Staff Support, Marika and other memeber of supporting team I have briefly reviewed your draft to be further reviewed by the Team before being sent to GNSO Council Being professional for more than 4 decade, I admire the devotion, skills ,attention, preciseness and valuable draft. ,in particular, conciseness of the Draft being prepared in such a short time I wish to formally and sincerely express my appreciation AND PROFOUND GRATITUDES which I am sure will be shared by other Members of the EPDP Team to yourself and the ICANN supporting Team for such a helpful and constructive draft Congratulations Kavouss

1 0

Re: [Gnso-epdp-team] FW: Fwd: Coordination between ICANN org and EPDP
by Arnaud WITTERSHEIM Aug. 16, 2018

Aug. 16, 2018

Thanks Kristina for the proposal to allow alternates to access the AC Room. It greatly helps to follow more easily the exchanges and thus be up to date information in the case where the alternate must replace a member. I was able to resume the history of the last exchanges and am therefore ready to follow the meeting later. Have a nice day Arnaud Le 16/08/2018 à 05:35, 'Rosette, Kristina' via ePDP team a écrit : > > FYI. Not sure of the timing of Kurt’s response so recommend that any > comments/proposed changes be provided to Alan, Marc and Arnaud > tomorrow. (Arnaud is acting as Member on my behalf until Monday.) > > K > > *From:*Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] *On > Behalf Of *Kurt Pritz > *Sent:* Wednesday, August 15, 2018 5:14 PM > *To:* GNSO EPDP <gnso-epdp-team(a)icann.org> > *Subject:* [Gnso-epdp-team] Fwd: Coordination between ICANN org and EPDP > > Hi Everyone: > > Yesterday, I received the email below from Göran Marby. I wanted those > of you who are interested to see and have the ability to comment on my > draft reply, which is immediately below Göran’s letter. > > The reply will be from me so I might not include all comments - not > necessarily because I disagree with the substance but it might be > because of tone, timing or level of detail. > > On the other hand, I’d be foolish not to consult with you as many of > you have been involved with ICANN efforts at correspondence and issue > resolution. If you have input, I will read and consider it carefully. > > I am not sure I want to make this a topic of discussion in tomorrow’s > meeting as finishing the triage is more important. I see the letter as > more of an invitation to start a dialogue where we can integrate > efforts, rather than pursue separate objectives. > > Best regards, > > Kurt > > > > Begin forwarded message: > > *From: *Goran Marby <goran.marby(a)icann.org > <mailto:goran.marby@icann.org>> > > *Subject: Coordination between ICANN org and EPDP* > > *Date: *August 14, 2018 at 8:17:13 AM PDT > > *To: *"rafik.dammak(a)gmail.com <mailto:rafik.dammak@gmail.com>" > <rafik.dammak(a)gmail.com <mailto:rafik.dammak@gmail.com>>, > "kurt(a)kjpritz.com <mailto:kurt@kjpritz.com>" <kurt(a)kjpritz.com > <mailto:kurt@kjpritz.com>> > > *Cc: *David Olive <david.olive(a)icann.org > <mailto:david.olive@icann.org>>, Theresa Swinehart > <theresa.swinehart(a)icann.org > <mailto:theresa.swinehart@icann.org>>, John Jeffrey > <john.jeffrey(a)icann.org <mailto:john.jeffrey@icann.org>>, "Akram > Atallah" <akram.atallah(a)icann.org > <mailto:akram.atallah@icann.org>>, Chris Disspain > <chris.disspain(a)board.icann.org > <mailto:chris.disspain@board.icann.org>>, > "leon.sanchez(a)board.icann.org > <mailto:leon.sanchez@board.icann.org>" > <leon.sanchez(a)board.icann.org > <mailto:leon.sanchez@board.icann.org>>, Cassia Oliveira > <cassia.oliveira(a)icann.org <mailto:cassia.oliveira@icann.org>> > > Kurt, > > Today, ICANN org held a call to provide community leaders with > updates regarding various GDPR activities. The slides and > recording of the call are available > athttps://www.icann.org/resources/pages/data-protection-meetings-2017-12-08…. > > On the call, a few community leaders reinforced the value of > coordination between ICANN org and the EPDP Working Group, > particularly around access model. To this end, please share with > us any thoughts you might have regarding a process by which (1) > ICANN org can share guidance we receive from the DPAs and European > Data Protection Board with the EPDP Working Group; and (2) How the > EPDP Working Group will provide input regarding access to ICANN > org to use in our interactions with DPAs and European Data > Protection Board to obtain legal guidance that will help guide the > Working Group in its work. As you know, we post all information we > receive through our blogs and engage with stakeholders, also > through communications we post whether through correspondence or > comments viagdpr(a)icann.org <mailto:gdpr@icann.org>. I look forward > to hearing your thoughts on how we can continue to strengthen our > work together toward the common goal of having an access model > that is guided by the law and supported by the community. > > Best regards, > > Göran Marby > > President & CEO ICANN > > +1(310) 578 8690 > > Cássia Oliveira > > Sr. Manager, Office of the President & CEO > > cassia.oliveira(a)icann.org <mailto:cassia.oliveira@icann.org> > > +1(310) 578 8656 > > Dear Goran: > > I have repeated some your email below so that there is a > clear connection between your questions and my responses. > > Today, ICANN org held a call to provide community leaders with updates > regarding various GDPR activities. The slides and recording of the > call are available at > https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en. > > On the call, a few community leaders reinforced the value of > coordination between ICANN org and the EPDP Working Group, > particularly around access model. To this end, please share with us > any thoughts you might have regarding a process by which: > > 1) ICANN org can share guidance we receive from the DPAs and > European Data Protection Board with the EPDP Working Group. > > a. Through its many recent actions: engaging with the ICANN > community, governments, the EDPB, and others, it is apparent that > ICANN is the midst of executing a plan to obtain certainty around the > various GDPR provisions. It would be instructive for the EPDP Team if > ICANN were to share its plan (or elements of it) so that the team can > anticipate the receipt (and timing) of new information. It would > also indicate where there is likely no additional information, i.e., > where the team would be left to draw conclusions based on the > information that is already available. This information would likely > cut down on the number of questions the ICANN Org receives from the team. > > We understand that the plan must have a degree of informality and be > flexible, with each step based upon the information received in the > step before it. However, where available, it would be instructive to > know the planned-for objectives, expected learnings, a set of ultimate > questions to be answered, planned inquiries, targets and so on. > > b. While ICANN has published each communication, the findings or > results of those communications have not been organized in anyway of > which we know. For example, observers of the back-and-forth between > the ICANN Org and the EDPB have offered conclusions that can be drawn > from these documents. However, no one has organized those conclusions > in a way that might become a rule set or set of guidelines for those > reviewing the Temporary Specification or creating an access model. > > > Coincidentally, in today’s EPDP meeting such a request was made: for > disclosure of all the communications with the EDPB and DPAs, the > staff commentary to those communications, and some organization of same. > > c. We also wish to hear of developments related to GDPR in other > industries, if available, such as: > > 1. what data processing protocols have been adopted > 2. what data processing protocols have been tested in courts > 3. what other privacy regimes are in works in other jurisdictions > 4. what data is available regarding: > > 1. the effects of GDPR on malfeasance detection, avoidance > 2. other positive or negative effects of GDPR > > > 2) How the EPDP Working Group will provide input regarding access > to ICANN org to use in our interactions with DPAs and European Data > Protection Board to obtain legal guidance that will help guide the > Working Group in its work. As you know, we post all information we > receive through our blogs and engage with stakeholders, also > through communications we post whether through correspondence or > comments via gdpr(a)icann.org <mailto:gdpr@icann.org>. > > a. The EPDP team’s third set of deliverables is to provide an, > “Initial Report and a Final Report regarding the EPDP Team’s > recommendations … for a System for Accredited Access to Non-Public > Registration Data.” Work on this could begin as early as > the completion and publication of the Initial Report on the > Temporary Specification. (The Team stays in close contact with the > GNSO Council leadership in pursuit of the deliverables to ensure the > spirit and letter of the EPDP Charter is followed.) > > b. While our current answer to this question is not yet finely > honed, it is likely that, from time to time, the EPDP Team will have > question regarding the constraints / opportunities imposed by the > GDPR. These questions might take the form of a proposed access model > (or elements of an access model). The EPDP Team will forward those to > ICANN, which, in turn, can test them against its own knowledge base, > with DPAs, with the EDPB, or elsewhere. > > c. As ICANN is a data controller involved in the collection, use > and disclosure of the same data that is the subject matter of this > Team’s work, it is expected that ICANN will work with the team on the > successor to the Temporary Specification and an access model. > > I hope you find this response helpful. The team is keen to continue an > active correspondence with ICANN in order to flesh out the > framework provided by GDPR with detailed clarifications, > implementation guidance and cases from other, similarly situated > industries that have faced many of these same issues. > > We also plan to remain in close communication with ICANN leaders > on this topic, through the ICANN-provided liaisons to the EPDP Team. > > Sincerely, > > -- > You received this message because you are subscribed to the Google > Groups "ePDP team" group. > To unsubscribe from this group and stop receiving emails from it, send > an email to epdp-team+unsubscribe(a)googlegroups.com > <mailto:epdp-team+unsubscribe@googlegroups.com>. > To post to this group, send email to epdp-team(a)googlegroups.com > <mailto:epdp-team@googlegroups.com>. > To view this discussion on the web visit > https://groups.google.com/d/msgid/epdp-team/c91e7ce1597342c995fecd08db01beb… > <https://groups.google.com/d/msgid/epdp-team/c91e7ce1597342c995fecd08db01beb…>. > For more options, visit https://groups.google.com/d/optout.

1 0

Slides + Part 3 Survey Results for 16 August EPDP Team Meeting
by Caitlin Tubergen Aug. 16, 2018

Aug. 16, 2018

Dear All, Please find a copy of the slides for our Thursday, 16 August EPDP Team meeting, as well as the results from Part 3 of the survey attached. Thank you. Best regards, Marika, Berry, and Caitlin From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Wednesday, August 15, 2018 at 10:29 AM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Proposed Agenda - EPDP Team Meeting #5 - 16 August at 13.00 UTC Dear All, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Thursday 16 August at 13.00 UTC. Note that the slides and other documents will follow later as survey responses have not all been received yet. Best regards, Caitlin, Berry and Marika EPDP Meeting #5 Agenda Thursday, 16 August 2018 Roll Call & SOI Updates Welcome and Updates from EPDP Team Chair Summary of responses to EPDP Input Survey Part 3 - Results for Appendix D: Uniform Rapid Suspension, Appendix E: Uniform Domain Name Dispute Resolution Policy, Appendix G: Supplemental Procedures to the Transfer Policy Substantive Discussion of Temporary Specification: Part 3 of the Survey can be found at https://www.surveymonkey.com/r/7PWQPP7 Appendix D: Uniform Rapid Suspension Appendix E: Uniform Domain Name Dispute Resolution Policy Appendix G: Supplemental Procedures to the Transfer Policy Confirmation of action items and questions for ICANN Org, if any Wrap and confirm next meeting to be scheduled for Tuesday 21 August at 13.00 UTC. (Part 4 Survey results due Sunday, 19 August by 19.00 UTC) Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses and visiting the GNSO Newcomer pages.

1 0

Fwd: Coordination between ICANN org and EPDP
by Kurt Pritz Aug. 15, 2018

Aug. 15, 2018

Hi Everyone: Yesterday, I received the email below from Göran Marby. I wanted those of you who are interested to see and have the ability to comment on my draft reply, which is immediately below Göran’s letter. The reply will be from me so I might not include all comments - not necessarily because I disagree with the substance but it might be because of tone, timing or level of detail. On the other hand, I’d be foolish not to consult with you as many of you have been involved with ICANN efforts at correspondence and issue resolution. If you have input, I will read and consider it carefully. I am not sure I want to make this a topic of discussion in tomorrow’s meeting as finishing the triage is more important. I see the letter as more of an invitation to start a dialogue where we can integrate efforts, rather than pursue separate objectives. Best regards, Kurt > Begin forwarded message: > > From: Goran Marby <goran.marby(a)icann.org> > Subject: Coordination between ICANN org and EPDP > Date: August 14, 2018 at 8:17:13 AM PDT > To: "rafik.dammak(a)gmail.com" <rafik.dammak(a)gmail.com>, "kurt(a)kjpritz.com" <kurt(a)kjpritz.com> > Cc: David Olive <david.olive(a)icann.org>, Theresa Swinehart <theresa.swinehart(a)icann.org>, John Jeffrey <john.jeffrey(a)icann.org>, "Akram Atallah" <akram.atallah(a)icann.org>, Chris Disspain <chris.disspain(a)board.icann.org>, "leon.sanchez(a)board.icann.org" <leon.sanchez(a)board.icann.org>, Cassia Oliveira <cassia.oliveira(a)icann.org> > > Kurt, > > Today, ICANN org held a call to provide community leaders with updates regarding various GDPR activities. The slides and recording of the call are available at https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en <https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en>. > > On the call, a few community leaders reinforced the value of coordination between ICANN org and the EPDP Working Group, particularly around access model. To this end, please share with us any thoughts you might have regarding a process by which (1) ICANN org can share guidance we receive from the DPAs and European Data Protection Board with the EPDP Working Group; and (2) How the EPDP Working Group will provide input regarding access to ICANN org to use in our interactions with DPAs and European Data Protection Board to obtain legal guidance that will help guide the Working Group in its work. As you know, we post all information we receive through our blogs and engage with stakeholders, also through communications we post whether through correspondence or comments via gdpr(a)icann.org <mailto:gdpr@icann.org>. I look forward to hearing your thoughts on how we can continue to strengthen our work together toward the common goal of having an access model that is guided by the law and supported by the community. > > Best regards, > > Göran Marby > President & CEO ICANN > +1(310) 578 8690 > > > Cássia Oliveira > Sr. Manager, Office of the President & CEO > cassia.oliveira(a)icann.org <mailto:cassia.oliveira@icann.org> > +1(310) 578 8656 Dear Goran: I have repeated some your email below so that there is a clear connection between your questions and my responses. Today, ICANN org held a call to provide community leaders with updates regarding various GDPR activities. The slides and recording of the call are available at https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en. On the call, a few community leaders reinforced the value of coordination between ICANN org and the EPDP Working Group, particularly around access model. To this end, please share with us any thoughts you might have regarding a process by which: 1) ICANN org can share guidance we receive from the DPAs and European Data Protection Board with the EPDP Working Group. a. Through its many recent actions: engaging with the ICANN community, governments, the EDPB, and others, it is apparent that ICANN is the midst of executing a plan to obtain certainty around the various GDPR provisions. It would be instructive for the EPDP Team if ICANN were to share its plan (or elements of it) so that the team can anticipate the receipt (and timing) of new information. It would also indicate where there is likely no additional information, i.e., where the team would be left to draw conclusions based on the information that is already available. This information would likely cut down on the number of questions the ICANN Org receives from the team. We understand that the plan must have a degree of informality and be flexible, with each step based upon the information received in the step before it. However, where available, it would be instructive to know the planned-for objectives, expected learnings, a set of ultimate questions to be answered, planned inquiries, targets and so on. b. While ICANN has published each communication, the findings or results of those communications have not been organized in anyway of which we know. For example, observers of the back-and-forth between the ICANN Org and the EDPB have offered conclusions that can be drawn from these documents. However, no one has organized those conclusions in a way that might become a rule set or set of guidelines for those reviewing the Temporary Specification or creating an access model. Coincidentally, in today’s EPDP meeting such a request was made: for disclosure of all the communications with the EDPB and DPAs, the staff commentary to those communications, and some organization of same. c. We also wish to hear of developments related to GDPR in other industries, if available, such as: what data processing protocols have been adopted what data processing protocols have been tested in courts what other privacy regimes are in works in other jurisdictions what data is available regarding: the effects of GDPR on malfeasance detection, avoidance other positive or negative effects of GDPR 2) How the EPDP Working Group will provide input regarding access to ICANN org to use in our interactions with DPAs and European Data Protection Board to obtain legal guidance that will help guide the Working Group in its work. As you know, we post all information we receive through our blogs and engage with stakeholders, also through communications we post whether through correspondence or comments via gdpr(a)icann.org. a. The EPDP team’s third set of deliverables is to provide an, “Initial Report and a Final Report regarding the EPDP Team’s recommendations … for a System for Accredited Access to Non-Public Registration Data.” Work on this could begin as early as the completion and publication of the Initial Report on the Temporary Specification. (The Team stays in close contact with the GNSO Council leadership in pursuit of the deliverables to ensure the spirit and letter of the EPDP Charter is followed.) b. While our current answer to this question is not yet finely honed, it is likely that, from time to time, the EPDP Team will have question regarding the constraints / opportunities imposed by the GDPR. These questions might take the form of a proposed access model (or elements of an access model). The EPDP Team will forward those to ICANN, which, in turn, can test them against its own knowledge base, with DPAs, with the EDPB, or elsewhere. c. As ICANN is a data controller involved in the collection, use and disclosure of the same data that is the subject matter of this Team’s work, it is expected that ICANN will work with the team on the successor to the Temporary Specification and an access model. I hope you find this response helpful. The team is keen to continue an active correspondence with ICANN in order to flesh out the framework provided by GDPR with detailed clarifications, implementation guidance and cases from other, similarly situated industries that have faced many of these same issues. We also plan to remain in close communication with ICANN leaders on this topic, through the ICANN-provided liaisons to the EPDP Team. Sincerely,

1 0

For your review - EPDP Team Communications Plan
by Marika Konings Aug. 15, 2018

Aug. 15, 2018

Dear All, Following yesterday’s meeting, please find attached for your review the proposed EPDP Team Communications Plan that has been developed with the support of our colleague Arial Liang. You are encouraged to provide any suggestions, comments and/or input you may have. Thanks, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

2 1