August 2018 - Gnso-epdp-team

***REMINDER*** Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 28 August 2018 at 13:00 UTC
by Julie Bisland Aug. 27, 2018

Aug. 27, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesday’s and Thursday’s at 13:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/UxhpBQ Kind Regards, Andrea Glandon

1 0

Re: [Gnso-epdp-team] Correction!!
by Hadia Abdelsalam Mokhtar EL miniawi Aug. 27, 2018

Aug. 27, 2018

Hi Aslam, The charter says " .. complying with the GDPR and other relevant privacy and data protection law .." However this is not the issue nor will it in my opinion add any hurdles to our mission. Best Hadia _______________________________________ From: Aslam Mohamed <gmohamedaslam(a)gmail.com> Sent: 26 August 2018 19:22 To: Hadia Abdelsalam Mokhtar EL miniawi Cc: Mueller, Milton L; Heineman, Ashley; gnso-epdp-team(a)icann.org; Mohamed Aslam Subject: Re: [Gnso-epdp-team] Correction!! Sorry to interrupt Hadia. My understanding is EPDP was tasked to find a way to gain access to WHOIS data without running foul of GDPR and nothing else..compliance with other laws was not part of the EPDP mandate. Anyone to please correct me if my understanding was wrong? Best > On Aug 26, 2018, at 12:51 PM, Hadia Abdelsalam Mokhtar EL miniawi <Hadia(a)tra.gov.eg> wrote: > > Dear All, > > > First off, I would like to mention that it is highly unlikely that ALAC will have alternates present a the F2F meeting, however I have a couple of remarks. First, and as mentioned by others, none of the members represent their personal views but rather the views of their respective group and thus the request for the presence of the alternates is to ensure that the group is well represented and that the alternates are able to step in efficiently and effectively if required to do so. Second, to assume that the alternates and members are present to lobby for what they think is in the best interest of their stakeholder group is not realistic because the mandate of the Temp Spec EPDP team is to ensure that the temp spec as is, or with modifications complies with the GDPR and other relevant laws, so we are all here to work together to ensure compliance, ultimately we all have the same goal. If there are still unresolved items that do not relate to the compliance issue the EPDP team can always recommend future work to the GNSO. > > > Hadia Elminiawi (M.Sc.) > > Director, DNS Entrepreneurship Center > > ________________________________ > From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Mueller, Milton L <milton(a)gatech.edu> > Sent: 24 August 2018 21:20 > To: Mueller, Milton L; Heineman, Ashley > Cc: gnso-epdp-team(a)icann.org > Subject: [Gnso-epdp-team] Correction!! > > Facepalm. > > I meant THREE (3) fully participating GAC members, not 2. Lost track of their assigned number. > > > From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Mueller, Milton L > Sent: Friday, August 24, 2018 2:41 PM > To: Heineman, Ashley <AHeineman(a)ntia.doc.gov> > Cc: gnso-epdp-team(a)icann.org > Subject: Re: [Gnso-epdp-team] Travel Planning to Los Angeles > > Ashley > I don’t think we need to make a big deal of this. I am fine with letting alternates come, but please let’s stick to the rules in the charter about each unit’s representation. That’s what my colleagues seem to be concerned about, and with good cause. So, e.g., if GAC has 3 or 4 people come, _only_ two of them can participate at a time, and that includes those on the telephone participating remotely. Same deal on our side. Confer all you like in the hallways, chat apps, coffee breaks and Facetime but don’t try to expand the number of full participants assigned to your AC/SG. That’s a basic matter of fairness and of adherence to the group’s charter. > > I really don’t want to have to monitor that during the meeting, but I am telling everyone now I will be watching that like a hawk, and I expect the ePDP chair and ICANN staff to be doing so, also. > > Dr. Milton L Mueller > Professor, School of Public Policy<http://spp.gatech.edu/> > Georgia Institute of Technology > Internet Governance Project > http://internetgovernance.org/ > > > > > From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Heineman, Ashley > Sent: Friday, August 24, 2018 10:32 AM > To: Farzaneh Badiei <farzaneh.badii(a)gmail.com<mailto:farzaneh.badii@gmail.com>>; Ayden Férdeline <icann(a)ferdeline.com<mailto:icann@ferdeline.com>> > Cc: Mark Svancarek \ via Gnso-epdp-team <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> > Subject: Re: [Gnso-epdp-team] Travel Planning to Los Angeles > > > Dear EPDP colleagues, > > > > The United States is concerned that there appears to be a concerted attempt to block the ability of EPDP members and alternates to communicate and confer with each other in real time whether during the regular teleconferences or face to face meetings. To be clear, no one has requested an expansion of the alternates’ role or that alternates speak in addition to members during formal EPDP meetings. No one has requested additional travel support for alternates. Rather, we request that the procedures and protocols for teleconferences and face to face meetings support the ability of members and alternates to confer in real time as they carry out the important and time-sensitive work of the EPDP. > > > > The EPDP Charter clearly articulates that the members are not to represent individual views or positions and thus requires the ability to confer. Nothing in the Charter bars alternates from real time access to meetings or communicating with their primary member colleagues so long as they do not seek to step into to the primary member’s role by addressing remarks to the entire group. > > > > While we fully appreciate and are happy to comply with the EPDP Charter that has limited participation to prescribed numbers, we cannot support overt attempts to stymie openness and transparency as well as the ability of members to confer with colleagues to ensure we are representing the views/formal positions of our SG/C or SO/AC. In the interest of transparency and to promote the efficient work of the EPDP, we urge the EPDP leadership to take steps to ensure that alternates and members are able to attend face to face meetings and teleconferences. > > > > Thanks and I hope we can reach agreement to ensure the successful engagement and ultimate conclusion of the EPDP. > > > > > > ________________________________ > From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Ayden Férdeline <icann(a)ferdeline.com<mailto:icann@ferdeline.com>> > Sent: Friday, August 24, 2018 4:59 AM > To: farzaneh badii > Cc: Mark Svancarek \ via Gnso-epdp-team > Subject: Re: [Gnso-epdp-team] Travel Planning to Los Angeles > > +1 Farzaneh. > > This is not the time to re-write the rules and re-define what is the role of the alternate. The distinction between a member and an alternate is important. > > —Ayden > > On 23 Aug 2018, at 19:05, farzaneh badii <farzaneh.badii(a)gmail.com<mailto:farzaneh.badii@gmail.com>> wrote: > > Dear Kurt > > We have been raising objections about alternates being able to be present at the meeting when they do not replace a member. > > We have provided reasons which I reiterate here: > > 1. Principle: the EPDP membership structure was designed carefully to reach the right balance and representation. Presence of alternates even if they do not speak during the meeting meddles with the balance. Here are my reasons: Alternates can discuss face to face outside of the meeting about the issues, discuss with their counterparts and relay their views much easier so that they can be channeled through the meeting. Nothing inherently wrong with that, but it should not be facilitated either. They can do it on chat, but face to face is more effective. > > 2. Setting precedent: we agreed on the balance of representation and the role of members and alternates at GNSO. We are opening the door to meddling in this role. > > > 3. Unclear intention: What is the intention here exactly? Why are we accommodating this request? I would like to hear why this request was made initially. If the presence of alternates in the room makes no difference, then they can just sit behind their computer and discuss with their colleagues through other means. I am not implying at all that there is a bad intention. But the intention is not clear. Is it to easily replace a member if they are tired in the middle of the meeting? I don't think this is a football match. > > 4. Imbalance of power: Bringing the alternates, in my opinion, adds to the strength of a group and makes it easier for them to deliberate spontaneously. Some groups have the funds to bring in their alternates, some don't. So there will be power imbalance. You could argue that I can just bring in NCSG alternates too. That is not possible. Because they live around the world and we don't have funding to bring them. Also it's against the principle I mentioned above. > > > As a group that has had to fight for being given equal representation in this EPDP, I find it puzzling that accommodating such requests that can bring imbalance of representation is being done so easily. > > > Best > > > > Farzaneh > > > On Thu, Aug 23, 2018 at 12:36 PM Kurt Pritz <kurt(a)kjpritz.com<mailto:kurt@kjpritz.com>> wrote: > Hello Everyone: > > After reviewing the chat and content of our call Tuesday, 21 August, it has been decided to proceed with the meeting in Los Angeles as proposed. (See bullet three, below.) > > 1. Members who are attending in person already should have travel arrangements in process. > > 2. Members unable to attend should have designated their alternates for attendance, who should be in contact with ICANN regarding travel arrangements. (See Alternate Assignment form, https://docs.google.com/forms/d/e/1FAIpQLScuCvS7vKS4MuaXwJmDcUHtOTskg6t5qrS…<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.googl…>) Remote participation is available for members that prefer to participate remotely instead of designating an alternate. > > 3. Members who are attending but will miss a portion of the meeting should designate an alternate who will replace that member when they are gone from the meeting for a significant period. That alternate will be permitted to sit in on the entire three-day meeting but participate only when the member is absent from the meeting. In these cases, alternates will not be provided travel funding. Travel funding is allocated based on the number of members in each group. > > Remote participation will also be available for those members that prefer to participate remotely instead of designating an alternate. > > If any of the above is not clear or if you have questions, you can contact me, Rafik or the ICANN Support Team. > > Through this email, I am asking Terri Agnew to follow up with you to ensure all necessary travel is planned and funded. > > I am looking forward to the meeting and commit to work with the support staff to make the effort on your part worth your while. > > Best regards, > > Kurt > > _______________________________________________ > Gnso-epdp-team mailing list > Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> > https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmm.icann.o…> > > _______________________________________________ > Gnso-epdp-team mailing list > Gnso-epdp-team(a)icann.org > https://mm.icann.org/mailman/listinfo/gnso-epdp-team

1 0

Correction!!
by Mueller, Milton L Aug. 26, 2018

Aug. 26, 2018

Facepalm. I meant THREE (3) fully participating GAC members, not 2. Lost track of their assigned number. From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Mueller, Milton L Sent: Friday, August 24, 2018 2:41 PM To: Heineman, Ashley <AHeineman(a)ntia.doc.gov> Cc: gnso-epdp-team(a)icann.org Subject: Re: [Gnso-epdp-team] Travel Planning to Los Angeles Ashley I don't think we need to make a big deal of this. I am fine with letting alternates come, but please let's stick to the rules in the charter about each unit's representation. That's what my colleagues seem to be concerned about, and with good cause. So, e.g., if GAC has 3 or 4 people come, _only_ two of them can participate at a time, and that includes those on the telephone participating remotely. Same deal on our side. Confer all you like in the hallways, chat apps, coffee breaks and Facetime but don't try to expand the number of full participants assigned to your AC/SG. That's a basic matter of fairness and of adherence to the group's charter. I really don't want to have to monitor that during the meeting, but I am telling everyone now I will be watching that like a hawk, and I expect the ePDP chair and ICANN staff to be doing so, also. Dr. Milton L Mueller Professor, School of Public Policy<http://spp.gatech.edu/> Georgia Institute of Technology Internet Governance Project http://internetgovernance.org/ From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Heineman, Ashley Sent: Friday, August 24, 2018 10:32 AM To: Farzaneh Badiei <farzaneh.badii(a)gmail.com<mailto:farzaneh.badii@gmail.com>>; Ayden Férdeline <icann(a)ferdeline.com<mailto:icann@ferdeline.com>> Cc: Mark Svancarek \ via Gnso-epdp-team <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Travel Planning to Los Angeles Dear EPDP colleagues, The United States is concerned that there appears to be a concerted attempt to block the ability of EPDP members and alternates to communicate and confer with each other in real time whether during the regular teleconferences or face to face meetings. To be clear, no one has requested an expansion of the alternates' role or that alternates speak in addition to members during formal EPDP meetings. No one has requested additional travel support for alternates. Rather, we request that the procedures and protocols for teleconferences and face to face meetings support the ability of members and alternates to confer in real time as they carry out the important and time-sensitive work of the EPDP. The EPDP Charter clearly articulates that the members are not to represent individual views or positions and thus requires the ability to confer. Nothing in the Charter bars alternates from real time access to meetings or communicating with their primary member colleagues so long as they do not seek to step into to the primary member's role by addressing remarks to the entire group. While we fully appreciate and are happy to comply with the EPDP Charter that has limited participation to prescribed numbers, we cannot support overt attempts to stymie openness and transparency as well as the ability of members to confer with colleagues to ensure we are representing the views/formal positions of our SG/C or SO/AC. In the interest of transparency and to promote the efficient work of the EPDP, we urge the EPDP leadership to take steps to ensure that alternates and members are able to attend face to face meetings and teleconferences. Thanks and I hope we can reach agreement to ensure the successful engagement and ultimate conclusion of the EPDP. ________________________________ From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Ayden Férdeline <icann(a)ferdeline.com<mailto:icann@ferdeline.com>> Sent: Friday, August 24, 2018 4:59 AM To: farzaneh badii Cc: Mark Svancarek \ via Gnso-epdp-team Subject: Re: [Gnso-epdp-team] Travel Planning to Los Angeles +1 Farzaneh. This is not the time to re-write the rules and re-define what is the role of the alternate. The distinction between a member and an alternate is important. -Ayden On 23 Aug 2018, at 19:05, farzaneh badii <farzaneh.badii(a)gmail.com<mailto:farzaneh.badii@gmail.com>> wrote: Dear Kurt We have been raising objections about alternates being able to be present at the meeting when they do not replace a member. We have provided reasons which I reiterate here: 1. Principle: the EPDP membership structure was designed carefully to reach the right balance and representation. Presence of alternates even if they do not speak during the meeting meddles with the balance. Here are my reasons: Alternates can discuss face to face outside of the meeting about the issues, discuss with their counterparts and relay their views much easier so that they can be channeled through the meeting. Nothing inherently wrong with that, but it should not be facilitated either. They can do it on chat, but face to face is more effective. 2. Setting precedent: we agreed on the balance of representation and the role of members and alternates at GNSO. We are opening the door to meddling in this role. 3. Unclear intention: What is the intention here exactly? Why are we accommodating this request? I would like to hear why this request was made initially. If the presence of alternates in the room makes no difference, then they can just sit behind their computer and discuss with their colleagues through other means. I am not implying at all that there is a bad intention. But the intention is not clear. Is it to easily replace a member if they are tired in the middle of the meeting? I don't think this is a football match. 4. Imbalance of power: Bringing the alternates, in my opinion, adds to the strength of a group and makes it easier for them to deliberate spontaneously. Some groups have the funds to bring in their alternates, some don't. So there will be power imbalance. You could argue that I can just bring in NCSG alternates too. That is not possible. Because they live around the world and we don't have funding to bring them. Also it's against the principle I mentioned above. As a group that has had to fight for being given equal representation in this EPDP, I find it puzzling that accommodating such requests that can bring imbalance of representation is being done so easily. Best Farzaneh On Thu, Aug 23, 2018 at 12:36 PM Kurt Pritz <kurt(a)kjpritz.com<mailto:kurt@kjpritz.com>> wrote: Hello Everyone: After reviewing the chat and content of our call Tuesday, 21 August, it has been decided to proceed with the meeting in Los Angeles as proposed. (See bullet three, below.) 1. Members who are attending in person already should have travel arrangements in process. 2. Members unable to attend should have designated their alternates for attendance, who should be in contact with ICANN regarding travel arrangements. (See Alternate Assignment form, https://docs.google.com/forms/d/e/1FAIpQLScuCvS7vKS4MuaXwJmDcUHtOTskg6t5qrS…<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.googl…>) Remote participation is available for members that prefer to participate remotely instead of designating an alternate. 3. Members who are attending but will miss a portion of the meeting should designate an alternate who will replace that member when they are gone from the meeting for a significant period. That alternate will be permitted to sit in on the entire three-day meeting but participate only when the member is absent from the meeting. In these cases, alternates will not be provided travel funding. Travel funding is allocated based on the number of members in each group. Remote participation will also be available for those members that prefer to participate remotely instead of designating an alternate. If any of the above is not clear or if you have questions, you can contact me, Rafik or the ICANN Support Team. Through this email, I am asking Terri Agnew to follow up with you to ensure all necessary travel is planned and funded. I am looking forward to the meeting and commit to work with the support staff to make the effort on your part worth your while. Best regards, Kurt _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmm.icann.o…>

2 1

Proposed Agenda - EPDP Team Meeting #8 - 28 August at 13.00 UTC
by Marika Konings Aug. 25, 2018

Aug. 25, 2018

Dear All, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 28 August at 13.00 UTC. Please also take note of the separate message that was sent by Kurt re. homework. Best regards, Caitlin, Berry and Marika EPDP Meeting #8 Agenda Tuesday, 28 August 2018 1. Roll Call & SOI Updates (2 min) 1. Welcome and Updates from EPDP Team Chair (3 min) 1. Reconcile input received on Triage Report, if needed, and confirm report for submission to the GNSO Council (5-10 min) 1. Review of project plan (10 min) (see also section category allocation attached) 1. Touch base on comments received on & review status of: (10-20 min) 1. Appendix D – Uniform Rapid Suspension (see discussion summary index (DSI) at https://community.icann.org/x/ExxpBQ) 1. Appendix E – Uniform Domain Name Resolution Dispute Policy (see DSI at https://community.icann.org/x/ExxpBQ) 1. Appendix G: Supplemental Procedures to the Transfer Policy (see DSI at https://community.icann.org/x/ExxpBQ) 1. Commence deliberations for section 4.4 – Lawfulness and Purpose of Processing gTLD Registration Data (see DSI at https://community.icann.org/x/ExxpBQ) (50 min) 1. Confirm action items and questions for ICANN Org, if any (5 min) 1. Wrap and confirm next meeting to be scheduled for Thursday 30 August at 13.00 UTC.) Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

1 0

Preparation for next meeting with attachment and link
by Kurt Pritz Aug. 24, 2018

Aug. 24, 2018

Dear All: As mentioned, there is a homework assignment for our next meeting. I apologize for this coming out so late but I hope you recorded some of these from the meeting discussion on homework and have been thinking about them. 1. Temporary Specification sections 4.4.1-4.4.13: Please review the attached discussion summary index (DSI) for section 4.4.1-13, as well as your own notes and the record of the triage discussion. Our discussion’s objective is to redline this section so that it complies with GDPR taking into account: · advice provided by the EDPB, · input that has been provided by other members of the EPDP Team, (All the information cited above is included in the DSI.) It will be very helpful if you share proposals regarding each of the with the mailing list as soon as possible, and particularly by Monday 18.00 UTC. The purpose in gathering written comment is so that commonalities can be identified in your proposals in order to better focus the discussion. 2. Appendix D, E and G: Provide proposed edits (using the DSIs if possible) for Appendix D, E and G, having to do with URS, UDRP and Transfers, respectively. Please share your proposed edits to these sections on the mailing list that would address the comments / issues that have been identified. Understanding that these sections have already been put into operation, please flag specific changes that are required to be addressed in the initial report, i.e., are of an urgent nature, needing to be addressed as a matter of priority. Links to all the DSIs will be posted to: https://community.icann.org/x/ExxpBQ <https://community.icann.org/x/ExxpBQ> For the meeting Tuesday, I think having printouts of the DSIs and your Temporary Specification would be handy. In some cases we might decide that certain sections do not affect Temporary Specification compliance with GDPR and can be placed for later discussion. I am working on a discussion flow for our next meeting to make efficient and meaningful use of your time. If you have thoughts on this please let me know. I will follow up on this with my thoughts in a subsequent email. Thanks in advance for providing your thoughts on these issues. Best regards, Kurt

1 0

Preparation for next meeting
by Kurt Pritz Aug. 24, 2018

Aug. 24, 2018

Dear All: As mentioned, there is a homework assignment for our next meeting. I apologize for this coming out so late but I hope you recorded some of these from the meeting discussion on homework and have been thinking about them. 1. Temporary Specification sections 4.4.1-4.4.13: Please review the attached discussion summary index (DSI) for section 4.4.1-13, as well as your own notes and the record of the triage discussion. Our discussion’s objective is to redline this section so that it complies with GDPR taking into account: · advice provided by the EDPB, · input that has been provided by other members of the EPDP Team, (All the information cited above is included in the DSI.) It will be very helpful if you share proposals regarding each of the with the mailing list as soon as possible, and particularly by Monday 18.00 UTC. The purpose in gathering written comment is so that commonalities can be identified in your proposals in order to better focus the discussion. 2. Appendix D, E and G: Provide proposed edits (using the DSIs if possible) for Appendix D, E and G, having to do with URS, UDRP and Transfers, respectively. Please share your proposed edits to these sections on the mailing list that would address the comments / issues that have been identified. Understanding that these sections have already been put into operation, please flag specific changes that are required to be addressed in the initial report, i.e., are of an urgent nature, needing to be addressed as a matter of priority. In some cases we might decide that certain sections do not affect Temporary Specification compliance with GDPR and can be placed for later discussion. I am working on a discussion flow for our next meeting to make efficient and meaningful use of your time. If you have thoughts on this please let me know. I will follow up on this with my thoughts in a subsequent email. Thanks in advance for providing your thoughts on these issues. Best regards, Kurt

1 0

Travel Planning to Los Angeles
by Kurt Pritz Aug. 24, 2018

Aug. 24, 2018

Hello Everyone: After reviewing the chat and content of our call Tuesday, 21 August, it has been decided to proceed with the meeting in Los Angeles as proposed. (See bullet three, below.) 1. Members who are attending in person already should have travel arrangements in process. 2. Members unable to attend should have designated their alternates for attendance, who should be in contact with ICANN regarding travel arrangements. (See Alternate Assignment form, https://docs.google.com/forms/d/e/1FAIpQLScuCvS7vKS4MuaXwJmDcUHtOTskg6t5qrS…) Remote participation is available for members that prefer to participate remotely instead of designating an alternate. 3. Members who are attending but will miss a portion of the meeting should designate an alternate who will replace that member when they are gone from the meeting for a significant period. That alternate will be permitted to sit in on the entire three-day meeting but participate only when the member is absent from the meeting. In these cases, alternates will not be provided travel funding. Travel funding is allocated based on the number of members in each group. Remote participation will also be available for those members that prefer to participate remotely instead of designating an alternate. If any of the above is not clear or if you have questions, you can contact me, Rafik or the ICANN Support Team. Through this email, I am asking Terri Agnew to follow up with you to ensure all necessary travel is planned and funded. I am looking forward to the meeting and commit to work with the support staff to make the effort on your part worth your while. Best regards, Kurt

7 6

Notes and action items from today's EPDP Team Meeting - 23 August 2018
by Caitlin Tubergen Aug. 23, 2018

Aug. 23, 2018

Dear All, Below, please find notes and action items from today’s EPDP Team Call. As a reminder, our next meeting will be Tuesday, 28 August, 13:00 UTC. Best regards, Marika, Berry, and Caitlin EPDP Team Meeting - 23 August 2018 High-level Notes/Actions: Please provide additional input (if any) on the Triage Report by Friday, 24 August at 19.00 UTC. The Triage Report, scheduled for release early next week, will include the following appendices or companion documents: all the survey responses sorted by group and sorted by Temporary Specification section; a print version of the opening statements made by each group; Early Inputs submitted by each group. The Team has now begun substantive discussion of the Temporary Specification. As a tool to aid in these discussions, the support team will distribute discussion summary indexes for each survey section, which provides the relevant Temporary Specification text, related charter question(s), EPDP Team Members’ feedback provided to date (via the triage surveys), related EDPB advice (if any). The discussion summary index also provides a field in which EPDP Team Members may propose modified text. Members of the group raised the utility of performing a privacy impact assessment. Three takeaways were for members to understand the benefits of such an assessment in the work, suggest which elements could be helpful to undertake (given the timeline), and also to ask ICANN if it was planned that an impact assessment will be undertaken. See, https://bit.ly/2OVgeYY. In discussing whether and how other privacy regimes impact our work, the support team pointed out that other privacy regulations can be found at https://bit.ly/2PxFt4I. It was also indicated by Thomas and Alan that, as a generalization, GDPR provides a “high-water mark. I.e., if our work is GDPR compliant, it should be universally compliant. It was suggested that ICANN be asked to perform an assessment to determine if other privacy regimes should be analyzed for possible inclusion into this work. Per the proposed strategy discussed today, the Leadership Team is working together to propose a detailed project plan, which outlines the order in which the EPDP Team will deliberate on the sections of the Temporary Specification. For more detail on the strategy, please refer to the detailed notes. With regard to next steps, there were several recommendations that we examine the purposes of collecting and purposes of accessing data. That input matches with the existing plan to undertake a look at sections 4.4.1-4.4.13 next, which describe the uses of data. The corresponding discussion summary index that will be distributed for this discussion will include the charter questions that might be answered in parallel with this inquiry. As a prerequisite to that discussion, we will discuss the purposes of collecting data. This was discussed in depth in the RDS working group and the support team will document the findings by that working group. All Action Items: Preliminary input on the triage report is due Friday, 24 August. Goal is to submit the triage report early next week. For any groups who plan to respond to the requests to provide early input, please do so as soon as possible. Support Team to provide EPDP Team with output of RDS PDP WG’s work on which data elements are required to register a domain name and maintain that registration. EPDP Team members to look at the discussion summary indexes for Appendix D, E, F and provide recommend redlines (if any) to the email list. We will attempt to address these sections via email rather than take up meeting time with them. Support team to distribute discussion summary index for Section 4.4, as well as RDS findings with regards to the purposes of collecting registrant data. EPDP Team members to review discussion summary index for Section 4.4 in preparation to discuss at next EPDP Team meeting on Tuesday, 28 August at 13.00 UTC These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates Attendance will be taken via the Adobe Connect Room. SOIs must be kept up-to-date. All relevant documentation can be found on the EPDP wiki space. Please remember to state your name before speaking. 2. Welcome and Updates from EPDP Team Chair We will be moving from discussing every section of the Temporary Specification in the triage surveys and turning to a substantive review of specific sections. We will spend the first part of the meeting discussing the strategy for moving forward. 3. Preliminary input on Triage Report (deadline for input: Friday, 24 August at 19:00 UTC) Preliminary input on the triage report is due Friday, 24 August. Goal is to submit the triage report early next week. As a reminder, for any group who would like to respond to the early input requests, please do so as soon as possible. The triage report will be updated to include all submitted comments. 4. Proposed approach for moving forward, including review of proposed project plan A GDPR-compliant specification is required by 25 May, requiring a good portion of our work to be completed in October. GDPR-compliance requires, among other things, that the sections specifying processor requirements must have the consensus support of this team Some prioritization is required that takes into account: The time available Sections that require registrar / registry & other processor actions Issue complexity Which sections are already in operation and functioning Availability of EDPB and other guidance Further guidance is possible (dependent on timing) New questions for EDPB or DPAs Clarification requests of existing guidance But case law and standard practices will be lacking EPDP Team feedback: The goal is to comply with GDPR Any successor should take into account emerging privacy law in other jurisdictions. Aiming to tackle the topic of privacy in a more holistic way would be a more efficient use of our time. Examples could include privacy-by-design principles or a privacy impact assessment What is a privacy impact assessment? Generally, a privacy impact assessment would be a systematic process conducted by government agencies or businesses to reflect on privacy and see how various practices impact individuals Is some sort of survey needed of other privacy regimes? A privacy impact assessment has been around in several jurisdictions for years. The only problem in doing a privacy impact assessment is that it's only as good as the framework you apply, and since there are over 100 national laws around the world, you would have to select the leader or come up with a framework that allows you to select other laws. In the context of emerging legislative and regulatory initiatives that may impact on ICANN, please see https://www.icann.org/en/system/files/files/legislative-regulatory-fy18-23a…. This is something that is actively being tracked. It might not be necessary to select a particular regime for a privacy impact assessment. The GDPR is principle-based, and the principles can be applied broadly. The privacy impact assessment could be based on broad principles. What we are effectively doing in the EPDP is a privacy impact assessment of the temp spec ourselves -- for example, are the purposes connected to a solid legal basis? Doing a privacy impact assessment for ICANN would be a complicated and expensive exercise. Other companies may look at this type of work as a threat assessment -- what are we trying to protect? Who has access to it? Who is using it? Is there a specific question to ask ICANN - whether any of the other regimes create requirements above and beyond the GDPR? Proposed Criteria for Discussion Planning Priority must be assigned to those sections: affected by EDPB advice, i.e., where change is mandated by advice received after the specification was written where the Team has indicated the likelihood that change is required to bring the section into compliance with GDPR Requiring less attention are issues that are not expected to impact the Temporary Specification’s compliance with the GDPR, such as: operations changes to existing consensus policy such as UDRP or Transfers requirements issues that can be settled after the initial report is launched, e.g., SLAs to be negotiated between contracted parties and ICANN, Best practices and reporting requirements where it is thought the Temporary Specification is overly prescriptive Unless a pre-requisite to the issues above, those items that do not direct registry and registrar actions can be considered as time is available such as: background, rationale, justification, administrative sections. Sections affected by EPDB are Category 1. Sections where the Team Indicated Amendment to the Temp Spec is desirable are Category 2. Sections related to transfers, DRPs and require little or no change, are Category 3. Sections involving background, admin are Category 4. For sections where there is pertinent EDPB guidance or where the Team has indicated a likelihood that change is required: Allocate time to ensure a common understanding of: The Temporary Specification section Existing EDPB advice or other authority Previous discussion and the issues raised Deliberate what changes, if any, are required, to ensure that the advice has been addressed. As these are more complex issues the discussion might be plan to extend over (a part of) two or three sequential meetings. If it becomes clear that additional information, research or guidance is necessary, or that progress might be facilitated by offline discussion between two or more parties, then a small group might be assigned work, that will operate based on the task assigned: Populated by interested and necessary parties Working methods (e.g., email, conference) based on the task assigned With delivery set to support a delivery of the initial report This approach is meant to be flexible. For sections that are not expected to impact the Temporary Specification’s compliance with the GDPR, or those items that do not direct registry, registrar and other processor actions: Time will be allocated for a briefing on these items during meetings to review the previous discussion and issues raised. In many cases, attaining consensus might be attained in a brief period. Where addition refinement is necessary an expert group might be asked to provide additional information or recommend an amendment: Ex: where the Temporary Specification recommends content for Privacy Notices to be posted by registrars: a registrar and GDPR expert might be asked to create a better approach Wherever possible, this additional work would be considered and included in the initial report. If not and based on the subject matter, the Team will consider the timing of inserting the new draft into the successor specification for approval. Depending on the review and the approval cycle, inclusion into the successor specification might occur before or after the final report. (This is a ”parking lot” where issues will be recorded and resolved.) EPDP Team Feedback: While not against this approach, using an example - for discussing transfers, you first need to discuss what data goes to a registry. Depending on that outcome, you can then discuss transfers. It's important to have the questions in the correct sequence so that problems don't occur and/or already-proposed changes need to be corrected later in the process. A point of contention between people in the group is whether ICANN has made the legal argument over where information can be collected and later distributed. Who is responsible for building the legal argument? Is it the EPDP team's job or is that ICANN org's job? ICANN may believe it has built the legal argument in the Temp Spec, but there is a question whether that has been satisfied in this group. Perhaps the team can tailor the discussion around the processing of data under GDPR - after doing that, the team can go back and look at ICANN's powers. The EPDP Team needs to deal with the fundamental issues regarding what data needs to be collected and redacted. ICANN org thinks it has already done this, but the team should come to an agreement on the redacted data elements. Purpose and collection is equally fundamental, but it's unlikely the team will come to agreement on that. Agreeing on redacted data elements appears to be a concrete and specific task. Our charter lays out the questions (and the sequence to be used to answer them) quite nicely. Our charter already laid out the sequence, so the team should follow the charter and use that order of how to approach the work. The Team can decide how to tackle the work, but the charter provides a good order to begin with. For example, tackling purposes is critical. If we do not come up with an agreed upon set of purposes for our deliberations, we will never agree on other points. Agree that we need to debate the purposes. The GAC's next meeting is to discuss what data will be provided, and how will the data be transferred. The purpose issue is primary; however, having debated purposes since 2005, there is concern we will never move past that. Some may approach this as what data they would like access to and work backwards to try to get data. What is the plan when we discover we cannot agree on purposes? This EPDP was formed to break this deadlock, and as a group, we have to find a way to move forward. It will be impossible to debate other sections without first agreeing on purposes. People tend to justify data they need and define purposes based on that; however, one thing that we could catch in a privacy impact assessment is what problem are we trying to solve? You may or may not have to collect information to solve a problem. As we discuss purposes, we should come back to the problems we need to solve, like hijacked domain names. The problems may also be a source of contention, but the group may agree on these problems. What the group should aim for is to make sure that the purposes listed do comply with the privacy laws. In terms of going about the work the team needs to do, debates around purpose would happen in category 2, but perhaps the group needs to see the full schedule. Maybe if the group maps the schedule based on the flowchart in the slides, and include the charter questions for each piece of work, the team could see the roadmap and have a better idea of the work going forward. Some members believe the discussion of purpose may be theoretical and abstract, but this is problematic. If purposes of the data to be collected is abstract in theory, the whole Temp Spec is abstract in theory. We are operating in a multi-stakeholder environment – we are trying to retrofit a set of policies and contracts so that it does not violate data protection law and the GDPR. Naturally, we have a hard time determining purpose because many of the stakeholders consider their purpose the same as the registrar’s purpose. The actual purpose for collecting registration data is a very narrow one – it is for the domain name to function. Publishing this data is not a legitimate purpose. The RDS Team raised most of these arguments, and if we have to rehash these arguments, this team will fail. What problem are we trying to solve, and what data do we need? This question is inherently problematic – rather than collecting use cases, we should ask what is ICANN’s purpose. If we continue to focus on what data we need, we lose sight of the problem. If I had a guarantee that if I go to a Ry/Rr and get information in a predictable timeframe, I may never have to see the data (probably unlikely), but this is a possibility. There is a trap for an attractive piece of data and why it should be published, and we should avoid this. Let’s look to the technical people to solve the problems of bulk access. Focusing on the data itself is a bit of a trap. Focusing instead on purposes is very important. ICANN needs to collect data to fulfill its purposes – its purposes are not IP or law enforcement; however, the data is collects may be useful to entities with legitimate purposes. If we recognize the difference between ICANN’s purpose and third-party purposes, the group can make progress. When we confuse third party purpose with the purpose of WHOIS is where we run into trouble. We should first look at what data needs to be collected for domain name registration. Then we can look at what additional data might be required – that could include additional data under consent. Then, you can look at transfer of data to other parties. If we go through that thought process, we can look at what data can be collected in domain name registration. As well as looking at what is necessary for registration contracts, we need to look at ICANN’s mission/coordination role. GDPR recognizes there are legitimate purposes and exemptions – what is missing from our conversation is an assessment of necessity and proportionality. One problem is that we have different opinions on what ICANN’s mission is – one part of ICANN’s mission is to secure a trusted DNS. What does ICANN need to do to achieve that part of our mission – that is where the tie-in to law enforcement and third-party interests lie. The team seems to be confusing several issues – one thing we need to talk about is enforcement of contracts. There is an agreement in the registration agreement that the registrant submits to UDRP disputes. This is squarely within the mission of ICANN and providing a framework for having a trusted DNS. The mission is not that narrow. What the team should do is try to peel the onion. Start by looking at data collected for the registrant – look at what is required to register a domain name and maintain that registration. We are conflating what is required to perform a contract with the overarching goals ICANN has in its mission. The RDS WG already did some of this work. One of the homework assignments is to go back to the RDS WG’s work to look at which data elements are required to register a domain name and maintain that registration. Our future conversations will be guided by discussion summary indexes. For each section (and relevant sub-sections) a scorecard will be prepared to facilitate the deliberations which will include: Current text Identification of category Related charter question(s) Support indicated as result of triage effort DPA/EDPB Advice (if any) Proposed changes / rationale for change (as provided by EPDP Team in response to triage surveys) Information to be completed: Proposed response to charter question(s) High level summary of the deliberations and/or recommendation(s) Proposed modification of text (if appropriate) Level of consensus Data Summary Index to facilitate development of Initial Report The number of meetings we have to get the work done is limited, as displayed on the screen. The leadership team is embarking on how to divide the work in the meetings. 5. Commence deliberations and review of Appendix D – Uniform Rapid Suspension (see discussion summary index) 6. Commence deliberations and review of Appendix E – Uniform Domain Name Resolution Dispute Policy (see discussion summary index) 7. If time allows, commence deliberations and review of Appendix G: Supplemental Procedures to the Transfer Policy (see scorecard attached) 8. Wrap and confirm next meeting to be scheduled for Tuesday 28 August at 13.00 UTC. Action Items: Preliminary input on the triage report is due Friday, 24 August. Goal is to submit the triage report early next week. For any groups who plan to respond to the requests to provide early input, please do so as soon as possible. Support Team to provide EPDP Team with output of RDS PDP WG’s work on which data elements are required to register a domain name and maintain that registration. EPDP Team members to looks at the discussion summary indexes for Appendix D, E, F and provided suggested mark-ups (if any) to the email list Support team to distribute discussion summary index for Section 4.4 EPDP Team members to review discussion summary index for Section 4.4 in preparation to discuss at next EPDP Team meeting on Tuesday, 28 August at 13.00 UTC

1 0

Re: [Gnso-epdp-team] Coordination between ICANN org and EPDP
by Kurt Pritz Aug. 23, 2018

Aug. 23, 2018

Hello Göran: Thanks very much for contacting me and your note I have repeated some your email below so that there is a clear connection between your questions and my responses. Today, ICANN org held a call to provide community leaders with updates regarding various GDPR activities. The slides and recording of the call are available at https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en <https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en>. On the call, a few community leaders reinforced the value of coordination between ICANN org and the EPDP Working Group, particularly around access model. To this end, please share with us any thoughts you might have regarding a process by which: 1) ICANN org can share guidance we receive from the DPAs and European Data Protection Board with the EPDP Working Group. Generally, our Team discussions are appropriately aimed at refining / altering ICANN processes so they are GDPR compliant. So guidance, case law or authoritative opinions received that provides compliance requirements will be extremely helpful. a. Through its many recent actions: engaging with the ICANN community, governments, the EDPB, and others, it is apparent that ICANN is the midst of executing a plan to obtain certainty around the various GDPR provisions. It would be instructive for the EPDP Team if ICANN were to share its plan (or elements of it) so that the team can anticipate the receipt (and timing) of new information. It would also indicate where there is likely no additional information, i.e., where the team would be left to draw conclusions based on the information that is already available. This information would likely cut down on the number of questions the ICANN Org receives from the team. We understand that the plan must have a degree of informality and be flexible, with each step based upon the information received in the step before it. However, where available, it would be instructive to know the planned-for objectives, expected learnings, a set of ultimate questions to be answered, planned inquiries, targets and so on. b. While ICANN has published each communication, the findings or results of those communications have not been organized in anyway of which we know. For example, observers of the back-and-forth between the ICANN Org and the EDPB have offered conclusions that can be drawn from these documents. However, no one has organized those conclusions in a way that might become a rule set or set of guidelines for those reviewing the Temporary Specification or creating an access model. Coincidentally, in today’s EPDP meeting such a request was made: for disclosure of all the communications with the EDPB and DPAs, the staff commentary to those communications, and some organization of same. c. We also wish to hear of developments related to GDPR in other industries, if available, such as: what data processing protocols have been adopted what data processing protocols have been tested in courts what other privacy regimes are in works in other jurisdictions what data is available regarding: the effects of GDPR on malfeasance detection, avoidance other positive or negative effects of GDPR d. Finally, it’d be helpful to be made aware of the details of ICANN’s GDPR implementation plan as ICANN org had to take on the advice of DPAs and the EDPB in fashioning that. (This is a request made from the EPDP team in yesterday’s meeting and so this request has been repeated to the ICANN liaisons working with the EPDP.) 2) How the EPDP Working Group will provide input regarding access to ICANN org to use in our interactions with DPAs and European Data Protection Board to obtain legal guidance that will help guide the Working Group in its work. As you know, we post all information we receive through our blogs and engage with stakeholders, also through communications we post whether through correspondence or comments via gdpr(a)icann.org <mailto:gdpr@icann.org>. a. A point of information: The EPDP team’s third set of deliverables is to provide an, “Initial Report and a Final Report regarding the EPDP Team’s recommendations … for a System for Accredited Access to Non-Public Registration Data.” Work on this could begin as early as the completion and publication of the Initial Report on the Temporary Specification. (The Team stays in close contact with the GNSO Council leadership in pursuit of the deliverables to ensure the spirit and letter of the EPDP Charter is followed.) b. While our current answer to this question is not yet finely honed, it is likely that, from time to time, the EPDP Team will have question regarding the constraints / opportunities imposed by the GDPR. These questions might take the form of a proposed access model (or elements of an access model). The EPDP Team will forward those to ICANN, which, in turn, can test them against its own knowledge base, with DPAs, with the EDPB, or elsewhere. c. As ICANN is a data controller involved in the collection, use and disclosure of the same data that is the subject matter of this Team’s work, it is expected that ICANN will work with the team on the successor to the Temporary Specification and an access model. I hope you find this response helpful. The team is keen to continue an active correspondence with ICANN in order to flesh out the framework provided by GDPR with detailed clarifications, implementation guidance and cases from other, similarly situated industries that have faced many of these same issues. We also plan to remain in close communication with ICANN leaders on this topic, through the ICANN-provided liaisons to the EPDP Team. Sincerely, Kurt > On Aug 14, 2018, at 8:17 AM, Goran Marby <goran.marby(a)icann.org> wrote: > > Kurt, > > Today, ICANN org held a call to provide community leaders with updates regarding various GDPR activities. The slides and recording of the call are available at https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en <https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en>. > > On the call, a few community leaders reinforced the value of coordination between ICANN org and the EPDP Working Group, particularly around access model. To this end, please share with us any thoughts you might have regarding a process by which (1) ICANN org can share guidance we receive from the DPAs and European Data Protection Board with the EPDP Working Group; and (2) How the EPDP Working Group will provide input regarding access to ICANN org to use in our interactions with DPAs and European Data Protection Board to obtain legal guidance that will help guide the Working Group in its work. As you know, we post all information we receive through our blogs and engage with stakeholders, also through communications we post whether through correspondence or comments via gdpr(a)icann.org <mailto:gdpr@icann.org>. I look forward to hearing your thoughts on how we can continue to strengthen our work together toward the common goal of having an access model that is guided by the law and supported by the community. > > Best regards, > > Göran Marby > President & CEO ICANN > +1(310) 578 8690 > > > Cássia Oliveira > Sr. Manager, Office of the President & CEO > cassia.oliveira(a)icann.org <mailto:cassia.oliveira@icann.org> > +1(310) 578 8656

2 1

Recordings, Attendance & AC chat from the GNSO Temp Spec gTLD RD EPDP held Thursday, 23 August 2018
by Andrea Glandon Aug. 23, 2018

Aug. 23, 2018

Dear all, Please find the attendance and AC chat attached to this email. The MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Thursday, 23 August 2018 at 13:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/TRhpBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-23aug18… <https://urldefense.proofpoint.com/v2/url?u=https-3A__audio.icann.org_gnso_g…> AC Recording: https://participate.icann.org/p7gc228iokq/<https://participate.icann.org/p7gc228iokq/?OWASP_CSRFTOKEN=863031ed14eb3300…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ [community.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> Thank you. Kind Regards, Andrea Glandon

1 0

Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 28 August 2018 at 13:00 UTC
by Andrea Glandon Aug. 23, 2018

Aug. 23, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesday’s and Thursday’s at 13:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/UxhpBQ Kind Regards, Andrea Glandon

1 0

redacted data
by Mueller, Milton L Aug. 23, 2018

Aug. 23, 2018

I have raised this point several times and I see it being avoided. The redacted data elements are one of the most important aspects of the temp spec. It is imperative that this group identify specifically which redactions we agree with and which ones certain stakeholders don't agree with. This should be very simple to do. I would propose that we add to the Triage report a simple list of each redacted data element, and then list who agrees and disagrees with its redaction. Those opposing a redaction must explain why they think publishing that data is consistent with GDPR and other privacy laws that may apply. My understanding is that the NCSG, RySG, RrSG, ALAC and ISPC all are ok with the current set of redactions under the temp spec. It is therefore incumbent upon the BC, IPC, and GAC to specify which data elements they think should be published and which they are ok with redacting. Again, this seems like a very simple thing to do and as a form of "triage" would be most helpful for the group's progress Dr. Milton L. Mueller Professor, School of Public Policy Georgia Institute of Technology

2 4

FW: Responses to outstanding questions from the EPDP
by Marika Konings Aug. 23, 2018

Aug. 23, 2018

Dear All, Please find below the input from ICANN Org on the questions that were raised by the EPDP meeting on the 9th, 13th, and 16th. The responses will get posted shortly here: https://community.icann.org/x/ahppBQ. Best regards, Caitlin, Berry and Marika ** 1. Regarding Temporary Specification section 4.4.8 - Supporting a framework to address issues involving domain name registrations: the team requests additional specificity. Does this mean that registrars and registries must support a uniform access mechanism when approved or is there some present requirement? RESPONSE: Section 4.4.8 identifies that addressing issues involving domain name registrations, including but not limited to: consumer protection, investigation of cybercrime, DNS abuse, and intellectual property protection using a framework to be developed is a legitimate purpose for the processing of registration data. With regard to the second question, section 4.4.8 does not by itself require that registrars and registries must support a uniform access mechanism when approved. Please note however that section 4.1 of Appendix A does have a requirement for registrars and registries to “provide reasonable access to Personal Data in Registration Data to third parties on the basis of legitimate interests pursued by the third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Registered Name Holder or data subject pursuant to Article 6(1)(f) GDPR.” Separately, section 4.2 of Appendix A requires registrars and registries to “provide reasonable access to Personal Data in Registration Data to a third party where the Article 29 Working Party/European Data Protection Board, court order of a relevant court of competent jurisdiction concerning the GDPR, applicable legislation or regulation has provided guidance that the provision of specified non-public elements of Registration Data to a specified class of third party for a specified purpose is lawful.” Section 4.2 of Appendix A further requires that registrars and registries “provide such reasonable access within 90 days of the date ICANN publishes any such guidance, unless legal requirements otherwise demand an earlier implementation.” 1. Regarding Temporary Specification section 4.4.13 - Handling contractual monitoring requests: which data sets will be required to measure compliance against which contractual provisions? RESPONSE: The data requested by ICANN Contractual Compliance will vary depending on the particular compliance issue. For example, for a registrant’s complaint that a renewal reminder email was not received, ICANN Contractual Compliance may request from the registrar of record a copy of the communication to the Registered Name Holder. 1. Can ICANN summarize in some searchable form the contacts and engagements with the EDPB and/or other DPAs in relation to the Temporary Specification for gTLD Registration Data? RESPONSE: ICANN org has been open and transparent with our engagements with the EDPB and DPAs. All of the formal written communications from EDPB and DPAs are published on ICANN correspondence. In addition, we’ve had informal verbal conversations with the EDPB and DPAs to educate, inform, and ask for guidance. Summaries of those informal conversations are published in blogs. To assist the EPDP Team in its work, ICANN org will provide the EPDP Team with a compiled list of correspondence received and blogs published thus far, including the topic of each correspondence/blog. 1. In section 5.7 of the Temporary Specification (and other sections), what is the meaning of “reasonable access”? Is it access to personal data reasonably provided? Does “reasonably” relate to the effort necessary to retrieve it? Does it mean how criteria for releasing it are applied, i.e., legitimate and not overcome by the rights of others? Should it just be “access”? RESPONSE: “Reasonable access” is not defined in the Temporary Specification. Generally, compliance with the requirement for registrars and registries to provide reasonable access to non-public registration data is evaluated on a case-by-case basis, based on evidence provided by the requestor, including its request for access to non-public registration data, evidence of the requestor’s legitimate purpose for accessing the non-public registration data, the timing and content of the contracted party’s response to the request (if any), and any other information or evidence relevant to assessing the request and response. 1. Believing that ICANN org has its own GDPR implementation plan in place, it would be helpful for our group to understand the elements and implementation status of the plan so that the Team can draw comparisons to the EPDP Team’s work. RESPONSE: ICANN org has been open and transparent about its work to get ready for GDPR both in terms of domain registration data collected and processed by registrars and registries (which we refer to as “external” GDPR readiness), and personal data processed by ICANN org in the ordinary course of the organization’s operations such as finance, meetings, and human resources (which we refer to as “internal” GDPR readiness). ICANN org’s plans and activities regarding “external” (domain registration data) GDPR compliance have been openly and transparently blogged and posted on the ICANN Data Protection page at <https://www.icann.org/dataprotectionprivacy>. On 5 June 2018, ICANN’s CEO and President, Göran Marby, shared information about ICANN org’s “internal” efforts to be GDPR compliant via a blog. In the blog, Göran shared that several of ICANN’s policies have been updated. These include an updated online Privacy Policy<https://www.icann.org/privacy/policy>, a revised Terms of Service<https://www.icann.org/privacy/tos>, a revised Cookies Policy<https://www.icann.org/privacy/cookies>, a new Notice of Applicant Privacy<https://www.icann.org/privacy/applicantnotice> (relating to data processed for employment applications), and a revised New gTLD Program Personal Data Privacy Statement<https://newgtlds.icann.org/en/applicants/agb/program-privacy>. Additionally, ICANN org has also rolled out internal changes to the way we handle personal data, from data processing arrangements with vendors to our various personnel policies. Read the full blog here<https://www.icann.org/news/blog/data-protection-privacy-update-icann-s-gdpr…>. 1. The Council envisioned, via the EPDP Charter, to have direct participation of ICANN org liaisons, within the EPDP Team. As we leave the Triage and head into substantive detail, do the ICANN liaisons see a role or specific set of actions for ICANN supporting the team? RESPONSE: Section III of the EPDP Charter describes the role of ICANN org liaisons as “ICANN Staff Liaison: The ICANN Org GDD and Legal Liaisons are expected to provide timely input on issues that may require ICANN Org input such as implementation-related queries. The ICANN Staff Liaisons are not expected to advocate for any position and/or participate in any EPDP Team consensus calls.” In line with this description of ICANN org liaisons’ role, Göran Marby’s response<https://www.icann.org/en/system/files/correspondence/marby-to-forrest-et-al…> to the GNSO Council regarding a request for appointment of ICANN org liaisons confirmed the scope of participation of the ICANN org liaisons as “Trang Nguyen from ICANN organization’s Global Domains Division and Dan Halloran from ICANN’s legal team will join the working group’s mailing list and the group’s calls to coordinate responses to requests for GDD or legal input as needed to support the working group’s deliberations. Such requests will ordinarily be responded to in writing, following consultation with internal and external experts as appropriate.”

2 2

proposed modification to triage report
by Mueller, Milton L Aug. 23, 2018

Aug. 23, 2018

A simple one. Point #8: Current wording: 8. ICANN relies on its mission and bylaws to justify the requirement that registration data be disclosed in certain circumstances, but the EPDP team seeks supplemental information from ICANN to make it clear why the mission and bylaws make such disclosures necessary. 8. ICANN relies on its mission and bylaws to justify the requirement that registration data be disclosed in certain circumstances, but the EPDP team seeks supplemental information from ICANN to determine whether or not the mission and bylaws make such disclosures necessary. Dr. Milton L. Mueller Professor, School of Public Policy Georgia Institute of Technology

1 0

Proposed agenda + accompanying materials for EPDP Team Meeting - 23 August 2018
by mail＠berrycobb.com Aug. 23, 2018

Aug. 23, 2018

Dear All, Please find below the proposed agenda for the next EPDP Team meeting, which is scheduled for Tuesday, 23 August at 13.00 UTC. Accompanying materials are also attached. Best regards, Marika, Caitlin, and Berry EPDP Meeting #7 Agenda Thursday, 22 August 2018 1. Roll Call & SOI Updates 2. Welcome and Updates from EPDP Team Chair 3. Preliminary input on Triage Report (deadline for input: Friday, 24 August at 19:00 UTC) 4. Proposed approach for moving forward, including review of proposed project plan 5. Commence deliberations and review of Appendix D – Uniform Rapid Suspension (see scorecard attached) 6. Commence deliberations and review of Appendix E – Uniform Domain Name Resolution Dispute Policy (see scorecard attached) 7. If time allows, commence deliberations and review of Appendix G: Supplemental Procedures to the Transfer Policy (see scorecard attached) 8. Wrap and confirm next meeting to be scheduled for Tuesday 28 August at 13.00 UTC.)

3 2

Face-to-face meeting attendance
by Kurt Pritz Aug. 22, 2018

Aug. 22, 2018

Hi Everyone: Here is where I am on attendance at the face-to face meeting (and for discussion tomorrow). I have given this considerable thought, writing a 1400+ word memo / analysis of the different options to the GNSO leadership. Then, I re-thought all of that to come up with an alternative approach. I believe that the best option is: Members are invited and will be provided travel support. If a member cannot attend in person, an alternate can attend and be provided travel support. If this is the case, the alternate should be designated to the Support Team as soon as possible. In example(2) above, if the absent member wished to participate remotely of a portion of the meeting, then she can do that and the alternate can only participate when the member is unavailable to participate. If an attending member is, in good faith, reasonably certain that s/he will be absent for a period of time where attendance by an alternate is desired, then: that member and the alternate can attend the full meeting but only one will be designated as a participant at any one time the alternate will not be given travel support I think this is the best option for several reasons: It provides travel support commensurate with membership It allows alternates, when needed, to keep up with the proceedings It is economical compared to other solutions It will be easy to manage who participates and when Will not materially impact the meeting room size or planning by the ICANN Meetings Team Thinking of other options: If alternate participation is curtailed beyond this, team effectiveness might be hobbled. If alternative participation is expanded beyond this, meeting costs might escalate and logistics would become complicated. My second choice would be to make the meeting completely open. In this case there would be two sets of attendees: members and observers. The separation would be easy to manage The goal of keeping alternates up to speed could be realised. Openness and transparency would be assured. However, costs and logistic support requirements would increase, taking budget from more important needs Thanks and regards, Kurt

3 2

ICANN Procedure for Handling WHOIS Conflicts with Privacy Law
by Marika Konings Aug. 22, 2018

Aug. 22, 2018

Dear All, Per the action item from today’s meeting, please find attached the staff assessment and next steps report on the Revised ICANN Procedure for Handling WHOIS Conflicts with Privacy Law which was published in May 2017. As there were specific questions in relation to the origin of the procedure, I’ve excerpted the background section from this document below. As noted, the GNSO Council has already agreed to form an Implementation Advisory Group to review the procedure and adopted a charter for this effort in February of this year (see https://gnso.icann.org/en/council/resolutions#201802) However, due to workload issues and the pending EPDP, the Council delayed the call for volunteers and agreed during its most recent meeting to decide when the call for volunteers should be launched following the publication of the Initial Report on the Temporary Specification by the EPDP Team. Best regards, Caitlin, Berry and Marika ============================ Background (from https://www.icann.org/en/system/files/files/whois-privacy-conflicts-procedu…) In November 2005, the GNSO concluded a policy development process<https://gnso.icann.org/en/issues/whois-privacy/council-rpt-18jan06.htm> (PDP) on Whois conflicts with privacy law which recommended that “In order to facilitate reconciliation of any conflicts between local/national mandatory privacy laws or regulations and applicable provisions of the ICANN contract regarding the collection, display and distribution of personal data via the gTLD Whois service, ICANN should: 1. Develop and publicly document a Procedure for dealing with the situation in which a registrar or registry can credibly demonstrate that it is legally prevented by local/national privacy laws or regulations from fully complying with applicable provisions of its ICANN contract regarding the collection, display and distribution of personal data via Whois. 2. Create goals for the procedure which include: * Ensuring that ICANN staff is informed of a conflict at the earliest appropriate juncture; * Resolving the conflict, if possible, in a manner conducive to ICANN's Mission, applicable Core Values, and the stability and uniformity of the Whois system; * Providing a mechanism for the recognition, if appropriate, in circumstances where the conflict cannot be otherwise resolved, of an exception to contractual obligations to those registries/registrars to which the specific conflict applies with regard to collection, display and distribution of personally identifiable data via Whois; and * Preserving sufficient flexibility for ICANN staff to respond to particular factual situations as they arise”. The ICANN Board of Directors adopted the recommendations in May 2006 and directed staff to develop such a Procedure. A draft Procedure was posted for public comment, and input was specifically solicited from the Governmental Advisory Committee (GAC). The GAC recommended adding a provision, which was included as section 1.4 in the procedure, urging a registrar or registry to work with relevant national governments to ensure adherence to domestic and international law, as well as applicable international conventions. If the Whois requirements require changes that ICANN determines prevent compliance with contractual Whois obligations, ICANN may refrain, on a provisional basis, from taking enforcement action for non-compliance, while ICANN prepares a public report and recommendation and submits it to the ICANN Board for a decision. Given that to date no registrar or registry operator has formally invoked the Whois Procedure, and yet numerous concerns have arisen from contracted parties and the wider community, ICANN launched a review in 2014, as provided in the Whois Procedure’s final clause. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

5 7

***REMINDER*** Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Thursday, 23 August 2018 at 13:00 UTC
by Julie Bisland Aug. 22, 2018

Aug. 22, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesday's and Thursday's at 13:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/TRhpBQ Kind Regards, Andrea Glandon

1 0

Re: [Gnso-epdp-team] For your review - EPDP Team Communications Plan
by Marika Konings Aug. 21, 2018

Aug. 21, 2018

Not having seen any further comments or suggestions, staff will move forward with the implementation of this plan as proposed. Of course, suggestions will remain welcome. Best regards, Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Wednesday, August 15, 2018 at 10:09 To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] For your review - EPDP Team Communications Plan Dear All, Following yesterday’s meeting, please find attached for your review the proposed EPDP Team Communications Plan that has been developed with the support of our colleague Arial Liang. You are encouraged to provide any suggestions, comments and/or input you may have. Thanks, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

1 0

Notes and action items from today's EPDP Team Meeting - 21 August 2018
by Marika Konings Aug. 21, 2018

Aug. 21, 2018

Dear All, Below, please find notes and action items from today’s EPDP Team Call. As a reminder, our next meeting will be Thursday, 23 August, 13:00 UTC. Best regards, Caitlin, Berry, and Marika =============== EPDP Team Meeting #6 Tuesday, August 21, 2018 Notes and Action Items High-level Notes/Actions: * Triage Report is first deliverable of the EPDP Team. Please review the latest version but keep in mind that this is intended to reflect the outcome of triage – it does not include any recommendations or agreements, nor is it intended to prejudice future deliberations. Questions for ICANN Org from the EPDP Team: 1. Can an update be provided on the status of the reconfirmation of the Temporary Specification by the ICANN Board? Response: There is a board meeting planned for later today (21 August). No changes to the Temporary Specification are being proposed. 2. Has the WHOIS Conflicts with local laws procedure been used and successfully used to date? Please indicate the instances where the procedure was invoked and the outcome. Were any specific issues identified with the use of this procedure? 3. Regarding data disclosures concerning LEA requests: does GDPR compel a report of those disclosures to be made to the data subject? Please provide analysis of “in-jurisdiction” and “out-of-jurisdiction” requests. All Action items: * Action item #1: Kurt to follow up with an email outlining the plan for attendees at the F2F meeting. * Action item #2: EPDP Team to review the draft triage report and provide any initial feedback by Friday, 24 August at 19:00 UTC. (Earlier feedback strongly encouraged.) * Action item #3 - Team Support to send to the Team information concerning the PDP that was the basis for the WHOIS Conflicts with Local Law Procedure. * Action item #4 - Thomas and Emily to work on a framework to outlines the controller designations between ICANN and Contracted Parties for EPDP Team review / consideration. These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates · Attendance will be taken from Adobe Connect · Remember to mute your microphones when not speaking and state your name before speaking for transcription purposes. · Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair · The hope is to wrap up discussions on triage effort during today's meeting. Appreciate all the work that has gone into this, recognizing the short turnaround time. Triage document aims to capture outcome of triage effort. · F2F Meeting - set for 24 - 26 of September. See proposal circulated by Kurt to the mailing list for how to deal with alternates. Recommend working in accordance with the first proposal: 1. Members are invited and will be provided travel support. 2. If a member cannot attend in person, an alternate can attend and be provided travel support. If this is the case, the alternate should be designated to the Support Team as soon as possible. 3. In example (2) above, if the absent member wished to participate remotely of a portion of the meeting, then she can do that and the alternate can only participate when the member is unavailable to participate. 4. If an attending member is, in good faith, reasonably certain that s/he will be absent for a period of time where attendance by an alternate is desired, then: 1. that member and the alternate can attend the full meeting but only one will be designated as a participant at any one time 2. the alternate will not be given travel support · Comments: 3) may be difficult to enforce. Suggest making it either / or. If it is not enforced properly it could give some groups more voices. The scenario envisioned here is that a member could attend for 2 days but not 3 so alternate would come in for one day, or for half a day. It shouldn't be a case of people walking in and out every 5 minutes. · Some expressed support for option 2 - trust that alternates understand their role. · Need to factor in the distinction between members and alternates as outlined in the charter. See proposed modification sent to the list by Ayden to ensure balance in the room. · Remote participation will be available, that is not in question. · Leadership to further consider input received but is leaning towards going with option 1. Action item #1: Kurt to follow up with an email outlining the path forward for the F2F meeting. Triage document · See updated version shared with the mailing list, including proposed annexes. · Triage Report, per the Charter, is EPDP Team’s first deliverable · The report represents the results from the triage surveys, Part 1 - 4 · Report includes: · an executive summary · operating methodology · the summary table of inputs · the issue summaries that were created for each section · an appendix with all written comments · The report does not represent any group’s final opinion on any issue - all groups should feel free to revise their input during the course of the EPDP Team’s work Action item #2: EPDP Team to review the draft triage report and provide any initial feedback by Friday, 24 August at 19:00UTC. 3. Summary of responses to EPDP Input Survey Part 4 - Results for Section 8: Miscellaneous; Appendix C: Data Processing Requirements · See high level summary 'heat map' in the presentation · As before, green sometimes means conditional support, while red sometimes means objection to only certain parts but not the whole section, so the 'heat map' should be taken with a grain of salt. 4. Substantive Discussion of Temporary Specification: Part 4 of the Survey can be found at https://www.surveymonkey.com/r/9KD5K79 Section 8: Miscellaneous Appendix C: Data Processing Requirements Issue Summary: The following questions and issues were raised with respect to Section 8: 1. As Sections 8.2 and 8.3 are relevant to the Temp Spec only, will this language need to be amended or removed in the next iteration? 2. Regarding Section 8.2, should the next iteration reference GNSO processes for any subsequent modifications (or just removed entirely)? 3. Should the text be modified to reflect the relevant relationships, e.g., Joint Controller, Controller, Processor, and relevant flows of registration data, once the EPDP Team discusses these topics? 4. In reference to the referral of GAC advice in Section 8.2, should the language: (1) be modified to include all relevant GAC advice or (2) require further clarification? 5. In reference to Section 8.1, should the text be amended to reflect (a) that third party obligations will not be created outside of what is required for minimum GDPR compliance? (b) the other third-party obligations will arise? · Is dynamic modification possible? Are any one off modifications foreseen? If so, what impact would this have on the effective date? Board meets periodically so changes could only be taken up then. Is within remit to make changes - out of hands of EPDP Team. How to convert Temporary Specification into GNSO policy recommendations that is the role of the EPDP Team. Once that has happened, any changes would go through the GNSO rules so this section on changes may no longer be relevant. Note that there is also the WHOIS conflicts with local law procedure that could be used for any potential changes, once the temporary specification is converted into a consensus policy. · No third-party beneficiaries is part of most ICANN agreements. · Should the text be modified to reflect the relevant relationships, e.g., Joint Controller, Controller, Processor, and relevant flows of registration data, once the EPDP Team discusses these topics? There are different flows of registration data some of which have a data processing relationship others have a joint-controller relationship. Different agreements need to be in place depending on the relationship. Action item #3 - Staff to send to the mailing list information concerning the PDP that was the basis for the WHOIS Conflicts with Local Law Procedure. Action item #4 - Thomas and Emily to work on a framework to outlines the controller designations between ICANN and Contracted Parties or EPDP Team review / consideration. Appendix C - Preamble The following questions and issues were raised with respect to the preamble of Appendix C: 1. Is this inclusion of language, which is based on but not exactly the same as articles of the GDPR, strictly necessary? 2. Should this language be amended to broadly refer to general data protection principles instead of specific references to the GDPR? 3. Should language be examined using the domain name lifecycle as a reference, i.e., should the EPDP team examine all of the processes at different stages by different parties for collection, updating, publication, access and retention, for both purpose and conformity to the GDPR? 4. Should this language be modified as it currently only references some, but not all, of the bases for processing personal data? 5. Should we replace “...such access will at all times comply with the requirements of the GDPR.” with “...such access will comply with the requirements of the GDPR, as applicable”? 6. Should "EBERO" be a party instead of an activity? 7. Within the table, for Public RDDS/WHOIS field, should the language "performance of a contract" be added as a legal justification for Registrar/Registry/ICANN? · Is the intention of the table to be all-inclusive, or not? If it is, the row specific to "Public RDDS/WHOIS" needs to show specifically as a "Performance of a Contract" as this must be done and the publicly available WHOIS is not based on legitimate interest. If it is not all-inclusive, maybe there should be a clarification included? · Is contractual obligation a legal justification? · There may not be as much dissent as reflected in the chart - CPs need to abide by the law. This is very GDPR specific - there are also privacy laws in the works in other countries that may have an impact. Not ideal to quote a summary of legal obligations, better to reference it directly. · All obligations are subject to applicable law. Concern that the language in this section seems to circumvent requirements and create uncertainty. Nullifying consensus policy should be done elsewhere. Need an effective conflicts with local laws procedure. It is a strange concept for CPs to ask ICANN for permission to comply with applicable laws. Could a strengthened version of the procedure serve as a safety valve? Note that the GNSO Council has already agreed to commence a review of the procedure. The following questions and issues were raised in reference to Appendix C, Section 1: 1. Should the reference to "obligations to applicable laws and regulation" be deleted in deference to providing certainty and the already existing, WHOIS conflicts with local laws policy? 2. Should the language be amended as it may be misleading since Art.6 of the GDPR is not the only legal basis that can be applied to processing? 3. Is this paragraph describing principles useful as it does not describe specific data handling practices, or their monitoring? 4. Should Section 1 be modified to reference data protection principles more broadly, noting that if the GDPR is updated or amended, the language would need to change? The following questions and issues were raised in reference to Appendix C, Section 2: 1. Does the term "legitimate interest" require further clarity? 2. Does the clause "except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of Personal Data" need further qualification, as not all data disclosures (e.g., to LEA) are subject to this balancing test? 3. Should the EPDP consider submitting the group's agreed-upon legitimate interests (when agreed) as part of an Article 40 Code of Conduct referral to ensure a greater degree of certainty? 4. Should this language be modified since it only references some, but not all, of the bases for processing personal data? Should the singular reference to children be deleted as it is not possible to tell whether a data subject is a child in current registration data? 5. Does this paragraph add value or should it be deleted? 6. Should the identity of the data controller for WHOIS be identified? · Need a clear definition of legitimate purpose · What is a code of conduct referral? Need to outline what would be the basis for our processing? Our state in legitimate interest, the legal basis, etc. could be outlined by the DNS industry which could then be referred to the EDPB to review it as a code of conduct per the GDPR. Code of Conduct should be considered but is not easily achieved. However, if EPDP Team wants to bend what is possible under GDPR, it should get that approval via a Code of Conduct. Should this be part of the discussion of UAM instead of here? · Are legitimate interests not overridden by privacy rights lawful? Some have now been overridden by privacy rights and as such and no longer considered lawful? It is not only LEAs that have legitimate interests. Also need to further consider ICANN's mission in this regard - fundamental difference in perspectives of what the purpose for collecting data in the first place is. · Is this group able to determine what is legitimate? Is input from an external authority needed such as EDPB or court cases to provide clarity? Not for ICANN either to make this determination. The following issues and questions were raised in reference to Appendix C, Section 3.1: 1. Are all parties included in this section about informing data subjects about processing, e.g., ICANN, data escrow agents, and emergency backend registry operators? 2. Should the text be modified to reflect the relevant relationships, e.g., Joint Controller, Controller, Processor, and relevant flows of registration data, once the EPDP Team discusses these topics? 3. With respect to Section 3.1.2, do the terms "necessary and appropriate" require further clarity? 4. With respect to Section 3.1.5, how is this testing to be achieved? 5. Should Section 1, et.seq. be modified to reference data protection principles more broadly, to address changes in GDPR or introduction of other privacy regimes? The following issues and questions were raised in reference to Appendix C, Section 3.2 - 3.7: 1. Are all parties included in this section about informing data subjects about processing, e.g., ICANN, data escrow agents, and emergency backend registry operators? 2. Should the text be modified to reflect the relevant relationships, e.g., Joint Controller, Controller, Processor, and relevant flows of registration data, once the EPDP Team discusses these topics? 3. In reference to Section 3.7, does the language require more detail in terms of how privacy-by-design should be implemented? · What is some of this language intended for. For example, 3.5 - is this relates to the initial communication to the registrant? Not related to disclosure for LE? This is just related to general privacy notice, not day to day requests. · LE - how is LE defined, by whom are they recognised? Premature to discuss this here, but currently focused on local law enforcement. Different scenarios will need to be considered, for example what if request is made from LE in another EU country? Depending on outcome of those discussions, information requirements may need to be updated accordingly. The following issues and questions were raised in reference to Appendix C, Section 3.8 - 3.11: 1. Are all parties included in this section about informing data subjects about processing, e.g., ICANN, data escrow agents, and emergency backend registry operators? 2. Should the text be modified to reflect the relevant relationships, e.g., Joint Controller, Controller, Processor, and relevant flows of registration data, once the EPDP Team discusses these topics? 3. Should the EPDP Team further discuss the requirements for security measures to ensure the measures fit the sensitivity of the data? 4. In reference to Section 3.8, should the term "natural persons" be changed to "data subjects"? 4. Should the specific examples in Sec. 3.8.1-3.8.8 be deleted as: (1) they are not mandatory, and (2) they are overly specific and may become outdated? 5. In reference to Section 3.9, is further detail needed with respect to the roles of ICANN, the registrar, the reseller, and/or other data processors as well as the GDRP-mandated 72 notice in the event of a breach? 6. In reference to Section 3.10, does the term "international organizations" require further clarity? Other Comments · BC strongly supports the inclusion of each of the issues identified in 1-7 to be addressed in the EPDP, with the exception of the accreditation model, since that work is being pursued on a separate track. As discussed earlier, providing definition to what is meant by “continued [and]public access” falls squarely within this PDP and must be explored. For example, difference between legal and natural persons, volume limitations, anonymized email. Time should be found for talking about these issues. · RySG: These issues are not being considered in the Triage exercise. Please note specifically the Objectives & Goals of the GNSO scope document for the EPDP note that these matters are not for initial consideration and the focus of the EPDP team should remain on the Primary queries at this juncture. · IPC: Apart from the issue identified in point #1 of the annex (related to an accreditation model) which IPC supports continued discussion of the important issues enumerated in the Annex by the EPDP team. We understand that the issued address in #1 is subject to the gating questions defined in the charter. · Need to define 'reasonable' in the context of reasonable access and/or reinventing the term. 5. Overview of triage report, including timeline for review · See notes above · Nothing in the triage report should prejudice future discussions of the EPDP Team. 6. Discussion of next steps · Triage effort has provided insight into the different issues as well as suggestions made. · Issue summaries and individual comments will be used as a guide. · Leadership team working on proposed approach for discussion during Thursday's meeting Homework for next meeting · Review triage report · Review input provided on URS/UDRP/Transfer sections - possible topics for next meetings · Consider comments made in relation to redaction of data elements and further rationale that should be considered for not redacting certain data elements. 7. Confirm action items and questions for ICANN org (if any) 8. Wrap and confirm next meeting to be scheduled for Thursday 23 August at 13.00 UTC. (Initial comments on Triage Report due Friday, 25 August by 19.00 UTC) Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

1 0

Recordings, Attendance & AC chat from the GNSO Temp Spec gTLD RD EPDP held Tuesday, 21 August 2018
by Andrea Glandon Aug. 21, 2018

Aug. 21, 2018

Dear all, Please find the attendance and AC chat attached to this email. The MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Tuesday, 21 August 2018 at 13:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/FxdpBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-21aug18… AC Recording: https://participate.icann.org/p27r8mt24t5/<https://participate.icann.org/p27r8mt24t5/?OWASP_CSRFTOKEN=863031ed14eb3300…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ [community.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> Thank you. Kind Regards, Andrea Glandon

1 0

Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Thursday, 23 August 2018 at 13:00 UTC
by Andrea Glandon Aug. 21, 2018

Aug. 21, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesday’s and Thursday’s at 13:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/TRhpBQ Kind Regards, Andrea Glandon

1 0

Possible Unified Access Model for community input
by Trang Nguyen Aug. 21, 2018

Aug. 21, 2018

All, ICANN org published a blog yesterday on a possible Unified Access Model for community input. https://www.icann.org/news/blog/possible-unified-access-model-published-for… Input can be sent to gdpr(a)icann.org<mailto:gdpr@icann.org>. Regards, Trang Nguyen (ICANN Org Liaison)

1 0

Triage Report - Complete Draft
by Kurt Pritz Aug. 21, 2018

Aug. 21, 2018

Hi Everyone: Please find attached a pro-forma version of the complete Triage report. It includes the issue or comment summaries of all sections of the Preliminary Specifications. There will be three appendices published as separate documents: The complete set of comments organized by group (attached here and to be reorganized by alphabetical order) The complete set of comments organized by Temporary Specification section The set of opening comments made during the first meeting. These other two appendices should be ready tomorrow. Please note the one topic of discussion, the second sentence of the second paragraph of the report, where reference to redacted data has been, for now, deleted. This report represents our first deliverable to the GNSO Council and, more importantly, represents considerable work done by this group, reflecting a thorough understanding of the issues presented by the Temporary Specification, However, it does not portray any consensus or agreement by this group - it is a required stepping stone onto more substantive work. Please review and comment on this report with that in mind. If the issue summaries disagree with your comments, they should be amended. However, non-substantive changes to this report will not affect our final work. Thank you for all your work that went into this. Best regards, Kurt

1 0

Proposed agenda + accompanying materials for EPDP Team Meeting - 21 August 2018
by Caitlin Tubergen Aug. 21, 2018

Aug. 21, 2018

Dear All, Please find below the proposed agenda for the next EPDP Team meeting, which is scheduled for Tuesday, 21 August at 13.00 UTC. Accompanying materials are also attached. Please accept our apologies for the delay. Best regards, Marika, Berry, and Caitlin EPDP Meeting #6 Agenda Tuesday, 21 August 2018 Roll Call & SOI Updates Welcome and Updates from EPDP Team Chair Summary of responses to EPDP Input Survey Part 4 - Results for Section 8: Miscellaneous; Appendix C: Data Processing Requirements Substantive Discussion of Temporary Specification: Part 4 of the Survey can be found at https://www.surveymonkey.com/r/9KD5K79 Section 8: Miscellaneous Appendix C: Data Processing Requirements Overview of triage report, including timeline for review Discussion of next steps Confirm action items and questions for ICANN org (if any) Wrap and confirm next meeting to be scheduled for Thursday 23 August at 13.00 UTC. (Initial comments on Triage Report due Friday, 25 August by 19.00 UTC)

1 0