September 2018 - Gnso-epdp-team

Slide Deck - 6 Sept EPDP meeting
by Kurt Pritz Sept. 6, 2018

Sept. 6, 2018

Hi Everyone: Attached is the slide deck for today’s call. There might be a few tweaks by meeting time. I have also attached a newer version the Data Elements matrix that combines elements of Thomas’ work and the RDS results. This is the chart to which we will refer when we discuss data. After having a conversation with Thomas and few others yesterday, we added a column alongside the data collected by registrars for “rationale,” i.e., the purpose(s) for which the data is collected. Also attached is a document describing travel support planning for the Barcelona meeting. The slide describing the availability of travel funding for Barcelona is entitled “Travel Funding of Last Resort,” which pretty much sums up the approach. For the discussion today, please have available the registrars’ recommendations in redline form for edits to section 4.4 et.seq. I have included the clean version of their recommendations in the deck but the redline would be too difficult to see. You might also wish to have Amr's and Ashley’s emails regarding sections 4.4.2 and 4.4.9. I have pretty much restated them in the slides but they might be easier for you to read If you have them in their original form. We will provide updates if necessary. Talk to you later. Best regards, Kurt

2 2

Temporary Specification vs Consensus Policy
by Alan Greenberg Sept. 6, 2018

Sept. 6, 2018

The discussion initiated by Alan Woods' proposal on behalf of the RySG to remove Appendix C from EPDP Scope has caused me to think about what we are doing in the EPDP. The EPDP Charter sets the stage by setting out mission "This EPDP Team is being chartered to determine if the Temporary Specification for gTLD Registration Data should become an ICANN Consensus Policy, as is or with modifications, while complying with the GDPR and other relevant privacy and data protection law." The triage document reinforces this with "which includes items that have the Full Consensus support of the EPDP Team that these should be adopted as is (with no further discussion or modifications needed)". The GNSO Recommends policy to the ICANN Board and that is what we are here to do. People questioned why this was called a "Temporary Specification". It is because that is exactly what it is It is temporary due to the 1 year lifetime, and it is a Specification because that is what we call addenda to the Registry and Registrar contracts (the Ry agreement currently has 12 of them and the 2013 RAA 8). It is natural that this contract document be formatted as it is, with appendices and such. Our job is to write policy and it need not be in the final form to be inserted into contracts. But if we choose to write the policy in its "final form", that is fine, but we will need to identify where there are terms that are beyond those in the picket fence that we can specify in consensus policy and will need to be negotiated (or otherwise drafted and deemed to be acceptable to ICANN and contracted parties). I don't much care what form we deliver our end product in (ie as a policy requiring significant drafting to be inserted in the contracts, or ready to go (to the extent that the content is within scope). But I think we will make far more productive use of our time if we do not spend time debating the exact form now and concentrate on the substance that we need to agree on regardless of the for, Alan

1 0

Proposed Course of Action on 4.4.2
by Amr Elsadr Sept. 5, 2018

Sept. 5, 2018

Hi, Following up on the action item from Thursday 30 August on a proposed rewrite of section 4.4.2 of the Temp Spec, which in its current form goes as follows: 4.4.2Providing access to accurate, reliable, and uniform Registration Data based on legitimate interests not outweighed by the fundamental rights of relevant data subjects, consistent with GDPR My proposed course of action on section 4.4.2 is to delete it altogether. My rationale is as follows: 1. Reading through Kurt’s email titled "Project Plan Adjustments and Policy Organization”, sent on 4 September, I found myself in agreement that sections 4.4.2, 4.4.8, 4.4.9 and 4.4.10 are better placed under a different heading than “Lawfulness and Purposes of Processing gTLD Registration Data”. These 4 sections are not really purposes, and would likely be better placed under a different heading altogether, so I proceeded with that in mind. 2. Feedback submitted by different groups in response to the survey on this section indicated a view that it was too vague, to broad, and not sufficiently specific to serve as a purpose for lawful processing of gTLD Registration Data. Subsequent discussions supported this, both of which I presume contributed to the rationale of moving 4.4.2 out from under the Section 4 header. 3. If 4.4.2 does not actually serve to clarify a lawful purpose for processing gTLD Registration Data, it made sense to me to attempt to identify what purpose it does serve: - 4.4.2 is a statement that creates an obligation to provide access to gTLD Registration Data - 4.4.2 describes conditions that need to be fulfilled before access to gTLD Registration Data may be provided; that they be “based on legitimate interests not outweighed by the fundamental rights of relevant data subjects, consistent with GDPR” - 4.4.2 describes obligatory characteristics of the gTLD Registration Data to which access shall be provided; that the data will be “accurate, reliable, and uniform” 4.4.2, to me, appears to serve as a guiding principle under which access may be provided to certain third-parties, which will need to be deliberated upon. 4.4.8, 4.4.9 and 4.4.10 may indeed serve the same purpose. However, these principles describe already existing requirements. The need to process (including disclose to third-parties) gTLD Registration Data based on legitimate interests not overridden by the fundamental rights and freedoms on the data subject, and in compliance with GDPR already exists in the section 4 heading. My understanding is that Thomas and Kurt will be proposing modifications/improvements to this header as well. Furthermore, it seems to me that the characteristics of gTLD Registration Data being being accurate, reliable and uniform are already existing requirements that are better detailed in the 2013 RAA’s WHOIS Accuracy Program Specification, and the Consensus Policy of “thick” WHOIS under consistent labelling and display. My conclusion is that not only is 4.4.2 unhelpful and vaguely drafted, but is also very redundant. If there are reasons why other EPDP Team members believe it should be retained, and what modifications might make this provision more useful, I’m happy to discuss. Thanks. Amr

1 0

Re: [Gnso-epdp-team] Request for Adobe Access (Read-only) for Alternates
by Alan Greenberg Sept. 5, 2018

Sept. 5, 2018

I support Kristina's proposal. The graphics displayed can be important. Alan At 13/08/2018 04:29 PM, Rosette, Kristina via Gnso-epdp-team wrote: >All, > >On behalf of the RySG, Im writing to request >that EPDP Alternates be granted read-only access >to the Adobe Connect room. We are finding that, >without access to the Adobe room, it is >difficult for the Alternates to follow the >meeting fully, to assist Members during the >meeting, and to prepare for direct participation (when doing so for a Member). > >If it would be possible for us to add this >request to our agenda for tomorrow (as an AOB), >the RySG would appreciate it. I apologize for >the short notice, but I had drafted another >version of this email on Friday, where it got stuck in my pre-vacation Outbox. > >Thank you. > >Kristina > >Kristina Rosette >Senior Corporate Counsel, IP Domains ><mailto:rosettek@amazon.com>rosettek(a)amazon.com | 703.407.1354 > >_______________________________________________ >Gnso-epdp-team mailing list >Gnso-epdp-team(a)icann.org >https://mm.icann.org/mailman/listinfo/gnso-epdp-team

3 3

**REMINDER** Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Thursday, 06 September 2018 at 13:00 UTC
by Julie Bisland Sept. 5, 2018

Sept. 5, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesday's and Thursday's at 13:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/0gONBQ Kind Regards, Andrea Glandon

1 0

Proposed Agenda - EPDP Team Meeting #11 - 6 September at 13.00 UTC
by Marika Konings Sept. 5, 2018

Sept. 5, 2018

Dear All, Please find below the proposed agenda for Thursday’s EPDP Team meeting. Note that the order of the agenda may change depending on the submission of proposals for the different outstanding action items. As a reminder, you can find the action items and their expected delivery date/time here: https://community.icann.org/x/NwSNBQ. Best regards, Caitlin, Berry and Marika ============ EPDP Meeting #11 Agenda Thursday, 6 September 2018 1. Roll Call & SOI Updates 1. Welcome and Updates from EPDP Team Chair 1. Update on status of GDPR training 2. Update on travel to ICANN63 3. Other updates, if applicable 1. Proposed modifications to section 4.4 - Registrar / Registry / ICANN processing of data * Review proposed modifications put forward by the Registrar Team * Consider input from EPDP Team members on proposed modifications * Agree on next steps 1. Proposed modifications to section 4.4 – introductory paragraph * Review proposed modification put forward by Alex Deacon and Thomas Rickert * Consider input from EPDP Team members on proposed modifications * Agree on next steps 1. Status update on modifications to section 4 – Third Party Legitimate Interests * revised language for §4.4.2 (Amr Elsadr) * revised language for §4.4.8 (Alex Deacon & Amr Elsadr) * revised language for §4.4.9 (Ashley Heineman) 1. Review data matrix formed from RDS work and Thomas’s chart * High-level overview of chart * Discuss proposed amendments to Chart * Agree on next steps 1. Introduction to Appendix A 1. Confirm action items and questions for ICANN Org, if any 1. Wrap and confirm next meeting to be scheduled for Tuesday 11 September at 13.00 UTC.)

1 0

IPC Early Input
by Marika Konings Sept. 5, 2018

Sept. 5, 2018

Dear All, The IPC Early Input has been received and posted on the related wiki page: https://community.icann.org/x/Ag9pBQ. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

1 0

Notes and action items from today's EPDP Team Meeting - 4 September 2018
by Marika Konings Sept. 4, 2018

Sept. 4, 2018

Dear All, Below, please find notes and action items from today’s EPDP Team Call. As a reminder, our next meeting will be Thursday, 6 September, 13:00 UTC. Best regards, Caitlin, Berry, and Marika =============== EPDP Team Meeting #10 Tuesday, 4 September 2018 Notes and Action Items High-level Notes/Actions: Action item #1: EPDP Team to review the latest version of the triage report as circulated by Kurt to the mailing list and provide input before Thursday 6 September with the goal to send the report the following day. Action item #2: Leadership team to circulate guidelines for members to be able to apply for travel support for ICANN63 shortly after this meeting. Action item #3: Registrar team to circulate proposed modifications for § § 4.4.1; 4.4.3-4.4.7; 4.4.11-4.4.13 Registrar/Registry/ICANN Processing data to the mailing list by the end of today Action item #4: Alex and Thomas to collaborate on redrafting §4.4 (introductory paragraph), Appendix A.4. and Appendix C2. Action item #5: Proposed revisions for § §4.4.2, 4.4.8, 4.4.9 due by Wednesday 5 September at 22.00 UTC Action item #6: Thomas provide an illustrative joint controller agreement so that the team can differentiate between the operational elements and the policy-related elements. Action item #7: Margie to review appendix C and indicate what aspects may need a specific mention in the policy recommendations regarding disclosure of data to third parties. . Action item #8: Kurt to confer with Thomas to prepare the discussion for Thursday’s meeting on data elements - anyone else interested in this prep conversation to reach out to Kurt. Action item #9: The group to comment on Kurt’s email with proposals for relocating § §4.4.2, 4.4.8, 4.4.9 to a different section of the Temporary Specification. Questions for ICANN Org from the EPDP Team: None Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates * Attendance will be taken from Adobe Connect * Remember to mute your microphones when not speaking and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair * Update on status of triage report and expected next steps * See email circulated by Kurt Action item #1: EPDP Team to review the latest version of the triage report as circulated by Kurt to the mailing list and provide input before Friday 7 September. * Update on status of early input received and proposed approach for considering early input * Early input received from ALAC, BC, NCSG and SSAC * Input largely in line with input received in response to triage surveys * Support team to integrate input into related DSIs * RySG and IPC input is forthcoming * Other updates, if applicable * Guidelines for applications for support to attend BCN meeting will be circulated shortly after the meeting. Support should be as a last resort. Action item #2: Leadership team to circulate guidelines for members to be able to apply for travel support for ICANN63 shortly after this meeting. 3. Proposed modifications to section 4.4 - Registrar / Registry / ICANN processing of data a) Review proposed modifications put forward by the Registrar Team b) Consider input from EPDP Team members on proposed modifications) Agree on next steps * Registrars are working on the proposed modifications. Apologies for the delay. Action item #3: Registrar team to circulate proposed modifications for 4.4. Registrar/Registry/ICANN Processing data to the mailing list by the end of today * 4. Proposed modifications to section 4.4 – introductory par agrapha) Review proposed modification put forward by Alex Deacon b) Consider input from EPDP Team members on proposed modifications c) Agree on next steps * See edits put forward by Alex Deacon for section 4.4., appendix A.4.1., Appendix C.2 - broaden the purpose for processing. * Cross-referencing may be problematic - terms that could be ambiguous or referring to other directives. Should specific language be called out instead? Future policy needs to be future proof and be able to accommodate potential modifications. May make more sense to define what is being referred to instead of referring to GDPR. Several pointed out that specific references to GDPR may be problematic. GDPR should be viewed as the lowest common denominator - as such the baseline, but need to describe it in a more general manner (and test it against GDPR) so it is also broadly applicable. * The addition of "at least" to the preamble paragraph may not be GDPR compliant? * Why is there a reference to Art. 2? Is it being suggested that the contracted parties must check in every instance whether the data sets concerned fall under GDPR? That is easy for EU-based contracted parties, not so much for non-EU contracted parties. Reference to article 2 was to point out the boundaries of GDPR, where it applies and where it doesn't. Leaving this reference in would mean that contracted parties can no longer consider their client base on a global basis, would be problematic. * Concerns about proposed deletion of reference of fundamental rights and freedoms. * Should other legal basis be referenced as well? * Need parking lot for issues that require much further discussion and deliberation such as how different laws have dealt with processing on a legal basis. * Would it be sufficient to just state that the requirements need to be GDPR compliant? * Consider first what data can be legitimately collected by registrars and passed on to registries, only then should disclosure be discussed. Need to prioritize the sequence. * The way it is currently written in the Temporary Specification needs to be fixed whether it is now or at a later stage. * Lack of clarity may be related to earlier sections such as 4.1 and 4.2 - maybe once that gets addressed it would also fix the other parts? Action item #4: Alex and Thomas to collaborate on redrafting 4.4 (introductory paragraph and Appendix C2. Action item #5: Kurt to provide guidance on how to deal with 4.2. and 4.3. 5. Status update on modifications to section 4 – Third Party Legitimate Interests revised language for §4.4.2 (Amr Elsadr) revised language for §4.4.8 (Alex Deacon & Amr Elsadr)revised language for §4.4.9 (Ashley Heineman) * See Kurt's email * Previously agreed to move third party legitimate interests into a separate section or appendix * 4.4.2 looks more like a high-level principle, may not fit here. * 4.4.8 is being worked on. * 4.4.9 is also being worked on. Need to consider lawfulness. Not expected to require additional data elements beyond what is collected, it is just about access to data already collected. * No one is currently proposing the collection of additional data elements beyond what is already required to be collected. * How to deal with technical contact? Not a necessity for ICANN contract but it is data that may be necessary for third party legitimate interests. Could this be made optionally available? * Proposed revisions due by Wednesday 5 September at 22.00 UTC Action item #6: proposed revisions for 4.4.2, 4.4.8, 4.4.9 due by Wednesday 5 September at 22.00 UTC 6. Proposed modifications to Appendix Ca) Review draft recommendation to ICANN that the subject matter be taken out from consideration by this group and folded into current CPH-ICANN negotiations regarding registration data elements of the RAA and RA. (Alan Woods) b) Review proposed amendments to Appendix C, section 2, Lawfulness of Processing, that includes all GDPR mechanisms that allow processing of data (Alex Deacon)c) Agree on next steps * See recommendation put forward by Alan to the mailing list. * Recommendations are twofold: * Removal of Appendix C * EPDP recommendation that ICANN must engage with the Contracted Parties to put in place the legally required instruments (such as Art 26 or 28, as appropriate) without further delay that would enshrine the GDPR concepts found in Appendix C. * 2A) the EPDP should also further recommend that such a review of contracts (for the purposes of data processing arrangements), must extend to those other service providers, which are equally essential to the DNS ecosystem, including, but not necessarily limited to EBERO providers, Data Escrow agents and the RPM agents. * Just because it goes into policy recommendations doesn't mean it cannot be part of contract negotiations. Basic principles may need to be called out here so these serve as input to any subsequent negotiations. Should this group specify the core contents. How data is handled is part of Appendix C also in the context of third party disclosures - should set a standard for what goes into the contract. Need to review what principles in Appendix C should be retained. * What is for this group to do and what isn't? A data processing agreement needs to be done in writing. Need to put in a request in the report that ICANN should enter into agreement with EBERO and Escrow agents, but not necessarily for this group to write these agreements. Idem for the data controller agreements. Consider making that the recommendation but remove appendix C. * Consider putting in language which states that DPAs should be entered into as needed, but Appendix C does the needed job of laying out the bases and roles. * EPDP Team will need to determine who is controller, what are the purposes, etc, but appendix C does not add anything in that regard. Elements that will shape the agreements will be part of the policy recommendations and teased out in the other sections, not Appendix C. * Consider moving this to a parking lot item. Action item #6: Thomas to illustrate for the group what needs to go into a joint controller agreement Action item #7: Margie to review appendix C and indicate what aspects may need a specific mention in the policy recommendations. 7. (Tentative) Data matrix formed from RDS work and Thomas’s chart * Deferred to Thursday's meeting Action item #8: Kurt to confer with Thomas to prepare data elements discussion - anyone else interested in this prep conversation to reach out to Kurt. 8. (Tentative) Introduction to Appendix A * Deferred to the next meeting 9. Confirm action items and questions for ICANN Org, if any 10. Wrap and confirm next meeting to be scheduled for Thursday 6 September at 13.00 UTC. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

1 0

Recordings, Attendance & AC chat from the GNSO Temp Spec gTLD RD EPDP held Tuesday, 04 September 2018
by Andrea Glandon Sept. 4, 2018

Sept. 4, 2018

Dear all, Please find the attendance and AC chat attached to this email. The MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Tuesday, 04 September 2018 at 13:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/0gONBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-04sep18… AC Recording: https://participate.icann.org/p6f45qzo5jq/<https://participate.icann.org/p6f45qzo5jq/?OWASP_CSRFTOKEN=1878425a032e0b15…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ [community.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> Thank you. Kind Regards, Andrea Glandon

1 0

Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Thursday, 06 September 2018 at 13:00 UTC
by Andrea Glandon Sept. 4, 2018

Sept. 4, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesday’s and Thursday’s at 13:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/0gONBQ Kind Regards, Andrea Glandon

1 0