September 2018 - Gnso-epdp-team

Recordings, Attendance & AC chat from the GNSO Temp Spec gTLD RD EPDP held Thursday, 20 September 2018
by Andrea Glandon Sept. 20, 2018

Sept. 20, 2018

Dear all, Please find the attendance and AC chat attached to this email. The MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Thursday, 20 September 2018 at 13:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/3gONBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-20sep18… <https://urldefense.proofpoint.com/v2/url?u=https-3A__audio.icann.org_gnso_g…> AC Recording: https://participate.icann.org/p41orwlww7g/ ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

Letter from ICANN Business and Intellectual Property Constituencies to Göran Marby
by Johan Helsingius Sept. 20, 2018

Sept. 20, 2018

Hi all, I noticed this letter (on "Next Steps for Access to Non-Public WHOIS", and I am wondering what impact (if any) it has on our work? https://www.icann.org/en/system/files/correspondence/bc-ipc-to-marby-07sep1… Julf

2 1

Proposed agenda for EPDP Meeting #15 - 20 September 2018
by Caitlin Tubergen Sept. 20, 2018

Sept. 20, 2018

Dear All, Please find below the proposed agenda for Thursday’s EPDP Team meeting. As a reminder, you can find the action items and their expected delivery date/time here: https://community.icann.org/x/NwSNBQ. Best regards, Marika, Berry and Caitlin EPDP Meeting #15 Agenda Thursday, 20 September 2018 1. Roll Call & SOI Updates (2 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes) 3. Review and discuss draft agenda for EPDP meeting in Los Angeles (30 min) To obtain input on the agenda and a common understanding of the objectives of the meeting. To discuss a routinized way of discussing topics since there will be elements of repetition in discussing many “purposes,” many data elements, and so on. 4. Continue with purposes matrix to complete discussion of purposes §§4.4.11 – 4.4.13. (30 min) During Tuesday’s meeting, we reviewed the sub-sections where team comments added parties to be included for each purpose. We ended with §4.4.10, having to do with the zone file. We intend to finish off the remaining sub-sections asking each newly added party to explain why this is a legitimate and lawful purpose. 5. Introduction to Appendix A (30 minutes) Elements of Appendix A are on the agenda for the Los Angeles meeting, so an introduction of the key areas is required. Background: Relevant charter questions: f1) Should there be any changes made to registrant data that is required to be redacted? If so, what data should be published in a freely accessible directory? f2) Should standardized requirements on registrant contact mechanism be developed? f3) Under what circumstances should third parties be permitted to contact the registrant, and how should contact be facilitated in those circumstances? Key topics are Appendix A §§2-4. Note feedback already received on Appendix A input document 6. Confirm action items and questions for ICANN Org, if any (5 minutes) 7. Wrap and confirm next meeting to be scheduled for Monday, 23 September at 15.30 UTC at ICANN Los Angeles.

1 1

Los Angeles Meeting Agenda - Proposed
by Kurt Pritz Sept. 19, 2018

Sept. 19, 2018

Hi Everyone: Attached is a draft agenda for the Los Angeles meeting. It was developed after a discussion with CBI and the support team - even though the final product is relatively simply. Overall: 1) we plan to focus on very few, key issues where closure must be reached in order to deliver a policy. 2) there is a great deal of flexibility built in; by focusing on few issues we can choose to extend discussion in any one area if need be. There is also great flexibility (on my part) for amending the agenda in any way. Some of you asked to provide significant input into the agenda and this draft is not intended to cut-off any other ideas. So your comments are welcome. Basically, the topics covered are: 1) Elements of the Policy being created that will replace the temporary specification? I.e., to narrow our scope, what is the minimum required to adequately replace the temporary specification with a policy that enables ICANN, contracted parties and others to carry on their activities in a GDPR-compliant way? (This is just 90 minutes at the top of the meeting.) 2) Completing the replacement of section 4.4 - legitimate purposes for processing registration data. 3) Discussion of the data element themselves: which can be legally collected and which must be related. This will take into account the life-cycle of the data elements and handling of data disclosure to various parties (data escrow providers, registries, dispute resolution providers, others) so that the policy can demonstrate compliance will all aspects of the GDPR. These are essentially Appendix A issues. That’s it. Again, there is some purposeful ambiguity in the schedule to provide flexibility. If that makes us uncomfortable, we can make the time allotted for each discussion more specific. We’ll make the agenda the subject of our meeting tomorrow. Comments very welcome on email or in the meeting. Best regards, Kurt

1 0

Recordings, Attendance & AC chat from the GDPR Q&A session with the GNSO Temp Spec gTLD RD EPDP held Wednesday, 19 September 2018
by Andrea Glandon Sept. 19, 2018

Sept. 19, 2018

Dear all, Please find the attendance and AC chat attached to this email. The MP3 and AC recording below from the GDPR Q&A session with the GNSO Temp Spec gTLD RD EPDP held on Wednesday, 19 September 2018 at 13:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/lAWrBQ MP3: https://audio.icann.org/gnso/gnso-gdpr-epdp-gtld-rd-temp-specs-19sep18-en.m… <https://urldefense.proofpoint.com/v2/url?u=https-3A__audio.icann.org_gnso_g…> AC Recording: https://participate.icann.org/p2ay385gtib/<https://participate.icann.org/p2ay385gtib/?OWASP_CSRFTOKEN=cb0b0376b5be585e…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

***REMINDER*** Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Thursday, 20 September 2018 at 13:00 UTC
by Julie Bisland Sept. 19, 2018

Sept. 19, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesday’s and Thursday’s at 13:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/3gONBQ Kind Regards, Andrea Glandon

1 0

EPDP Agenda: Thursday, 20 August
by Kurt Pritz Sept. 18, 2018

Sept. 18, 2018

Hi Everyone: Recognizing the validity of Milton’s remark about the today’s meeting agenda and the need to remain focused on the issues most pertinent to our goals, I am writing to briefly consult with you regarding our agenda for Thursday, 20 September. Should we continue with our discussion of “purposes for processing registration data” and the re-writing of §4.4 of the Temporary Specification? Work and results on this is probably our key deliverable in the Los Angeles meeting next week. The current plan for the meeting on Thursday is to discuss the matrix of data elements, either currently collected or proposed to be collected. (This is work developed by Thomas.) We also plan to discuss which of these data are to be redacted. This agenda is in line with our current meeting cadence of alternating topic, meeting-by-meeting so that this group has some time to consider and respond to the issues raised. Discussion of data elements is also a key topic for progress next week. In fact, these are the two areas upon which the agenda will center: purposes for processing registration data and describing which data elements are allowable under the law. Given that the perspective from the outside is often different from the inside, I’d appreciate feedback on this. If you have a clear preference for the agenda topic, please respond. Also, and this is important to creating the agenda, please include specific aspects of the topic that should be addressed and why it is important to take that up at this upcoming meeting. Thanks for considering this and any fast responses. We strive to send the agenda out 36 hours before the meeting but will delay slightly in this case. Best regards, Kurt

1 0

Notes and action items from today's EPDP Team Meeting - 18 September 2018
by Marika Konings Sept. 18, 2018

Sept. 18, 2018

Dear All, Below, please find notes and action items from today’s EPDP Team Call. As a reminder, our next meeting will be Thursday, 20 September, 13:00 UTC. Best regards, Caitlin, Berry, and Marika =============== EPDP Team Meeting #14 Tuesday, 18 September 2018 Notes and Action Items High-level Notes/Actions: Action item #1: Please complete GDPR Training Course by Tuesday 18 September All EPDP Team Members, Alternates and Liaisons should have received an email with login credentials from noreply(a)grcelearning.com on Monday, 10 September. Action item #2: EPDP Team to submit any questions / topics for the upcoming session with Becky Burr to the google doc: https://docs.google.com/document/d/1QBy9YhdoaQ2yBmPicUSJai9YaNPZWrRywFJVlJA… Action item #3: Staff to review principles document and aim to identify where Appendix C data processing principles are already covered in other parts of the Temporary Specification and suggest a way to integrate the required materials.. Action item #4: EPDP Team leadership to see if certain comments made in relation to this discussion on 4.4 can be translated into principles that would guide the EPDP Team's discussion on purposes. Questions for ICANN Org from the EPDP Team: None Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates * Attendance will be taken from Adobe Connect * Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) a) Reminder to complete GDPR Training Course by Tuesday, 18 September Action item #1: Please complete GDPR Training Course by Tuesday 18 September b) Reminder of GDPR Q&A session with Becky Burr on Wednesday, 19 September, scheduled for 13.00 UTC. Action item #2: EPDP Team to submit any questions / topics to the google doc: https://docs.google.com/document/d/1QBy9YhdoaQ2yBmPicUSJai9YaNPZWrRywFJVlJA… c) ICANN63 Travel Support * 4 applications received which were all granted d) Recap CBI Open House Session * Session held yesterday to allow EPDP Team members to provide input on do's and don'ts for a F2F meeting. Will guide development of the agenda and approach for F2F meeting next week. * Session was recorded and transcribed for those interested. * Draft agenda expected to be shared shortly. There may a need for iteration. Likely to be shared with EPDP Team for input. e) Other updates, if applicable * Use of DSIs - one stop shop for all documentation that supports a certain subject. Slides are to a certain extent a duplication of this information. Going forward rely much more heavily on those to serve as a reference for the deliberations. * CBI - has invited teams to reach out to provide further guidance as needed. CBI to provide status update on outreach. * See timeline - 8 meetings left to ICANN63, which includes 3 days of F2F 3. Appendix C (30 minutes) Objective: Reach Preliminary Agreement on how to move forward with Appendix C a. Review additional input provided by RySG b. Agree on next steps * Original proposal provided by RySG (see email from Alan Woods) to remove Appendix C * Modification by BC (see email from Margie Milam) - some principles outlined in the document should be kept * Support for modification as suggested by BC by IPC (see email from Diane Plaut) * Redline of Appendix C shared with the mailing list which aims to apply the modifications suggested by Margie. Proposal to use that as a starting point. Transformation to principles so no longer an appendix. * Note that additional input was received from RySG in response to BC proposal. * Proposals are diametrically opposed as RySG proposed to eliminate all of Appendix C. Views are coming from very different perspective - focus from RySG is on what absolutely has to get done to assure GDPR compliance, while others seem to focus on broader issues and topics that go beyond that narrow remit. Need to agree on what the scope of work and EPDP Team deliverable is. * Need to make GDPR requirements enforceable vis a vis those that might not be governed by GDPR. However, the policy EPDP Team needs to come up with has to adhere to the named principles, so they will (hopefully) be baked into our policy. For other areas, it may be better to just state that GDPR principles need to be followed and maybe have an explanatory document along with the Policy (but not part of it) that quotes the text of the law? * Would removing Appendix C be taking a step back? Provides data subject with the information necessary to ensure compliance with GDPR. * Significant part of appendix C is reciting GDPR - is that really necessary? There shouldn't be a need to replicate. But need to focus on defining legitimate interests as outlined in Appendix C. * Need to review if there are operational aspects that should be retained and achieve the aims that were stated by BC/IPC. * Reasons for keeping Appendix C are not what appendix C actually does so it does not seem to add value. Encourage to re-read the input provided by the RySG as to why Appendix C is not needed and how the important principles are already covered in other areas. * Review data processing principles document and determine which aspects already appear in the temp spec and as such may not be needed. Also make sure that exact wording and/or reference of GDPR is used. * Some of the aspects referenced may not be relevant for the policy - contracted parties have certain obligations that they have to follow regardless, putting certain principles in a policy is not the task of the EPDP and shouldn't be the focus. Need to agree on the scope of EPDP Team's work. EPDP Team will have to apply its judgement to ensure that recommendations have the right level of specificity. Broad remit for how specific group can be. Action item #3: Staff to review principles document and aim to identify where Appendix C data processing principles are already covered in other parts of the Temporary Specification. 4. Section 4.4 (80 minutes) Objective of discussion: (1) begin formulating answers to Charter questions: Part 1: Purposes for Processing Registration Data a) Purposes outlined in Sec. 4.4.1-4.4.13 of the Temporary Specification: a1) Are the purposes enumerated in the Temporary Specification valid and legitimate? a2) Do those purposes have a corresponding legal basis? a3) Should any of the purposes be eliminated or adjusted? a4) Should any purposes be added? (2) begin formulating answers to EDPB advice re: ICANN not conflating its own purposes with the interests of third parties. a. Review input received on Registrar purposes (see https://docs.google.com/document/d/1IinDj9isH6uU-KYIVPPu2GyT0-Q3urTXXIW1Hhr…) b. Agree on next steps c. Review input received on overview of purposes (see https://docs.google.com/spreadsheets/d/1RivZFrPQpJ_bgDlOI6yfhhYaSs2oYgS1n4T…) d. Agree on next steps New format of 4.4: * Registrar purposes for processing data * Registry purposes for processing data * ICANN purposes for processing data * Purposes for processing data by third-party interests * There would likely be repetition of purposes in these categories. * Consider separating between first and third party purposes - need to establish who wants what. Or should focus be on who needs what, not who wants what. * Next step following matrix would be what kind of data is processed. May be difficult to itemize each use, but may be able to approach this in a more general way and base it on ICANN Bylaw provisions. * ICANN purposes and registrars/registries are not necessary the same thing. Looking here only at ICANN purposes. Third parties do not have purposes, it is their interest - these are separate things. * The aim of this table is ONLY to establish who is pursuing what purposes. Let's work on legal basis, rationale and other questions in the data matrix and then link back to this document to match (if possible) the processing activities in the data matrix with the purposes (which might need to be refined or narrowed as the case may be). Hence, the language in this list of purposes is provisional only. * Need to conduct a privacy impact assessment on the framework EPDP Team is looking at. ICANN Bylaws may not comply with data protection law. * Detailed and specific interests of third parties are separate and need to be dealt with elsewhere, but ICANN's Bylaws do fit in within ICANN's purpose as outlined in 4.4.8 and 4.4.9. It is to recognize what is within ICANN's Bylaws (see for example email Laureen sent to the list). * Is there conflation between the purposes of ICANN and those of registries and registrars? * Registries and registrars have purposes for processing data and this is separate from ICANN Org purposes. CP will try to limit their liability. Where is the voice of ICANN? Would ICANN take responsibility for requiring the processing of certain data? Isn't this for the EPDP Team to determine? Or is ICANN Org expected to provide this input? Bylaws are the result of community work and recommendations, not staff. * Could some of the points made be translated into principles that should guide the EPDP Team's discussion on purposes. * Who is pursuing what purpose? This is separate from the exercise of whether the purpose is lawful, is there a legal basis to support a certain purpose? * Review overview of purposes chart - note proposed modifications in red. Goal is to get clarification for why additional interests for processing where added for certain groups. At later stage assessment would be made in relation to legitimacy. * Need to make sure that purposes for access are listed, even if details of access are dealt with at a later stage - agree that first need to talk about the other purposes and only then focus on third party interests. The access and disclosure question is an important one, but may get lost and tied up in that discussion if deliberations are started now. Even though some may want to put a marker down and spelling out a purpose for why data needs to be collected for an access purpose, but you cannot discuss the legality of collection of data without answering the question of the legality of access. Need to determine first what can be collected - if there are additional purposes that justify collection these could be added later on. There will be iteration, let's not get hung up on how this iteration is done. * 4.4.3 - ICANN purpose as it aims to address abuse. Disagreement - identification or contacting is not a purpose for ICANN. But it is probably a purpose for other registrars, not necessarily the original registrar. Giving the registrant a right to transfer the name from one to another - important for registrant interests. * Enabling a mechanism for identifying a registered name holder - for example, UDRP - identifies the registrant so that dispute can continue. Compliance processes - could ask ICANN Compliance whether they ever need to verify the identity of a registrant to determine whether a complaint is valid. ICANN has obligation in relation to accuracy of WHOIS - need to have access to registrant information. Need to identify that a registrant is linked to a certain registration (not necessarily verify that the registrant is who he/she says they are). * For UDRP, it is actually a registrar purpose not ICANN - they do not have a necessity to see that data. Separate processing of data when data subject complains to ICANN as data is provided directly. Accuracy is invoked through audit, not through access. Need to ask the question of necessity - what is necessary? If it is not necessary to fulfil that function, it should not be included. * May need to clarify what is meant with 'identifying'? Is it just to link registrant to a certain domain name registration or is something else meant here? * Transfers are now solely reliant on auth info codes - no longer dependent on WHOIS data. * Note that this clause is further limited as it references purposes identified below. * 4.4.4 - to be removed as no one is identified as pursuing this purpose. * 4.4.10. - not clear on how this works in practice, does access to zone files require facilitation? Do zone files contain personal data? No, unlikely. Maybe this should be discussed together with ICANN purposes as it is not clear who is pursuing this purpose? May be put in in relation to the centralized zone data service (CZDS)? Data has nothing to do with the registration of the domain name - is completely separate data processing activity so does not belong here and not within scope for EPDP Team. Agreement that zone files do not contain personal data and as such this purpose should not be further considered by the EPDP Team. Action item #4: EPDP Team leadership to see if points made in relation to this discussion on 4.4 can be translated into principles that would guide the EPDP Team's discussion on purposes. 5. Confirm action items and questions for ICANN Org, if any (5 minutes) 6. Wrap and confirm next meeting to be scheduled for Thursday 20 September at 13.00 UTC. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

1 0

Recordings, Attendance & AC chat from the GNSO Temp Spec gTLD RD EPDP held Tuesday, 18 September 2018
by Andrea Glandon Sept. 18, 2018

Sept. 18, 2018

Dear all, Please find the attendance and AC chat attached to this email. The MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Tuesday, 18 September 2018 at 13:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/3AONBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-18sep18… <https://urldefense.proofpoint.com/v2/url?u=https-3A__audio.icann.org_gnso_g…> AC Recording: https://participate.icann.org/p2p4iyylf10/<https://participate.icann.org/p2p4iyylf10/?OWASP_CSRFTOKEN=cb0b0376b5be585e…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Thursday, 20 September 2018 at 13:00 UTC
by Andrea Glandon Sept. 18, 2018

Sept. 18, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesday’s and Thursday’s at 13:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/3gONBQ Kind Regards, Andrea Glandon

1 0