September 2018 - Gnso-epdp-team

Re: [Gnso-epdp-team] Input on registrar related purposes - due by Friday 14 September at 19.00 UTC
by Caitlin Tubergen Sept. 13, 2018

Sept. 13, 2018

Dear All, Friendly reminder to provide feedback on the proposed registrar purposes in the following google doc: https://docs.google.com/document/d/1IinDj9isH6uU-KYIVPPu2GyT0-Q3urTXXIW1Hhr…. Please provide your group’s feedback in the rightmost column. Please be sure to include your name and affiliation and provide your recommendation regarding accepting / amending as well as your rationale for any further changes that are proposed. As a reminder, this only concerns the registrar related purposes. Other purposes and third-party interests are dealt with separately. Note that input is due at the latest by tomorrow, Friday 14 September at 19.00 UTC. Kind regards, Marika, Berry and Caitlin From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Tuesday, September 11, 2018 at 11:37 AM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Input on registrar related purposes - due by Friday 14 September at 19.00 UTC Dear All, In order to facilitate your input and come to closure on the modifications to the registrar related purposes (as per action item #6), staff has created the following google doc: https://docs.google.com/document/d/1IinDj9isH6uU-KYIVPPu2GyT0-Q3urTXXIW1Hhr…. Please provide your group’s input in last column. Make sure to include your name and affiliation and provide your recommendation regarding accepting / amending as well as your rationale for any further changes that are proposed. As a reminder, this only concerns the registrar related purposes. Other purposes and third-party interests are dealt with separately. Note that input is due at the latest by Friday 14 September at 19.00 UTC. Best regards, Caitlin, Berry and Marika Action item #6: EPDP Team to review email from Kurt re. Registrar purposes (see https://mm.icann.org/pipermail/gnso-epdp-team/2018-September/000337.html) and provide input by Friday 14 September at 19.00 UTC at the latest. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses and visiting the GNSO Newcomer pages.

1 0

[article] Beginning of the end for DomainTools? Court orders it to scrub Whois records
by Ayden Férdeline Sept. 13, 2018

Sept. 13, 2018

Dear all, I am sharing this article published today by Domain Incite for information purposes, as I think is it is broadly relevant to our work: Beginning of the end for DomainTools? Court orders it to scrub Whois records http://domainincite.com/23401-beginning-of-the-end-for-domaintools-court-or… > “… A Washington court yesterday handed down a preliminary injunction against the company, after New Zealand’s Domain Name Commission sued it in July for scraping and republishing its Whois in violation of its terms of service. > > Notably — especially if you’re involved in the ongoing Whois reform debate — Judge Robert Lasnik’s scathing order rubbished DomainTools’ claims that its historical Whois service provides a public interest benefit that outweighs the privacy interests of .nz registrants.” (Emphasis added) Kind regards, Ayden Férdeline

1 0

FW: Questions for ICANN Org from EPDP Team Meeting - 9 August 2018
by Marika Konings Sept. 13, 2018

Sept. 13, 2018

For your information. The responses to these questions will be posted on the related wiki page: https://community.icann.org/x/ahppBQ. Best regards, Caitlin, Berry and Marika From: Trang Nguyen <trang.nguyen(a)icann.org> Date: Tuesday, August 28, 2018 at 09:12 To: Marika Konings <marika.konings(a)icann.org>, Daniel Halloran <daniel.halloran(a)icann.org>, Erika Randall <erika.randall(a)icann.org> Cc: Berry Cobb <Berry.Cobb(a)icann.org>, Caitlin Tubergen <caitlin.tubergen(a)icann.org> Subject: Re: Questions for ICANN Org from EPDP Team Meeting - 9 August 2018 Hi Marika, Please see below responses to the question from the 21 August meeting. Best, Trang ** QUESTION: Can an update be provided on the status of the reconfirmation of the Temporary Specification by the ICANN Board? Response: There is a board meeting planned for later today (21 August). No changes to the Temporary Specification are being proposed. RESPONSE: The Board reaffirmed<https://www.icann.org/resources/board-material/resolutions-2018-08-21-en> the Temporary Specification with no changes on 21 August 2018. QUESTION: Has the WHOIS Conflicts with local laws procedure been used and successfully used to date? Please indicate the instances where the procedure was invoked and the outcome. Were any specific issues identified with the use of this procedure? RESPONSE: The procedure was most recently invoked for .FRL in late 2017. However, the request was withdrawn prior to an outcome when .FRL agreed to comply with the requirements of the Temporary Specification. The request was withdrawn early on in the process so ICANN org had not conducted a formal review to identify specific issues with the procedure. The procedure was also previously attempted by .FRL in late 2016 but the request did not meet the requirements to utilize the procedure. At the time, requirement to trigger the procedure was that the contracted party must have received “notification of an investigation, litigation, regulatory proceeding or other government or civil action that might affect its compliance.” However, .FRL was not subject to any such proceeding at the time, and the procedure could not be used. QUESTION: Regarding data disclosures concerning LEA requests: does GDPR compel a report of those disclosures to be made to the data subject? Please provide analysis of “in-jurisdiction” and “out-of-jurisdiction” requests. RESPONSE: The latest Draft Framework for a Possible Unified Access Model for Continued Access to Full WHOIS Data – For Discussion<Draft%20Framework%20for%20a%20Possible%20Unified%20Access%20Model%20for%20Continued%20Access%20to%20Full%20WHOIS%20Data%20–%20For%20Discussion> addresses the question of “whether or not logs of query activities concerning non-public data must be available to the registrant upon request except if prohibited by a relevant court order or legal requirement.” Please refer to Section 8 of the draft framework for more information on this topic. The draft framework is published for community discussion and to seek guidance from the European Data Protection Board. With a better understanding of the law, we will all be well positioned to develop, implement and enforce a legally sound, consistent unified model for access to non-public registration data, and lower the risk for the contracted parties in order for them to be able to accept such model.

5 4

Recordings, Attendance & AC chat from the GNSO Temp Spec gTLD RD EPDP held Thursday, 13 September 2018
by Andrea Glandon Sept. 13, 2018

Sept. 13, 2018

Dear all, Please find the attendance and AC chat attached to this email. The MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Thursday, 13 September 2018 at 13:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/2gONBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-13sep18… AC Recording: https://participate.icann.org/p2g9i4c1pwk/ ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

Notes and action items from today's EPDP Team Meeting - 13 September 2018
by Caitlin Tubergen Sept. 13, 2018

Sept. 13, 2018

Dear All, Below, please find notes and action items from today’s EPDP Team Call. As a reminder, our next meeting will be Tuesday, 18 September, 13:00 UTC. Best regards, Marika, Berry, and Caitlin EPDP Team Meeting #13 13 September 2018 High-level Notes/Action Items Please complete the IT Governance GDPR Training Course by Tuesday, 18 September. A GDPR Q&A session with Becky Burr will be held on Wednesday, 19 September at 13.00 UTC. If you have questions and/or topics you would like Becky to address, please submit questions via this document: https://docs.google.com/document/d/1QBy9YhdoaQ2yBmPicUSJai9YaNPZWrRywFJVlJA…. The EPDP Leadership Team is putting together an agenda for the F2F meeting, and the preliminary schedule will be published early next week - if anyone from the EPDP Team would like to provide ideas or suggestions, please feel free to do so via the list. The team should have received an email regarding the engagement of CBI for mediation services. CBI will be present during the F2F meeting in Los Angeles to assist in moving the team forward. Please remember to provide further comments on §4.4 and Thomas and Benedict's purposes classification by Friday, 14 September. Thomas Rickert will further develop the data elements matrix based on today’s discussion. ICANN Support Team will create a distribute Google docs to allow members to work on answering the issues addressed for Appendix A, §§2.1 - 2.3, Appendix A §2.4, Appendix A §1, Appendix A, §4. The EPDP Leadership Team is looking for a small team of volunteers to work on this. Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates Attendance will be taken from Adobe Connect Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) Reminder to complete GDPR Training Course by Tuesday, 18 September Reminder of GDPR Q&A session with Becky Burr on Wednesday, 19 September at 13.00 UTC Leadership Team is putting together an agenda for the F2F meeting - the preliminary schedule will be published early next week - if you have ideas, please let the leadership team know The team should have received an email regarding the engagement of CBI (for mediation services) With respect to action items, please take note of the impending due date (Friday, 14 September) for comments on §4.4 and further comments on Thomas and Benedict's purposes classification by Friday, 14 September. Other updates, if applicable Action item #1: If anyone from the EPDP Team would like to provide ideas or suggestions for the F2F in Los Angeles, please feel free to do so via the list. 3. Review data matrix formed from RDS work and Thomas’s chart (50 minutes) Objective of discussion: Charter questions b1 and b2 (collection of data by registrar) to be answered (or considered) in substantive discussion High-level overview of chart This document brings together Thomas's chart with work the RDS Team worked on. In the first column on the left, all data elements that are currently required, including non-WHOIS elements, appear. The second column are registry, registrar or contract purposes. The rationale column is to be used to provide rationale to the data elements. The two tables complement each other. During the last call, we discussed the purposes and who is pursuing the purposes. What we are trying to do now is to look at operational steps between the registrar and the registrant - what data can be collected by the registrar. We are not talking about passing on data to the registry or questions related to the disclosure of the data. The first step is to analyze what data the registrar requires to fulfill the contract. The outcome will be a table what data will be collected to perform the contract vis-a-vis the registrant. Secondly, what data can be collected for a third party. Art.6(I)(f) For the focus of this call, let's focus on what needs to be collected by registrars to perform the contract. Column A of the document shows all of the data elements ICANN requires to be collected. Some of the elements may be out of scope for this EPDP, but they are included for the sake of comprehensiveness. Question for discussion: does anyone object to the data being collected to perform the contract? To execute the contract b/w a Rr and Rt, it's not necessary to collect any of this data. Even if we focus on registrant records as required, a lot of these that are mandatory should be moved to optional (fax number, for example). Because of the confusion on how organization is displayed, many natural persons retype their names, and that creates complications. Some fields are marked as optional. A radio button for asking for natural person/legal person declaration could be helpful. If you think about the registrar role, the registrar does not dictate what goes into the registry. There are policy reasons for some of this data. ICANN Staff should go back and look at the RAA and Consensus Policy and see what is required to be collected. Perhaps it would be helpful for members to denote which fields should be optional into the chat. For the distinction b/w natural and legal entities, that is a discussion we need to have. With respect to the contract, the data elements in Column A should represent what Margie has suggested in terms of contract and consensus policies. The mere fact that these elements appear in another document does not de facto mean that it is lawful to collect the data. It might be helpful to distinguish optional vs. mandatory by denoting optional data in a separate column. The legal bases under the ICANN contract and third party legitimate interests are all tied together. What data elements are required for a domain name registration to work? The word optional should not be construed as consent and should be identified separately. Other than a few elements such as domain name servers, there is nothing collected in WHOIS for the registrar or registry to do their business. The meta question being raised with the respect to the data needs to be resolved. In some sense, the ICANN process is the equivalent of an ownership title for the domain registrant. Are we discussing the contract b/w Rr and Rt, or are we talking about the whole contractual framework, and if so, how can we define the third party legitimate interests? We are trying to focus on what data is required to perform the contract with the registrant. The fundamental confusion of the group is that we are merging ICANN's purposes with the Rr/Rt contract. The team is necessarily confused because the group has not agreed on the parameters of what we're doing. This problem is not being approached in a logical way. An example: escrow data. Many things are out of scope in this discussion, but from the pure purpose of registrant rights, we have escrow data. The EPDP Charter is broad enough to allow us to deal with all data collection. We are here to discuss what elements that are currently in the contract that should be used in the future. While we have an aversion to invoking third party requirements, virtually nothing in WHOIS is necessary for the registrar. Who is the controller for purposes of this discussion? We are going to determine the controller decision later. Is there any opposition to leaving the data elements for the Rt as they are with the elements marked optional as they are with the qualification that we need to find a solution for a demarcation b/w natural and legal persons. Why do we need all three - phone, fax, and email? The premise that none of this data is needed to perform the registrar-registrant contract does not seem correct. In terms of what data elements are not necessary - you do not need a phone number or a fax number, particularly when we're talking about many people not having one. Are we also getting to technical and administrative contacts? Why do we need to have a philosophical discussion over whether fax should be provided? If the Team can agree on an approach for how to deal with existing data elements, that would be helpful. The Temp Spec took the approach of not adding new or removing existing data elements, and the Temp Spec specified elements that in certain circumstances would not need to be displayed in RDS. Is it important to rename the name and organization fields to better reflect natural and legal persons? It appears there is some traction to rename name and organization as data elements. For street, city, postal code, these are uncontroversial. Shall the phone number data element be kept as it is? There is a divergance on the requirement for the phone data element. Do you agree that the phone extension should be kept as it is (as optional)? Most want to keep it. Shall the fax be kept as optional? There is divergence on this point. Should the fax extension be kept as is? It appears most members would like this deleted. For members asking that phone numbers need to be retained, please give the reason since phone numbers can be abused. Shall we ask staff to propose a rationale as to why these elements might be needed? Tick marks do not give a rationale as to why these data elements may or may not be required. Additionally, counting tick marks is not appropriate since there is unequal representation within this team. This topic starts to wade into the diversity of registrars and how they serve their customers. There is a high degree of duplication or redundancy. The data minimization principle would ask why the information is being collected that is a duplicate. Some registrars, however, do use admin/tech contact. We could say that if there were to become optional, they could be submitted only when they are different than the registrant contact. It would be helpful to hear from registrars who use these contacts what the rationale is. We should differentiate whether a field is optional and whether entry to a field is optional. How we treat optional is critical in these types of cases. Whose policy are we setting here with respect to mandatory or optional? b) Discuss proposed amendments to chart c) Note: relevant charter questions: b1) What data should registrars be required to collect for each of the following contacts: Registrant, Tech, Admin, Billing? b2) What data is collected because it is necessary to deliver the service of fulfilling a domain registration, versus other legitimate purpose as outlined in part (A) above? d. Agree on next steps 4. Introduction to Appendix A (50 minutes) Objection of discussion: Charter questions f1 - f3 (publication of data by registry/registrar) to be answered (or considered) in substantive discussion; EDPB advice re: collection of full WHOIS data and registration of legal persons to be considered in substantive discussion. In App. A discussion, we were going to focus on priority 1 and 2a items (the items we need to sort through in our initial report). Action item #2: ICANN Support Team to create Google docs to allow members to work on answering the issues addressed for Appendix A, 2.1 - 2.4. a) Substantive discussion on §§2 – 4 b) Note: relevant charter questions: · f1) Should there be any changes made to registrant data that is required to be redacted? If so, what data should be published in a freely accessible directory? · f2) Should standardized requirements on registrant contact mechanism be developed? · f3) Under what circumstances should third parties be permitted to contact the registrant, and how should contact be facilitated in those circumstances c. Agree on next steps 5. Confirm action items and questions for ICANN Org, if any (5 minutes) 6. Wrap and confirm next meeting to be scheduled for Tuesday 18 September at 13.00 UTC.

1 0

Section 4.4.8
by Alex Deacon Sept. 13, 2018

Sept. 13, 2018

Hi All, As you know a group of us has been working to recommend an update to Section 4.4.8 of the temp spec. While we haven't come to full agreement on the update, we are pretty close and wanted to share the current/tentative output of the volunteer team with the broader team. 4.4.8 Supporting a framework that enables identification of third-parties with legitimate interests grounded in legal bases, and providing these third-parties with access to Registration Data relevant to addressing specific issues involving domain name registrations *related to consumer protection, investigation of cybercrime, DNS abuse and intellectual property protection. * The non-bold text was suggested by Amr/NCSG and the added bold text was an updated suggested by me/IPC and supported by the BC. Giving it a re-read again today I think additional word-smithing could be warranted, but for now I will resist and step away and let others share their thoughts. Alex -- ___________ *Alex Deacon* Cole Valley Consulting alex(a)colevalleyconsulting.com +1.415.488.6009

6 8

Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 18 September 2018 at 13:00 UTC
by Andrea Glandon Sept. 13, 2018

Sept. 13, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesday’s and Thursday’s at 13:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/3AONBQ Kind Regards, Andrea Glandon

1 0

Re: [Gnso-epdp-team] Section 4.4.8
by Alan Greenberg Sept. 13, 2018

Sept. 13, 2018

I am generally in support of this, but I question the term "grounded in legal bases". It this the legal basis in reference to GDPR (ie that there needs to be a legitimate demonstrable need to access otherwise private information). Or a legal basis as in reference to law enforcement having a right to demand certain information. I can accept the former (if it is made clear), but not the latter. ICANN's Mission-defined interest in ensuring that security and stability of the DNS (and by implication, the trusted nature of the DNS) may create a need for cybersecurity workers to have access to certain data, but there is no LAW that gives them that right. Alan At 11/09/2018 04:33 PM, Alex Deacon wrote: >Hi All, > >As you know a group of us has been working to recommend an update to >Section 4.4.8 of the temp spec. > >While we haven't come to full agreement on the update, we are pretty >close and wanted to share the current/tentative output of the >volunteer team with the broader team. > >4.4.8 Supporting a framework that enables identification of >third-parties with legitimate interests grounded in legal bases, and >providing these third-parties with access to Registration Data >relevant to addressing specific issues involving domain name >registrations related to consumer protection, investigation of >cybercrime, DNS abuse and intellectual property protection. > > >The non-bold text was suggested by Amr/NCSG and the added bold text >was an updated suggested by me/IPC and supported by the BC. > >Giving it a re-read again today I think additional word-smithing >could be warranted, but for now I will resist and step away and let >others share their thoughts. > >Alex > > > >-- >___________ >Alex Deacon >Cole Valley Consulting ><mailto:alex@colevalleyconsulting.com>alex(a)colevalleyconsulting.com >+1.415.488.6009 > >_______________________________________________ >Gnso-epdp-team mailing list >Gnso-epdp-team(a)icann.org >https://mm.icann.org/mailman/listinfo/gnso-epdp-team

4 5

questions/answers from ICANN org
by Caitlin Tubergen Sept. 12, 2018

Sept. 12, 2018

Dear All, Below, please find questions and answers from recent EPDP questions to ICANN org. Please note the questions and answers can be also be found on the wiki page here: https://community.icann.org/display/EOTSFGRD/Input+from+ICANN+Org. Kind regards, Marika, Berry and Caitlin QUESTION: Language in the preamble of Appendix C is similar but different from the GDPR. What was the thinking in writing it this way? RESPONSE: The text in the preamble of Appendix C is simply an overview of the processing requirements that follows. The preamble does reference the GDPR, and it states that generally “terms with initial capital letters have the meaning given under the GDPR.” But we would need more clarity around what specific language in the preamble is seen to be similar to what specific language in the GDPR to be able to comment further on this question. QUESTION: Why did ICANN include the term content in 4.4.5? RESPONSE: To be clear, ICANN does not regulate content. Section 4.4 lists purposes for processing personal data in registration data*. The processing activities in this section are not limited to ICANN's, they include the processing activities by Registrars and Registries and other third-parties. Section 4.4.5 says one of those purposes is “Enabling a mechanism for the communication or notification to the Registered Name Holder of technical issues and/or errors with a Registered Name or any content or resources associated with such a Registered Name.” For example, a law enforcement agent investigating potentially illegal content might use the registration data to identify and contact the registered name holder as part of the investigation. As a point of reference regarding processing by third parties, on 25 May 2018 the EDPB endorsed a statement of the WP29, which stated that the “WP29 expects ICANN to develop and implement a WHOIS model which will enable legitimate uses by relevant stakeholders, such as law enforcement, of personal data concerning registrants in compliance with the GDPR, without leading to an unlimited publication of those data.” <https://www.icann.org/en/system/files/files/statement-edpb-whois-27may18-en…> (*Note that Registration Data is defined in the Temporary Specification as “data collected from a natural and legal person in connection with a domain name registration.” This is broader than just data displayed in RDDS and includes all data collected in connection with the domain name registration.)

1 0

Topics, questions and clarifications for GDPR Q & A Session
by Marika Konings Sept. 12, 2018

Sept. 12, 2018

Dear All, In order to allow for advance preparations for the GDPR Q & A session which is scheduled for next Wednesday 19 September at 13.00 UTC, please add any GDPR topics, questions and/or clarifications to this document: https://docs.google.com/document/d/1QBy9YhdoaQ2yBmPicUSJai9YaNPZWrRywFJVlJA…. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

1 0