January 2019 - Gnso-epdp-team

Re: [Gnso-epdp-team] For your review - Proposed language for agreements reached in principle
by Alan Greenberg 31 Jan '19

31 Jan '19

I prefer redaction as well. It means there needs to be a flag to indicate it can be publicly displayed, but I agree with the ICANN Org concern about losing potentially important imformation. Alan At 22/01/2019 06:25 PM, Mark Svancarek \(CELA\) via Gnso-epdp-team wrote: Regarding redaction/deletion, I think I prefer redaction. I defer to James whether redaction is technically more annoying than deletion. From: Trang Nguyen <trang.nguyen(a)icann.org> Sent: Tuesday, January 22, 2019 3:14 PM To: Mark Svancarek (CELA) <marksv(a)microsoft.com>; James M. Bladel <jbladel(a)godaddy.com>; Marika Konings <marika.konings(a)icann.org>; Sarah Wyld <swyld(a)tucows.com>; gnso-epdp-team(a)icann.org Subject: Re: [Gnso-epdp-team] For your review - Proposed language for agreements reached in principle Dear All, Regarding the organization field, ICANN org flagged the following in the AC chat during the Toronto face-to-face meeting last week. We wanted to flag this again for your consideration/discussion as you work to finalize the recommendation: Some registrants use the organization field to identify themselves, an example of this is ICANN where the registrant name is “Domain Administrator” and organization is “ICANN” ( https://www.godaddy.com/whois/results.aspx?domain=icann.org&quot<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.godad…> ;). Under 3(c) in James’s email below, if registrants do not respond the organization field would be deleted. This could result in a number of registrations where identifying information for registrants would no longer be available. It’s unclear if deletion is needed or whether redaction of the information would achieve the intent of the recommendation? Regarding the Natural vs. Legal recommendation, the proposed text of the recommendation says: “�without requiring Registrars to differentiate between registrations of legal and natural persons, although registrars are permitted to make this distinction.” Is the intent of the recommendation to limit the requirement to registrars only, or should the text include registries as well? Best, Dan and Trang ICANN Org Liaisons From: Gnso-epdp-team < gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of "Mark Svancarek (CELA) via Gnso-epdp-team" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> > Reply-To: "Mark Svancarek (CELA)" <marksv(a)microsoft.com<mailto:marksv@microsoft.com>> Date: Tuesday, January 22, 2019 at 8:32 AM To: "James M. Bladel" <jbladel(a)godaddy.com<mailto:jbladel@godaddy.com>>, Marika Konings <marika.konings(a)icann.org<mailto:marika.konings@icann.org> >, Sarah Wyld <swyld(a)tucows.com<mailto:swyld@tucows.com>>, " gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> > Subject: Re: [Gnso-epdp-team] For your review - Proposed language for agreements reached in principle Makes sense, thanks for clarifying. From: James M. Bladel <jbladel(a)godaddy.com<mailto:jbladel@godaddy.com>> Sent: Tuesday, January 22, 2019 8:08 AM To: Mark Svancarek (CELA) <marksv(a)microsoft.com<mailto:marksv@microsoft.com>>; Marika Konings <marika.konings(a)icann.org<mailto:marika.konings@icann.org> >; Sarah Wyld <swyld(a)tucows.com<mailto:swyld@tucows.com>>; gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] For your review - Proposed language for agreements reached in principle I think we need to standardize on what the “Registrant Org” field is telling us. Some registrars use this field to indicate that the Organization is the registrant, so if the end user deletes this information, it has the effect of re-assigning the name to natural person listed as the Registrant. J. From: "Mark Svancarek (CELA)" <marksv(a)microsoft.com<mailto:marksv@microsoft.com>> Date: Tuesday, January 22, 2019 at 8:05 AM To: "James M. Bladel" <jbladel(a)godaddy.com<mailto:jbladel@godaddy.com>>, Marika Konings <marika.konings(a)icann.org<mailto:marika.konings@icann.org> >, Sarah Wyld <swyld(a)tucows.com<mailto:swyld@tucows.com>>, " gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> > Subject: RE: [Gnso-epdp-team] For your review - Proposed language for agreements reached in principle I think I agree: can you clarify what this means? * Registration is re-assigned to Registrant (natural person) From: Gnso-epdp-team < gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Tuesday, January 22, 2019 6:30 AM To: Marika Konings <marika.konings(a)icann.org<mailto:marika.konings@icann.org> >; Sarah Wyld <swyld(a)tucows.com<mailto:swyld@tucows.com>>; gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] For your review - Proposed language for agreements reached in principle Hi Folks �< Let’s try to untangle this with the aim on simplicity & minimizing confusion (epdp and registrants). Here are my recollections from Toronto: Between the adoption of ePDP and some future date (Jan 1 2020?) 1. Redact Registrant ORG field. 2. Registrars contact Registrants who have data in this field, and ask them to confirm the data is correct & accurate. 3. Based upon Registrant Action � * Registrant Confirms or Corrects � Data remains n Org field. * Registrant Declines � Data in Org field is DELETED, Registration is re-assiigned to Registrant (natural person) * Registrant No Response � Data in Org field is DELETED, Registration is re-assigned to Registrant (natural person) After future date � New registrations would present some disclosure/disclaimer when data is entered in the ORG field 1. Registrars are free to innovate on the exact process, either an opt-in, or pop-up or locked/grayed out field, etc. ORG will be treated as the legal-person registrant of the domain name, with the Natural Person listed as a point of contact. ORG field will be published, if it contains data. From: Gnso-epdp-team < gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Marika Konings <marika.konings(a)icann.org<mailto:marika.konings@icann.org> > Date: Tuesday, January 22, 2019 at 6:02 AM To: Sarah Wyld <swyld(a)tucows.com<mailto:swyld@tucows.com>>, " gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> > Subject: Re: [Gnso-epdp-team] For your review - Proposed language for agreements reached in principle Thanks, Sarah, for flagging this. We actually went back and forth on this looking at the transcript and our understanding was that opt-in was for existing registrations, while opt-out would apply to any new registrations (with the appropriate information being provided to the registrant that the information for the Organization field would be published, unless indicated differently). However, as this was James’s proposal, we would like to ask him to confirm what the original proposal was so that the recommendation can be adjusted, as needed. James, over to you. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team < gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Sarah Wyld <swyld(a)tucows.com<mailto:swyld@tucows.com>> Organization: Tucows Date: Tuesday, January 22, 2019 at 05:36 To: " gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> > Subject: Re: [Gnso-epdp-team] For your review - Proposed language for agreements reached in principle Good morning, I notice a significant difference between the Toronto Day 3 notes and the draft below, regarding the Organization field. Day 3 notes - "Principles for Redaction of Registrant Organization Field" #4: 4. Upon (1) the registration of a Registered Name sponsored by Registrar or (2) the transfer of the sponsorship of a Registered Name to Registrar, the Registrar MUST inform all Registered Name Holders that the Registrant Org field will be redacted unless the Registered Name Holder affirmatively opts in to the publication of the Registrant Org field. Updated Recommendation #9 below: 4. Upon (1) the registration of a Registered Name sponsored by Registrar or (2) the transfer of the sponsorship of a Registered Name to Registrar, the Registrar MUST inform the Registered Name Holder that the Registrant Org field will be published unless the Registered Name Holder affirmatively opts in to redaction of the Registrant Org field. The Org field should be redacted by default, and the Registered Name Holder should be able to opt-in to publication. This aligns with the principle of Privacy by Default and is what we agreed on during the Day 3 meeting. Thanks, -- Sarah Wyld Tucows +1.416 535 0123 Ext. 1392 On 1/22/2019 12:33 AM, Marika Konings wrote: Dear EPDP Team, In Toronto, we reached agreement in principle on several issues but did not have time to develop language to which the team agreed. To move that discussion forward, the support team has developed the proposed language below for discussion and inclusion in the Final Report. Please review this language with your group to ensure it aligns with the agreement that was reached. If you are of the view that it does not conform to the agreement, please: Respond to this message and change the subject line to the topic of the recommendation about which you have concerns; Outline your concerns, focusing on how the proposed language does not reflect the principle agreement reached, and; Propose edits that would address your concerns that are in line with the agreement reached. The deadline for doing so is Thursday 25 January so that there is sufficient time to review and discuss any concerns. If no concerns are raised, this language will be incorporated into the draft Final Report for your review. Best regards, Caitlin, Berry and Marika ========= Based on the discussions during the F2F meeting in Toronto, the following updated language is provided for EPDP Team review on the following topics / recommendations: Natural vs. legal Draft recommendation1) The EPDP Team recommends that the policy recommendations in this Final Report apply to all gTLD registrations, without requiring Registrars to differentiate between registrations of legal and natural persons, although registrars are permitted to make this distinction.2) The EPDP Team recommends that as soon as possible ICANN Org undertakes a study, for which the terms of reference are developed in consultation with the community, that considers: * The feasibility and costs of distinguishing between legal and natural persons; * Taking into account examples of industries or other organizations where this has been successfully done; * Consider privacy risks to registrants, and; * Consider the risks of not differentiating. 3) Depending on the timing of the research, whether to inform the scope or make use of its findings, the EPDP team will discuss the Legal vs Natural issue in Phase 2. Consent to publish additional contact information Agreement in principle: In its discussion on consent, the Temporary Specification omitted RNH email as a piece of information to which the registrant could consent to publication. This draft recommendation corrects that omission. Draft recommendationThe EPDP Team recommends that, as soon as commercially reasonable, Registrar must provide the opportunity for the Registered Name Holder to provide its Consent to publish additional contact information. Organization Field Agreement in principle: Rather than requiring the publication or redaction of the Organization Field, a phased approach was suggested by Team Members that gained general agreement. Updated Recommendation #9 1. The EPDP Team recommends that Registrars MAY begin redacting the Registrant Org field immediately.2. For existing registrants: the EPDP Team recommends that Registrars MUST notify all existing Registered Name Holders that the Registrant Org field will be treated as non-personal data for new registrants beginning on [x date - to be agreed upon during the implementation of this Policy], and accordingly, the field will be published for new registrants in the freely-accessible directory beginning on [x date]. However, if existing Registered Name Holders wish to have its Organization field published within the freely-accessible database, it must affirmatively consent to the publication by opting in. If the Registered Name Holder affirmatively opts in to the publication of its existing (or modified) Registrant Organization, the Registrar may publish the Registrant Organization Field immediately and/or on the agreed-upon [x] date.3. The EPDP Team recommends if the existing Registered Name Holder does not affirmatively opt in to the publication of its Registrant Organization field, the Registrar will show the existing Registrant Organization Field but the field MAY be left blank.4. Upon (1) the registration of a Registered Name sponsored by Registrar or (2) the transfer of the sponsorship of a Registered Name to Registrar, the Registrar MUST inform the Registered Name Holder that the Registrant Org field will be published unless the Registered Name Holder affirmatively opts in to redaction of the Registrant Org field. Deferring consideration of new proposed purposes to phase 2 Agreement in principle: With regards to proposed Purpose O, the Purpose supporting ARS, and the additional purposes received through public comment, the EPDP Team understands some legal clarification is required as to whether those purposes can fall under existing Purposes. Additional complexities were introduced. Therefore, the Team decided to put off this discussion for Phase 2 where the EPDP Charter makes it clear that additional Purposes are, in fact, anticipated. Draft recommendationThe EPDP Team commits to considering in Phase 2 of its work whether additional purposes should be considered to facilitate research carried out by ICANN’s Office of the Chief Technology Officer (OCTO) as well as the continuation of the WHOIS Accuracy Reporting System (ARS). This consideration should be informed by legal guidance on if/how provisions in the GDPR concerning research apply to ICANN Org. Marika KoningsVice President, Policy Development Support � GNSO, Internet Corporatioon for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSOFind out more about the GNSO by taking our interactive courses [nam06.safelinks.protection.outlook.com]<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefens…> and visiting the GNSO Newcomer pages [nam06.safelinks.protection.outlook.com]<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefens…>. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team [nam06.safelinks.protection.outlook.com] _______________________________________________Gnso-epdp-team mailing listGnso-epdp-team(a)icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team

6 6

schedule for completing our work?
by Greg Aaron 30 Jan '19

30 Jan '19

Dear Kurt: As some have mentioned on the list, time to deliver the Final Report is rapidly approaching, and it will be difficult to squeeze yet more hours out of the team. On behalf of SSAC I'm requesting your view about what the schedule will look like between now and delivery of the Final Report to Council. It's our understanding that the GNSO operating guidelines and the EPDP charter oblige the WG to deliver certain things in the Final Report, which the WG team will need prepare in the next few weeks. The language of some of the Recommendations continues to evolve, so we are wondering at what point everyone puts down their pencils and participants will be able to review the proposed final Recommendation language. It seems that only at that point will it be possible to confirm consensus levels. Some of the tasks still to be accomplished are as follows. What is your plan for the below? 1. "Each recommendation in the Final Report should be accompanied by the appropriate consensus level designation, per the Standard Methodology for Making Decisions". When will the measuring or designation process take place, and what process are your planning to use? 2. "It is the role of the Chair to designate which level of consensus is reached and announce this designation to the Working Group. Member(s) of the Working Group should be able to challenge the designation of the Chair as part of the Working Group discussion." 3. "In cases of Consensus, Strong support but significant opposition, and No Consensus, an effort should be made to document that variance in viewpoint and to present any Minority View recommendations that may have been made. Documentation of Minority View recommendations normally depends on text offered by the proponent(s). In all cases of Divergence, the WG Chair should encourage the submission of minority viewpoint(s)." #3 above will require that the WG participants get some time with the draft Final Report to perform review and submit final notes. If all of this has already been laid out to the team, please excuse me asking again. (The schedule info I have been able to find looks out of date.) Anyway, it seems like a good time to confirm this stuff to the team as we all push to the finish line together. With best wishes, --Greg

1 0

Proposed Agenda - EPDP Team Meeting #41
by Caitlin Tubergen 30 Jan '19

30 Jan '19

Dear EPDP Team, Please find the proposed agenda for the next EPDP Team meeting below. If any EPDP Team Members believe topics based on ICANN org questions need to be added to the discussion, please let us know. The previously-circulated email re: ICANN org questions as well as a summary guide re: the questions identified in the agenda have been attached for your reference. Best regards, Marika, Berry, and Caitlin EPDP Meeting #41 Agenda Thursday, 31 January 2019 Roll Call & SOI Updates (5 minutes) Welcome and Updates from EPDP Team Chair (5 minutes) Reminder: process for email discussions and upcoming deadlines Review of outstanding action items Other updates, if applicable Continue review of public comments on Initial Report and/or revised recommendations Recommendation 11 – Data retention (20 minutes) Review small team updates and input provided (see PCRT at https://community.icann.org/x/U4cWBg and small team recommendations). Review input provided (RySG, RrSG, GAC) (5 minutes) Confirmation of agreement reached or next steps to come to agreement (5 minutes) Implementation Transition Period (30 minutes) The GNSO Council Leadership has requested the team further discuss next steps regarding implementation transition period and notes it may be helpful to include a recommendation in the Final Report. ICANN Org Questions ICANN Org Liaisons to introduce questions for discussion RDAP and SLAs – what recommendations and/or guidance needs to be included in the Final Report, or is this to be addressed during implementation? RDDS Search Capabilities - should the requirements in the Temp Spec be confirmed by the EPDP Team in the Final Report or is this to be further considered in phase 2? Bulk data registration access to ICANN – should the requirements in the Temp Spec be confirmed by the EPDP Team in the Final Report? Process for amendments to Registry – Registrar agreements – should the process in the Temp Spec be confirmed as a policy recommendation, or is this to be addressed during implementation? Does the ‘consent’ provision in the Temporary Specification require confirmation in the Final Report or is this to be addressed during implementation as consent is already defined in the GDPR? Notices to Registered Name Holders Regarding Data Processing - is this required to be addressed in the Final Report or is this part of implementation or in direct consultation with registrars? Confirmation of agreement reached or next steps to come to agreement Wrap and confirm next meeting to be scheduled for Tuesday, 5 February 2019 at 14.00 UTC (5 minutes) Confirm action items Confirm questions for ICANN Org, if any

1 0

Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Thursday, 31 January 2019 at 14:00 UTC for 3 hours
by Andrea Glandon 30 Jan '19

30 Jan '19

Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/h5oWBg Thank you. Kind Regards, Andrea

1 0

Recordings, Attendance & AC Chat / GNSO Temp Spec gTLD RD EPDP / Tuesday, 29 January 2019
by Andrea Glandon 30 Jan '19

30 Jan '19

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Tuesday, 29 January 2019 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/hZoWBg MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-29jan19… AC Recording: https://participate.icann.org/p1z8zgz8l0w/<https://participate.icann.org/p1z8zgz8l0w/?OWASP_CSRFTOKEN=1e3c883343392133…> <https://participate.icann.org/p3qcfj7oeex/?OWASP_CSRFTOKEN=84cf656755a5fb62…>** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

Re: [Gnso-epdp-team] Notes and action items EPDP Team Meeting #40
by Trang Nguyen 29 Jan '19

29 Jan '19

Thank you, Marika! All, I had provided in the AC chat room links to ICANN org’s responses to EPDP Team’s questions regarding OCTO’s use of registration data, but the links were broken. Here they are again. As mentioned, if the Team has any additional questions for OCTO, Dan and I would be happy to take them to our colleagues in OCTO. https://mm.icann.org/pipermail/gnso-epdp-team/2018-October/000495.html https://mm.icann.org/pipermail/gnso-epdp-team/2018-October/000610.html https://mm.icann.org/pipermail/gnso-epdp-team/2018-December/001124.html Best, Trang From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Tuesday, January 29, 2019 at 12:00 PM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Notes and action items EPDP Team Meeting #40 Dear EPDP Team, Please find below the notes and action items from today’s EPDP Team meeting. Please take specific note of action item #4: Action item #4: EPDP Team to indicate if there are any concerns / objections to the addition of ‘maintenance’ to the language for purpose 1, so that it reads: “To ensure that a Registered Name Holder may exercise its rights in the use, maintenance, and disposition of the Registered Name Holder... Best regards, Caitlin, Berry and Marika ============ EPDP Team Meeting #40 Tuesday, 29 January 2019 Notes and Action Items High-level Notes/Actions: Action item #1: Leadership team / Support staff to propose revised wording later today to address input provided during today's meeting in relation to reasonable access. Action item #2: Legal committee to formulate question to obtain clarity for how the proposed additional “purpose” of ICANN Org research could/should be addressed. Via what means ICANN Org, as controller and even though it does not have the data, request data in a GDPR-compliant manner to undertake research. Action item #3: Staff support team to make updates accordingly to data elements workbooks for purpose 5 to cover ARS. Action item #4: EPDP Team to indicate if there are any concerns / objections to the addition of ‘maintenance’ to the language for purpose 1, so that it reads: “To ensure that a Registered Name Holder may exercise its rights in the use, maintenance, and disposition of the Registered Name Holder... Questions for ICANN Org from the EPDP Team: None Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/ZwPVBQ. Proposed Agenda: 1. Roll Call & SOI Updates * Attendance will be taken from Adobe Connect * Remember to mute your microphones when not speaking and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) a. Reminder: process for email discussions and upcoming deadlines (see also https://community.icann.org/x/VZwWBg and https://mm.icann.org/pipermail/gnso-epdp-team/2019-January/001342.html) b. Review of outstanding action items c. Other updates, if applicable * Appreciate all the contributions that have been made on the mailing list over the last few days * Leadership has taken note of the comments in relation to workload * Aim to keep the pace and work towards final report - need to determine what is necessary for the report to be meaningful. * Try to close of as many issues as possible on the mailing list, but may need to come back to some of those during calls. * Urge to focus on what is really important in the recommendations - avoid wordsmithing for the sake of improving the language. * Wiki page will include the latest information: https://community.icann.org/x/VZwWBg. * As deadlines close, leadership will review input received and make a recommendation on how to move forward. This could be in the form of a 'final' version to be reviewed on list or during a meeting. * Important to note which of these questions / recommendations could benefit / improve with more time and which would remain the same. Not spend more time on those latter items. * Planned publication date for Final Report is 11 February to align with GNSO Council document deadlines. Special Council meeting has been scheduled for 14 Feb which would allow for Council review / discussion, followed by a possible vote during the 21 Feb meeting. This would allow consideration by the ICANN Board prior to the 25 May expiration date. * Need sufficient time to allow members to consult with their respective groups. Think about ways to already get input from members before formal consensus call takes place. * As a reminder, a consensus call is not about asking people to express consensus for the report or recommendations, but it is about the chair indicating the consensus level he believes that have been achieved. Members are then asked to indicate whether or not these designations accurately reflect the positions of the group. 3. Continue review of public comments on Initial Report and/or revised recommendations a. Recommendation 5 – Data elements to be transferred from registrar to registry: the team will review the public comments while small teams will review the data elements (30 minutes) i. Silent review of comments received (see PCRT and discussion table at https://community.icann.org/x/U4cWBg) (5 minutes) ii. Question for team: which concerns / data elements merit group discussion? Specifically, do any of the concerns / data elements suggested present new information the EPDP Team has not discussed during its formulation of this purpose or recommendation? (20 minutes) iii. Confirmation of agreement reached or next steps to come to agreement (5 minutes) * Data that can be transferred is a matter of legal assessment, not want or desire. EPDP Team has gone through this legal analysis as part of its work. Where there is a legal basis (6.1(f)), such data may be transferred. * Many of the comments are on opposite ends to the spectrum. For our purposes, need to recognize that the concepts of thin / thick do not serve our purpose here, also in the context of the GDPR. RDS PDP WG came to a similar conclusion - identified minimum public data set (baseline set of elements). Registries / registrars are free to add additional data elements under purpose 7. Need to forget about thick / thin - we are creating something new. * EPDP Team has factored in data minimization and which data is required. * Approach that has been taken at the outset is that purpose for processing data were identified, followed by data elements analysis and subsequent data processing steps that found which data elements are required to be transferred to registries. * Consider distinguishing between base set and base set plus additional data elements. To be further considered by Data Elements Workbooks small team. * Registrars are not opposed transmitting data to registry but have maintained that whether it is done or not is predicated on a legal justification for that data sharing. That case needs to be made outside of the purposes identified by the EPDP Team. Dependent on the registries making the case that registrars 'must'. Need to change vocabulary. Registrars would NOT support transferring millions of records to a Registry that does not or cannot justify why they need this data. * There is an existing consensus policy that will need to factored in. Note that recommendation #22 already refers to Thick Whois as one of the policies that will need to consider how the EPDP Team recommendations potentially impact that policy and its implementation. * Thick WHOIS IRT will need to review potential impact of these recommendations on its work. * Agreement from the group to proceed this way - In relation to the questions raised in relation to thick WHOIS, the EPDP team refers commenters to the analysis in the Final Report for which data elements may be transferred from registrars to registries, but also noted that per recommendation #22, the impact of these recommendations on the Thick WHOIS policy will need to be assessed during the implementation phase. (Consider how to further clarify this language per the discussions during the meeting) b. Recommendation 12 Reasonable Access (30 minutes) i. Review of updated language circulated by Alex Deacon on behalf of small team - https://mm.icann.org/pipermail/gnso-epdp-team/2019-January/001327.html (5 minutes) ii. Consider updated language – does it address the concerns expressed during the public comment? (20 minutes) iii. Confirmation of agreement reached or next steps to come to agreement (5 minutes) * See revised language shared by Alex Deacon. * Aims to add further detail in relation to the items to be further considered in the context of 'reasonable'. Aim to create a feedback loop over time so that process can be improved over time. * See input from RrSG and responses from Alex. * Hesitant to put specific timelines in. May need to distinguish between urgent requests for which a shorter timeline is essential. A subpoena/warrant/court order is always an "Express Lane". Consider something like: "without unreasonable delay, but ordinarily not more than 30 business days from receipt." * Each data element needs a legal basis as to why it should be disclosed. * There should be flexibility for the CPs. Responses might need to be different than what has been offered and a response may also be to provide a subset of the data that has been requested. * How to deal with voluminous requests? Would that impact the deadline? * Consider strengthening language that currently says are 'further explored as part of the implementation'? * Need to consider how CPs can deal with requests in new environment. What is technically reasonable? What can be automated? * Focus on the policy language that sets policy goals for the interim period while further work is undertaken on the standardized access model as well as part of implementation. * How can data be made available to LE outside of the EU? Consider adding a point to the recommendation to consider this as part of implementation. * The more details that are added, the more time that may needed for groups to review. * Need a permanent disclosure policy going forward as not every entity may be able to accredit in a future access model. * Wording needs to set limit but also set expectations so that the limit is not the norm. * Should go beyond best practices, and need something sooner rather than later. Need to make it more clear what reasonable access means. * How to deal with registrars that are not at the table - important that compliance can take action against those as it is not about those that are actively collaborating with requestors. * Consider asking legal counsel for advice on whether ICANN Org research can be captured under purpose 2, whether it is already foreseen under GDPR (ability of controller to do research) or whether a separate purpose needs to be created. Action item #1: Leadership team / Support staff to propose revised wording later today to address input provided during today's meeting in relation to reasonable access. 10 minute break c. Recommendation #1 – Additional Purposes (20 minutes) i. Review input received to date (RrSG, ALAC, NCSG) (5 minutes) (see attached) ii. Confirmation of agreement reached or next steps to come to agreement (5 minutes) * See summary document that was circulated that contains input received to date. * New recommendation on additional purposes: see conclusions reached by Milton, no other purposes identified that require further discussion, apart from those already on the list. * ARS is a compliance activity as such capturing it as part of purpose 5 by updating references to ICANN Compliance to ICANN Org would remove the need to consider a separate purpose. * In relation to research, see also input from legal counsel on how this might fall under controller ability to undertake research. Is access of data by OCTO just another access question under purpose 2 or does it require a separate purpose? Is the work significantly different that it requires a separate purpose? ICANN Org has indicated that no additional data is currently used or needed to carry out responsibilities. Could this be addressed by Purpose 2, even though focus is on third parties? No, this is unlikely to apply. Could you make purpose 2 apply to ICANN Org? Or Purpose 5 - Compliance? Need to test legality. Need to clarify with legal counsel whether ICANN as controller, even though it does not have the data, it cannot request it to undertake research, per the GDPR. * Would need requirements from OCTO to be able to determine what is needed. ICANN Org would need to indicate what is needed for this to be a purpose. See previous responses on this topic: https://community.icann.org/x/ahppBQ. If data is needed in the future, it would be hashed data. We are not discussing what ICANN should do in the future, but what ICANN does now. * EPDP Team Agreement: Address ARS as part of purpose 5 by making the updates as suggested by Alan Greenberg (change reference to ICANN Compliance to ICANN Org). Action item #2: Legal committee to formulate question to obtain clarity for how the proposed additional “purpose” of ICANN Org research could/should be addressed. Via what means ICANN Org, as controller and even though it does not have the data, request data in a GDPR-compliant manner to undertake research. Action item #3: Staff support team to make updates accordingly to data elements workbooks for purpose 5 to cover ARS. * Purpose 1 – proposal by BC to add “maintenance” Action item #4: EPDP Team to indicate if there are any concerns / objections to the addition of ‘maintenance’ to the language for purpose 1, so that it reads: “To ensure that a Registered Name Holder may exercise its rights in the use, maintenance, and disposition of the Registered Name Holder... d. Recommendation 11 – Data retention (20 minutes) i. Review small team recommendation and input provided (RySG, RrSG, GAC) (5 minutes) (see attached) ii. Consider updated language – does it address the concerns expressed during the public comment? (20 minutes) iii. Confirmation of agreement reached or next steps to come to agreement (5 minutes) * Deferred to next meeting / mailing list 4. Next steps to get to Final Report (15 minutes) a. Updated Timeline (see attached) b. See draft Final Report circulated to the mailing list (see https://drive.google.com/a/icann.org/file/d/1E6W-daNTaadOhG5BRlzNJQbrT9MSoK… [drive.google.com]) c. Process for review (see https://docs.google.com/document/d/1sVZ9odV0qK1Bk8a4bDwWe5RW_PBzOnYBhHW_GnL… [docs.google.com]) 5. Wrap and confirm next meeting to be scheduled for Thursday, 31 January 2019 at 14.00 UTC (5 minutes) a. Confirm action items b. Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Notes and action items EPDP Team Meeting #40
by Marika Konings 29 Jan '19

29 Jan '19

Dear EPDP Team, Please find below the notes and action items from today’s EPDP Team meeting. Please take specific note of action item #4: Action item #4: EPDP Team to indicate if there are any concerns / objections to the addition of ‘maintenance’ to the language for purpose 1, so that it reads: “To ensure that a Registered Name Holder may exercise its rights in the use, maintenance, and disposition of the Registered Name Holder... Best regards, Caitlin, Berry and Marika ============ EPDP Team Meeting #40 Tuesday, 29 January 2019 Notes and Action Items High-level Notes/Actions: Action item #1: Leadership team / Support staff to propose revised wording later today to address input provided during today's meeting in relation to reasonable access. Action item #2: Legal committee to formulate question to obtain clarity for how the proposed additional “purpose” of ICANN Org research could/should be addressed. Via what means ICANN Org, as controller and even though it does not have the data, request data in a GDPR-compliant manner to undertake research. Action item #3: Staff support team to make updates accordingly to data elements workbooks for purpose 5 to cover ARS. Action item #4: EPDP Team to indicate if there are any concerns / objections to the addition of ‘maintenance’ to the language for purpose 1, so that it reads: “To ensure that a Registered Name Holder may exercise its rights in the use, maintenance, and disposition of the Registered Name Holder... Questions for ICANN Org from the EPDP Team: None Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/ZwPVBQ. Proposed Agenda: 1. Roll Call & SOI Updates * Attendance will be taken from Adobe Connect * Remember to mute your microphones when not speaking and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) a. Reminder: process for email discussions and upcoming deadlines (see also https://community.icann.org/x/VZwWBg and https://mm.icann.org/pipermail/gnso-epdp-team/2019-January/001342.html) b. Review of outstanding action items c. Other updates, if applicable * Appreciate all the contributions that have been made on the mailing list over the last few days * Leadership has taken note of the comments in relation to workload * Aim to keep the pace and work towards final report - need to determine what is necessary for the report to be meaningful. * Try to close of as many issues as possible on the mailing list, but may need to come back to some of those during calls. * Urge to focus on what is really important in the recommendations - avoid wordsmithing for the sake of improving the language. * Wiki page will include the latest information: https://community.icann.org/x/VZwWBg. * As deadlines close, leadership will review input received and make a recommendation on how to move forward. This could be in the form of a 'final' version to be reviewed on list or during a meeting. * Important to note which of these questions / recommendations could benefit / improve with more time and which would remain the same. Not spend more time on those latter items. * Planned publication date for Final Report is 11 February to align with GNSO Council document deadlines. Special Council meeting has been scheduled for 14 Feb which would allow for Council review / discussion, followed by a possible vote during the 21 Feb meeting. This would allow consideration by the ICANN Board prior to the 25 May expiration date. * Need sufficient time to allow members to consult with their respective groups. Think about ways to already get input from members before formal consensus call takes place. * As a reminder, a consensus call is not about asking people to express consensus for the report or recommendations, but it is about the chair indicating the consensus level he believes that have been achieved. Members are then asked to indicate whether or not these designations accurately reflect the positions of the group. 3. Continue review of public comments on Initial Report and/or revised recommendations a. Recommendation 5 – Data elements to be transferred from registrar to registry: the team will review the public comments while small teams will review the data elements (30 minutes) i. Silent review of comments received (see PCRT and discussion table at https://community.icann.org/x/U4cWBg) (5 minutes) ii. Question for team: which concerns / data elements merit group discussion? Specifically, do any of the concerns / data elements suggested present new information the EPDP Team has not discussed during its formulation of this purpose or recommendation? (20 minutes) iii. Confirmation of agreement reached or next steps to come to agreement (5 minutes) * Data that can be transferred is a matter of legal assessment, not want or desire. EPDP Team has gone through this legal analysis as part of its work. Where there is a legal basis (6.1(f)), such data may be transferred. * Many of the comments are on opposite ends to the spectrum. For our purposes, need to recognize that the concepts of thin / thick do not serve our purpose here, also in the context of the GDPR. RDS PDP WG came to a similar conclusion - identified minimum public data set (baseline set of elements). Registries / registrars are free to add additional data elements under purpose 7. Need to forget about thick / thin - we are creating something new. * EPDP Team has factored in data minimization and which data is required. * Approach that has been taken at the outset is that purpose for processing data were identified, followed by data elements analysis and subsequent data processing steps that found which data elements are required to be transferred to registries. * Consider distinguishing between base set and base set plus additional data elements. To be further considered by Data Elements Workbooks small team. * Registrars are not opposed transmitting data to registry but have maintained that whether it is done or not is predicated on a legal justification for that data sharing. That case needs to be made outside of the purposes identified by the EPDP Team. Dependent on the registries making the case that registrars 'must'. Need to change vocabulary. Registrars would NOT support transferring millions of records to a Registry that does not or cannot justify why they need this data. * There is an existing consensus policy that will need to factored in. Note that recommendation #22 already refers to Thick Whois as one of the policies that will need to consider how the EPDP Team recommendations potentially impact that policy and its implementation. * Thick WHOIS IRT will need to review potential impact of these recommendations on its work. * Agreement from the group to proceed this way - In relation to the questions raised in relation to thick WHOIS, the EPDP team refers commenters to the analysis in the Final Report for which data elements may be transferred from registrars to registries, but also noted that per recommendation #22, the impact of these recommendations on the Thick WHOIS policy will need to be assessed during the implementation phase. (Consider how to further clarify this language per the discussions during the meeting) b. Recommendation 12 Reasonable Access (30 minutes) i. Review of updated language circulated by Alex Deacon on behalf of small team - https://mm.icann.org/pipermail/gnso-epdp-team/2019-January/001327.html (5 minutes) ii. Consider updated language – does it address the concerns expressed during the public comment? (20 minutes) iii. Confirmation of agreement reached or next steps to come to agreement (5 minutes) * See revised language shared by Alex Deacon. * Aims to add further detail in relation to the items to be further considered in the context of 'reasonable'. Aim to create a feedback loop over time so that process can be improved over time. * See input from RrSG and responses from Alex. * Hesitant to put specific timelines in. May need to distinguish between urgent requests for which a shorter timeline is essential. A subpoena/warrant/court order is always an "Express Lane". Consider something like: "without unreasonable delay, but ordinarily not more than 30 business days from receipt." * Each data element needs a legal basis as to why it should be disclosed. * There should be flexibility for the CPs. Responses might need to be different than what has been offered and a response may also be to provide a subset of the data that has been requested. * How to deal with voluminous requests? Would that impact the deadline? * Consider strengthening language that currently says are 'further explored as part of the implementation'? * Need to consider how CPs can deal with requests in new environment. What is technically reasonable? What can be automated? * Focus on the policy language that sets policy goals for the interim period while further work is undertaken on the standardized access model as well as part of implementation. * How can data be made available to LE outside of the EU? Consider adding a point to the recommendation to consider this as part of implementation. * The more details that are added, the more time that may needed for groups to review. * Need a permanent disclosure policy going forward as not every entity may be able to accredit in a future access model. * Wording needs to set limit but also set expectations so that the limit is not the norm. * Should go beyond best practices, and need something sooner rather than later. Need to make it more clear what reasonable access means. * How to deal with registrars that are not at the table - important that compliance can take action against those as it is not about those that are actively collaborating with requestors. * Consider asking legal counsel for advice on whether ICANN Org research can be captured under purpose 2, whether it is already foreseen under GDPR (ability of controller to do research) or whether a separate purpose needs to be created. Action item #1: Leadership team / Support staff to propose revised wording later today to address input provided during today's meeting in relation to reasonable access. 10 minute break c. Recommendation #1 – Additional Purposes (20 minutes) i. Review input received to date (RrSG, ALAC, NCSG) (5 minutes) (see attached) ii. Confirmation of agreement reached or next steps to come to agreement (5 minutes) * See summary document that was circulated that contains input received to date. * New recommendation on additional purposes: see conclusions reached by Milton, no other purposes identified that require further discussion, apart from those already on the list. * ARS is a compliance activity as such capturing it as part of purpose 5 by updating references to ICANN Compliance to ICANN Org would remove the need to consider a separate purpose. * In relation to research, see also input from legal counsel on how this might fall under controller ability to undertake research. Is access of data by OCTO just another access question under purpose 2 or does it require a separate purpose? Is the work significantly different that it requires a separate purpose? ICANN Org has indicated that no additional data is currently used or needed to carry out responsibilities. Could this be addressed by Purpose 2, even though focus is on third parties? No, this is unlikely to apply. Could you make purpose 2 apply to ICANN Org? Or Purpose 5 - Compliance? Need to test legality. Need to clarify with legal counsel whether ICANN as controller, even though it does not have the data, it cannot request it to undertake research, per the GDPR. * Would need requirements from OCTO to be able to determine what is needed. ICANN Org would need to indicate what is needed for this to be a purpose. See previous responses on this topic: https://community.icann.org/x/ahppBQ. If data is needed in the future, it would be hashed data. We are not discussing what ICANN should do in the future, but what ICANN does now. * EPDP Team Agreement: Address ARS as part of purpose 5 by making the updates as suggested by Alan Greenberg (change reference to ICANN Compliance to ICANN Org). Action item #2: Legal committee to formulate question to obtain clarity for how the proposed additional “purpose” of ICANN Org research could/should be addressed. Via what means ICANN Org, as controller and even though it does not have the data, request data in a GDPR-compliant manner to undertake research. Action item #3: Staff support team to make updates accordingly to data elements workbooks for purpose 5 to cover ARS. * Purpose 1 – proposal by BC to add “maintenance” Action item #4: EPDP Team to indicate if there are any concerns / objections to the addition of ‘maintenance’ to the language for purpose 1, so that it reads: “To ensure that a Registered Name Holder may exercise its rights in the use, maintenance, and disposition of the Registered Name Holder... d. Recommendation 11 – Data retention (20 minutes) i. Review small team recommendation and input provided (RySG, RrSG, GAC) (5 minutes) (see attached) ii. Consider updated language – does it address the concerns expressed during the public comment? (20 minutes) iii. Confirmation of agreement reached or next steps to come to agreement (5 minutes) * Deferred to next meeting / mailing list 4. Next steps to get to Final Report (15 minutes) a. Updated Timeline (see attached) b. See draft Final Report circulated to the mailing list (see https://drive.google.com/a/icann.org/file/d/1E6W-daNTaadOhG5BRlzNJQbrT9MSoK… [drive.google.com]) c. Process for review (see https://docs.google.com/document/d/1sVZ9odV0qK1Bk8a4bDwWe5RW_PBzOnYBhHW_GnL… [docs.google.com]) 5. Wrap and confirm next meeting to be scheduled for Thursday, 31 January 2019 at 14.00 UTC (5 minutes) a. Confirm action items b. Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

4 sessions per Week for EPDP
by Kavouss Arasteh 29 Jan '19

29 Jan '19

Dear Kurt Dear All Good Morning Geneva time What is the issude of having 4 sessions of three hours each per Week pls ? Who has proposed that ? What are the logiocs behind that? Regards Kavouss

1 0

Recommendation 1 Purpose 1 - RrSG Comments
by Sarah Wyld 29 Jan '19

29 Jan '19

Hello All, For Recommendation 1 Purpose 1, the RrSG has the following comments: * Rename this to: Further Processing of Data. * Within the ICANN context we want to process data collected for a different purpose to be further processed for research purposes o What is research within the ICANN context? And does it have scientific purposes? o Is the ARS Reporting system research, or as the name indicates a reporting system that flags possible incorrect data? And is this not already in scope of the GDPR? o Art 89 and relevant recitals in scope due to whatever research is within the ICANN context? o Depending on the research do Art 17 and 21 apply? * *In short with the above in mind, what does the WG think is research and does it require processing of personal data?* -- Sarah Wyld Domains Product Team Tucows +1.416 535 0123 Ext. 1392

3 2

Re: [Gnso-epdp-team] [Ext] Re: Recommendation 1 Purpose 1 - RrSG Comments
by Trang Nguyen 29 Jan '19

29 Jan '19

Dear Theo, Regarding your first question, the processing activity is publication of the public WHOIS data, which may contain personal data. Regarding your second question, apologies for the incorrect link. Please refer to this link instead, which lists other dispute policies/procedures: https://www.icann.org/resources/pages/dndr-2012-02-25-en. Best, Trang From: Theo Geurts <gtheo(a)xs4all.nl> Date: Monday, January 28, 2019 at 7:03 AM To: Trang Nguyen <trang.nguyen(a)icann.org>, Sarah Wyld <swyld(a)tucows.com>, "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Ext] Re: [Gnso-epdp-team] Recommendation 1 Purpose 1 - RrSG Comments Hi Trang, Can you be more specific about the processing activity in your first question? Purpose 6, is focused on disputes, I am not sure why the rest should be in scope? Thanks, Theo On 26-1-2019 1:38, Trang Nguyen wrote: Hello All, Regarding Recommendation #1, ICANN org has the following questions and would appreciate clarification from EPDP Team: * There are processing activities related to public WHOIS, which could contain personal data, it would be helpful if the EPDP Team could clarify which purpose(s) this processing activity would fall under. * Purpose 6: Does the text of this purpose mean that registration data could no longer be used for policies and procedures not specified in the purpose, such as those policies and procedures listed at https://www.icann.org/resources/pages/appendix-11-2013-07-08-en [icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resource…>? Best, Dan & Trang ICANN Org Liaisons From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org><mailto:gnso-epdp-team-bounces@icann.org> on behalf of Sarah Wyld <swyld(a)tucows.com><mailto:swyld@tucows.com> Organization: Tucows Date: Friday, January 25, 2019 at 1:14 PM To: "gnso-epdp-team(a)icann.org"<mailto:gnso-epdp-team@icann.org> <gnso-epdp-team(a)icann.org><mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] Recommendation 1 Purpose 1 - RrSG Comments Hello All, For Recommendation 1 Purpose 1, the RrSG has the following comments: * Rename this to: Further Processing of Data. * Within the ICANN context we want to process data collected for a different purpose to be further processed for research purposes * What is research within the ICANN context? And does it have scientific purposes? * Is the ARS Reporting system research, or as the name indicates a reporting system that flags possible incorrect data? And is this not already in scope of the GDPR? * Art 89 and relevant recitals in scope due to whatever research is within the ICANN context? * Depending on the research do Art 17 and 21 apply? * In short with the above in mind, what does the WG think is research and does it require processing of personal data? -- Sarah Wyld Domains Product Team Tucows +1.416 535 0123 Ext. 1392 _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team

1 0