December 2019 - Gnso-epdp-team

Financial sustainability issues of the SSAD
by Janis Karklins Jan. 22, 2020

Jan. 22, 2020

Goran, I am writing you in my capacity of the Chair of the EPDP Phase 2 Team to seek input on financial sustainability issues if the SSAD. The EPDP Phase 2 Team is considering the financial sustainability of the System for Standardized Access/Disclosure (SSAD) currently being deliberated. This will likely involve ICANN managing or operating a centralized system to facilitate requests for disclosure of non-public gTLD registration data. The Team is contemplating how considerable cost implications would be to develop, operationalize and run such a System. The EPDP currently considers principles on which such a system may be based. Work is still in progress, but the Team is discussing principles such as: 1. The SSAD should operate on a cost-neutral basis. No party should operate or seek to operate this service as a for-profit service, as this would invite abuse and manipulation of the SSAD functions. 2. Costs to operate the SSAD should be borne by the *direct* beneficiaries of the service. The costs of SSAD should not be transferred to Data Subjects (Registrants), either directly via fees from ICANN or indirectly via fees to Contracted Parties who provide the SSAD with data and bear the legal risks of disclosures. In the absence of responses from both the EPDP letter to the Board, and to the Strawberry Team’s query as presented to the European Data Protection Board, the EPDP team is not in a position to consider a single model for the potential SSAD. Accepting that financial sustainability is a vital consideration for the initial report, and as we have not yet determined the model for the SSAD, we must therefore present the financial sustainability of each of the general model types so far postulated: - Fully Centralized (e.g. with ICANN at the core) - Centralized Accreditation and request portal, distributed decision-making, with final response via Centralized portal (e.g. CZDS). - Central Gateway, with distributed review and disclosure The Team understands that a cost analysis is difficult to conduct while the exact details of the SSAD are still being determined. We hope that looking at existing systems such as TMCH or CZDS might provide useful baselines and identify dependent assumptions that impact cost models. CZDS, for example, is itself a centralized system for access to data (in this case zone file data), sharing many similarities with the SSAD being contemplated. Equally, financial sustainability analysis of the UAM could provide same useful indications for Team’s deliberations. In order to understand if it is possible for the SSAD to adhere to these crucial principles, we are requesting ICANN Org’s help in understanding all the likely costs associated with both the development and the ongoing operation of the SSAD. Once we understand the anticipated costs, we would expect to propose a credentialing and transaction fee structure which would pay for the System and allow us to better understand the cost/benefit balance of the SSAD as a whole. Your input on financial sustainability issues will be highly appreciated. Best regards JK

2 3

Meeting Invitation / Observers / GNSO Temp Spec gTLD RD EPDP-P2 call / Thursday, 09 January 2020
by Terri Agnew Jan. 8, 2020

Jan. 8, 2020

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 09 January 2020 at 14:00 UTC for 120 minutes. (calls will be scheduled for 120 minutes but aim to keep to 90 minutes) For other times: https://tinyurl.com/rmmv4ok Agenda Wiki: https://community.icann.org/x/LQBhBw The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Kind Regards, Terri If needed, an option to join via telephone has been added for this meeting. **New join information - Conference Bridge: Toll-free access number (US and Canada): 800 550 6865 and Toll 213 233 3193 Other telephone numbers found here: http://www.adigo.com/icann [adigo.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.adigo.com_icann&d=D…> Enter passcode on telephone: 7349

2 1

For your review - latest version of draft Initial Report, deadline 7 January 2020
by Marika Konings Jan. 7, 2020

Jan. 7, 2020

Ho, ho, ho, EPDP Team, As promised, your early Christmas present has arrived! The latest version of the draft Initial Report has been posted for your review (see https://community.icann.org/x/BQZxBw) In this clean version, staff has incorporated the latest language of the building blocks that has been reviewed over the last couple of weeks and made a number of minor updates to address input already received. Remaining comments and text highlighted in yellow concern items that will need to be further reviewed and discussed by the EPDP Team in upcoming meetings. For those interested, we have also posted a redline version (pdf document) so you can see all the edits made as well as comments resolved. If there are any comments or edits that have been applied / resolved but which in your group’s opinion should be further considered, please mark these as such in the new google doc. As a reminder: * Please do not reopen previously closed discussions unless there is new information to consider. * If you have concerns about certain section, please provide alternative language to address your concern but also factor in other perspectives expressed to date. * Please do not redline but provide language suggestions in the form of comments so that these can be reviewed by all before being applied. * Minor edits (grammar, style) can be sent to the staff support team directly. Your group’s input is due at the latest by 7 January 2020. Happy reading and happy holidays!! Caitlin, Berry and Marika

4 4

New full representative for NCSG
by Stephanie Perrin Dec. 20, 2019

Dec. 20, 2019

The NCSG team is pleased to report that Stefan Filipovic has agreed to step forward as a full representative rather than an alternate, replacing Farzaneh Badii. We are very glad to welcome him, given that we expect more work will be coming at us in the New Year! Stefan is a Master of Law student at the Norwegian Research Center for Computers and Law in Oslo, and a research assistant on a very interesting robotics project. Stephanie Perrin

2 1

Action Items + timeline with upcoming deadlines for feedback
by Caitlin Tubergen Dec. 20, 2019

Dec. 20, 2019

Dear EPDP Team, As shared during yesterday’s meeting, please find attached the proposed timelines and deadlines to get to the Initial Report by early February. As a reminder, please provide your input on the Initial Report language on: Terms of use Automation by Sunday 8 December at the latest. The comments and suggestions made by the deadline will serve as the guide for discussion during the meeting on 10 December 2019. Please also take note of the other upcoming deadlines to plan your work accordingly. Other action items and high-level notes for Tuesday’s meeting are: EPDP Leadership to further consider the appropriate channel to further consider the geographic differentiation issue. EPDP Team may continue to provide comments on the structure, formatting, and diagrams within the Initial Report Google Doc in comment mode (please refrain from line edits in the document). EPDP Team to provide additional comments (if any) on the Authorization Provider Building Block by Friday, 6 December. EPDP Support Staff to propose compromise text, where possible, in response to the Team’s discussion and additional comments for the Authorization Provider Building Block for the Team’s review by Monday, 9 December. Questions for ICANN org: Could ICANN org provide detail on how/if it would enforce a policy with a “should” directive? By way of example, how would the following text be enforced? “If, based on consideration of the above factors, the authorization provider determines that the requestor’s legitimate interest is not outweighed by the interests or fundamental rights and freedoms of the data subject, the data should be disclosed.” (emphasis added) Best regards, Marika, Berry, and Caitlin

4 3

Update to SOI
by Johan Helsingius Dec. 19, 2019

Dec. 19, 2019

As there was no opportunity to do so at the beginning of the call today, I am hereby flagging some minor updates to my SOI. Last week, instead of attending the EPDP call, I was at the autumn meeting of the Finnish Internet Association that is the Finnish ISOC chapter and thus an ICANN At-Large Structure, and ended up elected to the board, so I guess I now have one toe in the ALAC camp. I am also not a member of Non Commercial Users Constituency any more, but a constitution-less member of the Noncommercial Stakeholder Group. Julf

2 3

**Reminder** Meeting Invitation / Observers / GNSO Temp Spec gTLD RD EPDP-P2 call / Thursday, 19 December 2019
by Julie Bisland Dec. 18, 2019

Dec. 18, 2019

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 19 December 2019 at 14:00 UTC for 120 minutes. (calls will be scheduled for 120 minutes but aim to keep to 90 minutes) For other times: https://tinyurl.com/yyl7w7o9 [tinyurl.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__tinyurl.com_yyl7w7o9&d…> Agenda Wiki: https://community.icann.org/x/WYEzBw The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Kind Regards, Terri If needed, an option to join via telephone has been added for this meeting. **New join information - Conference Bridge: Toll-free access number (US and Canada): 800 550 6865 and Toll 213 233 3193 Other telephone numbers found here: http://www.adigo.com/icann [adigo.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.adigo.com_icann&d=D…> Enter passcode on telephone: 7349

1 0

Belgian Data Protection Authority Correspondence to Proposed Unified Access Model
by Janis Karklins Dec. 18, 2019

Dec. 18, 2019

Dear Team members, For those who haven't seen it already, I would like to draw attention to the announcement which has been posted on ICANN website in relation to ICANN Org exchange with the EDPB: https://www.icann.org/news/announcement-2019-12-17-en I suggest that (similarly to response on financial assessments) we discuss this correspondence in early January prior the next f2f meeting in LA. Thank you JK

1 0

Proposed agenda - EPDP Team Meeting #37 - Thursday, 19 December
by Caitlin Tubergen Dec. 16, 2019

Dec. 16, 2019

Dear EPDP Team: Please find below the agenda for the next EPDP Team meeting on Thursday, 19 December at 14:00 UTC. As a reminder, please find the upcoming deadlines below: Tuesday, 17 December: Deadline for review of Purposes Building Block Tuesday, 17 December: Deadline for review of Acceptable Use Policy Building Block Thank you. Best regards, Marika, Berry, and Caitlin -- EPDP Phase 2 - Meeting #37 Proposed Agenda Thursday, 19 December 2019 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Confirmation of agenda (Chair) 3. Welcome and housekeeping issues (Chair) (5 minutes) a) Legal committee update b) Status of building blocks 4. Preliminary Rec - User Groups a) Review updated language and comments / suggestions provided by deadline b) Feedback from EPDP Team c) Confirm next steps 5. Preliminary Rec – Acceptable Use Policy a) Review comments / suggestions provided by the deadline in relation to edits discussed previously b) Feedback from EPDP Team c) Confirm next steps 6. Preliminary Rec - Purposes a) Review comments / suggestions provided by deadline b) Feedback from EPDP Team c) Confirm next steps 7. Homework over the holiday period a) Staff to publish updated version of draft Initial Report by 24 December at the latest with updates to the building blocks as discussed to date b) EPDP Team to flag any issues / concerns by 7 January at the latest: o please do not reopen previously closed discussions unless there is new information to consider. o If you have concerns about certain sections, please provide alternative language to address your concern but also factoring in other perspectives expressed to date. o Please do not redline but provide language suggestions in the form of comments so that these can be reviewed by all before being applied. o Minor edits (grammar, style) can be sent to the staff support team directly. 8. Wrap and confirm next EPDP Team meeting (5 minutes): a) Thursday 9 January 2020 at 14.00 UTC b) Confirm action items c) Confirm questions for ICANN Org, if any

1 0

FW: Clarification on display of information of affiliated vs. accredited P/P providers
by Caitlin Tubergen Dec. 13, 2019

Dec. 13, 2019

Dear EPDP Team: Further to EPDP Support Staff’s action item to follow up with ICANN org re: the Clarification on display of information of affiliated vs. accredited P/P providers, please see the below response from ICANN org. Thank you. Best regards, Marika, Berry, and Caitlin From: Cyrus Jamnejad <cyrus.jamnejad(a)icann.org> Date: Tuesday, December 3, 2019 at 12:49 PM To: Caitlin Tubergen <caitlin.tubergen(a)icann.org> Cc: Marika Konings <marika.konings(a)icann.org>, "policy(a)bacinblack.com" <policy(a)bacinblack.com>, Karen Lentz <karen.lentz(a)icann.org>, Amanda Fessenden <amanda.fessenden(a)icann.org> Subject: Re: Clarification on display of information of affiliated vs. accredited P/P providers Hi Team, Thanks for reaching out, and my apologies on the delayed response. I hope I haven’t set you back, and I am happy to discuss further if you’d like to. I want to also thank Amy Bivins for her amazing help on this. So your request references two recommendations, EPDP Phase 1 Recommendation 14 (and its accompanying note), and PPSAI Recommendation 4. In asking, “Can you please provide clarifying information on how this recommendation is being implemented?” I understand you to be asking about PPSAI Recommendation 4. The EPDP Phase 1 IRT is in the process of implementing EPDP Phase 1, Recommendation 14. As you are aware, the PPSAI implementation (and IRT) is on hold pending the resolution of the EPDP Phase 2 work. There is no current activity underway. In term of the implementation of PPSAI Recommendation 4, the PP IRT was considering a proposed requirement that all privacy and proxy service providers include a label, which would flag each registration as a privacy/proxy registration and identify which provider is associated with that registration, in the existing WHOIS output “registrant organization” field. (See Draft PPAA, distributed to PP IRT 12 Sept 2018, at https://mm.icann.org/pipermail/gdd-gnso-ppsai-impl/attachments/20180913/426…, Section 3.15). This requirement would apply to all privacy and proxy service providers, regardless of whether the provider is affiliated with a registrar or registry operator or operating independently of any other contracted party. The draft privacy and proxy service provider accreditation agreement does not distinguish between requirements for registrar-affiliated and non-affiliated privacy and proxy service providers, at the direction of the PPSAI IRT. The draft requirements would require all privacy and proxy service providers to become accredited to continue offering those services. This requirement for accreditation would be enforced through the registrar, on the grounds that accredited registrars could not knowingly accept registrations involving a privacy or proxy service from an unaccredited provider (See PPSAI recommendation 1, note, p. 7, https://gnso.icann.org/sites/default/files/filefield_48305/ppsai-final-07de…) Following the completion of the EPDP Phase 2 work and the Rec 27 analysis, the existing draft PPSAI materials will need to be revisited to ensure consistency with the EPDP-recommended requirements, and to ensure the requirements and processes fit together in a manner that will create a transparent, predictable, and reasonable process for all parties involved. I hope this helps, and again, please reach out if more is needed. Best, Cyrus Jamnejad gTLD Accounts & Services Manager Internet Corporation for Assigned Names and Numbers (ICANN) Skype: cyrus.jamnejad.icann Telephone: +1 310 578 8635 www.icann.org From: Caitlin Tubergen <caitlin.tubergen(a)icann.org> Date: Wednesday, October 30, 2019 at 8:50 AM To: Cyrus Jamnejad <cyrus.jamnejad(a)icann.org> Cc: Marika Konings <marika.konings(a)icann.org>, "policy(a)bacinblack.com" <policy(a)bacinblack.com>, Karen Lentz <karen.lentz(a)icann.org> Subject: Clarification on display of information of affiliated vs. accredited P/P providers Dear Cyrus: On behalf of the EPDP on the Temporary Specification for gTLD Registration Phase 2 Team, we are writing to request clarification on the display of information of affiliated vs. accredited privacy/proxy providers within the context of the implementation of the Privacy and Proxy Services Accreditation Issues Working Group’s recommendations. As part its work in Phase 1, the EPDP Team made the following recommendation in its Final Report: “In the case of a domain name registration where an ‘affiliated’ privacy/proxy service used (e.g., where data associated with a natural person is masked), Registrar (and Registry where applicable) MUST include in the public RDDS and return in response to any query full non-personal RDDS data of the privacy/proxy service, which MAY also include the existing privacy/proxy pseudonymized email.” The EPDP Team went on to note, “PPSAI is an approved policy that is currently going through implementation. It will be important to understand the interplay between the display of information of affiliated vs. accredited privacy / proxy providers. Based on feedback received on this topic from the PPSAI IRT, the EPDP Team may consider this further in phase 2”. As you are aware, the Privacy and Proxy Services Accreditation Issues Working Group recommended the following, “[t]o the extent that this is feasible, domain name registrations involving P/P service providers should be clearly labelled as such in WHOIS.” Can you please provide clarifying information on how this recommendation is being implemented? Thank you. Best regards, Marika, Berry, and Caitlin EPDP Policy Development Support Staff

1 0