February 2019 - Gnso-epdp-team

Fwd: ISPCP input to draft final report
by Thomas Rickert Feb. 19, 2019

Feb. 19, 2019

I just heard that the below note may not have made it to the list. Anfang der weitergeleiteten Nachricht: > Von: Thomas Rickert <thomas(a)rickert.net> > Datum: 18. Februar 2019 um 14:26:27 MEZ > An: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> > Kopie: Thomas Rickert <thomas(a)rickert.net> > Betreff: ISPCP input to draft final report > > Kurt, all, > please find below the statement on the draft final report from the ISPCP in addition to the input already provided on the first and second batch of the consensus call. > > Recommendation 5 - optional Tech-C: > > Whilst not opposing recommendation 5, we would like our concern to be noted that our goal should be to have one system that works globally for gTLDs to avoid fragmentation. Therefore, we recommend to amend this recommendation so that > > - the registrar MUST offer the option to provide data for the tech-c and > - the provision of data for a tech-c is optional > > Users should get the same experience and options regardless of what registrar they choose to work with. > > Recommendations 10 / 16 and 17: > > We think that more work needs to be done in order to provide for a system that is globally applicable to avoid fragmentation in terms of RNH rights and user experience. > > Recommendation 18: > > We suggest to include the timelines / procedure as laid down in Art. 15 III GDPR so that there is transparency regarding response times: > > The clause reads: > 1The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. 2That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. 3The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. 4Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject. > > Additionally, we suggest to include a requirement for contracted parties to publish data on how many disclosure requests they get. That helps the community understand whether response times are corresponding with work load. > > Recommendation 19: > > The EPDP Team chose to dilute the language of this recommendation not to make reference to a specific legal vehicle. As a matter of compromise, reference to the analysis in the report was agreed to be made to inform the implementation and decision on what legal vehicle to use. The report now includes amended language as prepared by ICANN representatives. These changes were not discussed by the EDPDP team and we ask to reinstate the original language of the report to inform the decision-making during the implementation of the recommendation. > > Recommendation 27: > > We support the recommendation as long as it is ensured that > the community is part of the implementation team > the GNSOCouncil as the policy manager has the last saying on any policy amendments according to its PDP rules > Thomas Rickert

1 0

Last chance, last dance
by Kurt Pritz Feb. 19, 2019

Feb. 19, 2019

Hello Everyone: Well, if I ever share my “lessons learned” from this experience, the first one will be, “don’t have a quiet period for final report review.” I think that, by-and-large, the statements and reviews were constructive and measured. In certain cases (more than one), we strayed from our objectives to maintain the agreed-upon language in the report, absent some mistake or inconsistency. We have essentially two days of meeting time before we must deliver the report. Here is my approach to the next two days - you are free to provide feedback on these. This approach was developed with the idea that I don’t wish to require your attendance at two days of marathon meetings. (By my reckoning, we are ~4300 person-hours of meeting time into this, and two days at the end can only slightly perturb the results of those extensive consultations and deliberations.) The attached document has divided the recommendations into three groups: (a) those for which there is no commentary in the statements, (b) those for which there are comments but do not suggest edits to the recommendation or report, and (c) those that recommend edits. In the cases of the first two groups, there will be no discussion. The comments made in set (b) will be included in the report, either in the group statement or in the report body. Subject to the points below, they will be designated as enjoying full consensus / consensus support. The approach for suggested edits will be: 1) We will keep to the central idea that we will not discuss substantial changes to each of the recommendations. Edits substantially changing the intent of the recommendation will either not be discussed or lightly mentioned. Groups recommending substantial changes from previously agreed upon language can signal dissent if they cannot accept the language as written and the consensus designation will take note of that. There are a couple exceptions to this that I will discuss below. 2) For edits to recommendations or supporting text that might be termed clarifications or corrections, we will have a brief explanation of those to see if there is (more or less) universal approval of those. If that level of approval is not apparent, we will revert to the previous language and the group recommending the edit can decide whether they still can support the recommendation as written. 3) There are two areas where I believe we should continue our substantive discussion. The first is Reasonable Access or Lawful Disclosure where the recommendation has oscillated between two versions and we were unable to get to an agree-upon conclusion because of who could attend what meeting and, essentially, time ran out. I’d like Ashley to start this discussion. The second issue is the Geographic considerations issue. As some others did, I too remember a discussion and, I thought, agreement, that we would request that additional research be done on this topic. I remember Amr’s intervention that the research be undertaken in two phases so that it is properly scoped and done economically. While the discussion of this research is in the body of the report (as “implementation advice” I guess), we should discuss whether to move it into the recommendation itself. As Stephanie has said more than once, research is a good thing. There are other issues raised during the quiet period that provided corrections or clarifications to recommendations or supporting text that should be discussed in plenary: Recommendation 5 - Data collected by registrars / Tech contact Recommendation 9 - Contractual Compliance Recommendation 11 - City field Recommendation 12 - Organization field Recommendation 17 - Natural v Legal distinctions For the remainder of the issues in the attached, we will allow a 48-hour review period and then consider them closed unless there is a comment to the contrary. The agenda remains open for discussion and items can be added or deleted. 4) There are a number of recommendations that still enjoy the consensus support of the group. Our report will include the extent of support for each recommendation. To the representatives of the IPC and BC, it is apparent to me that not all of your recommendations will be adopted. Assuming that eventuality and based on your joint statement, I think you will have to decide for each of these recommendations that have the full support of the group whether you continue to support them or wish to state that you cannot support them as written. Also assuming that all of the IP / BC edits will not be adopted, but reading all of the other stakeholder group comments in support of the report, I will plan to designate the Final Report as having Strong Support but not Consensus. The team should look for solutions / compromise solutions to avoid such a designation. Talk to you all soon, Kurt

5 6

Proposed agenda - EPDP Meeting #46 and #47
by Caitlin Tubergen Feb. 19, 2019

Feb. 19, 2019

Dear All, Please find the agenda for this week’s meetings (46-47) below. Thank you. Best regards, Marika, Berry, and Caitlin -- EPDP Meeting #46 & #47 Agenda Tuesday, 19 February 2019; Wednesday 20 February 2019 1. Roll Call & SOI Updates 2. Welcome and Updates from EPDP Team Chair (15 minutes) a. Recap of GNSO Council briefing on 14 Feb b. Quiet period recap of input received and proposed next steps c. Discussion of proposed way forward as described in email and document 3. Discussion of items for amendment and final discussion: Recommendation 18 – Reasonable Access / Lawful Disclosure (30 minutes) Recommendation 11 – City field (30 minutes) i. consider legal guidance ii. considered proposed consensus approach for Phase 2 Recommendation 16 – Geographic considerations – consider proposed approach given anticipated legal advice during Phase 2 (30 minutes) Recommendation 5 - Data collected by registrars (30 minutes), consider: i. Tech contact issue ii. legal guidance received regarding notice and consent requirements iii. possible Phase 2 discussion Recommendation 9 – Contractual Compliance – consider clarification (30 minutes) Recommendation 12 – Organization field – consider clarification (30 minutes) Recommendation 17 – Natural v Legal distinctions – consider clarification (30 minutes) 4. Confirm next Steps (15 minutes) 19 February 2019EPDP Team Meeting (if necessary) Consider issues flagged as a result of the quiet period review and consider how these should be addressed EPDP Team 20 February 2019EPDP Team Meeting (if necessary) Consider issues flagged as a result of the quiet period review and consider how these should be addressed EPDP Team 20 February 2019Final Report Submit Final Report or confirm that version submitted on 11 February should be considered finalStaff Support Team / Council Liaison 21 February 2019Consider Final Report for adoptionGNSO Council 4 March 2019Consider Final Report for adoption (if needed)GNSO Council 5. Wrap and confirm next meeting to be scheduled for Wednesday, 20 February 2019 at 14.00 UTC (5 minutes)

1 0

Re: [Gnso-epdp-team] BC Consensus Call Responses
by Matt Serlin Feb. 18, 2019

Feb. 18, 2019

Thanks Margie for sending this over and I appreciate the time that I’m sure was put into this. I have a few initial comments but let me be clear these are my own personal comments and not those of the RrSG. While I appreciate (and even personally agree with many of the “minor amendments” you have put forth, I strongly object to the manner in which they have been put forth. The reality is that this group of volunteers have spent thousands of hours discussing and debating these very issues. Everyone had the opportunity to have their views heard and I recall many of these points being discussed among the group, so I don’t believe anyone’s voice was silenced in the process. The fact that not every group’s views were accepted and included in the report is how it should work in this multi-stakeholder model that we have. If every group had the expectation of always getting their way, how could this possible be successful? Take the discussion of the organization field as an example…contracted parties started off with a position of redaction while other groups started with full display. After lengthy discussion and debate, everyone compromised, and we ended up with something in the middle. I pointed to that very issue the other day in describing our work to the broader RrSG team as a successful outcome in the process. How would other groups feel if now we can back and said, “actually for us to sign off on this report, we need to go back to full redaction of the organization field…” I’m pretty sure I know the answer, but what’s to stop every other group from now putting forth their “minor amendments” in order to support the full report. To be clear, I am not speaking for the RrSG and my comments are in no way a reflection of my views on the substance of your points. I’m simply disappointed we have come this far and are so close to a milestone only to seemingly have our entire body of work held hostage. I’m also unsure of how we move forward…you’ve indicated you look forward to “constructive engagement” yet you’re clear that your support is contingent on your five amendments. Apologies for the rant, but thank you for your willingness to read this far ☺ Best regards, Matt From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Margie Milam <margiemilam(a)fb.com> Date: Sunday, February 17, 2019 at 10:29 AM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] BC Consensus Call Responses Dear Colleagues- The BC and IPC members have been working hard over the weekend to develop our response to the consensus call and GNSO Council voting on the Final Report for EPDP Phase 1<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…>. The attached response is just 3 pages long, and reflects close collaboration with the IPC, listing five minor amendments to the Final Report in order to obtain BC and IPC support. We hope to discuss these items with you this week. All the best, Margie Milam and Mark Svancarek BC Representatives on the EPDP

4 3

Reminder: Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 19 February 2019 at 14:00 UTC
by Nathalie Peregrine Feb. 18, 2019

Feb. 18, 2019

Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/EYU2Bg Thank you. Kind Regards, Andrea

1 0

Legal Advice Received
by Kurt Pritz Feb. 18, 2019

Feb. 18, 2019

Hi Everyone: I have attached the two latest legal memoranda from Bird & Bird that the EPDP Legal Team has decided to pass on to the full team without comment. The two memoranda answer our questions about: Data Accuracy requirements, and City name redaction / publication I will take the liberty of noting that the "City Name” memo identifies that data element as personal data and then indicates that additional research is required to determine if there is a legal basis for its publication. To me, this fits well with the current recommendation to redact the city name field pending result of additional; independent legal input. Currently, the report reflects the divergence of opinion on this recommendation. We are authorizing Bird & Bird to complete the research. We are currently waiting for an answer regarding geographical aspects. Any questions you have can be posed to the EPDP Legal Team or can also be forwarded to Bird and Bird. Best regards, Kurt

3 2

BC Consensus Call Responses
by Margie Milam Feb. 17, 2019

Feb. 17, 2019

Dear Colleagues- The BC and IPC members have been working hard over the weekend to develop our response to the consensus call and GNSO Council voting on the Final Report for EPDP Phase 1<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…>. The attached response is just 3 pages long, and reflects close collaboration with the IPC, listing five minor amendments to the Final Report in order to obtain BC and IPC support. We hope to discuss these items with you this week. All the best, Margie Milam and Mark Svancarek BC Representatives on the EPDP

1 0

RrSG Feedback on Feb. 11 Final phase 1 report
by Matt Serlin Feb. 16, 2019

Feb. 16, 2019

Hi All, Hope everyone is having a good weekend! Please find attached feedback from the RrSG on the Feb. 11 Final Report. Regards, Matt.

1 0

For your review - updated version of Final Report
by Marika Konings Feb. 16, 2019

Feb. 16, 2019

Dear EPDP Team, Based on the input received to date, the staff support team has made some further updates to the Final Report, mainly for clarity and consistency reasons. You will find these changes in redline in the attached version (a Word version is posted on the wiki, see https://community.icann.org/x/VZwWBg) We also included references to the legal guidance provided on city field and accuracy, consistent with how other parts of legal advice have been included. In a new Annex F, you find the statements received to date for inclusion from the SSAC and ALAC. The staff support team is assuming at this stage that the input provided by RySG and NCSG relates to the consensus designation process and finalization of the report – if this is not correct, please let us know and we can include the input provided accordingly. Please note that the RySG input provided further suggestions for clarifications / changes to some of the recommendations or parts of the report, these have NOT been applied so that the EPDP Team can first review and consider these. Further updates have also been made to the data element tables and workbooks in Annex D as a result of further work by the data elements team. You will find an overview of the changes below (these do not appear in redline in the report). If any of the changes made are considered substantive and requiring further discussion, please flag these as soon as possible (by Monday 18 Feb COB at the latest) so these can be added to the agenda for the meetings next week. Best regards, Caitlin, Berry and Marika Workbook updates: • Incorporated the split of Purpose 1 into 1A and 1B • Made updates to address a shortcoming of the workbooks where by a “transfer” from a Registrar is also considered a collection by a “Registry” • Developed a clearer distinction for the use of “optional” • Refined data elements designations for collection and transfer processing activities that better reflect what occurs technically • Refined the disclosure processing activity to identify a disclosure to a third party versus publication • Migrated the publication and disclosure processing activities from Purpose 2 to Purpose 3 to better represent a minimum public data set available on a public directory • Imported data element designations into update consolidated tables by processing activity • Created an additional view of data transferred from a Registrar to a Registry that better represents why data is transferred based on URS as a contractual arrangement for gTLDs versus gTLDs that are not contractually obligated to support URS • Applied filters to generate new tables used for recommendations in the final report which now include better representation for those data elements that are required for processing versus optional Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

NCSG comments on the final report
by Mueller, Milton L Feb. 16, 2019

Feb. 16, 2019

NCSG has reviewed the 11 Feb final report and attached are our comments. I've also attached them as text below. 15 February 2019 NCSG Comments for the annex of the final EPDP report The comments that follow pertain only to recommendations where the NCSG strongly disagrees or has important warnings or qualifications. Additional objections to other elements appearing in the report have been withheld due to our desire to reach a consensus policy. Recommendation #1: Purposes: * Purpose 2: Disclosure of data to third parties. NCSG continues to maintain that disclosure to third parties is not a valid ICANN purpose for processing domain name registrants’ data. Further, defining disclosure as a purpose is not necessary to disclose redacted data to law enforcement and other third parties with legitimate interests. To achieve consensus on this report, we have accepted this as a “purpose,” but warn that it could be overruled by law. * Consensus guidance: NCSG would like to record its concern. It does not object to this purpose. * Purpose 7: Purpose 7 is not acceptable to NCSG because it would needlessly increase the number of data registration elements in the RDDS or Whois. Some of these data elements could be very sensitive and personally identifiable. Registries can validate eligibility independently, without use of ICANN’s RDDS/Whois. We were assured by registry operators that such data elements would not go into the RDDS, but since this proceeding concerns RDDS/Whois we believe it is inevitable that the data will go into it. * Consensus guidance: NCSG dissents on this purpose. Recommendation #2: Research and OCTO * Recommendation 2 states that Phase 2 will consider whether additional purposes should be defined to facilitate carrying out the mission of ICANN’s Office of the Chief Technology Officer (OCTO). Yet OCTO has clearly stated on multiple occasions that it does not need access to personal information of domain name registrants. While we favor seeking legal guidance on ICANN’s ability to use Whois data for research, Rec 2 is too ambiguous and broad and could open the door to bulk access for many third parties (and is actually intended to do so) * Consensus guidance: NCSG dissents on this recommendation. Recommendation #7: Transfer of registration data elements * Recommendation 7 states “the specifically-identified data elements under “[t]ransmission of registration data from Registrar to Registry” … must be transferred from registrar to registry provided an appropriate legal basis exists and data processing agreement is in place." * Consensus guidance: NCSG can accept this but wishes to emphasize that there may be no valid legal justification for transferring all of these data elements from registrars to registries and inclusion of this recommendation does not imply that there is one. Recommendation #8: Transfer to Escrow * As noted in our objection to Purpose 7, additional data elements identified by registries should not be added to escrow. * Consensus guidance: NCSG dissents from Purpose 7 Recommendation #16: Geographic differentiation * The Recommendation says that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. * NCSG does not recall the group settling on this position. NCSG believes that ICANN’s rules should be uniformly applicable, therefore registries and registrars should be obliged NOT to differentiate. Recommendation #18: Reasonable access, Timeline, and Criteria NCSG accepts the recommendation and particularly emphasizes the importance of re-naming this to “Reasonable Requests for Lawful Disclosure of Non-Public Registration Data.” We have the following observations: * Logs of requests: Logs of requests should be provided only to ICANN upon request, on a case by case basis, as stated in purpose 13. The audit function, which has been added to the recommendation 18, is not acceptable. * Logs of the request should only contain information about “confirmation that a relay of the communication between the requestor and the Registered Name Holder has occurred, not including the origin, recipient, or content of the message.” * The distinction between urgent and non-urgent requests and obliging contracted parties to treat requests differently is not acceptable. * We recommend deleting recommendation 18 provisions about logs and responding to urgent requests

1 0

ALAC statement on the Phase 1 Final Report
by Alan Greenberg Feb. 16, 2019

Feb. 16, 2019

Please find attached the ALAC statement on the report submitted to the GNSO Council. Please note that this statement has the formal approval of the ALAC. Alan

1 0

RySG feedback on 11 Feb Draft of phase 1 report
by Anderson, Marc Feb. 16, 2019

Feb. 16, 2019

Kurt and Team, The RySG has reviewed the 11 Feb draft of the phase 1 report and is providing the attached comments and assessment of where we support and do not support the purposes and recommendations as written. Thank you, Marc Marc Anderson mcanderson(a)verisign.com<mailto:mcanderson@verisign.com> Cell: 571.521.9943 Office: 703.948.3404 12061 Bluemont Way, Reston, VA 20190 Verisign.com<http://www.verisign.com/>

1 0

Timing of Feedback on Draft Final Report
by Kurt Pritz Feb. 15, 2019

Feb. 15, 2019

Hi Everyone: TIMING I have been asked by a couple groups about the timing of feedback for the Final Report, given that we are at the conclusion of the quiet period. The purpose of this time was to flag issues for the final report and also to provide a group written statement accompanying the report on topics. As it currently sits, today is the day to flag issues in the final report so that the next version can be developed and meet agendas can be set for next week. However, statements that will be included in the reports can be provided later as they will added to or incorporated into the report in some way. If necessary, statements could be issued as late as Tuesday. (To differentiate between today’s requirement to flag issues and the statements: I think it means that there are no surprises in the report.) I wish to thank many who have contributed their review of the report. Many questions were raised and I believe the report will be better understood based on the email interactions and clarifications that have taken place. We plan meetings for Tuesday and Wednesday to discuss issues raised and items that need to be closed. OUTSTANDING ITEMS I have not yet sent out the last Bundle (aka “3B”) for designation of consensus. Part of this week was to allow for online discussion of those recommendations. I have had been party to discussions on the recommendation for Reasonable Access where the there is not yet agreement on the phrasing “Reasonable Requests for Lawful Access” vs “Reasonable Lawful Access” so that I could fully understand the concerns between the two phrases. This remaining difference is the result of the clock running out as different versions were championed at different meetings. I think we should place Reasonable Access on the agenda for Tuesday. This is an important recommendation and one where we have made great headway and come farther than I thought we would. It is always risky for me to characterize an issue but I want to take advantage of the work we have done to date and the agreement in principle that we have on this Recommendation and come to agreement on the language as well. During our meetings, I heard two concerns raised in reference to the two different phrasings above. Contracted Parties want to ensure that just because a request is reasonable or properly submitted, that disclosure is not required. The request must still be lawful (e.g., in a Art 6(1)f sense) before a disclosure is made. Data requesters want to ensure that registrars will not respond merely by rejecting all requests - but that they take reasonable steps to determine if the request can be fulfilled in a GDPR-complaint way. I think the spirit of the agreement addresses both of those concerns but there is concern that the different phrasings allow the agreement in principle to be turned. I believe that the Recommendation can be made final by adding sentence regarding a reasonable response by registrars and the requirement that requests must be GDPR complaint before disclosure can be made. I hope you find that constructive. It is sort of an extraordinary intervention on my part but I see an opportunity to arrive at a consensus position on a very difficult topic. Please let me know if you have questions on either of these two topics. Best regards, Kurt

3 2

Consensus calls, SSAC - Bundle 3
by Ben Butler Feb. 15, 2019

Feb. 15, 2019

Hi Kurt, As requested, and after deliberating with SSAC members, here are the consensus call positions from SSAC for Bundle 3/3B. I have grouped the recommendations based on our position. We have provided comments on a few for inclusion/consideration in the report to GNSO Council. SSAC will likely provide additional comments next week as well based on the extended deadline referred to in your last correspondence. Supported Recommendations: Recommendation #5 (old #4) - Data elements to be collected by Registrars – SSAC concurs with the recommendation with the understanding that Registrars must support / process Tech Contact data if it is provided by the RNH Explanation: There is some confusion whether Recommendation 5 requires registrars to offer the Tech Contact fields to their Registered Name Holders or not. This is because Recommendation 5's table marks the Tech Contact fields as mandatory to collect, but Recommendation 5 also says "if the Registrar provides this option". SSAC understands that there are legal requirements for collecting and transferring the Tech Contact data which will need to be discussed in the implementation phase. SSAC believes that the ePDP Team's discussion was: Registrars MUST offer the Registered Name Holder the opportunity to provide Technical Contact data. Technical Contact data should be optional for the Registered Name Holder to provide. If Technical Contact data is provided to the registrar, the data must be provisioned to the registry. If that is what Recommendation 5 delivers, SSAC can endorse Recommendation 5. If Recommendation 5 does not deliver that, SSAC cannot endorse Recommendation 5. Recommendation #7 (old #5)– Data elements to be transferred from Registrars to Registries – SSAC concurs with the recommendation as written Recommendation #9 (old #7) – Contractual Compliance – SSAC concurs with the recommendation as written Recommendation #10 (old #8) – Data Redaction – SSAC concurs with the recommendation as written Recommendation #12 (old #9) – Organization field – SSAC concurs with the recommendation as written Recommendation #13 (old #10) – Email communication – SSAC concurs with the recommendation as written Recommendation #14 – Privacy/Proxy Registrations – SSAC concurs with the recommendation as written Recommendation #19 (old #13) - Controller Agreement – SSAC concurs with the recommendation as written Recommendation #20 (old #14) - Responsible Parties – SSAC concurs with the recommendation as written Recommendation #27 (old #22) – Impact on other policies – SSAC concurs with the recommendation as written Recommendation #29 – Admin Contact Transition – SSAC concurs with the recommendation as written Recommendation #2 –Additional Purposes – SSAC concurs with the recommendation as written Dissentions: Recommendation #16 – Geographic Basis – SSAC cannot support the recommendation as written (See Below) Recommendation #17 – Natural vs. legal – SSAC cannot support the recommendation as written (See Below) Reasoning: Recommendations 16 and 17 have a negative effect on security and legitimate contactability. Recommendation 16 allows significant over-redaction of data not required by GDPR (or other laws currently in place), and enables a race to the bottom, allowing venue-shopping without respect to the actual location of registrars or registrants. Recommendation 17 enables ongoing redaction of information about legal persons that do not have the rights of natural persons. These outcomes are not balanced, and are neither necessary nor desirable. We believe that better, more balanced solutions are both legally and technically possible and should be discussed. It is the SSAC's position that: * Recommendation 16: Registrars and Registry Operators must be obligated to differentiate between registrants on a geographic -- i.e. legal jurisdiction basis, after a suitable implementation period. * Recommendation 17: Registrars and Registry Operators must be obligated to differentiate between registrations of legal and natural persons, after a suitable implementation period. Regarding Recommendation 17: * The EPDP Team will discuss the Legal vs. Natural issue in Phase 2, and SSAC looks forward to participating in that discussion. Should Recommendation 17 be adopted by Council, SSAC notes that the study criteria in section #2 are unbalanced and must be updated. They assume that the main decision-making criteria are the costs and risks to contracted parties. The list is missing consideration of how policy affects third parties with legitimate interests, and how the law imposes new responsibilities(and therefore costs) on the Contracted Parties . As SAC104 notes: "The GDPR imposes certain new obligations and therefore risk and costs on registrars and registry operators. It has also imposed risk and costs on the parties who rely upon domain registration data for the wide array of legitimate purposes. The GDPR calls for balancing and the accommodation of legitimate security interests, explicitly called out in Recital 49. ICANN policy should also provide balanced solutions. In some cases the Initial [and now the Final] Report asks what costs will be borne by the Contracted Parties, but does not also evaluate the costs on all other parties, or the cost of not putting a balanced solution into place. Cost or risk to registrars or registry operators alone is not a persuasive argument against balanced solutions." Supporting Documentation: SAC104: https://www.icann.org/en/system/files/files/sac-104-en.pdf SAC101v2: https://www.icann.org/en/system/files/files/sac-101-v2-en.pdf As SSAC stated in SAC104: "The GDPR states clearly that it 'does not cover processing of personal data which concerns legal persons.' We recommend that registrars be required to deploy mechanisms that ensure a reliable declaration or determination of natural or legal person status for new registrations going forward, and to eventually obtain those declarations or determinations for existing registrations and their registrants. "Contact data associated with natural persons should be published in RDS where such is not prohibited by local law. In SAC101, SSAC stated: 'The new policy [The Temporary Specification] allows RDDS operators complete freedom to choose when to redact domain contact data from publication, whether or not a domain contact is protected by GDPR or by any other local privacy law. The result has been blanket redactions, hiding more data than is legally called for. A more balanced and justified approach is needed.. access should not be less timely, more restricted, and less public than law requires.... We also note that as of this writing, most ccTLD operators in the European Union continue to publish some (and sometimes all) contact data fields for domains registered by legal persons. Some continue to publish some personal data for natural person registrants in public WHOIS output.' "SAC101 also highlights RIPE-NCC's solution, which allows for the publication of data about natural persons contained in the contact data for legal persons. This process provides mechanisms that RIPE-NCC says were specifically designed to comply with GDPR. The RIPE-NCC solution seems to be balanced in that it provides contactability and does not overapply the law. SSAC believes that RIPE's model deserves a full examination and neutral legal evaluation.... We also recommend the following: 1. Introduction of a policy requiring registrants to make a legal or natural person declaration. 2. Obtaining declaration would be mandatory for registrars to implement within a reasonable time. 3. A declaration would only be required during registration events, i.e. when a new domain is registered, or when an existing domain is renewed or transferred (by gaining registrar). This would eventually "fill in" status data about existing/historical registrations. 4. Registrar may make declaration on behalf of registrant if the registrar has reasonable knowledge of registrant's status and the registrant has not made a declaration of its own. This would be applicable to registrars with specific business models, for instance when they only process registrations on behalf of organizations where it is clear that the registrant falls into a particular category based on their relationship with the registrar. 5. Registrant may change its declaration at any time. 6. The absence of a declaration results in assumption that the registrant is a natural person; i.e. a default redaction of data. 7. Inaccurate declarations will be subject to a revised WHOIS inaccuracy complaint process." Cluster #3B Recommendation #11 City Field – SSAC concurs with the recommendation as written Recommendation #15 (new #11) - Data retention – SSAC concurs with the recommendation as written Recommendation #18 (old #12) – Reasonable access – SSAC concurs with the recommendation as written Recommendation #28 - Implementation Transition Period – SSAC concurs with the recommendation as written As always, please reach out if we can provide any additional context or clarification. -Ben

1 0

Issues with the report
by Caitlin Tubergen Feb. 15, 2019

Feb. 15, 2019

Hi Alan, Please find answers to your questions in blue. We are still looking into one of your questions, but noting the request for a quick reply, please see the answers below. Thank you. Best regards, Marika, Berry, and Caitlin -- There are several issues with the report that are either incorrect, or I do not know how the decisions were made (and several others also do not know). - Rec #8 implies (but does not clearly say) that offering Tech Contacts is an option for registrars. In the interim report, we raised the question of whether "optional" for the Tech fields meant optional for the registrant, or optional for the registrar. I cannot recall ever discussing this when we went over the comments, but somehow it is now optional for registrars, requiring registrants to shop around for a registrar that accepts the option - if indeed any registrars will! When was this decided? Please refer to the 24 January meeting as well as the response from Bird & Bird re: the liability associated with additional contact information. As you may remember, there was an “informal vote” at the end of the 24 January call, during which there was no consensus with respect to the meaning of “optional”. In other words, approximately half of the groups preferred optional to mean the registrar has the option of offering a technical contact field to the registrant, and half of the groups preferred optional to mean the registrar must offer the technical contact field but the registrant has the option of providing contact information for the technical contact field. We noted, during the call, that we would document the status of the issue in the Final Report and await further legal advice. The following question was posted to legal counsel: The EPDP Team also took note of a related footnote [from the EDPB] which states, “[if contact details for persons other than the RNH are provided] it should be ensured that the individual concerned is informed”. The EPDP Team discussed whether this note implies that it is sufficient for the Registered Name Holder (RNH) to inform the individual it has designated as the technical contact, or whether the registrar may have the additional legal obligations to obtain consent. The EPDP Team requested external legal counsel guidance on this topic who provided the following summary answer: Legal Counsel provided the following response: “In cases where the RNH and the technical contact are not the same person, relying on the RNH to provide notice on the registrar's behalf will not meet GDPR's notice requirements if the RNH fails to provide the notice. While this may provide grounds for a contractual claim against the RNH, it is unlikely to provide a viable defence under the GDPR. Moreover, this arrangement will make it difficult for registrars to demonstrate that notice has been provided. If notice is not effectively provided, this could affect the legitimate interests analysis, since technical contacts may not "reasonably expect" the manner in which their data will be processed. If relying on consent, such an arrangement would make it difficult to document that consent has been provided”. If you would like to refer to the full response from Bird & Bird, please refer to the this memo. This response has also been documented in the Final Report. - Rec #16 takes geographic differentiation off the table. My recollection is that we put that decision into Phase 2. When was this decision taken? Please refer to the email from Marc A. (see https://mm.icann.org/pipermail/gnso-epdp-team/2019-February/001543.html) which includes the text that is now in the Final Report. Feedback was requested, following a number of positive responses to this approach (see https://mm.icann.org/pipermail/gnso-epdp-team/2019-February/001485.html) - no objections were raised at the time; however, if your group believes this is in error, please flag this accordingly. Please also note the following question has been posed to legal counsel: In light of the EDPB Guidance on territorial scope of GDPR, how do ICANN’s stable establishments within the EU impact its responsibilities as a data controller. The EDPB Guidance appears to suggest that ICANN, as a controller with stable establishments within the EU, might be required to comply with GDPR? Is this the case even if the majority of processing activities (including registrar/reseller collection of data from RNH) take place outside of the EU? . Specifically: Do any of ICANN’s operations within the EU qualify as Establishments, as defined by Recital 22 of the GDPR? If ICANN is found to have Establishments within the EU, do these Establishments require ICANN (as a controller of gTLD Registration Directory Services related processing activities) to be subject to article 3.1 of the GDPR? Do the answers to the above questions impact ICANN’s, and/or any associated controllers’ or processors’, ability to distinguish between Registered Name Holders (RNH)/data subjects based on the geographic location of the RNHs in determining the geographic scope of GDPR? - Rec #18 does not make sense to me. It says that Temp Spec sections 4.1 and 4.2 are to be replaced "upon expiration". What is the purpose of replacing these sections once the Temp Spec is no longer operative? And how does that affect access? I note that Rec #28 temporarily reinstates the Temp Spec, but the version PRIOR to expiration. The work of the EPDP Team is to confirm, or not, the language in the Temporary Spec. In some cases, the Team confirmed the precise language in the Temporary Specification. Per the feedback of the EPDP Team, rather than simply confirming language, we have inserted the specifically-agreed upon language within the Temporary Specification into the Final Report. In the case of Recommendation 18, the Team agreed to replace the language in the Temporary Specification with the language noted in the recommendation, noting that work in Phase 2 may complement or replace the language within the recommendation. The Team agreed these new defined criteria would be effective as soon as the Temporary Specification expires, which is why it is denoted as such. - Rec #29 requires explicit action from registrars before the Admin fields can be eliminated. Either we need to explicitly say that this action must be taken prior to 29 February 2020, or we need to include them in Rec #5 listing all RDDS fields flagging them as being there only until the Rec #29 action is taken. Thank you for flagging this. We could add a sentence that this action must be taken prior to 29 February 2020 if the EPDP Team agrees. On a less substantive level: - We say the Tech name and contact fields are option, but in the various tables, the are not flagged with a trailing (opt.) like the other optional fields are. - In Rec #8, why are Tech name and contacts transmitted by registries to escrow but not by registrars (as currently required by the RAA)? We are looking into this and will revert to you shortly. - Rec #13 makes a reference to "Recommendation X". I presume this should be Rec #6. Yes, thank you for noting this. - Rec #21 makes reference to Thick and Thin registries, a concept that we are told no longer exists. The language you reference is part of the Temporary Specification that the Team agreed to confirm at its face-to-face meeting in Toronto. Please refer to Annex D of the Temporary Specification. The first issues have a direct bearing on whether the ALAC can support this report and I would appreciate a quick reply. Alan

4 3

Re: [Gnso-epdp-team] Permission to publish redacted information
by Marika Konings Feb. 15, 2019

Feb. 15, 2019

Alan, can you clarify why you consider that this is not covered under recommendation #6: "The EPDP Team recommends that, as soon as commercially reasonable, Registrar must provide the opportunity for the Registered Name Holder to provide its Consent to publish additional contact information in the RDS for the sponsoring registrar." Thanks, Caitlin, Berry and Marika On 2/15/19, 08:55, "Gnso-epdp-team on behalf of Alan Greenberg" <gnso-epdp-team-bounces(a)icann.org on behalf of alan.greenberg(a)mcgill.ca> wrote: Temp Spec 2.3 allowed a registrant to consent to publication of redacted fields. In Toronto, we noted that this did not apply to e-mail since it was not technically "redacted". Rec #6 addressed this. But we seem to have lost the ability of a registrant to consnt to publication of the redacted fields! Is this an error that will be corrected or intentional (I do not recall such a decision). Alan _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team

2 1

Permission to publish redacted information
by Alan Greenberg Feb. 15, 2019

Feb. 15, 2019

Temp Spec 2.3 allowed a registrant to consent to publication of redacted fields. In Toronto, we noted that this did not apply to e-mail since it was not technically "redacted". Rec #6 addressed this. But we seem to have lost the ability of a registrant to consnt to publication of the redacted fields! Is this an error that will be corrected or intentional (I do not recall such a decision). Alan

1 0

Recommendation 9
by Trang Nguyen Feb. 15, 2019

Feb. 15, 2019

Dear EPDP Team, Please see below a request from Jamie Hedlund, ICANN’s SVP of Contractual Compliance and Consumer Safeguard. Regards, Trang Nguyen ICANN Org Liaison ** ICANN Contractual Compliance requests confirmation that the scope of Recommendation #9 is limited to registration data elements that appear in WHOIS (and eventually RDAP), and that it does not include data or information other than WHOIS (or RDAP) data elements. With this understanding, ICANN Contractual Compliance requirements for other data and information from contracted parties which is necessary for enforcement of ICANN’s agreements and policies, including the types of data listed in the ICANN Contractual Compliance Data Processing Activities overview, would not be governed by Recommendation #9. Please confirm. Thank you.

1 0

FW: [council] FW: FYI Motion For EPDP Final Report Approval
by Margie Milam Feb. 14, 2019

Feb. 14, 2019

fyi From: "Drazek, Keith" <kdrazek(a)verisign.com> Date: Thursday, February 14, 2019 at 12:25 PM To: Margie Milam <margiemilam(a)fb.com> Cc: "MarksvATmicrosoft.com" <Marksv(a)microsoft.com>, "sdelbiancoATnetchoice.org" <sdelbianco(a)netchoice.org>, "kurt(a)kjpritz.com" <kurt(a)kjpritz.com>, "marika.konings(a)icann.org" <marika.konings(a)icann.org>, "rafik.dammak(a)gmail.com" <rafik.dammak(a)gmail.com>, "marie.pattullo(a)aim.be" <marie.pattullo(a)aim.be>, "smccormick(a)hackerone.com" <smccormick(a)hackerone.com> Subject: RE: [council] FW: [Gnso-epdp-team] FYI Motion For EPDP Final Report Approval Hi Margie, Thanks for your follow-up note, and for the opportunity to discuss your views during our phone call yesterday. I’ve provided some initial responses below. Please note I have not had a chance to discuss this with the GNSO Council Leadership Team, EPDP Leadership Team, or ICANN Staff supporting both groups, but I wanted to get this preliminary response back to you prior to this afternoon’s special GNSO Council meeting. 1. I agree the “gating questions” were at least partially “addressed” in the Initial Report, but my understanding is there was no consensus call on the substance or content of the Initial Report, and no consensus on the proposed answers to the gating questions. Rather, there was simply agreement to publish the Initial Report for public comment, and at that time the answers to the gating questions were far from complete or agreed-to by the EPDP WG. As such, the GNSO Council was not asked to consider them and to communicate non-objection to transitioning to Phase 2 as required by the Charter. 1. In relation to Phase 2, you noted below that the EPDP WG Charter says “Work on this topic shall begin once the gating questions above have been answered and finalized in preparation for the Temporary Specification initial report.“ But you omitted the following sentence that states “The threshold for establishing “answered” for the gating questions shall be consensus of the EPDP Team and non-objection by the GNSO Council.” As noted above, the gating questions still have not been agreed-to by the EPDP WG, but that should currently be taking place with the ongoing consensus assessment process. 1. Further, if you refer to the “Deliverables and Timeline” section on Page 10 of the Charter, there are three distinct deliverables, which clearly include two separate Final Reports of the PDP. The GNSO Council clearly recognized in the Charter that two Final Reports would be needed, one to address the Temp Spec, and a second to address the System for Standardized Access to Non-Public Registration Data. Here’s an excerpt of the relevant section that lists the deliverables: * “The first deliverable of the EPDP Team shall be a triage document of the Temporary Specification” * “The second deliverable shall be the Initial Report which will include the items that received Full Consensus support per the triage document as well as all other items of the Temporary Specification (not including the Annex) that were considered and deliberated upon, followed by a Final Report following review of public comments.” * “The third deliverable of the EPDP Team shall be an Initial Report outlining a proposed model of a system for providing accredited access to non-public Registration Data, followed by a Final Report following review of public comments.” 1. It was always the intention of the Council that the Phase 1 Final Report would either confirm the Temp Spec as Consensus Policy or replace the Temp Spec with a new Consensus Policy. As such, we are not changing the interpretation of the Charter mid-stream. We had hoped that the Initial Report would have presented a consensus agreement on the gating questions, but it did not, and we are now attempting to do so with the Final Report. 1. On timing, the Consensus Policy must be approved by the Board prior to May 25, 2019. The Phase 1 Final Report needs to be finalized by the EPDP WG in the next two weeks so the Council can vote on 4 March (at the latest) in order to provide time for a traditional 40-day public comment period, Staff analysis of the comments received, and Board consideration and vote before May 25, 2019. There is no time left for a so-called “Phase 1 Part 2 Final Report” and consideration of such a construct was not included in the Charter. 1. In response to your points on the completeness of the Phase 1 Final Report, it is my understanding that the EPDP WG agreed to defer some questions and issues to Phase 2, which in my view is the prerogative of the EPDP WG in conducting its work. That said, here are my observations: * Purposes – I defer comment on this until after I’ve had a chance to discuss with the EPDP WG leadership team. * Data Accuracy – Data accuracy requirements were not included in the EPDP WG Charter. * Geographic Requirements – The Final Report includes a recommendation, so this appears to be addressed. * Natural/Legal Persons – The Final Report includes a recommendation and says that ICANN should study the issue further, so this appears addressed. * Other Consensus Policies – The Final Report includes a recommendation acknowledging that other Consensus Policies be updated as part of the implementation of the new Consensus Policy. It appears more work can be done here, but these were not gating questions and therefore can be addressed in Phase 2 and/or the implementation of Phase 1. 1. Finally, to reiterate a point from my earlier email, the GNSO Council is looking forward to approving the Phase 1 Final Report AND signaling non-objection to the EPDP WG transitioning to Phase 2 during our GNSO Council meetings on 21 February or 4 March. I encourage everyone to continue providing input and feedback to the EPDP WG as the quiet period comes to a close so any remaining adjustments might be considered and incorporated. Please let me know if you have any follow up questions. Best, Keith Drazek GNSO Chair P.s. Please forward this to the EPDP WG list as I do not have posting privileges. From: Margie Milam <margiemilam(a)fb.com> Sent: Thursday, February 14, 2019 12:36 PM To: Drazek, Keith <kdrazek(a)verisign.com> Cc: MarksvATmicrosoft.com <Marksv(a)microsoft.com>; sdelbiancoATnetchoice.org <sdelbianco(a)netchoice.org>; 'kurt(a)kjpritz.com' <kurt(a)kjpritz.com>; marika.konings(a)icann.org; rafik.dammak(a)gmail.com; Marie Pattullo <marie.pattullo(a)aim.be>; Scott McCormick <smccormick(a)hackerone.com> Subject: [EXTERNAL] Re: [council] FW: [Gnso-epdp-team] FYI Motion For EPDP Final Report Approval Importance: High Hi Keith- Thank you for talking to us about the GNSO Council’s upcoming vote on the EPDP “Final Report.” We owed you additional pieces of information that help explain our view on how the charter is interpreted. * Gating Questions It appears the gating questions were addressed in the Initial report. You’ll recall not all questions in the charter were termed “gating” – only Part 1(a) and Part 2(b), (c) and (f). · Part 1(a) (Purposes for Processing Registration Data) is addressed by Initial Report Recommendation 1 · Part 2(b) (Collection of registration data by registrar) is addressed by Initial Report Recommendation 4 · Part 2(c) (Transfer of data from registrar to registry) is addressed by Initial Report Recommendation 5 · Part 2(f) (Publication of data by registrar/registry) is addressed by Initial Report Recommendations 8 and 10 As I explained, nowhere in the Charter or elsewhere does it call for a consensus decision of the Final Report in order to move ahead with Phase 2. Instead the Charter states: “Work on this topic shall begin once the gating questions above have been answered and finalized in preparation for the Temporary Specification initial report. “ Since there was consensus to publish the Initial Report, the Council should have simply notified the EPDP Team in November that it had no objection to proceeding to Phase 2. Indeed, this reference to the Initial Report confirms that there was no intent to wait until consensus for the Final Report. In our view, it is problematic to change the interpretation of the Charter midstream during the EPDP’s deliberations for those stakeholder groups and constituencies that relied on this interpretation of the Charter. * Completeness of Phase 1 Report Per our discussion, Phase 1 was not fully completed; there are questions that should have been answered in Phase 1 but were recommended in the Phase 1 Final Report to be delayed into Phase 2 for consideration and work. This non-exhaustive list includes (referenced by charter section): · Charter section: None Recommendation 2: The EPDP team considers whether additional purposes should be considered to facilitate work by ICANN Org’s OCTO. · Charter section: P.7: System for Standardized Access to Non-Public Registration Data Recommendation 3: Questions about a standardized access model (e.g., whether such a system should be adopted, what are legitimate purposes for third parties to access registration data, etc.) · Charter section: Part 2(g), P.5: Data retention Recommendation 15: Undertake a review of all ICANN Org active processes to document instances when personal data is requested from a registrar beyond the period of the “life of the registration.” · Charter section: Part 2(h)(3-5), P.5: Legal vs. Natural Persons Recommendation 17: The EPDP Team will discuss the Legal vs. Natural issue in Phase 2. · Charter section: P.7: System for Standardized Access to Non-Public Reg. Data Recommendation 18: Replacement of Secs. 4.1 and 4.2 of Appendix A to the Temp Spec by criteria enumerated by the EPDP team. * Further examples of issues NOT yet addressed in Phase 1 · Charter section: Part 4 (n-q), P.7: Updates to other consensus polices o URS o UDRP o Transfer policy o Sunsetting Whois (following migration to RDAP) * Need for a Final Report Part II As previously discussed and highlighted above, the (actual) Final Report is incomplete and cannot form the basis of a consensus policy until the charter’s work is complete. One needs to look no further than the Board resolution in support of this, including elucidation of the appropriate timeline: As required when a temporary policy or specification is adopted, the Board also is taking action to implement the consensus policy development process. The Board will consult with the GNSO Council on potential paths forward (e.g. Expedited Policy Development Process) for considering the development of a consensus policy on the issues within the Temporary Specification, which must be concluded in a one-year time period. The initial Phase 1 report was published in November 2018, with the “gating questions” (Parts 2(b), 2(c) and 2(f)) sufficiently addressed (see EPDP initial report<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_sites_d…>). Per the charter, work on an access model should have begun late last year. Instead this work has been deferred to Phase 2 of the team’s work. What is unclear is when the EPDP team will take up its remaining responsibilities under the charter and produce an actual “final” report - – which must occur prior to the expiration of the Temp Spec on May 25, 2019. We hope this helps clarify our thoughts as the Council considers these procedural issues in its call later today. We’d like to encourage the Council to ask the EDPD Leadership to create a timeline for producing the Final Report -Part II that brings the work to a close in an expedited manner. All the best, Margie From: "Drazek, Keith" <kdrazek(a)verisign.com<mailto:kdrazek@verisign.com>> Date: Tuesday, February 12, 2019 at 11:08 AM To: "marie.pattullo(a)aim.be<mailto:marie.pattullo@aim.be>" <marie.pattullo(a)aim.be<mailto:marie.pattullo@aim.be>>, "council(a)gnso.icann.org<mailto:council@gnso.icann.org>" <council(a)gnso.icann.org<mailto:council@gnso.icann.org>> Cc: "MarksvATmicrosoft.com" <Marksv(a)microsoft.com<mailto:Marksv@microsoft.com>>, "sdelbiancoATnetchoice.org" <sdelbianco(a)netchoice.org<mailto:sdelbianco@netchoice.org>>, Margie Milam <margiemilam(a)fb.com<mailto:margiemilam@fb.com>>, "'kurt(a)kjpritz.com'" <kurt(a)kjpritz.com<mailto:kurt@kjpritz.com>>, "marika.konings(a)icann.org<mailto:marika.konings@icann.org>" <marika.konings(a)icann.org<mailto:marika.konings@icann.org>>, "rafik.dammak(a)gmail.com<mailto:rafik.dammak@gmail.com>" <rafik.dammak(a)gmail.com<mailto:rafik.dammak@gmail.com>> Subject: RE: [council] FW: [Gnso-epdp-team] FYI Motion For EPDP Final Report Approval Hi all, Thanks for forwarding this note from the BC’s EPDP WG reps. I’ll be happy to provide some additional context and guidance, both for Councilors and for the members of the EPDP WG. I’m copying Kurt, Rafik and Marika, so this can be forwarded to the EPDP WG list. 1. During the EPDP WG Chartering process, the GNSO Council drafting team made clear there would need to be two distinct phases of the work of the EPDP, each with its own Initial Report and Final Report. Phase One would focus on the Temporary Specification with an imposed 12-month deadline of May 25, 2019 due to the Board’s decision to invoke the Temp Spec. Phase Two would focus on the System for Standardized Access to Non-Public Registration Data after the gating questions from Phase One were addressed and the GNSO Council agreed. Here is the Charter language specifying the Objectives and timing: “To develop, at a minimum, an Initial Report and a Final Report regarding the EPDP Team’s recommendations on issues relating to the Temporary Specification for gTLD Registration Data as well as regarding the EPDP Team’s recommendations for a System for Accredited Access to Non-Public Registration Data, pursuant to the processes described in Annex A and A-1 of the ICANN Bylaws and the GNSO Expedited PDP Manual. Work on recommendations for a System for Accredited Access to Non-Public Registration Data should not commence until all gating questions have been answered. Similarly, delivery of the Final Report on the EPDP Team’s recommendations on issues relating to the Temporary Specification for gTLD Registration Data to the GNSO Council and subsequently the ICANN Board (before 25 May 2019) should not be held up by work that may still be ongoing in relation to the EPDP Team’s recommendations for a System for Accredited Access to Non-Public Registration Data.” 1. The Phase One Initial Report was delivered on 21 November and public comments were received, analyzed and incorporated. During the chartering process, the GNSO Council drafting team agreed, after much negotiation, to consider initiating the Phase Two work after the publication of the Phase One Initial Report, rather than after the Phase One Final Report, with the hope/expectation that the gating questions would have been sufficiently answered and the foundation for Phase Two would have been established. Unfortunately, as we all know, the Phase One Initial Report was not sufficiently complete, the gating questions were not yet addressed, and much more work was required before Phase Two could begin. Fortunately, with the current Phase One Final Report nearly complete, the EPDP will be able to begin work on Phase Two in short order. 1. As everyone should have seen in my email to the Council list last night (responding to Rafik’s note submitting the draft Final Report and Council Motion), our proposed motion will approve the Phase One Final Report and Consensus Policy recommendations AND signal the Council’s agreement (through non-objection) that the Phase Two work can begin. This is a significant moment where the EPDP WG is recommending a Consensus Policy replacement to the Temp Spec to be confirmed by Council and ICANN Board, it has substantially answered the gating questions, and it also agreed to defer certain issues to Phase Two. This is the definition of bottom-up consensus policy-making, and the GNSO Council looks forward to approving the Phase One Final Report, delivering it to the Board, and to supporting the EPDP WG in its Phase Two work on a System for Standardized Access to Non-Public Registration Data, or Uniform Access Model. To summarize: * The EPDP WG was chartered to have two distinct phases, one on the Temp Spec, the other on a System for Standardized Access to Non-Public Registration Data and the Annex to the Temporary Specification (Important Issues for Further Community Action). * The current report is the Final Report from Phase One. * The GNSO Council is expected to approve the Phase One Final Report replacing the Temp Spec AND authorize the EPDP WG to move to Phase Two. * Following GNSO PDP operating procedures and the ICANN bylaws, the EPDP WG recommendations to replace the Temp Spec will need to be approved by GNSO Council and the ICANN Board to ensure they are Consensus Policies and enforceable by ICANN Org. * The EPDP Charter is clear that the work on the System for Standardized Access is the next critical phase and it will receive the full support of the GNSO Council and ICANN Org. * Without Council approval of the Phase One Final Report, and without a new Consensus Policy to replace the Temp Spec before May 25, 2019, there will be no work on Phase Two. I hope this helps provide clarity around the views and intent of the GNSO Council as we initiated this important work and our expectations for the coming weeks. I appreciate the opportunity to review and reflect on the Charter and the work of the EPDP and I’m impressed by the group’s output in a very compressed timeframe. Please let me know if anyone has follow up questions. Otherwise, we’ll look forward to considering the EPDP WG Phase One Final Report during our 21 February and/or 4 March GNSO Council meetings. Regards, Keith Drazek, GNSO Chair From: council <council-bounces(a)gnso.icann.org<mailto:council-bounces@gnso.icann.org>> On Behalf Of Marie Pattullo Sent: Tuesday, February 12, 2019 12:36 PM To: council(a)gnso.icann.org<mailto:council@gnso.icann.org> Cc: Mark Svancarek (CELA) <marksv(a)microsoft.com<mailto:marksv@microsoft.com>>; Steve DelBianco <sdelbianco(a)netchoice.org<mailto:sdelbianco@netchoice.org>>; Margie Milam <margiemilam(a)fb.com<mailto:margiemilam@fb.com>> Subject: [EXTERNAL] [council] FW: [Gnso-epdp-team] FYI Motion For EPDP Final Report Approval Importance: High Dear all, I’ve been asked to send the below message to you from Margie, on behalf of the BC’s EPDP participants. I’m copying them here for ease. We’d appreciate your thoughts. Thanks Marie Hi – Thank you for sharing this note. I am genuinely confused about the directions given to the GNSO Council since this report – although it is misnamed a “Final Report” is really only an “Phase 1 Interim Report” since the PDP has not concluded, and the charter questions have not been answered. As a result, is seems that the voting thresholds to create a consensus policy and the vote required under the Bylaws do not yet apply until the Phase 2 work is complete. I understand the desire to call this a Final Report, but there is a significant amount of work that has not been done yet, as outlined in the draft report being circulated, with key areas missing, such as: …the EPDP Team is, at a minimum, expected to consider the following elements of the Temporary Specification and answer the following charter questions. (p.3, Mission and Scope, emphasis added) This passage sets forth the minimum requirements necessary for successful completion of the EPDP. However, one set of questions (see p.7 of the charter) -- dealing with access to non-public registration data -- is entirely unaddressed by the EPDP team. Further, according to the charter: System for Standardized Access to Non-Public Registration Data Work on this topic shall begin once the gating questions above have been answered and finalized in preparation for the Temporary Specification initial report. (p.7, emphasis added) The initial Phase 1 report was published in November 2018, with the “gating questions” (Parts 2(b), 2(c) and 2(f)) sufficiently addressed (see EPDP initial report<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_sites_d…>). Per the charter, work on an access model should have begun late last year. Instead this work has been deferred to Phase 2 of the team’s work. What is unclear is when the EPDP team will take up its remaining responsibilities under the charter and produce an actual “final” report (not merely a report on the conclusion of Phase 1), inclusive of Phases 1 and 2. Additionally, Section 2(j) of the charter addresses “Reasonable Access.” In what is labeled the draft final report<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…>, the charter’s section 2(j) questions are only partially answered, and included is a recommendation that the rest of the details be worked out in the implementation phase. Again, the EPDP team’s work is not yet finished, and it is premature to consider the current “consensus calls” instructive since this is an incomplete report, and true consensus can only truly be determined when the entire package (Phase 1 and Phase 2) of recommendations is developed. As a result, the report should be renamed, and the Council’s instructions should be updated accordingly. All the best, Margie From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Rafik Dammak <rafik.dammak(a)gmail.com<mailto:rafik.dammak@gmail.com>> Date: Tuesday, February 12, 2019 at 3:43 AM To: "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] FYI Motion For EPDP Final Report Approval hi all, Please find below the email sent to GNSO council to submit the motion for council consideration to approve the final report. You can find the latest version of the report posted in word and redline version on the wiki space https://community.icann.org/display/EOTSFGRD/g.+Draft+Final+Report<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…>. Best Regards, Rafik ---------- Forwarded message --------- From: Rafik Dammak <rafik.dammak(a)gmail.com<mailto:rafik.dammak@gmail.com>> Date: mar. 12 févr. 2019 à 08:10 Subject: Motion For EPDP Final Report Approval To: Council GNSO <council(a)gnso.icann.org<mailto:council@gnso.icann.org>> Hi all, I am glad to submit today the motion for the approval of EPDP Final Report Please find attached the motion and the draft final report. That version of the report is being currently reviewed by EPDP team members during this week - "quiet time". You will find below a cover letter from the EPDP leadership team giving more details in that regard. The motion may need to be amended in due time to be in line with the level of support for the recommendations in the Final Report. Best Regards, Rafik Dammak ------------------------------------------------------------------------------------------------- Dear Councillors: We are pleased to present this Draft Final EPDP Report Final Report of the Temporary Specification for gTLD Registration Data. The purpose in sending this draft Final Report is so that you can become acquainted with its layout and contents in advance of the release of the Final Report, expected on 20 February. It is hoped that this early release will facilitate your review of the final document. The EPDP Team is grateful to have two additional weeks for its deliberations.We are using the first week as a sort of “quiet period” to review the draft Final Report and have scheduled meetings for next week to reach conclusions on open issues. So we expect so substantive and non-substantive amendments to the report. With regard to the level of consensus, the report indicates those items where: · The Chair has indicated a consensus level and the EPDP Team has had the opportunity to review and comment on that designation · The Chair has indicated a level of Consensus and the EPDP Team has not yet had the opportunity to review and comment on that designation · The Chair has not made a designation yet because the issue is still open for some discussion. In many (nearly all) of the open recommendations, we are very close to final language but we have attempted to be conservative in the consensus designation and so have left some of these recommendations with no designation as of yet. The language you are reading in this report is close to final. Sections that still remain open are designated with brackets. The next steps for those sections are highlighted in yellow. We will also conduct a final Consensus call on the entire document when the report is final to identify any issues raised by the interplay between the Recommendations. Finally, and there will be more about this when the final report is delivered, this work product represents a significant sacrifice in time and effort by the working group members and, more significantly, a willingness by them to collaborate, cooperate, and compromise for our common goals. Best regards, EPDP Leadership Team

1 0

FW: [council] FW: FYI Motion For EPDP Final Report Approval
by Margie Milam Feb. 14, 2019

Feb. 14, 2019

FYI- From: Margie Milam <margiemilam(a)fb.com> Date: Thursday, February 14, 2019 at 9:35 AM To: "Drazek, Keith" <kdrazek(a)verisign.com> Cc: "MarksvATmicrosoft.com" <Marksv(a)microsoft.com>, "sdelbiancoATnetchoice.org" <sdelbianco(a)netchoice.org>, "'kurt(a)kjpritz.com'" <kurt(a)kjpritz.com>, "marika.konings(a)icann.org" <marika.konings(a)icann.org>, "rafik.dammak(a)gmail.com" <rafik.dammak(a)gmail.com>, Marie Pattullo <marie.pattullo(a)aim.be>, Scott McCormick <smccormick(a)hackerone.com> Subject: Re: [council] FW: [Gnso-epdp-team] FYI Motion For EPDP Final Report Approval Hi Keith- Thank you for talking to us about the GNSO Council’s upcoming vote on the EPDP “Final Report.” We owed you additional pieces of information that help explain our view on how the charter is interpreted. * Gating Questions It appears the gating questions were addressed in the Initial report. You’ll recall not all questions in the charter were termed “gating” – only Part 1(a) and Part 2(b), (c) and (f). · Part 1(a) (Purposes for Processing Registration Data) is addressed by Initial Report Recommendation 1 · Part 2(b) (Collection of registration data by registrar) is addressed by Initial Report Recommendation 4 · Part 2(c) (Transfer of data from registrar to registry) is addressed by Initial Report Recommendation 5 · Part 2(f) (Publication of data by registrar/registry) is addressed by Initial Report Recommendations 8 and 10 As I explained, nowhere in the Charter or elsewhere does it call for a consensus decision of the Final Report in order to move ahead with Phase 2. Instead the Charter states: “Work on this topic shall begin once the gating questions above have been answered and finalized in preparation for the Temporary Specification initial report. “ Since there was consensus to publish the Initial Report, the Council should have simply notified the EPDP Team in November that it had no objection to proceeding to Phase 2. Indeed, this reference to the Initial Report confirms that there was no intent to wait until consensus for the Final Report. In our view, it is problematic to change the interpretation of the Charter midstream during the EPDP’s deliberations for those stakeholder groups and constituencies that relied on this interpretation of the Charter. * Completeness of Phase 1 Report Per our discussion, Phase 1 was not fully completed; there are questions that should have been answered in Phase 1 but were recommended in the Phase 1 Final Report to be delayed into Phase 2 for consideration and work. This non-exhaustive list includes (referenced by charter section): · Charter section: None Recommendation 2: The EPDP team considers whether additional purposes should be considered to facilitate work by ICANN Org’s OCTO. · Charter section: P.7: System for Standardized Access to Non-Public Registration Data Recommendation 3: Questions about a standardized access model (e.g., whether such a system should be adopted, what are legitimate purposes for third parties to access registration data, etc.) · Charter section: Part 2(g), P.5: Data retention Recommendation 15: Undertake a review of all ICANN Org active processes to document instances when personal data is requested from a registrar beyond the period of the “life of the registration.” · Charter section: Part 2(h)(3-5), P.5: Legal vs. Natural Persons Recommendation 17: The EPDP Team will discuss the Legal vs. Natural issue in Phase 2. · Charter section: P.7: System for Standardized Access to Non-Public Reg. Data Recommendation 18: Replacement of Secs. 4.1 and 4.2 of Appendix A to the Temp Spec by criteria enumerated by the EPDP team. * Further examples of issues NOT yet addressed in Phase 1 · Charter section: Part 4 (n-q), P.7: Updates to other consensus polices o URS o UDRP o Transfer policy o Sunsetting Whois (following migration to RDAP) * Need for a Final Report Part II As previously discussed and highlighted above, the (actual) Final Report is incomplete and cannot form the basis of a consensus policy until the charter’s work is complete. One needs to look no further than the Board resolution in support of this, including elucidation of the appropriate timeline: As required when a temporary policy or specification is adopted, the Board also is taking action to implement the consensus policy development process. The Board will consult with the GNSO Council on potential paths forward (e.g. Expedited Policy Development Process) for considering the development of a consensus policy on the issues within the Temporary Specification, which must be concluded in a one-year time period. The initial Phase 1 report was published in November 2018, with the “gating questions” (Parts 2(b), 2(c) and 2(f)) sufficiently addressed (see EPDP initial report<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_sites_d…>). Per the charter, work on an access model should have begun late last year. Instead this work has been deferred to Phase 2 of the team’s work. What is unclear is when the EPDP team will take up its remaining responsibilities under the charter and produce an actual “final” report - – which must occur prior to the expiration of the Temp Spec on May 25, 2019. We hope this helps clarify our thoughts as the Council considers these procedural issues in its call later today. We’d like to encourage the Council to ask the EDPD Leadership to create a timeline for producing the Final Report -Part II that brings the work to a close in an expedited manner. All the best, Margie From: "Drazek, Keith" <kdrazek(a)verisign.com> Date: Tuesday, February 12, 2019 at 11:08 AM To: "marie.pattullo(a)aim.be" <marie.pattullo(a)aim.be>, "council(a)gnso.icann.org" <council(a)gnso.icann.org> Cc: "MarksvATmicrosoft.com" <Marksv(a)microsoft.com>, "sdelbiancoATnetchoice.org" <sdelbianco(a)netchoice.org>, Margie Milam <margiemilam(a)fb.com>, "'kurt(a)kjpritz.com'" <kurt(a)kjpritz.com>, "marika.konings(a)icann.org" <marika.konings(a)icann.org>, "rafik.dammak(a)gmail.com" <rafik.dammak(a)gmail.com> Subject: RE: [council] FW: [Gnso-epdp-team] FYI Motion For EPDP Final Report Approval Hi all, Thanks for forwarding this note from the BC’s EPDP WG reps. I’ll be happy to provide some additional context and guidance, both for Councilors and for the members of the EPDP WG. I’m copying Kurt, Rafik and Marika, so this can be forwarded to the EPDP WG list. 1. During the EPDP WG Chartering process, the GNSO Council drafting team made clear there would need to be two distinct phases of the work of the EPDP, each with its own Initial Report and Final Report. Phase One would focus on the Temporary Specification with an imposed 12-month deadline of May 25, 2019 due to the Board’s decision to invoke the Temp Spec. Phase Two would focus on the System for Standardized Access to Non-Public Registration Data after the gating questions from Phase One were addressed and the GNSO Council agreed. Here is the Charter language specifying the Objectives and timing: “To develop, at a minimum, an Initial Report and a Final Report regarding the EPDP Team’s recommendations on issues relating to the Temporary Specification for gTLD Registration Data as well as regarding the EPDP Team’s recommendations for a System for Accredited Access to Non-Public Registration Data, pursuant to the processes described in Annex A and A-1 of the ICANN Bylaws and the GNSO Expedited PDP Manual. Work on recommendations for a System for Accredited Access to Non-Public Registration Data should not commence until all gating questions have been answered. Similarly, delivery of the Final Report on the EPDP Team’s recommendations on issues relating to the Temporary Specification for gTLD Registration Data to the GNSO Council and subsequently the ICANN Board (before 25 May 2019) should not be held up by work that may still be ongoing in relation to the EPDP Team’s recommendations for a System for Accredited Access to Non-Public Registration Data.” 1. The Phase One Initial Report was delivered on 21 November and public comments were received, analyzed and incorporated. During the chartering process, the GNSO Council drafting team agreed, after much negotiation, to consider initiating the Phase Two work after the publication of the Phase One Initial Report, rather than after the Phase One Final Report, with the hope/expectation that the gating questions would have been sufficiently answered and the foundation for Phase Two would have been established. Unfortunately, as we all know, the Phase One Initial Report was not sufficiently complete, the gating questions were not yet addressed, and much more work was required before Phase Two could begin. Fortunately, with the current Phase One Final Report nearly complete, the EPDP will be able to begin work on Phase Two in short order. 1. As everyone should have seen in my email to the Council list last night (responding to Rafik’s note submitting the draft Final Report and Council Motion), our proposed motion will approve the Phase One Final Report and Consensus Policy recommendations AND signal the Council’s agreement (through non-objection) that the Phase Two work can begin. This is a significant moment where the EPDP WG is recommending a Consensus Policy replacement to the Temp Spec to be confirmed by Council and ICANN Board, it has substantially answered the gating questions, and it also agreed to defer certain issues to Phase Two. This is the definition of bottom-up consensus policy-making, and the GNSO Council looks forward to approving the Phase One Final Report, delivering it to the Board, and to supporting the EPDP WG in its Phase Two work on a System for Standardized Access to Non-Public Registration Data, or Uniform Access Model. To summarize: * The EPDP WG was chartered to have two distinct phases, one on the Temp Spec, the other on a System for Standardized Access to Non-Public Registration Data and the Annex to the Temporary Specification (Important Issues for Further Community Action). * The current report is the Final Report from Phase One. * The GNSO Council is expected to approve the Phase One Final Report replacing the Temp Spec AND authorize the EPDP WG to move to Phase Two. * Following GNSO PDP operating procedures and the ICANN bylaws, the EPDP WG recommendations to replace the Temp Spec will need to be approved by GNSO Council and the ICANN Board to ensure they are Consensus Policies and enforceable by ICANN Org. * The EPDP Charter is clear that the work on the System for Standardized Access is the next critical phase and it will receive the full support of the GNSO Council and ICANN Org. * Without Council approval of the Phase One Final Report, and without a new Consensus Policy to replace the Temp Spec before May 25, 2019, there will be no work on Phase Two. I hope this helps provide clarity around the views and intent of the GNSO Council as we initiated this important work and our expectations for the coming weeks. I appreciate the opportunity to review and reflect on the Charter and the work of the EPDP and I’m impressed by the group’s output in a very compressed timeframe. Please let me know if anyone has follow up questions. Otherwise, we’ll look forward to considering the EPDP WG Phase One Final Report during our 21 February and/or 4 March GNSO Council meetings. Regards, Keith Drazek, GNSO Chair From: council <council-bounces(a)gnso.icann.org> On Behalf Of Marie Pattullo Sent: Tuesday, February 12, 2019 12:36 PM To: council(a)gnso.icann.org Cc: Mark Svancarek (CELA) <marksv(a)microsoft.com>; Steve DelBianco <sdelbianco(a)netchoice.org>; Margie Milam <margiemilam(a)fb.com> Subject: [EXTERNAL] [council] FW: [Gnso-epdp-team] FYI Motion For EPDP Final Report Approval Importance: High Dear all, I’ve been asked to send the below message to you from Margie, on behalf of the BC’s EPDP participants. I’m copying them here for ease. We’d appreciate your thoughts. Thanks Marie Hi – Thank you for sharing this note. I am genuinely confused about the directions given to the GNSO Council since this report – although it is misnamed a “Final Report” is really only an “Phase 1 Interim Report” since the PDP has not concluded, and the charter questions have not been answered. As a result, is seems that the voting thresholds to create a consensus policy and the vote required under the Bylaws do not yet apply until the Phase 2 work is complete. I understand the desire to call this a Final Report, but there is a significant amount of work that has not been done yet, as outlined in the draft report being circulated, with key areas missing, such as: …the EPDP Team is, at a minimum, expected to consider the following elements of the Temporary Specification and answer the following charter questions. (p.3, Mission and Scope, emphasis added) This passage sets forth the minimum requirements necessary for successful completion of the EPDP. However, one set of questions (see p.7 of the charter) -- dealing with access to non-public registration data -- is entirely unaddressed by the EPDP team. Further, according to the charter: System for Standardized Access to Non-Public Registration Data Work on this topic shall begin once the gating questions above have been answered and finalized in preparation for the Temporary Specification initial report. (p.7, emphasis added) The initial Phase 1 report was published in November 2018, with the “gating questions” (Parts 2(b), 2(c) and 2(f)) sufficiently addressed (see EPDP initial report<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_sites_d…>). Per the charter, work on an access model should have begun late last year. Instead this work has been deferred to Phase 2 of the team’s work. What is unclear is when the EPDP team will take up its remaining responsibilities under the charter and produce an actual “final” report (not merely a report on the conclusion of Phase 1), inclusive of Phases 1 and 2. Additionally, Section 2(j) of the charter addresses “Reasonable Access.” In what is labeled the draft final report<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…>, the charter’s section 2(j) questions are only partially answered, and included is a recommendation that the rest of the details be worked out in the implementation phase. Again, the EPDP team’s work is not yet finished, and it is premature to consider the current “consensus calls” instructive since this is an incomplete report, and true consensus can only truly be determined when the entire package (Phase 1 and Phase 2) of recommendations is developed. As a result, the report should be renamed, and the Council’s instructions should be updated accordingly. All the best, Margie From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Rafik Dammak <rafik.dammak(a)gmail.com<mailto:rafik.dammak@gmail.com>> Date: Tuesday, February 12, 2019 at 3:43 AM To: "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] FYI Motion For EPDP Final Report Approval hi all, Please find below the email sent to GNSO council to submit the motion for council consideration to approve the final report. You can find the latest version of the report posted in word and redline version on the wiki space https://community.icann.org/display/EOTSFGRD/g.+Draft+Final+Report<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…>. Best Regards, Rafik ---------- Forwarded message --------- From: Rafik Dammak <rafik.dammak(a)gmail.com<mailto:rafik.dammak@gmail.com>> Date: mar. 12 févr. 2019 à 08:10 Subject: Motion For EPDP Final Report Approval To: Council GNSO <council(a)gnso.icann.org<mailto:council@gnso.icann.org>> Hi all, I am glad to submit today the motion for the approval of EPDP Final Report Please find attached the motion and the draft final report. That version of the report is being currently reviewed by EPDP team members during this week - "quiet time". You will find below a cover letter from the EPDP leadership team giving more details in that regard. The motion may need to be amended in due time to be in line with the level of support for the recommendations in the Final Report. Best Regards, Rafik Dammak ------------------------------------------------------------------------------------------------- Dear Councillors: We are pleased to present this Draft Final EPDP Report Final Report of the Temporary Specification for gTLD Registration Data. The purpose in sending this draft Final Report is so that you can become acquainted with its layout and contents in advance of the release of the Final Report, expected on 20 February. It is hoped that this early release will facilitate your review of the final document. The EPDP Team is grateful to have two additional weeks for its deliberations.We are using the first week as a sort of “quiet period” to review the draft Final Report and have scheduled meetings for next week to reach conclusions on open issues. So we expect so substantive and non-substantive amendments to the report. With regard to the level of consensus, the report indicates those items where: · The Chair has indicated a consensus level and the EPDP Team has had the opportunity to review and comment on that designation · The Chair has indicated a level of Consensus and the EPDP Team has not yet had the opportunity to review and comment on that designation · The Chair has not made a designation yet because the issue is still open for some discussion. In many (nearly all) of the open recommendations, we are very close to final language but we have attempted to be conservative in the consensus designation and so have left some of these recommendations with no designation as of yet. The language you are reading in this report is close to final. Sections that still remain open are designated with brackets. The next steps for those sections are highlighted in yellow. We will also conduct a final Consensus call on the entire document when the report is final to identify any issues raised by the interplay between the Recommendations. Finally, and there will be more about this when the final report is delivered, this work product represents a significant sacrifice in time and effort by the working group members and, more significantly, a willingness by them to collaborate, cooperate, and compromise for our common goals. Best regards, EPDP Leadership Team

2 1

PLEASE SHARE: ICANN64 Prep Week Announcement
by Terri Agnew Feb. 14, 2019

Feb. 14, 2019

Hello all, Please find below the announcement of the "ICANN64 Prep Week" published on the ICANN website which includes the link to register for Pre-ICANN64 Policy Update Webinar as well as other webinars in the week. https://www.icann.org/news/announcement-2019-02-14-en [icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_news_ann…> Kind regards, Terri ICANN64 Prep Week ICANN org is piloting a new initiative called Prep Week to consolidate all pre-ICANN Public Meeting webinars into one week. Starting with ICANN64, Prep Week will streamline the pre-meeting experience, so deeper conversations can be had in the ICANN meeting sessions. There are four webinars scheduled for ICANN64 Prep Week. The org will present updates on the community's work. Wednesday, 27 February 16:00 UTC | Multistakeholder Strategy and Strategic Initiatives (MSSI) Webinar. Topics include: * General Data Protection Regulation (GDPR) * ICANN Strategic Plan for Fiscal Years 2021-2025 * The latest update and progress on various ICANN Reviews * The next steps on WorkStream 2 recommendations Wednesday, 27 February 23:00 UTC | Contractual Compliance Update Webinar. Topics include updates on: * Registrar compliance * Registry compliance * The Registry Contractual Compliance Audit underway Thursday, 28 February 16:00 UTC | Policy Update Webinar. Topics include updates on activities of various Supporting Organizations and Advisory Committees. Thursday, 28 February 23:00 UTC | Finance/Operating Plan and Budget Planning Webinar. Topics include: * Key dates in the ICANN Planning process and cycle * An overview of the ICANN64 Finance/Planning Session Please register and submit any questions via this form [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_forms_…> by Friday, 22 February 2019. The webinars will be in English. Recordings and materials will be posted here<https://meetings.icann.org/en/kobe64-prep-week>. With this new initiative, we not only hope to improve community preparation, but also to increase awareness of cross-community and high-interest topics and enhance briefings and readout sessions.

1 0

Consensus Call - Bundle #3
by Kurt Pritz Feb. 13, 2019

Feb. 13, 2019

Hi Everyone: I have attached Bundle 3 of the consensus designations. As some items are still in discussion or newly minted, I have held off assigning a designation to those. To make it clear, I have created two separate tables (3A and 3B). I have taken a conservative approach in holding back a final designation where we have not received feedback on final wording. However, I do think we have agreement on nearly all of these and look forward to closing them out by the end of this week. Please comment on Table 3A by the end of this week if you disagree or wish to discuss the level of consensus indicated. Please use Table 3B to consider your response so that we can request a rapid turnaround on that table when it is issued. Please read the introduction to the document for a more complete explanation. Please let me know if you have questions or need for further explanation. As always, thank you and best regards, Kurt

3 4

Consensus call #2
by Thomas Rickert Feb. 13, 2019

Feb. 13, 2019

Dear Kurt, all, for the record, I am happy to confirm the ISPCP’s support for the second batch of the consensus call. As mentioned for the first batch, this is conditional to the wording remaining unaltered. In case there are changes, Fiona and would need to take the new language back to the ISPCP. I also add - again - a caveat for the last recommendation on "consent to publish additional information“, which I shared on the list earlier: Let me just to on the record (again) that - whilst I do support that an opportunity for consent must be given at some point - we need to make sure this is done in a compliant fashion. As state previously, I do not think we have the technical and organizational means in place so that the controller(s) can demonstrate that the consent (and the contents thereof) have been given, see Art. 7 I GDPR. This is not impossible to do, but I think the gTLD ecosystem is not yet ready for handling consent and make it travel with the registration data to all players. I think some in our team think that we are operationally and legally ready to do that in a compliant fashion, in which case we should probably link to related documentation or write a few lines on how this can be done. In sum, I do not think it is just a matter of commercial factors. All the best, Thomas

1 0

Issues with the report
by Alan Greenberg Feb. 13, 2019

Feb. 13, 2019

There are several issues with the report that are either incorrect, or I do not know how the decisions were made (and several others also do not know). - Rec #8 implies (but does not clearly say) that offering Tech Contacts is an option for registrars. In the interim report, we raised the question of whether "optional" for the Tech fields meant optional for the registrant, or optional for the registrar. I cannot recall ever discussing this when we went over the comments, but somehow it is now optional for registrars, requiring registrants to shop around for a registrar that accepts the option - if indeed any registrars will! When was this decided? - Rec #16 takes geographic differentiation off the table. My recollection is that we put that decision into Phase 2. When was this decision taken? - Rec #18 does not make sense to me. It says that Temp Spec sections 4.1 and 4.2 are to be replaced "upon expiration". What is the purpose of replacing these sections once the Temp Spec is no longer operative? And how does that affect access? I note that Rec #28 temporarily reinstates the Temp Spec, but the version PRIOR to expiration. - Rec #29 requires explicit action from registrars before the Admin fields can be eliminated. Either we need to explicitly say that this action must be taken prior to 29 February 2020, or we need to include them in Rec #5 listing all RDDS fields flagging them as being there only until the Rec #29 action is taken. On a less substantive level: - We say the Tech name and contact fields are option, but in the various tables, the are not flagged with a trailing (opt.) like the other optional fields are. - In Rec #8, why are Tech name and contacts transmitted by registries to escrow but not by registrars (as currently required by the RAA)? - Rec #13 makes a reference to "Recommendation X". I presume this should be Rec #6. - Rec #21 makes reference to Thick and Thin registries, a concept that we are told no longer exists. The first issues have a direct bearing on whether the ALAC can support this report and I would appreciate a quick reply. Alan

2 1

FW: [Ext] RE: [council] FW: FYI Motion For EPDP Final Report Approval
by Marika Konings Feb. 12, 2019

Feb. 12, 2019

For your information, please find below a response from Keith Drazek, GNSO Chair, to the questions that Margie raised on the list earlier today. Best regards, Caitlin, Berry and Marika From: "Drazek, Keith" <kdrazek(a)verisign.com> Date: Tuesday, February 12, 2019 at 14:07 To: "marie.pattullo(a)aim.be" <marie.pattullo(a)aim.be>, "council(a)gnso.icann.org" <council(a)gnso.icann.org> Cc: "marksv(a)microsoft.com" <marksv(a)microsoft.com>, "sdelbianco(a)netchoice.org" <sdelbianco(a)netchoice.org>, Margie Milam <margiemilam(a)fb.com>, "'kurt(a)kjpritz.com'" <kurt(a)kjpritz.com>, Marika Konings <marika.konings(a)icann.org>, "rafik.dammak(a)gmail.com" <rafik.dammak(a)gmail.com> Subject: [Ext] RE: [council] FW: [Gnso-epdp-team] FYI Motion For EPDP Final Report Approval Hi all, Thanks for forwarding this note from the BC’s EPDP WG reps. I’ll be happy to provide some additional context and guidance, both for Councilors and for the members of the EPDP WG. I’m copying Kurt, Rafik and Marika, so this can be forwarded to the EPDP WG list. 1. During the EPDP WG Chartering process, the GNSO Council drafting team made clear there would need to be two distinct phases of the work of the EPDP, each with its own Initial Report and Final Report. Phase One would focus on the Temporary Specification with an imposed 12-month deadline of May 25, 2019 due to the Board’s decision to invoke the Temp Spec. Phase Two would focus on the System for Standardized Access to Non-Public Registration Data after the gating questions from Phase One were addressed and the GNSO Council agreed. Here is the Charter language specifying the Objectives and timing: “To develop, at a minimum, an Initial Report and a Final Report regarding the EPDP Team’s recommendations on issues relating to the Temporary Specification for gTLD Registration Data as well as regarding the EPDP Team’s recommendations for a System for Accredited Access to Non-Public Registration Data, pursuant to the processes described in Annex A and A-1 of the ICANN Bylaws and the GNSO Expedited PDP Manual. Work on recommendations for a System for Accredited Access to Non-Public Registration Data should not commence until all gating questions have been answered. Similarly, delivery of the Final Report on the EPDP Team’s recommendations on issues relating to the Temporary Specification for gTLD Registration Data to the GNSO Council and subsequently the ICANN Board (before 25 May 2019) should not be held up by work that may still be ongoing in relation to the EPDP Team’s recommendations for a System for Accredited Access to Non-Public Registration Data.” 1. The Phase One Initial Report was delivered on 21 November and public comments were received, analyzed and incorporated. During the chartering process, the GNSO Council drafting team agreed, after much negotiation, to consider initiating the Phase Two work after the publication of the Phase One Initial Report, rather than after the Phase One Final Report, with the hope/expectation that the gating questions would have been sufficiently answered and the foundation for Phase Two would have been established. Unfortunately, as we all know, the Phase One Initial Report was not sufficiently complete, the gating questions were not yet addressed, and much more work was required before Phase Two could begin. Fortunately, with the current Phase One Final Report nearly complete, the EPDP will be able to begin work on Phase Two in short order. 1. As everyone should have seen in my email to the Council list last night (responding to Rafik’s note submitting the draft Final Report and Council Motion), our proposed motion will approve the Phase One Final Report and Consensus Policy recommendations AND signal the Council’s agreement (through non-objection) that the Phase Two work can begin. This is a significant moment where the EPDP WG is recommending a Consensus Policy replacement to the Temp Spec to be confirmed by Council and ICANN Board, it has substantially answered the gating questions, and it also agreed to defer certain issues to Phase Two. This is the definition of bottom-up consensus policy-making, and the GNSO Council looks forward to approving the Phase One Final Report, delivering it to the Board, and to supporting the EPDP WG in its Phase Two work on a System for Standardized Access to Non-Public Registration Data, or Uniform Access Model. To summarize: * The EPDP WG was chartered to have two distinct phases, one on the Temp Spec, the other on a System for Standardized Access to Non-Public Registration Data and the Annex to the Temporary Specification (Important Issues for Further Community Action). * The current report is the Final Report from Phase One. * The GNSO Council is expected to approve the Phase One Final Report replacing the Temp Spec AND authorize the EPDP WG to move to Phase Two. * Following GNSO PDP operating procedures and the ICANN bylaws, the EPDP WG recommendations to replace the Temp Spec will need to be approved by GNSO Council and the ICANN Board to ensure they are Consensus Policies and enforceable by ICANN Org. * The EPDP Charter is clear that the work on the System for Standardized Access is the next critical phase and it will receive the full support of the GNSO Council and ICANN Org. * Without Council approval of the Phase One Final Report, and without a new Consensus Policy to replace the Temp Spec before May 25, 2019, there will be no work on Phase Two. I hope this helps provide clarity around the views and intent of the GNSO Council as we initiated this important work and our expectations for the coming weeks. I appreciate the opportunity to review and reflect on the Charter and the work of the EPDP and I’m impressed by the group’s output in a very compressed timeframe. Please let me know if anyone has follow up questions. Otherwise, we’ll look forward to considering the EPDP WG Phase One Final Report during our 21 February and/or 4 March GNSO Council meetings. Regards, Keith Drazek, GNSO Chair From: council <council-bounces(a)gnso.icann.org> On Behalf Of Marie Pattullo Sent: Tuesday, February 12, 2019 12:36 PM To: council(a)gnso.icann.org Cc: Mark Svancarek (CELA) <marksv(a)microsoft.com>; Steve DelBianco <sdelbianco(a)netchoice.org>; Margie Milam <margiemilam(a)fb.com> Subject: [EXTERNAL] [council] FW: [Gnso-epdp-team] FYI Motion For EPDP Final Report Approval Importance: High Dear all, I’ve been asked to send the below message to you from Margie, on behalf of the BC’s EPDP participants. I’m copying them here for ease. We’d appreciate your thoughts. Thanks Marie Hi – Thank you for sharing this note. I am genuinely confused about the directions given to the GNSO Council since this report – although it is misnamed a “Final Report” is really only an “Phase 1 Interim Report” since the PDP has not concluded, and the charter questions have not been answered. As a result, is seems that the voting thresholds to create a consensus policy and the vote required under the Bylaws do not yet apply until the Phase 2 work is complete. I understand the desire to call this a Final Report, but there is a significant amount of work that has not been done yet, as outlined in the draft report being circulated, with key areas missing, such as: …the EPDP Team is, at a minimum, expected to consider the following elements of the Temporary Specification and answer the following charter questions. (p.3, Mission and Scope, emphasis added) This passage sets forth the minimum requirements necessary for successful completion of the EPDP. However, one set of questions (see p.7 of the charter) -- dealing with access to non-public registration data -- is entirely unaddressed by the EPDP team. Further, according to the charter: System for Standardized Access to Non-Public Registration Data Work on this topic shall begin once the gating questions above have been answered and finalized in preparation for the Temporary Specification initial report. (p.7, emphasis added) The initial Phase 1 report was published in November 2018, with the “gating questions” (Parts 2(b), 2(c) and 2(f)) sufficiently addressed (see EPDP initial report<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_sites_d…>). Per the charter, work on an access model should have begun late last year. Instead this work has been deferred to Phase 2 of the team’s work. What is unclear is when the EPDP team will take up its remaining responsibilities under the charter and produce an actual “final” report (not merely a report on the conclusion of Phase 1), inclusive of Phases 1 and 2. Additionally, Section 2(j) of the charter addresses “Reasonable Access.” In what is labeled the draft final report<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…>, the charter’s section 2(j) questions are only partially answered, and included is a recommendation that the rest of the details be worked out in the implementation phase. Again, the EPDP team’s work is not yet finished, and it is premature to consider the current “consensus calls” instructive since this is an incomplete report, and true consensus can only truly be determined when the entire package (Phase 1 and Phase 2) of recommendations is developed. As a result, the report should be renamed, and the Council’s instructions should be updated accordingly. All the best, Margie From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Rafik Dammak <rafik.dammak(a)gmail.com<mailto:rafik.dammak@gmail.com>> Date: Tuesday, February 12, 2019 at 3:43 AM To: "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] FYI Motion For EPDP Final Report Approval hi all, Please find below the email sent to GNSO council to submit the motion for council consideration to approve the final report. You can find the latest version of the report posted in word and redline version on the wiki space https://community.icann.org/display/EOTSFGRD/g.+Draft+Final+Report<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…>. Best Regards, Rafik ---------- Forwarded message --------- From: Rafik Dammak <rafik.dammak(a)gmail.com<mailto:rafik.dammak@gmail.com>> Date: mar. 12 févr. 2019 à 08:10 Subject: Motion For EPDP Final Report Approval To: Council GNSO <council(a)gnso.icann.org<mailto:council@gnso.icann.org>> Hi all, I am glad to submit today the motion for the approval of EPDP Final Report Please find attached the motion and the draft final report. That version of the report is being currently reviewed by EPDP team members during this week - "quiet time". You will find below a cover letter from the EPDP leadership team giving more details in that regard. The motion may need to be amended in due time to be in line with the level of support for the recommendations in the Final Report. Best Regards, Rafik Dammak ------------------------------------------------------------------------------------------------- Dear Councillors: We are pleased to present this Draft Final EPDP Report Final Report of the Temporary Specification for gTLD Registration Data. The purpose in sending this draft Final Report is so that you can become acquainted with its layout and contents in advance of the release of the Final Report, expected on 20 February. It is hoped that this early release will facilitate your review of the final document. The EPDP Team is grateful to have two additional weeks for its deliberations.We are using the first week as a sort of “quiet period” to review the draft Final Report and have scheduled meetings for next week to reach conclusions on open issues. So we expect so substantive and non-substantive amendments to the report. With regard to the level of consensus, the report indicates those items where: · The Chair has indicated a consensus level and the EPDP Team has had the opportunity to review and comment on that designation · The Chair has indicated a level of Consensus and the EPDP Team has not yet had the opportunity to review and comment on that designation · The Chair has not made a designation yet because the issue is still open for some discussion. In many (nearly all) of the open recommendations, we are very close to final language but we have attempted to be conservative in the consensus designation and so have left some of these recommendations with no designation as of yet. The language you are reading in this report is close to final. Sections that still remain open are designated with brackets. The next steps for those sections are highlighted in yellow. We will also conduct a final Consensus call on the entire document when the report is final to identify any issues raised by the interplay between the Recommendations. Finally, and there will be more about this when the final report is delivered, this work product represents a significant sacrifice in time and effort by the working group members and, more significantly, a willingness by them to collaborate, cooperate, and compromise for our common goals. Best regards, EPDP Leadership Team

1 0