February 2019 - Gnso-epdp-team

FYI Motion For EPDP Final Report Approval
by Rafik Dammak Feb. 12, 2019

Feb. 12, 2019

hi all, Please find below the email sent to GNSO council to submit the motion for council consideration to approve the final report. You can find the latest version of the report posted in word and redline version on the wiki space https://community.icann.org/display/EOTSFGRD/g.+Draft+Final+Report. Best Regards, Rafik ---------- Forwarded message --------- From: Rafik Dammak <rafik.dammak(a)gmail.com> Date: mar. 12 févr. 2019 à 08:10 Subject: Motion For EPDP Final Report Approval To: Council GNSO <council(a)gnso.icann.org> Hi all, I am glad to submit today the motion for the approval of EPDP Final Report Please find attached the motion and the draft final report. That version of the report is being currently reviewed by EPDP team members during this week - "quiet time". You will find below a cover letter from the EPDP leadership team giving more details in that regard. The motion may need to be amended in due time to be in line with the level of support for the recommendations in the Final Report. Best Regards, Rafik Dammak ------------------------------------------------------------------------------------------------- Dear Councillors: We are pleased to present this Draft Final EPDP Report Final Report of the Temporary Specification for gTLD Registration Data. The purpose in sending this draft Final Report is so that you can become acquainted with its layout and contents in advance of the release of the Final Report, expected on 20 February. It is hoped that this early release will facilitate your review of the final document. The EPDP Team is grateful to have two additional weeks for its deliberations.We are using the first week as a sort of “quiet period” to review the draft Final Report and have scheduled meetings for next week to reach conclusions on open issues. So we expect so substantive and non-substantive amendments to the report. With regard to the level of consensus, the report indicates those items where: - The Chair has indicated a consensus level and the EPDP Team has had the opportunity to review and comment on that designation - The Chair has indicated a level of Consensus and the EPDP Team has not yet had the opportunity to review and comment on that designation - The Chair has not made a designation yet because the issue is still open for some discussion. In many (nearly all) of the open recommendations, we are very close to final language but we have attempted to be conservative in the consensus designation and so have left some of these recommendations with no designation as of yet. The language you are reading in this report is close to final. Sections that still remain open are designated with brackets. The next steps for those sections are highlighted in yellow. We will also conduct a final Consensus call on the entire document when the report is final to identify any issues raised by the interplay between the Recommendations. Finally, and there will be more about this when the final report is delivered, this work product represents a significant sacrifice in time and effort by the working group members and, more significantly, a willingness by them to collaborate, cooperate, and compromise for our common goals. Best regards, EPDP Leadership Team

3 2

Fwd: Rec. relating Effective date
by Kurt Pritz Feb. 12, 2019

Feb. 12, 2019

Reading this - I think Kavouss’ second suggestion makes sense. Kurt > Begin forwarded message: > > From: Arasteh <kavouss.arasteh(a)gmail.com> > Subject: Rec. relating Effective date > Date: February 11, 2019 at 10:25:53 PM PST > To: Kurt Pritz <kurt(a)kjpritz.com> > > Dear Kurt > Yesterday you forcefully defended Ashley , point who was absent > But you did nit support my proposals in two area > 1. The last sentence of the big para . > I suggested 5 time to add at the beginning g the following, > Should registries and registrars, under certains circumstance continue the expired Temp Spec..... > 2. Delete informally and leave it to GNSO /ICANN to take appropriate action as it is not up to Team to decide in their behalf > In both cases I had support > Pls then implement those in final version > I expect to test equally everybody > Regards > Kavouss > > > Sent from my iPhone

1 0

Recordings, Attendance & AC Chat / GNSO Temp Spec gTLD RD EPDP / Monday, 11 February 2019
by Andrea Glandon Feb. 12, 2019

Feb. 12, 2019

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Monday, 11 February 2019 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/TJ0WBg MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-11feb19… AC Recording: https://participate.icann.org/p71sv86k16l/<https://participate.icann.org/p71sv86k16l/?OWASP_CSRFTOKEN=0b487d148c1a4460…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

List of closed vs outstanding items
by Anderson, Marc Feb. 11, 2019

Feb. 11, 2019

Kurt and team, First off apologies if this has already been sent or if I'm missing something obvious from the working group wiki, but I'm looking for a list of the items/recommendations that are considered closed and which ones are considered outstanding. I expect that the purposes from the Batch 1 consensus call and the recommendations from the Batch 2 consensus call are the closed items while everything else is outstanding and will be covered in a batch 3. If there is a consolidated list somewhere, that would be very helpful. Also, should we be working off the 8 February draft of the final report for the latest version of language for each recommendation? I expect we may see some changes as a result of today's discussion so how and where will those changes be tracked? Thank you, Marc Marc Anderson mcanderson(a)verisign.com<mailto:mcanderson@verisign.com> Cell: 571.521.9943 Office: 703.948.3404 12061 Bluemont Way, Reston, VA 20190 Verisign.com<http://www.verisign.com/>

3 2

Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 19 February 2019 at 14:00 UTC
by Andrea Glandon Feb. 11, 2019

Feb. 11, 2019

Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/EYU2Bg Thank you. Kind Regards, Andrea

1 0

For your review: updated Rec. 15 (data retention)
by Caitlin Tubergen Feb. 11, 2019

Feb. 11, 2019

Dear EPDP Team: Please find updated language for Recommendation 15 attached for your review. The edits, which come today’s EPDP meeting, appear in bold. Please note the attached language will be included in the pro forma version of the Final Report, which will be sent the GNSO Council today. The language, however, will be flagged as still open. Accordingly, if you believe this language does not accurately reflect today’s discussion, please note the issue and proposed edits over the list. Best regards, Marika, Berry, and Caitlin

1 0

Notes, action items - EPDP Meeting #45
by Caitlin Tubergen Feb. 11, 2019

Feb. 11, 2019

Dear All, Please find the notes and action items from today’s EPDP Meeting #45 below. Best regards, Marika, Berry, and Caitlin EPDP Meeting #45 11 February 2019 High-level Notes/Actions Support Staff to retain the CPH originally-proposed language for Recommendation 28 (the implementation bridge) into the Final Report. Any groups who wish to propose edits are asked to do so over the list during the quiet period, i.e., as soon as today and no later than Friday, 15 February. Support Staff to revert Recommendation 18 (reasonable requests for lawful disclosure) back to its previously-agreed form, i.e., delete proposal from Thomas, remove Ashley’s edits for the reasons described during the discussion. Any groups who wish to propose edits are asked to do so over the list during the quiet period, i.e., as soon as today and no later than Friday, 15 February. Support Staff to circulate updated text for Recommendation 15 (data retention) based on today’s discussion. EPDP Team to review the update Data Elements Workbook (Annex D) and flag any issues during the quiet period, i.e., no later than Friday, 15 February. During the quiet period, groups should flag any inconsistencies or errors in the Final Report. Please refrain from opening previously-closed issues. Notes These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/ZwPVBQ . 1. Roll Call & SOI Updates Attendance will be taken from Adobe Connect Remember to mute your microphones when not speaking and state your name before speaking for transcription purposes. Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) a. Review of outstanding action items b. Other updates, if applicable A version of the Final Report was sent to the Team on Friday. If any edits are needed due to today's meeting, the edits will be applied. The updated version will be sent to the Council for instructive purposes. EPDP Leadership will be presenting the Final Report during Thursday's Council meeting. Kurt will distribute the third consensus bundle following today's call. 3. Implementation Bridge – Recommendation #28 (30 minutes) a. Review proposed language for inclusion in the Final Report: The date of February 29, 2020 has been added. Also, the language allows implementation to begin as soon as possible. Team Feedback: Why are there no compliance penalties? Why is the term informally inserted before convened? This should be deleted. Interpretation: if the CP is not following the new policy, it must be following the Temp Spec. The flexibility of the language allows for an informal group to convene before Board consideration. Until 29 Feb, CP may operate under the new policy or under the Temp Spec. As long as the contracted party is operating under the one of those regimes, the contracted party will not be subject to compliance penalties. In the second paragraph, "will not be" should be changed to "may not be". The language is not meant to show preference to either regime. Perhaps the word expired should be inserted before Temp Spec. What does it mean to informally convene the IRT? The word "informally" was inserted to allow for earlier implementation. Rather than "shall be" it should be "shall be no later than". We should not refer to an expired policy in a policy recommendation. We should say "should not be subject to compliance penalties". The policy recommendations need to be translated into policy language, and that takes time, which is why there is a period for implementation. The language was the result of compromise, and any changes or additions will need to taken back to the list. The preference should be for the contracted parties to follow the policy, not the Temp Spec. The burden of why a contracted party cannot follow the new policy should be on them to provide. The standard practice is for contracted parties to apply status quo until the policy effective date, following the implementation of the policy. This language allows for contracted parties to adopt the new policy recommendations sooner. To require justification on the contracted parties, that would trigger a new procedure and accompanying burden and would likely not be accepted by the contracted parties. The goal is to move more quickly through defined processes for the benefit of contracted parties and the community. b. Discuss proposed language for inclusion in the Final Report c. Confirmation of agreement reached or next steps to come to agreement 4. Recommendation #18 (old #12) - Reasonable Access (30 minutes) a. Consider how to address applicability of the criteria in the body of the report – Thomas to suggest language? The idea of the updated language (in bold) is to add color to the previous sentence re: LEA disclosure. It notes the team did not have enough time to review language for LEA requests. The language notes the above recommendation does not apply to LEA requests. The language does not exclude LEA requests but does not limit LEA requirements either. The language also clarifies where we are in the process, i.e., that more work needs to be done. Is the updated language compatible with concerns previously raised on the list? Yes, the updated language addresses the concerns addressed. LEAs should not be putting their eggs in the Rec. 18 basket. The language was not intended to put law enforcement in a worse position, so the updated text goes a long way in clarifying that. Why are we inserting this language here when we will grapple with these issues in Phase 2. The language could be misinterpreted. The insertion of this language is, therefore, unnecessary. When we talk about different criteria and processes, are we discussing within the WHOIS policy or outside of it? This language should be deleted. Change to reasonable requests for lawful disclosure, and the "reasonable request" language is described more below. Action: revert the wording back to "reasonable requests for lawful disclosure" - delete the quote at the end. Revert the language back the way it was and groups can note their disagreement (if any) during the quiet period. b. Confirmation of agreement reached or next steps to come to agreement 5. Recommendation #15 (old #11) – Data Retention (30 minutes) a. Review revised language circulated to the mailing list The language to this recommendation was agreed with the following exceptions: paragraph 1 was edited per Marc A's proposed rewording. Also, Marc A. noted the language in para 3 was slightly confusing, so leadership and the support team attempted to clarify the language. The EPDP team should not invite community members. Paragraph 1 is clearer now that additional information will be gathered to inform Phase 2. Re: para 2 - it's unclear what contractual language is maintained and what is not. Re: para 3 - the new language recognizes that there is an existing waiver process and that it should be looked at. The language is trending in the right direction, but registrars should weigh in on para. 2. Thought the group decided on a general retention period of one year - not just for the TDRP. In essence, para. 2 is fine, but the point about the period may need to be longer than one year to get over the hiatus in the TDRP, for example. Possibly an 18-month period could resolve the issue Alan G. has raised. The recommendation in para. 3 that the waiver procedure applies to period less than ICANN requirements and not that is more. Consider adding a footnote about the TDRP. In the first bullet point: it should say different retention periods. For second paragraph - 1 year period beyond the registration based on the TDRP, and another six months to implement the deletion. The reference to "shorter periods" needs more clarification. The Team could consider adding a footnote about the details being worked out in Phase 2. Action: change period to 18 months (insert Thomas' language) 2 changes: 1. 18 months. 2. in para 1, change different retention purposes to different retention periods. 3. add footnote about phase 2 Action: Support Staff to circulate revised language following this call. b. Discuss revised language c. Confirmation of agreement reached or next steps to come to agreement 6. Data Elements Workbooks (30 minutes) a. Status Update Thank you to Berry for all of the work involved in this. When we are looking at the data elements, we are looking at it per purpose. Significant work to document the purposes across data elements and it make it more user-friendly. The Team must now review the tables for understanding and accuracy. b. Further updates expected in relation to Final Report c. Questions / Comments? 7. Next Steps (10 minutes) Silent review should be used for pointing out errors or inconsistencies Draft report will be forwarded to the GNSO Council and will be discussed during the Council Based on flagged issues, the Team may hold meeting next week (placeholder invites have already been sent out). Report will be sent on 20 Feb to Council. Question: what words will be used when full consensus is not designated? Deadline for feedback on the Final Report is EOD Friday, 15 February. 8. Wrap and confirm next meeting to be scheduled for Tuesday, 19 February 2019 at 14.00 UTC (5 minutes) a. Confirm action items b. Confirm questions for ICANN Org, if any

1 0

Re: [Gnso-epdp-team] For your review: updated recommendations 10, 11, 12
by Alan Greenberg Feb. 11, 2019

Feb. 11, 2019

I agree. We do not yet fully understand the process for non-EU LEA access to data and Process 2 had no such limitations. Alan At 07/02/2019 03:52 PM, Heineman, Ashley wrote: Thanks for this and hello colleagues, After further reflection on today’s discussion of Recommendation 12 and the new text proposed by Thomas, I believe this language should be deleted. Specifically �� “These criteria are applicable to disclosure requests relating to civil claims. LEA requests will be handled according to applicable laws.” While I am extremely pleased with the state of the Recommendation overall, this new insertion has not been fully considered and I believe is misplaced. I understand and am sympathetic to Thomas’ concerns, but that being said, I believe those concerns are best addressed elsewhere. The singular intent of Recommendation 12 is to provide clarity around the process and expectations of reasonable lawful disclosure in terms of making requests. The recommendation attempts to ensure that expectations are set for how to submit requests and in what fashion those requests will be handled once received. The Recommendation does NOT assume that disclosure will be made and, further, it isn’t even contemplated how and on what basis a decision for disclosing (or not) will be made. Those issues are to be dealt with in Phase 2 and/or otherwise in a specific access discussion. I’m thus concerned that by explicitly limiting this recommendation to civil requests will unfairly and unnecessarily remove the benefits of process clarity for LEA. In light of these concerns, I strongly recommend the deletion of this text. Thomas’ legitimate concerns should then be taken up and addressed in our Phase 2 work. Thanks! Ashley 202 482 0298 From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> On Behalf Of Caitlin Tubergen Sent: Thursday, February 7, 2019 3:26 PM To: gnso-epdp-team(a)icann.org Subject: [Gnso-epdp-team] For your review: updated recommendations 10, 11, 12 Dear EPDP Team: Attached, please find the updated recommendations. The updates are the result of today’s EPDP Team discussion As always, please feel free to flag any text that you believe does not represent what the Team agreed to. Best regards, Marika, Berry, and Caitlin _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team

7 10

Re: [Gnso-epdp-team] [Ext] RE: Proposed path for additional topics flagged
by Marika Konings Feb. 10, 2019

Feb. 10, 2019

Hi Marc, As there did not appear to be support for the changes proposed, the language will remain as is in the next iteration of the Final Report, but with the addition as proposed by the RrSG: The EPDP Team recommends that, as soon as commercially reasonable, Registrar must provide the opportunity for the Registered Name Holder to provide its Consent to publish additional contact information in the RDS for the sponsoring registrar. Best regards, Caitlin, Berry and Marika From: "Anderson, Marc" <mcanderson(a)verisign.com> Date: Friday, February 8, 2019 at 13:30 To: Marika Konings <marika.konings(a)icann.org>, "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Ext] RE: [Gnso-epdp-team] Proposed path for additional topics flagged I understand that staff is working on a new draft of the final report and so I expect we will get to see the latest version of the language for some, if not all of these shortly. That said, I want to flag one item. On item #4 (new recommendation – consent) – this document requests input on the mailing list followed by discussion if needed, however this recommendation was also a part of the batch 2 consensus call (which closed yesterday). Can we get a clarification on the state and status of this recommendation? Best, Marc From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> On Behalf Of Marika Konings Sent: Wednesday, February 06, 2019 1:36 PM To: gnso-epdp-team(a)icann.org Subject: [EXTERNAL] Re: [Gnso-epdp-team] Proposed path for additional topics flagged Please use the attached version which has the numbering included as referenced below. Apologies for the inconvenience, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Marika Konings <marika.konings(a)icann.org<mailto:marika.konings@icann.org>> Date: Wednesday, February 6, 2019 at 11:22 To: "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] Proposed path for additional topics flagged Dear EPDP Team, The leadership team has reviewed the additional topics that were put forward for EPDP Team consideration by the deadline and has suggested a path forward in the attached document. Please do have a look to make sure that you are comfortable with the proposed path forward and confirm that it aligns with the EPDP Team discussions to date. We would like to especially draw your attention item 3 (optional tech contact), item 6 (redaction) and item 11 (purpose 1). If your group is not comfortable with the proposed path forward for any of the topics in the table, please flag this as soon as possible, preferably prior to tomorrow’s meeting so it can be added to the agenda for tomorrow’s meeting, but no later than Thursday 7 February COB. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

3 2

Recommendation 13 - Responsibilities of the Parties - email list discussion
by Kurt Pritz Feb. 10, 2019

Feb. 10, 2019

Hi Everyone: With the goal of progressing on issues via email, the leadership team has considered the discussion provided during the Toronto meeting and suggests the following compromise language to address the different positions expressed. (This is a resend of an earlier email with only the subject line of the email updated.) Discussion The language below is the same language proposed by the small team that reviewed the comments, but modified: as suggested by Diane during the meeting to reflect that GDPR Art 28 is unlikely to apply in this situation, and by an addition (bracketed & bolded below) to reference the analysis in the Final Report that this team recommends the creation of Joint Controller Agreements, to appropriately influence the negotiation of GDPR-compliant agreements. This language is intended to strike a balance between those preferring to leave some flexibility for ICANN Org and Contracted Parties to consider the appropriate agreements and those preferring to be specific about the type of agreement to be pursued. I understand this is a complex topic that might require additional discussion but it is also possible that we cannot be dispositive on this issue prior to a lengthy contract formation discussion that extends well beyond our time frames. For that reason, we are taking the liberty of making this recommendation and hope you accept it in the spirit it is offered. Proposed Recommendation #13 Language The EPDP Team recommends that ICANN Org negotiates and enters into required data protection agreements such as a Data Processing Agreement (GDPR Art. 28) or Joint Controller Agreement (Art. 26), as appropriate, with the Contracted Parties. In addition to the legally required components of such agreement, the agreement shall specify the responsibilities of the respective parties for the processing activities as described therein. Indemnification clauses shall ensure that the risk for certain data processing is borne by either one or multiple parties that determine the purpose and means of the processing. [Due consideration should be given to the analysis carried out by the EPDP Team in its Final Report.] Action: Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. Deadline: Monday, 28 January, additional email discussion might follow depending on responses. Sincerely, Kurt

19 37