May 2019 - Gnso-epdp-team - lists.icann.org

**REMINDER** Meeting Invitation: Observers GNSO Temp Spec gTLD RD EPDP - Phase 2 call / Thursday, 23 May 2019 at 14:00 UTC
by Julie Bisland 22 May '19

22 May '19

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 23 May 2019 at 14:00 UTC for 90 minutes. 07:00 PDT, 10:00 EDT, 16:00 Paris CEST, 19:00 Karachi PKT, 23:00 Tokyo JST, (Friday) 00:00 Melbourne AEST For other times: https://tinyurl.com/y5qzq3nc [tinyurl.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__tinyurl.com_y5qzq3nc&d…> Agenda Wiki: https://community.icann.org/x/44SGBg The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream02 <https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream02.m3u <https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Thank you. Kind Regards, Andrea Glandon

1 0

RySG ePDP Team feedback on proposed approach
by Rosette, Kristina 20 May '19

20 May '19

All, Attached and set out below is the RySG ePDP Team's feedback on the proposed approach. -*- The Registries Stakeholder Group (RySG) ePDP Team ("RySG") submits its feedback on the two draft approaches to Phase II of the EPDP. The RySG appreciates the work by Janis Karklins and ICANN Staff reflected in these approaches. The RySG disagrees with the characterization of the EPDP Team's objective on several grounds. First, the EPDP Team's objective is to develop policy recommendations, not necessarily "rules and requirements." Second, those policy recommendations pertain to "a standardized model for lawful disclosure of non-public Registration Data," as set forth in Phase I, Recommendation 3. Third, the current statement of the objective presupposes that data SHALL be shared with third parties, which is incorrect and inconsistent with GDPR. The RySG agrees that the development of policy recommendations for a standardized model for lawful disclosure of non-public Registration Data should be agnostic to the modalities of that model. The distinction between a centralized and decentralized model, which apparently has disappeared from the recent draft, is an important one and the RySG believes it is critical that the EPDP Team consider both. The RySG agrees that the EPDP Team as a whole should engage with ICANN Org on the development of policy questions that will help inform the discussions with DPAs. However, although ICANN's engagement with the DPAs may lead to further clarity, the EPDP should not defer policy development pending consultation and engagement with the DPAs/EDPB. We should proceed with our task, implementing the data protection principles of both Privacy by Default and Privacy by Design. The EPDP should, when appropriate, rely upon the legal constructs whereby we can engage the DPAs as part of our policy development process (e.g. Art 36 prior consultations and Data Protection Impact Assessments under Section 3 of the GDPR.) The RySG appreciates the urgency in completing this process, but the effects of enhanced workloads and tightened timelines do not result in a refined end product, as was patently clear from the closing stages of Phase I. The RySG does not support parallel work streams. The proposed working method increases the workloads of the team members who must participate in both workstreams, and provides a false impression of covering more ground. The proposed parallel work streams will lose the expertise of non-participating EPDP Team members, expedite the onset of Team fatigue, and ultimately be counterproductive. Many Phase 1 items earmarked for WS 2 will materially affect the direction, scope and considerations of WS 1. The 2 streams contain some large interdependencies (e.g Legal v Natural), which will likely lead to reopening or re-assessment of work items. Such reopening or re-assessment will lead to frustration and delay. Rather than achieve the goal of completing Phase II work sooner the two phased approach is likely to cause delays to the overall timeline. Further, the ICANN Board's recent decision to not adopt Recommendation 1, Purpose 2 effectively means that the EPDP Team will need to revisit it. Any change that results from re-opening the discussion of Purpose 2 is expected to impact both work streams and thus impact the overall schedule. It is unclear why the quote from the European Commission's May 3, 2019 letter is a newly added element to the proposed work approach. The RySG supports using clear terminology in this process to set reasonable expectations in the outcome and to ensure clear and efficient communication and work. The RySG supports ensuring that the focus of Phase II release of non-public Registration Data be considered "DISCLOSURE," consistent with Recommendation 18 of the Phase 1 final report, whereby a clear distinction between "Access" and "Disclosure" was drawn by the team. The RySG recognizes the need for timelines, but those timelines must be realistic for the task -- not arbitrary and based on external pressures. The proposed approach does not seem unreasonable at this early stage, but seems target-based rather than based on any actual apparent assessment or even any measurable assumptions. We would like to better understand the underlying data and assumptions that led to this timeline. The RySG is very supportive of setting a realistic target date, so long as such a timeline exists with built in "check-in" points during the intervening period. Such "check-ins" should provide the opportunity for the team to objectively reassess practical considerations of any experienced difficulties, review progress, and consider any additional complications, additions or other factors. Such check-ins should then result in a reasonable readjustment, where necessary, of our timeline. With regard to the timeline, it is not clear why the timelines for the two WS 1 bullets -- "Deliberation on issues outlined on Slide 4" and "Coordination with Org on UAM questions" do not end simultaneously and why the latter ends 3 months before the former. -*- Kristina Rosette Senior Corporate Counsel, IP - Domains rosettek(a)amazon.com<mailto:rosettek@amazon.com> | 703.407.1354

1 0

Re: [Gnso-epdp-team] [Ext] Re: Action items - reminder of upcoming deadlines
by Marika Konings 20 May '19

20 May '19

James, all, In relation to your question on meeting frequency as shown on slide 8, it is intended to show that there would be a weekly meeting to address workstream 1 items and an additional meeting once every two weeks to address work stream 2 items. There is an error in the slide in that it doesn’t show the weekly meeting for week 3 as well as week 4 – we have updated this in the attached version. Apologies for any confusion this may have created. Best regards, Caitlin, Berry and Marika From: "James M. Bladel" <jbladel(a)godaddy.com> Date: Monday, May 20, 2019 at 09:33 To: Marika Konings <marika.konings(a)icann.org>, "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Ext] Re: [Gnso-epdp-team] Action items - reminder of upcoming deadlines Dear Janis, Marika and EPDP Team - Thank you to Janis and the ICANN Staff team for providing this draft approach to Phase 2 of the EPDP. The RrSG has already provided some comments on this mailing list, which this letter supports and expands upon. Meeting Timing/Frequency and Streams We need some clarification regarding the proposed timelines found in slide 8. Meeting dates should be included to avoid confusion over which dates each of the weeks actually refer to. There are no meetings scheduled for Week 3, is this intentional? It seems to suggest that meetings will be held weekly on Thursdays for Work Stream 1 and every third Tuesday for Work Stream 2, if this is indeed the schedule our team would support it. The RrSG encourages the EPDP team to establish a pace which can be maintained over the coming months of work. If the schedule is to be more frequent than what is currently suggested, would the group be open to designating specific Alternates to participate in a specific Work Stream, without the requirement for a Member to give up their place in the primary group during that same period? This would require more conversation (e.g. could alternates send emails in dedicated threads?) but could help to alleviate the workload for members of all groups, making participation more sustainable overall. Timelines The proposed timeline found on slide 7 should be achievable. That said, this team should be aware that the timelines may be impacted in light of the Board’s resolution of only partial adoption of the Phase 1 recommendations. We encourage ICANN staff to start planning for the upcoming Face to Face meeting as early as possible, so attendees can confirm their travel calendars and start applying for travel documents as needed. Phase 1 Legal Memo review Although this is not strictly part of the draft Approach, we do want to confirm our expectation that the EPDP team in its entirety will be given the opportunity to review all the questions, provide input, and determine in plenary which questions are submitted to Bird & Bird for further review or for inclusion in a briefing. Thanks - J. ------------- James Bladel GoDaddy ________________________________ From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Sent: Monday, May 20, 2019 07:02 To: gnso-epdp-team(a)icann.org Subject: [Gnso-epdp-team] Action items - reminder of upcoming deadlines Notice:This email is from an external sender. Reminder: 1. EPDP Team Members to provide additional feedback, if any, on the proposedapproach by Monday, 20 May COB(see Phase 2 Draft Approach - upd 16 May 2019.pdf<https://community.icann.org/download/attachments/109479137/Phase%202%20Draf…>) 2. EPDP Team Members to provide feedback on worksheets published to datein advance of the next EPDP Team meeting on Thursday, 23 May. (see https://community.icann.org/x/5oaGBg) 3. EPDP Team Members to provide additional clarifying questions on legal memos, if any, byThursday, 23 May. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Thursday, May 16, 2019 at 10:23 To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Notes, Action Items - EPDP Team Phase 2 Meeting #2 Dear All, Please find the notes and action item’s from today’s EPDP Team call below. The next EPDP meeting is scheduled for Thursday, 23 May at 14:00 UTC. Best regards, Caitlin, Berry and Marika -- EPDP Phase 2 - Meeting #2 Thursday, 16 May 2019 at 14.00 UTC Action Items 1. Leadership Team and Support Staff to develop initial glossary of working definitions for EPDP Team feedback in advance of next EPDP Team meeting on Thursday, 23 May. 2. Support Staff to provide initial draft of outreach message to SG/C/SO/AC to request early input in advance of next EPDP Team meeting on Thursday, 23 May. EPDP Team members to consider questions that should be included in the outreach message. 3. EPDP Team Members to provide feedback on worksheets published to date in advance of the next EPDP Team meeting on Thursday, 23 May. 4. Support staff to develop or update worksheets for remaining topics (accuracy and standardized framework for A/D) 5. Support Staff to review legal clarifying questions received to date and align them with legal memos and consolidate where possible in advance of the next EPDP Team meeting on Thursday, 23 May. 6. EPDP Team Members to provide additional clarifying questions on legal memos, if any, byThursday, 23 May. 1. Roll Call & SOI Updates (5 minutes) • Attendance will be taken by Zoom room • Alternates are required to add “zzz” to their name within Zoom - in order to do this, please hover over your name and click “rename” • SOIs must be kept up-to-date; please contact the GNSO secretariat for assistance in updating your SOI • On Monday, 21 May at 13.00, there will be a Zoom drop-in call for those who wish to familiarize themselves with Zoom 2. Confirmation of agenda (Chair) Feedback: • Would it be possible to start with a brief overview of the Board resolution that just adopted? • Answer: Since Board resolution has not yet been published, we will wait to discuss the resolution. • Have there been any preliminary decisions made by the Council during its meeting today? • Answer: Because of the limited time in the agenda, the Council was unable to discuss this. There will be a special meeting on this topic in the future. 3. Welcome and housekeeping issues (10 minutes) a. Bilateral meetings of the Chair to date • 3 bilateral meetings o Board liaisons o Contracted parties o European Commission • SSAC has reached out for an informal meeting • Regarding meeting with EC - very general discussion re: the letters sent after approval of Phase 1 and the letter sent on 3 May. b. ICANN65 Travel Support (Marika) (seehttps://community.icann.org/x/6hdIBg) • The process has been completed for travel support requests • Three members will receive travel support: Alex Deacon, Amr Elsadr, and Thomas Rickert • This information has been posted on the wiki page c. Confirmation of immediate resources (Rafik) (seehttps://gnso.icann.org/en/correspondence/chalaby-to-drazek-et-al-06may19… [gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_corr…>) • GNSO Council made resource request to the Board for the initial work in Phase 2 • Board approved resources for telecom/transcription serves, travel support, legal counsel and professional mediation services through this fiscal year • The Board is awaiting a GNSO Council-approved work plan before approving additional resources 4. Review and discussion of draft approach for phase 2 (45 minutes) (Chair): •Review draft approach (see attached, with minor updates in red to reflect input received) * The main objective of Workstream 1 would be to develop rules for sharing non-public registration data with third parties * There was discussion re: the terminology of access vs. disclosure - proposal to use “AD” instead of access or disclosure rather than discussing the choice of terms at length * Proposal to work in two streams - there was comments re: not working in two streams; some argued that the team should accelerate the Phase 2 work * Sample worksheets have been distributed to the list - does the team find these worksheets useful? * Clarification letter from the European Commission was received on 3 May 2019 - reference to a unified access model * Propose to start with working definitions for the Team’s conversation - these will not be legal definitions, but rather, would be used for the sake of a common understanding * Slide 6 shows an non-exhaustive outline of issues to be considered during workstream 1, e.g., legal guidance, terminology, etc. * Proposing to have an additional F2F meeting in Los Angeles in mid-September 2019 and possibly in January 2020 (in addition to F2F time at ICANN meetings) * Target for Montreal - Initial report for WS1 •Each group to provide their input on the draft approach (what, why and how things could or should be done different) i. RySG • RySG has not had an opportunity to sync up on a unified response • Important to seek further input from SOs/ACs • Disclosure and Access needs to be lawful • Worksheets may not be helpful. Similar worksheets were considered for Phase 1 but were not utilized. If the EPDP team goes forward with the worksheets, the team should commit to use, maintain, and update the worksheets. ii. RrSG • Nothing to add at this time iii. IPC • Timeline is needed for workstream 2 • Setting a meeting every other week for workstream 2 may not be enough • Worksheets are helpful, and hoping the Team can utilize these going forward iv. BC • Please refer to the BC’s email from 15 May • The term legal certainty is not the appropriate standard as this may be unattainable; however, reduction of risk is important to consider • Workstream 2 is missing items from the Phase 1 Final report, such as accuracy v. ISPCP • Meeting schedule is acceptable • The UDAM may be too ambitious if we would like to bake in feedback from the authorities - if that is the case, it is likely an unrealistic timeline vi. NCSG • Postpone response on the work plan until next week • Re: EPDP working with ICANN org and European Data Commissioner - what does that mean? o Re: letter from ICANN CEO for subteam to talk through policy questions related to Phase 2 in order for ICANN org to interact with European data protection agencies - proposal is to engage not as a subteam but as the whole EPDP Team at an appropriate time. This is a communication line that will facilitate the EPDP Team’s work. vii. GAC • The timeline is consistent with GAC advice to date. We should find areas to compress the timeline if at all possible • Terminology re: access vs. disclosure should not be a prolonged discussion • Support the multiple work streams approach, but the team should remain flexible • Worksheets could be a useful tool viii. ALAC • Generally support the work plan • Concerned about the timeline for workstream 2 • Regarding board resolution - if there are additional issues that need to be dealt with in implementation, they may have to dealt with urgently • An item missing from the plan - when will we deal with the legal advice received in Phase 1? ix. SSAC • In support of parallel workstreams • More comments will be provided on the list shortly x. Board liaisons • Proposed path forward is acceptable xi. ICANN Org liaisons • No specific comments on draft approach - however, if issues need to be raised after additional internal consultation, we will raise them on the list •Confirm agreements and, if applicable, areas that need to be reviewed * No group disagreed with the proposal as a whole * Confirm next steps & action items * EPDP Members to provide general comments on draft approach by Monday, 20 May - * Next call - finalize the approach and propose additional details to the work plan for discussion. * Leadership team to share initial glossary of terms for discussion during the next meeting - working definitions (not legal definitions) 5. Discuss required step of “soliciting of statements from GNSO Stakeholder Groups and Constituencies” (5 minutes) (Marika) • One required step of the PDP/EPDP - request early input from SGs/Cs to inform the deliberations • This concept was made in the context of a potentially underrepresented group, which is not the case in the EPDP • The timeframe given is 21 days for groups to provide input • Factoring in the specific set up of the group and the representation, what can be done to meet this requirement without creating duplicate work? • One approach: once the Team has reached agreement on the approach - share it with the groups and input received during Phase 1 and ask if there is any new or additional information that groups want to provide so that the input is not merely a repetition of feedback already received. Feedback: • Important to give SOs/ACs an opportunity to provide early input to the Team’s work • The question is not if the group can discard the step, but rather - how should the Team go about getting the feedback - should specific questions be asked? What format should the request take? • Providing targeted questions to the SOs/ACs would be helpful * Support Staff to prepare draft of outreach message for initial SO/AC input before next call 6. Workstream 2 Worksheets (10 minutes) (Chair) * Confirm latest status * From a staff perspective, the worksheets are helpful for the scope of the work and the expected deliverable * Important for the Team members to review the worksheets so that Staff can translate the work sheets into timeframes, necessary input, etc. * Staff plans to document conversations on these topics as they happen within the worksheets and will also use the worksheets for draft recommendations and supporting text * Feedback: if worksheets are used in the method described, they could be useful, so long as they are a living document * EPDP Team Members to provide feedback on worksheets published to date by next EPDP Team meeting * Confirm deadline for review and input * EPDP Team Members to provide feedback on worksheets published to date by next EPDP Team meeting 7. Review of clarifying questions received in relation to legal memos (10 minutes) * Review clarifying questions received * Support staff to review the questions received so far and align them with memos received. The EPDP Team can then review the questions. * The Board resolution may impact the questions asked, so more time is needed. * Confirm next steps * Deadline for EPDP Team members to provide additional feedback - Thursday, 23 May 8. Any other business 9. Wrap and confirm next meeting to be scheduled for Thursday, 23 May at 14.00 UTC (5 minutes) * Confirm action items * Confirm questions for ICANN Org, if any

2 1

Action items - reminder of upcoming deadlines
by Marika Konings 20 May '19

20 May '19

Reminder: 1. EPDP Team Members to provide additional feedback, if any, on the proposed approach by Monday, 20 May COB (see Phase 2 Draft Approach - upd 16 May 2019.pdf<https://community.icann.org/download/attachments/109479137/Phase%202%20Draf…>) 2. EPDP Team Members to provide feedback on worksheets published to date in advance of the next EPDP Team meeting on Thursday, 23 May. (see https://community.icann.org/x/5oaGBg) 3. EPDP Team Members to provide additional clarifying questions on legal memos, if any, by Thursday, 23 May. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Thursday, May 16, 2019 at 10:23 To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Notes, Action Items - EPDP Team Phase 2 Meeting #2 Dear All, Please find the notes and action item’s from today’s EPDP Team call below. The next EPDP meeting is scheduled for Thursday, 23 May at 14:00 UTC. Best regards, Caitlin, Berry and Marika -- EPDP Phase 2 - Meeting #2 Thursday, 16 May 2019 at 14.00 UTC Action Items 1. Leadership Team and Support Staff to develop initial glossary of working definitions for EPDP Team feedback in advance of next EPDP Team meeting on Thursday, 23 May. 2. Support Staff to provide initial draft of outreach message to SG/C/SO/AC to request early input in advance of next EPDP Team meeting on Thursday, 23 May. EPDP Team members to consider questions that should be included in the outreach message. 3. EPDP Team Members to provide feedback on worksheets published to date in advance of the next EPDP Team meeting on Thursday, 23 May. 4. Support staff to develop or update worksheets for remaining topics (accuracy and standardized framework for A/D) 5. Support Staff to review legal clarifying questions received to date and align them with legal memos and consolidate where possible in advance of the next EPDP Team meeting on Thursday, 23 May. 6. EPDP Team Members to provide additional clarifying questions on legal memos, if any, by Thursday, 23 May. 1. Roll Call & SOI Updates (5 minutes) · Attendance will be taken by Zoom room · Alternates are required to add “zzz” to their name within Zoom - in order to do this, please hover over your name and click “rename” · SOIs must be kept up-to-date; please contact the GNSO secretariat for assistance in updating your SOI · On Monday, 21 May at 13.00, there will be a Zoom drop-in call for those who wish to familiarize themselves with Zoom 2. Confirmation of agenda (Chair) Feedback: · Would it be possible to start with a brief overview of the Board resolution that just adopted? · Answer: Since Board resolution has not yet been published, we will wait to discuss the resolution. · Have there been any preliminary decisions made by the Council during its meeting today? · Answer: Because of the limited time in the agenda, the Council was unable to discuss this. There will be a special meeting on this topic in the future. 3. Welcome and housekeeping issues (10 minutes) a. Bilateral meetings of the Chair to date · 3 bilateral meetings o Board liaisons o Contracted parties o European Commission · SSAC has reached out for an informal meeting · Regarding meeting with EC - very general discussion re: the letters sent after approval of Phase 1 and the letter sent on 3 May. b. ICANN65 Travel Support (Marika) (see https://community.icann.org/x/6hdIBg) · The process has been completed for travel support requests · Three members will receive travel support: Alex Deacon, Amr Elsadr, and Thomas Rickert · This information has been posted on the wiki page c. Confirmation of immediate resources (Rafik) (see https://gnso.icann.org/en/correspondence/chalaby-to-drazek-et-al-06may19-en… [gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_corr…>) · GNSO Council made resource request to the Board for the initial work in Phase 2 · Board approved resources for telecom/transcription serves, travel support, legal counsel and professional mediation services through this fiscal year · The Board is awaiting a GNSO Council-approved work plan before approving additional resources 4. Review and discussion of draft approach for phase 2 (45 minutes) (Chair): · Review draft approach (see attached, with minor updates in red to reflect input received) * The main objective of Workstream 1 would be to develop rules for sharing non-public registration data with third parties * There was discussion re: the terminology of access vs. disclosure - proposal to use “AD” instead of access or disclosure rather than discussing the choice of terms at length * Proposal to work in two streams - there was comments re: not working in two streams; some argued that the team should accelerate the Phase 2 work * Sample worksheets have been distributed to the list - does the team find these worksheets useful? * Clarification letter from the European Commission was received on 3 May 2019 - reference to a unified access model * Propose to start with working definitions for the Team’s conversation - these will not be legal definitions, but rather, would be used for the sake of a common understanding * Slide 6 shows an non-exhaustive outline of issues to be considered during workstream 1, e.g., legal guidance, terminology, etc. * Proposing to have an additional F2F meeting in Los Angeles in mid-September 2019 and possibly in January 2020 (in addition to F2F time at ICANN meetings) * Target for Montreal - Initial report for WS1 · Each group to provide their input on the draft approach (what, why and how things could or should be done different) i. RySG · RySG has not had an opportunity to sync up on a unified response · Important to seek further input from SOs/ACs · Disclosure and Access needs to be lawful · Worksheets may not be helpful. Similar worksheets were considered for Phase 1 but were not utilized. If the EPDP team goes forward with the worksheets, the team should commit to use, maintain, and update the worksheets. ii. RrSG · Nothing to add at this time iii. IPC · Timeline is needed for workstream 2 · Setting a meeting every other week for workstream 2 may not be enough · Worksheets are helpful, and hoping the Team can utilize these going forward iv. BC · Please refer to the BC’s email from 15 May · The term legal certainty is not the appropriate standard as this may be unattainable; however, reduction of risk is important to consider · Workstream 2 is missing items from the Phase 1 Final report, such as accuracy v. ISPCP · Meeting schedule is acceptable · The UDAM may be too ambitious if we would like to bake in feedback from the authorities - if that is the case, it is likely an unrealistic timeline vi. NCSG · Postpone response on the work plan until next week · Re: EPDP working with ICANN org and European Data Commissioner - what does that mean? o Re: letter from ICANN CEO for subteam to talk through policy questions related to Phase 2 in order for ICANN org to interact with European data protection agencies - proposal is to engage not as a subteam but as the whole EPDP Team at an appropriate time. This is a communication line that will facilitate the EPDP Team’s work. vii. GAC · The timeline is consistent with GAC advice to date. We should find areas to compress the timeline if at all possible · Terminology re: access vs. disclosure should not be a prolonged discussion · Support the multiple work streams approach, but the team should remain flexible · Worksheets could be a useful tool viii. ALAC · Generally support the work plan · Concerned about the timeline for workstream 2 · Regarding board resolution - if there are additional issues that need to be dealt with in implementation, they may have to dealt with urgently · An item missing from the plan - when will we deal with the legal advice received in Phase 1? ix. SSAC · In support of parallel workstreams · More comments will be provided on the list shortly x. Board liaisons · Proposed path forward is acceptable xi. ICANN Org liaisons · No specific comments on draft approach - however, if issues need to be raised after additional internal consultation, we will raise them on the list · Confirm agreements and, if applicable, areas that need to be reviewed * No group disagreed with the proposal as a whole * Confirm next steps & action items * EPDP Members to provide general comments on draft approach by Monday, 20 May - * Next call - finalize the approach and propose additional details to the work plan for discussion. * Leadership team to share initial glossary of terms for discussion during the next meeting - working definitions (not legal definitions) 5. Discuss required step of “soliciting of statements from GNSO Stakeholder Groups and Constituencies” (5 minutes) (Marika) · One required step of the PDP/EPDP - request early input from SGs/Cs to inform the deliberations · This concept was made in the context of a potentially underrepresented group, which is not the case in the EPDP · The timeframe given is 21 days for groups to provide input · Factoring in the specific set up of the group and the representation, what can be done to meet this requirement without creating duplicate work? · One approach: once the Team has reached agreement on the approach - share it with the groups and input received during Phase 1 and ask if there is any new or additional information that groups want to provide so that the input is not merely a repetition of feedback already received. Feedback: · Important to give SOs/ACs an opportunity to provide early input to the Team’s work · The question is not if the group can discard the step, but rather - how should the Team go about getting the feedback - should specific questions be asked? What format should the request take? · Providing targeted questions to the SOs/ACs would be helpful * Support Staff to prepare draft of outreach message for initial SO/AC input before next call 6. Workstream 2 Worksheets (10 minutes) (Chair) * Confirm latest status * From a staff perspective, the worksheets are helpful for the scope of the work and the expected deliverable * Important for the Team members to review the worksheets so that Staff can translate the work sheets into timeframes, necessary input, etc. * Staff plans to document conversations on these topics as they happen within the worksheets and will also use the worksheets for draft recommendations and supporting text * Feedback: if worksheets are used in the method described, they could be useful, so long as they are a living document * EPDP Team Members to provide feedback on worksheets published to date by next EPDP Team meeting * Confirm deadline for review and input * EPDP Team Members to provide feedback on worksheets published to date by next EPDP Team meeting 7. Review of clarifying questions received in relation to legal memos (10 minutes) * Review clarifying questions received * Support staff to review the questions received so far and align them with memos received. The EPDP Team can then review the questions. * The Board resolution may impact the questions asked, so more time is needed. * Confirm next steps * Deadline for EPDP Team members to provide additional feedback - Thursday, 23 May 8. Any other business 9. Wrap and confirm next meeting to be scheduled for Thursday, 23 May at 14.00 UTC (5 minutes) * Confirm action items * Confirm questions for ICANN Org, if any

2 1

**TODAY** Zoom Drop in Training
by Julie Bisland 20 May '19

20 May '19

Dear all, On Monday, 20 May 2019 we will have a Zoom room available from 13:00-15:00 UTC for members to join, explore the room/features and have a support staff member available to answer questions. Please feel free to join at any time during the above 2 hour time frame. Attached you will also find a ics attachment for your calendar. If you have questions about this training, please email gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> Zoom room: https://icann.zoom.us/my/gnso.pdp1 [icann.zoom.us]<https://urldefense.proofpoint.com/v2/url?u=https-3A__icann.zoom.us_my_gnso.…> You will have VoIP and telecom bridge audio options available to you upon logging in. One tap mobile +19294362866,,3107952819# US (New York) +16699006833,,3107952819# US (San Jose) Meeting ID: 310 795 2819 Find your local number: https://zoom.us/u/acwzlz1QoY<https://urldefense.proofpoint.com/v2/url?u=https-3A__zoom.us_u_acwzlz1QoY&d…> Thank you. Kind Regards, Andrea Glandon

1 0

Re: [Gnso-epdp-team] Access vs Disclosure and Centralized vs Decentralized
by Alan Greenberg 20 May '19

20 May '19

Of course there will be rules associated with any such transfer and that will even apply to the data subject - someone will need to have a process by which the subject suitably identifies themselves to establish that they do have a legitimate right to that information. My point is that debating calling accessing or disclosing or widgetting or blivoting does not further our real work, and that for any transfer, there is a sender and receiver. Alan At 17/05/2019 05:21 AM, Mueller, Milton L wrote: I want to differ a bit with Alan?s analysis below. Access typically denotes a more general right to get something when one wants it. When I buy a subscription to a mobile phone service I am buying ?access? to the network whenever I want to use it. A distinction between access demand and usage demand is a staple of information and communication economics. In this regard, as Janis?s slide correctly stated, in data protection law and policy the right of access usually refers to the right of a data _subject_ to inspect their data to ensure its accuracy. This is a broader, less conditional right than, say, the interest of a trademark holder in seeing a third party?s domain name registration data. The trademark holders occasionally have a legitimate interest to see redacted data of a suspected infringer. What the trademark holder wants is the disclosure of contact data he or she needs to serve legal process or to ascertain the legitimacy of the name?s use. The trademark holder does _not_ have a right of access to any and all registration data; he has disclosure rights. So the insistence on the use of the term ?disclosure? rather than ?access? is not arbitrary, and we don?t solve it with A/D. They are fundamentally different concepts and we need to keep them distinct. There are important differences in using one name or the other. whether we are talking UDM or some other form of DM when we talk about third parties we are talking about a disclosure model, not an access model. From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> On Behalf Of Alan Greenberg Sent: Wednesday, May 15, 2019 11:07 PM To: GNSO EPDP <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Access vs Disclosure and Centralized vs Decentralized I would find the discussions of these two issues quite humorous if it was not for how much time we have and will spend on them, and the fact that the debates will take time and effort away from real issues. Access vs Disclosure They are the same thing, but from different perspectives. From the perspective of the entity holding the data (primarily the contracted parties in our case), information they hold and may be responsible for is being "disclosed". From the perspective of the entity requesting the data, it is a matter of them "accessing" it. We can certainly define new meanings for these words as suggested on slide 3. But long experience has shown that when you attempt to define existing words in a way that is different from the dictionary meaning (ie {"access" is only for the data subject) people always revert back to the dictionary definitions and cause untold confusion. Centralized vs Decentralized Any real world solution that will be usable by those who will need data, and be supportable by those who hold the data, will have components that are decentralized and components that a centralized (and yet perhaps replicated for reliability). For example there will likely be common places at which to make a request, and accreditation for a given type of requestor may be centralized, yet the data will almost certainly reside in highly decentralized places. Let's focus on how the work will be done and not worry about global labels. Alan

2 1

Recordings, Attendance & Zoom Chat / EPDP - Phase 2 / Thursday, 16 May 2019
by Andrea Glandon 17 May '19

17 May '19

Dear all, Please find the attendance attached to this email, and links to the audio only, zoom recording (audio, visual, rough transcript) and chat below from the EPDP – Phase 2 call held on Thursday, 16 May 2019 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/4YSGBg Audio Only: https://icann.zoom.us/recording/play/59iKDmwtVNNA0jIeiCVhpXEucc5Q5JjJLKFD6R… Zoom Recording (includes visual and rough transcript. To access the rough transcript, select the Audio Transcript tab): https://icann.zoom.us/recording/play/NWLVpinbR1BRX7RyWRfSwjYBaB1TR7aMPgncLV… Chat: https://icann.zoom.us/recording/download/zKnYkGE5P7BBzOJl0f5JGrOLHnhRePUoih… ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

**REMINDER** Zoom Drop In Training
by Julie Bisland 17 May '19

17 May '19

Dear all, On Monday, 20 May 2019 we will have a Zoom room available from 13:00-15:00 UTC for members to join, explore the room/features and have a support staff member available to answer questions. Please feel free to join at any time during the above 2 hour time frame. Attached you will also find a ics attachment for your calendar. If you have questions about this training, please email gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> Zoom Room: https://icann.zoom.us/my/gnso.pdp1 You will have VoIP and telecom bridge audio options available to you upon logging in. One tap mobile +19294362866,,3107952819# US (New York) +16699006833,,3107952819# US (San Jose) Meeting ID: 310 795 2819 Find your local number: https://zoom.us/u/acwzlz1QoY<https://urldefense.proofpoint.com/v2/url?u=https-3A__zoom.us_u_acwzlz1QoY&d…> Thank you. Kind Regards, Andrea Glandon

1 0

BC Comments on the Legal Analysis
by Margie Milam 17 May '19

17 May '19

Hi – In advance of tomorrow’s call, here are comments and questions submitted on behalf of the BC: Possible Legal Bases for Processing. Our comments on the legal bases topic have been influenced by both the 6(1)(f) memo and the recent EC communication, so we’ve broken our clarifying questions into 2 groupings, one for 6(1)(b) and one for 6(1)(e). * Performance of Contract – B&B should revisit its analysis in light of the recent EC Letter where it notes: “As explained in our comments, Art. 6(1)f GDPR (legitimate interest) is one of the six possible legal bases provided under Art. 6(1) GDPR. For instance, disclosure of nonpublic gTLD registration data could be necessary for compliance with a legal obligation to which the contracted parties are subject (see Art. 6(1)c GDPR).” This is consistent with the B&B memo that recognizes that a direct contract with the data subject is not necessary. * To identify 6(1)(b) as purpose for processing registration data, we should follow up on the B & B advice that- “it will be necessary to require that the specific third party or at least the processing by the third party is, at least abstractly, already known to the data subject at the time the contract is concluded and that the controller, as the contractual partner, informs the data subject of this prior to the transfer to the third party” * B&B should clarify why it believes that the only basis for providing WHOIS is for the prevention of DNS abuse. Its conclusion in Paragraph 10 does not consider the other purposes identified by the EPDP in Rec 1, and, in any event should consider the recent EC recognition that ICANN has a broad purpose to: ‘contribute to the maintenance of the security, stability, and resiliency of the Domain Name System in accordance with ICANN's mission’, which is at the core of the role of ICANN as the “guardian” of the Domain Name System.” * WHOIS in the Public Interest - Similarly, B&B should advise on the extent to which GDPR’s public interest basis 6(1)e is applicable, in light of the EC’s recognition that: “With regard to the formulation of purpose two, the European Commission acknowledges ICANN’s central role and responsibility for ensuring the security, stability and resilience of the Internet Domain Name System and that in doing so it acts in the public interest.” Natural-Legal: * The EDPD should explore with B&B the possible ways of protecting against an erroneous identification as a legal person. The policy recommendations could point to different practices that exist today (relying on the CCTLD research referenced in the EPDP Phase 1 report) that could enable the natural/legal person distinction to be made. For example, the EPDP could propose a verification component, based on a number of indicators that can determine whether the registrant is a legal entity. * Has B&B considered how the natural/legal person distinction is handled by ccTLDs? * With regard to concerns about emails possibly containing personal info – has B & B considered whether the risk could be mitigated if the registrant is asked if the email is “role based” or identifies an actual individual? Accuracy: Has B&B reviewed the statistics from the WHOIS ARS on accuracy levels or the findings of the 1st and 2nd WHOIS RT with regard to accuracy? This should factor into the summary conclusions in Paragraph 21. Thick WHOIS: Did B&B review the GNSO’s Final Report and analysis in support of the Thick WHOIS policy recommendations? Specifically, the consensus policy was based on recognized benefits to the Internet Ecosystem of having Thick WHOIS. For example, under the Thick WHOIS policy, the registry is the authoritative place for domain name registration records. Mark and I look forward to discussing these issues in more detail tomorrow. All the best, Margie and Mark

3 2

Response to 10 May letter re. collaboration with EPDP Team
by Marika Konings 17 May '19

17 May '19

Sending on behalf of Göran Marby, President & CEO ICANN Dear Janis, Thank you for your email sharing the EPDP Team initial views. Noting yours and the Team’s remarks with respect to the time the constitution of a small group may consume as well as your proposal to the Team to use a plenary format, I invite all the members of the EPDP Team to work with ICANN org on the topics under consideration if this is the Team’s preference. With respect to the expected scope of work, I reiterate the work that ICANN org has been supporting in relation to a UAM based on the model proposed by the TSG has as its objective to determine whether this would diminish the legal liability of contracted parties, who would provide access to non-public registration data. As noted, further work needs to be undertaken to help inform the discussions with the European Commission and Data Protection Authorities, before an answer can be provided. ICANN org is currently working to map next steps needed before a determination can be made on whether a UAM based on the model proposed by the TSG can diminish the legal liability of contracted parties, following which we will suggest a mode of operation on this work with the EPDP Team. Similarly, with respect to timeline, it is premature to commit to a particular duration at this stage. I note however that ICANN org would like to have clarity on whether the proposed model reduces exposure of contracted parties to liability related to disclosure of non-public registration data the soonest possible, hoping that this will help inform the EPDP Team’s deliberations. My team remains available should you have any further questions or require further information. Finally, I would like to repeat I remain at the EPDP’s disposal to channel to the Data Protection Authorities any questions that would help the Team with their ongoing or future work. Kind Regards, Göran Marby President & CEO ICANN

2 1