May 2019 - Gnso-epdp-team - lists.icann.org

Meeting Invitation: Observers GNSO Temp Spec gTLD RD EPDP - Phase 2 call / Thursday, 23 May 2019 at 14:00 UTC
by Andrea Glandon May 16, 2019

May 16, 2019

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 23 May 2019 at 14:00 UTC for 90 minutes. 07:00 PDT, 10:00 EDT, 16:00 Paris CEST, 19:00 Karachi PKT, 23:00 Tokyo JST, (Friday) 00:00 Melbourne AEST For other times: https://tinyurl.com/y5qzq3nc [tinyurl.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__tinyurl.com_y5qzq3nc&d…> Agenda Wiki: https://community.icann.org/x/44SGBg The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream02 <https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream02.m3u <https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Thank you. Kind Regards, Andrea Glandon

1 0

Notes, Action Items - EPDP Team Phase 2 Meeting #2
by Marika Konings May 16, 2019

May 16, 2019

Dear All, Please find the notes and action item’s from today’s EPDP Team call below. The next EPDP meeting is scheduled for Thursday, 23 May at 14:00 UTC. Best regards, Caitlin, Berry and Marika -- EPDP Phase 2 - Meeting #2 Thursday, 16 May 2019 at 14.00 UTC Action Items 1. EPDP Team Members to provide additional feedback, if any, on the proposed approach by Monday, 20 May COB (see Phase 2 Draft Approach - upd 16 May 2019.pdf<https://community.icann.org/download/attachments/109479137/Phase%202%20Draf…>) 2. Leadership Team and Support Staff to develop initial glossary of working definitions for EPDP Team feedback in advance of next EPDP Team meeting on Thursday, 23 May. 3. Support Staff to provide initial draft of outreach message to SG/C/SO/AC to request early input in advance of next EPDP Team meeting on Thursday, 23 May. EPDP Team members to consider questions that should be included in the outreach message. 4. EPDP Team Members to provide feedback on worksheets published to date in advance of the next EPDP Team meeting on Thursday, 23 May. 5. Support staff to develop or update worksheets for remaining topics (accuracy and standardized framework for A/D) 6. Support Staff to review legal clarifying questions received to date and align them with legal memos and consolidate where possible in advance of the next EPDP Team meeting on Thursday, 23 May. 7. EPDP Team Members to provide additional clarifying questions on legal memos, if any, by Thursday, 23 May. 1. Roll Call & SOI Updates (5 minutes) · Attendance will be taken by Zoom room · Alternates are required to add “zzz” to their name within Zoom - in order to do this, please hover over your name and click “rename” · SOIs must be kept up-to-date; please contact the GNSO secretariat for assistance in updating your SOI · On Monday, 21 May at 13.00, there will be a Zoom drop-in call for those who wish to familiarize themselves with Zoom 2. Confirmation of agenda (Chair) Feedback: · Would it be possible to start with a brief overview of the Board resolution that just adopted? · Answer: Since Board resolution has not yet been published, we will wait to discuss the resolution. · Have there been any preliminary decisions made by the Council during its meeting today? · Answer: Because of the limited time in the agenda, the Council was unable to discuss this. There will be a special meeting on this topic in the future. 3. Welcome and housekeeping issues (10 minutes) a. Bilateral meetings of the Chair to date · 3 bilateral meetings o Board liaisons o Contracted parties o European Commission · SSAC has reached out for an informal meeting · Regarding meeting with EC - very general discussion re: the letters sent after approval of Phase 1 and the letter sent on 3 May. b. ICANN65 Travel Support (Marika) (see https://community.icann.org/x/6hdIBg) · The process has been completed for travel support requests · Three members will receive travel support: Alex Deacon, Amr Elsadr, and Thomas Rickert · This information has been posted on the wiki page c. Confirmation of immediate resources (Rafik) (see https://gnso.icann.org/en/correspondence/chalaby-to-drazek-et-al-06may19-en… [gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_corr…>) · GNSO Council made resource request to the Board for the initial work in Phase 2 · Board approved resources for telecom/transcription serves, travel support, legal counsel and professional mediation services through this fiscal year · The Board is awaiting a GNSO Council-approved work plan before approving additional resources 4. Review and discussion of draft approach for phase 2 (45 minutes) (Chair): · Review draft approach (see attached, with minor updates in red to reflect input received) * The main objective of Workstream 1 would be to develop rules for sharing non-public registration data with third parties * There was discussion re: the terminology of access vs. disclosure - proposal to use “AD” instead of access or disclosure rather than discussing the choice of terms at length * Proposal to work in two streams - there was comments re: not working in two streams; some argued that the team should accelerate the Phase 2 work * Sample worksheets have been distributed to the list - does the team find these worksheets useful? * Clarification letter from the European Commission was received on 3 May 2019 - reference to a unified access model * Propose to start with working definitions for the Team’s conversation - these will not be legal definitions, but rather, would be used for the sake of a common understanding * Slide 6 shows an non-exhaustive outline of issues to be considered during workstream 1, e.g., legal guidance, terminology, etc. * Proposing to have an additional F2F meeting in Los Angeles in mid-September 2019 and possibly in January 2020 (in addition to F2F time at ICANN meetings) * Target for Montreal - Initial report for WS1 · Each group to provide their input on the draft approach (what, why and how things could or should be done different) i. RySG · RySG has not had an opportunity to sync up on a unified response · Important to seek further input from SOs/ACs · Disclosure and Access needs to be lawful · Worksheets may not be helpful. Similar worksheets were considered for Phase 1 but were not utilized. If the EPDP team goes forward with the worksheets, the team should commit to use, maintain, and update the worksheets. ii. RrSG · Nothing to add at this time iii. IPC · Timeline is needed for workstream 2 · Setting a meeting every other week for workstream 2 may not be enough · Worksheets are helpful, and hoping the Team can utilize these going forward iv. BC · Please refer to the BC’s email from 15 May · The term legal certainty is not the appropriate standard as this may be unattainable; however, reduction of risk is important to consider · Workstream 2 is missing items from the Phase 1 Final report, such as accuracy v. ISPCP · Meeting schedule is acceptable · The UDAM may be too ambitious if we would like to bake in feedback from the authorities - if that is the case, it is likely an unrealistic timeline vi. NCSG · Postpone response on the work plan until next week · Re: EPDP working with ICANN org and European Data Commissioner - what does that mean? o Re: letter from ICANN CEO for subteam to talk through policy questions related to Phase 2 in order for ICANN org to interact with European data protection agencies - proposal is to engage not as a subteam but as the whole EPDP Team at an appropriate time. This is a communication line that will facilitate the EPDP Team’s work. vii. GAC · The timeline is consistent with GAC advice to date. We should find areas to compress the timeline if at all possible · Terminology re: access vs. disclosure should not be a prolonged discussion · Support the multiple work streams approach, but the team should remain flexible · Worksheets could be a useful tool viii. ALAC · Generally support the work plan · Concerned about the timeline for workstream 2 · Regarding board resolution - if there are additional issues that need to be dealt with in implementation, they may have to dealt with urgently · An item missing from the plan - when will we deal with the legal advice received in Phase 1? ix. SSAC · In support of parallel workstreams · More comments will be provided on the list shortly x. Board liaisons · Proposed path forward is acceptable xi. ICANN Org liaisons · No specific comments on draft approach - however, if issues need to be raised after additional internal consultation, we will raise them on the list · Confirm agreements and, if applicable, areas that need to be reviewed * No group disagreed with the proposal as a whole * Confirm next steps & action items * EPDP Members to provide general comments on draft approach by Monday, 20 May - * Next call - finalize the approach and propose additional details to the work plan for discussion. * Leadership team to share initial glossary of terms for discussion during the next meeting - working definitions (not legal definitions) 5. Discuss required step of “soliciting of statements from GNSO Stakeholder Groups and Constituencies” (5 minutes) (Marika) · One required step of the PDP/EPDP - request early input from SGs/Cs to inform the deliberations · This concept was made in the context of a potentially underrepresented group, which is not the case in the EPDP · The timeframe given is 21 days for groups to provide input · Factoring in the specific set up of the group and the representation, what can be done to meet this requirement without creating duplicate work? · One approach: once the Team has reached agreement on the approach - share it with the groups and input received during Phase 1 and ask if there is any new or additional information that groups want to provide so that the input is not merely a repetition of feedback already received. Feedback: · Important to give SOs/ACs an opportunity to provide early input to the Team’s work · The question is not if the group can discard the step, but rather - how should the Team go about getting the feedback - should specific questions be asked? What format should the request take? · Providing targeted questions to the SOs/ACs would be helpful * Support Staff to prepare draft of outreach message for initial SO/AC input before next call 6. Workstream 2 Worksheets (10 minutes) (Chair) * Confirm latest status * From a staff perspective, the worksheets are helpful for the scope of the work and the expected deliverable * Important for the Team members to review the worksheets so that Staff can translate the work sheets into timeframes, necessary input, etc. * Staff plans to document conversations on these topics as they happen within the worksheets and will also use the worksheets for draft recommendations and supporting text * Feedback: if worksheets are used in the method described, they could be useful, so long as they are a living document * EPDP Team Members to provide feedback on worksheets published to date by next EPDP Team meeting * Confirm deadline for review and input * EPDP Team Members to provide feedback on worksheets published to date by next EPDP Team meeting 7. Review of clarifying questions received in relation to legal memos (10 minutes) * Review clarifying questions received * Support staff to review the questions received so far and align them with memos received. The EPDP Team can then review the questions. * The Board resolution may impact the questions asked, so more time is needed. * Confirm next steps * Deadline for EPDP Team members to provide additional feedback - Thursday, 23 May 8. Any other business 9. Wrap and confirm next meeting to be scheduled for Thursday, 23 May at 14.00 UTC (5 minutes) * Confirm action items * Confirm questions for ICANN Org, if any

1 0

WORKING with a new link**Update on audio cast / EPDP Phase 2 Meeting #2 - Thursday 16 May at 14.00 UTC
by Terri Agnew May 16, 2019

May 16, 2019

Please use this updated link for the audio stream: http://stream.icann.org:8000/stream02 or itunes: http://stream.icann.org:8000/stream02.m3u Thank you, Terri From: Gnso-secs <gnso-secs-bounces(a)icann.org> on behalf of Terri Agnew <terri.agnew(a)icann.org> Date: Thursday, May 16, 2019 at 9:40 AM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Cc: "gnso-secs(a)icann.org" <gnso-secs(a)icann.org> Subject: [gnso-secs] WORKING **Update on audio cast / EPDP Phase 2 Meeting #2 - Thursday 16 May at 14.00 UTC **UPDATE The audio cast is up and running, you are able to join at this time. Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Best, Terri From: Terri Agnew <terri.agnew(a)icann.org> Date: Thursday, May 16, 2019 at 8:41 AM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Cc: "gnso-secs(a)icann.org" <gnso-secs(a)icann.org> Subject: **Update on audio cast / EPDP Phase 2 Meeting #2 - Thursday 16 May at 14.00 UTC ***BIG NOTE: Please note we are having technical issues with the audiocast for today's EPDP- Phase 2 Team meeting. It will not be available to listen 'live', but of course, the recordings will be posted immediately after the meeting. We will keep you posted if any changes. This is for the 16 May meeting only. Thank you. Kind regards, Terri From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Terri Agnew <terri.agnew(a)icann.org> Date: Wednesday, May 1, 2019 at 9:18 AM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Cc: "gnso-secs(a)icann.org" <gnso-secs(a)icann.org> Subject: [Gnso-epdp-team] **Updated with audio cast / Proposed agenda and preparatory materials for EPDP Phase 2 Meeting #1 - Thursday 2 May at 14.00 UTC As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Thank you. Kind regards, Terri

1 0

WORKING **Update on audio cast / EPDP Phase 2 Meeting #2 - Thursday 16 May at 14.00 UTC
by Terri Agnew May 16, 2019

May 16, 2019

**UPDATE The audio cast is up and running, you are able to join at this time. Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u Best, Terri From: Terri Agnew <terri.agnew(a)icann.org> Date: Thursday, May 16, 2019 at 8:41 AM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Cc: "gnso-secs(a)icann.org" <gnso-secs(a)icann.org> Subject: **Update on audio cast / EPDP Phase 2 Meeting #2 - Thursday 16 May at 14.00 UTC ***BIG NOTE: Please note we are having technical issues with the audiocast for today's EPDP- Phase 2 Team meeting. It will not be available to listen 'live', but of course, the recordings will be posted immediately after the meeting. We will keep you posted if any changes. This is for the 16 May meeting only. Thank you. Kind regards, Terri From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Terri Agnew <terri.agnew(a)icann.org> Date: Wednesday, May 1, 2019 at 9:18 AM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Cc: "gnso-secs(a)icann.org" <gnso-secs(a)icann.org> Subject: [Gnso-epdp-team] **Updated with audio cast / Proposed agenda and preparatory materials for EPDP Phase 2 Meeting #1 - Thursday 2 May at 14.00 UTC As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u Thank you. Kind regards, Terri

1 0

Fwd: [council] Fwd: [CORRESPONDENCE] Cherine Chalaby to Keith Drazek EPDP Phase I Board Action (preview version)
by Rafik Dammak May 16, 2019

May 16, 2019

Hi all, please find this regarding the board vote on EPDP phase 1 recommendations. Best Regards, Rafik ---------- Forwarded message --------- De : Drazek, Keith via council <council(a)gnso.icann.org> Date: jeu. 16 mai 2019 à 13:49 Subject: [council] Fwd: [CORRESPONDENCE] Cherine Chalaby to Keith Drazek EPDP Phase I Board Action (preview version) To: council(a)gnso.icann.org <council(a)gnso.icann.org> Cc: karklinsj(a)gmail.com <karklinsj(a)gmail.com>, gnso-secs(a)icann.org < gnso-secs(a)icann.org> All, Please see below for the ICANN Board’s communication to the GNSO Council regarding the Board’s 15 May action on the EPDP Phase 1 recommendations. The Board approved 27 of the 29 recommendations in full, and did not adopt *parts* of the remaining two recommendations. They deferred adopting Recommendation 1, Purpose 2 to further consideration in EPDP Phase 2, and did not adopt the portion of Recommendation 12 that permitted deletion of registrant/organization field data. Everything else was adopted. There are also some important questions/comments for IRT consideration on nine recommendations highlighted in the attached. In not fully accepting the GNSO recommendations, we now have a bylaws-mandated consultation period in effect. My understanding is there is no deadline for concluding those consultations, but we should take some time to consider next steps during our 16 May Council call and over the coming weeks. All in all, this is very good news and a step forward, but it also highlights the importance of the IRT for Phase 1, the unfinished Phase 2 policy work, and the continuing engagement with the European Commission and relevant data protection authorities. I look forward to speaking with you all in just a few hours. I have copied Janis on this message as the EPDP Team has its next working call shortly after the GNSO Council call. Best, Keith Begin forwarded message: *From:* Wendy Profit <wendy.profit(a)icann.org> *Date:* May 16, 2019 at 12:14:27 AM EDT *To:* Keith Drazek <kdrazek(a)verisign.com>, Chris Disspain < chris.disspain(a)board.icann.org>, "leon.sanchez(a)board.icann.org" < leon.sanchez(a)board.icann.org> *Cc:* Cherine Chalaby <cherine.chalaby(a)board.icann.org>, " karklinsj(a)gmail.com" <karklinsj(a)gmail.com>, "gnso-secs(a)icann.org" < gnso-secs(a)icann.org>, "David Olive" <david.olive(a)icann.org>, Secretary < secretary(a)icann.org>, Correspondence <Correspondence(a)icann.org>, Board Ops Team <board-ops-team(a)icann.org> *Subject:* *[EXTERNAL] Re: [CORRESPONDENCE] Cherine Chalaby to Keith Drazek EPDP Phase I Board Action (preview version)* Resending with Chris Disspain and León Sánchez (EPDP Liaisons from the Board) in copy. *From: *Wendy Profit <wendy.profit(a)icann.org> *Date: *Wednesday, May 15, 2019 at 9:10 PM *To: *Keith Drazek <kdrazek(a)verisign.com> *Cc: *Cherine Chalaby <cherine.chalaby(a)board.icann.org>, " karklinsj(a)gmail.com" <karklinsj(a)gmail.com>, "gnso-secs(a)icann.org" < gnso-secs(a)icann.org>, David Olive <david.olive(a)icann.org>, Secretary < secretary(a)icann.org>, Correspondence <Correspondence(a)icann.org>, ICANN Board Ops <board-ops-team(a)icann.org> *Subject: *[CORRESPONDENCE] Cherine Chalaby to Keith Drazek EPDP Phase I Board Action (preview version) Dear Keith Drazek, Please find the attached letter from Cherine Chalaby regarding the ICANN Board action related to the GNSO’s EPDP on the Temp Spec for gTLD Registration Data policy recommendations. Please note the attached letter is the “preview version”; whereas the version which will be published on the ICANN Correspondence page will include URLs for the Board Resolutions once they are published (see highlights on pages 7 & 8 of the attached annexes). We will re-send the final version of the attached letter after the Board Resolutions are published. Thank you and best regards, Wendy Profit Senior Manager, Board Operations ICANN _______________________________________________ council mailing list council(a)gnso.icann.org https://mm.icann.org/mailman/listinfo/council

5 4

**Update on audio cast / EPDP Phase 2 Meeting #2 - Thursday 16 May at 14.00 UTC
by Terri Agnew May 16, 2019

May 16, 2019

***BIG NOTE: Please note we are having technical issues with the audiocast for today's EPDP- Phase 2 Team meeting. It will not be available to listen 'live', but of course, the recordings will be posted immediately after the meeting. We will keep you posted if any changes. This is for the 16 May meeting only. Thank you. Kind regards, Terri From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Terri Agnew <terri.agnew(a)icann.org> Date: Wednesday, May 1, 2019 at 9:18 AM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Cc: "gnso-secs(a)icann.org" <gnso-secs(a)icann.org> Subject: [Gnso-epdp-team] **Updated with audio cast / Proposed agenda and preparatory materials for EPDP Phase 2 Meeting #1 - Thursday 2 May at 14.00 UTC As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u Thank you. Kind regards, Terri

1 0

IPC's Comments on the Legal Memo's
by Alex Deacon May 16, 2019

May 16, 2019

Hi, Here are the IPC's questions on the legal memos. As a general question about the legal memos: are these to be considered legal advice to the EPDP team? Are they legal advice to ICANN Org? Is there an attorney/client relationship between Bird and Bird and ICANN Org? As our work may impact the legal posture and liabilities of ICANN Org, we should be clear that counsel has a fiduciary duty to the EPDP team and not to ICANN Org, which could present a conflict of interest. This approach was effective for the CCWG-Accountability group, and should be employed here. * 6(1)(b)* 1. Has Bird and Bird considered that ICANN fulfills its contract with registrants by coordinating a *secure, stable, resilient* DNS, which all of ICANN’s advisory committees have clearly stated requires registration data processing? To fulfill its end of the contractual framework that flows through to registrants, it is necessary for ICANN to enable registration data processing. 2. This legal memo addresses part of WP217. Has Bird and Bird considered the allegory presented in WP217, “For example, the establishment of a company-wide internal employee contact database containing the name, business address, telephone number and email address of all employees, to enable employees reach their colleagues, may in certain situations be considered as necessary for the performance of a contract under Article 7(b)…” How does the 6(1)(b) basis apply in this context? What corollaries can be drawn to registration data? 3. How does the Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects ( https://edpb.europa.eu/our-work-tools/public-consultations/2019/guidelines-…) impact this advice? *Natural vs. Legal and Technical Contact Memos* 1. Did Bird and Bird consider the obligations already present under Sections 3.7.7 of the Registrar Accreditation Agreement, and under the WHOIS Accuracy Program Specification ( https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en#who… They are relevant, but are not cited. Considering these provisions, how does this change the advice provided? 2. Accuracy of Personal Data: What is the definition of Accuracy and whom determines the level of importance? 3. Risk of Liability: How is this defined? What are the perimeters of risk associated with inaccuracy registrant data? 4. Is sending a confirmation associated with registrant data considered a trigger to decrease the risk of liability? *Accuracy* 1. It would be helpful to receive additional guidance would be helpful as it pertains to “serious consequences” referenced in paragraph 8? 2. Please identify the “relevant parties” referenced in paragraph 21? *Thick WHOIS Memo* 1. In Paragraph 1.1 Bird and Bird claims that registrars and registries are data controllers – why? It seems that ICANN, in its contracts and policies, determines the purposes for which and means by which data is processed ( https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-busine…) Registries and registrars do not become controllers by virtue of participation in the policy development process; this logic would result in non-contracted participants in the policy development process also being data controllers, which would be an absurd result. In what other sense are registrars and registries data controllers? 2. In Paragraph 3.1, considering Thick WHOIS consensus policy has determined that thin WHOIS is insufficient to protect registrants, and Thick WHOIS was determined to be necessary for the performance of the contract, why does Bird and Bird disagree? As we note above, registering a domain name in the ICANN-coordinated DNS comes with expectations about the security, stability, and resilience of the service provided. 3. Why does Bird and Bird not consider the benefits of Thick WHOIS policy to domain name registrants in Paragraph 3.7 or in 3.11-12? https://gnso.icann.org/en/group-activities/active/thick-whois Alex On behalf of the IPC.

1 0

BC Comments on the Phase 2 Proposed Approach
by Margie Milam May 15, 2019

May 15, 2019

Dear All, On behalf of the BC – here are our comments on the draft approach for Phase 2: * Slide 1: * Objective – is to produce a consensus policy that describes the policies for access to non-public registration data for third parties. As previously noted, this information may be personal or non-personal data. * We believe “legal certainty” is not the appropriate standard; while we agree it’s a goal to minimize risk on the contracted parties, the development of the system can proceed in parallel with the effort to minimize risk. It is unlikely that “legal certainty” will ever be attained; but through this process we can solicit and hopefully receive recognition that the system reduces the risk of providing access. * We do not think the word “disclosure” should be used in lieu of “access”. The letters from the European Commission indicate “we have constantly urged ICANN and the community to develop a unified access model that applies to all registries and registrars and provides a stable, predictable, and workable method for accessing non-public gTLD registration data for users with a legitimate interest or other legal basis as provided for in the General Data Protection Regulation (GDPR).” * Slide 3: The definitions are confusing and should not be adopted. It is clear from the quote above that the EC and the ICANN community thinks of “access” in the context of third party access – limiting the definition of “access” to only be applicable to the registrant or data subject is problematic. The refence to the cite ico.org.uk page<https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-…> is not relevant because that page refers to “subject access” which is a different concept than what is intended to be accessed through a UAM. * Slide 4: - reference “Standardized Access of Non-Public Data” instead of “Standardized Disclosure of Non-Public Data” * Work Stream 2 – is missing topics from the Phase 1 Final Report: * Data Accuracy and the WHOIS Accuracy Reporting System: See footnote 6 in the Final Report: The topic of accuracy as related to GDPR compliance is expected to be considered further as well as the WHOIS Accuracy Reporting System. * Revisiting Purpose 2 in light of the GDPR concerns raised in the EC Letters * Revisiting topics in legal memos delivered after the Final Report to see if they affect our analysis. The recent correspondence from the EC may lead to updates to the Bird & Bird analysis, and thus, may impact some of the policy recommendations from Phase 1. * Slide 5: It is unclear what is meant by “centralized or decentralized” model, so we should be more clear, since it could be referring to centralized/decentralized accreditations, request submissions, data access systems or data storage. In addition, we should add other topics – such as “risk mitigation” * Slide 6: The timeline for workstream should be shortened. The timeline has a Final Report published more than 1 year away, which is much too long. Under this proposed plan, the board approval would be towards the end of next year, and implementation would be years away. Our timeline should reflect the “expedited” nature of this work and the importance to the Internet Ecosystem. Mark and I look forward to discussing these issues on our next EPDP call. All the best, Margie and Mark

1 0

Reminder - action item review of legal memos
by Marika Konings May 15, 2019

May 15, 2019

Reminder: EPDP Team Members to review all Phase 1 legal memos: https://community.icann.org/pages/viewpage.action?pageId=105386422 and identify any clarifying questions by 15 May at the latest to determine whether a briefing by Bird & Bird is needed. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Caitlin Tubergen <caitlin.tubergen(a)icann.org> Date: Thursday, May 2, 2019 at 10:50 To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Notes and action items from EPDP Phase 2 Meeting #1 Dear EPDP Team, Please find the notes and action items from today’s EPDP Team meeting below. Best regards, Marika, Berry, and Caitlin -- EPDP Phase 2 Meeting #1 2 May 2019 Action Items 1. Staff to develop worksheet templates for all topics in phase 2. EPDP Team Members to provide feedback on proposed worksheet template, both substance and outline. 2. EPDP Team Members to review all Phase 1 legal memos: https://community.icann.org/pages/viewpage.action?pageId=105386422 and identify any clarifying questions by 15 May at the latest to determine whether a briefing by Bird & Bird is needed. 3. Janis to reach out to Goran Marby to obtain further information in relation to the expectations, working methods and time commitment expected from the small team that is to work with ICANN Org to move forward the discussions with DPAs on UAM. 4. Leadership team to develop first draft of proposed approach / work plan for review during next EPDP Team meeting (16 May 2019). 5. Staff to schedule separate zoom training session for interested EPDP Team members. Questions for ICANN Org 1. Is there an attorney-client relationship between ICANN Org and Bird & Bird?  Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/ZwPVBQ. 1. Roll Call & SOI Updates (5 minutes) * Attendance will be taken from Zoom * Remember to mute your microphones upon entry to Zoom, which is typically the first icon on the left on the bottom toolbar. * Please state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Brief introduction to Zoom (5 minutes) * The bottom toolbar provides helpful icons, such as: * Mute, look to the left of the bottom toolbar. Please mute upon entry. * Manage Participants - your name will always be at the top, then hosts, co-hosts, then anyone with an open mic, then alphabetical order. * Chat - you will only see Zoom chat from the time that you joined the meeting and nothing before you joined. However, the full chat will be sent to the list following the meeting. * In order to see both screens, you must go to the top toolbar and toggle. The agenda will be shared by Andrea or Terri. The documents will be shared by EPDP staff support - Marika, Caitlin, or Berry. * Question: how will the queue be managed as it does not appear the queue appears in the order in which hands are raised? 3. Welcome from EPDP Team Chair (10 minutes) a. Chair introduction * Congratulations on completing the Phase 1 Final Report. * Applying to this position was a desire to return to the ICANN community after retiring as GAC chair in 2010. My goal is to reach a good conclusion. * I have met with the ICANN CEO as well as members of ICANN staff. * Some constituencies have reached out to me directly. I have spoken to IPC, and I am willing to do the same for any other interested group. * As a result of today’s conversation, I will make a draft outline of Phase 2, to be discussed during our next call on Thursday, 16 May. * I have been in public service for 27 years. From 2007 - 2010, I was the GAC Chair. * For Phase 2, the focus should be standardized access and outstanding issues from Phase 1. * My understanding is the EPDP Team would like a less rigorous schedule after Phase 1; however, it will still be important to establish a target date for Phase 2 completion. * Proposal to proceed with weekly calls of 90 minutes. There will be homework between each call - each group should express their views on the call topic after the call. Team members should not only talk, but also listen. Questions/Comments · Regarding a proposed target date - it would be reasonable to develop a work plan and identify an estimated time for each issue before identifying a target date. · Regarding the recent email from Keith Drazek referencing dialogue b/w Goran’s team and data protection authorities, it would be helpful if the details of this conversation are shared with this team. * The proposed target date will flow from the proposed work plan. b. EPDP Statement of Participation – reminder 4. Phase 2 Potential modalities of work – Marika Konings (15 minutes): 1. Scope (see mind map - EPDP Team Phase 2 - upd 10 March 2019.pdf<https://community.icann.org/download/attachments/105388008/EPDP%20Team%20Ph…>) · A number of items were identified in the original EPDP Charter - including standardized access to registration data and the annex of further issues for community consideration · In addition, as a result of Phase 1 work, there were a number of items that were deferred. · Staff created a mind map to organize the issues. o Yellow items are deferred items from Phase 1 o Blue items come from the charter re: standardized access. o White items come from charter re: the annex. 1. Use of worksheets to ensure a common understanding and agreement in relation to scope / issues to be discussed; information to be gathered; briefings to be planned; legal questions to be answered; dependencies identified, and; approach to be taken. · Example worksheet - privacy/proxy issues · One hope from staff support - if the Team is OK using this as a template, we could build upon it, add deliberations, proposed recommendations, and ultimately include it in the Initial Report. · Issue description and Charter question - this comes from Phase 1. Support staff added expected deliverable. (As a reminder, this deals with display of information by affiliated P/P providers.) · There is a section where legal questions could be identified. Support staff did not identify any legal questions at this time. · There is a section for required reading and briefings to be provided. In Phase 1, for example, the Team identified that it would be helpful to have a GDPR briefing. · There is a section for dependencies. · Lastly, there is a section for proposed timing and approach. This is the section where we anticipate the group to identify proposed approach and dependencies. · The template is a starting point. If this is helpful, support staff will move forward and complete templates for all of the identified issues. If you believe this is unhelpful and/or something is missing, please let us know so we can edit the template accordingly. Questions/Comments 5. Discussion of phase 2 process, focus, timeline and expected outcomes (45 minutes) a. Each team and team member to provide their input on expectations and vision for phase 2: * RySG - The Registries Stakeholder Group is committed to participating actively and in good faith to develop appropriate consensus policy recommendations around access to non-public registration data per our charter and to ensuring such recommendations provide a clear path to compliance with the GDPR, are commercially reasonable and implementable, take into account our differing business models, and do not inhibit innovation. We agree that developing a responsible and reasonable timeline and milestones are important to ensuring a comprehensive approach to the important work of Phase 2, however we note that this is something we will need to discuss within our stakeholder group to ensure proper resourcing is available. * RrSG - Three concerns and objectives - first, to gain some sort of legal and regulatory assurances that we can participate in an access model. We have operational concerns because we do not know what volume we expect. We must also guard against abuse. There are also economic concerns - deploying a system such as this will likely be expensive. With respect to a target date, the pace of Phase 1 was unsustainable. It’s reasonable to set a target date but the date should be supported by a realistic work plan. We’d like clarity regarding Goran’s proposal for a small group to interact with DPAs. * IPC - The IPC would like to get to consensus on recommendations related to questions in the charter. We hope we can reach agreement on a concrete and specific group of third parties who may access non-public registration data. We hope there is agreement on questions related to access that strikes a balance b/w privacy rights of the registrant and the legitimate interests of third parties. We believe Phase 2 work should occur in two concurrent workstreams. One workstream should be standardized access and the other workstream will be deferred issues from Phase 1. We would like to see demonstrable progress by the Montreal meeting. * BC - It will be helpful to set a date and get this done quickly. Essential to ensure ICANN is complying with the GDPR. We hope the work plan will move quickly and focus on the important work of the TSG and the unified access model. We believe it’s critical to the security and stability of the DNS to provide access to non-public registration data. One of the first things to focus on is third party interests. One work track should be focused on unified access model. The other work track should focus on issues deferred from Phase 1. * ISPCP - Looking forward to working with you all in a collegial manner towards a solution compliant with GDPR. * NCSG - Build upon what was recommended in Phase 1, particularly the items that had consensus. The stakeholder group is a basic unit of representation - we advise the Chair to keep in mind that constituencies are not the same as stakeholders group. As we deal with legitimate interest, this should be done on a case-by-case basis - we do not see the process of disclosure by a group being categorically accredited as having a legitimate interest. We would like the team to consider whether a data privacy impact assessment needs to be conducted- specifically article 34 of the GDPR. * GAC - We concur with much of what has been said so far, particularly by the RrSG and IPC. We would like any system to be GDPR compliant and to meet the various needs in the group. A target date would be ideal, and we are looking forward to a commitment to meeting a timeline in Phase 2. We would like to put forward 12 months as a target date. We also believe in categories of interests - in order to help set a process for credentialing. If workstreams can be done in parallel, that would be helpful. We could also look to the TSG to help guide our work. * ALAC - Committed to seeing this through and that we end up with something that protects privacy where appropriate. We also need to consider the needs of those that want access. The EU comment on the Phase 1 Final Report indicated that we have a responsibility to balance the interests. We have a concern with a UAM if we look at data elements which every group will get access to and look to the conditions of every request, we may be here forever. If we serialize the two work streams, we may end up changing the rules as contracted parties are already implementing recommendations. Working in parallel could be helpful. * SSAC - Wish to avoid the unsustainable pace that occurred at the end of Phase 1; however, we do need to maintain momentum to have reliable and predictable access to appropriate levels of registration data. Emphasize SSR issues as it relates to the Internet ecosystem as a whole. Our focus will include appropriate legitimate access for security researchers. * Board liaisons * ICANN Org liaisons - As per the EPDP Charter - we are here to provide timely input on ICANN org-related questions. We are not here to advocate for a specific position or to participate on consensus calls. * Everyone is eager to get back to work. No one questioned the outcome of Phase 1 or the GDPR. The team cannot establish the target date until we review the tasks ahead of us and the pace at which we want to accomplish the tasks. There did not seem to be any objections to working in parallel, so we can take that into account when building the work proposal. 6. Review of legal guidance obtained during phase 1 (5 minutes) * Proposed approach · All legal memos are housed on the wiki: https://community.icann.org/pages/viewpage.action?pageId=105386422 · EPDP team members should review all of the legal memos · Proposal to have a call with Bird & Bird to review the memos · All Team members please review or revisit the legal memos. If there is a prevailing feeling that we need to organize a special briefing, we can do so. If not, we will not. * Discussion · Does Bird & Bird have attorney-client relationship with ICANN org? 7. ICANN65 planning – 1. EPDP Team Phase 2 meetings planned: * Tuesday 25 June from 8.30 – 15.00 * Thursday 27 June from 8.30 – 15.00 2. IRT meetings planned: * Wednesday 26 June from 10.30 – 12.00 3. Travel support – Staff support team is following up with those who identified a potential need. As a reminder, requirement is that the requesting member is (1) otherwise not able to attend AND (2) no alternate is already funded to ICANN65. * Please let us know as soon as possible if you have not yet responded. * Per the previous process, supported members will be posted to the wiki page. · Please note that these meeting dates and times are still tentative - members should already pencil these in, but a confirmation will come later once the overall schedule has been finalized. · Janis will not be able to attend the entire Marrakech meeting due to a family commitment. Rafik agreed to moderate the conversation on 25 June. · Goran Marby letter regarding sub team - is there any objection to creating a sub team? The main issue of the sub team would be what kind of policy questions do we need to raise in relation to a unified access model. Feedback · The track Goran is working on is a siloed effort from what this team is doing. Caution against more silos with smaller groups of people working. · Understanding what may be required to potential volunteers would be helpful. For example, is travel required, how often will the team meet, where will the team meet, etc. · This is an excellent idea - it’s good that ICANN is doing its best to get clarification now regarding uniform access. It’s also a good idea b/c it provides transparency into the conversations that are happening. · It is important if we form a group, we understand what this group is doing. Also, those within the EPDP should know what is going on within ICANN. If we are going to do this, we need representation, which may the group larger than it would otherwise be. · Constant consultation with DPAs on models, until we decide to differentiate b/w one request and another, we may not get anywhere. We need to come up with a model of layered access. There were a number of policy decisions inherent in the TSG’s work - proceeding ahead where policy decisions are made at the ICANN org level instead of at the community level is worrisome. Building the TSG system may be overkill - contracted parties may be able to handle requests without using a big, expensive system. · Recommendation 3 - a unified access model is one form, but not the only form, of standardized access. The proposed TSG is one form, but not the only form, of a model. It’s unclear everyone is referring to the same thing when referring to UAM. · Action: Janis to reach out to Goran to get more confirmation. 8. Wrap and confirm next meeting to be scheduled for Thursday, 16 May at 14.00 UTC (5 minutes) 1. Proposed call schedule going forward · 90-minute call every Thursday at 14:00 UTC 2. Confirm action items 3. Confirm questions for ICANN Org, if any · No meeting next week, but will discuss the proposed work plan on 16 May. · We may consider a F2F meeting b/w Marrakech and Montreal but that can be discussed at a later meeting.

3 2

Re: [Gnso-epdp-team] [Ext] RE: For your review - Phase 2 Draft Approach
by Marika Konings May 15, 2019

May 15, 2019

Apologies, it looks like the pdf conversion got rid of the ticks. We’ve replaced them with ‘X’ in the attached version. Best regards, Caitlin, Berry and Marika From: "Mueller, Milton L" <milton(a)gatech.edu> Date: Wednesday, May 8, 2019 at 15:35 To: Marika Konings <marika.konings(a)icann.org>, "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Ext] RE: For your review - Phase 2 Draft Approach Hi, Looks like Janis and staff have been busy! I have a question about Slide 7. There are no “X’s” or ticks in the columns for WS 1 and WS 2. So I can’t tell what this means. Are we proposing (I hope) that WS1 meets on Tuesdays and WS2 meets on Thursdays? Or is this still open-ended? --MM From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> On Behalf Of Marika Konings Sent: Wednesday, May 8, 2019 2:07 PM To: gnso-epdp-team(a)icann.org Subject: [Gnso-epdp-team] For your review - Phase 2 Draft Approach Sending on behalf of Janis Karklins Dear EPDP Team, Following last week’s meeting, the leadership team and staff support have worked together on developing a draft approach for tackling phase 2. We hope this strikes a balance between the different views expressed and will form the basis for a detailed work plan with concrete milestones and deliverables. You will find attached a couple of slides that outline our current thinking in further detail, but here are some points I want to emphasize: * This is a draft approach for discussion and review. Based on your input prior and our discussion during next week’s meeting, we will further iterate and detail our approach, the proposed work plan and accompanying timeline. This draft is for discussion that, hopefully, will lead to a consensual agreement. * For the purpose of our exercise it is important to use definitions and terminology with the same understanding. We propose to develop and use working definitions without prejudice to consensual outcome. Final definitions can only be developed once the Team has finalized its work and agreed on its recommendations. * Based on the Team’s feedback in relation to the request to form a small team to engage with ICANN Org, I suggest to keep a plenary setting which will avoid creating a separate structure and ensure that everyone is part of discussion. Nevertheless, as this work on obtaining legal certainty is ongoing, I would propose that we deal with the charter questions and list of issues identified on slide 5 in an agnostic manner. In other words, we should refrain at the outset to deliberate on whether or not a System for Standardized Disclosure should be centralized or not, but rather we should focus on the commonalities and where needed identify that differentiation may be required depending on which model is ultimately determined to be legally compliant with GDPR and workable. I also expect that this approach would help inform the engagement of ICANN org and DPAs. * I appreciate that some of you may consider the timeline ambitious, but I’ve heard from almost everyone that the work on a System for Standardized Disclosure is a priority and as such I am committed to setting a target date for us to work towards. This will require your support and dedication. I am pretty confident I can count on that. I look forward to receiving your feedback and would like to encourage you to focus your input on what, why and how things could or should be done differently, instead of simply saying that something cannot be acceptable or should not be done. Janis Karklins Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

6 8