June 2019 - Gnso-epdp-team - lists.icann.org

Legal Advisory Group modalities
by Janis Karklins June 5, 2019

June 5, 2019

Dear EPDP Team, Further to the discussion in our recent meeting, please find an outline of the approach to handling legal questions and the chair-appointed members of the Legal Advisory Group. Those of you who participated in Phase 1 will remember we established a Legal Committee to review and revise proposed legal questions to ensure: (1) the questions are truly legal in nature, as opposed to policy or policy implementation questions; (2) the questions are phrased in a neutral manner, avoiding both presumed outcomes as well as constituency positioning; (3) the questions are both apposite and timely to the EPDP Team’s work; and (4) the limited budget for external legal counsel is being used responsibly. In order to forward these goals, I proposed that I work together with a small team of chair-appointed legal experts to review legal questions as they come in. The membership of this team is not representative, but expertise based. Members of the Legal Advisory Group are asked to provide advice based on their legal experience, factoring in all aspects of the conversation, not only that of their respective constituency. It is important to state that any output of deliberations of the Legal Advisory Group will be shared with the EPDP Team for review and agreement. At this time, I do not anticipate a weekly meeting schedule; the Legal Advisory Group will meet on an as-needed basis. The meetings will be open to anyone from the EPDP Team who would like to attend; however, only the chair-appointed legal experts will be invited to speak. I have also asked EPDP Support Staff to provide a recommendation for an initial categorization of the clarifying legal questions received. Specifically, Support Staff has reviewed the questions to determine: 1. if the questions relate to Phase 2 issues identified in the Mind Map, i.e., charter questions, questions in the Annex: Important Issues for Further Community Action, or issues deferred from Phase 1. 2. If the question is NOT related to the EPDP Team’s Phase 2 work, it will not be reviewed further. If the question does relate to Phase 2 work, Support Staff will align the question with the relevant Phase 2 issue and determine if the Phase 2 issue is a Priority 1 or a Priority 2 item. 3. Priority 1 questions, or questions related to a system for standardized access/disclosure, will be reviewed first. 4. Priority 2 items will be moved to the corresponding worksheets for further discussion following EPDP Team agreement on the scope and expected deliverable of the topic. 5. Once the initial parameters are agreed to, the Legal Advisory Group can better determine necessary legal guidance (if any) and will begin working on the Priority 1 questions identified. I have asked the following members to the Team to donate their time to the Legal Advisory Group: Laureen Kapin Brian King Margie Milam Thomas Rickert Kristina Rosette Tatiana Tropina I invited these individuals due to their legal expertise, but also that they would provide diverse views to ensure that the different perspectives on the EPDP Team will be considered. Legal Advisory Group’s activities will be supported by ICANN staff and ICANN Org liaison (Legal) will attend the meetings and will be engaging with the Group when asked. You will find an updated table with Support Staff’s preliminary recommendations attached. Thank you JK

6 7

EPDP Phase 1 Factsheet
by mail＠berrycobb.com June 5, 2019

June 5, 2019

Hi All, Please find attached the final EPDP Phase 1 Factsheet. We apologize for the delay, but it took a while to fully reconcile actual expenses within the ICANN finance system with what we tracked manually as expenses were incurred by the EPDP. Prior distributions only included the page 1 summary. This final version, however, includes details of the expenses for Professional Services and Face-to-Face Meeting travel. It also includes an expanded view of the project activity and resources used over the eight months. In short, $424,883 of the committed $590,000 was consumed for Phase 1. 1. Page 1 is a summary as provided monthly over the course of the project 2. Page 2 provides details for the professional services (CBI, Verizon, Bird & Bird, and IT Governance) 3. Page 3 displays expenses by type for the three face to face meetings (Los Angeles, Barcelona, and Toronto) 4. Pages 4 & 5 provide telcom expenses by category and email traffic activity 5. Page 6 summarizes the key milestones and deliverables As noted in recent correspondence to the GNSO, the ICANN Board provided resources in the near-term for Phase 2 in FY19 and committed to additional resources being available once the EPDP has developed a full work plan of its activities. Staff has created a fresh EPDP-Phase 2 Factsheet to track this effort separate from Phase 1. I suspect the first version of Phase 2 activities will first occur in August after ICANN65 expenses have been fully realized. This is also posted on the EPDP wiki under Phase 1 https://community.icann.org/pages/viewpage.action?pageId=88574682. Please let me know if you have any questions. Thank you. B GNSO Policy Consultant @berrycobbb

2 1

updated working definitions document
by Caitlin Tubergen June 5, 2019

June 5, 2019

Dear EPDP Team, Thank you for your feedback on the working definitions. Please find the updated working definitions document attached. Best regards, Marika, Berry, and Caitlin

1 0

RySG GNSO Council input
by Anderson, Marc June 5, 2019

June 5, 2019

All, On behalf of the RySG team, our input for the GNSO council’s consultation with the board is attached. Thank you, Marc Marc Anderson mcanderson(a)verisign.com<mailto:mcanderson@verisign.com> Cell: 571.521.9943 Office: 703.948.3404 12061 Bluemont Way, Reston, VA 20190 Verisign.com<http://www.verisign.com/>

1 0

**Reminder** Meeting Invitation: Observers GNSO Temp Spec gTLD RD EPDP - Phase 2 call / Thursday, 06 June 2019 at 14:00 UTC
by Julie Bisland June 5, 2019

June 5, 2019

**Updated with telephone join option (see below) As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 06 June 2019 at 14:00 UTC for 120 minutes. (calls will be scheduled for 120 minutes but aim to keep to 90 minutes) 07:00 PDT, 10:00 EDT, 16:00 Paris CEST, 19:00 Karachi PKT, 23:00 Tokyo JST, (Friday) 00:00 Melbourne AEST For other times: https://tinyurl.com/y37actos [tinyurl.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__tinyurl.com_y37actos&d…> Agenda Wiki: https://community.icann.org/x/6YSGBg The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream02 <https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream02.m3u <https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> If needed, an option to join via telephone has been added for this meeting. Passcode: EPDP Telephone numbers: Dial in numbers: Country Toll Numbers Freephone/ Toll Free Number ARGENTINA 0800-777-0519 AUSTRALIA ADELAIDE: 61-8-8121-4842 1-800-657-260 AUSTRALIA BRISBANE: 61-7-3102-0944 1-800-657-260 AUSTRALIA CANBERRA: 61-2-6100-1944 1-800-657-260 AUSTRALIA MELBOURNE: 61-3-9010-7713 1-800-657-260 AUSTRALIA PERTH: 61-8-9467-5223 1-800-657-260 AUSTRALIA SYDNEY: 61-2-8205-8129 1-800-657-260 AUSTRIA 43-1-92-81-113 0800-005-259 BELGIUM 32-2-400-9861 0800-3-8795 BRAZIL RIO DE JANEIRO: 55-21-40421490 0800-7610651 BRAZIL SAO PAULO: 55-11-3958-0779 0800-7610651 CHILE 1230-020-2863 CHINA CHINA A: 86-400-810-4789 10800-712-1670 CHINA CHINA B: 86-400-810-4789 10800-120-1670 COLOMBIA 01800-9-156474 CROATIA 080-08-06-309 CZECH REPUBLIC 420-2-25-98-56-64 800-700-177 DENMARK 45-7014-0284 8088-8324 ESTONIA 800-011-1093 FINLAND 358-9-5424-7162 0-800-9-14610 FRANCE LYON: 33-4-26-69-12-85 080-511-1496 FRANCE MARSEILLE: 33-4-86-06-00-85 080-511-1496 FRANCE PARIS: 33-1-70-70-60-72 080-511-1496 GERMANY 49-69-2222-20362 0800-664-4247 GREECE 30-80-1-100-0687 00800-12-7312 HONG KONG 852-3001-3863 800-962-856 HUNGARY 36-1-700-8856 06-800-12755 INDIA INDIA A: 000-800-852-1268 INDIA INDIA B: 000-800-001-6305 INDIA INDIA C: 1800-300-00491 INDONESIA 001-803-011-3982 IRELAND 353-1-246-7646 1800-992-368 ISRAEL 1-80-9216162 ITALY MILAN: 39-02-3600-6007 800-986-383 ITALY ROME: 39-06-8751-6018 800-986-383 ITALY TORINO: 39-011-510-0118 800-986-383 JAPAN OSAKA: 81-6-7878-2631 0066-33-132439 JAPAN TOKYO: 81-3-6868-2631 0066-33-132439 LATVIA 8000-3185 LUXEMBOURG 352-27-000-1364 8002-9246 MALAYSIA 1-800-81-3065 MEXICO GUADALAJARA (JAL): 52-33-3208-7310 001-866-376-9696 MEXICO MEXICO CITY: 52-55-5062-9110 001-866-376-9696 MEXICO MONTERREY: 52-81-2482-0610 001-866-376-9696 NETHERLANDS 31-20-718-8588 0800-023-4378 NEW ZEALAND 64-9-970-4771 0800-447-722 NORWAY 47-21-590-062 800-15157 PANAMA 011-001-800-5072065 PERU 0800-53713 PHILIPPINES 63-2-858-3716 1800-111-42453 POLAND 00-800-1212572 PORTUGAL 8008-14052 ROMANIA 40-31-630-01-79 RUSSIA 8-10-8002-0144011 SAUDI ARABIA 800-8-110087 SINGAPORE 65-6883-9230 800-120-4663 SLOVAK REPUBLIC 421-2-322-422-25 0800-002066 SOUTH AFRICA 080-09-80414 SOUTH KOREA 82-2-6744-1083 00798-14800-7352 SPAIN 34-91-414-25-33 800-300-053 SWEDEN 46-8-566-19-348 0200-884-622 SWITZERLAND 41-44-580-6398 0800-120-032 TAIWAN 886-2-2795-7379 00801-137-797 THAILAND 001-800-1206-66056 TURKEY 00-800-151-0516 UNITED ARAB EMIRATES 8000-35702370 UNITED KINGDOM BIRMINGHAM: 44-121-210-9025 0808-238-6029 UNITED KINGDOM GLASGOW: 44-141-202-3225 0808-238-6029 UNITED KINGDOM LEEDS: 44-113-301-2125 0808-238-6029 UNITED KINGDOM LONDON: 44-20-7108-6370 0808-238-6029 UNITED KINGDOM MANCHESTER: 44-161-601-1425 0808-238-6029 URUGUAY 000-413-598-3421 USA 1-517-345-9004 866-692-5726 VENEZUELA 0800-1-00-3702 VIETNAM 120-11751 Thank you. Kind Regards, Terri

1 0

RrSG GNSO Council input
by Sarah Wyld June 4, 2019

June 4, 2019

Hello all, The RrSG team's input for the GNSO Council’s consultation with the Board is attached, thank you. -- Sarah Wyld Domains Product Team Tucows +1.416 535 0123 Ext. 1392

1 0

Helpful information / Calendar view of meetings
by Terri Agnew June 4, 2019

June 4, 2019

Dear all, To help stay organized, in addition to the ics to download on your calendars there are three resources for you to find meeting dates and times for Council, PDP, EPDP and CCWG- Auction Proceed meetings. 1. Global calendar: All SO and AC events: https://features.icann.org/calendar 2. GNSO Master calendar: GNSO Working Groups, Council events, transcriptions, and recordings: https://gnso.icann.org/en/group-activities/calendar 3. GNSO Wiki: Working Groups and Council meeting agendas, recordings, notes, action items and background documents: https://community.icann.org/category/gnso Thank you. With kind regards, Terri --- Terri Agnew Operations Support - GNSO Lead Administrator Internet Corporation for Assigned Names and Numbers (ICANN) Email: terri.agnew(a)icann.org<mailto:terri.agnew@icann.org> Skype ID: terri.agnew.icann Find out more about the GNSO by visiting: https://learn.icann.org/ <https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO <https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> See All SO and AC events on the ICANN Global calendar<https://features.icann.org/calendar>

1 0

Fwd: Thanks for the invitation to brief the SSAC EPDP WG
by Benedict Addis June 4, 2019

June 4, 2019

A message of gratitude from Steve Crocker hereunder. Begin forwarded message: > From: Steve Crocker <steve(a)shinkuro.com> > Date: 30 May 2019 at 15:05:12 BST > To: Benedict Addis <bee(a)theale.co.uk> > Subject: Thanks for the invitation to brief the SSAC EPDP WG > > Benedict, > > Thanks very much for inviting me to brief the SSAC EPDP WG yesterday. > > The discussion about how the EPDP WG will react, and particularly how the illustrative list of Groups might be (mis)understood, made an impression. It intersects with some other thoughts I've been having about how to dissect this model into its components and how different constituencies might use this model. I'm tentatively invited to present our framework to them a week from today. I will make some adjustments in the presentation and try to avoid the implication that we've decided on a specific set of Groups. > > Feel free to forward this note to them and to express my thanks for their time and attention. > > Steve >

1 0

Re: [Gnso-epdp-team] For your review - Clarifying Legal Questions Table
by Heineman, Ashley June 4, 2019

June 4, 2019

Hello again. Apparently the following failed to be circulated as well. Please see below. From: Heineman, Ashley Sent: Thursday, May 30, 2019 9:59 AM To: gnso-epdp-team(a)icann.org Subject: RE: [Gnso-epdp-team] For your review - Clarifying Legal Questions Table Dear colleagues, In addition to the legal memo questions, the GAC Small Group proposes the following as a broader Phase 2 legal question for consideration. Can a centralized access/disclosure model (one in which a single entity is responsible for receiving disclosure requests, conducting the balancing test, checking accreditation, responding to requests, etc.) be designed in such a way as to limit the liability for the contracted parties to the greatest extent possible? IE - can it be opined that the centralized entity can be largely (if not entirely) responsible for the liability associated with disclosure (including the accreditation and authorization) and could the contracted parties’ liability be limited to activities strictly associated with other processing not related to disclosure, such as the collection and secure transfer of data? If so, what needs to be considered/articulated in policy to accommodate this? From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Georgios.TSELENTIS(a)ec.europa.eu<mailto:Georgios.TSELENTIS@ec.europa.eu> Sent: Thursday, May 30, 2019 7:12 AM To: vgreimann(a)key-systems.net<mailto:vgreimann@key-systems.net>; milton(a)gatech.edu<mailto:milton@gatech.edu> Cc: gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] For your review - Clarifying Legal Questions Table Dear Volker, Milton, EPDP colleagues, I am reading with great interest the reactions to the clarification questions we sent, in particular regarding accuracy. The mere fact that the community has different understandings as to what exactly it means in the WHOIS policy reform under GDPR begs for asking those questions and not putting the issue (again) under the carpet. We might come with an outcome that current accuracy measures are sufficient for WHOIS GDPR compliance, or that we need more to do. Anyhow at this stage those are clarification questions not a policy per se so I would welcome first the legal counsel to provide some informed opinion before any community jumping to conclusions. Best regards, Georgios From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Volker Greimann Sent: Wednesday, May 29, 2019 6:54 PM To: gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] For your review - Clarifying Legal Questions Table Hi Margie, the risk of the poor registrant losing his domain name due to inaccurate whois data is actually entirely of ICANNs making as contracted parties certainly do not need this data set for the purposes of maintaining the registration. We have account data for that. The only reason whois inaccuracies can cause a registrant to lose his domain is ICANN policies and contractual obligations regarding failures to update inaccurate data and registrars opting for deletion instead of deactivation (do such registrars still exist?). For all other purposes reasonable steps are already being taken, as I explained in my previous mail. Best, Volker Am 29.05.2019 um 18:38 schrieb Margie Milam: Hi Chris and all – To answer your question, the legal advice provided by Bird & Bird on accuracy addresses this issue and notes that there is a positive obligation on the controller to ensure the data is accurate depending on the circumstances and the consequences of processing inaccurate data. It also notes that a controller may have to get independent confirmation where the impact is particularly significant. In addition, the issue of data accuracy as part of a GDPR compliant system was also raised by the European Commission in its recent comments to the Board. In the case of domain names, the consequence of inaccurate data affects not just the registrant (who could lose its domain name), but those that may be trying to resolve technical issues, cyber-crime or consumer protection issues. We also have numerous studies conducted by ICANN over the last decade that show unacceptable levels of accuracy in the WHOIS system. This is why the question of accuracy was pushed to Phase 2 in our Phase 1 Final Report so that we could explore these issues further. See Footnote 6 where it says: The topic of accuracy as related to GDPR compliance is expected to be considered further as well as the WHOIS Accuracy Reporting System. All the best, Margie From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org><mailto:gnso-epdp-team-bounces@icann.org> on behalf of Chris Disspain <chris.disspain(a)board.icann.org><mailto:chris.disspain@board.icann.org> Date: Tuesday, May 28, 2019 at 9:48 AM To: "gnso-epdp-team(a)icann.org"<mailto:gnso-epdp-team@icann.org> <gnso-epdp-team(a)icann.org><mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] For your review - Clarifying Legal Questions Table Greetings All, I’m a little confused by this discussion. Apologies in advance if the below is wrong or naive or has been covered before. I don’t understand the connection between accuracy and GDPR. The regulations govern a registrars right to collect the data and what they can do with it. Assuming they have that right under GDPR, the registrants obligation to provide them with *accurate* data is not governed by GDPR but rather the contractual relationship between registrar and registrant and the registrar is entitled to require accurate information from the registrant pursuant to that. The registrar can also require the updating of changed information and/or proactively seek re-confirmation of accuracy. And ICANN, in its contract with a registrar, can require that registrar to require the registrant to provide accurate information. Other than governing the right to collect the information (and what can be done with it) does GDPR have some other role that I’m missing? Cheers, Chris On 28 May 2019, at 17:23, Volker Greimann <vgreimann(a)key-systems.net<mailto:vgreimann@key-systems.net>> wrote: Didn't we have (and settle) the same argument about six months ago? This principle is a protection of the data subject. When we create personal data from the data provided to us by the data subject or a third party, we must ensure we store it accurately and our processing does not falsify it. As such, the contractual provision that the data subject must provide to us accurate data (and keep uit updated when it changes) and the confirmation of the accuracy by the data subject is sufficient for our purposes and therefore reasonable in accordance with this principle. The principles protect the data subject, not third parties. Can we now please stop going over old settled issues? Volker Am 28.05.2019 um 18:06 schrieb Greg Aaron: Milton, no, the word “accuracy” does not appear only in GDPR Article 18. It appears most prominently in Article 5, which says: Art. 5 GDPR Principles relating to processing of personal data "1. Personal data shall be: ... (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);… 2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).” There has been discussion in legal and GDPR compliance communities that the above means all of these: a) Controllers have some responsibilities to take positive steps to ensure data collected from subjects is accurate. b) Organizations must allow data subjects to rectify inaccuracies. (Your point.) c) The data controller must carefully consider any challenges to the accuracy of information – no matter where that challenge comes from. d) Organizations must identify essential steps to erase or rectify inaccurate data without delay. And, e) Within some limits, the parties to a Date Sharing Agreement are free to agree on terms and conditions applicable to their sharing of data – for example specific obligations and warranties about the accuracy and completeness of data. How far the above extend, and how they apply to RDS data, is a Phase 2 subject for exploration. GDPR certainly discourages the submission or maintenance of data that is incorrect or misleading. And Article 5 seems to mean more than “trust implicitly whatever the data subject says, and correct the data only if the data subject itself requests.” The GDPR may contain some balancing mechanisms here, and proportionality is a general principle of EU law. So, given all that, and because there’s not a common understanding within our group, these issues are definitely good ones to ask Bird & Bird about. All best, --Greg From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org><mailto:gnso-epdp-team-bounces@icann.org> On Behalf Of Mueller, Milton L Sent: Saturday, May 25, 2019 9:18 AM To: Georgios.TSELENTIS(a)ec.europa.eu<mailto:Georgios.TSELENTIS@ec.europa.eu>; caitlin.tubergen(a)icann.org<mailto:caitlin.tubergen@icann.org> Cc: gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] For your review - Clarifying Legal Questions Table Dear Georgios and colleagues: I think the questions related to accuracy below are not worth sending to the lawyers. They are based on a fundamental misconception, one which we have identified many times. Accuracy in GDPR and other data protection law is a right _of the data subject_, not a right of third parties to accurate data about the data subject. To prove this, beyond a shadow of the doubt, let me note that the word “accuracy” appears in GDPR in only two places, in Art 18. Article 18, Right to restriction of processing: ----------------------------------------------------------- “The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;” So data subjects can contest the accuracy of data about them, or require controllers to verify its accuracy. There is NO OTHER reference to accuracy in the entire GDPR. Georgios’s questions are based on the assumption that third parties have a right to accurate contact data about the data subject. That assumption was embedded in the old Whois and pre-GDPR Whois accuracy policies, all of which were predicated on indiscriminate publication of the contact data to any and all third parties. That regime is gone. And it’s recognized even by the most militant pro-surveillance interests that such indiscriminate disclosure is illegal. Likewise, Georgios asks about liability under Article 82 of GDPR. Again all we need to do is actually read Art 82 to find the answer: Article 82 says “Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.” So this is a right of PERSONS (data subjects) to compensation based on illegal acts of controllers and processors of THEIR data. It is not a right of third parties to accurate information about the data subject, and it certainly creates no liability for controllers or processors for the inaccuracy of the registrants’ data. Dr. Milton L Mueller Georgia Institute of Technology School of Public Policy From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Georgios.TSELENTIS(a)ec.europa.eu<mailto:Georgios.TSELENTIS@ec.europa.eu> Sent: Friday, May 24, 2019 7:02 PM To: caitlin.tubergen(a)icann.org<mailto:caitlin.tubergen@icann.org> Cc: gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] For your review - Clarifying Legal Questions Table Dear Caitlin, colleagues, Please find below questions on the topics of the legal memos from the GAC: Accuracy . If current verification statistics provide that a large number of data is inaccurate isn't that a metric to deduce that the accuracy principle is not served in a reasonable manner as demanded by the GDPR? . According to the GDPR all personal data are processed based on the principle that they are necessary for the purpose for which they are collected. If those data are necessary, how can the purpose be served while the data are inaccurate? . Can you provide an analysis on the third-parties mentioned in para 19 on which "ICANN and the relevant parties may rely on to confirm the accuracy of personal data if it is reasonable to do so"? Do they become in such a scenario data processors? . How does the accuracy principle in connection to the parties' liability has to be understood in light of the accountability principle of the GDPR? What are the responsibilities of ICANN and the contracted parties (who are subject to the GDPR) under Chapter IV pf the GDPR? If the contracted parties (as data controllers) engage third entities as processors (e.g. to provide data back-up services), what are the responsibilities of these entities? What does this mean in terms of liabilities (in light of Art. 82 GDPR)? . While in the first place it is up to the registrants to provide accurate details about themselves and it is up to the registrants not to mistakenly identify themselves as natural or legal persons, the Memo on "Natural vs Legal persons" provides interesting ideas/suggestions for the contracted parties to proactively ensuring the reliability of information provided, including through measures to independently verify the data. Could similar mechanisms be identified also for ensuring the reliability of the contact details of the registrant? Can best practices be drawn from the ccTLD? Natural or non-natural persons . How is the (inaccurate or accurate) designation by the registrant about her status as non-natural person considered personal data information? If it's not is the analysis about whether the accuracy principle applies relevant? . How would the analysis provided take into account the possibility for registrants who are natural persons to "opt-in" for a full publication of their personal data? Indeed it might be the case that some of these registrants might wish to ensure their details are available on WHOIS. Technical contact Most of the issue for not allowing this seems to be around the inability to verify if the RNH has obtained consent from the technical contact. When the CP's verify the email address could consent also be confirmed for the term of the registration? General question: . How could anonymisatio/pseudonymisation techniques be of help in complying with the GDPR while also allowing for additional disclosure of certain data elements? E.g. use of anonymised/pseudonymised emails and names, in particular in the context of registrations by legal persons. Apologies again for the delay of our submission. Georgios Tselentis (GAC-EPDP) From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Caitlin Tubergen Sent: Wednesday, May 22, 2019 5:22 PM To: gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] For your review - Clarifying Legal Questions Table Dear EPDP Team, Following up on an action item from our last meeting, please find attached a table which organizes the clarifying legal questions received to date. We will discuss the table during our next meeting. Please note that the deadline for submitting additional clarifying questions is before 14:00 UTC on Thursday, 23 May. If additional questions come in before the deadline, we will update the table accordingly. Thank you. Best regards, Marika, Berry, and Caitlin _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefens…> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefens…>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefens…>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. -- Volker A. Greimann General Counsel and Policy Manager KEY-SYSTEMS GMBH T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefens…> Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Alexander Siffrin Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefens…> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefens…>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefens…>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmm.icann.…> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann…>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann…>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. -- Volker A. Greimann General Counsel and Policy Manager KEY-SYSTEMS GMBH T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net<https://gcc01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.key-sy…> Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Alexander Siffrin Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

1 0

IPC input on the SSAD worksheet
by Alex Deacon June 4, 2019

June 4, 2019

Hi, here is the IPC input on the SSAD Worksheet <https://docs.google.com/document/d/1uoolznpxb0JxddFZA5n9ueRkB4tjDOQQCoMeQWp…> General - The "Introduction" text on page 6 should specify our objective is to agree to recommendations and policy related to the sharing of non-public registration data, not “rules and requirements”. - We believe that we should not pre-suppose or assume the use of a code of conduct at this point in time. There may be other options available to us that will allow us to achieve the same goal. - Based on my question on the last call, let's clarify the text at the end of page 8. Replace “Following the completion of this effort” with “After receiving input from the EPDP team on this Worksheet, each topic….” - To avoid confusion or misinterpretation we should avoid paraphrasing or summarizing Phase 1 recommendation language. List of topics identified (page 6) – are there any topics missing? - The third bullet suggests we will be deciding the "Format" of request. The EPDP should not be concerning itself with issues of “format”. We need to focus on setting policy around the criteria and “contents” of requests, including which data/fields are mandatory and which may be optional. - The fourth bullet also mentions format - as above we should focus on the “what” not the “how”. - As stated above we should not pre-suppose or assume the use of a code of conduct at this point in time. Perhaps a more generic term should be used. Also things like terms of use/disclosure agreements/SLAs/data retention and discussion may be included in a CoC/Contract so perhaps we can merge these into a single bullet. - Add: Authorization (its a result of the accreditation) along with Authentication (identification). Proposed logical order to address topics (page 7) – does this order make sense? If not, how should it be reorganized and why? - We believe the order OK. - See above regarding the use of a more generic term for Code of Conduct. Objective for each topic (pages 9-21) – are the objectives identified for each topic the correct ones? What if anything is missing? General Comment The main objective of this exercise is to ensure we discuss and answer (in the form of recommendations) the charter questions as defined in the “System for Standardized Access to Non Public Registration Data”. Answering these charter questions should be included in the “objective” for each topic (as or if applicable). We notice that the charter questions are referenced in the “Related mind map questions” section of each topic, and in many cases charter questions are referenced in multiple topics, however we believe it is in the teams best interest to discuss and answer each charter question in a single “place” with the goal of avoiding (or minimizing to the greatest extent possible) the re-opening and re-debate of decisions previously made. Additional Input - For e) on page 17: - References "format" again. Should focus on content of requests and responses. (what is required) - For f) on page 19 - The header/term "query limitations" doesn't quite describe the set of objectives listed and is misleading/confusing. - Perhaps "Query Policy" would be better. - for i) on page 24 - again this section presupposes the use of an need for a code of conduct. - suggest the use of a generic term. Target date for completion (pages 9-21) – how much time do you estimate a specific topic needs to get addressed? - We suggest once we agree with a delivery date date we work back from that date with a work plan to address all issues that need to be worked on. For topics a-f (pages 9-18) confirm that the tasks identified are the correct ones and/or identify what tasks are missing. - Ensure tasks for each topic allow for, at a minimum, answering the relevant charter questions. - Can we map each charter question into a single SSAD topic, to ensure we do not miss anything and avoid any duplication of effort? ___________ *Alex Deacon* Cole Valley Consulting alex(a)colevalleyconsulting.com +1.415.488.6009

1 0