February 2020 - Gnso-epdp-team

Notes and action items - EPDP Meeting #44 - 27 Feb 2020
by Caitlin Tubergen 04 Mar '20

04 Mar '20

Dear EPDP Team: Please find below the notes and action items from EPDP Meeting #44 on Thursday, 27 February 2020. The next plenary meeting will be Thursday, 5 March 2020 at 14:00 UTC. The Legal Committee will meet on Tuesday, 3 March at 14:00 UTC. Thank you. Best regards, Marika, Berry, and Caitlin Action Items The EPDP Team expressed no objections to EPDP Support Staff’s proposal on data retention to reconfirm its Phase 1 Recommendation #15.2, which was adopted on an interim basis, and provides that registration data must be retained for a period of fifteen months following the life of the registration plus three months to implement the deletion, i.e., 18 months. Any EPDP Team members who cannot live with this proposal to provide a rationale and proposed alternative by Wednesday, 4 March. Following the deadline, Support Staff to develop proposed language by Friday, 6 March. EPDP Support Staff to create and distribute a table, detailing the board-approved purposes from Phase 1, Recommendation 1, and allowing EPDP Members to identify any gaps or additional purposes (if any) that may be needed as a result of the Board not adopting Purpose 2. EPDP Team members to use the table to identify gaps and additional purposes by Wednesday, 4 March. Volker and Brian to start a discussion on reformulating “Purpose 2” to ensure it is fit for purpose for the SSAD by COB Monday, 2 March. Following the receipt of Volker and Brian’s message, EPDP Team Members to respond, discuss the necessity of an updated “Purpose 2”, and discuss the corresponding processing activities on-list by COB Monday, 9 March. EPDP Phase 2 - Meeting #44 Agenda Thursday, 27 February 2020 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Confirmation of agenda (Chair) 3. Welcome and housekeeping issues (Chair) (5 minutes) Meeting with Belgian DPA – feedback from Janis Janis participated to brief the officials on the Initial Report The DPAs took the document and listened very carefully In terms of the Belgian DPA providing a public comment on the Initial Report, there was no conclusive answer, but the likely answer is no Questions from EPDP Team: Members of the Team have requested more details on the meeting. Is there anything actionable for the EPDP Team re: this meeting? The Team should not rely on any feedback of the Belgian DPA – the Team is working under the assumption of joint controllership This was a very good meeting, but there is nothing actionable out of it. The Belgian DPA is not in the position to make a decision on something that has global impact. The EC could send questions to the EPDB, which could give authoritative opinions. The DPA was answering and clarifying the initial questions and the answers. The Belgian DPA is not the authority to give an authoritative answer and cannot dictate a preference towards a model, but they could speak about what could work. They mentioned that automation is not something they can opine on without more details. The EPDP Team has to decide how to move forward. We’ve heard that automation is not forbidden but they cannot provide guidance until there are more details. The Team may have to be more aggressive and test the waters. If we only provide the safe examples, we will not learn. The DPAs are separate and make their own decisions. With the amount of info even in the Initial Report, there is not enough information for them to make a comment. It’s good to hear that centralization is still possible. Is there something in the policy work that we could concentrate on that would help the DPAs provide further detail? If the EPDP Team tried to talk to the EDPB, what is stopping the DPA from seizing the conversation? During the meeting, the question ICANN was asking re: controllership and liability had not been understood. The Belgian DPA thought it was being asked to bless the Strawberry model, but that is not what ICANN was asking – it was just testing a hypothesis. If the EC can ask the EDPB for the answer – what is the process to do this, and when is the appropriate time to do this? The Belgian DPA volunteered to engage with ICANN. The EDPB is a body made out of 27 data protection authorities of member states. One is preparing the topic for consideration by the board on behalf of DPAs. There is a competent national DPA to deal with the issue, and a technical board. In the meeting, the Belgian DPA referred to a direct request from the part of the Commission that is dealing with GDPR – DG Justice. The question needs to be formulated very clearly so that the board will have all of the elements to give a useful answer. Is the Team prepared to formulate questions to the Board in the timeframe allocated to us? If the Team decides to go for another year, then asking the EDPB may make sense and suspend activities until an answer is given. What question can be asked to whom, by whom, and what kind of answer would we get under what kind of timeframe? Suggest that a call be made to the chair of the EDPB or to the secretary of the EDPB. ICANN org knows very well who to speak with. ICANN cannot call up the chair of the EDPB – that is against process. With respect to if it would be possible to receive an answer by June – the answer is yes, it’s just a matter of the question. This third-track interaction with data protection authorities has just been a source of confusion and delay. The only thing the Team can do is develop a policy within the stated timeframe. ICANN67 Virtual Meeting – current state of planning / discussions Proposing two meetings per week – during normal hours, and possibly leaving time to the legal committee There may be a need for a period of more intensive work based on how we progress on Priority 2 items, for public comment review EPDP Team Reactions: GDD Summit, if it’s going forward, starts on 3 May and will be in Paris – this should be considered as a location. Disappointed that we are not discussing a F2F earlier – the Team needs serious discussions around automation The new schedule has picked up five 2-hr meetings – five extra meetings are now on the schedule. Concerned that the Team will not be able to close out all of the public comments and come to consensus on the Final Report. The work would greatly benefit from a potential F2F. 4. Timeline review and priority 2 worksheet compilation (10 minutes) a) Consider any input provided by EPDP Team by Tuesday 25 February b) Confirm next steps 5. Data retention (priority 2) (30 minutes) EPDP Team to review ICANN Org feedback (see https://mm.icann.org/pipermail/gnso-epdp-team/2019-November/002747.html and https://mm.icann.org/pipermail/gnso-epdp-team/attachments/20191102/e8cd309e… Consider Support Staff proposed recommendation: EPDP Team to consider whether updates are needed to phase 1 data retention recommendation (EPDP Team meeting - 27 Feb 2020). At a minimum, the EPDP Team would need to reconfirm its original recommendation, which was adopted on an interim basis, that registration data must be retained for a period of fifteen months following the life of the registration plus three months to implement the deletion, i.e., 18 months. No objections Confirm next steps Action: The EPDP Team expressed no objections to EPDP Support Staff’s proposal on data retention to reconfirm its Phase 1 Recommendation #15.2, which was adopted on an interim basis, that registration data must be retained for a period of fifteen months following the life of the registration plus three months to implement the deletion, i.e., 18 months. Any EPDP Team members who cannot live with this proposal to provide a rationale and proposed alternative by Wednesday, 4 March. Following the deadline, Support Staff to develop proposed language by Friday, 6 March. 6. Feasibility of unique contacts (priority 2) (30 minutes) EPDP Team to review Legal Committee proposal Confirm next steps 7. Purpose 2, Phase 1 (30 minutes) As a reminder, the EPDP Team recommended in phase 1 the following purpose ICANN Purpose for processing gTLD Registration Data: “Contributing to the maintenance of the security, stability, and resiliency of the Domain Name System in accordance with ICANN’s mission through enabling responses to lawful data disclosure requests”. “ICANN Purpose” _is used to describe purposes for processing personal data that should be governed by ICANN Org via a Consensus Policy. The ICANN Board did not adopt this purpose noting that: “The Board does not adopt this Recommendation at this time in light of the EPDP Team’s characterization of this as a placeholder and the need to consider recent input from the European Commission. Based on the views presented in the recent letters from the European Commission, Purpose 2, as stated in the EPDP Team’s Final Report, may require further refinement to ensure that it is consistent with and facilitates ICANN’s ability to deliver a predictable and consistent user experience compliant with applicable law. The Board’s concern is that if the wording of purpose 2 is deemed inconsistent with applicable law, the impact might be elimination of an ICANN purpose. There are clear ICANN purposes that ICANN should be able to employ under existing legal frameworks to deploy a unified method to enable those with a legitimate and proportionate interest to access non-public gTLD registration data, although such purposes may need to be restated or further refined based on additional legal, regulatory or other input. The Board directs ICANN org to continue to evaluate this proposed purpose and to request additional guidance from the DPAs, regarding the legitimate and proportionate access to registrant data and ICANN’s SSR mission”. To review the European Commission letter on this topic, see https://www.icann.org/en/system/files/correspondence/odonohue-to-marby-03ma… In a recent motion concerning the non-adoption of purpose 2, the GNSO Council noted that: “The GNSO Council has concluded that concerning Recommendation 1, Purpose 2, this is firmly within the scope of the EPDP Team to address as part of its phase 2 deliberations as the original language was already flagged as a placeholder pending further consideration during phase 2.” Brian King has proposed that the EPDP Team consider recommending the following ICANN purpose: “Contributing to the maintenance of the security, stability, and resiliency of the Domain Name System in accordance with ICANN’s mission”. Brian to introduce proposal New proposal attempts to de-conflate the Purpose 2 issue Important to keep some formulation of Purpose 2 – agree with Brian’s reformulation of the purpose Not fundamentally opposed to this, but if this wording was presented to a registrant, that would be confusing and may need additional clarity If a registrant was to look at this as a statement of purpose, how would they know their data is being processed for whom and for what reason? There is still scope within the existing purposes to deal with security/stability. This purpose should speak to the very first purpose in making registration data public before there was an ICANN – to deal with technical problems with the DNS. If the Team could work on something along those lines, that would work. Could include a disclaimer such as this purpose could result in the disclosure of data to third parties Agree that what Brian has proposed is overly broad – it does not tell the data subject how their data will be used. Rec. 1 contains 6 ICANN purposes for the processing of registration data. These are clear and cover the use cases we’ve discussed. The contactability purpose is already covered in Purpose 3. What processing activity is not accounted for in the other 6 purposes? Do not see a reason for Purpose 2 – we need confirmation on what gap (if any) the absence of purpose 2 would leave Still need a purpose 2 for ICANN – keep it in Many of the third parties that are requesting data are doing work for ICANN. The operation of the SSAD itself may include processing user data and is one of things that should be included in this purpose. The Team is missing, in the purposes, anything about the SSAD or anything that looks like it’s within ICANN’s realm of possibility to do in SSAD. The closest one is to enable communication with the RNH, but that’s not the only potential use of the SSAD. Remove the part that conflates and leave the rest. Is the role ICANN will be playing in the hybrid model currently reflected in Purpose 2? Proposal - “To exercise its role as data controller in the SSAD, contributing to the security, stability, and resiliency of the Domain Name System in accordance with ICANN's mission” This is not removing the previous issue of conflation – disclosing data is not part of the purpose of ICANN – suggest deleting Purpose 2 The Team is operationalizing disclosure. If this is an issue, the Team would have had a major crisis at the beginning of Phase 2, but no one raised this issue because it isn’t one. Third party purposes are conflated, and that is the problem. If a third party is helping ICANN achieve SSR, that is the third party’s purpose. If ICANN required the third party, then ICANN would enter into contractual relationships with them. Consider preparing a table with existing purposes from Phase 1 and see if the Team can identify any gaps The Team spent a long time on this back in Phase 1 – security and stability is not a purpose for collecting information in this instance. The creation of this instrument does not need a specific purpose to make it happen. There seems to be some hints of agreement as the first statement as a purpose statement, but the Team may need to define the processing activities behind the SSAD. The Team could further define the processing activities: we don’t need to identify collection b/c that is identified in purposes, but there would need to be a processing activity of the transfer of data from CP to requestor and perhaps retention of that data. Documenting this would help with the framework and in showing how the DPA might view it. Do not understand why the Team needs to go down this road. BC/IPC seems to believe SSAD will be created and before it’s turned on, there will be cries of no purpose, and therefore, no SSAD. This is a mischaracterization of BC/IPC’s position – ICANN conducting research, ICANN implementing policies are other purposes that are not currently identified. The Team is talking about two different aspects: is a specific purpose needed in relation to ICANN’s role in SSAD? The second question: is there a purpose for additional ICANN purposes like research. For the second question, the group may want to consider in context of the OCTO question – the EPDP Team needs to review that response. Does it make sense to take that issue separately? EPDP Team needs to get on with a DPIA EPDP Team feedback Confirm next steps Support Staff to create a table where Phase 1 purposes are identified and identify what gaps exist to make the precise formulation of a new purpose (if necessary) Action: Brian and Volker to lead the online conversation of the possible formulation of Purpose 2 8. Wrap and confirm next EPDP Team meeting (5 minutes): Thursday 5 March 2020 at 14.00 UTC (topics: City field redaction and Automation Use Cases – small team recommendations) Confirm action items Confirm questions for ICANN Org, if any

3 3

European Parliament question
by Eleeza Agopian 28 Feb '20

28 Feb '20

Dear EPDP team, ICANN org wants to share with the team this question from the European Parliament that was published today, regarding “Lack of access to WHOIS internet domain registration data”: https://www.europarl.europa.eu/doceo/document/E-9-2020-000826_EN.html Thank you, Eleeza and Dan ICANN org liaisons

3 2

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2 | Thursday, 27 February 2020 at 14:00 UTC
by Terri Agnew 27 Feb '20

27 Feb '20

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2 held on Thursday, 27 February 2020 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/Pg_JBw> (attendance included) and the GNSO Master calendar <https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_en_group…> . These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call, observers can join via audio cast, listen to the recordings and read the transcript afterwards. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Meeting Invitation / Observers / GNSO Temp Spec gTLD RD EPDP-P2 call / Thursday, 05 March 2020
by Terri Agnew 27 Feb '20

27 Feb '20

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 05 March 2020 at 14:00 UTC for 2 hours. For other times: https://tinyurl.com/uvfuh4f Agenda Wiki: https://community.icann.org/x/WR_JBw The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> If needed, an option to join via telephone has been added for this meeting. **Join information - Conference Bridge: Toll-free access number (US and Canada): 800 550 6865 and Toll 213 233 3193 Other telephone numbers found here: http://www.adigo.com/icann Enter passcode on telephone: 7349 Kind Regards, Terri

1 0

Re: [Gnso-epdp-team] [Ext] RE: Notes and action items - EPDP Meeting #43 - Thursday, 20 February 2020
by Caitlin Tubergen 26 Feb '20

26 Feb '20

Hi Marc, Thank you for your message. Support Staff added some context to the draft text. Please let us know if this helps alleviate your concern. At the time of publication of this report, the implementation of the Privacy and Proxy Services Accreditation Issues (“PPSAI”) Working Group’s recommendations is on hold. Accordingly, the EPDP Team’s Recommendation 14 from the Phase 1 Final Report remains in place. The EPDP Team notes the current implementation plan for the PPSAI Working Group’s recommendations contemplates that all accredited privacy/proxy services providers will be labeled or flagged in the RDS system. Assuming all accredited privacy and proxy service providers are clearly labeled in the RDS system, the EPDP Team recommends the following: In the case of a domain name registration where an accredited privacy/proxy service is used, e.g., where data associated with a natural person is masked, Registrar (and Registry, where applicable) MUST include the full non-personal RDDS data of the accredited privacy/proxy service in both the public RDDS and in response to an RDDS query. The full non-personal RDDS data MAY also include the existing privacy/proxy pseudonymized email. Thank you. Best regards, Marika, Berry, and Caitlin From: "Anderson, Marc" <mcanderson(a)verisign.com> Date: Tuesday, February 25, 2020 at 1:17 PM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Cc: Caitlin Tubergen <caitlin.tubergen(a)icann.org> Subject: [Ext] RE: Notes and action items - EPDP Meeting #43 - Thursday, 20 February 2020 All, I’m responding to action item #3 from the 20 Feb meeting. That action item asks us to review the staff proposed language: PROPOSED RECOMMENDATION FOR EPDP TEAM CONSIDERATION Based on input received, EPDP Support Staff recommends the EPDP Team to consider the following recommendation: Following the implementation of the PPSAI recommendations, the EPDP Team recommends that EPDP Phase 1 recommendation #14 (“In the case of a domain name registration where an "affiliated" privacy/proxy service used (e.g. where data associated with a natural person is masked), Registrar (and Registry where applicable) MUST include in the public RDDS and return in response to any query full non-personal RDDS data of the privacy/proxy service, which MAY also include the existing privacy/proxy pseudonymized email.”) applies to all accredited privacy and proxy services. I’m ok with the principle that we as a working group already agreed in phase 1 that privacy and proxied data should NOT also be redacted. In phase 1 the best we could do at the time was a recommendation to not redact where an “affiliated” service was used. In theory, once privacy/proxy services are accredited that scope could be expanded. What we heard from the Privacy/Proxy implementation is that “the PP IRT was considering a proposed requirement that all privacy and proxy service providers include a label, which would flag each registration as a privacy/proxy registration and identify which provider is associated with that registration, in the existing WHOIS output “registrant organization” field.” I’m concerned that the draft text isn’t clear and is very conditional. I think this text is intended to become a new EPDP phase 2 recommendation (rec 20?). That recommendation would replace, modify or otherwise supersede the EPDP phase 1 recommendation #14 (that hasn’t yet been implemented), but only when/if the Privacy/Proxy implementation produces a new policy that results in domain registration data that clearly identifies that it is a privacy/proxy registration, thus enabling an automated determination by the registrar (and registry if applicable) NOT to redact the data. Otherwise EPDP phase 1 rec #14 stands. Is this everyone else’s understanding? As I said, the principle sounds fine, but I don’t think the text reflects my recollection of what we discussed and I’m concerned about the squishy conditional nature of this new recommendation. Thanks, Marc From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> On Behalf Of Caitlin Tubergen Sent: Sunday, February 23, 2020 5:59 PM To: gnso-epdp-team(a)icann.org Subject: [EXTERNAL] [Gnso-epdp-team] Notes and action items - EPDP Meeting #43 - Thursday, 20 February 2020 Dear EPDP Team: Please find below the notes and action items from EPDP Meeting #43 on Thursday, 20 February 2020. As a reminder, the next plenary EPDP Team meeting will be Thursday, 27 February at 14:00 UTC. The small team of volunteers for automation use cases will meet on Tuesday, 25 February at 14:00 UTC. Thank you. Best regards, Marika, Berry, and Caitlin Action Items EPDP Team to review the Priority 2 compilation overview and timetable in detail and flag any major scheduling concerns by Tuesday, 25 February. EPDP Team members are encouraged to provide feedback on Priority 2 topics via the list in advance of the scheduled date(s) for discussion. EPDP Team to review the EPDP Support Staff’s proposed updated recommendation for the display of information of affiliated vs. accredited privacy / proxy providers [docs.google.com] by Wednesday, 26 February COB. Specifically, if any EPDP Team members cannot live with the updated recommendation as proposed, please provide an alternate proposal to the list by Wednesday, 26 February COB. For those EPDP Team members interested in participating in the small team discussion on automation use cases, please attend the meeting on Tuesday, 25 February at 14:00 UTC. EPDP Support Staff sent a calendar invite to the Team; if you did not receive the invite and would like to attend, please reach out to gnso-secs(a)icann.org. EPDP Phase 2 - Meeting #43 Proposed Agenda Thursday, 20 February 2020 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Confirmation of agenda (Chair) 3. Welcome and housekeeping issues (Chair) (5 minutes) ICANN67 Update The ICANN Board announced that ICANN67 will be a remote meeting. EPDP Team Feedback: Would be helpful to ask groups to provide feedback following this announcement – it will likely be difficult to have a 10-hour meeting on a Saturday There is value to F2F interactions – the location could be subject to discussion Option that makes the most sense – two normal-sized meeting during ICANN67, and another meeting in May 10-hour meeting on a Saturday is not viable ICANN Belgian DPA Update See blog post [icann.org] Imperative that ICANN org and Janis provide more detail regarding the meeting with the Belgian DPA Position of the roles of Janis and Georgios – Janis was there to present the work of the EPDP Team. Question: was there any discussion on the DPA reviewing the Initial Report in detail and providing input during the public comment period, or input on the Final Report? Blog post was very high level and did not seem to have anything actionable from the EPDP Team’s work An important question that needed to be asked was the allocation of liability based on the allocation of processing If there is not enough detail in the current draft recommendations, what does that mean? Does it mean there should be more details or are critical details being left to the implementation phase? Perhaps the Team should be more specific in its recommendations. It would be helpful if Janis could provide more detail in a future update. Update from legal committee Legal Committee reviewed the previously-sent legal questions – decided the question regarding reverse look-ups should be removed from consideration since this topic is no longer part of the Initial Report Recommended proceeding with the SSAC question re: representations b/w legal vs. natural. (Legal vs. Natural Question 2) Did the legal committee consider the issue of instances where the inclusion of personal data is included within a legal person’s contact information? Answer: yes Legal Committee still reviewing additional questions Reminder of the role of the legal committee – it is a representative group and approved questions will be sent to the EPDP Team as an FYI, but not for approval. All members of the EPDP Team may channel questions/concerns through their dedicated legal committee rep. 4. Timeline review and priority 2 worksheet compilation (20 minutes) a) Priority 2 worksheet compilation overview EPDP Leadership and Support Staff have compiled the remaining Priority 2 issues, which includes both suggested dates when the Team will discuss the topic as well as leadership-proposed paths forward, where applicable. The compilation includes links to the Priority 2 worksheets, which were populated as a result of small team calls. All EPDP Team members should review the Priority 2 worksheets in detail, as they include details regarding expected deliverables, required reading, etc. Action: EPDP Team to review the compilation overview in detail and flag any concerns, alternative proposals, etc. EPDP Team members are encouraged to provide feedback in advance of the scheduled date for discussion. b) Consider input received to date c) EPDP team input d) Confirm volunteers for Automation Use Cases Small Team e) Confirm next steps 5. Display of information of affiliated vs. accredited privacy / proxy providers [docs.google.com] (priority 2) (45 minutes) EPDP Team to review ICANN Org feedback During Phase 1 deliberations, the EPDP Team was unsure whether one could tell if a domain name is a privacy or proxy registration by looking at the output. The answer to the question that the P/P recommendations would include a recommendation that would lead to a clear indication in the RDDS response if the registration was a P/P service. This is a concern that all accredited P/P providers will be visible in RDDS – this has been addressed, and the recommendation as proposed by staff. There is doubt that the accreditation program for these services is still needed – the recommendation should be that the PDP should be reopened to reassess the recommendations of that group It’s a giant leap of faith to assume that P/P services will be deactivated Consider Support Staff proposed recommendation No EPDP Team objections expressed on the call over Support Staff’s proposal for P/P services. Action: EPDP Team to review the proposed recommendation in detail and flag objections on the list by Thursday, 27 February. Confirm next steps 6. Wrap and confirm next EPDP Team meeting (5 minutes): Thursday 27 February 2020 at 14.00 UTC (topics: data retention & feasibility of unique contacts to have a uniform anonymized email address) Confirm action items Confirm questions for ICANN Org, if any

1 0

Proposed agenda - EPDP Team meeting #44 - Thursday, 27 February
by Caitlin Tubergen 26 Feb '20

26 Feb '20

Dear EPDP Team: Please find below the proposed agenda for EPDP Team Meeting #44. Thank you. Best regards, Marika, Berry, and Caitlin -- EPDP Phase 2 - Meeting #44 Proposed Agenda Thursday, 27 February 2020 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Confirmation of agenda (Chair) 3. Welcome and housekeeping issues (Chair) (5 minutes) Meeting with Belgian DPA – feedback from Janis ICANN67 Virtual Meeting – current state of planning / discussions 4. Timeline review and priority 2 worksheet compilation (10 minutes) a) Consider any input provided by EPDP Team by Tuesday 25 February b) Confirm next steps 5. Data retention (priority 2) (30 minutes) EPDP Team to review ICANN Org feedback (see https://mm.icann.org/pipermail/gnso-epdp-team/2019-November/002747.html and https://mm.icann.org/pipermail/gnso-epdp-team/attachments/20191102/e8cd309e… Consider Support Staff proposed recommendation: EPDP Team to consider whether updates are needed to phase 1 data retention recommendation (EPDP Team meeting - 27 Feb 2020). At a minimum, the EPDP Team would need to reconfirm its original recommendation, which was adopted on an interim basis, that registration data must be retained for a period of fifteen months following the life of the registration plus three months to implement the deletion, i.e., 18 months. Confirm next steps 6. Feasibility of unique contacts (priority 2) (30 minutes) EPDP Team to review Legal Committee proposal Confirm next steps 7. Purpose 2, Phase 1 (30 minutes) As a reminder, the EPDP Team recommended in phase 1 the following purpose ICANN Purpose for processing gTLD Registration Data: “Contributing to the maintenance of the security, stability, and resiliency of the Domain Name System in accordance with ICANN’s mission through enabling responses to lawful data disclosure requests”. “ICANN Purpose” is used to describe purposes for processing personal data that should be governed by ICANN Org via a Consensus Policy. The ICANN Board did not adopt this purpose noting that: “The Board does not adopt this Recommendation at this time in light of the EPDP Team’s characterization of this as a placeholder and the need to consider recent input from the European Commission. Based on the views presented in the recent letters from the European Commission, Purpose 2, as stated in the EPDP Team’s Final Report, may require further refinement to ensure that it is consistent with and facilitates ICANN’s ability to deliver a predictable and consistent user experience compliant with applicable law. The Board’s concern is that if the wording of purpose 2 is deemed inconsistent with applicable law, the impact might be elimination of an ICANN purpose. There are clear ICANN purposes that ICANN should be able to employ under existing legal frameworks to deploy a unified method to enable those with a legitimate and proportionate interest to access non-public gTLD registration data, although such purposes may need to be restated or further refined based on additional legal, regulatory or other input. The Board directs ICANN org to continue to evaluate this proposed purpose and to request additional guidance from the DPAs, regarding the legitimate and proportionate access to registrant data and ICANN’s SSR mission”. To review the European Commission letter on this topic, see https://www.icann.org/en/system/files/correspondence/odonohue-to-marby-03ma… In a recent motion concerning the non-adoption of purpose 2, the GNSO Council noted that: “The GNSO Council has concluded that concerning Recommendation 1, Purpose 2, this is firmly within the scope of the EPDP Team to address as part of its phase 2 deliberations as the original language was already flagged as a placeholder pending further consideration during phase 2.” Brian King has proposed that the EPDP Team consider recommending the following ICANN purpose: “Contributing to the maintenance of the security, stability, and resiliency of the Domain Name System in accordance with ICANN’s mission”. Brian to introduce proposal EPDP Team feedback Confirm next steps 8. Wrap and confirm next EPDP Team meeting (5 minutes): Thursday 5 March 2020 at 14.00 UTC (topics: City field redaction and Automation Use Cases – small team recommendations) Confirm action items Confirm questions for ICANN Org, if any

2 1

**Reminder** Meeting Invitation / Observers / GNSO Temp Spec gTLD RD EPDP-P2 call / Thursday, 27 February 2020
by Julie Bisland 26 Feb '20

26 Feb '20

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 27 February 2020 at 14:00 UTC for 2 hours. For other times: https://tinyurl.com/vyddber [tinyurl.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__tinyurl.com_vyddber&d=…> Agenda Wiki: https://community.icann.org/x/Pg_JBw The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> If needed, an option to join via telephone has been added for this meeting. **Join information - Conference Bridge: Toll-free access number (US and Canada): 800 550 6865 and Toll 213 233 3193 Other telephone numbers found here: http://www.adigo.com/icann [adigo.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.adigo.com_icann&d=D…> Enter passcode on telephone: 7349 Kind Regards, Terri

1 0

Proposal: Timetable to address Priority 2 issues
by Janis Karklins 25 Feb '20

25 Feb '20

Dear EPDP Team, The leadership team has worked together with the staff support team to outline the proposed next steps for both addressing priority 2 items and the subsequent review of input received on the SSAD Initial Report. When reviewing the attached timetable, which outlines the proposal in detail, please keep in mind the following: · The window of opportunity to allow folding in of priority 2 items into the SSAD Final Report is short – preliminary recommendations would need to be published for public comment by 24 March at the latest. If the EPDP Team does not reach agreement by that date on how to address priority 2 items, these items will be referred back to the GNSO Council for its consideration on how to proceed. Note that due to external dependencies, certain items, such as legal / natural, will automatically be referred to the GNSO Council. · The legal committee plays a key role in preparing the ground for a number of priority 2 items – please remember that the legal committee is a representative body. As such, members of the legal committee must consult with and keep their fellow team members up to date so that when the legal committee sends its recommendations to the plenary team, discussions are not rehashed, and recommendations/proposed questions do not come as a surprise. · The priority remains to finalize the SSAD Final Report by 11 June 2020 at the latest: as a reminder, both the funding that was made available for phase 2 and my availability to chair the Team will end on 30 June. · Depending on the number of comments received, there may be a need to plan for an intense EPDP Team call week – this is foreseen for the week of 11-15 May. Please already pencil this into your agendas – it would likely take the form of extended calls taking place (almost) every day of the week. Certainly the timetable may need to be adjusted as the EPDP Team progresses through its work; as such, we expect everyone to remain flexible. In order to make progress on priority 2 items, it is imperative that everyone reviews the relevant worksheets in advance of the meeting to appreciate the context and come prepared to find solutions to the issues identified. You are encouraged to provide your group’s feedback on the proposed timetable by Tuesday 18 February at the latest. Thank you JK

7 6

Notes and action items - EPDP Meeting #43 - Thursday, 20 February 2020
by Caitlin Tubergen 25 Feb '20

25 Feb '20

Dear EPDP Team: Please find below the notes and action items from EPDP Meeting #43 on Thursday, 20 February 2020. As a reminder, the next plenary EPDP Team meeting will be Thursday, 27 February at 14:00 UTC. The small team of volunteers for automation use cases will meet on Tuesday, 25 February at 14:00 UTC. Thank you. Best regards, Marika, Berry, and Caitlin Action Items EPDP Team to review the Priority 2 compilation overview and timetable in detail and flag any major scheduling concerns by Tuesday, 25 February. EPDP Team members are encouraged to provide feedback on Priority 2 topics via the list in advance of the scheduled date(s) for discussion. EPDP Team to review the EPDP Support Staff’s proposed updated recommendation for the display of information of affiliated vs. accredited privacy / proxy providers by Wednesday, 26 February COB. Specifically, if any EPDP Team members cannot live with the updated recommendation as proposed, please provide an alternate proposal to the list by Wednesday, 26 February COB. For those EPDP Team members interested in participating in the small team discussion on automation use cases, please attend the meeting on Tuesday, 25 February at 14:00 UTC. EPDP Support Staff sent a calendar invite to the Team; if you did not receive the invite and would like to attend, please reach out to gnso-secs(a)icann.org. EPDP Phase 2 - Meeting #43 Proposed Agenda Thursday, 20 February 2020 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Confirmation of agenda (Chair) 3. Welcome and housekeeping issues (Chair) (5 minutes) ICANN67 Update The ICANN Board announced that ICANN67 will be a remote meeting. EPDP Team Feedback: Would be helpful to ask groups to provide feedback following this announcement – it will likely be difficult to have a 10-hour meeting on a Saturday There is value to F2F interactions – the location could be subject to discussion Option that makes the most sense – two normal-sized meeting during ICANN67, and another meeting in May 10-hour meeting on a Saturday is not viable ICANN Belgian DPA Update See blog post Imperative that ICANN org and Janis provide more detail regarding the meeting with the Belgian DPA Position of the roles of Janis and Georgios – Janis was there to present the work of the EPDP Team. Question: was there any discussion on the DPA reviewing the Initial Report in detail and providing input during the public comment period, or input on the Final Report? Blog post was very high level and did not seem to have anything actionable from the EPDP Team’s work An important question that needed to be asked was the allocation of liability based on the allocation of processing If there is not enough detail in the current draft recommendations, what does that mean? Does it mean there should be more details or are critical details being left to the implementation phase? Perhaps the Team should be more specific in its recommendations. It would be helpful if Janis could provide more detail in a future update. Update from legal committee Legal Committee reviewed the previously-sent legal questions – decided the question regarding reverse look-ups should be removed from consideration since this topic is no longer part of the Initial Report Recommended proceeding with the SSAC question re: representations b/w legal vs. natural. (Legal vs. Natural Question 2) Did the legal committee consider the issue of instances where the inclusion of personal data is included within a legal person’s contact information? Answer: yes Legal Committee still reviewing additional questions Reminder of the role of the legal committee – it is a representative group and approved questions will be sent to the EPDP Team as an FYI, but not for approval. All members of the EPDP Team may channel questions/concerns through their dedicated legal committee rep. 4. Timeline review and priority 2 worksheet compilation (20 minutes) a) Priority 2 worksheet compilation overview EPDP Leadership and Support Staff have compiled the remaining Priority 2 issues, which includes both suggested dates when the Team will discuss the topic as well as leadership-proposed paths forward, where applicable. The compilation includes links to the Priority 2 worksheets, which were populated as a result of small team calls. All EPDP Team members should review the Priority 2 worksheets in detail, as they include details regarding expected deliverables, required reading, etc. Action: EPDP Team to review the compilation overview in detail and flag any concerns, alternative proposals, etc. EPDP Team members are encouraged to provide feedback in advance of the scheduled date for discussion. b) Consider input received to date c) EPDP team input d) Confirm volunteers for Automation Use Cases Small Team e) Confirm next steps 5. Display of information of affiliated vs. accredited privacy / proxy providers (priority 2) (45 minutes) EPDP Team to review ICANN Org feedback During Phase 1 deliberations, the EPDP Team was unsure whether one could tell if a domain name is a privacy or proxy registration by looking at the output. The answer to the question that the P/P recommendations would include a recommendation that would lead to a clear indication in the RDDS response if the registration was a P/P service. This is a concern that all accredited P/P providers will be visible in RDDS – this has been addressed, and the recommendation as proposed by staff. There is doubt that the accreditation program for these services is still needed – the recommendation should be that the PDP should be reopened to reassess the recommendations of that group It’s a giant leap of faith to assume that P/P services will be deactivated Consider Support Staff proposed recommendation No EPDP Team objections expressed on the call over Support Staff’s proposal for P/P services. Action: EPDP Team to review the proposed recommendation in detail and flag objections on the list by Thursday, 27 February. Confirm next steps 6. Wrap and confirm next EPDP Team meeting (5 minutes): Thursday 27 February 2020 at 14.00 UTC (topics: data retention & feasibility of unique contacts to have a uniform anonymized email address) Confirm action items Confirm questions for ICANN Org, if any

2 2

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2 - Small Team - Small Team - Automation Use Cases| Tuesday, 25 February 2020 at 14:00 UTC
by Terri Agnew 25 Feb '20

25 Feb '20

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2 – Small Team - Small Team - Automation Use Cases held on Tuesday, 25 February 2020 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/PA_JBw> . These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) As a reminder only members and alternates can join the call, observers can listen to the recordings and read the zoom transcript afterwards. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0