March 2020 - Gnso-epdp-team

Notes and action items - EPDP Phase 2 - Meeting #45 - 5 March 2020
by Caitlin Tubergen 05 Mar '20

05 Mar '20

Dear EPDP Team: Please find below the notes and action items from today’s EPDP meeting #45. Thank you. Best regards, Marika, Berry, and Caitlin -- Action Items EPDP Support Staff to send the proposed draft answers to ICANN Org’s questions and assumptions re: the financial considerations for SSAD to the EPDP Team for its review. (Complete) EPDP Team to review the draft financial consideration answers. Becky, Amr, Volker, Franck, Marc A., and Mark Sv. to provide feedback on the draft answers by Wednesday, 11 March for the plenary Team’s review. Re: Feasibility of unique contacts, no EPDP Team members objected to the Legal Committee’s proposal. EPDP Support Staff to incorporate the draft recommendation into the draft Priority 2 addendum. Re: City field redaction, Margie to propose, on-list, an automated use case for the disclosure of city field to share with the EPDP Team by Monday, 9 March. EPDP support staff to propose text based on today's city field redaction discussion for the EPDP Team’s review in advance of Tuesday, 10 March. Re: Potential OCTO Purpose, EPDP Team to review ICANN org’s recent response and ICANN Org’s responses from Phase 1 re: the use of nonpublic registration data prior to effective date of GDPR. Following review of the questions and answers from Phase 1, EPDP Team members who believe an additional question/response from ICANN org is still necessary, to provide the draft question and rationale for the EPDP Team’s review by Monday, 9 March. EPDP Phase 2 - Meeting #45 Proposed Agenda Thursday, 5 March 2020 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Confirmation of agenda (Chair) Request to discuss the financial considerations recommendation if time allows 3. Welcome and housekeeping issues (Chair) (5 minutes) ICANN67 Virtual Meeting – confirmation of schedule 4 meetings during ICANN67 Today’s meeting is also an additional meeting, as it was originally cancelled due to it being a travel day Legal committee update Two documents were circulated to the plenary Team – feasibility of unique contacts and city field redaction The LC went through the outstanding questions with significant modifications to tighten up the language If the representative LC reached consensus, the questions will be sent directly to B&B. If not, the questions will go to the plenary for further discussion. Financial Feasibility The Team had conversations about the financial feasibility building block in November. The Team thought it would be useful to better understand the possible scale of the SSAD, and Janis asked for an estimate on how much the SSAD would cost. In response to the request, ICANN org sent a detailed list of questions Support Staff endeavored to provide a first cut of answers for the EPDP Team to review Should this be further considered during the next meeting, or should a small group of volunteers work on this issue? EPDP Response: Prefer to form a small team as this is very involved and may not be a good use of plenary meeting time There should be ICANN org representation on the small team Disagree with small team – this should be a discussion on-list instead of in a small team. An on-list discussion would not take time away from plenary meetings. Agree that ICANN org should be a part of the discussion. Volunteers to look at answers: Becky, Amr, Volker, Franck, Marc. Mark Sv. – will review the document and drive the work on-list, but the plenary team is also invited to provide feedback. Small team calls can be scheduled if absolutely necessary. 4. Feasibility of unique contacts (priority 2) (30 minutes) EPDP Team to review Legal Committee proposal Advice from Bird & Bird – whether there is a pseudonymized email or anonymized email, it would be considered personal data. Legal committee’s conclusion, based on the advice, was that the uniform masked email addresses results in the publication of personal data; therefore, wide publication of masked email addresses is not currently feasible under the GDPR as disclosure would, in certain circumstances, require meaningful human review, i.e., balancing test under GDPR Article 6(1)(f). Does the EPDP Team agree with the Legal Committee’s recommendation? EPDP Team Response: This legal opinion is confusing b/c of the term masked – does this mean that part of the email is in clear text while part of it is masked? Why is the word masked the appropriate term here? The use of the term masked in this paragraph is Becky’s. In either case, technically the emails would be pseudonymized personal data. Even if every character is not the same but would still enable you to contact the email, it is still considered personal data. This is fundamentally different than directly contacting via a pseudonymized email vs a link to contact an intermediary. The issue is not contactability; the issue is the fact that you can use the pseudonymized email to identify a particular individual Confirm next steps No EPDP Team objections to the recommendation of the Legal Committee – EPDP Support Staff to update the draft Priority 2 addendum accordingly 5. City field redaction (priority 2) (30 minutes) EPDP Team to review Legal Committee proposal The Legal Committee reviewed the previous legal advice received in Phase 1 re: the permissibility of publishing the city field in public RDDS B&B’s conclusion: in order to perform the balancing test, the EPDP Team would need to provide additional information about the benefits of universal publication of city field. B&B lays out how to conduct balancing test EPDP Team response: First time seeing a reference to a generic balancing test. If we do not have to look at the particulars of the data subject, that changes a lot of previous recommendations. The scope of this memo is not a case-by-case balancing, but it is not a generic balancing test – it is a specific but very challenging balancing test and considering the rights of all individuals who would be affected by universal publication In terms of automated disclosure for specific use cases, there are specific use cases where city field is relevant for specific legal claims. This memo was focused on the universal publication. The balancing test may not be as difficult with automatic disclosures, and this is a specific automated use case in the examples Mark Sv. provided Interpreted the B&B advice differently – publication of this does not make any sense. This advice does not make a case for universal publication, but in some instances a requestor may ask for automated disclosure of the city field. Could the Team agree that we will not universally publish the city field in the general case and review it under automated use cases? Easiest way to solve this – the CP should perform the balancing test – recommend that the city field may be disclosed in the public WHOIS but may be redacted based on the CP’s analysis – that way, we allow the publication of more for those who would like to publish Either the CP should be able to decide for their own domains or all CPs should redact the city field Phase 1 Rec. 11 states that city field MUST be redacted; proposal to change this to a MAY Do not agree with making this a choice for contracted parties as the city field is part of the data subject’s address This should be considered as part of the automated use cases Action: Margie to formulate text to consider on disclosure of city field as an automated use case Logical contradiction in MAY proposal: if the city field is redacted and someone requests it, the CP will be able to decide if they are putting themselves at a legal risk. No need for CPs to publish this data if they want to. If there is a legal privacy right, it should not be widely published. Confirm next steps Action: Margie to formulate text to consider on disclosure of city field as an automated use case 6. Potential OCTO Purpose (if time allows) Review ICANN org response Received an email from ICANN org liaisons – sent to the EPDP Team on 26 Feb ICANN org did not identify any additional uses for non-public registration data In the email, there is a paragraph that references the public data and associated uses, like the BRDA, but these uses do not use non-public data There is a letter from Goran to GNSO Council re: ARS, noting it cannot do this work without non-public data There is a difference b/w what ICANN org is doing now vs. what it was doing before GDPR – such as where ICANN was accessing the entire WHOIS database, conducting testing of new registrars and registries ICANN org already answered this – GDPR changed the landscape and some things that used to be common are simply no longer possible, and WHOIS ARS is an example of that If ICANN believes it has a purpose for the data in the future, there is nothing stopping this. ICANN is a controller and can create the purpose in the future. ARS is an audit, and that is allowed under the current purposes. Why ICANN has chosen not to do it is a separate issue OCTO and Org are two distinct entities. ICANN has not identified any additional purposes outside of what is covered in Phase 1 Confirm next steps EPDP Team to review previous responses from OCTO and revisit the question 7. Wrap and confirm next EPDP Team meeting (5 minutes): Tuesday 10 March 2020 Virtual ICANN67 Cancun EPDP Team meeting (tentative 9:00 – 11:00 local time (14:00 – 16:00 UTC) - https://67.schedule.icann.org/meetings/1152557 Confirm action items Confirm questions for ICANN Org, if any

1 0

Financial Sustainability - Cost Model Questions for ICANN Org
by policy＠bacinblack.com 05 Mar '20

05 Mar '20

Hi All, Please find below a link to a Google doc that contains initial response to the questions posed by Org back in January. The responses included here were created by me as a finger in the wind estimate and take note that this is not indicative of any position supported by Org. I will admit that not having direct experience from the "demand side" for disclosure requests made this a challenging task to develop what I think is a reasonable response. Thus, I encourage the team to pay extra attention to the "Scaling Questions." For initial input, the entire group is welcome to provide feedback. Please only use side-bar comments to ask questions, make suggested edits, or add new sizing elements for consideration. Those that volunteered for the small team on today's call, will then review and consolidate the input to develop a final response. Please review and provide input by 11 March 2020. If there's stark disagreement, the leadership team can perhaps find room on the agenda for the calls either on the 17th or 19th to discuss this in greater detail. https://docs.google.com/document/d/1YtLHw4ASPOLwI_77bXGJrGypCHzYePQ5vaIWXzPa tww/edit#heading=h.gjdgxs Small team volunteers thus far: Becky Amr Volker Frank Marc MarkSV (via Steve) Thank you. B Berry Cobb @berrycobb GNSO Policy Consultant

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2 | Thursday, 05 March 2020 at 14:00 UTC
by Terri Agnew 05 Mar '20

05 Mar '20

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2 held on Thursday, 05 March 2020 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/WR_JBw> (attendance included) and the GNSO Master calendar <https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_en_group…> . These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call, observers can join via audio cast, listen to the recordings and read the transcript afterwards. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Meeting Invitation / Observers / GNSO Temp Spec gTLD RD EPDP-P2 call / Tuesday, 17 March 2020
by Terri Agnew 05 Mar '20

05 Mar '20

** Call details are for week after ICANN67 Virtual Community Forum As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Tuesday, 17 March 2020 at 14:00 UTC for 2 hours. For other times: https://tinyurl.com/wsufp84 Agenda Wiki: https://community.icann.org/x/oB_JBw The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> If needed, an option to join via telephone has been added for this meeting. **Join information - Conference Bridge: Toll-free access number (US and Canada): 800 550 6865 and Toll 213 233 3193 Other telephone numbers found here: http://www.adigo.com/icann Enter passcode on telephone: 7349 Kind Regards, Terri

1 0

Purpose 2
by King, Brian 05 Mar '20

05 Mar '20

Hi all, Following last week’s conversation about some EPDP members’ desire to have a bit more specificity in Purpose 2 (the irony of which is not lost on the IPC 😊), I propose the below: Contributing to the maintenance of the security, stability, and resiliency of the Domain Name System in accordance with ICANN’s mission, specifically “maintenance of and access to accurate and up-to-date information concerning registered names and name servers.” (ICANN Bylaws, Annex G-1; ICANN Bylaws, Annex G-2) Brian J. King Director of Internet Policy and Industry Affairs T +1 443 761 3726 markmonitor.com<http://www.markmonitor.com> MarkMonitor Protecting companies and consumers in a digital world

3 2

Proposed agenda - EPDP Team meeting #45 - Thursday, 05 March
by policy＠bacinblack.com 04 Mar '20

04 Mar '20

Dear EPDP Team: Please find below the proposed agenda for EPDP Team Meeting #45. Thank you. Best regards, Marika, Berry, and Caitlin -- EPDP Phase 2 - Meeting #45 Proposed Agenda Thursday, 5 March 2020 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Confirmation of agenda (Chair) 3. Welcome and housekeeping issues (Chair) (5 minutes) a. ICANN67 Virtual Meeting – confirmation of schedule a. 10 March – 14:00 – 16:00 UTC b. 12 March – 15:45 – 17:45 UTC c. 17 March – 14:00 – 16:00 UTC d. 19 March – 14:00 – 16:00 UTC b. Legal committee update 4. Feasibility of unique contacts <https://docs.google.com/document/d/1meyuNRsq4sMOI6pefJk4jZevaKUsTkVf8_XyW1t…> (priority 2) (30 minutes) a. EPDP Team to review Legal Committee proposal b. Confirm next steps 5. City field redaction <https://docs.google.com/document/d/1rdtRLaNm5DiWR_EPei4Oi64FaDauIXEQhnF2Lm_…> (priority 2) (30 minutes) a. EPDP Team to review Legal Committee proposal b. Confirm next steps 6. Potential OCTO Purpose <https://docs.google.com/document/d/174PSGgWB-UTTcqIA-NndIVDkP6WR701tzwjDsoz…> (if time allows) a. Review ICANN org response b. Confirm next steps 7. Wrap and confirm next EPDP Team meeting (5 minutes): a. Tuesday 10 March 2020 Virtual ICANN67 Cancun EPDP Team meeting (9:00 – 11:00 local time (14:00 – 16:00 UTC) - https://67.schedule.icann.org/meetings/1152557 b. Confirm action items c. Confirm questions for ICANN Org, if any

4 3

Notes and action items - EPDP Meeting #44 - 27 Feb 2020
by Caitlin Tubergen 04 Mar '20

04 Mar '20

Dear EPDP Team: Please find below the notes and action items from EPDP Meeting #44 on Thursday, 27 February 2020. The next plenary meeting will be Thursday, 5 March 2020 at 14:00 UTC. The Legal Committee will meet on Tuesday, 3 March at 14:00 UTC. Thank you. Best regards, Marika, Berry, and Caitlin Action Items The EPDP Team expressed no objections to EPDP Support Staff’s proposal on data retention to reconfirm its Phase 1 Recommendation #15.2, which was adopted on an interim basis, and provides that registration data must be retained for a period of fifteen months following the life of the registration plus three months to implement the deletion, i.e., 18 months. Any EPDP Team members who cannot live with this proposal to provide a rationale and proposed alternative by Wednesday, 4 March. Following the deadline, Support Staff to develop proposed language by Friday, 6 March. EPDP Support Staff to create and distribute a table, detailing the board-approved purposes from Phase 1, Recommendation 1, and allowing EPDP Members to identify any gaps or additional purposes (if any) that may be needed as a result of the Board not adopting Purpose 2. EPDP Team members to use the table to identify gaps and additional purposes by Wednesday, 4 March. Volker and Brian to start a discussion on reformulating “Purpose 2” to ensure it is fit for purpose for the SSAD by COB Monday, 2 March. Following the receipt of Volker and Brian’s message, EPDP Team Members to respond, discuss the necessity of an updated “Purpose 2”, and discuss the corresponding processing activities on-list by COB Monday, 9 March. EPDP Phase 2 - Meeting #44 Agenda Thursday, 27 February 2020 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Confirmation of agenda (Chair) 3. Welcome and housekeeping issues (Chair) (5 minutes) Meeting with Belgian DPA – feedback from Janis Janis participated to brief the officials on the Initial Report The DPAs took the document and listened very carefully In terms of the Belgian DPA providing a public comment on the Initial Report, there was no conclusive answer, but the likely answer is no Questions from EPDP Team: Members of the Team have requested more details on the meeting. Is there anything actionable for the EPDP Team re: this meeting? The Team should not rely on any feedback of the Belgian DPA – the Team is working under the assumption of joint controllership This was a very good meeting, but there is nothing actionable out of it. The Belgian DPA is not in the position to make a decision on something that has global impact. The EC could send questions to the EPDB, which could give authoritative opinions. The DPA was answering and clarifying the initial questions and the answers. The Belgian DPA is not the authority to give an authoritative answer and cannot dictate a preference towards a model, but they could speak about what could work. They mentioned that automation is not something they can opine on without more details. The EPDP Team has to decide how to move forward. We’ve heard that automation is not forbidden but they cannot provide guidance until there are more details. The Team may have to be more aggressive and test the waters. If we only provide the safe examples, we will not learn. The DPAs are separate and make their own decisions. With the amount of info even in the Initial Report, there is not enough information for them to make a comment. It’s good to hear that centralization is still possible. Is there something in the policy work that we could concentrate on that would help the DPAs provide further detail? If the EPDP Team tried to talk to the EDPB, what is stopping the DPA from seizing the conversation? During the meeting, the question ICANN was asking re: controllership and liability had not been understood. The Belgian DPA thought it was being asked to bless the Strawberry model, but that is not what ICANN was asking – it was just testing a hypothesis. If the EC can ask the EDPB for the answer – what is the process to do this, and when is the appropriate time to do this? The Belgian DPA volunteered to engage with ICANN. The EDPB is a body made out of 27 data protection authorities of member states. One is preparing the topic for consideration by the board on behalf of DPAs. There is a competent national DPA to deal with the issue, and a technical board. In the meeting, the Belgian DPA referred to a direct request from the part of the Commission that is dealing with GDPR – DG Justice. The question needs to be formulated very clearly so that the board will have all of the elements to give a useful answer. Is the Team prepared to formulate questions to the Board in the timeframe allocated to us? If the Team decides to go for another year, then asking the EDPB may make sense and suspend activities until an answer is given. What question can be asked to whom, by whom, and what kind of answer would we get under what kind of timeframe? Suggest that a call be made to the chair of the EDPB or to the secretary of the EDPB. ICANN org knows very well who to speak with. ICANN cannot call up the chair of the EDPB – that is against process. With respect to if it would be possible to receive an answer by June – the answer is yes, it’s just a matter of the question. This third-track interaction with data protection authorities has just been a source of confusion and delay. The only thing the Team can do is develop a policy within the stated timeframe. ICANN67 Virtual Meeting – current state of planning / discussions Proposing two meetings per week – during normal hours, and possibly leaving time to the legal committee There may be a need for a period of more intensive work based on how we progress on Priority 2 items, for public comment review EPDP Team Reactions: GDD Summit, if it’s going forward, starts on 3 May and will be in Paris – this should be considered as a location. Disappointed that we are not discussing a F2F earlier – the Team needs serious discussions around automation The new schedule has picked up five 2-hr meetings – five extra meetings are now on the schedule. Concerned that the Team will not be able to close out all of the public comments and come to consensus on the Final Report. The work would greatly benefit from a potential F2F. 4. Timeline review and priority 2 worksheet compilation (10 minutes) a) Consider any input provided by EPDP Team by Tuesday 25 February b) Confirm next steps 5. Data retention (priority 2) (30 minutes) EPDP Team to review ICANN Org feedback (see https://mm.icann.org/pipermail/gnso-epdp-team/2019-November/002747.html and https://mm.icann.org/pipermail/gnso-epdp-team/attachments/20191102/e8cd309e… Consider Support Staff proposed recommendation: EPDP Team to consider whether updates are needed to phase 1 data retention recommendation (EPDP Team meeting - 27 Feb 2020). At a minimum, the EPDP Team would need to reconfirm its original recommendation, which was adopted on an interim basis, that registration data must be retained for a period of fifteen months following the life of the registration plus three months to implement the deletion, i.e., 18 months. No objections Confirm next steps Action: The EPDP Team expressed no objections to EPDP Support Staff’s proposal on data retention to reconfirm its Phase 1 Recommendation #15.2, which was adopted on an interim basis, that registration data must be retained for a period of fifteen months following the life of the registration plus three months to implement the deletion, i.e., 18 months. Any EPDP Team members who cannot live with this proposal to provide a rationale and proposed alternative by Wednesday, 4 March. Following the deadline, Support Staff to develop proposed language by Friday, 6 March. 6. Feasibility of unique contacts (priority 2) (30 minutes) EPDP Team to review Legal Committee proposal Confirm next steps 7. Purpose 2, Phase 1 (30 minutes) As a reminder, the EPDP Team recommended in phase 1 the following purpose ICANN Purpose for processing gTLD Registration Data: “Contributing to the maintenance of the security, stability, and resiliency of the Domain Name System in accordance with ICANN’s mission through enabling responses to lawful data disclosure requests”. “ICANN Purpose” _is used to describe purposes for processing personal data that should be governed by ICANN Org via a Consensus Policy. The ICANN Board did not adopt this purpose noting that: “The Board does not adopt this Recommendation at this time in light of the EPDP Team’s characterization of this as a placeholder and the need to consider recent input from the European Commission. Based on the views presented in the recent letters from the European Commission, Purpose 2, as stated in the EPDP Team’s Final Report, may require further refinement to ensure that it is consistent with and facilitates ICANN’s ability to deliver a predictable and consistent user experience compliant with applicable law. The Board’s concern is that if the wording of purpose 2 is deemed inconsistent with applicable law, the impact might be elimination of an ICANN purpose. There are clear ICANN purposes that ICANN should be able to employ under existing legal frameworks to deploy a unified method to enable those with a legitimate and proportionate interest to access non-public gTLD registration data, although such purposes may need to be restated or further refined based on additional legal, regulatory or other input. The Board directs ICANN org to continue to evaluate this proposed purpose and to request additional guidance from the DPAs, regarding the legitimate and proportionate access to registrant data and ICANN’s SSR mission”. To review the European Commission letter on this topic, see https://www.icann.org/en/system/files/correspondence/odonohue-to-marby-03ma… In a recent motion concerning the non-adoption of purpose 2, the GNSO Council noted that: “The GNSO Council has concluded that concerning Recommendation 1, Purpose 2, this is firmly within the scope of the EPDP Team to address as part of its phase 2 deliberations as the original language was already flagged as a placeholder pending further consideration during phase 2.” Brian King has proposed that the EPDP Team consider recommending the following ICANN purpose: “Contributing to the maintenance of the security, stability, and resiliency of the Domain Name System in accordance with ICANN’s mission”. Brian to introduce proposal New proposal attempts to de-conflate the Purpose 2 issue Important to keep some formulation of Purpose 2 – agree with Brian’s reformulation of the purpose Not fundamentally opposed to this, but if this wording was presented to a registrant, that would be confusing and may need additional clarity If a registrant was to look at this as a statement of purpose, how would they know their data is being processed for whom and for what reason? There is still scope within the existing purposes to deal with security/stability. This purpose should speak to the very first purpose in making registration data public before there was an ICANN – to deal with technical problems with the DNS. If the Team could work on something along those lines, that would work. Could include a disclaimer such as this purpose could result in the disclosure of data to third parties Agree that what Brian has proposed is overly broad – it does not tell the data subject how their data will be used. Rec. 1 contains 6 ICANN purposes for the processing of registration data. These are clear and cover the use cases we’ve discussed. The contactability purpose is already covered in Purpose 3. What processing activity is not accounted for in the other 6 purposes? Do not see a reason for Purpose 2 – we need confirmation on what gap (if any) the absence of purpose 2 would leave Still need a purpose 2 for ICANN – keep it in Many of the third parties that are requesting data are doing work for ICANN. The operation of the SSAD itself may include processing user data and is one of things that should be included in this purpose. The Team is missing, in the purposes, anything about the SSAD or anything that looks like it’s within ICANN’s realm of possibility to do in SSAD. The closest one is to enable communication with the RNH, but that’s not the only potential use of the SSAD. Remove the part that conflates and leave the rest. Is the role ICANN will be playing in the hybrid model currently reflected in Purpose 2? Proposal - “To exercise its role as data controller in the SSAD, contributing to the security, stability, and resiliency of the Domain Name System in accordance with ICANN's mission” This is not removing the previous issue of conflation – disclosing data is not part of the purpose of ICANN – suggest deleting Purpose 2 The Team is operationalizing disclosure. If this is an issue, the Team would have had a major crisis at the beginning of Phase 2, but no one raised this issue because it isn’t one. Third party purposes are conflated, and that is the problem. If a third party is helping ICANN achieve SSR, that is the third party’s purpose. If ICANN required the third party, then ICANN would enter into contractual relationships with them. Consider preparing a table with existing purposes from Phase 1 and see if the Team can identify any gaps The Team spent a long time on this back in Phase 1 – security and stability is not a purpose for collecting information in this instance. The creation of this instrument does not need a specific purpose to make it happen. There seems to be some hints of agreement as the first statement as a purpose statement, but the Team may need to define the processing activities behind the SSAD. The Team could further define the processing activities: we don’t need to identify collection b/c that is identified in purposes, but there would need to be a processing activity of the transfer of data from CP to requestor and perhaps retention of that data. Documenting this would help with the framework and in showing how the DPA might view it. Do not understand why the Team needs to go down this road. BC/IPC seems to believe SSAD will be created and before it’s turned on, there will be cries of no purpose, and therefore, no SSAD. This is a mischaracterization of BC/IPC’s position – ICANN conducting research, ICANN implementing policies are other purposes that are not currently identified. The Team is talking about two different aspects: is a specific purpose needed in relation to ICANN’s role in SSAD? The second question: is there a purpose for additional ICANN purposes like research. For the second question, the group may want to consider in context of the OCTO question – the EPDP Team needs to review that response. Does it make sense to take that issue separately? EPDP Team needs to get on with a DPIA EPDP Team feedback Confirm next steps Support Staff to create a table where Phase 1 purposes are identified and identify what gaps exist to make the precise formulation of a new purpose (if necessary) Action: Brian and Volker to lead the online conversation of the possible formulation of Purpose 2 8. Wrap and confirm next EPDP Team meeting (5 minutes): Thursday 5 March 2020 at 14.00 UTC (topics: City field redaction and Automation Use Cases – small team recommendations) Confirm action items Confirm questions for ICANN Org, if any

3 3

Clarification of the proposed SLA process
by Mark Svancarek (CELA) 04 Mar '20

04 Mar '20

Since there is still some confusion regarding how the proposed SLAs would function under SSAD, Volker and I have prepared the following hopefully-handy document. Marksv & Volker

1 0

**Reminder** Meeting Invitation / Observers / GNSO Temp Spec gTLD RD EPDP-P2 call / Thursday, 05 March 2020
by Julie Bisland 04 Mar '20

04 Mar '20

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 05 March 2020 at 14:00 UTC for 2 hours. For other times: https://tinyurl.com/uvfuh4f [tinyurl.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__tinyurl.com_uvfuh4f&d=…> Agenda Wiki: https://community.icann.org/x/WR_JBw The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> If needed, an option to join via telephone has been added for this meeting. **Join information - Conference Bridge: Toll-free access number (US and Canada): 800 550 6865 and Toll 213 233 3193 Other telephone numbers found here: http://www.adigo.com/icann [adigo.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.adigo.com_icann&d=D…> Enter passcode on telephone: 7349 Kind Regards, Terri

1 0

ICANN67: GNSO Sessions - How to Get Organized and Remote Participation Details
by Julie Bisland 02 Mar '20

02 Mar '20

Dear all, The one-stop wiki page for all your Remote Participation queries is now available. This wiki page covers remote participation details for all GNSO open virtual meetings. In addition to this, ICANN Meetings’ Team has put together an updated ICANN meeting website which allows you to download all GNSO-related meetings to your inbox calendar in one go. 2 LINKS TO BOOKMARK NOW: ICANN67 Meeting Schedule<https://67.schedule.icann.org/> GNSO Remote Participation Wiki Page<https://community.icann.org/x/dACJBw> Step 1 – Create a profile and your personalized ICANN67 schedule Go to the Meeting Schedule webpage and create a profile and login. Every session on the full schedule can be selected and added to your individual schedule by clicking the Add box to the bottom right of each meeting, this adds it to your individual schedule which you can then add to your calendar. See next step. Step 2 - There are two ways to import your schedule into your calendar: once you’ve added all your chosen meetings to “My Schedule” go to Export. · Downloading creates a one-time snapshot of your schedule and copies it into your default calendar. If you subsequently make changes to your Pathable calendar, they will not be reflected in your calendar. · Subscribing creates a live feed of your schedule in your default calendar. Outlook checks for changes every few hours and updates your calendar appropriately. [cid:image001.png@01D5F08C.0F3E3380] * Select either Download or Subscribe My Schedule * Meetings will download to your default calendar * For Microsoft Outlook, right click on the ics attachment, open with Microsoft Outlook Step 3 All remote participation sessions will use Zoom rooms. You can find the Zoom room links for public meetings on the ICANN67 Meeting Schedule<https://67.schedule.icann.org/> and on the <https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> GNSO Remote Participation Wiki Page<https://community.icann.org/display/gnsocouncilmeetings/ICANN67+GNSO+Remote…>. Zoom access details for closed meetings will be communicated separately. There are three options to connect your audio: 1) Via VoIP, choose Computer Audio 2) Getting a dial out from Zoom to your phone, choose Call Me 3) Phoning into the audio bridge (access numbers and Meeting ID are provided for that option), choose Telephone Audio If you cannot log into the Zoom room, but wish to connect via telephone only, to dial into the audio refer to the GNSO Remote Participation Wiki Page<https://community.icann.org/display/gnsocouncilmeetings/ICANN67+GNSO+Remote…> for access numbers and individual Meeting IDs. Step 4 Please download the mobile app by searching for “ICANN Meetings” in your app stores. For all GNSO meeting related queries (RP or others), please email us at: gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> and we will be more than happy to assist! Kind regards, GNSO SO/AC Support team -- Julie Bisland GNSO SO/AC Support coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Skype ID: 79613b691cb8a6c1 Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0