January 2021 - Gnso-epdp-team

EOI for Vice Chair
by Drazek, Keith Feb. 2, 2021

Feb. 2, 2021

Hi all, In preparation for Thursday’s EPDP Phase 2A plenary call, please find the Expression of Interest from Brian Beckham for the role of Vice Chair. Best, Keith From: BECKHAM Brian <brian.beckham(a)wipo.int> Sent: Wednesday, January 27, 2021 2:04 PM To: Drazek, Keith <kdrazek(a)verisign.com> Cc: caitlin.tubergen(a)icann.org; Berry.Cobb(a)icann.org; marika.konings(a)icann.org Subject: [EXTERNAL] RE: [Ext] RE: Q re Phase 2a Caution: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Hi Keith, all, Please see the attached – I hope this covers the necessary bases, but do of course let me know if further detail would be required or if I can answer any questions. Brian

1 1

Legal v. Natural Proposals
by Caitlin Tubergen Jan. 29, 2021

Jan. 29, 2021

Dear EPDP Team: In an effort to continue the constructive progress on the legal vs. natural proposals, the staff support team has developed this google doc: https://docs.google.com/document/d/1N-3HyLJZTBq6tCVB4Ig3ws2Tfjb08RGFP1NTNe1…. As described in the background briefing document<https://community.icann.org/download/attachments/153518176/P2A%20Background…> that was presented during the first meeting, the leadership team has decided to first focus on best practices and proposed methodology regarding how to distinguish between legal and natural person registrations. After reviewing best practices and how differentiation could be done in practice, EPDP leadership believes the team will be better positioned to consider the question of whether the phase 1 recommendation can and should be modified. We don’t expect you to complete these documents yet as Laureen is still due to present part 2 of her proposal, but you are already welcome to provide any input you may have, or any feedback you have on this approach. We note that a number of the other proposals put forward (see here<https://docs.google.com/document/d/1QlM4O_vwx7cQ11DJ_Lx2kqhyyRgDkMXG/edit#h…>) are either similar or focus on specific parts of the proposal that Laureen presented during the call. We would like to ask those that put forward additional proposals that appear linked (Brian, Margie/Mark, Hadia/Alan) to indicate off-list whether they would still like to present their proposals separately or whether you consider these approaches already captured or subsumed by Laureen’s proposal. For next week’s agenda, we will allot time for Laureen to introduce part 2 of her proposal, and Milton, Melina, and Tara to present their proposals. Additionally, we will allot time to any others who have indicated that they would still like to present their proposal if it is different from what Laureen presented. Best regards, Berry, Marika, and Caitlin

1 0

Notes and action items - EPDP Phase 2A Meeting #04 - 28 Jan 2021
by Caitlin Tubergen Jan. 28, 2021

Jan. 28, 2021

Dear EPDP Team, Please find below the notes and a link to the action items from today’s meeting. As a reminder, the Legal Committee will be meeting on Tuesday, 2 February at 14:00 UTC, and the next EPDP Team meeting will be Thursday, 4 February at 14:00 UTC. Best regards, Marika, Berry, and Caitlin Action Items ❗️Please refer to the Google Sheet<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> for Action Items. We will review the action items at the beginning of each call. ❗️ EPDP Phase 2A - Meeting #04 Proposed Agenda Thursday 28 January 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. Update on Council Liaison to EPDP-P2A * The Team will shortly have a GNSO Council liaison to EPDP P2A; this will be formalized at the next Council meeting. Philippe Fouquart has volunteered to serve in this role. b. Update on Legal Committee * Brian Beckham has submitted an expression of interest to the list; the Team should have received this yesterday. * As a reminder, since Brian is not a member of the EPDP Team, if the group is comfortable with Brian as the vice-chair, the Council would need to confirm this is OK. * Please indicate additional questions (if any) for Brian or any objections to his candidacy by COB Wednesday, 3 February, as we would like to formalize this at the next plenary meeting. * The legal committee is now fully formed and will have its first meeting, on Tuesday, 2 February at 1400 UTC. 3. Legal vs. natural (see https://docs.google.com/document/d/1QlM4O_vwx7cQ11DJ_Lx2kqhyyRgDkMXG/edit# [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1QlM4O_vwx7cQ…>) * Each EPDP team member who submitted a proposal will have the opportunity to present the proposal to the team. * Following the brief presentation of the proposal, the Team may respond; however, please provide feedback in a constructive manner. * Please note these are proposals for what registrars may do if they differentiate b/w legal vs. natural. * Question from EPDP Team: why is the group only focused on voluntary differentiation rather than having a discussion about making mandatory differentiation part of a consensus policy? * Response: The Council instructed the EPDP Team to develop best practices and then consider if mandatory differentiation should become consensus policy. * Some proposals only make sense if differentiation is mandatory. * Understand sequencing; however, the endgame for certain stakeholder groups is to find a way that information that is not protected under the GDPR to be published, and that any policy ultimately agreed to is consistency with GDPR. The current policy protects information that is not legally entitled to be protected. * The first question to consider is if any updates are required for EPDP Phase 1 a. Observations from ICANN org webinar · Any remaining questions or missing information on the topic? · Other comments * One interesting thing from the webinar is that the organizations who have differentiated have noted it’s not as onerous as some may have thought. It is worth investigating why these organizations have found this to be easier than one would assume. * There may be value is asking that question; however, this needs to be qualified – have these organizations always differentiated, or was this something they instituted following GDPR? * ICANN org overstepped in this study, as Org weighed the factors in the study but some of the conclusions drawn are wrong * ICANN org noted, during the webinar, that this is a framework and is not meant to be determinative and definitive. It is meant to be a tool to help the group in its deliberations. b. Introduction of proposals for guidance that can be provided to Registrars and Registries who differentiate or want to differentiate between registrations of legal and natural persons · Proponents to introduce proposal * GAC (proposal #5): Fully mindful of the fact that there is a difference in dealing with new registrants vs. legacy registrants, and this proposal is for new registrations, not legacy registrations. The goal is to leverage the legal advice from Bird & Bird. * Upon registration, registrants could identify as legal or natural persons. CPs would be required to use plain language to allow Jane or John Public to understand the difference. There are probably existing models to learn from, as some registrars already do this. In terms of the plain language, focus groups could be used to determine if the language is indeed understandable – the language could then be uniform and required. * Second step would be to send the confirmation to the contact, and technical and admin contact – the email could provide a warning about publication so that the registrant is informed of the consequences. * There could also be a separate verification after that – such as a corporate identification number or some sort of screening process or third-party provider. The EDPB also noted there should be a directive given that legal registrants should NOT be providing personal data in their registration. * Fourth step – if they get it wrong, it should be easy to get it right. * Response: many ccTLDs do similar things; however, registrars still have issues with this. ccTLDs generally focus on one jurisdiction only, while gTLD registrars are dealing with registrants from across the globe. In terms of fixing it if the registrant gets it wrong, there is no putting the genie back in the bottle because the data could have already been harvested. * Emphasize a degree to which GAC’s proposal introduces an unnecessary step. Key question: is the data published or not? If there is an option that says – I want this published – that’s all that is needed. The legal v. natural distinction is confusing and it’s unnecessary if the registrant consents to publication. Do not understand the need for this step. * Under GDPR – is it allowed for a legal person to not have their data disclosed? * Did not hear the GAC proposal invoke corporate registrars. GDPR is silent as to what extent one could voluntarily keep legal person data protected. * The distinction b/w legal and natural is a bit of red herring. The question is does the registration data contain personal information. Having to declare this in the registration path is a bit of a nightmare. An example is Customer A has a user handle for all registrations but now the user handle carries a different meaning. Consent may not be the consent of the data subject. Consent is hard online. * In terms of legacy registrations, this proposal cabins that off and focuses on new registrations. Understand that liability and fines are a concern. The point of this exercise is to go over proposals that minimize liability. As we have all recognized, there is no risk-free or liability-free world. However, if there are procedures in place that will help to minimize liability, we should visit those. Appreciate the suggestion to focus on consent, but focusing on consent does not take us where we need to go because the current policy allows protection of information that has no protection under the GDPR. The law requires certain info to be protected, and the policy goes above and beyond what the law requires. * For new registrants, introducing new handles should not be an issue. In relation to legal person’s data that could include personal data, declaring that there is no personal information is necessary but some of the safeguards suggested by the legal memos suggest using a technical tool to confirm that email addresses of legal persons do not contain personal information. Also, there should be tools for legal persons to correct their data, which is a requirement under Article 16. The legal memos and study provide safeguards in relation to each of the contracted parties’ concerns * The conversation is one-sided, in that it focuses on the privacy side without focusing on the NIS2 directive, which requires the publication of data of legal persons. It’s a good idea to design a policy that considers these issues. * The team is confusing privacy by default and privacy by design – some in the group are focusing on privacy by default. Privacy by design requires a design – we should focus on that. * The question is not if legal data should be protected. What we are talking about is an adjacent problem – we don’t know how we can achieve that in line with the law. Yes, the NIS2 directive notes that legal person data should be published so long as it is in line with data protection law. In terms of privacy by default and privacy be design – in order to have the design, there must be privacy by default. In other words, there was no breach of the data if we were to make a mistake in the design. One core concept in European law is proportionality, and that includes cost of implementation. Is this proportional and feasible, or is this a “in a perfect world scenario”? * NIS2 directive is not something that should be relied b/c it’s a proposal, it is subject to a lot of lobbying and discussion in parliament and when agreed to, it will take years to be transposed into local law. This could be at least five years down the line. How many emails do you expect registrars’ customers to receive? The required notices are numerous and customers already feel spammed by their registrar. * Have not yet heard an argument as to why the team can’t focus on consent rather than a legal v. natural distinction. Someone mentioned that some laws require legal persons to publish their information; however, that is an obligation imposed on the legal person, not the registrar. * With some collaboration and discussion, the team can consider a safety valve that would occur before publication, such as communications with the registrant. These safety valves would provide the registrant an opportunity to not have their information published. If the steps proposed are not enough, would welcome discussion on that. * Privacy by design is getting all of the aspects mentioned in the proposal into the design of the system which reduces the risk of getting information out there. * This may not be a silver bullet, but the team should focus on helping the proposal rather than focusing on getting to zero risk, which is not possible. We’re here to work on how to get to as close to zero risk as possible. * In response to previous characterization that NIS2 is a “legal nothing” is not constructive and minimizes on the EU’s role. There is a clear sign that this is the way the GDPR should be interpreted. There is a lot of talk about the existence of risk and liability, but the Team should try to qualify this. Not every DPA is going to use a nuclear bomb and fine everyone. * In terms of having zero risk here, that is not necessarily true. There is zero risk if there is no publication. * At this time, the NIS2 is a proposal – it will take years to become national law. Once it becomes a valid law, then we can act. * When we talk about privacy by default, there may be other considerations. Do not know how in this plenary we can constructively have a conservation about proportionality. Some people perceive the proportionality of risk to be very high; others think this is very low. * Real-life example: friend who cuts hair and rents a station at a salon. All of the info associated with the LLC is her personal address. Her clients stalked her at her home, and this is a risk that must be considered when legal person data is published. * Circling back to Laureen’s proposal – focus on the first point: notification to registrants to choose if they are legal or natural person and notifying of the risks. * The idea of finding appropriate language will probably look like an ICANN policy report and confuse people. You can ask someone meaningfully if they want their information published very easily, but explaining the difference b/w legal and natural and third party access is too confusing to the average registrant and is overly convoluted. * In the proposal, the term user-friendly – the text needs to be understandable with Joe and Jane Public. This could be an interactive process – it’s an engagement b/w the registrant and the registrar and doing this is part of the process of obtaining a domain name. This is currently being done; we can do some reconnaissance to see how other EU-GDPR compliant entities are doing this already. * Registrants may not speak English as their first language; they may not understand. For many registrars, this will amount to a check-box exercise, and this has inherent risks. · Q & A by EPDP Team · Confirm next steps 4. Feasibility of unique contacts (see https://docs.google.com/document/d/1weQemSQ0-884ILbhmR3OLzUWouyGXMKH/edit [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1weQemSQ0-884…> and https://docs.google.com/document/d/1e2-rVF2wh-821tct76O50QdWwn4ZcIqS/edit [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1e2-rVF2wh-82…>) – if time allows a. Introduction of proposals for options to require unique contacts to have a uniform anonymized email address across domain name registrations that would not result in being treated as publication of personal data · Proponents to introduce proposal · Q & A by EPDP Team · Confirm next steps 5. Wrap and confirm next EPDP Team meeting (5 minutes): a. Meeting #05 Thursday 4 February at 14.00 UTC. b. Confirm action items * EPDP Team members to indicate objections or additional questions (if any) for the vice-chair candidate, Brian Beckham, by COB Wednesday, 3 February. * EPDP Team members who previously prepared proposals for Legal v. Natural and Feasibility of Unique Contacts to be prepared to present proposals to the EPDP Team at the next meeting on 4 February. 1. Confirm questions for ICANN Org, if any * How does ICANN org see its liability risk to enforce mandatory differentiation of legal v. natural persons? For example, the risk for a registry is for 1 zone, for ICANN, the risk is likely for thousands of contracted parties.

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2A | Thursday, 28 January 2021 at 14:00 UTC
by Terri Agnew Jan. 28, 2021

Jan. 28, 2021

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2A call held on Thursday, 28 January 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/iogmCQ> (attendance included) and the GNSO Master calendar<https://gnso.icann.org/en/group-activities/calendar>. These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a panelist, observers can join as an attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 04 February 2021 at 14:00 UTC
by Terri Agnew Jan. 28, 2021

Jan. 28, 2021

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, zoom webinar room will be made available for the EPDP plenary meetings. As a reminder, the zoom recording, audio recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 04 February 2021 at 14:00 UTC for 90 minutes. Zoom room information: Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the Expected Standards of Behavior [icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resource…> Visit the Wiki agenda page: https://community.icann.org/x/jIgmCQ Check your time zone: https://tinyurl.com/y9lengt8 The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

**Reminder** Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 28 January 2021 at 14:00 UTC
by Julie Bisland Jan. 27, 2021

Jan. 27, 2021

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, zoom webinar room will be made available for the EPDP plenary meetings. As a reminder, the zoom recording, audio recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 28 January 2021 at 14:00 UTC for 90 minutes. Zoom room information: Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the Expected Standards of Behavior [icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resource…> Visit the Wiki agenda page: https://community.icann.org/x/iogmCQ Check your time zone: https://tinyurl.com/yd9myw47 [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/yd9myw47__;!!PtGJab4!r8s9Vww…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Post Call | ICANN Org Presentation on Legal v. Natural Study | Tuesday, 26 January 2021 at 14:00 UTC
by Terri Agnew Jan. 26, 2021

Jan. 26, 2021

Dear all, All recordings for the ICANN Org Presentation on Legal v. Natural Study call held on Tuesday, 26 January 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/IwdACQ> (attendance included) and the GNSO Master calendar.<https://gnso.icann.org/en/group-activities/calendar> These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a panelist, observers can join as an attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Proposed Agenda - EPDP Team meeting #04 - Thursday 28 January at 14.00 UTC
by policy＠bacinblack.com Jan. 26, 2021

Jan. 26, 2021

Dear EPDP Team, Please find below the proposed agenda for Thursday’s EPDP Team meeting. Best regards, Caitlin, Marika and Berry ======================= EPDP Phase 2A - Meeting #04 Proposed Agenda Thursday 28 January 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. Update on Council Liaison to EPDP-P2A b. Update on Legal Committee 3. Legal vs. natural (see https://docs.google.com/document/d/1QlM4O_vwx7cQ11DJ_Lx2kqhyyRgDkMXG/edit# <https://docs.google.com/document/d/1QlM4O_vwx7cQ11DJ_Lx2kqhyyRgDkMXG/edit> ) a. Observations from ICANN org webinar * Any remaining questions or missing information on the topic? * Other comments b. Introduction of proposals for guidance that can be provided to Registrars and Registries who differentiate or want to differentiate between registrations of legal and natural persons * Proponents to introduce proposal * Q & A by EPDP Team * Confirm next steps 4. Feasibility of unique contacts (see https://docs.google.com/document/d/1weQemSQ0-884ILbhmR3OLzUWouyGXMKH/edit and https://docs.google.com/document/d/1e2-rVF2wh-821tct76O50QdWwn4ZcIqS/edit) – if time allows a. Introduction of proposals for options to require unique contacts to have a uniform anonymized email address across domain name registrations that would not result in being treated as publication of personal data * Proponents to introduce proposal * Q & A by EPDP Team * Confirm next steps 5. Wrap and confirm next EPDP Team meeting (5 minutes): a. Meeting #05 Thursday 4 February at 14.00 UTC. b. Confirm action items a. Confirm questions for ICANN Org, if any

1 0

Notes and action items: EPDP Phase 2A Meeting #03 - 21 Jan 2021
by Caitlin Tubergen Jan. 21, 2021

Jan. 21, 2021

Dear EPDP Team, Please find below the notes and a link to the action items from today’s meeting. As a reminder, ICANN org will be providing a presentation on the Legal v. Natural Study<https://community.icann.org/display/EOTSFGRD/Legal+v.+Natural?preview=/1535…> on Tuesday, 26 January at 14:00 UTC. Best regards, Marika, Berry, and Caitlin Action Items ❗️Please refer to the Google Sheet<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> for Action Items. We will review the action items at the beginning of each call.❗️ Notes EPDP Phase 2A - Meeting #03 Thursday 21 January 2021 at 14.00 UTC 1. Roll Call & SOI Updates 2. Welcome & Chair updates 1. Reminder to select your represented member on the Legal Committee * The legal committee is expected to reconvene on 2 February, and there will be homework assignments in advance of that call. Support Staff is trying to schedule the first meeting of the Legal Committee, so please confirm your reps as soon as possible. Please remember to (re)confirm your group’s member on the legal committee as soon as possible. If your rep has not changed from phase 2, please let gnso-secs know. * EPDP Phase 2A will be using a new tool for action items: on the screen is the Google sheet<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> that we are using to track action items: only members and alternates have access to this Google sheet. Support Staff is assigning the action items via this sheet. There is a differentiation b/w the different types of items seen on the sheet: meetings, action items. There is also a status column, which will show open or closed. Each action item will have a due date. If a date expires, the item will show as red (see for example, appoint members to the legal committee). 1. Vice-chair selection update * Keith has reached out to Brian Beckham and requested that he provide further information to help inform the EPDP Team’s evaluation of his candidacy. At the same time, Council leadership has been informed of this possible path and the need for Council non-objection to this approach. A Council liaison has not been identified yet. 3. Review of Homework Assignments (75 minutes) Feasibility of unique contacts (see https://docs.google.com/document/d/1weQemSQ0-884ILbhmR3OLzUWouyGXMKH/edit and https://docs.google.com/document/d/1e2-rVF2wh-821tct76O50QdWwn4ZcIqS/edit) a. Review of proposed definitions and terminology: · Review EPDP Team input · Confirm common understanding of definitions / terminology * As a reminder, Staff has inserted the relevant recommendations from phase 1 into the document. Alan G. raised a question on the status of implementation of recommendation #6, which recommends that registrars, as soon as commercially reasonable, must provide the opportunity for the RNH to provide its consent to publish redacted contact information, as well as the email address. * Action: Support Staff to reach out to the Phase 1 Implementation Review Team staff support to request a written update on the status of Phase 1 recommendations, particularly Recommendation 6 and Recommendation 13. * As agreed during the last call, the staff support team took a stab at deriving definitions and descriptions from the different materials available to the EPDP Team. Several team members have provided very helpful input and suggestions. Support Staff has highlighted in in yellow bracketed language or updates that aim to reflect the input that has been provided. Please take an opportunity to review to see if there are any concerns about these clarifications. At this stage, the main focus is to make sure everyone has the same thing in mind when using certain terms or concepts. * An item Support Staff would like to flag is that some of the confusion seems to have arisen from the fact that the original language from the Annex to the Temporary Specification refers to an anonymized email address, while several Team members have pointed out that the actual question relates to pseudonymized email addresses (and not anonymized email addresses). The Legal Committee has already noted this, so perhaps the Team can consider using pseudonymized going forward. * EPDP Team Feedback: * The Team hasn’t completely agreed on terms (as noted in the feedback to the sheets); however, it is important that the Team is talking about the same thing when using the same words. * Staff seemed to suggest that we’re talking about pseudonymization, but the memo seemed to suggest that even anonymized data is personal. Would like some clarity on the status of anonymization – is this allowed in the policy? * The document isn’t complete. It’s clear from our discussions to date that the Team is not using the terms in the same way. Would it be possible to ask for a small team of volunteers to work on the definitions and finalize them? May be helpful to have a separate definitions document. * There is a clear incongruity b/w uniform and unique contracts. * This is language that comes from the legal committee’s question to legal counsel. Perhaps the legal committee could look at this inconsistency. Additionally, other language comes from previous language from the EPDP Team. It may be helpful so that the group could add further comments or concerns, and based on that, the Team can make further changes or create a small team. * Definitions also define the scope of what the team is working on, so it’s important that everyone is on the same page. As an example, uniform pseudonymized email notes “a given registrar” is consistent with the scope of Phase 2A, but at the same time, would this definition serve the purpose of correlation? Have to distinguish anonymized and pseudonymized from the side of the controller and third parties. An important question is will these emails be anonymized from the side of the third party. * This discussion of definitions is unnecessary and beside the point: what the team is doing is having a debate about the amount of information that is published. Some groups are having issues with webforms; we are now discussing whether we will move from webforms to some sort of email address. The legal advice from Phase 2 has already told us that a unique email address that can be correlated, that is personal information and it is illegal to publish. This is really a policy discussion about contact information; arguing endlessly about definitions is futile. * In having the discussion, if the team is using certain words, the team needs to use them consistently. Personal data does not necessarily imply that it can’t be processed. * Rec. 13 of Phase 1 already establishes the use of an email address or a webform; most CPs have decided to use webforms, but the use of email addresses is already established. b. Review of problem statement: * Review EPDP Team input * CPH looked at the instructions from the GNSO Council to see what this Phase 2A team is expected to solve. As noted earlier, CPs may use an email address. If the CP does implement an email address, should the CP be required to use certain guidance, what is that guidance expected to be? * There has been some further information imported from Staff from team members during the call. * From a staff perspective, the work done here is not incompatible. However, as noted, the team needs to focus on the question Council asked that the team is expected to respond to. * Confirm common understanding of problem statement / problems that are expected to be resolved * The staff support team used as a starting point the input that was provided during the last meeting and several Team members have added further details to the identified objectives of contactability and correlation. One more objective was proposed, namely research – processing for research or statistical purposes. * In addition, the CPH team has provided a proposed problem statement that seems to be focused on the questions that the EPDP Team is expected to answer, in line with the instructions that the Council provided. * If there is general agreement about what the underlying objectives may have been, maybe moving forward the group can start focusing again on the actual question and the instructions that the Council has provided for how it expects this question to be resolved? * Some did note specific issues with the use of webforms and although that is not the focus of this group, maybe it is something that Contracted Parties can take back to share with their group to see if there are ways to address these issues and/or share best practices? EPDP Team Feedback: * This problem statement does not address the correlation issues that some groups have noted is important. * Need more time to review this. What is pseudonymized for CPs could be anonymized for third parties. * Where did this concept of correlation come from? What is the providence of this concept of correlation, given what the GNSO has asked the team to do? * Correlation is in reference to uniform anonymized email addresses. The second question is worded – is the team intentionally ignoring the fact that members of the team have said that webforms do not work. Some of the webforms are not even fillable. Would like to have a constructive conversation going forward. * Is the webform a compliance concern for ICANN? * If the webform is not working or is not implemented properly, that is more of an ICANN compliance issue, rather than an EPDP P2A issue. The webforms have been horrendously abused; they have been scripted and spammed. Trying to balance operational contactability against abuse. Some registrars use a menu system, rather than a freeform response. * If the webform is not being relayed to the registrant, that is a compliance issue. However, the team did not specify what the webform should contain. * If there is a stated problem, such as contactability, there is no reason this should not be clarified in policy. Specificity is needed here. Problem with Chair’s intervention driving the conversation. * If one of the issues is contactability, or there needs to be a possibility of directly contacting the registrant; another is to make it anonymous to third parties. As a minimum, maybe it should be possible to contact the registrant to anonymously contact the registrant. * Rec. 13 reconfirms the Temp Spec approach: email address or webform to facilitate communication with a registrant. If there are concerns with the webforms, perhaps this could be brought to the Phase 1 IRT. * Helpful to receive an update on webforms for Phase 1 IRT * Current text from Recommendation 13 for the Phase 1 IRT: Where a Registrar redacts the data element values listed in Section 10.3.1.8 or 10.3.1.12, in lieu of “REDACTED”, Registrar MUST Publish an email address or a link to a web form for the Email value to facilitate email communication with the relevant contact, but MUST NOT identify the contact email address or the contact itself. [Rec 13] * Might be better to request an update from the IRT staff lead c. Practical application of pseudonymization · CPH Teams to share examples, if available, of how pseudonymization is used in practice providing input on questions such as do the different registrars communicate at the time of registration and exchange this unique string along with other personal data of the registrant? Or is there a common database where all strings corresponding to each registration are listed? · Q & A by EPDP Team EPDP Feedback: * Surprised at this question. Why would registrars share their customer data with competitors? There is no shared database of contacts b/w registrars, and there is no functional or policy reason for this. * Not aware of any registrars using pseudonymization for contacts and it may be difficult to find an example when not currently aware of any. * One should not be expected to share data with competitors but could share a pseudonymized algorithm across registrars. * Question of are their practical examples of this in the wild – the answer today seems to be no. * There was a previous conversation whether this exists in the wild. There are some privacy services that offer functionality for pseudonymization. In terms of sharing this across registrars – this does not exist, other than sharing to a thick registry. * Registrars do need to share info with the registries – there may be a handle that registrars share – is this generated in a pseudo-anonymous way that may be further investigated * Examples of pseudonymization are beside the point as this would ultimately be illegal publication. * Do CPs not use pseudonymization at all * There is no requirement that emails remain protected when there is no personally-identifiable data associated with it. The email could be available upon request, rather than published. One could make a request for a domain name with a phishing attack. One could then ask for all other domain name associated with that email address. * With respect to the information registrars send to registries – when registrars create a registration with a registry, they are required to create a unique identifier, but that is tied to the domain registration, not the contact info. If the domain is transferred to another contact, that unique identifier does not change. * In looking at the B&B memo, this is not an outright exclusion of using pseudonymized techniques. The memo refers to risk reduction. The study that was referenced (ENISA) – it is all about pseudonymization and the techniques and analysis that must be used so that the public cannot decode it. As a starting point, do not believe this is illegal – rather, how to reduce the risk that the data is anonymized vis-à-vis the public. * This group is supposed to talk about data published in the RDS or requested via the SSAD. Everything else can be requested through a subpoena but has nothing to do with this group’s work. Need to make sure that when the team talks about this topic – the group needs to talk about only what the RDS and SSAD require. For example, if one wants correlation data, there is a way to get that – it is called a subpoena that can allow a database query. * This team is paying the price for not having done the DPIA and roles/responsibilities assessment. Even if emails are pseudonymized, you are achieving contact, which is an intrusion. * The team has identified that there is a distinction b/w contactability and correlation. A fundamental question of publishing a pseudonymized or anonymized email address. Reminder for everyone to review the charter what is required. Review the Council instructions – the background briefing paper should include all of this. d. Confirm assignments for clarifying questions · Review input received · Confirm assignments * No input was received on the assignments – this leaves questions 6 – 10 for feasibility without assignment at the moment. The staff support team would like to suggest to assign these questions to the legal committee for further review as these are mostly related to the memos – not all of these seem to be questions that may need to go back to Bird & Bird, but the legal committee may benefit from the input provided to determine what questions, if any, need to go back to legal counsel. * If the group agrees with this, the staff support team will go ahead and compile the questions for the legal committee so it can already start its consideration online to be able to make progress ahead of the legal committee meeting. Will proceed the same way for legal v. natural in the interest of time. 4. Wrap and confirm next EPDP Team meeting (5 minutes): 1. Meeting #04 Thursday 28 January at 14.00 UTC. 2. Confirm action items 1. Confirm questions for ICANN Org, if any * This meeting is expected to focus on legal / natural to allow the EPDP Team to debrief from the webinar on the ICANN org study and further focus on the proposals that have been put forward for potential guidance to registrars and registries.

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2A | Thursday, 21 January 2021 at 14:00 UTC
by Terri Agnew Jan. 21, 2021

Jan. 21, 2021

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2A call held on Thursday, 21 January 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/h4gmCQ> (attendance included) and the GNSO Master calendar <https://gnso.icann.org/en/group-activities/calendar/2021> . These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a panelist, observers can join as an attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0