February 2021 - Gnso-epdp-team

Update on vice chair and GNSO Council liaison
by Caitlin Tubergen Feb. 27, 2021

Feb. 27, 2021

Dear EPDP Team, This message is to inform you of the GNSO Council’s non-objection to the appointment of a non-EPDP Team member (Brian Beckham) as vice-chair to the EPDP Phase 2A Team. Additionally, the GNSO Council has appointed Philippe Fouquart as the GNSO Council Liaison to the EPDP Phase 2A Team. Welcome to the Team, Brian and Philippe! Best regards, Berry, Marika, and Caitlin

4 3

For your review: EPDP homework - due Wed 24 February
by Caitlin Tubergen Feb. 26, 2021

Feb. 26, 2021

Dear EPDP Team, Thank you for using the Jamboard<https://jamboard.google.com/d/1H3CDUTITCfgcS85WMjlvyLV07cb7_V7ksFz8lVjExPg/…> to input your ideas in response to Laureen’s proposal (Proposal 1a). EPDP Leadership, together with Support Staff, reviewed the input received and has suggested some follow-up questions for groups to consider in advance of the next plenary meeting. The new Google Doc includes: (1) a flow chart of Proposal #1a on p.1; (2) the text of Proposal 1a on p.2; and (3) Leadership’s follow-up questions to the groups beginning on p.3. Please review the questions directed at your group and provide additional comments by Wednesday, 24 February at 14:00 UTC: https://docs.google.com/document/d/1Je23419t1xv7OFgD32-DmBrYknUqtbOt4wktPEj…. Please let us know if you have any questions. Best regards, Berry, Marika, and Caitlin

1 1

Re: [Gnso-epdp-team] Update on vice chair and GNSO Council liaison
by Drazek, Keith Feb. 26, 2021

Feb. 26, 2021

Re-sending as I see my reply didn’t go to the full list. Best, Keith From: Drazek, Keith Sent: Friday, February 26, 2021 11:51 AM To: 'vgreimann(a)key-systems.net' <vgreimann(a)key-systems.net>; 'caitlin.tubergen(a)icann.org' <caitlin.tubergen(a)icann.org> Subject: RE: [EXTERNAL] Re: [Gnso-epdp-team] Update on vice chair and GNSO Council liaison Thanks Caitlin and Volker. The extended timeline was partly due to the need for Council to indicate support, and the timing of the scheduled Council meetings. Having a Vice Chair is important in case I get hit by a bus, or the lottery. 😉 Fortunately Brian has been observing our meetings for the last couple of months so he’s up to speed on our work. Welcome Brian! Cheers all, Keith From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Volker Greimann via Gnso-epdp-team Sent: Friday, February 26, 2021 11:46 AM To: Caitlin Tubergen <caitlin.tubergen(a)icann.org<mailto:caitlin.tubergen@icann.org>> Cc: gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: [EXTERNAL] Re: [Gnso-epdp-team] Update on vice chair and GNSO Council liaison Caution: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. That sure took time. Given our timeline, do we actually still need a Vice-Chair? Congrats. -- Volker A. Greimann General Counsel and Policy Manager KEY-SYSTEMS GMBH T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net<http://secure-web.cisco.com/1iSsvnBKq3RqDUX1KpgajBDpZ5S9pvd65d0jqHlGkS1UloB…> Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358. This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached. <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> Virus-free. www.avast.com<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> On Fri, Feb 26, 2021 at 12:33 AM Caitlin Tubergen via Gnso-epdp-team <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> wrote: Dear EPDP Team, This message is to inform you of the GNSO Council’s non-objection to the appointment of a non-EPDP Team member (Brian Beckham) as vice-chair to the EPDP Phase 2A Team. Additionally, the GNSO Council has appointed Philippe Fouquart as the GNSO Council Liaison to the EPDP Phase 2A Team. Welcome to the Team, Brian and Philippe! Best regards, Berry, Marika, and Caitlin _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://secure-web.cisco.com/1vWvtptqC19iaDQHez8WzT3sjoA6h0S_7z3HQ4ItPUAOr5…> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://secure-web.cisco.com/13kEmqPBnmYE26KnOxgGxEbi9gVal7teRCaC6DI41Ktm91…>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://secure-web.cisco.com/1O2S5DCUjvkEp_FbNDzetsMavmobGLKLePh8nwjofFAi8V…>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

1 0

ICANN org response to 28 January question concerning "liability risk"
by Amy Bivins Feb. 25, 2021

Feb. 25, 2021

Dear All, Below is a response from ICANN org to a question raised by the EPDP 2A Team on 28 January: How does ICANN org see its liability risk to enforce mandatory differentiation of legal v. natural persons? For example, the risk for a registry is for 1 zone, for ICANN, the risk is likely for thousands of contracted parties. We understand this question about potential liability for differentiation of registration data of legal vs natural persons is being asked from the perspective that a contractual requirement (including a requirement in a consensus policy or a temporary policy that contracted parties must comply with under their agreements with ICANN) for differentiation between data of legal and natural persons would make ICANN a controller with respect to any processing of personal data that might occur as a result of that differentiation. (As a side note, this question asks about “ICANN org” liability in relation to controllership. To clarify, however, such liability would exist for ICANN, the Internet Corporation for Assigned Names and Numbers, a California non-profit, public benefit corporation, and not only for ICANN org, as a part of ICANN.) The concepts of controller and processor cannot always be clearly differentiated from each other and, in particular, the concept of joint controllership is still developing and in the process of being shaped by court decisions and data protection authority guidance (see Draft Guidelines 07/2020 on the concepts of controller and processor in the GDPR<https://urldefense.com/v3/__https:/edpb.europa.eu/our-work-tools/public-con…>). At the moment, it’s not clear whether a Consensus Policy requirement, alone and absent ICANN’s actual involvement in processing contemplated under any such Policy, would make ICANN a controller for this processing. ICANN org has been advocating for clarity in this regard. For example, ICANN org’s 19 October 2020 Public Comment to the Guidelines 07/2020<https://edpb.europa.eu/our-work-tools/public-consultations-art-704/2020/gui…>, Feedback Reference 07/2020-0047 stated: “… ICANN org would recommend a further clarification of whether a contract between the parties, alone, would lead to a joint controllership assumption if one party lacks any factual influence on the processing. The Board states that “[i]n line with the factual approach, the word “determines” means that the entity that actually exerts influence on the purposes and means of the processing is the controller.” Building on that, it should be emphasized that a contractual set of rules or a joint code of conduct, without further possibilities of exerting control over the actual processing activities, is not sufficient to assume joint controllership and that independent controllership would need further examination on the basis of the other criteria described for control stemming from factual influence in the Guidelines.” In the same Public Comment document, ICANN org also rejected the notion that requirements stated in policies may lead per se to an assumption of controllership: “…, adherence to international community-based policies by decentralized organizations (e.g., umbrella associations, standardization organizations, global think tanks) should not per se lead to a general controllership assumption of both the members and the organization itself. This is particularly important if the latter merely coordinates the policy-making process, as is the case with many governance models in the digital space.” Some have asked about how the NIS2 might apply in this scenario, and members of the Phase 2A team have raised questions about whether and how the team could or should account for NIS2 in their current work. Among other things, article 23 (4) of the NIS 2 Directive requires that “Member States shall ensure that the TLD registries and the entities providing domain name registration services for the TLD publish, without undue delay after the registration of a domain name, domain registration data which are not personal data.” In ICANN org’s view, under the wording of Article 23 (4) as proposed in the NIS 2 Directive, the issue of presumably non-personal data such as the domain name or the legal person’s name containing data that are to be considered personal data under EU data protection rules remains. Therefore, also the question by which means a differentiation between personal and non-personal data shall be accomplished and how liability under EU data protection law is allocated if personal data are mistakenly published in this process. ICANN org intends to highlight that in the contribution it plans to submit to the public consultation on NIS2 and welcomes additional clarification. In any event, if the EPDP Team develops consensus policy recommendations concerning differentiation, and the Board determines it is in the best interests of the ICANN community and directs ICANN org to implement such recommendations, ICANN org would do so. Regards, Amy and Brian G.

1 0

FW: ICANN Stakeholder Assembly: A Briefing by the European Commission on the Recent EU Initiatives on Digital Services and Cybersecurity
by Brian Gutterman Feb. 24, 2021

Feb. 24, 2021

Dear all, In case you haven’t already received this, I am forwarding the invite for the “ICANN Stakeholder Assembly: A Briefing by the European Commission on the Recent EU Initiatives on Digital Services and Cybersecurity” that is taking place this Friday 26 February at 15:30 UTC. During the webinar the European Commission will provide an overview of the recently announced initiatives, including: * The Digital Services Act (DSA) * The EU Cybersecurity Policy Initiatives: * The Cybersecurity Strategy * The revised Network and Information Security Directive (NIS2) The briefing will focus on the areas of relevance to the DNS and the broader ICANN community, and answer questions on these important initiatives and their possible impacts. Here<https://icann.zoom.us/webinar/register/WN_3DjDGwH7Q0KsKLtBYElkBA> is the direct link to registration. Please note you can submit questions in advance, if you so wish, to nora.mari(a)icann.org<mailto:nora.mari@icann.org>. For background information, you can view the recording of the “ICANN Stakeholder Assembly: ICANN Perspectives on EU Digital Initiatives” that took place on 27 January here<https://icann.zoom.us/rec/play/8uVLgrqdjVQiEWIiiDFcSP9xt0VEH1SxEUOqhkRCa-Cv…>. Kind Regards, Brian

1 0

Legal Committee - approved definitions + approved question for Bird & Bird
by Caitlin Tubergen Feb. 24, 2021

Feb. 24, 2021

Dear EPDP Team, Please find below the updated definitions from the Legal Committee and an approved question for Bird & Bird. Please note the question is sent only as an FYI to the EPDP Team. The Legal Committee is still reviewing other questions that may be sent to Bird & Bird, and the EPDP Team will be informed if additional questions are approved. Updated Definitions The Legal Team proposes replacement of the phrase "Pseudonymous email contact with the phrase "Registrant-based email contact", defined as: “an email for all domains registered by a unique registrant [sponsored by a given Registrar] OR [across Registrars], which is intended to be pseudonymous data when processed by non-contracted parties. The Legal Team proposes replacement of the phrase "Anonymous email contact" with the phrase "Registration-based email contact", defined as “A separate single use email for each domain name registered by a unique registrant, which is intended to be anonymous data when processed by non-contracted parties.” The Legal Team notes that the question of persistence over time (i.e., are the emails changed on a periodic basis) is a policy question for the plenary. Approved Question for Bird & Bird Under the consensus policy adopted, Registrars will give Registrants the opportunity to consent to publication of personal data included in their Registration Data. Please compare the legal risks for contracted parties associated with: 1) publishing personal data based on the Registrant’s consent, on the one hand, And 2) publishing data based on a Registrant’s (i) self identification of the data as either containing legal person data only or also containing natural person data (organization or individual) prior to publication and (ii) undertaking the verification procedures outlined in Bird & Bird’s January 25, 2019 memo (i.e., notify/explain; confirm; verify; opportunity to correct) on the other hand. Thank you. Best regards, Berry, Marika, and Caitlin

1 0

SSAC response re EPDP homework - due Wed 24 February
by Steve Crocker Feb. 24, 2021

Feb. 24, 2021

Folks, In our view, the proposal has two substantial flaws. First, it is overly specific as to the process *all* contracted registrars must use to determine whether the registrant is a legal vs a natural person. Second, it includes procedures for verifying the accuracy of the data for legal persons. The procedure is unnecessary for determining whether the registrant is a legal person. If the eventual policy requires a high degree of accuracy of a legal person's name and address, that's a separate matter and should be dealt with in that part of the policy. The attached memo suggests a simpler and more comprehensive approach. Thanks, Steve

4 7

EPDP 2A -- Call to action....
by Drazek, Keith Feb. 23, 2021

Feb. 23, 2021

Hello EPDP 2A team, We are now one month away from the date I will have to provide an EPDP Phase 2A progress report to the GNSO Council. The ICANN 70 GNSO Council meeting is scheduled for 24 March, and our charter requires that I report to the Council whether I believe we are on a path to consensus, or not. Our ability to continue work on an initial report and final report are dependent on progress made over the next month. In order to make sufficient progress, everyone MUST do their homework and work together in between calls. The future of this group is currently up to us, but one month from now, our fate will be in the hands of the GNSO Council. As such, it is critically important that all groups prioritize our work, both in the legal committee and among the full team, so we can make the best case possible. It is incumbent upon those making proposals to help drive the side-work needed to make progress. Proposals should ideally build on recommendations from Phases 1 and 2 and be both implementable and commercially reasonable. Please reach out to one another, establish ad-hoc small groups, and try to advance this effort around concrete proposals. I know there's work going on within your respective groups; I'm asking you to reach out and engage one another in between plenaries to find compromise paths forward, if at all possible. I appreciate the work that's being done, but we have to dial it up. Best, Keith

2 1

Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 04 March 2021 at 14:00 UTC
by Andrea Glandon Feb. 23, 2021

Feb. 23, 2021

Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 04 March 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/UQhtCQ Check your time zone: https://tinyurl.com/yztdeosb The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Andrea

1 0

CANCELLED | Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 25 February 2021 at 14:00 UTC
by Andrea Glandon Feb. 23, 2021

Feb. 23, 2021

Per the EPDP-P2A Leadership team decision and consultation with the Legal Committee, the Thursday, 25 February 2021 Plenary call is cancelled and will be re-purposed to continue the Legal Committee’s work. The next Plenary call will be on Thursday, 04 March at 14:00 UTC (invite will be sent shortly). Please remember to remove 25 February from your calendars. From: Gnso-secs <gnso-secs-bounces(a)icann.org> on behalf of Terri Agnew <terri.agnew(a)icann.org> Date: Tuesday, February 16, 2021 at 09:58 To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Cc: "gnso-secs(a)icann.org" <gnso-secs(a)icann.org> Subject: [gnso-secs] Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 25 February 2021 at 14:00 UTC Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 25 February 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/k4gmCQ Check your time zone: https://tinyurl.com/ybgrnlca [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/ybgrnlca__;!!PtGJab4!qX92laH…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Re: [Gnso-epdp-team] Jamboard instructions AND homework
by Drazek, Keith Feb. 17, 2021

Feb. 17, 2021

Hi all, I am reinforcing what Caitlin noted below. Please continue to work on the homework assignments following the original schedule. Thanks in advance! Keith From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> On Behalf Of Caitlin Tubergen Sent: Tuesday, February 16, 2021 10:49 AM To: gnso-epdp-team(a)icann.org Subject: [EXTERNAL] Re: [Gnso-epdp-team] Jamboard instructions Caution: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Dear EPDP Team, Please note the Thursday, 18 February plenary meeting has been cancelled to accommodate an additional meeting of the Legal Committee. You all should have received a cancellation notice from Terri. Despite repurposing Thursday's plenary session, please note that your homework assignment is still due per the instructions below. As Keith noted during last week's meeting, it is important that the group continues its deliberations online between meetings. Please take note of the deadlines below; in addition, we would like you to also start providing your group's input on the other pages of the JamBoard. Input on the other pages is due by Monday, 22 February. Thank you. Best regards, Berry, Marika, and Caitlin From: Caitlin Tubergen <caitlin.tubergen(a)icann.org<mailto:caitlin.tubergen@icann.org>> Date: Thursday, February 11, 2021 at 11:42 AM To: "gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Jamboard instructions Dear EPDP Team, Thank you for your willingness to give Google Jamboard a try. You should now all have editor privileges – if not, please let staff know off-list and we’ll try to fix it as soon as possible. Here are the instructions for this week’s homework assignment: * Please get together with your group and log into the Jamboard (see https://jamboard.google.com/d/1H3CDUTITCfgcS85WMjlvyLV07cb7_V7ksFz8lVjExPg/…) * Review the proposal on the first page (the updated proposal by Laureen) * Use a sticky note (fourth option on the menu on the left-hand side) to formulate your group’s concern together with a proposed solution to address that concern. You can use as many sticky notes as you like, but please make sure to include the initials of your group in case any get misplaced. There is no need to use any of the other functionality at this point in time – please stick to the sticky notes. * For this week, please focus on proposal 1a (page 1) but if you want to go ahead and also review the other proposals and provide your input, please feel free to do so. * Please complete your input by Tuesday 16 February COB at the latest. This will allow everyone to review the input received on Wednesday 17 February. Following your review, you are then requested to use the copy/paste function to move those concerns/proposals that your group supports to the right-hand side of the page (“favorite suggestions”). Please do not move your own proposals; this is for other groups to do. * We’ll review during next week’s call the input received with the aim to determine shared concerns as well as supported solutions that can be used to further update and refine the proposal. * As indicated previously, the focus for now is on best practices that can be recommended to Contracted Parties who choose to distinguish. The question of whether there should be changes to the phase 1 recommendation will be considered at a later stage. If you do not have access to Jamboard as a result of local restrictions, please work with your team members to get your input in. If this is not possible, feel free to reach out to the staff support team to assist. As indicated on the call, this is an attempt to provide a more interactive tool to facilitate input and collaboration between meetings. We’ll review during next week’s meeting whether to continue using this tool or whether reverting back to google docs is the preferred approach. Best regards, Berry, Marika, and Caitlin

2 1

Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 25 February 2021 at 14:00 UTC
by Terri Agnew Feb. 16, 2021

Feb. 16, 2021

Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 25 February 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/k4gmCQ Check your time zone: https://tinyurl.com/ybgrnlca The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Jamboard instructions
by Caitlin Tubergen Feb. 16, 2021

Feb. 16, 2021

Dear EPDP Team, Thank you for your willingness to give Google Jamboard a try. You should now all have editor privileges – if not, please let staff know off-list and we’ll try to fix it as soon as possible. Here are the instructions for this week’s homework assignment: * Please get together with your group and log into the Jamboard (see https://jamboard.google.com/d/1H3CDUTITCfgcS85WMjlvyLV07cb7_V7ksFz8lVjExPg/…) * Review the proposal on the first page (the updated proposal by Laureen) * Use a sticky note (fourth option on the menu on the left-hand side) to formulate your group’s concern together with a proposed solution to address that concern. You can use as many sticky notes as you like, but please make sure to include the initials of your group in case any get misplaced. There is no need to use any of the other functionality at this point in time – please stick to the sticky notes. * For this week, please focus on proposal 1a (page 1) but if you want to go ahead and also review the other proposals and provide your input, please feel free to do so. * Please complete your input by Tuesday 16 February COB at the latest. This will allow everyone to review the input received on Wednesday 17 February. Following your review, you are then requested to use the copy/paste function to move those concerns/proposals that your group supports to the right-hand side of the page (“favorite suggestions”). Please do not move your own proposals; this is for other groups to do. * We’ll review during next week’s call the input received with the aim to determine shared concerns as well as supported solutions that can be used to further update and refine the proposal. * As indicated previously, the focus for now is on best practices that can be recommended to Contracted Parties who choose to distinguish. The question of whether there should be changes to the phase 1 recommendation will be considered at a later stage. If you do not have access to Jamboard as a result of local restrictions, please work with your team members to get your input in. If this is not possible, feel free to reach out to the staff support team to assist. As indicated on the call, this is an attempt to provide a more interactive tool to facilitate input and collaboration between meetings. We’ll review during next week’s meeting whether to continue using this tool or whether reverting back to google docs is the preferred approach. Best regards, Berry, Marika, and Caitlin

1 1

CANCELLED | Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 18 February 2021 at 14:00 UTC
by Terri Agnew Feb. 16, 2021

Feb. 16, 2021

Per the EPDP-P2A Leadership team decision and consultation with the Legal Committee, the Thursday, 18 February 2021 Plenary call is cancelled and will be re-purposed to continue the Legal Committee’s work. The next Plenary call will be on Thursday, 25 February at 14:00 UTC (invite will be sent shortly). Please remember to remove 18 February from your calendars. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 18 February 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/kYgmCQ Check your time zone: https://tinyurl.com/y8dwfr5k [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/y8dwfr5k__;!!PtGJab4!sYfoqfF…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Notes and action items: EPDP P2A Meeting #06 - 11 Feb 2021
by Caitlin Tubergen Feb. 11, 2021

Feb. 11, 2021

Dear EPDP Team: Please find below the notes and action items from today’s call. The next plenary meeting will be Thursday, 18 Feb at 1400 UTC. Thank you. Best regards, Berry, Marika, and Caitlin Action Items Please remember to check for action items using the team’s Workplan and Action Items sheet: https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…. EPDP Phase 2A - Meeting #06 Agenda Thursday 11 February 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. Membership update: · Welcome Steve Crocker as a new SSAC rep b. Legal committee update on status of questions being considered for external counsel · The legal committee met on Tuesday and is assessing a way to move more quickly through the questions so that more work can be accomplished in between meetings. · Note from Keith: If the group is not able to make progress in plenary meetings b/c legal committee feedback is needed, a plenary session can be repurposed for the legal committee so that work can move forward. This is an option available, if needed. 3. Feasibility of unique contacts a. Definitions / Terminology – as proposed by Legal Committee (15 min) · Update from legal committee (Becky) · The legal committee had a good discussion on the definitions for feasibility of unique contacts. There was consensus that the use of the word anonymous is problematic in the sense that there is always someone who will be able to identify the registrant, and the definition of anonymization means information that cannot be reverse engineered so that even the data controller cannot identify that person. Both proposed mechanisms are pseudonymous; the difference is that one identifier is a one-time pseudonymous email, while the other is a persistent pseudonymous email. The Legal Committee will come back to the plenary team shortly with updated definitions. · EPDP Team input · The different treatment of pseudonymous emails can lead to different registrant behaviors · This a policy question not a legal question · Interesting that there is no such thing as an anonymous email. Effectively, we have a data set, and within that data set there is a domain name. That cannot be made anonymous due to internet functioning. Has the legal team looked at this question from the perspective of a third party, rather than the data controller? · This is an interesting and difficult question under European law and the ECJ has taken different positions in different cases. A technical reading would be: if anyone can identify the individual, including the data controller, it is not anonymous. · Thank you for the distinction and noting this is a policy question the group is faced with. Definitional discussions are unhelpful in answering the policy question. Could the team set aside, based on this legal input, that the word anonymous has implications and may not be correct? Can the team now agree that the issue is the applicability of the identifier to multiple registrations and the utilization of this identifier? · It is important for the legal committee to finalize the terms being used so that the team can have a common understanding of the terms. · Recommend sticking to the GDPR definitions · Obfuscation is a word that would help here b/c pseudonymization is being misused and conflated with anonymization. The team always talks about a registrant not wanting to be identified because they are doing something criminal, but that is not correct. It could be that someone is trying to protect a patent, for example. It is not a simple case of good guys vs. bad guys. · Agree that inclusion of the term obfuscation could be helpful. · Confirm next steps · Legal Committee will share the updated definitions with the plenary shortly. b. Introduction of proposals (see https://docs.google.com/document/d/1e2-rVF2wh-821tct76O50QdWwn4ZcIqS/edit) for options to require unique contacts to have a uniform anonymized email address across domain name registrations that would not result in being treated as publication of personal data (15 min) · Proponents to introduce proposal o Brian King · The proposal is third parties need an email that actually works. · Seems the concern is contactability. · Keep hearing third parties say that web forms are not a workable option, but have yet to understand why. Is it just the textual limits – what, precisely, is not working? · The web forms at some registrars limit the textual input to an unworkable character limit – for example, one registrar has a character limit of 100 words. Other large registrars only allow third parties to choose b/w a registrar-chosen drop down menu with no freeform field. Insistence on a web form was for IP owners to contact the registrant and describe the issue. · The web form came from the Temp Spec and the implementation from Phase 1 – is that a separate but related conversation for the Phase 1 IRT to have re: access and contactability? Is there an opportunity to make some improvements there? · This does not seem to be a proposal for how to make unique contacts work that complies with data protection law. The web form was already a requirement from Phase 1; do not think this proper use of this phase’s time. With respect to attachments, this a big security concern. · The web forms used to be workable solution, if there is gaming to these – this should be fixed rather than throwing the baby out with the bathwater. There can be rethinking of how web forms can work, but they have proven effective in protecting customers from spam and malware. If there are issues re: contactability, these can and should be fixed. · Web forms are not a requirement; it’s an option. In many cases, and including at many large registrars, not able to effectively communicate with registrants. WHOIS used to facilitate with the registrant; yes, this comes with the potential for spam. GDPR is no reason why there cannot be some sort of email address that facilitates communication. o Melina Stroungi, Chris Lewis-Evans · Is it feasible to use obfuscated or pseudonymized emails of registrants? We all agree that certain personal information – the registrar will always have re: the registrant. The question is – is it feasible for a third party perspective if the registrar publishes an obfuscated third party email. · The reason some have email and some have web forms is because of thick and thin registries. This could be taken as a question as to thick and thin because thin registries allow more direct communication with the customer. · The team is not thinking about what happens when someone has an anonymous email address and then the third party makes the same request to the SSAD. This appears to defeat the purpose of the SSAD, and the team should be mindful of the broader implications of this. · Q & A by EPDP Team · Confirm next steps 4. Legal vs. natural (30 minutes) a. Overview of Laureen’s Updated Proposal · Feedback from this group noted that the important distinction is b/w personal and non-personal data rather than legal v. natural. This rewrite keeps this distinction in mind. The process still starts with the question of legal v. natural. The other aspect of this proposal is mindful of resource issues and trying to leverage existing mechanisms rather than creating a lot of new mechanisms. The current process required under registrar agreements to verify accuracy of information could be leveraged as part of the confirmation process. Information should be quarantined before information is published. At the very end, there is a verification process (step 4). Tried to mitigate some of the concerns by baking in new safety valves and tried to include requirements into already existing mechanisms. · Thank you to those who have been doing work intersessionally. b. Jamboard Brainstorming Experiment · Explain Jamboard concept · Google Jamboard is a new tool that we have access to which is intended to facilitate online brainstorming and collaboration. · It is also a new tool for us so please bear with us if we don’t have all the answers, but we thought it might be worth exploring it as a way to promote and facilitate work in between calls. · For those of you have explored the Jamboard that we created, you may have seen that it is basically an online version of a whiteboard with sticky notes and markers. · The idea is that you get together with your group and review the proposals that have been put forward to date. You use a sticky note (click on the fourth symbol on the left-hand side) to write down your group’s concerns in combination with constructive suggestions for how these concerns can be addressed. Make sure to put the sticky note in the row that has been assigned for your group – to avoid confusion, you are also encouraged to add your group’s name to the sticky note. · Prior to the next meeting during which these proposals will be discussed, you are all expected to have reviewed the input provided by other groups and use the copy/paste function to duplicate on the right side of the Jamboard the concerns you share as well as the proposed suggestions for changes you support (you cannot pick your own proposals!). The idea is that this will give the proponents of the proposals further guidance on how to update their proposals until the group gets to a version that everyone feels comfortable with including in the Initial Report as a best practice to be recommended to Contracted Parties. · Important point – do homework intersessionally. We could consider creating small teams to work on proposals. Encourage folks to reach out to one another outside of meeting time, and bring proposals that have been worked through back to the plenary for discussion. · Test run Jamboard on proposal #1 · Input from EPDP Team on this approach · Confirm next steps · Important point – please do homework intersessionally. We could consider creating small teams to work on proposals. Encourage folks to reach out to one another outside of meeting time, and bring proposals that have been worked through back to the plenary for discussion. 5. Wrap and confirm next EPDP Team meeting (5 minutes): a. Meeting #07 Thursday 18 February at 14.00 UTC. b. Confirm action items c. Confirm questions for ICANN Org, if any

1 0

Notes and action items: EPDP Phase 2A Meeting #06 - 11 Feb 2021
by Caitlin Tubergen Feb. 11, 2021

Feb. 11, 2021

Dear EPDP Team: Please find below the notes and action items from today’s call. The next plenary meeting will be Thursday, 18 Feb at 1400 UTC. Thank you. Best regards, Berry, Marika, and Caitlin Action Items Please remember to check for action items using the team’s Workplan and Action Items sheet: https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…. EPDP Phase 2A - Meeting #06 Agenda Thursday 11 February 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) * Membership update: * Welcome Steve Crocker as a new SSAC rep * Legal committee update on status of questions being considered for external counsel * The legal committee met on Tuesday and is assessing a way to move more quickly through the questions so that more work can be accomplished in between meetings. * Note from Keith: If the group is not able to make progress in plenary meetings b/c legal committee feedback is needed, a plenary session can be repurposed for the legal committee so that work can move forward. This is an option available, if needed. 3. Feasibility of unique contacts a. Definitions / Terminology – as proposed by Legal Committee (15 min) * Update from legal committee (Becky) * The legal committee had a good discussion on the definitions for feasibility of unique contacts. There was consensus that the use of the word anonymous is problematic in the sense that there is always someone who will be able to identify the registrant, and the definition of anonymization means information that cannot be reverse engineered so that even the data controller cannot identify that person. Both proposed mechanisms are pseudonymous; the difference is that one identifier is a one-time pseudonymous email, while the other is a persistent pseudonymous email. The Legal Committee will come back to the plenary team shortly with updated definitions. * EPDP Team input * The different treatment of pseudonymous emails can lead to different registrant behaviors * This a policy question not a legal question * Interesting that there is no such thing as an anonymous email. Effectively, we have a data set, and within that data set there is a domain name. That cannot be made anonymous due to internet functioning. Has the legal team looked at this question from the perspective of a third party, rather than the data controller? * This is an interesting and difficult question under European law and the ECJ has taken different positions in different cases. A technical reading would be: if anyone can identify the individual, including the data controller, it is not anonymous. * Thank you for the distinction and noting this is a policy question the group is faced with. Definitional discussions are unhelpful in answering the policy question. Could the team set aside, based on this legal input, that the word anonymous has implications and may not be correct? Can the team now agree that the issue is the applicability of the identifier to multiple registrations and the utilization of this identifier? * It is important for the legal committee to finalize the terms being used so that the team can have a common understanding of the terms. * Recommend sticking to the GDPR definitions * Obfuscation is a word that would help here b/c pseudonymization is being misused and conflated with anonymization. The team always talks about a registrant not wanting to be identified because they are doing something criminal, but that is not correct. It could be that someone is trying to protect a patent, for example. It is not a simple case of good guys vs. bad guys. * Agree that inclusion of the term obfuscation could be helpful. * Confirm next steps * Legal Committee will share the updated definitions with the plenary shortly. b. Introduction of proposals (see https://docs.google.com/document/d/1e2-rVF2wh-821tct76O50QdWwn4ZcIqS/edit) for options to require unique contacts to have a uniform anonymized email address across domain name registrations that would not result in being treated as publication of personal data (15 min) · Proponents to introduce proposal * Brian King * The proposal is third parties need an email that actually works. * Seems the concern is contactability. * Keep hearing third parties say that web forms are not a workable option, but have yet to understand why. Is it just the textual limits – what, precisely, is not working? * The web forms at some registrars limit the textual input to an unworkable character limit – for example, one registrar has a character limit of 100 words. Other large registrars only allow third parties to choose b/w a registrar-chosen drop down menu with no freeform field. Insistence on a web form was for IP owners to contact the registrant and describe the issue. * The web form came from the Temp Spec and the implementation from Phase 1 – is that a separate but related conversation for the Phase 1 IRT to have re: access and contactability? Is there an opportunity to make some improvements there? * This does not seem to be a proposal for how to make unique contacts work that complies with data protection law. The web form was already a requirement from Phase 1; do not think this proper use of this phase’s time. With respect to attachments, this a big security concern. * The web forms used to be workable solution, if there is gaming to these – this should be fixed rather than throwing the baby out with the bathwater. There can be rethinking of how web forms can work, but they have proven effective in protecting customers from spam and malware. If there are issues re: contactability, these can and should be fixed. * Web forms are not a requirement; it’s an option. In many cases, and including at many large registrars, not able to effectively communicate with registrants. WHOIS used to facilitate with the registrant; yes, this comes with the potential for spam. GDPR is no reason why there cannot be some sort of email address that facilitates communication. * Melina Stroungi, Chris Lewis-Evans * Is it feasible to use obfuscated or pseudonymized emails of registrants? We all agree that certain personal information – the registrar will always have re: the registrant. The question is – is it feasible for a third party perspective if the registrar publishes an obfuscated third party email. * The reason some have email and some have web forms is because of thick and thin registries. This could be taken as a question as to thick and thin because thin registries allow more direct communication with the customer. * The team is not thinking about what happens when someone has an anonymous email address and then the third party makes the same request to the SSAD. This appears to defeat the purpose of the SSAD, and the team should be mindful of the broader implications of this. · Q & A by EPDP Team · Confirm next steps 4. Legal vs. natural (30 minutes) a. Overview of Laureen’s Updated Proposal * Feedback from this group noted that the important distinction is b/w personal and non-personal data rather than legal v. natural. This rewrite keeps this distinction in mind. The process still starts with the question of legal v. natural. The other aspect of this proposal is mindful of resource issues and trying to leverage existing mechanisms rather than creating a lot of new mechanisms. The current process required under registrar agreements to verify accuracy of information could be leveraged as part of the confirmation process. Information should be quarantined before information is published. At the very end, there is a verification process (step 4). Tried to mitigate some of the concerns by baking in new safety valves and tried to include requirements into already existing mechanisms. * Thank you to those who have been doing work intersessionally. b. Jamboard Brainstorming Experiment * Explain Jamboard concept * Google Jamboard is a new tool that we have access to which is intended to facilitate online brainstorming and collaboration. * It is also a new tool for us so please bear with us if we don’t have all the answers, but we thought it might be worth exploring it as a way to promote and facilitate work in between calls. * For those of you have explored the Jamboard that we created, you may have seen that it is basically an online version of a whiteboard with sticky notes and markers. * The idea is that you get together with your group and review the proposals that have been put forward to date. You use a sticky note (click on the fourth symbol on the left-hand side) to write down your group’s concerns in combination with constructive suggestions for how these concerns can be addressed. Make sure to put the sticky note in the row that has been assigned for your group – to avoid confusion, you are also encouraged to add your group’s name to the sticky note. * Prior to the next meeting during which these proposals will be discussed, you are all expected to have reviewed the input provided by other groups and use the copy/paste function to duplicate on the right side of the Jamboard the concerns you share as well as the proposed suggestions for changes you support (you cannot pick your own proposals!). The idea is that this will give the proponents of the proposals further guidance on how to update their proposals until the group gets to a version that everyone feels comfortable with including in the Initial Report as a best practice to be recommended to Contracted Parties. * Important point – do homework intersessionally. We could consider creating small teams to work on proposals. Encourage folks to reach out to one another outside of meeting time, and bring proposals that have been worked through back to the plenary for discussion. * Test run Jamboard on proposal #1 * Input from EPDP Team on this approach * Confirm next steps * Important point – please do homework intersessionally. We could consider creating small teams to work on proposals. Encourage folks to reach out to one another outside of meeting time, and bring proposals that have been worked through back to the plenary for discussion. 5. Wrap and confirm next EPDP Team meeting (5 minutes): a. Meeting #07 Thursday 18 February at 14.00 UTC. b. Confirm action items c. Confirm questions for ICANN Org, if any

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2A | Thursday, 11 February 2021 at 14:00 UTC
by Terri Agnew Feb. 11, 2021

Feb. 11, 2021

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2A call held on Thursday, 11 February 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/j4gmCQ> (attendance included) and the GNSO Master calendar [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…>. These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a panelist, observers can join as an attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 18 February 2021 at 14:00 UTC
by Terri Agnew Feb. 11, 2021

Feb. 11, 2021

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, zoom webinar room will be made available for the EPDP plenary meetings. As a reminder, the zoom recording, audio recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 18 February 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/kYgmCQ Check your time zone: https://tinyurl.com/y8dwfr5k The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Revised GAC Proposal
by Kapin, Laureen Feb. 10, 2021

Feb. 10, 2021

Hi folks, Just a quick note to let you know that the GAC has revised its proposal in light of recent discussions and input. Looking forward to further exchanges on tomorrow's call. Kind regards, Laureen Kapin Counsel for International Consumer Protection Federal Trade Commission (202) 326-3237

1 0

**REMINDER** Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 11 February 2021 at 14:00 UTC
by Julie Bisland Feb. 10, 2021

Feb. 10, 2021

**Updated duration from 90 minutes to 60 minutes to accommodate those who would like to attend the SSR2 Webinar. As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, zoom webinar room will be made available for the EPDP plenary meetings. As a reminder, the zoom recording, audio recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 11 February 2021 at 14:00 UTC for 60 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the Expected Standards of Behavior [icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resource…> Visit the Wiki agenda page: https://community.icann.org/x/j4gmCQ Check your time zone: https://tinyurl.com/y97xxrcy [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/y97xxrcy__;!!PtGJab4!r3beTTj…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

**Updated duration | Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 11 February 2021 at 14:00 UTC
by Terri Agnew Feb. 9, 2021

Feb. 9, 2021

**Updated duration from 90 minutes to 60 minutes to accommodate those who would like to attend the SSR2 Webinar. As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, zoom webinar room will be made available for the EPDP plenary meetings. As a reminder, the zoom recording, audio recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 11 February 2021 at 14:00 UTC for 60 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the Expected Standards of Behavior [icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resource…> Visit the Wiki agenda page: https://community.icann.org/x/j4gmCQ Check your time zone: https://tinyurl.com/y97xxrcy The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Proposed agenda: EPDP Phase 2A Meeting #06 - 11 Feb 2021
by Caitlin Tubergen Feb. 9, 2021

Feb. 9, 2021

Dear EPDP Team, Please find below the proposed agenda for the next EPDP Team meeting. As you will note, for agenda item #4, we want to introduce you to Jamboard – a tool that is intended to facilitate the group’s brainstorming with the objective to further develop and improve the different proposals for legal vs. natural through online collaboration. Some of you may already be familiar with the tool, but for those that aren’t, please click the link prior to the meeting and have a look around (or watch this brief intro: https://www.youtube.com/watch?v=gXwV5SlKLAE) For now, each Jamboard page<https://jamboard.google.com/d/1H3CDUTITCfgcS85WMjlvyLV07cb7_V7ksFz8lVjExPg/…> includes one of the proposals that has been put forward, and, in collaboration with Keith, we’ve added one hypothetical scenario to stimulate the group’s thinking. As indicated previously, the focus (for now) is best practice recommendations for CPs that want (or may need) to distinguish. Once these best practices have been further refined, the EPDP Team will turn to the question of whether, as a result of the work on best practices and a better understanding of the issue and potential risks, changes need to be made to the phase 1 recommendation on this topic. We hope you will find this tool useful, but, of course, if you have any other suggestions on how to stimulate online collaboration in between meetings, please share this with the group. Best regards, Berry, Marika, and Caitlin -- EPDP Phase 2A - Meeting #06 Proposed Agenda Thursday 11 February 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) * Legal committee update on status of questions being considered for external counsel 3. Feasibility of unique contacts a. Definitions / Terminology – as proposed by Legal Committee (15 min) * Update from legal committee (Becky) * EPDP Team input * Confirm next steps b. Introduction of proposals (see https://docs.google.com/document/d/1e2-rVF2wh-821tct76O50QdWwn4ZcIqS/edit) for options to require unique contacts to have a uniform anonymized email address across domain name registrations that would not result in being treated as publication of personal data (15 min) · Proponents to introduce proposal * Brian King * Melina Stroungi, Chris Lewis-Evans · Q & A by EPDP Team · Confirm next steps 4. Legal vs. natural (30 minutes) a. Jamboard Brainstorming Experiment * Explain Jamboard concept * Test run Jamboard<https://jamboard.google.com/d/1H3CDUTITCfgcS85WMjlvyLV07cb7_V7ksFz8lVjExPg/…> on proposal #1 * Input from EPDP Team on this approach * Confirm next steps 5. Wrap and confirm next EPDP Team meeting (5 minutes): a. Meeting #07 Thursday 18 February at 14.00 UTC. b. Confirm action items c. Confirm questions for ICANN Org, if any

1 1

Absence Thursday
by Mueller, Milton L Feb. 9, 2021

Feb. 9, 2021

Hello all, I became ill Thursday morning and had to skip the call. I have heard that Brian King did his very best to fill in for me, for which I am deeply grateful. I intend to return the favor sometime soon! In the next call, I will assume my rightful role as Milton Mueller and will happily replay any part of the agenda that our Chair needs. Dr. Milton L Mueller Georgia Institute of Technology School of Public Policy

2 1

REMINDER: EPDP Team homework
by Caitlin Tubergen Feb. 8, 2021

Feb. 8, 2021

Dear EPDP Team: Support Staff has populated the legal v. natural proposals, which were discussed during the last plenary meeting, into the Google Doc<https://docs.google.com/document/d/1N-3HyLJZTBq6tCVB4Ig3ws2Tfjb08RGFP1NTNe1…>. The five proponents (Laureen, Tara, Melina, Milton, and Margie) may wish to edit their proposals<https://docs.google.com/document/d/1N-3HyLJZTBq6tCVB4Ig3ws2Tfjb08RGFP1NTNe1…> in light of Thursday’s discussion. As a reminder, EPDP Leadership has asked the EPDP Team to use the Google Doc<https://docs.google.com/document/d/1N-3HyLJZTBq6tCVB4Ig3ws2Tfjb08RGFP1NTNe1…> to review the proposals and, using a constructive tone, provide input in the white columns, namely: 1. What concerns do you have about this proposed best practice? How could this concern be mitigated? 2. If there is support for the guidance provided (either in this form or modified form), what incentives could be provided to encourage the adoption by Contracted Parties of this guidance? Once EPDP Members have opined on the proposals, the Team will be better positioned to provide input in the orange column (should the Phase 1 rec be changed?). Please provide input by COB Wednesday, 10 February. Please let us know if you have any further questions. Best regards, Berry, Marika, and Caitlin

1 0

Notes and action items - EPDP Phase 2A Meeting #05 - 4 Feb 2021
by Caitlin Tubergen Feb. 4, 2021

Feb. 4, 2021

Dear EPDP Team: Please find below the notes and action items from today’s EPDP Phase 2A meeting. The next meeting of the Legal Committee will be Tuesday, 9 February at 1400 UTC, and the next plenary meeting will be Thursday, 11 February at 1400 UTC. Thank you. Best regards, Berry, Marika, and Caitlin Action Items Please refer to the Google Sheet<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> for Action Items. We will review the action items at the beginning of each call. Notes EPDP Phase 2A - Meeting #05 Thursday 4 February 2021 at 14.00 UTC 1. Roll Call & SOI Updates 2. Welcome & Chair updates (Chair) a. EPDP Phase 2A project package overview (Berry) * The EPDP Team provides a monthly status report to the Council re: the progress of the group. What you see on the screen is the first status report that will be sent to the Council. This will be the commitment to the plan that the Team is required to provide to the Council, including being committed to the delivery dates. The Team does have flexibility in terms of project change requests. * The first slide is a “poor man’s Gantt chart” or the summary timeline that includes delivery dates. This was first presented in early January and showed the original plan to deliver a report by 31 March. The key takeaway for the summary timeline is that the delivery date of the Initial Report has been extended to the end of May. The Chair’s update to the Council is still likely to occur at the ICANN70 virtual meeting, as it is still a requirement for Keith to provide this update on where the Team stands from a probability of meaningful progress perspective. * The reason why the plan has been extended by two months is partly b/c the Team got a slower start than anticipated, and there is greater demand from a legal advice perspective. It also takes into account that the Team is operating under a slower pace (one meeting per week), though, in effect, with the legal committee, there are now two meetings per week. * It should be noted that even though there are now two additional months, there is still very little meeting time, and the Team needs to be aggressive in its work and leverage offline interactions to meaningfully progress its work. * From a project manager perspective (not trying to presuppose an outcome), the plan is built to the end of a recommendations report being delivered to the Council. * This will be sent to the Council on Monday; it will likely be an AOB item during the Council’s next meeting on 18 Feb. * The other work products under PDP 3.0 include the PCST (project cost support team); because there is not a dedicated budget for this short-term effort, expenses are not tracked, and this will not be included in this project package. * There is also a situation report – the core of this document to understand is the status and health of the project. * The Gantt chart project plan looks like an eyesore on this screen, but it breaks down all of the Team’s work. * The last part of the package is the Google sheet<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> to track meetings and action items. Please regularly check in on this, with particular attention to the open action items. * Follow-up question: the chair is still on the hook to give an update to the Council in March, but based on the progress we’re making so far, the Initial Report is targeted for May, and we are asking the Council to approve that as the team’s timeline? * Yes. As part of PDP 3.0, current and future working groups are required to commit to a set of target delivery dates, and this is the plan the leadership team agreed to. The update to the Council in March was a requirement from the beginning. * Is there anything the team should review or comment on re: the project package? * No, it’s pretty finalized, but the Team is welcome to ask questions or spot inconsistencies. In terms of the substance and target dates, those are set in stone – this is more of an FYI of what will be sent to the Council. * Regarding the March timeline, it’s not a formal consensus call, it’s rather a chance or probability of consensus determination from the chair – this is in line with GNSO Council’s requirement. b. Vice-chair confirmation (see https://mm.icann.org/pipermail/gnso-epdp-team/2021-January/003650.html) * We received one expression of interest for a vice-chair from Brian Beckham. Brian submitted his EOI to the group. Historically, the vice-chair has been a member of the EPDP Team, and the team’s charter is unclear as to whether the vice-chair needs to be part of the team. * Accordingly, Keith will go to the Council for its non-objection to Brian being vice-chair as the Team has expressed no objection to the Brian’s appointment. c. Update from legal committee (Becky) * The Legal Committee met and started working its way through the draft questions received from the plenary. The approach is whether the Team has already received sufficient advice from B&B to answer the questions. If not, do the questions relate to items in scope of the EPDP Team? If so, would the question further the work of the group? So far, the Legal Committee is working on refining the questions received. * Feedback: last time around, the legal committee worked under an unanimity basis – is the methodology the same this time around? * The team was not looking for unanimity, but rather consensus of the small group. 3. Legal vs. natural a. Proposed approach for reviewing and refining proposals * See https://mm.icann.org/pipermail/gnso-epdp-team/2021-January/003654.html * Team is asked to review the proposals and opine on the following questions in a constructive manner: * What concerns do you have about this proposed best practice? How could this concern be mitigated? * If there is support for the guidance provided (either in this form or modified form), what incentives could be provided to encourage the adoption by Contracted Parties of this guidance? * Does this guidance provide sufficient risk mitigation to consider changing the EPDP Phase 1 recommendation? If not, why not and what further risk mitigation would be needed to change your opinion? (Note: this column is meant to be filled out later in the process following assessment of the proposed risk mitigation.) * EPDP Team input & suggestions * This seems to focus only on guidance, but what the team should be focusing on is consensus policy. * Note: the rightmost column of the Google doc<https://docs.google.com/document/d/1N-3HyLJZTBq6tCVB4Ig3ws2Tfjb08RGFP1NTNe1…> is reserved for consensus policy considerations, but leadership would like the team to first focus on best practices and guidance so that the team is better positioned to assess whether the best practices/guidance should become consensus policy. b. Continued introduction of proposals for guidance that can be provided to Registrars and Registries who differentiate or want to differentiate between registrations of legal and natural persons · Proponents to introduce proposal (see https://docs.google.com/document/d/1QlM4O_vwx7cQ11DJ_Lx2kqhyyRgDkMXG/edit) * Laureen Kapin (proposal #6) * This part of the proposal deals with whether the registrant provides personal information or not. It is proposing to leverage existing mechanisms that registrars use to communicate with their clients – education, clarification, confirmation, and ability to correct. * In terms of the discussion going on in the legal committee, Volker had suggested perhaps one option to deal with the risk of inadvertently disclosing personal information is to deal with this information via automatic disclosure through the SSAD. * Feedback: making the differentiation b/w personal data vs. legal v. natural is a more constructive approach. Most registrants have automatic renewal set up without anyone ever noticing anything. The more interaction that is required, the more disruptions that occur. In terms of voluntary updates the customer can make, that could be included in the WHOIS Data Reminder Policy (WDRP), that could work. As soon as this becomes a requirement where the customer has to react and do something, this creates chaos. * It only takes one or two issues before there is an existential business problem. Not every registrant pays attention to their domains or manages them as closely as they probably should. Instead of focusing on how to safely disclose data that is redacted, we could focus on building a mechanism for legal entities or natural persons who consent to publication to get them into a declaration state and focus on a path of mandatory redaction and build a safe publication process. * It’s impossible to prevent all registrants from making a mistake, and that is not the team’s goal. The goal is to put CPs in the best possible position to put the risk at near zero so that a registrant doesn’t have a case if data is disclosed because they were properly put on notice of the disclosure risks. * The voluntary publication is already part of Phase 1 – had previously asked if registrars already do this. The Team needs to understand if this is already being done. The question is: is this in place now, or has it been not implemented? * There will have to be some form of standardization because registrars still have to upload the data to some of the registries. If there is something in place industry-wide, there needs to be standardization. Registrars are dealing with a whole infrastructure that has to be taken into account. * The Phase 1 IRT is still doing its work re: Phase 1 recommendations. * Believe registrars already have implemented this, but it’s likely a bespoke process for each registrar. * The legal committee is discussing considering these recommendations via the SSAD in order to minimize risk – want to ensure this is captured as a discussion item. * Tara Whalen (proposal #8) * SSAC is looking for ways to publish appropriate data to help fight cyber-crime. * SSAC reviewed how this is done in other parts of the industry – particularly RIPE NCC and ARIN. * RIPE NCC’s registrants are legal persons, however sometimes natural persons data is published – RIPE NCC provides mechanisms for the removal and correction of personal data and created an acceptable use policy in line with this. * RIPE NCC needs to ensure contactability, which underpins their approach. The approach states that having contact details responsible for internet number resources facilitates internet coordination and is necessary when something goes wrong. * Proposal is to examine at the permission-based grant to see if this can be used for ICANN’s purposes. * This may already have been subject to previous guidance from B&B. See this memo: https://community.icann.org/display/EOTSFGRD/EPDP+-P2+Legal+subteam?preview…) * Just b/c another guy jumps off a tenth-floor window, we shouldn’t do the same. * The language from the previous phase is helpful, but this question still merits further review. * Are there examples of actual legal actions against companies? * When we’re talking about new regulations, it’s difficult to have this certainty. In terms of increased risk, this is very subjective, and it may not be productive to ask this question. * Could there be data breaches b/c of registrant conduct? Yes, there can. But there can be transparency that mitigates this risk. * These are legally-speaking, very separate analyses. The previous memo deals with consent, and we agree that is a problem. That is a very different question than looking at it through a lens of identification of a legal entity. It would be useful to keep in mind that these are two separate questions. * Action to take this back to the legal committee. * Melina Stroungi (proposal #10) * The proposal is at the core of what the team is discussing – in order to assess whether this is feasible, it would be helpful to have a cost-benefit analysis. The question is what the risks and costs are. Laureen’s proposal, for example, shows how to mitigate the liability risks. There are not only risks when implementing something; there are also risks in not differentiating between legal and natural persons. This has not been included in the cost-benefit analysis. * The group needs to consider how the cost-benefit analysis should be structured and to assess whether this is reasonably possible within the timeframe the team has. * Milton Mueller (proposal #3) * Milton was not present on this call, so this proposal was not discussed. * Other * In terms of preliminary discussion going on in the legal committee, does the disclosure of legal person’s data through the SSAD help mitigate the risk of improper disclosure? * The risk is different from disclosure through the SSAD vs. the publication in WHOIS, such as harvesting of data. When the team looks at the disclosure of information – the ways it can be possible is better within SSAD instead of outside of it. * This would mitigate the risk of an inadvertent disclosure, but from the perspective of ensuring that non-personal information has no basis to be shielded, this still has an above-and-beyond layer, which means this proposal still suffers from the same risks as the status quo that data that is not entitled to protection is protected. Do acknowledge that automated disclosure is more streamlined, but this is still an overprotection of information since GDPR does not protect legal person data. * Whether this is outside of GDPR, if there is still a high risk that the data is inside GDPR, this may be a safeguard that we can consider, but we need to look at if the data is protected. * This proposal does not satisfy the needs of other stakeholders in that there is no ability to use the public information to do correlation. Doing a single query via the SSAD will not provide what is necessary to protect victims of a phishing attack. * An additional proposal developed by EWG, which is a verified contact approach, is something the team should consider. * In Phase 2, the team decided the minimum data that should be public. * It is not this team’s job to determine what is allowed with public data; there are certain freedoms that we have no control over. Using the SSAD to get legal data is something the Team discussed in Phase 2, but CPs noted this is still processing of data and therefore could not be automatically disclosed. * What correlation means is – when identifying potentially infringing domain names, there is a challenge to prioritize what to go after first – if a registrant has several infringing domain names, the problems can be more efficiently addressed. This kind of correlation is perfectly legal and is a useful practice that is no longer possible b/c of how ICANN has treated registration data post-GDPR. * The point is that others can use the same tools to figure out who owns a domain name that is politically inconvenient or persecuted speech in certain parts of the world. Cannot allow the case where registrants might get hurt from the same tools when used for evil instead of good. * The minimum data set was decided in Phase 1. During Phase 1, it was decided that differentiation would be decided later. That is what the team is dealing with now. · Q & A by EPDP Team · Confirm next steps 4. Feasibility of unique contacts (see https://docs.google.com/document/d/1e2-rVF2wh-821tct76O50QdWwn4ZcIqS/edit) – if time allows a. Introduction of proposals for options to require unique contacts to have a uniform anonymized email address across domain name registrations that would not result in being treated as publication of personal data · Proponents to introduce proposal * Brian King * Melina Stroungi, Chris Lewis-Evans · Q & A by EPDP Team · Confirm next steps 5. Wrap and confirm next EPDP Team meeting (5 minutes): 1. Meeting #06 Thursday 11 February at 14.00 UTC. 2. Confirm action items 3. Confirm questions for ICANN Org, if any

1 0