March 2021 - Gnso-epdp-team

EPDP P2A Chair Update to GNSO Council
by Drazek, Keith March 22, 2021

March 22, 2021

Hi all, As promised last Thursday, attached are the draft slides I intend to use to update the GNSO Council on Wednesday. As always, thanks to our Staff colleagues for their work to help develop these. To recap our earlier discussion, my key speaking points/recommendations in support of the slides will be: 1. The EPDP Team got off to a slow start around the December/January holiday season, but has made recent progress after repurposing two plenary sessions in support of the legal committee. 2. The EPDP P2A legal committee has submitted its questions to Bird & Bird and we are looking forward to timely feedback within the next 2-3 weeks. 3. There appears to be a possibility that the EPDP P2A team may reach consensus on guidelines for registrars who choose to differentiate between legal/natural. 4. It is premature to determine whether consensus is likely or possible on additional Consensus Policy recommendations related to the legal/natural distinction. We will have a clearer picture following the receipt of pending advice from Bird & Bird. 5. The EPDP Team continues to work on the subject of unique email identifiers and more work is needed on the subject of anonymized vs. pseudonymized emails and whether those can be reasonably implemented within a single registrar or across the entire registrar channel. 6. The EPDP Team is committed to continuing its work through the current timeline. This would warrant a further update to the GNSO Council at the end of May, which is current target for publication of the Initial Report. 7. We will know by the end of May whether consensus is likely. If so, we will continue to produce a Final Report for Council consideration. If not, we will recommend suspension or termination of the EPDP P2A, until such time there is additional information and/or material changes to warrant further consideration and policy development work. Please let me know if anyone has feedback or concerns. Thanks, Keith

3 2

Legal/Natural Framing Document
by Drazek, Keith March 22, 2021

March 22, 2021

Hi all, In coordination with our Staff colleagues, the Leadership team submits the following legal/natural framing document for EPDP Team consideration: https://docs.google.com/document/d/14Fs3b_Sz1ij3Tiu58uy0C69DWFHAq1Dp/mobile… This is very much a working document intending to capture our current status on the legal/natural issue, including identifying next steps and possible paths forward on developing guidance for registrars who choose to differentiate. Please review the document prior to our Thursday plenary call and come prepared to discuss, or feel free to contribute on the list. Thanks and regards, Keith

1 0

**REMINDER! Don't forget to register!** ICANN70: GNSO Sessions - How to Get Organized and Remote Participation Details
by Julie Bisland March 19, 2021

March 19, 2021

Dear all, All ICANN70 GNSO sessions have been listed for your reference on the ICANN70 GNSO wiki page. For all access information and Zoom details however, please refer to the ICANN70 schedule on the meeting website. Registration is compulsory to access the meeting schedule. Information can be found on this page [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/ICANNEventsPortal/icann…> or follow instructions below. Access information will not be circulated via mailing lists. The ICANN meeting website, which ICANN Meetings’ Team has put together, allows you to download all GNSO-related meetings to your inbox calendar in one go. HOW TO DOWNLOAD ICANN70 SESSION INFORMATION TO YOUR CALENDARS: Step 1 - Create a profile and your personalized ICANN70 schedule Go to the Meeting Schedule webpage [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…> and create a profile and login. Every session on the Full Agenda can be selected and added to your individual schedule by clicking the [cid:image001.png@01D71CAE.A3CAC0A0] in the upper right corner of each meeting. This adds it to your individual schedule, My Agenda, which you can then add to your calendar. See next step. Step 2 - To import your schedule into your calendar: once you’ve added all your chosen meetings to your schedule, click on [cid:image002.png@01D71CAE.A3CAC0A0] (View My Agenda) * Click the down arrow next to Export * Select Export My Agenda (ics) * Open the exported meetings .ics and add to your chosen calendar * For Microsoft Outlook, right-click on the exported meetings .ics file and choose Show in Folder Right-click on the file, and select Open with Microsoft Outlook. Save & Close. Note: Your Agenda can only be exported from the desktop app; the ICANN70 phone app does not offer this feature Step 3 - All remote participation sessions will use Zoom rooms. You can find the Zoom room links for public meetings on the ICANN70 Meeting Schedule [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/agenda*/?limit=20&…>. PLEASE ENSURE YOU HAVE UPDATED YOUR ZOOM APP TO THE LATEST VERSION TO ACCESS ICANN70 SESSIONS. Please download the latest Zoom app [zoom.us]<https://urldefense.com/v3/__https:/zoom.us/download__;!!PtGJab4!tqxc8RJNnQI…> on your participation device (mobile or desktop computer). Need to learn or brush-up on using Zoom? Check out the Joining a Zoom Meeting Tutorial [support.zoom.us]<https://urldefense.com/v3/__https:/support.zoom.us/hc/en-us/articles/201362…>. Step 4 - Download the mobile app by searching for “ICANN Meetings” in your app stores. There are three options to connect your audio: 1) Via VoIP, choose Computer Audio (from a smartphone choose Call using Internet Audio) 2) Getting a dial out from Zoom to your phone, choose Call Me (from a smartphone choose Call My Phone) 3) Phoning into the audio bridge (access numbers and Meeting ID are provided for that option), choose Telephone Audio (from a smartphone choose Dial in) Registration is compulsory to access the meeting schedule. Access information will not be circulated via mailing lists. 1- REGISTRATION: Information can be found on this page [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/ICANNEventsPortal/icann…> or follow instructions below. Please go to this link via an Incognito page if using Google (FILE/NEW INCOGNITO WINDOW): https://events.icann.org/icann70/registration [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/icann70/registration__;…> 2- SCHEDULE ACCESS: Once you are registered, you will receive two emails: 1. The first email will be your registration confirmation within the next 5-10 minutes. 2. The second email will come within 15-30 minutes, and provide your access link to https://70.schedule.icann.org [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…>. The second email will contain a link asking you to "Claim your account". Please follow the steps to create a password for this event, which is not the same as your registration password (for security purposes), previous event passwords will also not work. Access and ability to log into the schedule platform can take up to 30 minutes after completing the registration process. Important Note: Participation links will be posted 24-hours prior to the session start times for security purposes. 3 LINKS TO BOOKMARK NOW: ICANN70 Meeting Schedule [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…> GNSO ICANN70 Wiki Page<https://community.icann.org/x/HINeCQ> GNSO Session agendas<https://community.icann.org/x/AgxACQ> For all GNSO meeting related queries (RP or others), please email us at: gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> and we will be more than happy to assist! Kind regards, GNSO SO/AC Support team

1 0

Notes and action items - EPDP Phase 2A Meeting #11 - 18 March 2021
by Caitlin Tubergen March 18, 2021

March 18, 2021

Dear EPDP Team, Please find below the notes from today’s EPDP Phase 2A Team meeting. The next EPDP Phase 2A meeting will be Thursday, 25 March at 14:00 UTC. Best regards, Berry, Marika, and Caitlin -- EPDP Phase 2A - Meeting #11 Proposed Agenda Thursday 18 March 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. Update on submission of legal committee questions to Bird & Bird (Becky) * Three questions have been sent to Bird & Bird, and Bird & Bird expects to respond the week after next. * There is one additional question, which is an addition to the second question on mitigation steps for legal v. natural. Laureen and Melina have revised the question, based on the discussion during the Legal Committee meeting. * The updated question was circulated to the Legal Committee today with a request to respond by COB tomorrow. * Because this is an additional part of a question, this is unlikely to slow down Bird & Bird’s response time. 3. Legal vs. natural (70 minutes) 1. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); 2. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. a. ICANN org supplemental information on legal / natural study * Brief overview of supplemental information<https://community.icann.org/x/I4GBCQ> provided (ICANN org liaisons) * ICANN org presented its study to the EPDP Team approximately two months ago * During the presentation, SSAC reps asked a follow-up question re: how EU ccTLD operators and company trademark registers handle the publication of legal v. natural person data. * ICANN org provided its response on 3 March. * The first response deals with EU ccTLD operators’ differentiation. ICANN org looked at 33 EU ccTLD operators including .EU, .IS, .LI, .NO, .CH, .UK. Looked to see FAQs, general term, agreements. * Approximately 21 operators use some form of differentiation. * Appendix A provides greater detail of this breakdown. * Using .AT as an example – appears to differentiate. Break out types of data that is published – information was gathered from policy information available on the website re: the publication of personal data. * With respect to company trademark registers, ICANN org took a similar approach – looked at EU IP Office, USPTO, GDPR, and Hamilton memo. Found that company trademark registers are guided by legal obligations to maintain a public register. * EPDP Team questions & comments * Would be helpful to know which of these ccTLDS have laws/regulations (like the one applicable to .eu) that provide a public interest basis for processing. Otherwise very hard to make sense of this. * May be helpful to reach out to colleagues in the ccNSO * Was there a degree of uniformity across ccTLDs? It would be helpful to understand this as the Team is trying to develop a model that could work across many types of entities. * ICANN org to add a separate column re: public interest basis for publishing info * There didn’t seem to be a definitive method across all of the ccTLD operators; methods seemed to vary * How much uniformity in necessary in this system? From SSAC point of view, it may be possible to permit a certain amount of variation across different registries and registrars? Have we sought a posture with respect to the degree of uniformity across companies? * Under Phase 1 recommendations, CPs have discretion of how to handle this. The non-uniform approach is compatible with what is already going on. If we are looking for policy guidance based on ccTLD operators, it doesn’t appear we will get it since the methods vary. * While one method may work for a particular ccTLD, this is unlikely to work for a gTLD registrar. If differentiation is made, the Team should look at the results of the differentiation, how would this be transferable (if at all), what would the output in the RDS look like? * ccTLDs have a much lower risk from getting enforcement from a DPA. Comparing gTLD to registrars to land office registries is not pracitical because this is not analogous – there is not the same public interest or regulatory framework. * Is it worth considering/investigating the value of registrant consent vis-à-vis the various ccTLD policies on display of natural person data, either in the context of legal person registrations or actual natural person registrations? * ccTLDs and gTLDs are not an apples-to-apples comparison. This can be instructive, but they are not the same and should not be assumed to be the same. * The question of consent is a critical one. If NIS-2 gets approved, and there is a requirement to publish information about legal persons, there still may be natural person data present. Consent is likely the way to resolve this conundrum. This is a key question of how to resolve this in the long term. * The NIS-2 references the word “publish” but does not say “publish in an open database”. It could take another avenue such as publish in the SSAD. It is not clear what this means and there are multiple interpretations. The most likely interpretation will be publication in the SSAD. * Confirm next steps, if any Guidance development b. Review input provided on legal vs natural thought experiment * See https://docs.google.com/document/d/1Hf-Nt-VMznpGE4WZ7wWaHF8pXdm8qA28OW7Mjr4… * The work on this exercise is to augment the work already done in Phase 1 and Phase 2. Publishing the data of legal persons does carry with it some risk. If we are thinking outside the box, are there ways to address that risk or mitigate that risk? Berry identified that in Phase 2, there was already the mention of legal risk fund – is this something that could be used to mitigate the risks identified in this table? * Teams to provide a brief summary of their main observations, focusing on new insights or ideas * IPC: Prefer to move away from the discussion of a legal risk fund. With respect to when differentiation would occur at registration or after – would prefer that this did happen at registration. If everything happens early and up front, this seems to be the simplest. Also, if it’s done at registration, there would be no issue with the 60-day lock. * RrSG: easy is not always the best. The 60-day lock may not apply because the only thing that would change is a flag would be added, the information wouldn’t necessarily change. Having a legal risk fund could be a big red flag to DPAs – this could result in additional fines. * NCSG: already agreed that registrants should be able to designate if they would like their info published or not. If this is entirely a self-designation, and there is no burdensome verification check superimposed into the registration process, would support this. Team needs to get to a middle ground. * GAC: encouraged by this framing of the issue. There is ample room to discuss how this goal could be met of allowing a registrant to designate its status and be in control of whether its data that is personal is published. In terms of verification, that is something included in the proposal since it was part of the guidance from Bird & Bird, but not wedded to this requirement. Registrant needs to make this designation and be informed of the consequences of this designation. * RrSG: voluntary self-identification of registrants is the correct direction. This is the way the group can find a solution. Anything that is too heavy-handed on the registrar or registrant would not work. * IPC: Curious to hear what registrars have to add re: the flags. Having worked at a few registrars, there are often indicators tied to a domain name (such as if a domain name is using a local presence service). * RrSG: policy should not be limited by current functionality, but group should still appreciate complexity of what is being suggested. Since a flag indicates a person set, this is more appropriately added to a contact set rather than a domain name. A contacts set is a group of fields that are associated together. One person could provide different information for the same person, and this could be seen as two different people – for example, if the registrant provides street or st, this would be two different people requiring two different flags. This results in an unhappy customer base that is required to take action for no perceived benefit. This flag is a complicated idea with no benefit. * NCSG: spent time looking at legal v. natural – do not understand why we are debating running a legal risk for registrars? The only people that will be hurt by a wrong designation are individuals. * BC: Seems that Tucows will not streamline the system, and that is disappointing. Putting a flag on a registrant is just a notifier or indication of an attribute. This is not personal information. This is not the correct definition of privacy by default. * RrSG: a flag is an internal or external indicator to notify itself that a certain data set is confirmed to contain personal data or not. Whether this is portable or just internal would have to be decided down the road. * Confirm next steps * Registrars – identify differences in Registrar input vs. Proposal 1(a) from Laureen. * RrSG: 1(a) is a step-by-step prescriptive guide that is more implementation rather than guidance, while the registrar guidance is guidance that could work for multiple types of registrars. c. Review input provided on RrSG proposal * See https://docs.google.com/document/d/1YyiBmtcpa5PxsPnKDXZFfU0WEPVhgjN5ySv9KvQ… * Teams to provide a brief summary of their main observations, focusing on new insights or ideas * Confirm next steps d. Development of guidance proposal(s) * If/how should the broadly supported aspects of the different proposals (RrSG, proposal 1a and thought experiment) be brought together? * One proposal or several? * High level vs. detailed? * How to allow for sufficient flexibility to accommodate different business models, while at the same time providing helpful insights to those that want to differentiate? * Volunteers to take a first stab, or should the staff support team be tasked with developing a first draft? 4. Wrap and confirm next EPDP Team meeting (10 minutes): 1. Update to GNSO Council 24 March at 17.00 UTC by Chair and Council Liaison (open to observers * Keith has obligation to report to the Council, which will happen during ICANN70. * Recommendation will be to allow the work to continue in light of the fact that the legal committee has submitted questions that we are awaiting feedback on. * There is a possible path forward on consensus on guidance for registrars who choose to differentiate; it’s premature to determine if there is consensus on consensus policy recommendations, as we are awaiting legal advice. * Recommendation will be to give this group until the end of May and that at the end of May, we will have a clear indication of if we have consensus or not. * Support Staff will circulate the slides that will be used during the Council presentation next week. * Appreciate the recognition that there are paths forward and hope these paths can be built upon. Next milestone will be at the end of May. * End of May is a clear inflection point as this is the target date for Initial Report publication. If there is no consensus on the Initial Report, it’s unlikely we will have consensus at all. * It is critical for team members to do their homework. 1. EPDP Team Meeting #12 Thursday 25 March at 14.00 UTC. 2. Confirm action items 3. Confirm questions for ICANN Org, if any

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2A | Thursday, 18 March 2021 at 14:00 UTC
by Terri Agnew March 18, 2021

March 18, 2021

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2A call held on Thursday, 18 March 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/VghtCQ> (attendance included) and the GNSO Master calendar [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…>. These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a panelist, observers can join as an attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 25 March 2021 at 14:00 UTC
by Terri Agnew March 18, 2021

March 18, 2021

**Reminder, some countries will have changed time, please make sure to check time zone link below. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 25 March 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/WAhtCQ Check your time zone: https://tinyurl.com/1ewmtoe7 The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

**REMINDER** Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 18 March 2021 at 14:00 UTC
by Julie Bisland March 17, 2021

March 17, 2021

**Reminder, some countries will have changed time, please make sure to check time zone link below. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 18 March 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/VghtCQ Check your time zone: https://tinyurl.com/16kxc2w0 [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/16kxc2w0__;!!PtGJab4!p2NNGYL…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Proposed Agenda - EPDP Phase 2A Meeting #11 - 18 March 2021
by Caitlin Tubergen March 16, 2021

March 16, 2021

Dear EPDP Team: Please find below the proposed agenda for the upcoming EPDP Phase 2A meeting on Thursday, 18 March at 14:00 UTC. Please also take note of the following outstanding action items<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…>: EPDP Team to review ICANN org's response<https://community.icann.org/pages/viewpage.action?pageId=159482147> to the follow-up questions from their presentation and provide follow-up questions (if any) by Wednesday, 17 March. EPDP Team to review the Guidance for Registrars When Distinguishing Registrant Type document<https://docs.google.com/document/d/1YyiBmtcpa5PxsPnKDXZFfU0WEPVhgjN5ySv9KvQ…> and provide feedback within the document or on list in advance of the next meeting, as this will be a discussion item during the next plenary meeting. EPDP team to review the comments provided within the Thought Experiment document<https://docs.google.com/document/d/1Hf-Nt-VMznpGE4WZ7wWaHF8pXdm8qA28OW7Mjr4…> and provide additional feedback based on other teams' suggestions. Please note that while the recommendation portions of the document provide questions geared toward registrars, other teams are welcome to include sidebar comments in these sections also. ISPCP and BC to provide feedback. Best regards, Berry, Caitlin, and Marika -- EPDP Phase 2A - Meeting #11 Proposed Agenda Thursday 18 March 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. Update on submission of legal committee questions to Bird & Bird (Becky) 3. Legal vs. natural (70 minutes) 1. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); 2. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. a. ICANN org supplemental information on legal / natural study * Brief overview of supplemental information<https://community.icann.org/x/I4GBCQ> provided (ICANN org liaisons) * EPDP Team questions & comments * Confirm next steps, if any Guidance development b. Review input provided on legal vs natural thought experiment * See https://docs.google.com/document/d/1Hf-Nt-VMznpGE4WZ7wWaHF8pXdm8qA28OW7Mjr4… * Teams to provide a brief summary of their main observations, focusing on new insights or ideas * Confirm next steps c. Review input provided on RrSG proposal * See https://docs.google.com/document/d/1YyiBmtcpa5PxsPnKDXZFfU0WEPVhgjN5ySv9KvQ… * Teams to provide a brief summary of their main observations, focusing on new insights or ideas * Confirm next steps d. Development of guidance proposal(s) * If/how should the broadly supported aspects of the different proposals (RrSG, proposal 1a and thought experiment) be brought together? * One proposal or several? * High level vs. detailed? * How to allow for sufficient flexibility to accommodate different business models, while at the same time providing helpful insights to those that want to differentiate? * Volunteers to take a first stab, or should the staff support team be tasked with developing a first draft? 4. Wrap and confirm next EPDP Team meeting (10 minutes): 1. Update to GNSO Council 24 March at 17.00 UTC by Chair and Council Liaison (open to observers) 2. EPDP Team Meeting #12 Thursday 25 March at 14.00 UTC. 3. Confirm action items 4. Confirm questions for ICANN Org, if any

1 0

**Don't forget to register!** ICANN70: GNSO Sessions - How to Get Organized and Remote Participation Details
by Julie Bisland March 16, 2021

March 16, 2021

Dear all, All ICANN70 GNSO sessions have been listed for your reference on the ICANN70 GNSO wiki page. For all access information and Zoom details however, please refer to the ICANN70 schedule on the meeting website. Registration is compulsory to access the meeting schedule. Information can be found on this page [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/ICANNEventsPortal/icann…> or follow instructions below. Access information will not be circulated via mailing lists. The ICANN meeting website, which ICANN Meetings’ Team has put together, allows you to download all GNSO-related meetings to your inbox calendar in one go. HOW TO DOWNLOAD ICANN70 SESSION INFORMATION TO YOUR CALENDARS: Step 1 - Create a profile and your personalized ICANN70 schedule Go to the Meeting Schedule webpage [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…> and create a profile and login. Every session on the Full Agenda can be selected and added to your individual schedule by clicking the [cid:image001.png@01D71A48.08B07AF0] in the upper right corner of each meeting. This adds it to your individual schedule, My Agenda, which you can then add to your calendar. See next step. Step 2 - To import your schedule into your calendar: once you’ve added all your chosen meetings to your schedule, click on [cid:image002.png@01D71A48.08B07AF0] (View My Agenda) * Click the down arrow next to Export * Select Export My Agenda (ics) * Open the exported meetings .ics and add to your chosen calendar * For Microsoft Outlook, right-click on the exported meetings .ics file and choose Show in Folder Right-click on the file, and select Open with Microsoft Outlook. Save & Close. Note: Your Agenda can only be exported from the desktop app; the ICANN70 phone app does not offer this feature Step 3 - All remote participation sessions will use Zoom rooms. You can find the Zoom room links for public meetings on the ICANN70 Meeting Schedule [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/agenda*/?limit=20&…>. PLEASE ENSURE YOU HAVE UPDATED YOUR ZOOM APP TO THE LATEST VERSION TO ACCESS ICANN70 SESSIONS. Please download the latest Zoom app [zoom.us]<https://urldefense.com/v3/__https:/zoom.us/download__;!!PtGJab4!tqxc8RJNnQI…> on your participation device (mobile or desktop computer). Need to learn or brush-up on using Zoom? Check out the Joining a Zoom Meeting Tutorial [support.zoom.us]<https://urldefense.com/v3/__https:/support.zoom.us/hc/en-us/articles/201362…>. Step 4 - Download the mobile app by searching for “ICANN Meetings” in your app stores. There are three options to connect your audio: 1) Via VoIP, choose Computer Audio (from a smartphone choose Call using Internet Audio) 2) Getting a dial out from Zoom to your phone, choose Call Me (from a smartphone choose Call My Phone) 3) Phoning into the audio bridge (access numbers and Meeting ID are provided for that option), choose Telephone Audio (from a smartphone choose Dial in) Registration is compulsory to access the meeting schedule. Access information will not be circulated via mailing lists. 1- REGISTRATION: Information can be found on this page [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/ICANNEventsPortal/icann…> or follow instructions below. Please go to this link via an Incognito page if using Google (FILE/NEW INCOGNITO WINDOW): https://events.icann.org/icann70/registration [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/icann70/registration__;…> 2- SCHEDULE ACCESS: Once you are registered, you will receive two emails: 1. The first email will be your registration confirmation within the next 5-10 minutes. 2. The second email will come within 15-30 minutes, and provide your access link to https://70.schedule.icann.org [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…>. The second email will contain a link asking you to "Claim your account". Please follow the steps to create a password for this event, which is not the same as your registration password (for security purposes), previous event passwords will also not work. Access and ability to log into the schedule platform can take up to 30 minutes after completing the registration process. Important Note: Participation links will be posted 24-hours prior to the session start times for security purposes. 3 LINKS TO BOOKMARK NOW: ICANN70 Meeting Schedule [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…> GNSO ICANN70 Wiki Page<https://community.icann.org/x/HINeCQ> GNSO Session agendas<https://community.icann.org/x/AgxACQ> For all GNSO meeting related queries (RP or others), please email us at: gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> and we will be more than happy to assist! Kind regards, GNSO SO/AC Support team

1 0

Notes and action items - EPDP Phase 2A Meeting #10 - 11 March 2021
by Caitlin Tubergen March 11, 2021

March 11, 2021

Dear EPDP Team, Please find below the notes and action items<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> from today’s meeting. The next EPDP Team meeting will be Thursday, 18 March at 14:00 UTC. Best regards, Berry, Marika, and Caitlin -- EPDP Phase 2A - Meeting #10 Proposed Agenda Thursday 11 March 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. ICANN org supplemental information on legal / natural study submitted - Please note that ICANN Org’s responses are now posted on the wiki: https://community.icann.org/pages/viewpage.action?pageId=159482147 - Action: EPDP Team members to identify additional questions to ICANN org (if any) by Wednesday, 17 March 3. Feasibility of unique contacts (15 minutes) i. Whether or not unique contacts to have a uniform anonymized email address is feasible, and if feasible, whether it should be a requirement. ii. ii. If feasible, but not a requirement, what guidance, if any, can be provided to Contracted Parties who may want to implement uniform anonymized email addresses. a. Update from Legal Committee on definitions and questions referred to Legal Committee on topic of feasibility of unique contacts (Becky) - Becky: he Legal Committee has worked hard in the last few weeks and has almost finished work on all questions. - The feasibility questions have been pared down to a single three-part question that will employ the definitions the Legal Committee previously circulated to the plenary, i.e., “registration-based email contact” and “registrant-based email contact”). -This will be circulated to the plenary shortly and then to Bird & Bird. - NCSG: Question – is the legal committee concerned with the feasibility or legality of anonymized contacts? - Becky: The Legal Committee is asking B&B to compare the level of risk and type of risk for automated disclosure of registrant-based email contact (which is an email contact that is consistent across the registrations of a single registrant) and, on the other hand, of a registration-based email contact, which would be unique to a particular registration. - The question that had been raised in one case (the Breyer case) – notwithstanding the definition of anonymity in GDPR - that would render the risk of reidentification by third parties insignificant. The Legal Committee is looking for a comparison with the legal risks associated with those choices. - SSAC: The business of trying to set up anonymous and pseudonymous is often the wrong direction. If you’d like to contact the registrant without revealing the contact information, could there be an easily computable email address that is forwarded to the registrant. There is no guarantee of a reply – it doesn’t have to be heavyweight. However, this is straightforward and trivial to implement system. - Becky: That would be work that would not be within the legal committee’s gambit; that is a policy question. b. Confirm next steps 4. Legal vs. natural (60 minutes) i. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); ii. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. a. Update from Legal Committee in relation to questions referred to legal committee on legal / natural (Becky) * Becky: The questions on legal v. natural follow up on the previous legal v. natural memo – specifically the mitigation procedures * There is also a question re: useful precedent with EURid’s interpretation of the regulation, as well as RIPE NCC re: publication of resource holders, and the extent the NIS2 regulation might implicate the balancing test * All questions sent to Bird & Bird were sent to the EPDP Team as an FYI * The Team is still discussing two questions with plans to finalize at the next meeting on Tuesday. * Keith: Regarding the implications of NIS-2 – this is directionally significant. It has the potential to impact the work of ICANN and consensus policies and contracts, but it is far from complete. However, because it is directionally significant, it is important for the Legal Committee to ask for advice. b. Follow up questions to Jamboard brainstorming – Proposal 1a · Review RrSG and RySG responses to leadership follow up questions to input provided on JamBoard (seehttps://docs.google.com/document/d/1Je23419t1xv7OFgD32-DmBrYknUqtbOt4wkt…) * Registrars have provided additional input on Proposal 1a * RrSG: For the 1(a) proposal, the registrar has direct contact with the domain owner at the time of registration. This idea could work for a retail or brand registrar; however, in the reseller model, this would not work because a registrar does not interact with the registrant at the time of registration (or at any point). * It is difficult to provide implementation guidance at this time since we’re not sure what the final policy will be. * Keith: Note of caution: the Team should endeavor to be careful in terms of being overly prescriptive, factoring in the wide range of business models. * RrSG: Guidance for Registrars When Distinguishing Registrant Type – * In putting together this table, the registrar team wants to emphasize that when registrars process data, we must adhere to the principles GDPR requires. On the left-hand column, you will see the principles for data processing under the GDPR. Each row shows what the registrar can do in line with these principles. * In response to Laureen’s clarifying comment, what registrars intended with person type information is when the data subject indicates whether it is a natural or legal person * This chart provides helpful guidance registrars who may not be familiar with GDPR obligations and make sure that domain name owners are able to make an informed choice about how their data is processed while allowing flexibility to registrars based on their own customer base * Keith: Please review this proposal in detail over the coming week so that we can have further discussion at the next meeting. * GAC: Appreciate the registrars’ effort on this – it would be helpful for registrars to zero in on the key differences b/w this proposal and the GAC proposal * RrSG: The key difference is that the GAC proposal is a step-by-step process to be followed in order to achieve a certain goal, while this is a set of principles that a registrar would need to adhere to if they would like to differentiate. It shows the pieces that are necessary without a specific prescription. * BC: Is this a proposal that could be combined with Laureen’s proposal? * RrSG: Not sure if that could work. Anyone that follows Proposal 1(a) should also be following these principles, but in terms of how to combine them - there is still the same difficulty with the GAC proposal because it is overly prescriptive. * Keith: It seems that the “what” is what the guidance or policy should cover, and that as you move into the “how” and “when” is when it becomes potentially too prescriptive in that it may not appropriately cover the range of business models. If we can agree on “what” is expected, the questions of “how” and “when” become the responsibility of each registrar to make that determination. * GAC: It would be incomplete and unhelpful if there is no specificity when this occurs. Practically speaking, it is only useful if it occurs some time before the information is actually published. * Keith: “when” should not be off the table entirely but it should acknowledge these variations * RrSG: The step-by-step process of what to do and when is too much, and the registrar guidance is applicable across business models. In terms of the question of if differentiation can happen – yes it can, but there is a risk, and assuming this risk should ultimately be up to the controller. * BC: There could be a requirement for “within a certain amount of days” for reseller-based registrars. Resellers have to agree to certain conditions and requirements, so not sure why it is impossible to do this within the registration process for resellers. Perhaps we can consider adding a delay to accommodate resellers. * NCSG: The operative question is whether there is personal information including that of employees. Why doesn’t the business constituency come up with a template for businesses to attest that there is no personal data in their registration. This is increasingly difficult when employees work from home. * GAC: If we are talking about reasonable steps and there is inadvertent publication, if the contracted parties will be covered. The risk discussion does not have a lot of merit. The Team is trying to discuss limiting the risks with mitigation techniques. Hopeful the Team can agree that differentiation is important and should happen and CPs come up with suggestions of a way this can be done in line with their business model. * Keith: Part of the group’s work is to come up with guidance for groups who choose to differentiate at this time. * NCSG: This is ignoring the fact that the risk to the registrant is frequently overlooked – registrants are looked at as a source of data that can be freely accumulated. Some groups want data to be available and others want to limit it. Understand that it is convenient for many stakeholders to have access to data in a restrictive manner. And understand that free access to that data creates security and privacy risks that the GDPR was designed to protect. Recommend allowing registrants to consent to publication. Some jurisdictions already require this data to be published. There will also be an SSAD in place – if you really need the data and you have a valid legal basis, you will be able to get it via the SSAD. * RrSG: The case for requiring differentiation has not been made. Where is the necessity to make this a policy requirement as opposed to a voluntary option for registrars to disclose? * RrSG: Surprised to hear that there is no risk to registrars to override the input of a registrant. Creating a new flag for legal v. natural would be a broad and significant change. * Keith: Input from the registrars is important – EPDP Team to take a week to consider it. There will be further discussion on this next week. There have been questions of consent of registrants. Some of this will be further informed by the questions posed to Bird & Bird. · EPDP Team to discuss and confirm updates to be made to proposal 1a · Confirm next steps c. Review input provided on legal vs natural thought experiment · See https://docs.google.com/document/d/1Hf-Nt-VMznpGE4WZ7wWaHF8pXdm8qA28OW7Mjr4… · The purpose of this discussion is to we assume, for a moment, that there is a requirement for CPs to distinguish b/w legal and natural persons – how would contracted parties go about doing this? · The first section of the document is the thought experiment – hypothetical requirement of legal v. natural differentiation. · The next section is trying to leverage what the previous two phases of the EPDP agreed to · Hoping to tease out (at the bottom of the document) where in the registration cycle these checks can occur and what this could actually look like. For each of the recommendations, we requested the registrar reps to respond; however, the rest of the Team is welcome to provide sidebar comments. The concept was to tease out what registrars might be implementing at a conceptual level. · Keith: Nothing discussed in this thought experiment will bind or commit anyone to anything. · In light of the time, we will get into this next week while we await feedback from Bird & Bird. · Resist making policy arguments over whether this should happen. · It’s not a question of how this could be done; it’s about identifying potential challenges and how to mitigate the challenges. · If your group has already provided input, it should not stop you from providing additional input or responding to other groups. Groups who have not yet participated are welcome to provide feedback – particularly in response to the input already provided. · Confirm next steps 5. Wrap and confirm next EPDP Team meeting (5 minutes): a. Meeting #11 Thursday 18 March at 14.00 UTC. b. Confirm action items c. Confirm questions for ICANN Org, if any

1 0