March 2021 - Gnso-epdp-team

On the proposed guidance
by Mueller, Milton L April 15, 2021

April 15, 2021

I was reading through two documents setting out in detail the proposed guidance on legal/natural. There seems to be more than one Google doc on this and I am not sure which one is the latest or most official, though I suspect it is the one with various people's comments crawling all over it. I was pretty supportive of the Guidance overall. I had one problem with it, though. I liked the description of HOW the differentiation needed to take place. But in describing WHEN differentiation takes place and WHO would do it, it sets out 3 "high level scenarios". The first two are ok. The third scenario (listed as #5 in the document) is that the Registrar does it for the RNH, based on "inferences." That option just doesn't fly for those of us representing RNH's in this process. We cannot have a registrant's disclosure status or person type determined FOR them by someone else. If we can strike that part of the guidance, I think we can be on our way to a much broader consensus. Dr. Milton L Mueller Georgia Institute of Technology School of Public Policy [IGP_logo_gold block]

12 25

**Reminder** Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 01 April 2021 at 14:00 UTC
by Andrea Glandon March 31, 2021

March 31, 2021

**Reminder, some countries will have changed time, please make sure to check time zone link below. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 01 April 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/xYSBCQ Check your time zone: https://tinyurl.com/2vkfwsf9 [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/2vkfwsf9__;!!PtGJab4!qkbRqE-…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Proposed agenda - EPDP Phase 2A - Meeting #13 - 1 April 2021
by Caitlin Tubergen March 31, 2021

March 31, 2021

Dear EPDP Team, Please find below the tentative agenda for Thursday’s meeting, noting it is subject to change depending on the timing of receipt of legal advice. Best regards, Berry, Marika, and Caitlin -- EPDP Phase 2A - Meeting #13 Proposed Agenda Thursday 1 April 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) 3. Legal vs. natural (40 minutes) 1. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); 2. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. Guidance development a. Review updated write up of guidance proposal * See updated draft write up developed by leadership & staff support team (https://docs.google.com/document/d/11AYCPVEKjF--Obp-okojggWv1Z4R2PBjvZFOGu4…) * Reactions by EPDP Team: * Does the updated version address input provided to date? * Are there any “cannot live with” aspects remaining? * What incentives, if any, could be considered to promote any guidance agreed to by the EPDP Team? * Confirm next steps 4. Wrap and confirm next EPDP Team meeting (5 minutes): 1. EPDP Team Meeting #14 Thursday 8 April at 14.00 UTC. 2. Confirm action items 3. Confirm questions for ICANN Org, if any Reset for legal committee meeting 5. Legal Committee meeting (45 minutes) a. Initial review of B & B responses to legal committee questions

1 0

Updated Legal v. Natural Write-up
by Caitlin Tubergen March 30, 2021

March 30, 2021

Dear EPDP Team, As discussed during our last meeting, the staff support team has reviewed and considered the input received during the call and via the Google Doc and has taken another stab at updating the legal/natural guidance write up. To facilitate review, you can find a clean version here: https://docs.google.com/document/d/11AYCPVEKjF--Obp-okojggWv1Z4R2PBjvZFOGu4…. We have also attached a redline version to provide further context and transparency. We hope this updated version strikes the right balance between the different views expressed. We wanted to point out and ask specific input on the following: · An additional scenario was added by Brian K. that seemed to propose flagging data automatically for publication and allowing the registrant to correct this designation at a later stage. As a number of respondents pointed out, this seems contrary to the privacy by default principle. As a result, we have provisionally removed this scenario to allow Brian to further explain his proposal so that the group can consider adding it to the list of examples. · Concerns have also been expressed about the last scenario listed, which originally came from the RrSG proposal. A number of updates have been made, especially in relation to the role of the registrant that may address some/all of these concerns, but if not, the group should consider whether or not this example should remain. Of course, you are welcome to provide input on any of the other aspects of the updated write up. Please use the comment function to provide your suggestions instead of the redline function, as this will allow others to react to your suggestions and will avoid people rewriting others’ suggestions. The deadline for input is Friday, 2 April. The idea is to get this document to a near final state in the course of next week so that it can be parked while the group reviews the responses to the legal advice and starts focusing on the other questions it has been asked to address. Thank you. Best regards, Berry, Marika, and Caitlin

1 0

Notes and action items - EPDP Phase 2A Meeting #12 - 25 March 2021
by Caitlin Tubergen March 25, 2021

March 25, 2021

Dear EPDP Team, Please find below the notes and action items<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> from today’s meeting. The next EPDP Phase 2A meeting is scheduled for Thursday, 1 April at 14:00 UTC. Best regards, Berry, Marika, and Caitlin -- EPDP Phase 2A - Meeting #12 Proposed Agenda Thursday 25 March 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. Status update to GNSO Council – feedback and reactions * Consistent with the message to the EPDP Team, Keith gave an update to the GNSO Council, noting that the Legal Committee has completed its work and the Team is currently awaiting feedback from Bird & Bird. Keith noted he believes there is a path to consensus on guidance to registrars who wish to differentiate; however, it’s premature to determine if there will be consensus on changes to consensus policy recommendations at this time. * Some councilors questioned the timeline, as some believed there should have been a go/no go decision at the end of March; however, Keith pointed to the project plan. * There is an expectation that Philippe will give an update to the Council at its April meeting. * Reminder to please continue making progress in good faith and complete homework in a timely fashion. * EPDP Feedback: * There are approximately 8 meetings left. If the Team spends its time looking at non-consensus recommendations, there may not be enough time to discuss actual consensus recommendations. * Encourage team members to speak to one another and do work outside of the plenary meetings. Also, the leadership and staff paper that was circulated is an opportunity to move things forward. * Bird & Bird’s advice should come in next week. * There has been progress working on the guidance and perhaps the Bird & Bird advice could assist; however, would not make any assumptions that legal advice will be determinative in the policy discussions. 3. Legal vs. natural (60 minutes) 1. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); 2. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. Guidance development a. Development of guidance proposal(s) * See draft write up developed by leadership & staff support team (https://docs.google.com/document/d/14Fs3b_Sz1ij3Tiu58uy0C69DWFHAq1Dp/edit) * Initial reactions by EPDP Team: * Does this accurately capture agreed aspects from the different proposals (RrSG, proposal 1a and thought experiment)? If not, what is missing? * Is it sufficiently high level to allow for flexibility to accommodate different business models, while at the same time providing helpful insights to those that want to differentiate? * What incentives, if any, could be considered to promote any guidance agreed to by the EPDP Team? * This document skips the legal vs. natural differentiation and, instead, looks at personal v. non-personal data. This is confusing. The registrants should first be differentiated by legal v. natural and then review if there is personal data. * There are challenges with trying to retrofit this approach with existing registrations. * The format of the document could be improved: for example, when the document gets to proposed guidance, it lists reminders, which is confusing. Perhaps include the reminders under “background”. * There are three scenarios, and it’s useful to have these here – these do not seem to be providing any guidance. * Data protection law does not apply to legal person data; however, there are difficulties in applying the requisite protections to natural persons, not legal persons. * GDPR exists to protect natural persons and not legal persons. Step 1 is important for compliance with the GDPR. First distinguish b/w legal and natural and then personal v. nonpersonal – indeed, this is for new registrations vs. existing registrations. Some members wish to only distinguish between personal and non-personal data – how can you distinguish only b/w personal and non-personal data – would this be done by asking the registrant or would you do it yourself? Also, would this be mandatory or voluntary? * OK with having a differentiation between legal and natural persons, so long as the registrant is in control of this determination and does not have it made for them. If we do introduce a legal v. natural distinction, and someone checks “legal”, there needs to be assurances that this will not be abused. Surprised to hear that someone said there was no guidance in this document – the document does provide guidance. Hope to get rid of the third scenario, but the other two are acceptable. * In terms of the person type, would not infer this as a registrar – would always have the data subject or domain owner indicate what type of person they are. In terms of required or voluntary, open to understanding the possibilities, but there is already a recommendation on this topic, and have not yet seen anything compelling indicating that this distinction should be mandatory. For example, during the last meeting, registrars explained why flags are difficult to implement. * The last sentence is problematic, as it appears to be providing legal advice to contracted parties. This is not appropriate for a WG to be providing legal advice. This should ultimately be up to the individual entity – these recommendations should not be written or drafted in a way that sounds like legal advice or guidance. * Cannot require manual review at the time of registration – this is not scalable * If it is up to the registrant to determine if data is personal or not personal – this has risks that if a registrant is a natural person, you should assume that all data is personal. If you allow differentiation, this is more compliant. * Appreciate concern for the risks we are addressing here. The domain owner can choose to publish information irrespective of person type – risk of publishing data without a proper legal basis is a greater risk of not having a legal person’s data published. * If all information is redacted, am as protected as I can be because I am not at risk of inadvertently publishing personal data. * Understand this point about greater risk of publishing personal data, however, this distinction could be very confusing. Encourage to further discuss with data protection officers – compare the two-step approach with the one-step approach. * The Team is currently talking about guidance – if it is just guidance, the distinction between legal and natural in a two-step process, have trouble understanding what the resistance is to registrars if it is just guidance. Is it b/c if you agree now, you’re concerned with it becoming mandatory? Please explain. The first step may actually be clarifying. If you check “yes” to this, your rights to data protection may be less strong or your data may be published. If you are a company, are you using your home office for your registration? As long as the registrant is in control of those decisions, this would be OK. * If there is a requirement (and there are discussions of requirements in NIS-2), this would be helpful in the future. Do not see a problem with this step being included in the guidance since it is currently optional. * What incentives, if any, could be considered to promote any guidance agreed to by the EPDP Team? * In Phase 1, the registrant can check a box and then the data will be published – this would likely be done by a computer rather than a person. How do you know that you should return the data? This can be called a flag or something else, but there is something informing the response to the query. * Understand the flag concept to be an additional field in the WHOIS record. This would create consistency. * There is a benefit in formally defining this flag – as this flag could carry on to another provider. * If there is the disclosure of legal persons, this would reduce the number of disclosure requests that would require manual review. * The problem is this is adding this complexity serves no benefit to the customer. * If there is an SSAD a nicely automated request system, you can automatically and quickly get concealed data through this process, and registrars won’t be burdened very much because it will be automated. * It’s important to distinguish between publication and disclosure through the SSAD. * Added SSAD recommendation from the Phase 2 final report within the document because it requires disclosure for domains with no personal data. If a flag is added, the system could be configured to respond automatically to requests. * Recommend avoiding the word “published” – what we mean is “provided in response to an RDS query” as this is more accurate. * Have until the end of day tomorrow to provide additional comments in the document. * Confirm next steps * EPDP Team members have until the end of the week to provide additional feedback, and Staff will then take the input and produce the next version. 4. Feasibility of unique contacts (10 minutes) 1. Whether or not unique contacts to have a uniform anonymized email address is feasible, and if feasible, whether it should be a requirement. 2. ii. If feasible, but not a requirement, what guidance, if any, can be provided to Contracted Parties who may want to implement uniform anonymized email addresses. a. Any issues that can be constructively discussed prior to receipt of legal advice? b. Confirm next steps 5. Wrap and confirm next EPDP Team meeting (5 minutes): 1. EPDP Team Meeting #13 Thursday 1 April at 14.00 UTC. 2. Confirm action items 3. Confirm questions for ICANN Org, if any

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2A | Thursday, 25 March 2021 at 14:00 UTC
by Terri Agnew March 25, 2021

March 25, 2021

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2A call held on Thursday, 25 March 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/WAhtCQ> (attendance included) and the GNSO Master calendar [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…>. These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a panelist, observers can join as an attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 01 April 2021 at 14:00 UTC
by Terri Agnew March 25, 2021

March 25, 2021

**Reminder, some countries will have changed time, please make sure to check time zone link below. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 01 April 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/xYSBCQ Check your time zone: https://tinyurl.com/2vkfwsf9 The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Re: [Gnso-epdp-team] On the proposed guidance
by Alan Greenberg March 24, 2021

March 24, 2021

Volker, I can't speak to other data protection laws, but GDPR requires accuracy "for the purposes for which they are processed" (GDPR Article 5(d). If contact data is collected to enable contact with the registrant, and it is "accurate data of the wrong data subject", then it cannot be used to contact the registrant and it is therefore not accurate. Alan At 2021-03-24 05:07 PM, Volker Greimann via Gnso-epdp-team wrote: >Hi Brian, > >That approach is actually very compliant with >data protection law. Overprotection is not an >issue. If you simply protect all data equally in >a way that would be compliant, you do not need to differentiate. > >Accuracy is shown by demonstrating that the data >is unchanged from the time it was created and >how it was created, by showing that the data >subject has contractually agreed to only provide >accurate data (and correct if outdated), and has >been provided with an annual opportunity to >review the data. That is the level accuracy that >is relevant under the accuracy principle of the GDPR, after all. > >On top of that (Bonus round for extra points >here) the data collection process ensured that >only properly formatted data was collected and >the registrant has been required to verify his email address. > >So reasonable steps to ensure the accuracy have >been taken, the data subject can request a >correction at any time and we will take action >on any indication of inaccuracy of the data. > >But the real problem isn't actually inaccurate >data, in our experience. It is accurate data of the wrong data subject. > >-- >Volker A. Greimann >General Counsel and Policy Manager >KEY-SYSTEMS GMBH > >T: +49 6894 9396901 >M: +49 6894 9396851 >F: +49 6894 9396851 >W: <http://www.key-systems.net/>www.key-systems.net > >Key-Systems GmbH is a company registered at the >local court of Saarbruecken, Germany with the registration no. HR B 18835 >CEO: Oliver Fries and Robert Birkner > >Part of the CentralNic Group PLC (LON: CNIC) a >company registered in England and Wales with company number 8576358. > >This email and any files transmitted are >confidential and intended only for the person(s) >directly addressed. If you are not the intended >recipient, any use, copying, transmission, >distribution, or other forms of dissemination is >strictly prohibited. If you have received this >email in error, please notify the sender >immediately and permanently delete this email >with any files that may be attached. > > >On Wed, Mar 24, 2021 at 9:48 PM King, Brian ><<mailto:Brian.King@markmonitor.com>Brian.King(a)markmonitor.com> wrote: > >Hey Volker, > > > >I suppose my point (and I think Iâm also >paraphrasing an intervention made by Melina >previously) is that approach is not likely to be >compliant with data protection law. > > > >I accept that the concept of accuracy as a >policy matter is not within our remit, but >letâs use accuracy as a data protection >principle how could a controller reasonably >demonstrate too a DPA that the controllerâs >data is accurate, for example, if the controller >has not even assessed whether the data is personal data? > > > > > >Brian J. Kingâ >He/Him/His > >Head of Policy and Advocacy, Intellectual Property Group > > >T +1 443 761 3726â > >Time zone: US Eastern Time > > > ><http://www.clarivate.com>clarivate.com | Accelerating innovation > >Follow us on ><https://www.linkedin.com/company/clarivate>LinkedIn, ><https://twitter.com/clarivate?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr…>Twitter, ><https://www.facebook.com/clarivate/>Facebook >and <https://www.instagram.com/clarivateofficial/?hl=en>Instagram > > > >From: Volker Greimann ><<mailto:vgreimann@key-systems.net>vgreimann(a)key-systems.net> >Sent: Wednesday, March 24, 2021 3:58 PM >To: King, Brian ><<mailto:Brian.King@markmonitor.com>Brian.King(a)markmonitor.com> >Cc: Mueller, Milton L ><<mailto:milton@gatech.edu>milton(a)gatech.edu>; ><mailto:gnso-epdp-team@icann.org>gnso-epdp-team(a)icann.org >Subject: Re: [Gnso-epdp-team] On the proposed guidance > > > >Hi Brian, > > > >the easiest way to comply with data protection >law is to simply treat all registration data as >if it were personal data. No chance of ever >running afoul data protection law if you do that >correctly and it is pretty easy to demonstrate as well. > > > >-- >Volker A. Greimann >General Counsel and Policy Manager >KEY-SYSTEMS GMBH > >T: +49 6894 9396901 >M: +49 6894 9396851 >F: +49 6894 9396851 >W: ><https://urldefense.proofpoint.com/v2/url?u=http-3A__www.key-2Dsystems.net_&…>www.key-systems.net > >Key-Systems GmbH is a company registered at the >local court of Saarbruecken, Germany with the registration no. HR B 18835 >CEO: Oliver Fries and Robert Birkner > >Part of the CentralNic Group PLC (LON: CNIC) a >company registered in England and Wales with company number 8576358. > >This email and any files transmitted are >confidential and intended only for the person(s) >directly addressed. If you are not the intended >recipient, any use, copying, transmission, >distribution, or other forms of dissemination is >strictly prohibited. If you have received this >email in error, please notify the sender >immediately and permanently delete this email >with any files that may be attached. > > > > > >On Wed, Mar 24, 2021 at 5:47 PM King, Brian via >Gnso-epdp-team ><<mailto:gnso-epdp-team@icann.org>gnso-epdp-team(a)icann.org> wrote: > >Hi Milton, > > > >Thank you for the constructive intervention. >Your point is well taken, and I can certainly >see that from the RNH perspective. > > > >One feature of data protection law related to >your point is that it requires data controllers >and processors to be able to demonstrate >compliance with the law. A controller or >processor could doubtfully demonstrate >compliance with data protection law if they had >not determined whether they were actually >processing personal data. In fact, data >protection professionals will tell you that you >absolutely must determine what personal data >youâre processing as the first step toward >compliance with data protection law. It seems >the policy question is: what, if anything, >should contracted parties be required to do >based on the status of the data? Is that right? > > > >As always, weâre happy to work with you and >look forward to finding consensus. > > > > > >Brian J. Kingâ >He/Him/His > >Head of Policy and Advocacy, Intellectual Property Group > > >T +1 443 761 3726â > >Time zone: US Eastern Time > > > ><http://www.clarivate.com>clarivate.com | Accelerating innovation > >Follow us on ><https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_compa…>LinkedIn, ><https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_clarivate-…>Twitter, ><https://urldefense.proofpoint.com/v2/url?u=https-3A__www.facebook.com_clari…>Facebook >and ><https://urldefense.proofpoint.com/v2/url?u=https-3A__www.instagram.com_clar…>Instagram > > > >From: Gnso-epdp-team ><<mailto:gnso-epdp-team-bounces@icann.org>gnso-epdp-team-bounces(a)icann.org> >On Behalf Of Mueller, Milton L via Gnso-epdp-team >Sent: Wednesday, March 24, 2021 11:13 AM >To: <mailto:gnso-epdp-team@icann.org>gnso-epdp-team(a)icann.org >Subject: [Gnso-epdp-team] On the proposed guidance > > > >I was reading through two documents setting out >in detail the proposed guidance on legal/natural. > >There seems to be more than one Google doc on >this and I am not sure which one is the latest >or most official, though I suspect it is the one >with various peopleâs comments crawling all over it. > > > >I was pretty supportive of the Guidance overall. >I had one problem with it, though. > >I liked the description of HOW the >differentiation needed to take place. But in >describing WHEN differentiation takes place and >WHO would do it, it sets out 3 âhigh level scenariosâ. > >The first two are ok. The third scenario (listed >as #5 in the document) is that the Registrar >does it for the RNH, based on âinferences.â > > > >That option just doesnât fly for those of us >representing RNHâs in this process. We cannot >have a registrantâs disclosure status or >person type determined FOR them by someone else. >If we can strike that part of the guidance, I >think we can be on our way to a much broader consensus. > > > >Dr. Milton L Mueller > >Georgia Institute of Technology > >School of Public Policy > >IGP_logo_gold block > > > > >Confidentiality note: This e-mail may contain >confidential information from Clarivate. If you >are not the intended recipient, be aware that >any disclosure, copying, distribution or use of >the contents of this e-mail is strictly >prohibited. If you have received this e-mail in >error, please delete this e-mail and notify the sender immediately. > >_______________________________________________ >Gnso-epdp-team mailing list ><mailto:Gnso-epdp-team@icann.org>Gnso-epdp-team(a)icann.org >https://mm.icann.org/mailman/listinfo/gnso-epdp-team >_______________________________________________ >By submitting your personal data, you consent to >the processing of your personal data for >purposes of subscribing to this mailing list >accordance with the ICANN Privacy Policy >(<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_…>https://www.icann.org/privacy/policy) >and the website Terms of Service >(<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_…>https://www.icann.org/privacy/tos) >You can visit the Mailman link above to change >your membership status or configuration, >including unsubscribing, setting digest-style >delivery or disabling delivery altogether (e.g., for a vacation), and so on. > >Confidentiality note: This e-mail may contain >confidential information from Clarivate. If you >are not the intended recipient, be aware that >any disclosure, copying, distribution or use of >the contents of this e-mail is strictly >prohibited. If you have received this e-mail in >error, please delete this e-mail and notify the sender immediately. > >Content-Type: image/png; name="image001.png" >Content-Disposition: inline; filename="image001.png" >Content-ID: <178660366ac4cff311> >X-Attachment-Id: 178660366ac4cff311 > > >_______________________________________________ >Gnso-epdp-team mailing list >Gnso-epdp-team(a)icann.org >https://mm.icann.org/mailman/listinfo/gnso-epdp-team >_______________________________________________ >By submitting your personal data, you consent to >the processing of your personal data for >purposes of subscribing to this mailing list >accordance with the ICANN Privacy Policy >(https://www.icann.org/privacy/policy) and the >website Terms of Service >(https://www.icann.org/privacy/tos) You can >visit the Mailman link above to change your >membership status or configuration, including >unsubscribing, setting digest-style delivery or >disabling delivery altogether (e.g., for a vacation), and so on.

2 1

**REMINDER** Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 25 March 2021 at 14:00 UTC
by Julie Bisland March 24, 2021

March 24, 2021

**Reminder, some countries will have changed time, please make sure to check time zone link below. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 25 March 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/WAhtCQ Check your time zone: https://tinyurl.com/1ewmtoe7 [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/1ewmtoe7__;!!PtGJab4!q_Prc2v…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Proposed agenda - EPDP Phase 2A Meeting #12 - 25 March 2021
by Caitlin Tubergen March 23, 2021

March 23, 2021

Dear EPDP Team, Please find below the proposed agenda for the next EPDP Phase 2A meeting on Thursday, 25 March at 14:00 UTC. Best regards, Berry, Marika, and Caitlin -- EPDP Phase 2A - Meeting #12 Proposed Agenda Thursday 25 March 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. Status update to GNSO Council – feedback and reactions 3. Legal vs. natural (60 minutes) 1. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); 2. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. Guidance development a. Development of guidance proposal(s) * See draft write up developed by leadership & staff support team (https://docs.google.com/document/d/14Fs3b_Sz1ij3Tiu58uy0C69DWFHAq1Dp/edit) * Initial reactions by EPDP Team: * Does this accurately capture agreed aspects from the different proposals (RrSG, proposal 1a and thought experiment)? If not, what is missing? * Is it sufficiently high level to allow for flexibility to accommodate different business models, while at the same time providing helpful insights to those that want to differentiate? * What incentives, if any, could be considered to promote any guidance agreed to by the EPDP Team? * Confirm next steps 4. Feasibility of unique contacts (10 minutes) 1. Whether or not unique contacts to have a uniform anonymized email address is feasible, and if feasible, whether it should be a requirement. 2. ii. If feasible, but not a requirement, what guidance, if any, can be provided to Contracted Parties who may want to implement uniform anonymized email addresses. a. Any issues that can be constructively discussed prior to receipt of legal advice? b. Confirm next steps 5. Wrap and confirm next EPDP Team meeting (5 minutes): 1. EPDP Team Meeting #13 Thursday 1 April at 14.00 UTC. 2. Confirm action items 3. Confirm questions for ICANN Org, if any

1 0

EPDP P2A Chair Update to GNSO Council
by Drazek, Keith March 22, 2021

March 22, 2021

Hi all, As promised last Thursday, attached are the draft slides I intend to use to update the GNSO Council on Wednesday. As always, thanks to our Staff colleagues for their work to help develop these. To recap our earlier discussion, my key speaking points/recommendations in support of the slides will be: 1. The EPDP Team got off to a slow start around the December/January holiday season, but has made recent progress after repurposing two plenary sessions in support of the legal committee. 2. The EPDP P2A legal committee has submitted its questions to Bird & Bird and we are looking forward to timely feedback within the next 2-3 weeks. 3. There appears to be a possibility that the EPDP P2A team may reach consensus on guidelines for registrars who choose to differentiate between legal/natural. 4. It is premature to determine whether consensus is likely or possible on additional Consensus Policy recommendations related to the legal/natural distinction. We will have a clearer picture following the receipt of pending advice from Bird & Bird. 5. The EPDP Team continues to work on the subject of unique email identifiers and more work is needed on the subject of anonymized vs. pseudonymized emails and whether those can be reasonably implemented within a single registrar or across the entire registrar channel. 6. The EPDP Team is committed to continuing its work through the current timeline. This would warrant a further update to the GNSO Council at the end of May, which is current target for publication of the Initial Report. 7. We will know by the end of May whether consensus is likely. If so, we will continue to produce a Final Report for Council consideration. If not, we will recommend suspension or termination of the EPDP P2A, until such time there is additional information and/or material changes to warrant further consideration and policy development work. Please let me know if anyone has feedback or concerns. Thanks, Keith

3 2

Legal/Natural Framing Document
by Drazek, Keith March 22, 2021

March 22, 2021

Hi all, In coordination with our Staff colleagues, the Leadership team submits the following legal/natural framing document for EPDP Team consideration: https://docs.google.com/document/d/14Fs3b_Sz1ij3Tiu58uy0C69DWFHAq1Dp/mobile… This is very much a working document intending to capture our current status on the legal/natural issue, including identifying next steps and possible paths forward on developing guidance for registrars who choose to differentiate. Please review the document prior to our Thursday plenary call and come prepared to discuss, or feel free to contribute on the list. Thanks and regards, Keith

1 0

**REMINDER! Don't forget to register!** ICANN70: GNSO Sessions - How to Get Organized and Remote Participation Details
by Julie Bisland March 19, 2021

March 19, 2021

Dear all, All ICANN70 GNSO sessions have been listed for your reference on the ICANN70 GNSO wiki page. For all access information and Zoom details however, please refer to the ICANN70 schedule on the meeting website. Registration is compulsory to access the meeting schedule. Information can be found on this page [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/ICANNEventsPortal/icann…> or follow instructions below. Access information will not be circulated via mailing lists. The ICANN meeting website, which ICANN Meetings’ Team has put together, allows you to download all GNSO-related meetings to your inbox calendar in one go. HOW TO DOWNLOAD ICANN70 SESSION INFORMATION TO YOUR CALENDARS: Step 1 - Create a profile and your personalized ICANN70 schedule Go to the Meeting Schedule webpage [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…> and create a profile and login. Every session on the Full Agenda can be selected and added to your individual schedule by clicking the [cid:image001.png@01D71CAE.A3CAC0A0] in the upper right corner of each meeting. This adds it to your individual schedule, My Agenda, which you can then add to your calendar. See next step. Step 2 - To import your schedule into your calendar: once you’ve added all your chosen meetings to your schedule, click on [cid:image002.png@01D71CAE.A3CAC0A0] (View My Agenda) * Click the down arrow next to Export * Select Export My Agenda (ics) * Open the exported meetings .ics and add to your chosen calendar * For Microsoft Outlook, right-click on the exported meetings .ics file and choose Show in Folder Right-click on the file, and select Open with Microsoft Outlook. Save & Close. Note: Your Agenda can only be exported from the desktop app; the ICANN70 phone app does not offer this feature Step 3 - All remote participation sessions will use Zoom rooms. You can find the Zoom room links for public meetings on the ICANN70 Meeting Schedule [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/agenda*/?limit=20&…>. PLEASE ENSURE YOU HAVE UPDATED YOUR ZOOM APP TO THE LATEST VERSION TO ACCESS ICANN70 SESSIONS. Please download the latest Zoom app [zoom.us]<https://urldefense.com/v3/__https:/zoom.us/download__;!!PtGJab4!tqxc8RJNnQI…> on your participation device (mobile or desktop computer). Need to learn or brush-up on using Zoom? Check out the Joining a Zoom Meeting Tutorial [support.zoom.us]<https://urldefense.com/v3/__https:/support.zoom.us/hc/en-us/articles/201362…>. Step 4 - Download the mobile app by searching for “ICANN Meetings” in your app stores. There are three options to connect your audio: 1) Via VoIP, choose Computer Audio (from a smartphone choose Call using Internet Audio) 2) Getting a dial out from Zoom to your phone, choose Call Me (from a smartphone choose Call My Phone) 3) Phoning into the audio bridge (access numbers and Meeting ID are provided for that option), choose Telephone Audio (from a smartphone choose Dial in) Registration is compulsory to access the meeting schedule. Access information will not be circulated via mailing lists. 1- REGISTRATION: Information can be found on this page [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/ICANNEventsPortal/icann…> or follow instructions below. Please go to this link via an Incognito page if using Google (FILE/NEW INCOGNITO WINDOW): https://events.icann.org/icann70/registration [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/icann70/registration__;…> 2- SCHEDULE ACCESS: Once you are registered, you will receive two emails: 1. The first email will be your registration confirmation within the next 5-10 minutes. 2. The second email will come within 15-30 minutes, and provide your access link to https://70.schedule.icann.org [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…>. The second email will contain a link asking you to "Claim your account". Please follow the steps to create a password for this event, which is not the same as your registration password (for security purposes), previous event passwords will also not work. Access and ability to log into the schedule platform can take up to 30 minutes after completing the registration process. Important Note: Participation links will be posted 24-hours prior to the session start times for security purposes. 3 LINKS TO BOOKMARK NOW: ICANN70 Meeting Schedule [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…> GNSO ICANN70 Wiki Page<https://community.icann.org/x/HINeCQ> GNSO Session agendas<https://community.icann.org/x/AgxACQ> For all GNSO meeting related queries (RP or others), please email us at: gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> and we will be more than happy to assist! Kind regards, GNSO SO/AC Support team

1 0

Notes and action items - EPDP Phase 2A Meeting #11 - 18 March 2021
by Caitlin Tubergen March 18, 2021

March 18, 2021

Dear EPDP Team, Please find below the notes from today’s EPDP Phase 2A Team meeting. The next EPDP Phase 2A meeting will be Thursday, 25 March at 14:00 UTC. Best regards, Berry, Marika, and Caitlin -- EPDP Phase 2A - Meeting #11 Proposed Agenda Thursday 18 March 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. Update on submission of legal committee questions to Bird & Bird (Becky) * Three questions have been sent to Bird & Bird, and Bird & Bird expects to respond the week after next. * There is one additional question, which is an addition to the second question on mitigation steps for legal v. natural. Laureen and Melina have revised the question, based on the discussion during the Legal Committee meeting. * The updated question was circulated to the Legal Committee today with a request to respond by COB tomorrow. * Because this is an additional part of a question, this is unlikely to slow down Bird & Bird’s response time. 3. Legal vs. natural (70 minutes) 1. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); 2. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. a. ICANN org supplemental information on legal / natural study * Brief overview of supplemental information<https://community.icann.org/x/I4GBCQ> provided (ICANN org liaisons) * ICANN org presented its study to the EPDP Team approximately two months ago * During the presentation, SSAC reps asked a follow-up question re: how EU ccTLD operators and company trademark registers handle the publication of legal v. natural person data. * ICANN org provided its response on 3 March. * The first response deals with EU ccTLD operators’ differentiation. ICANN org looked at 33 EU ccTLD operators including .EU, .IS, .LI, .NO, .CH, .UK. Looked to see FAQs, general term, agreements. * Approximately 21 operators use some form of differentiation. * Appendix A provides greater detail of this breakdown. * Using .AT as an example – appears to differentiate. Break out types of data that is published – information was gathered from policy information available on the website re: the publication of personal data. * With respect to company trademark registers, ICANN org took a similar approach – looked at EU IP Office, USPTO, GDPR, and Hamilton memo. Found that company trademark registers are guided by legal obligations to maintain a public register. * EPDP Team questions & comments * Would be helpful to know which of these ccTLDS have laws/regulations (like the one applicable to .eu) that provide a public interest basis for processing. Otherwise very hard to make sense of this. * May be helpful to reach out to colleagues in the ccNSO * Was there a degree of uniformity across ccTLDs? It would be helpful to understand this as the Team is trying to develop a model that could work across many types of entities. * ICANN org to add a separate column re: public interest basis for publishing info * There didn’t seem to be a definitive method across all of the ccTLD operators; methods seemed to vary * How much uniformity in necessary in this system? From SSAC point of view, it may be possible to permit a certain amount of variation across different registries and registrars? Have we sought a posture with respect to the degree of uniformity across companies? * Under Phase 1 recommendations, CPs have discretion of how to handle this. The non-uniform approach is compatible with what is already going on. If we are looking for policy guidance based on ccTLD operators, it doesn’t appear we will get it since the methods vary. * While one method may work for a particular ccTLD, this is unlikely to work for a gTLD registrar. If differentiation is made, the Team should look at the results of the differentiation, how would this be transferable (if at all), what would the output in the RDS look like? * ccTLDs have a much lower risk from getting enforcement from a DPA. Comparing gTLD to registrars to land office registries is not pracitical because this is not analogous – there is not the same public interest or regulatory framework. * Is it worth considering/investigating the value of registrant consent vis-à-vis the various ccTLD policies on display of natural person data, either in the context of legal person registrations or actual natural person registrations? * ccTLDs and gTLDs are not an apples-to-apples comparison. This can be instructive, but they are not the same and should not be assumed to be the same. * The question of consent is a critical one. If NIS-2 gets approved, and there is a requirement to publish information about legal persons, there still may be natural person data present. Consent is likely the way to resolve this conundrum. This is a key question of how to resolve this in the long term. * The NIS-2 references the word “publish” but does not say “publish in an open database”. It could take another avenue such as publish in the SSAD. It is not clear what this means and there are multiple interpretations. The most likely interpretation will be publication in the SSAD. * Confirm next steps, if any Guidance development b. Review input provided on legal vs natural thought experiment * See https://docs.google.com/document/d/1Hf-Nt-VMznpGE4WZ7wWaHF8pXdm8qA28OW7Mjr4… * The work on this exercise is to augment the work already done in Phase 1 and Phase 2. Publishing the data of legal persons does carry with it some risk. If we are thinking outside the box, are there ways to address that risk or mitigate that risk? Berry identified that in Phase 2, there was already the mention of legal risk fund – is this something that could be used to mitigate the risks identified in this table? * Teams to provide a brief summary of their main observations, focusing on new insights or ideas * IPC: Prefer to move away from the discussion of a legal risk fund. With respect to when differentiation would occur at registration or after – would prefer that this did happen at registration. If everything happens early and up front, this seems to be the simplest. Also, if it’s done at registration, there would be no issue with the 60-day lock. * RrSG: easy is not always the best. The 60-day lock may not apply because the only thing that would change is a flag would be added, the information wouldn’t necessarily change. Having a legal risk fund could be a big red flag to DPAs – this could result in additional fines. * NCSG: already agreed that registrants should be able to designate if they would like their info published or not. If this is entirely a self-designation, and there is no burdensome verification check superimposed into the registration process, would support this. Team needs to get to a middle ground. * GAC: encouraged by this framing of the issue. There is ample room to discuss how this goal could be met of allowing a registrant to designate its status and be in control of whether its data that is personal is published. In terms of verification, that is something included in the proposal since it was part of the guidance from Bird & Bird, but not wedded to this requirement. Registrant needs to make this designation and be informed of the consequences of this designation. * RrSG: voluntary self-identification of registrants is the correct direction. This is the way the group can find a solution. Anything that is too heavy-handed on the registrar or registrant would not work. * IPC: Curious to hear what registrars have to add re: the flags. Having worked at a few registrars, there are often indicators tied to a domain name (such as if a domain name is using a local presence service). * RrSG: policy should not be limited by current functionality, but group should still appreciate complexity of what is being suggested. Since a flag indicates a person set, this is more appropriately added to a contact set rather than a domain name. A contacts set is a group of fields that are associated together. One person could provide different information for the same person, and this could be seen as two different people – for example, if the registrant provides street or st, this would be two different people requiring two different flags. This results in an unhappy customer base that is required to take action for no perceived benefit. This flag is a complicated idea with no benefit. * NCSG: spent time looking at legal v. natural – do not understand why we are debating running a legal risk for registrars? The only people that will be hurt by a wrong designation are individuals. * BC: Seems that Tucows will not streamline the system, and that is disappointing. Putting a flag on a registrant is just a notifier or indication of an attribute. This is not personal information. This is not the correct definition of privacy by default. * RrSG: a flag is an internal or external indicator to notify itself that a certain data set is confirmed to contain personal data or not. Whether this is portable or just internal would have to be decided down the road. * Confirm next steps * Registrars – identify differences in Registrar input vs. Proposal 1(a) from Laureen. * RrSG: 1(a) is a step-by-step prescriptive guide that is more implementation rather than guidance, while the registrar guidance is guidance that could work for multiple types of registrars. c. Review input provided on RrSG proposal * See https://docs.google.com/document/d/1YyiBmtcpa5PxsPnKDXZFfU0WEPVhgjN5ySv9KvQ… * Teams to provide a brief summary of their main observations, focusing on new insights or ideas * Confirm next steps d. Development of guidance proposal(s) * If/how should the broadly supported aspects of the different proposals (RrSG, proposal 1a and thought experiment) be brought together? * One proposal or several? * High level vs. detailed? * How to allow for sufficient flexibility to accommodate different business models, while at the same time providing helpful insights to those that want to differentiate? * Volunteers to take a first stab, or should the staff support team be tasked with developing a first draft? 4. Wrap and confirm next EPDP Team meeting (10 minutes): 1. Update to GNSO Council 24 March at 17.00 UTC by Chair and Council Liaison (open to observers * Keith has obligation to report to the Council, which will happen during ICANN70. * Recommendation will be to allow the work to continue in light of the fact that the legal committee has submitted questions that we are awaiting feedback on. * There is a possible path forward on consensus on guidance for registrars who choose to differentiate; it’s premature to determine if there is consensus on consensus policy recommendations, as we are awaiting legal advice. * Recommendation will be to give this group until the end of May and that at the end of May, we will have a clear indication of if we have consensus or not. * Support Staff will circulate the slides that will be used during the Council presentation next week. * Appreciate the recognition that there are paths forward and hope these paths can be built upon. Next milestone will be at the end of May. * End of May is a clear inflection point as this is the target date for Initial Report publication. If there is no consensus on the Initial Report, it’s unlikely we will have consensus at all. * It is critical for team members to do their homework. 1. EPDP Team Meeting #12 Thursday 25 March at 14.00 UTC. 2. Confirm action items 3. Confirm questions for ICANN Org, if any

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2A | Thursday, 18 March 2021 at 14:00 UTC
by Terri Agnew March 18, 2021

March 18, 2021

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2A call held on Thursday, 18 March 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/VghtCQ> (attendance included) and the GNSO Master calendar [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…>. These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a panelist, observers can join as an attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 25 March 2021 at 14:00 UTC
by Terri Agnew March 18, 2021

March 18, 2021

**Reminder, some countries will have changed time, please make sure to check time zone link below. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 25 March 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/WAhtCQ Check your time zone: https://tinyurl.com/1ewmtoe7 The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

**REMINDER** Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 18 March 2021 at 14:00 UTC
by Julie Bisland March 17, 2021

March 17, 2021

**Reminder, some countries will have changed time, please make sure to check time zone link below. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 18 March 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/VghtCQ Check your time zone: https://tinyurl.com/16kxc2w0 [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/16kxc2w0__;!!PtGJab4!p2NNGYL…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Proposed Agenda - EPDP Phase 2A Meeting #11 - 18 March 2021
by Caitlin Tubergen March 16, 2021

March 16, 2021

Dear EPDP Team: Please find below the proposed agenda for the upcoming EPDP Phase 2A meeting on Thursday, 18 March at 14:00 UTC. Please also take note of the following outstanding action items<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…>: EPDP Team to review ICANN org's response<https://community.icann.org/pages/viewpage.action?pageId=159482147> to the follow-up questions from their presentation and provide follow-up questions (if any) by Wednesday, 17 March. EPDP Team to review the Guidance for Registrars When Distinguishing Registrant Type document<https://docs.google.com/document/d/1YyiBmtcpa5PxsPnKDXZFfU0WEPVhgjN5ySv9KvQ…> and provide feedback within the document or on list in advance of the next meeting, as this will be a discussion item during the next plenary meeting. EPDP team to review the comments provided within the Thought Experiment document<https://docs.google.com/document/d/1Hf-Nt-VMznpGE4WZ7wWaHF8pXdm8qA28OW7Mjr4…> and provide additional feedback based on other teams' suggestions. Please note that while the recommendation portions of the document provide questions geared toward registrars, other teams are welcome to include sidebar comments in these sections also. ISPCP and BC to provide feedback. Best regards, Berry, Caitlin, and Marika -- EPDP Phase 2A - Meeting #11 Proposed Agenda Thursday 18 March 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. Update on submission of legal committee questions to Bird & Bird (Becky) 3. Legal vs. natural (70 minutes) 1. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); 2. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. a. ICANN org supplemental information on legal / natural study * Brief overview of supplemental information<https://community.icann.org/x/I4GBCQ> provided (ICANN org liaisons) * EPDP Team questions & comments * Confirm next steps, if any Guidance development b. Review input provided on legal vs natural thought experiment * See https://docs.google.com/document/d/1Hf-Nt-VMznpGE4WZ7wWaHF8pXdm8qA28OW7Mjr4… * Teams to provide a brief summary of their main observations, focusing on new insights or ideas * Confirm next steps c. Review input provided on RrSG proposal * See https://docs.google.com/document/d/1YyiBmtcpa5PxsPnKDXZFfU0WEPVhgjN5ySv9KvQ… * Teams to provide a brief summary of their main observations, focusing on new insights or ideas * Confirm next steps d. Development of guidance proposal(s) * If/how should the broadly supported aspects of the different proposals (RrSG, proposal 1a and thought experiment) be brought together? * One proposal or several? * High level vs. detailed? * How to allow for sufficient flexibility to accommodate different business models, while at the same time providing helpful insights to those that want to differentiate? * Volunteers to take a first stab, or should the staff support team be tasked with developing a first draft? 4. Wrap and confirm next EPDP Team meeting (10 minutes): 1. Update to GNSO Council 24 March at 17.00 UTC by Chair and Council Liaison (open to observers) 2. EPDP Team Meeting #12 Thursday 25 March at 14.00 UTC. 3. Confirm action items 4. Confirm questions for ICANN Org, if any

1 0

**Don't forget to register!** ICANN70: GNSO Sessions - How to Get Organized and Remote Participation Details
by Julie Bisland March 16, 2021

March 16, 2021

Dear all, All ICANN70 GNSO sessions have been listed for your reference on the ICANN70 GNSO wiki page. For all access information and Zoom details however, please refer to the ICANN70 schedule on the meeting website. Registration is compulsory to access the meeting schedule. Information can be found on this page [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/ICANNEventsPortal/icann…> or follow instructions below. Access information will not be circulated via mailing lists. The ICANN meeting website, which ICANN Meetings’ Team has put together, allows you to download all GNSO-related meetings to your inbox calendar in one go. HOW TO DOWNLOAD ICANN70 SESSION INFORMATION TO YOUR CALENDARS: Step 1 - Create a profile and your personalized ICANN70 schedule Go to the Meeting Schedule webpage [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…> and create a profile and login. Every session on the Full Agenda can be selected and added to your individual schedule by clicking the [cid:image001.png@01D71A48.08B07AF0] in the upper right corner of each meeting. This adds it to your individual schedule, My Agenda, which you can then add to your calendar. See next step. Step 2 - To import your schedule into your calendar: once you’ve added all your chosen meetings to your schedule, click on [cid:image002.png@01D71A48.08B07AF0] (View My Agenda) * Click the down arrow next to Export * Select Export My Agenda (ics) * Open the exported meetings .ics and add to your chosen calendar * For Microsoft Outlook, right-click on the exported meetings .ics file and choose Show in Folder Right-click on the file, and select Open with Microsoft Outlook. Save & Close. Note: Your Agenda can only be exported from the desktop app; the ICANN70 phone app does not offer this feature Step 3 - All remote participation sessions will use Zoom rooms. You can find the Zoom room links for public meetings on the ICANN70 Meeting Schedule [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/agenda*/?limit=20&…>. PLEASE ENSURE YOU HAVE UPDATED YOUR ZOOM APP TO THE LATEST VERSION TO ACCESS ICANN70 SESSIONS. Please download the latest Zoom app [zoom.us]<https://urldefense.com/v3/__https:/zoom.us/download__;!!PtGJab4!tqxc8RJNnQI…> on your participation device (mobile or desktop computer). Need to learn or brush-up on using Zoom? Check out the Joining a Zoom Meeting Tutorial [support.zoom.us]<https://urldefense.com/v3/__https:/support.zoom.us/hc/en-us/articles/201362…>. Step 4 - Download the mobile app by searching for “ICANN Meetings” in your app stores. There are three options to connect your audio: 1) Via VoIP, choose Computer Audio (from a smartphone choose Call using Internet Audio) 2) Getting a dial out from Zoom to your phone, choose Call Me (from a smartphone choose Call My Phone) 3) Phoning into the audio bridge (access numbers and Meeting ID are provided for that option), choose Telephone Audio (from a smartphone choose Dial in) Registration is compulsory to access the meeting schedule. Access information will not be circulated via mailing lists. 1- REGISTRATION: Information can be found on this page [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/ICANNEventsPortal/icann…> or follow instructions below. Please go to this link via an Incognito page if using Google (FILE/NEW INCOGNITO WINDOW): https://events.icann.org/icann70/registration [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/icann70/registration__;…> 2- SCHEDULE ACCESS: Once you are registered, you will receive two emails: 1. The first email will be your registration confirmation within the next 5-10 minutes. 2. The second email will come within 15-30 minutes, and provide your access link to https://70.schedule.icann.org [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…>. The second email will contain a link asking you to "Claim your account". Please follow the steps to create a password for this event, which is not the same as your registration password (for security purposes), previous event passwords will also not work. Access and ability to log into the schedule platform can take up to 30 minutes after completing the registration process. Important Note: Participation links will be posted 24-hours prior to the session start times for security purposes. 3 LINKS TO BOOKMARK NOW: ICANN70 Meeting Schedule [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…> GNSO ICANN70 Wiki Page<https://community.icann.org/x/HINeCQ> GNSO Session agendas<https://community.icann.org/x/AgxACQ> For all GNSO meeting related queries (RP or others), please email us at: gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> and we will be more than happy to assist! Kind regards, GNSO SO/AC Support team

1 0

Notes and action items - EPDP Phase 2A Meeting #10 - 11 March 2021
by Caitlin Tubergen March 11, 2021

March 11, 2021

Dear EPDP Team, Please find below the notes and action items<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> from today’s meeting. The next EPDP Team meeting will be Thursday, 18 March at 14:00 UTC. Best regards, Berry, Marika, and Caitlin -- EPDP Phase 2A - Meeting #10 Proposed Agenda Thursday 11 March 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. ICANN org supplemental information on legal / natural study submitted - Please note that ICANN Org’s responses are now posted on the wiki: https://community.icann.org/pages/viewpage.action?pageId=159482147 - Action: EPDP Team members to identify additional questions to ICANN org (if any) by Wednesday, 17 March 3. Feasibility of unique contacts (15 minutes) i. Whether or not unique contacts to have a uniform anonymized email address is feasible, and if feasible, whether it should be a requirement. ii. ii. If feasible, but not a requirement, what guidance, if any, can be provided to Contracted Parties who may want to implement uniform anonymized email addresses. a. Update from Legal Committee on definitions and questions referred to Legal Committee on topic of feasibility of unique contacts (Becky) - Becky: he Legal Committee has worked hard in the last few weeks and has almost finished work on all questions. - The feasibility questions have been pared down to a single three-part question that will employ the definitions the Legal Committee previously circulated to the plenary, i.e., “registration-based email contact” and “registrant-based email contact”). -This will be circulated to the plenary shortly and then to Bird & Bird. - NCSG: Question – is the legal committee concerned with the feasibility or legality of anonymized contacts? - Becky: The Legal Committee is asking B&B to compare the level of risk and type of risk for automated disclosure of registrant-based email contact (which is an email contact that is consistent across the registrations of a single registrant) and, on the other hand, of a registration-based email contact, which would be unique to a particular registration. - The question that had been raised in one case (the Breyer case) – notwithstanding the definition of anonymity in GDPR - that would render the risk of reidentification by third parties insignificant. The Legal Committee is looking for a comparison with the legal risks associated with those choices. - SSAC: The business of trying to set up anonymous and pseudonymous is often the wrong direction. If you’d like to contact the registrant without revealing the contact information, could there be an easily computable email address that is forwarded to the registrant. There is no guarantee of a reply – it doesn’t have to be heavyweight. However, this is straightforward and trivial to implement system. - Becky: That would be work that would not be within the legal committee’s gambit; that is a policy question. b. Confirm next steps 4. Legal vs. natural (60 minutes) i. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); ii. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. a. Update from Legal Committee in relation to questions referred to legal committee on legal / natural (Becky) * Becky: The questions on legal v. natural follow up on the previous legal v. natural memo – specifically the mitigation procedures * There is also a question re: useful precedent with EURid’s interpretation of the regulation, as well as RIPE NCC re: publication of resource holders, and the extent the NIS2 regulation might implicate the balancing test * All questions sent to Bird & Bird were sent to the EPDP Team as an FYI * The Team is still discussing two questions with plans to finalize at the next meeting on Tuesday. * Keith: Regarding the implications of NIS-2 – this is directionally significant. It has the potential to impact the work of ICANN and consensus policies and contracts, but it is far from complete. However, because it is directionally significant, it is important for the Legal Committee to ask for advice. b. Follow up questions to Jamboard brainstorming – Proposal 1a · Review RrSG and RySG responses to leadership follow up questions to input provided on JamBoard (seehttps://docs.google.com/document/d/1Je23419t1xv7OFgD32-DmBrYknUqtbOt4wkt…) * Registrars have provided additional input on Proposal 1a * RrSG: For the 1(a) proposal, the registrar has direct contact with the domain owner at the time of registration. This idea could work for a retail or brand registrar; however, in the reseller model, this would not work because a registrar does not interact with the registrant at the time of registration (or at any point). * It is difficult to provide implementation guidance at this time since we’re not sure what the final policy will be. * Keith: Note of caution: the Team should endeavor to be careful in terms of being overly prescriptive, factoring in the wide range of business models. * RrSG: Guidance for Registrars When Distinguishing Registrant Type – * In putting together this table, the registrar team wants to emphasize that when registrars process data, we must adhere to the principles GDPR requires. On the left-hand column, you will see the principles for data processing under the GDPR. Each row shows what the registrar can do in line with these principles. * In response to Laureen’s clarifying comment, what registrars intended with person type information is when the data subject indicates whether it is a natural or legal person * This chart provides helpful guidance registrars who may not be familiar with GDPR obligations and make sure that domain name owners are able to make an informed choice about how their data is processed while allowing flexibility to registrars based on their own customer base * Keith: Please review this proposal in detail over the coming week so that we can have further discussion at the next meeting. * GAC: Appreciate the registrars’ effort on this – it would be helpful for registrars to zero in on the key differences b/w this proposal and the GAC proposal * RrSG: The key difference is that the GAC proposal is a step-by-step process to be followed in order to achieve a certain goal, while this is a set of principles that a registrar would need to adhere to if they would like to differentiate. It shows the pieces that are necessary without a specific prescription. * BC: Is this a proposal that could be combined with Laureen’s proposal? * RrSG: Not sure if that could work. Anyone that follows Proposal 1(a) should also be following these principles, but in terms of how to combine them - there is still the same difficulty with the GAC proposal because it is overly prescriptive. * Keith: It seems that the “what” is what the guidance or policy should cover, and that as you move into the “how” and “when” is when it becomes potentially too prescriptive in that it may not appropriately cover the range of business models. If we can agree on “what” is expected, the questions of “how” and “when” become the responsibility of each registrar to make that determination. * GAC: It would be incomplete and unhelpful if there is no specificity when this occurs. Practically speaking, it is only useful if it occurs some time before the information is actually published. * Keith: “when” should not be off the table entirely but it should acknowledge these variations * RrSG: The step-by-step process of what to do and when is too much, and the registrar guidance is applicable across business models. In terms of the question of if differentiation can happen – yes it can, but there is a risk, and assuming this risk should ultimately be up to the controller. * BC: There could be a requirement for “within a certain amount of days” for reseller-based registrars. Resellers have to agree to certain conditions and requirements, so not sure why it is impossible to do this within the registration process for resellers. Perhaps we can consider adding a delay to accommodate resellers. * NCSG: The operative question is whether there is personal information including that of employees. Why doesn’t the business constituency come up with a template for businesses to attest that there is no personal data in their registration. This is increasingly difficult when employees work from home. * GAC: If we are talking about reasonable steps and there is inadvertent publication, if the contracted parties will be covered. The risk discussion does not have a lot of merit. The Team is trying to discuss limiting the risks with mitigation techniques. Hopeful the Team can agree that differentiation is important and should happen and CPs come up with suggestions of a way this can be done in line with their business model. * Keith: Part of the group’s work is to come up with guidance for groups who choose to differentiate at this time. * NCSG: This is ignoring the fact that the risk to the registrant is frequently overlooked – registrants are looked at as a source of data that can be freely accumulated. Some groups want data to be available and others want to limit it. Understand that it is convenient for many stakeholders to have access to data in a restrictive manner. And understand that free access to that data creates security and privacy risks that the GDPR was designed to protect. Recommend allowing registrants to consent to publication. Some jurisdictions already require this data to be published. There will also be an SSAD in place – if you really need the data and you have a valid legal basis, you will be able to get it via the SSAD. * RrSG: The case for requiring differentiation has not been made. Where is the necessity to make this a policy requirement as opposed to a voluntary option for registrars to disclose? * RrSG: Surprised to hear that there is no risk to registrars to override the input of a registrant. Creating a new flag for legal v. natural would be a broad and significant change. * Keith: Input from the registrars is important – EPDP Team to take a week to consider it. There will be further discussion on this next week. There have been questions of consent of registrants. Some of this will be further informed by the questions posed to Bird & Bird. · EPDP Team to discuss and confirm updates to be made to proposal 1a · Confirm next steps c. Review input provided on legal vs natural thought experiment · See https://docs.google.com/document/d/1Hf-Nt-VMznpGE4WZ7wWaHF8pXdm8qA28OW7Mjr4… · The purpose of this discussion is to we assume, for a moment, that there is a requirement for CPs to distinguish b/w legal and natural persons – how would contracted parties go about doing this? · The first section of the document is the thought experiment – hypothetical requirement of legal v. natural differentiation. · The next section is trying to leverage what the previous two phases of the EPDP agreed to · Hoping to tease out (at the bottom of the document) where in the registration cycle these checks can occur and what this could actually look like. For each of the recommendations, we requested the registrar reps to respond; however, the rest of the Team is welcome to provide sidebar comments. The concept was to tease out what registrars might be implementing at a conceptual level. · Keith: Nothing discussed in this thought experiment will bind or commit anyone to anything. · In light of the time, we will get into this next week while we await feedback from Bird & Bird. · Resist making policy arguments over whether this should happen. · It’s not a question of how this could be done; it’s about identifying potential challenges and how to mitigate the challenges. · If your group has already provided input, it should not stop you from providing additional input or responding to other groups. Groups who have not yet participated are welcome to provide feedback – particularly in response to the input already provided. · Confirm next steps 5. Wrap and confirm next EPDP Team meeting (5 minutes): a. Meeting #11 Thursday 18 March at 14.00 UTC. b. Confirm action items c. Confirm questions for ICANN Org, if any

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2A | Thursday, 11 March 2021 at 14:00 UTC
by Terri Agnew March 11, 2021

March 11, 2021

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2A call held on Thursday, 11 March 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/VAhtCQ> (attendance included) and the GNSO Master calendar [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…>. These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a panelist, observers can join as an attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 18 March 2021 at 14:00 UTC
by Terri Agnew March 11, 2021

March 11, 2021

**Reminder, some countries will have changed time, please make sure to check time zone link below. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 18 March 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/VghtCQ Check your time zone: https://tinyurl.com/16kxc2w0 The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Re: [Gnso-epdp-team] RrSG Proposed Guidance
by King, Brian March 10, 2021

March 10, 2021

Thank you for doing this, Sarah (and RrSG team). Brian J. King He/Him/His Head of Policy and Advocacy, Intellectual Property Group T +1 443 761 3726 clarivate.com Accelerating innovation From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> On Behalf Of Sarah Wyld via Gnso-epdp-team Sent: Wednesday, March 10, 2021 8:43 AM To: gnso-epdp-team(a)icann.org Subject: [Gnso-epdp-team] RrSG Proposed Guidance Hello team, The RrSG team has put together this guidance for registrars when distinguishing registrant type. We look forward to your input and to discussing in plenary at the appropriate time. https://docs.google.com/document/d/1YyiBmtcpa5PxsPnKDXZFfU0WEPVhgjN5ySv9KvQ…<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> -- Sarah Wyld, CIPP/E Policy & Privacy Manager Tucows swyld(a)tucows.com<mailto:swyld@tucows.com> +1.416 535 0123 Ext. 1392 [cid:image001.png@01D71596.6A9DC080] Confidentiality note: This e-mail may contain confidential information from Clarivate. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this e-mail is strictly prohibited. If you have received this e-mail in error, please delete this e-mail and notify the sender immediately.

1 0

**REMINDER** Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 11 March 2021 at 14:00 UTC
by Julie Bisland March 10, 2021

March 10, 2021

Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 11 March 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/VAhtCQ Check your time zone: https://tinyurl.com/1i3ydoo9 [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/1i3ydoo9__;!!PtGJab4!o_GXXR-…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

RrSG Proposed Guidance
by Sarah Wyld March 10, 2021

March 10, 2021

Hello team, The RrSG team has put together this guidance for registrars when distinguishing registrant type. We look forward to your input and to discussing in plenary at the appropriate time. https://docs.google.com/document/d/1YyiBmtcpa5PxsPnKDXZFfU0WEPVhgjN5ySv9KvQ… -- Sarah Wyld, CIPP/E Policy & Privacy Manager Tucows swyld(a)tucows.com +1.416 535 0123 Ext. 1392

1 0

**Reminder to register!** ICANN70: GNSO Sessions - How to Get Organized and Remote Participation Details
by Julie Bisland March 9, 2021

March 9, 2021

Dear all, All ICANN70 GNSO sessions have been listed for your reference on the ICANN70 GNSO wiki page. For all access information and Zoom details however, please refer to the ICANN70 schedule on the meeting website. Registration is compulsory to access the meeting schedule. Information can be found on this page [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/ICANNEventsPortal/icann…> or follow instructions below. Access information will not be circulated via mailing lists. The ICANN meeting website, which ICANN Meetings’ Team has put together, allows you to download all GNSO-related meetings to your inbox calendar in one go. HOW TO DOWNLOAD ICANN70 SESSION INFORMATION TO YOUR CALENDARS: Step 1 - Create a profile and your personalized ICANN70 schedule Go to the Meeting Schedule webpage [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…> and create a profile and login. Every session on the Full Agenda can be selected and added to your individual schedule by clicking the [cid:image001.png@01D713ED.14DEED90] in the upper right corner of each meeting. This adds it to your individual schedule, My Agenda, which you can then add to your calendar. See next step. Step 2 - To import your schedule into your calendar: once you’ve added all your chosen meetings to your schedule, click on [cid:image002.png@01D713ED.14DEED90] (View My Agenda) * Click the down arrow next to Export * Select Export My Agenda (ics) * Open the exported meetings .ics and add to your chosen calendar * For Microsoft Outlook, right-click on the exported meetings .ics file and choose Show in Folder Right-click on the file, and select Open with Microsoft Outlook. Save & Close. Note: Your Agenda can only be exported from the desktop app; the ICANN70 phone app does not offer this feature Step 3 - All remote participation sessions will use Zoom rooms. You can find the Zoom room links for public meetings on the ICANN70 Meeting Schedule [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/agenda*/?limit=20&…>. PLEASE ENSURE YOU HAVE UPDATED YOUR ZOOM APP TO THE LATEST VERSION TO ACCESS ICANN70 SESSIONS. Please download the latest Zoom app [zoom.us]<https://urldefense.com/v3/__https:/zoom.us/download__;!!PtGJab4!tqxc8RJNnQI…> on your participation device (mobile or desktop computer). Need to learn or brush-up on using Zoom? Check out the Joining a Zoom Meeting Tutorial [support.zoom.us]<https://urldefense.com/v3/__https:/support.zoom.us/hc/en-us/articles/201362…>. Step 4 - Download the mobile app by searching for “ICANN Meetings” in your app stores. There are three options to connect your audio: 1) Via VoIP, choose Computer Audio (from a smartphone choose Call using Internet Audio) 2) Getting a dial out from Zoom to your phone, choose Call Me (from a smartphone choose Call My Phone) 3) Phoning into the audio bridge (access numbers and Meeting ID are provided for that option), choose Telephone Audio (from a smartphone choose Dial in) Registration is compulsory to access the meeting schedule. Access information will not be circulated via mailing lists. 1- REGISTRATION: Information can be found on this page [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/ICANNEventsPortal/icann…> or follow instructions below. Please go to this link via an Incognito page if using Google (FILE/NEW INCOGNITO WINDOW): https://events.icann.org/icann70/registration [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/icann70/registration__;…> 2- SCHEDULE ACCESS: Once you are registered, you will receive two emails: 1. The first email will be your registration confirmation within the next 5-10 minutes. 2. The second email will come within 15-30 minutes, and provide your access link to https://70.schedule.icann.org [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…>. The second email will contain a link asking you to "Claim your account". Please follow the steps to create a password for this event, which is not the same as your registration password (for security purposes), previous event passwords will also not work. Access and ability to log into the schedule platform can take up to 30 minutes after completing the registration process. Important Note: Participation links will be posted 24-hours prior to the session start times for security purposes. 3 LINKS TO BOOKMARK NOW: ICANN70 Meeting Schedule [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…> GNSO ICANN70 Wiki Page<https://community.icann.org/x/HINeCQ> GNSO Session agendas<https://community.icann.org/x/AgxACQ> For all GNSO meeting related queries (RP or others), please email us at: gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> and we will be more than happy to assist! Kind regards, GNSO SO/AC Support team

1 1

Proposed agenda - EPDP Phase 2A Meeting #10 - 11 March 2021
by Caitlin Tubergen March 9, 2021

March 9, 2021

Dear EPDP Team, Please find below the proposed agenda for the next EPDP Phase 2A meeting on Thursday, 11 March at 14:00 UTC. As a reminder, the following action items<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> are outstanding: OVERDUE: RrSG to respond to questions #8-11 on p. 3 of Google Doc: https://docs.google.com/document/d/1Je23419t1xv7OFgD32-DmBrYknUqtbOt4wktPEj…. OVERDUE: RySG reps to respond to questions #13-17 of Google Doc: https://docs.google.com/document/d/1Je23419t1xv7OFgD32-DmBrYknUqtbOt4wktPEj… OVERDUE: EPDP to respond to #18 (SSAC proposal): https://docs.google.com/document/d/1Je23419t1xv7OFgD32-DmBrYknUqtbOt4wktPEj… EPDP Team to provide input into the Thought Experiment Table https://docs.google.com/document/d/1Hf-Nt-VMznpGE4WZ7wWaHF8pXdm8qA28OW7Mjr4… by Wednesday, 10 March by 18:00 UTC. Best regards, Berry, Marika, and Caitlin -- EPDP Phase 2A - Meeting #10 Proposed Agenda Thursday 11 March 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. ICANN org supplemental information on legal / natural study submitted 3. Feasibility of unique contacts (15 minutes) 1. Whether or not unique contacts to have a uniform anonymized email address is feasible, and if feasible, whether it should be a requirement. 2. ii. If feasible, but not a requirement, what guidance, if any, can be provided to Contracted Parties who may want to implement uniform anonymized email addresses. a. Update from Legal Committee on definitions and questions referred to Legal Committee on topic of feasibility of unique contacts (Becky) b. Confirm next steps 2. Legal vs. natural (60 minutes) 1. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); 2. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. a. Update from Legal Committee in relation to questions referred to legal committee on legal / natural (Becky) b. Follow up questions to Jamboard brainstorming – Proposal 1a * Review RrSG and RySG responses to leadership follow up questions to input provided on JamBoard (see https://docs.google.com/document/d/1Je23419t1xv7OFgD32-DmBrYknUqtbOt4wktPEj…) * EPDP Team to discuss and confirm updates to be made to proposal 1a * Confirm next steps c. Review input provided on legal vs natural thought experiment * See https://docs.google.com/document/d/1Hf-Nt-VMznpGE4WZ7wWaHF8pXdm8qA28OW7Mjr4… * Confirm next steps 3. Wrap and confirm next EPDP Team meeting (5 minutes): a. Meeting #11 Thursday 18 March at 14.00 UTC. b. Confirm action items c. Confirm questions for ICANN Org, if any

1 0

Supplemental information to EPDP Phase 2a
by Brian Gutterman March 9, 2021

March 9, 2021

Dear EPDP Team members, As you may recall, ICANN org presented<https://community.icann.org/pages/viewpage.action?pageId=155191075> its study entitled Differentiation between Legal and Natural Persons in Domain Name Registration Data Directory Services (RDDS)<https://mm.icann.org/pipermail/gnso-epdp-team/attachments/20200708/5f72ece1…> to the EPDP Phase 2A team on 26 January 2021. During its presentation, ICANN org responded to questions submitted by the Phase 2A team, one of which (quoted below) dealt with differentiation between natural and legal persons by ccTLD operators in the European Union as well as how legal and natural person data is handled in different types of registries. Question: “SSAC has previously noted important deficiencies in the ICANN study ‘Differentiation between Legal and Natural Persons in Domain Name Registration Data Directory Services (RDDS).’ Those deficiencies need to be cured. As stated in SAC112: “The research report did not look at some of the most relevant and obvious examples, such as how and why natural and legal person data is collected and published in real estate registries, company registries, and trademark registries inside the EU; and how such registries outside the EU handle the data of subjects who reside in the EU. While the report stated that ‘most EU ccTLD operators continue to publish some (and sometimes all) contact data fields for domains registered by legal persons,’ the report did not provide the details, such as a list of which ccTLDs publish what data.”[1] ICANN org has investigated these questions further, and attached are two documents in response: 1. Overview/summary of additional research conducted by ICANN org 2. Detailed appendix of findings related to differentiation of legal and natural person data by European/EU ccTLD operators Please do not hesitate to reach out to us with any questions regarding these. Thank you, ________________________________ ________________________________ [1] See: https://www.icann.org/en/system/files/files/sac-112-en.pdf.

1 0

Approved questions from Legal Committee
by Caitlin Tubergen March 9, 2021

March 9, 2021

Dear EPDP Team: This message is to inform you that the Legal Committee agreed to send the below questions to Bird & Bird. Please note the questions are sent only as an FYI to the EPDP Team. The Legal Committee is still reviewing other questions that may be sent to Bird & Bird, and the EPDP Team will be informed if additional questions are approved. Thank you. Best regards, Berry, Marika, and Caitlin -- QUESTION 2 Paragraphs 17 through 25 of Bird & Bird’s memo data January 25, 2019 discussed the potential risks to Registrars associated with reliance on a Registrant’s (i) self-designation as a legal person and (ii) confirmation that the registration data does not contain personal data. The memo identified a variety of steps that Registrars could take to mitigate the risk of inadvertent publication of personal data. For example, the memo suggested Registrars might take certain steps to improve the accuracy of self-designation/attestation such as: providing separate, clear disclosures, including descriptions of the consequences of self-designation as a legal person and asking the registrants to confirm that they are not submitting personal data; testing the clarity/readability of such disclosures; periodic follow up emails to registrants and/or technical contact; and providing a mechanism to change self-designation, or correct or object to publication of personal data. 1. Assuming that a Registrar takes the mitigation steps identified by Bird & Bird, and based on your experience and applicable precedent, please describe the level of risk, likelihood of enforcement actions, fines, counseling, etc. flowing from subsequent inadvertent publication of personal data contained in the Registration data of a legal person. 2. Expanding on Question 1, please discuss what level of risks (e.g., enforcement actions, fines, counseling, etc.) a Contracted Party faces with respect to publication of personal data if a confirmation email sent by a Registrar the Registrant and/or the Registrant’s tech contacts (i) clearly states that the Registrant has self-designated as a legal person and has affirmatively stated that no personal data has been included in its registration data; (ii) explains that based on those two representations all fields in the registration data will be published on the Internet; and (iii) provides an easy-to-use mechanism through which the self-designation can be rescinded and an individual receiving the email can object to publication of their personal data and/or rectify any inaccurate date? Must the Registrar require the registrant’s and/or tech contact’s affirmative response to the confirmation email? Does the answer differ depending on the medium of the notification (e.g., snail mail v. email)? 3. Are there additional or alternative mitigation and/or verification steps that a Contracted Party could take to further reduce/eliminate liability associated with inadvertent publication of personal data in connection with reliance on a registrant’s self-designation, e.g. confirming the existence of corporate identifiers (Inc., GmbH, Ltd. Etc.), reviewing account holder data for indicia of legal personhood, etc.? To what degree would each such additional step reduce liability? QUESTION 3 Commission Regulation (EC) No 874/2004 of 28 April 2004 laying down public policy rules concerning the implementation and functions of the .eu Top Level Domain and the principles governing registration (‘.eu Regulation’) sets out the public policy rules concerning the implementation and functions of the .eu Top Level Domain (TLD) and public policy principles on registration of domain names in the .eu TLD. Article 16 of the .eu Regulation is entitled ‘Whois database’ and provides: ‘The purpose of the WHOIS database shall be to provide reasonably accurate and up to date information about the technical and administrative points of contact administering the domain names under the .eu TLD. The WHOIS database shall contain information about the holder of a domain name that is relevant and not excessive in relation to the purpose of the database. In as far as the information is not strictly necessary in relation to the purpose of the database, and if the domain name holder is a natural person, the information that is to be made publicly available shall be subject to the unambiguous consent of the domain name holder. The deliberate submission of inaccurate information, shall constitute grounds for considering the domain name registration to have been in breach of the terms of registration.’ As from 13 October 2022, the .eu Regulation will be repealed by Regulation 2019/517, which provides under Article 12, entitled WHOIS database: ‘1. The Registry shall set up and manage, with due diligence, a WHOIS database facility for the purpose of ensuring the security, stability and resilience of the .eu TLD by providing accurate and up-to-date registration information about the domain names under the .eu TLD. 2. The WHOIS database shall contain relevant information about the points of contact administering the domain names under the .eu TLD and the holders of the domain names. The information on the WHOIS database shall not be excessive in relation to the purpose of the database. The Registry shall comply with Regulation (EU) 2016/679 of the European Parliament and of the Council.’ The Whois database is currently administered by EURid, a non-profit designated by the European Commission to manage the .eu registry. In its Whois database, EURid publishes the email addresses of domain name registrants in the .eu TLD (both natural persons and legal entities). EURid distinguishes between natural persons and legal entities by publishing the postal address information of legal entities, whereas this information is not published for natural persons. Through Article 16 of the .eu Regulation, EURid is able to rely on GDPR Article 6(1)(e), which provides a legal basis for processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. While we understand that this Article 16 public interest basis is not available outside the .eu domain, the existence of this lawful basis for EURid’s processing could be interpreted to suggest that the EU legislature recognized that disclosure of the Registrant data serves a legitimate interest in stability, security, and resilience. Further, in carrying out its mandate under Article 16, EURid has determined that publication of the Registrant’s email “is not excessive in relation to the purpose of the database.” Similarly, while RIPE-NCC relies on consent to publish personal information about tech/admin contacts, it publishes personal information about resource holders on the grounds that “facilitating coordination between network operators is the one purpose that justifies the publication of personal data in the RIPE-NCC database and that it is clear that the processing of the personal data referring to a resource holder is necessary for the performance of the registry function, which is carried out in the legitimate interest of the RIPE community and the smooth operation of the Internet globally (and is therefore in accordance with article 6.1.f of the GDPR).” We understand that the public interest basis supplied by Article 16 is not available to Contracted Parties outside of the .eu top level domain. Based on your experience and applicable precedent to what extent if any do:(i) the existence of Article 16 of the EU Regulation; (ii) EURid’s decision to publish Registrant email addresses consistent with Article 16, (iii)RIPE-NCC’s decision to publish the email addresses of resource holders; and (iv) draft language regarding access to registration data in the recently proposed NIS2 Directive create precedent that would reduce Contracted Party risk in connection with publication of a legal person Registrant’s email address, even if it contained personal information? Do these facts affect your answers to Questions 1-3 above? If it does not affect your answers, please explain why.

1 0

Notes and action items - EPDP Phase 2A Meeting #09 - 4 March 2021
by Caitlin Tubergen March 9, 2021

March 9, 2021

Dear EPDP Team, Please find below the notes and action items from today’s meeting. As a reminder, the next plenary meeting will be Thursday, 11 March at 14:00 UTC. Best regards, Berry, Marika, and Caitlin -- Action Items Please remember to check for action items using the team’s Workplan and Action Items sheet: https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…. EPDP Phase 2A - Meeting #09 Proposed Agenda Thursday 4 March 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) * Upcoming update to GNSO Council on status of progress (24 March 2021) * Keith has an obligation to report back to the GNSO Council on the status of the group’s progress. Three weeks from now, Keith has to provide a report to the Council. The work over the next few weeks is critical – to demonstrate to the Council that progress is being made, and that there is a path to consensus. * Reminder to please do homework – it’s critical for the group’s progress. It’s imperative that the team picks up the pace. * Thoughts from Philippe (GNSO Council liaison): in capacity as liaison to Council, reiterate Keith’s previous points. Council meeting is scheduled for 24 March. A case will need to be made to Council by this time. * EPDP feedback: concerned that legal advice will still be outstanding when an update needs to be made. * If legal questions are agreed to and submitted, this would help the case, but this has not happened yet. Need to demonstrate to the Council that the group is on track to deliver an Initial Report by. * Suggest that the team plow ahead with the work and incorporate the legal advice into the evolution of the SSAD * Keith has an obligation to deliver an update to the Council that the group is on track to deliver an Initial Report by May. Council will be looking at this with a critical eye as the manager of the PDP process. Submitting legal questions and demonstrating progress by this group will be critical. * Hope Council will look at if the group is making progress to develop a policy, rather than on track for a specific and arbitrary date * PDP 3.0 guidelines – any group has to commit to a plan following a cursory review of its charter. B/c the group started slower than anticipated, leadership made a decision to commit to delivery of an Initial Report by the end of May. This is an analysis based on the amount of work in front of us. * ICANN org response to EPDP Team questions (see https://community.icann.org/x/I4GBCQ) · Status of implementation rec 6/13 · ICANN org liability in the context of distinguishing between legal / natural persons · Please note ICANN org has provided responses to the two questions over the list; they are now posted on the wiki. 3. Legal vs. natural (75 minutes) 1. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); 2. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. a. Update from Legal Committee in relation to questions referred to legal committee on legal / natural (Becky) * Team made significant process during the two repurposed calls * Legal Team has discussed all questions on both topics * Bulk of legal v. natural questions are out for final sign-off by Friday * The remaining legal v. natural questions will hopefully be completed over email. * Aim is to finish up the work on Tuesday – call is extended to 90 minutes. If everyone does their homework, reviews all questions, and works online – should be in a position to finish on Tuesday. Again, this requires everyone to do their homework. b. Follow up questions to Jamboard brainstorming – Proposal 1a * Review responses to leadership follow up questions to input provided on JamBoard (see https://docs.google.com/document/d/1Je23419t1xv7OFgD32-DmBrYknUqtbOt4wktPEj…) * EPDP Team to discuss and confirm updates to be made to proposal 1a * Does the flowchart assist? * BC: yes, but if steps are combined in the user experience, there would need to be a wireframe webpage in order to determine if this saves a step in the user experience * BC: agree that the concern was addressed in previous recommendations but in terms of how to design a webpage, have to mention it for completeness * If Rrs or Rys today are differentiating today or might in the future, what are the possibilities for doing this that could become best practices or recommendations for the group to consider? * Is this trip necessary? Yes, if you are going to differentiate, but that is not accepted by many in this group. As you can see by the diagram, it is very complicated. This doesn’t appear to have any benefit on the public and private interest. If we agree with the original recommendation that it’s a choice, delving into the specific process for which they do so is a waste of this group’s time. * Charter notes what types of practices could be developed for CPs that want to differentiate or may be required to differentiate in certain jx * Best practices is not the deliverable here – it is just one step on the journey * Several team members are trying to engage in one-on-one conversations with stakeholder representatives to get a more realistic perspective of what the real-world business consequences of differentiation are. We are open to listening and figuring out your concerns – want to make sure your customer relationships are preserved. Aware that reseller model is different than a retail registrar. There could be a path forward here and want to work together to create this path. * Urge that we move away from flowcharts and try to arrive at a result that shows what to do and why to do it * As it relates to the charter for this group, we are to review best practices. Do the Phase 1 recs that are consensus policy need to be adjusted? This does not presuppose that consensus will be achieved. Once we get through the best practices – based on this, should the recommendation change? * Caution that a one-size-fits-all model actually only fits one. Suggest starting with the GDPR principles and how to achieve each of those principles if you want to differentiate. Current consensus policy, which is flexible and allows the registrar to choose, is appropriate. Guidance does not mean the policy should be changed. * Tried to address some of these expressed concerns in the proposal. One concern raised was to consider the nature of personal data, not just legal v. natural data. Another concern was some models (like reseller) cannot take steps before registration, so tried to make this flexible. * Should first look at why the Phase 1 recommendation needs to be changed. * As we look towards the outcomes of this group – do we need to make adjustments to Phase 1 recommendations, and are there implications to Phase 2 recommendations? We approached this as a group – what could be possible – what are the potential best practices, but we will eventually have to move to how to clarify how existing policy should be changed (if at all). * We are not being told – rather than look at ways it could be possible, now we are being told we need to look at if group members want to make it possible. * There is still work to be done regarding whether adjustments to consensus policy are needed or required. At the end of this process, is there a path to consensus on changing Phase 1 recommendations. * Perhaps steps 2 and 3 could be collapsed (l v. n and whether personal data) could be asked in the same sentence. * Asking someone if they are a legal or natural person is very confusing to most people, particularly with language differences. If a registrar can come up with a safe way of doing this, then the existing consensus recommendation says they can do this. Flagging people is a problem. * Confusing the registrant has already been covered; there are safeguards in place in the GAC proposal. To be clear, this is about adding a binary flag to categorize the registrant as either legal or natural and that comes with benefits for policy choices. This is just considered to be a useful distinction as part of a broader proposal. * Work with UE designers and making sure that choices presented to users are clear is very important – regarding the flag, if the purpose of the flag is for how data should be handled, that is already a requirement. * Flag or not, registrar should have a way of identifying if data should be published or not; how they do this should be up to them. Ultimately, we are looking at a registrant making a declaration – no personal data, therefore publication could be OK. It could be the same declaration for someone with PII who wants their info published. The differentiation of legal v. natural is unnecessary here. We do not need to ask the legal v. natural question. The ultimate question is – is there consent to publish this info. * The benefit of formally defining a flag is that it is standardized and can go into escrow if we want it to. The question is – do we want a flag for legal v. natural, we want a standardized flag so that it’s usable is appropriate. How we set it and if we set is question for later, but having the flag would be helpful. * Yes, we have a flag, but the legal committee has been discussing this consent issue. The CP is relying on an attestation that there is consent to publish. This is a difficult question – large companies represented here may be able to assure themselves in most cases but others may not have a clue. * Consent relates to personal data. In the comments on the proposal, some argued that legal v. natural is difficult and there are language and educational barriers. However the bar is much higher for consent under GDPR. Consent should be the last resort b/c the bar to prove that you have valid consent is very high. If someone believes the language is not simple enough for legal v. natural, how can it be valid enough for someone to provide informed consent? The distinction b/w legal v. natural is a valuable distinction in many data protection regimes. Maybe a way to do this if CPs would want to propose ways they could differentiate. * Confirm next steps c. Review remaining proposals & input provided (starting with scenario #1) * See https://jamboard.google.com/d/1H3CDUTITCfgcS85WMjlvyLV07cb7_V7ksFz8lVjExPg/… * Berry circulated a thought experiment yesterday. * This thought experiment tries to encapsulate a lot of what we spoke about in today’s meeting and before. What is important is that in this is a thought experiment, nothing will happen tomorrow, but, a few years down the road, it may become a requirement to differentiate between legal and natural persons. This thought experiment asks the group to consider what would happen if this was a requirement. Let’s first approach this by what is already in the pipeline to be implemented. * Rec. 6 – touched on this – basically about Rrs providing ability for RNH “consent” to have their info published. Some have already implemented this; others will wait for this requirement to be implemented. This is indirectly related to legal v. natural. How are CPs actually going to implement this and obtain consent? Example – domain investor may wish to have their info published – what would this look like? * Rec. 12 – this is a Phase 1 rec about the Org field. The second half of the recommendation notes requirements for new registrations beginning on a date certain. On a date certain, registrars have to allow registrants to publish the org field. How does that impact the registration process – how will this be implemented? * Rec. 17 – which is the ability for CPs to differentiate b/w legal and natural persons should they choose to. Are some CPs going to do this – what about brand protection models? If so, how are they going to go about doing this? * Phase 2 – recognizing that only the Council has adopted the Phase 2 recommendations – liability risks. Footnote 39 – there is a requirement for a legal risk fund. Could this group build on this particular concept? * There are a series of questions here and the group should have a frank discussion on all of these. * So much of what we’re talking about ties back to Phase 1 and Phase 2 Feedback * Should not be making consensus policy based on a theoretical law. We are close to agreement that do we want to publish the data or not – and are we giving people a clear path to publishing, if they’d like to publish it. * It seems clear that the NCSG wants to leave this as a consent-based discretion. This is not what we’re here to do – we are here to relitigate the legal v. natural distinction. * Please try to keep this from becoming personal. * We have a consensus policy – the question before us is do we need to adjust the consensus policy. * The whole time the NCSG has been arguing, there has been law. The fundamental question to be asked here – are you consenting to the release of personal information here/can you consent to the release of personal information here. * Consent relates to personal data. If there is a registrant providing personal and non-personal data, and they do not consent – do you also not publish the non-personal information? The distinction is inevitable and serves a purpose. 4. Wrap and confirm next EPDP Team meeting (5 minutes): a. Meeting #10 Thursday 11 March at 14.00 UTC. b. Confirm action items c. Confirm questions for ICANN Org, if any

2 1

EPDP-P2A // February Project Package
by policy＠bacinblack.com March 4, 2021

March 4, 2021

Dear all, Please find attached the EPDP-P2A's February 2021 project package. 1. Page 01 - Summary timeline 2. Page 02 - Project Sitrep - an extract from the Project List 3. Page 03 - Group roster 4. Page 04 - Group attendance for plenary and legal committee 5. Page 05 - Work and activity metrics 6. Page 06 - Project Plan, Gannt chart 7. Pages 07-09 - Work plan & Action items (current & complete) Please let me know if you have any question. After our call on Thursday, it will be forwarded to the GNSO Council. Thank you B Berry Cobb GNSO Policy Consultant Principal | BAC in Black Consulting <http://bacinblack.com/> Mob: +1 (720) 839-5735 <https://twitter.com/berrycobb> <https://www.linkedin.com/in/berrycobb/>

1 1

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2A | Thursday, 04 March 2021 at 14:00 UTC
by Terri Agnew March 4, 2021

March 4, 2021

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2A call held on Thursday, 04 March 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/UQhtCQ> (attendance included) and the GNSO Master calendar [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…>. These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a panelist, observers can join as an attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 11 March 2021 at 14:00 UTC
by Terri Agnew March 4, 2021

March 4, 2021

Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 11 March 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/VAhtCQ Check your time zone: https://tinyurl.com/1i3ydoo9 The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Proposed Agenda - EPDP Phase 2A Meeting #09
by Caitlin Tubergen March 3, 2021

March 3, 2021

Dear EPDP Team, Please find below the proposed agenda for Thursday’s plenary session. Please take note of the homework that is still outstanding. For agenda item 3b: Follow up questions in relation to the input provided via jamboard on proposal 1a (see p. 3 of this Google Doc<https://docs.google.com/document/d/1Je23419t1xv7OFgD32-DmBrYknUqtbOt4wktPEj…>) are still outstanding: BC: #2, #3, #4 IPC: #5, #6, #7 RrSG: #8, #9, #10, #11 RySG: #13, #14, #15, #16, #17 EPDP Team: #18 For agenda item item 3c: Comments on the other jamboard<https://jamboard.google.com/d/1H3CDUTITCfgcS85WMjlvyLV07cb7_V7ksFz8lVjExPg/…> proposals were due last week, but this assignment still remains outstanding. Please complete your homework as soon as possible, specifically focusing on scenario #1 on page 6, as that will be the starting point for this agenda item. Please complete your homework in a timely manner so that others are able to review it in advance of the meeting. Without your input, it will not be possible to make progress in the deliberations. Best regards, Berry, Marika, and Caitlin -- EPDP Phase 2A - Meeting #09 Proposed Agenda Thursday 4 March 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) * Upcoming update to GNSO Council on status of progress (24 March 2021) * ICANN org response to EPDP Team questions (see https://community.icann.org/x/I4GBCQ) · Status of implementation rec6/13 · ICANN org liability in the context of distinguishing between legal / natural persons 3. Legal vs. natural (75 minutes) 1. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); 2. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. a. Update from Legal Committee in relation to questions referred to legal committee on legal / natural (Becky) b. Follow up questions to Jamboard brainstorming – Proposal 1a * Review responses to leadership follow up questions to input provided on JamBoard (see https://docs.google.com/document/d/1Je23419t1xv7OFgD32-DmBrYknUqtbOt4wktPEj…) * EPDP Team to discuss and confirm updates to be made to proposal 1a * Confirm next steps c. Review remaining proposals & input provided (starting with scenario #1) * See https://jamboard.google.com/d/1H3CDUTITCfgcS85WMjlvyLV07cb7_V7ksFz8lVjExPg/… * Confirm next steps 4. Wrap and confirm next EPDP Team meeting (5 minutes): a. Meeting #10 Thursday 11 March at 14.00 UTC. b. Confirm action items c. Confirm questions for ICANN Org, if any

2 1

ICANN70: GNSO Sessions - How to Get Organized and Remote Participation Details
by Julie Bisland March 3, 2021

March 3, 2021

Dear all, All ICANN70 GNSO sessions have been listed for your reference on the ICANN70 GNSO wiki page. For all access information and Zoom details however, please refer to the ICANN70 schedule on the meeting website. Registration is compulsory to access the meeting schedule. Information can be found on this page [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/ICANNEventsPortal/icann…> or follow instructions below. Access information will not be circulated via mailing lists. The ICANN meeting website, which ICANN Meetings’ Team has put together, allows you to download all GNSO-related meetings to your inbox calendar in one go. HOW TO DOWNLOAD ICANN70 SESSION INFORMATION TO YOUR CALENDARS: Step 1 - Create a profile and your personalized ICANN70 schedule Go to the Meeting Schedule webpage [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…> and create a profile and login. Every session on the Full Agenda can be selected and added to your individual schedule by clicking the [cid:image001.png@01D71035.DB6D1830] in the upper right corner of each meeting. This adds it to your individual schedule, My Agenda, which you can then add to your calendar. See next step. Step 2 - To import your schedule into your calendar: once you’ve added all your chosen meetings to your schedule, click on [cid:image002.png@01D71035.DB6D1830] (View My Agenda) * Click the down arrow next to Export * Select Export My Agenda (ics) * Open the exported meetings .ics and add to your chosen calendar * For Microsoft Outlook, right-click on the exported meetings .ics file and choose Show in Folder Right-click on the file, and select Open with Microsoft Outlook. Save & Close. Note: Your Agenda can only be exported from the desktop app; the ICANN70 phone app does not offer this feature Step 3 - All remote participation sessions will use Zoom rooms. You can find the Zoom room links for public meetings on the ICANN70 Meeting Schedule [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/agenda*/?limit=20&…>. PLEASE ENSURE YOU HAVE UPDATED YOUR ZOOM APP TO THE LATEST VERSION TO ACCESS ICANN70 SESSIONS. Please download the latest Zoom app [zoom.us]<https://urldefense.com/v3/__https:/zoom.us/download__;!!PtGJab4!tqxc8RJNnQI…> on your participation device (mobile or desktop computer). Need to learn or brush-up on using Zoom? Check out the Joining a Zoom Meeting Tutorial [support.zoom.us]<https://urldefense.com/v3/__https:/support.zoom.us/hc/en-us/articles/201362…>. Step 4 - Download the mobile app by searching for “ICANN Meetings” in your app stores. There are three options to connect your audio: 1) Via VoIP, choose Computer Audio (from a smartphone choose Call using Internet Audio) 2) Getting a dial out from Zoom to your phone, choose Call Me (from a smartphone choose Call My Phone) 3) Phoning into the audio bridge (access numbers and Meeting ID are provided for that option), choose Telephone Audio (from a smartphone choose Dial in) Registration is compulsory to access the meeting schedule. Access information will not be circulated via mailing lists. 1- REGISTRATION: Information can be found on this page [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/ICANNEventsPortal/icann…> or follow instructions below. Please go to this link via an Incognito page if using Google (FILE/NEW INCOGNITO WINDOW): https://events.icann.org/icann70/registration [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/icann70/registration__;…> 2- SCHEDULE ACCESS: Once you are registered, you will receive two emails: 1. The first email will be your registration confirmation within the next 5-10 minutes. 2. The second email will come within 15-30 minutes, and provide your access link to https://70.schedule.icann.org [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…>. The second email will contain a link asking you to "Claim your account". Please follow the steps to create a password for this event, which is not the same as your registration password (for security purposes), previous event passwords will also not work. Access and ability to log into the schedule platform can take up to 30 minutes after completing the registration process. Important Note: Participation links will be posted 24-hours prior to the session start times for security purposes. 3 LINKS TO BOOKMARK NOW: ICANN70 Meeting Schedule [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…> GNSO ICANN70 Wiki Page<https://community.icann.org/x/HINeCQ> GNSO Session agendas<https://community.icann.org/x/AgxACQ> For all GNSO meeting related queries (RP or others), please email us at: gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> and we will be more than happy to assist! Kind regards, GNSO SO/AC Support team

1 0

**REMINDER** Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 04 March 2021 at 14:00 UTC
by Julie Bisland March 3, 2021

March 3, 2021

Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 04 March 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/UQhtCQ Check your time zone: https://tinyurl.com/yztdeosb [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/yztdeosb__;!!PtGJab4!pJ5Oi_A…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Andrea

2 1

Question to ICANN Org re. status of the implementation of Phase 1 recommendations 6 and 13.1
by Brian Gutterman March 1, 2021

March 1, 2021

Dear WG members, Hope this message finds you all well. The Implementation Project Team was notified of a question from the EPDP Phase 2A Team relating to the status of the implementation of Phase 1 recommendations, particularly recommendations 6 and 13.1. As Keith noted during the recent EPDP Team meeting, the Phase 1 Implementation Review Team is still working on implementing the Phase 1 recommendations. The Implementation Review Team has reviewed draft language for both of the aforementioned recommendations, and we are sharing it below for ease of reference. Please note, however, that this language is not yet final as the Implementation Review Team has not performed its final review of the draft policy language. Additionally, this draft policy language (in its entirety) will be posted for public comment when complete, and we invite the EPDP Team to contribute to the public comment proceeding when it opens. EPDP Phase 1 Recommendation #6. The EPDP Team recommends that, as soon as commercially reasonable, Registrar must provide the opportunity for the Registered Name Holder to provide its Consent to publish redacted contact information, as well as the email address, in the RDS for the sponsoring registrar. Draft policy language: Where a Registrar redacts the values of the data elements listed in Sections 10.3.1.1 through 10.3.1.8, Registrar MUST provide the opportunity for the Registered Name Holder to provide its Consent to Publish the data element values. Registrar MUST Publish the value of the data element(s) for which the Registered Name Holder provided its Consent. EPDP Phase 1 Recommendation #13.1. The EPDP Team recommends that the Registrar MUST provide an email address or a web form to facilitate email communication with the relevant contact, but MUST NOT identify the contact email address or the contact itself, unless as per Recommendation #6, the Registered Name Holder has provided consent for the publication of its email address. Draft policy language: Where a Registrar redacts the data element values listed in Section 10.3.1.8 or 10.3.1.12, in lieu of “REDACTED”, Registrar MUST Publish an email address or a link to a web form for the Email value to facilitate email communication with the relevant contact, but MUST NOT identify the contact email address or the contact itself. We note that the EPDP Team has raised concerns with web forms; however, to date, the IRT has not discussed the issue of possible minimum web form requirements, as no IRT members have raised this as a topic requiring discussion. We also note that some EPDP Team members have asked how many registrars (if any) have already implemented a similar requirement, despite the fact that Phase 1 recommendations have not yet been implemented. The Implementation Project Team is not in a position to answer this question, as this question is more appropriately directed to registrars. Thank you. Regards, Brian

1 0