March 2021 - Gnso-epdp-team

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2A | Thursday, 11 March 2021 at 14:00 UTC
by Terri Agnew 11 Mar '21

11 Mar '21

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2A call held on Thursday, 11 March 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/VAhtCQ> (attendance included) and the GNSO Master calendar [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…>. These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a panelist, observers can join as an attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 18 March 2021 at 14:00 UTC
by Terri Agnew 11 Mar '21

11 Mar '21

**Reminder, some countries will have changed time, please make sure to check time zone link below. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 18 March 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/VghtCQ Check your time zone: https://tinyurl.com/16kxc2w0 The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Re: [Gnso-epdp-team] RrSG Proposed Guidance
by King, Brian 10 Mar '21

10 Mar '21

Thank you for doing this, Sarah (and RrSG team). Brian J. King He/Him/His Head of Policy and Advocacy, Intellectual Property Group T +1 443 761 3726 clarivate.com Accelerating innovation From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> On Behalf Of Sarah Wyld via Gnso-epdp-team Sent: Wednesday, March 10, 2021 8:43 AM To: gnso-epdp-team(a)icann.org Subject: [Gnso-epdp-team] RrSG Proposed Guidance Hello team, The RrSG team has put together this guidance for registrars when distinguishing registrant type. We look forward to your input and to discussing in plenary at the appropriate time. https://docs.google.com/document/d/1YyiBmtcpa5PxsPnKDXZFfU0WEPVhgjN5ySv9KvQ…<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> -- Sarah Wyld, CIPP/E Policy & Privacy Manager Tucows swyld(a)tucows.com<mailto:swyld@tucows.com> +1.416 535 0123 Ext. 1392 [cid:image001.png@01D71596.6A9DC080] Confidentiality note: This e-mail may contain confidential information from Clarivate. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this e-mail is strictly prohibited. If you have received this e-mail in error, please delete this e-mail and notify the sender immediately.

1 0

**REMINDER** Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 11 March 2021 at 14:00 UTC
by Julie Bisland 10 Mar '21

10 Mar '21

Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 11 March 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/VAhtCQ Check your time zone: https://tinyurl.com/1i3ydoo9 [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/1i3ydoo9__;!!PtGJab4!o_GXXR-…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

RrSG Proposed Guidance
by Sarah Wyld 10 Mar '21

10 Mar '21

Hello team, The RrSG team has put together this guidance for registrars when distinguishing registrant type. We look forward to your input and to discussing in plenary at the appropriate time. https://docs.google.com/document/d/1YyiBmtcpa5PxsPnKDXZFfU0WEPVhgjN5ySv9KvQ… -- Sarah Wyld, CIPP/E Policy & Privacy Manager Tucows swyld(a)tucows.com +1.416 535 0123 Ext. 1392

1 0

**Reminder to register!** ICANN70: GNSO Sessions - How to Get Organized and Remote Participation Details
by Julie Bisland 09 Mar '21

09 Mar '21

Dear all, All ICANN70 GNSO sessions have been listed for your reference on the ICANN70 GNSO wiki page. For all access information and Zoom details however, please refer to the ICANN70 schedule on the meeting website. Registration is compulsory to access the meeting schedule. Information can be found on this page [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/ICANNEventsPortal/icann…> or follow instructions below. Access information will not be circulated via mailing lists. The ICANN meeting website, which ICANN Meetings’ Team has put together, allows you to download all GNSO-related meetings to your inbox calendar in one go. HOW TO DOWNLOAD ICANN70 SESSION INFORMATION TO YOUR CALENDARS: Step 1 - Create a profile and your personalized ICANN70 schedule Go to the Meeting Schedule webpage [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…> and create a profile and login. Every session on the Full Agenda can be selected and added to your individual schedule by clicking the [cid:image001.png@01D713ED.14DEED90] in the upper right corner of each meeting. This adds it to your individual schedule, My Agenda, which you can then add to your calendar. See next step. Step 2 - To import your schedule into your calendar: once you’ve added all your chosen meetings to your schedule, click on [cid:image002.png@01D713ED.14DEED90] (View My Agenda) * Click the down arrow next to Export * Select Export My Agenda (ics) * Open the exported meetings .ics and add to your chosen calendar * For Microsoft Outlook, right-click on the exported meetings .ics file and choose Show in Folder Right-click on the file, and select Open with Microsoft Outlook. Save & Close. Note: Your Agenda can only be exported from the desktop app; the ICANN70 phone app does not offer this feature Step 3 - All remote participation sessions will use Zoom rooms. You can find the Zoom room links for public meetings on the ICANN70 Meeting Schedule [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/agenda*/?limit=20&…>. PLEASE ENSURE YOU HAVE UPDATED YOUR ZOOM APP TO THE LATEST VERSION TO ACCESS ICANN70 SESSIONS. Please download the latest Zoom app [zoom.us]<https://urldefense.com/v3/__https:/zoom.us/download__;!!PtGJab4!tqxc8RJNnQI…> on your participation device (mobile or desktop computer). Need to learn or brush-up on using Zoom? Check out the Joining a Zoom Meeting Tutorial [support.zoom.us]<https://urldefense.com/v3/__https:/support.zoom.us/hc/en-us/articles/201362…>. Step 4 - Download the mobile app by searching for “ICANN Meetings” in your app stores. There are three options to connect your audio: 1) Via VoIP, choose Computer Audio (from a smartphone choose Call using Internet Audio) 2) Getting a dial out from Zoom to your phone, choose Call Me (from a smartphone choose Call My Phone) 3) Phoning into the audio bridge (access numbers and Meeting ID are provided for that option), choose Telephone Audio (from a smartphone choose Dial in) Registration is compulsory to access the meeting schedule. Access information will not be circulated via mailing lists. 1- REGISTRATION: Information can be found on this page [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/ICANNEventsPortal/icann…> or follow instructions below. Please go to this link via an Incognito page if using Google (FILE/NEW INCOGNITO WINDOW): https://events.icann.org/icann70/registration [events.icann.org]<https://urldefense.com/v3/__https:/events.icann.org/icann70/registration__;…> 2- SCHEDULE ACCESS: Once you are registered, you will receive two emails: 1. The first email will be your registration confirmation within the next 5-10 minutes. 2. The second email will come within 15-30 minutes, and provide your access link to https://70.schedule.icann.org [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…>. The second email will contain a link asking you to "Claim your account". Please follow the steps to create a password for this event, which is not the same as your registration password (for security purposes), previous event passwords will also not work. Access and ability to log into the schedule platform can take up to 30 minutes after completing the registration process. Important Note: Participation links will be posted 24-hours prior to the session start times for security purposes. 3 LINKS TO BOOKMARK NOW: ICANN70 Meeting Schedule [70.schedule.icann.org]<https://urldefense.com/v3/__https:/70.schedule.icann.org/__;!!PtGJab4!tqxc8…> GNSO ICANN70 Wiki Page<https://community.icann.org/x/HINeCQ> GNSO Session agendas<https://community.icann.org/x/AgxACQ> For all GNSO meeting related queries (RP or others), please email us at: gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> and we will be more than happy to assist! Kind regards, GNSO SO/AC Support team

1 1

Proposed agenda - EPDP Phase 2A Meeting #10 - 11 March 2021
by Caitlin Tubergen 09 Mar '21

09 Mar '21

Dear EPDP Team, Please find below the proposed agenda for the next EPDP Phase 2A meeting on Thursday, 11 March at 14:00 UTC. As a reminder, the following action items<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> are outstanding: OVERDUE: RrSG to respond to questions #8-11 on p. 3 of Google Doc: https://docs.google.com/document/d/1Je23419t1xv7OFgD32-DmBrYknUqtbOt4wktPEj…. OVERDUE: RySG reps to respond to questions #13-17 of Google Doc: https://docs.google.com/document/d/1Je23419t1xv7OFgD32-DmBrYknUqtbOt4wktPEj… OVERDUE: EPDP to respond to #18 (SSAC proposal): https://docs.google.com/document/d/1Je23419t1xv7OFgD32-DmBrYknUqtbOt4wktPEj… EPDP Team to provide input into the Thought Experiment Table https://docs.google.com/document/d/1Hf-Nt-VMznpGE4WZ7wWaHF8pXdm8qA28OW7Mjr4… by Wednesday, 10 March by 18:00 UTC. Best regards, Berry, Marika, and Caitlin -- EPDP Phase 2A - Meeting #10 Proposed Agenda Thursday 11 March 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. ICANN org supplemental information on legal / natural study submitted 3. Feasibility of unique contacts (15 minutes) 1. Whether or not unique contacts to have a uniform anonymized email address is feasible, and if feasible, whether it should be a requirement. 2. ii. If feasible, but not a requirement, what guidance, if any, can be provided to Contracted Parties who may want to implement uniform anonymized email addresses. a. Update from Legal Committee on definitions and questions referred to Legal Committee on topic of feasibility of unique contacts (Becky) b. Confirm next steps 2. Legal vs. natural (60 minutes) 1. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); 2. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. a. Update from Legal Committee in relation to questions referred to legal committee on legal / natural (Becky) b. Follow up questions to Jamboard brainstorming – Proposal 1a * Review RrSG and RySG responses to leadership follow up questions to input provided on JamBoard (see https://docs.google.com/document/d/1Je23419t1xv7OFgD32-DmBrYknUqtbOt4wktPEj…) * EPDP Team to discuss and confirm updates to be made to proposal 1a * Confirm next steps c. Review input provided on legal vs natural thought experiment * See https://docs.google.com/document/d/1Hf-Nt-VMznpGE4WZ7wWaHF8pXdm8qA28OW7Mjr4… * Confirm next steps 3. Wrap and confirm next EPDP Team meeting (5 minutes): a. Meeting #11 Thursday 18 March at 14.00 UTC. b. Confirm action items c. Confirm questions for ICANN Org, if any

1 0

Supplemental information to EPDP Phase 2a
by Brian Gutterman 09 Mar '21

09 Mar '21

Dear EPDP Team members, As you may recall, ICANN org presented<https://community.icann.org/pages/viewpage.action?pageId=155191075> its study entitled Differentiation between Legal and Natural Persons in Domain Name Registration Data Directory Services (RDDS)<https://mm.icann.org/pipermail/gnso-epdp-team/attachments/20200708/5f72ece1…> to the EPDP Phase 2A team on 26 January 2021. During its presentation, ICANN org responded to questions submitted by the Phase 2A team, one of which (quoted below) dealt with differentiation between natural and legal persons by ccTLD operators in the European Union as well as how legal and natural person data is handled in different types of registries. Question: “SSAC has previously noted important deficiencies in the ICANN study ‘Differentiation between Legal and Natural Persons in Domain Name Registration Data Directory Services (RDDS).’ Those deficiencies need to be cured. As stated in SAC112: “The research report did not look at some of the most relevant and obvious examples, such as how and why natural and legal person data is collected and published in real estate registries, company registries, and trademark registries inside the EU; and how such registries outside the EU handle the data of subjects who reside in the EU. While the report stated that ‘most EU ccTLD operators continue to publish some (and sometimes all) contact data fields for domains registered by legal persons,’ the report did not provide the details, such as a list of which ccTLDs publish what data.”[1] ICANN org has investigated these questions further, and attached are two documents in response: 1. Overview/summary of additional research conducted by ICANN org 2. Detailed appendix of findings related to differentiation of legal and natural person data by European/EU ccTLD operators Please do not hesitate to reach out to us with any questions regarding these. Thank you, ________________________________ ________________________________ [1] See: https://www.icann.org/en/system/files/files/sac-112-en.pdf.

1 0

Approved questions from Legal Committee
by Caitlin Tubergen 09 Mar '21

09 Mar '21

Dear EPDP Team: This message is to inform you that the Legal Committee agreed to send the below questions to Bird & Bird. Please note the questions are sent only as an FYI to the EPDP Team. The Legal Committee is still reviewing other questions that may be sent to Bird & Bird, and the EPDP Team will be informed if additional questions are approved. Thank you. Best regards, Berry, Marika, and Caitlin -- QUESTION 2 Paragraphs 17 through 25 of Bird & Bird’s memo data January 25, 2019 discussed the potential risks to Registrars associated with reliance on a Registrant’s (i) self-designation as a legal person and (ii) confirmation that the registration data does not contain personal data. The memo identified a variety of steps that Registrars could take to mitigate the risk of inadvertent publication of personal data. For example, the memo suggested Registrars might take certain steps to improve the accuracy of self-designation/attestation such as: providing separate, clear disclosures, including descriptions of the consequences of self-designation as a legal person and asking the registrants to confirm that they are not submitting personal data; testing the clarity/readability of such disclosures; periodic follow up emails to registrants and/or technical contact; and providing a mechanism to change self-designation, or correct or object to publication of personal data. 1. Assuming that a Registrar takes the mitigation steps identified by Bird & Bird, and based on your experience and applicable precedent, please describe the level of risk, likelihood of enforcement actions, fines, counseling, etc. flowing from subsequent inadvertent publication of personal data contained in the Registration data of a legal person. 2. Expanding on Question 1, please discuss what level of risks (e.g., enforcement actions, fines, counseling, etc.) a Contracted Party faces with respect to publication of personal data if a confirmation email sent by a Registrar the Registrant and/or the Registrant’s tech contacts (i) clearly states that the Registrant has self-designated as a legal person and has affirmatively stated that no personal data has been included in its registration data; (ii) explains that based on those two representations all fields in the registration data will be published on the Internet; and (iii) provides an easy-to-use mechanism through which the self-designation can be rescinded and an individual receiving the email can object to publication of their personal data and/or rectify any inaccurate date? Must the Registrar require the registrant’s and/or tech contact’s affirmative response to the confirmation email? Does the answer differ depending on the medium of the notification (e.g., snail mail v. email)? 3. Are there additional or alternative mitigation and/or verification steps that a Contracted Party could take to further reduce/eliminate liability associated with inadvertent publication of personal data in connection with reliance on a registrant’s self-designation, e.g. confirming the existence of corporate identifiers (Inc., GmbH, Ltd. Etc.), reviewing account holder data for indicia of legal personhood, etc.? To what degree would each such additional step reduce liability? QUESTION 3 Commission Regulation (EC) No 874/2004 of 28 April 2004 laying down public policy rules concerning the implementation and functions of the .eu Top Level Domain and the principles governing registration (‘.eu Regulation’) sets out the public policy rules concerning the implementation and functions of the .eu Top Level Domain (TLD) and public policy principles on registration of domain names in the .eu TLD. Article 16 of the .eu Regulation is entitled ‘Whois database’ and provides: ‘The purpose of the WHOIS database shall be to provide reasonably accurate and up to date information about the technical and administrative points of contact administering the domain names under the .eu TLD. The WHOIS database shall contain information about the holder of a domain name that is relevant and not excessive in relation to the purpose of the database. In as far as the information is not strictly necessary in relation to the purpose of the database, and if the domain name holder is a natural person, the information that is to be made publicly available shall be subject to the unambiguous consent of the domain name holder. The deliberate submission of inaccurate information, shall constitute grounds for considering the domain name registration to have been in breach of the terms of registration.’ As from 13 October 2022, the .eu Regulation will be repealed by Regulation 2019/517, which provides under Article 12, entitled WHOIS database: ‘1. The Registry shall set up and manage, with due diligence, a WHOIS database facility for the purpose of ensuring the security, stability and resilience of the .eu TLD by providing accurate and up-to-date registration information about the domain names under the .eu TLD. 2. The WHOIS database shall contain relevant information about the points of contact administering the domain names under the .eu TLD and the holders of the domain names. The information on the WHOIS database shall not be excessive in relation to the purpose of the database. The Registry shall comply with Regulation (EU) 2016/679 of the European Parliament and of the Council.’ The Whois database is currently administered by EURid, a non-profit designated by the European Commission to manage the .eu registry. In its Whois database, EURid publishes the email addresses of domain name registrants in the .eu TLD (both natural persons and legal entities). EURid distinguishes between natural persons and legal entities by publishing the postal address information of legal entities, whereas this information is not published for natural persons. Through Article 16 of the .eu Regulation, EURid is able to rely on GDPR Article 6(1)(e), which provides a legal basis for processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. While we understand that this Article 16 public interest basis is not available outside the .eu domain, the existence of this lawful basis for EURid’s processing could be interpreted to suggest that the EU legislature recognized that disclosure of the Registrant data serves a legitimate interest in stability, security, and resilience. Further, in carrying out its mandate under Article 16, EURid has determined that publication of the Registrant’s email “is not excessive in relation to the purpose of the database.” Similarly, while RIPE-NCC relies on consent to publish personal information about tech/admin contacts, it publishes personal information about resource holders on the grounds that “facilitating coordination between network operators is the one purpose that justifies the publication of personal data in the RIPE-NCC database and that it is clear that the processing of the personal data referring to a resource holder is necessary for the performance of the registry function, which is carried out in the legitimate interest of the RIPE community and the smooth operation of the Internet globally (and is therefore in accordance with article 6.1.f of the GDPR).” We understand that the public interest basis supplied by Article 16 is not available to Contracted Parties outside of the .eu top level domain. Based on your experience and applicable precedent to what extent if any do:(i) the existence of Article 16 of the EU Regulation; (ii) EURid’s decision to publish Registrant email addresses consistent with Article 16, (iii)RIPE-NCC’s decision to publish the email addresses of resource holders; and (iv) draft language regarding access to registration data in the recently proposed NIS2 Directive create precedent that would reduce Contracted Party risk in connection with publication of a legal person Registrant’s email address, even if it contained personal information? Do these facts affect your answers to Questions 1-3 above? If it does not affect your answers, please explain why.

1 0

Notes and action items - EPDP Phase 2A Meeting #09 - 4 March 2021
by Caitlin Tubergen 09 Mar '21

09 Mar '21

Dear EPDP Team, Please find below the notes and action items from today’s meeting. As a reminder, the next plenary meeting will be Thursday, 11 March at 14:00 UTC. Best regards, Berry, Marika, and Caitlin -- Action Items Please remember to check for action items using the team’s Workplan and Action Items sheet: https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…. EPDP Phase 2A - Meeting #09 Proposed Agenda Thursday 4 March 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) * Upcoming update to GNSO Council on status of progress (24 March 2021) * Keith has an obligation to report back to the GNSO Council on the status of the group’s progress. Three weeks from now, Keith has to provide a report to the Council. The work over the next few weeks is critical – to demonstrate to the Council that progress is being made, and that there is a path to consensus. * Reminder to please do homework – it’s critical for the group’s progress. It’s imperative that the team picks up the pace. * Thoughts from Philippe (GNSO Council liaison): in capacity as liaison to Council, reiterate Keith’s previous points. Council meeting is scheduled for 24 March. A case will need to be made to Council by this time. * EPDP feedback: concerned that legal advice will still be outstanding when an update needs to be made. * If legal questions are agreed to and submitted, this would help the case, but this has not happened yet. Need to demonstrate to the Council that the group is on track to deliver an Initial Report by. * Suggest that the team plow ahead with the work and incorporate the legal advice into the evolution of the SSAD * Keith has an obligation to deliver an update to the Council that the group is on track to deliver an Initial Report by May. Council will be looking at this with a critical eye as the manager of the PDP process. Submitting legal questions and demonstrating progress by this group will be critical. * Hope Council will look at if the group is making progress to develop a policy, rather than on track for a specific and arbitrary date * PDP 3.0 guidelines – any group has to commit to a plan following a cursory review of its charter. B/c the group started slower than anticipated, leadership made a decision to commit to delivery of an Initial Report by the end of May. This is an analysis based on the amount of work in front of us. * ICANN org response to EPDP Team questions (see https://community.icann.org/x/I4GBCQ): · Status of implementation rec 6/13 · ICANN org liability in the context of distinguishing between legal / natural persons · Please note ICANN org has provided responses to the two questions over the list; they are now posted on the wiki. 3. Legal vs. natural (75 minutes) 1. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); 2. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. a. Update from Legal Committee in relation to questions referred to legal committee on legal / natural (Becky) * Team made significant process during the two repurposed calls * Legal Team has discussed all questions on both topics * Bulk of legal v. natural questions are out for final sign-off by Friday * The remaining legal v. natural questions will hopefully be completed over email. * Aim is to finish up the work on Tuesday – call is extended to 90 minutes. If everyone does their homework, reviews all questions, and works online – should be in a position to finish on Tuesday. Again, this requires everyone to do their homework. b. Follow up questions to Jamboard brainstorming – Proposal 1a * Review responses to leadership follow up questions to input provided on JamBoard (see https://docs.google.com/document/d/1Je23419t1xv7OFgD32-DmBrYknUqtbOt4wktPEj…) * EPDP Team to discuss and confirm updates to be made to proposal 1a * Does the flowchart assist? * BC: yes, but if steps are combined in the user experience, there would need to be a wireframe webpage in order to determine if this saves a step in the user experience * BC: agree that the concern was addressed in previous recommendations but in terms of how to design a webpage, have to mention it for completeness * If Rrs or Rys today are differentiating today or might in the future, what are the possibilities for doing this that could become best practices or recommendations for the group to consider? * Is this trip necessary? Yes, if you are going to differentiate, but that is not accepted by many in this group. As you can see by the diagram, it is very complicated. This doesn’t appear to have any benefit on the public and private interest. If we agree with the original recommendation that it’s a choice, delving into the specific process for which they do so is a waste of this group’s time. * Charter notes what types of practices could be developed for CPs that want to differentiate or may be required to differentiate in certain jx * Best practices is not the deliverable here – it is just one step on the journey * Several team members are trying to engage in one-on-one conversations with stakeholder representatives to get a more realistic perspective of what the real-world business consequences of differentiation are. We are open to listening and figuring out your concerns – want to make sure your customer relationships are preserved. Aware that reseller model is different than a retail registrar. There could be a path forward here and want to work together to create this path. * Urge that we move away from flowcharts and try to arrive at a result that shows what to do and why to do it * As it relates to the charter for this group, we are to review best practices. Do the Phase 1 recs that are consensus policy need to be adjusted? This does not presuppose that consensus will be achieved. Once we get through the best practices – based on this, should the recommendation change? * Caution that a one-size-fits-all model actually only fits one. Suggest starting with the GDPR principles and how to achieve each of those principles if you want to differentiate. Current consensus policy, which is flexible and allows the registrar to choose, is appropriate. Guidance does not mean the policy should be changed. * Tried to address some of these expressed concerns in the proposal. One concern raised was to consider the nature of personal data, not just legal v. natural data. Another concern was some models (like reseller) cannot take steps before registration, so tried to make this flexible. * Should first look at why the Phase 1 recommendation needs to be changed. * As we look towards the outcomes of this group – do we need to make adjustments to Phase 1 recommendations, and are there implications to Phase 2 recommendations? We approached this as a group – what could be possible – what are the potential best practices, but we will eventually have to move to how to clarify how existing policy should be changed (if at all). * We are not being told – rather than look at ways it could be possible, now we are being told we need to look at if group members want to make it possible. * There is still work to be done regarding whether adjustments to consensus policy are needed or required. At the end of this process, is there a path to consensus on changing Phase 1 recommendations. * Perhaps steps 2 and 3 could be collapsed (l v. n and whether personal data) could be asked in the same sentence. * Asking someone if they are a legal or natural person is very confusing to most people, particularly with language differences. If a registrar can come up with a safe way of doing this, then the existing consensus recommendation says they can do this. Flagging people is a problem. * Confusing the registrant has already been covered; there are safeguards in place in the GAC proposal. To be clear, this is about adding a binary flag to categorize the registrant as either legal or natural and that comes with benefits for policy choices. This is just considered to be a useful distinction as part of a broader proposal. * Work with UE designers and making sure that choices presented to users are clear is very important – regarding the flag, if the purpose of the flag is for how data should be handled, that is already a requirement. * Flag or not, registrar should have a way of identifying if data should be published or not; how they do this should be up to them. Ultimately, we are looking at a registrant making a declaration – no personal data, therefore publication could be OK. It could be the same declaration for someone with PII who wants their info published. The differentiation of legal v. natural is unnecessary here. We do not need to ask the legal v. natural question. The ultimate question is – is there consent to publish this info. * The benefit of formally defining a flag is that it is standardized and can go into escrow if we want it to. The question is – do we want a flag for legal v. natural, we want a standardized flag so that it’s usable is appropriate. How we set it and if we set is question for later, but having the flag would be helpful. * Yes, we have a flag, but the legal committee has been discussing this consent issue. The CP is relying on an attestation that there is consent to publish. This is a difficult question – large companies represented here may be able to assure themselves in most cases but others may not have a clue. * Consent relates to personal data. In the comments on the proposal, some argued that legal v. natural is difficult and there are language and educational barriers. However the bar is much higher for consent under GDPR. Consent should be the last resort b/c the bar to prove that you have valid consent is very high. If someone believes the language is not simple enough for legal v. natural, how can it be valid enough for someone to provide informed consent? The distinction b/w legal v. natural is a valuable distinction in many data protection regimes. Maybe a way to do this if CPs would want to propose ways they could differentiate. * Confirm next steps c. Review remaining proposals & input provided (starting with scenario #1) * See https://jamboard.google.com/d/1H3CDUTITCfgcS85WMjlvyLV07cb7_V7ksFz8lVjExPg/… * Berry circulated a thought experiment yesterday. * This thought experiment tries to encapsulate a lot of what we spoke about in today’s meeting and before. What is important is that in this is a thought experiment, nothing will happen tomorrow, but, a few years down the road, it may become a requirement to differentiate between legal and natural persons. This thought experiment asks the group to consider what would happen if this was a requirement. Let’s first approach this by what is already in the pipeline to be implemented. * Rec. 6 – touched on this – basically about Rrs providing ability for RNH “consent” to have their info published. Some have already implemented this; others will wait for this requirement to be implemented. This is indirectly related to legal v. natural. How are CPs actually going to implement this and obtain consent? Example – domain investor may wish to have their info published – what would this look like? * Rec. 12 – this is a Phase 1 rec about the Org field. The second half of the recommendation notes requirements for new registrations beginning on a date certain. On a date certain, registrars have to allow registrants to publish the org field. How does that impact the registration process – how will this be implemented? * Rec. 17 – which is the ability for CPs to differentiate b/w legal and natural persons should they choose to. Are some CPs going to do this – what about brand protection models? If so, how are they going to go about doing this? * Phase 2 – recognizing that only the Council has adopted the Phase 2 recommendations – liability risks. Footnote 39 – there is a requirement for a legal risk fund. Could this group build on this particular concept? * There are a series of questions here and the group should have a frank discussion on all of these. * So much of what we’re talking about ties back to Phase 1 and Phase 2 Feedback * Should not be making consensus policy based on a theoretical law. We are close to agreement that do we want to publish the data or not – and are we giving people a clear path to publishing, if they’d like to publish it. * It seems clear that the NCSG wants to leave this as a consent-based discretion. This is not what we’re here to do – we are here to relitigate the legal v. natural distinction. * Please try to keep this from becoming personal. * We have a consensus policy – the question before us is do we need to adjust the consensus policy. * The whole time the NCSG has been arguing, there has been law. The fundamental question to be asked here – are you consenting to the release of personal information here/can you consent to the release of personal information here. * Consent relates to personal data. If there is a registrant providing personal and non-personal data, and they do not consent – do you also not publish the non-personal information? The distinction is inevitable and serves a purpose. 4. Wrap and confirm next EPDP Team meeting (5 minutes): a. Meeting #10 Thursday 11 March at 14.00 UTC. b. Confirm action items c. Confirm questions for ICANN Org, if any

2 1