April 2021 - Gnso-epdp-team

EPDP Team homework reminder
by Caitlin Tubergen April 19, 2021

April 19, 2021

Dear EPDP Team, Please take note of the outstanding homework assignments below. The first two items are due by COB today, Monday, 19 April. 1. Complete review of Bird & Bird advice by comparing it to the latest version of the legal/natural guidance write up. Please review the remaining 4 questions (#6-9) in the comparison document (see https://docs.google.com/document/d/1jzKGLeTlJFf8-HB70NmAS_fZJvZgJiwO/edit [docs.google.com]<https://docs.google.com/document/d/1jzKGLeTlJFf8-HB70NmAS_fZJvZgJiwO/edit%2…>) and provide your group’s responses to these questions. In addition, if you review of the Bird & Bird advice has resulted in additional questions the group should consider in the context of the guidance write up, please add those. The Staff Support Team will use your responses to the questions as well as those discussed on the call to update the write up accordingly to ensure it is consistent with the Bird & Bird advice that has been provided. Your group’s input is expected by Monday 19 April COB at the latest. Please do NOT use this google doc to opine on the write up or to raise any other issues that you think the write up should address. 1. Review the latest version of the guidance write-up and respond to outstanding questions Please review the latest version of the legal/natural guidance write-up (see https://docs.google.com/document/d/1whCpXHm3UPmJ-IDSbliveSkwxL679x2U/edit#h… [docs.google.com]<https://docs.google.com/document/d/1whCpXHm3UPmJ-IDSbliveSkwxL679x2U/edit#h…>) and provide your group’s response to the questions that were identified by the staff support team as a result of the last round of input (also listed below questions #1-4). If you have further comments or suggestions, please add these to the document in the form of comments, preferably including specific text you would like the EPDP Team to consider. The Staff Support Team will use your responses to produce a next iteration of the legal/natural guidance write up. Your group’s input is expected by Monday 19 April COB at the latest. 1. Provide your group’s thoughts on the question of whether updates should be made to the phase 1 recommendation on this topic. Please review and respond to the questions in this document https://docs.google.com/document/d/1gMV29jRPQEFGv2psZ2py2_F8cr93OeeA/edit [docs.google.com]<https://docs.google.com/document/d/1gMV29jRPQEFGv2psZ2py2_F8cr93OeeA/edit%2…> with your group’s position. As outlined during the call, this will facilitate the leadership’s team assessment of where the group is at and a possible path to a response to this specific question. Your group’s input is expected by Wednesday 21 April COB at the latest. Please be prepared to provide a summary overview of your position during the next EPDP Team meeting. Thank you. Best regards, Berry, Marika, and Caitlin

1 0

FW: Points of Order
by Mueller, Milton L April 15, 2021

April 15, 2021

Just addressing Alan’s second point: 2. The Key Metrics Considerations part of the EPDP Charter requires the we ensure that we will have metrics to determine the success of our recommendations. As such, if we decide that we will not issue policy recommendation on the legal/natural issue, but rather only guidance, we must also include a policy requirement that contracted parties report on whether or not they are actually following the guidance. If we do not do that, there is no way to measure our ultimate success. If Legal / Natural differentiation is not mandatory, as I believe it will be and should be, then concepts such as “metrics to determine success” do not make a lot of sense to me. I do not support saddling the CP’s with (yet another) reporting requirement if it pertains to a non-mandatory action. What does it mean to “measure” the “success” of a non-binding recommendation? We can measure how many registrars do differentiate, we can categorize the ways they do it, we can measure a number of other things, but those measurements are best carried out through third party studies, not by individual reports of 700 registrars. Dr. Milton L Mueller Georgia Institute of Technology School of Public Policy [IGP_logo_gold block]

1 0

Homework assignments, notes and action items - EPDP Team Meeting #15
by policy＠bacinblack.com April 15, 2021

April 15, 2021

Dear EPDP Team, Please find below the notes and action items <https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> of today’s meeting. In order to ensure that there is no confusion, here are the instructions for the homework assignments: 1. Complete review of Bird & Bird advice by comparing it to the latest version of the legal/natural guidance write up. Please review the remaining 4 questions (#6-9) in the comparison document (see https://docs.google.com/document/d/1jzKGLeTlJFf8-HB70NmAS_fZJvZgJiwO/edit) and provide your group’s responses to these questions. In addition, if you review of the Bird & Bird advice has resulted in additional questions the group should consider in the context of the guidance write up, please add those. The Staff Support Team will use your responses to the questions as well as those discussed on the call to update the write up accordingly to ensure it is consistent with the Bird & Bird advice that has been provided. Your group’s input is expected by Monday 19 April COB at the latest. Please do NOT use this google doc to opine on the write up or to raise any other issues that you think the write up should address. 2. Review the latest version of the guidance write-up and respond to outstanding questions Please review the latest version of the legal/natural guidance write-up (see https://docs.google.com/document/d/1whCpXHm3UPmJ-IDSbliveSkwxL679x2U/edit#h…) and provide your group’s response to the questions that were identified by the staff support team as a result of the last round of input (also listed below questions #1-4). If you have further comments or suggestions, please add these to the document in the form of comments, preferably including specific text you would like the EPDP Team to consider. The Staff Support Team will use your responses to produce a next iteration of the legal/natural guidance write up. Your group’s input is expected by Monday 19 April COB at the latest. 3. Provide your group’s thoughts on the question of whether updates should be made to the phase 1 recommendation on this topic. Please review and respond to the questions in this document https://docs.google.com/document/d/1gMV29jRPQEFGv2psZ2py2_F8cr93OeeA/edit with your group’s position. As outlined during the call, this will facilitate the leadership’s team assessment of where the group is at and a possible path to a response to this specific question. Your group’s input is expected by Wednesday 21 April COB at the latest. Please be prepared to provide a summary overview of your position during the next EPDP Team meeting. We would like to again express our appreciation for all the dialogue that has taken place on the list, but please make sure to also translate your input into specific suggestions for the documents listed above. Best regards, Caitlin, Marika and Berry ==================== EPDP Phase 2A - Meeting #15 Proposed Agenda Thursday 15 April 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) * Appreciate all the dialogue on the mailing list – really important and encouraging that this discussion is happening. Important now to bring this back to the latest version of the write-up – many/most of the comment on the mailing list seem to be consistent with the latest version of the write-up. If not, it will be important for team members to point this out and focus on how it can be made consistent. * Update from the legal committee (Becky) * Responses have been received to 3 of the 4 questions. One question (q #3) is still pending but expected shortly. Based on the responses received to questions #1 and #2, the staff support team pulled together a comparison chart to compare the B & B advice to the latest version of the write up. Final call of the legal committee is expected to take place to review response to q#3. * Placeholder meeting will be scheduled for the legal committee for next Tuesday. If response to q3 is not received in a timely manner the call will be cancelled. Comments from team: * Any of the parties who are named in the registration data must be informed and knowledgeable about that they have been named and what the responsibilities are in relation to this naming. Doesn’t that make consent moot and take away registrar responsibility as the registrant is already supposed to have dealt with this? * This is an ideal but not a reality of what is going on. Employees for companies may name other employees or officers without their knowledge or do not update when employees leave the company. A registrar cannot rely on this consent given to the registrant – it must confirm itself that consent is present. * Bird & Bird memo pointed out the importance of having a complaint mechanism so that if issues occur, these can be flagged and corrected by the registrar. * Contracted parties are liable for any mistakes – not only about the money, but also reputational damage to consider. * Bird & Bird memo does point to ways in which risk can be reduced for Contracted Parties, noting that liability is reduced by taking reasonable steps to remove personal data from registration data associated with a legal person. 3. Legal vs. natural (75 minutes) i. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); ii. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. Guidance development a. Continue review of updated write up of guidance proposal * See comparison table developed by Staff Support Team and reviewed by Legal Committee – see https://docs.google.com/document/d/1jzKGLeTlJFf8-HB70NmAS_fZJvZgJiwO/edit * EPDP Team to deliberate on the questions identified in column 3: 1) Consider adding reference to information requirements in relation to consent? 2) Consider making more specific that the registrant (data subject) needs to have an easy means to correct mistakes? 3) Consider adding a step that following Registrant confirmation that the registration does not include any personal data, the registrar should contact the provided contact details to confirm that no personal data is present. 4) Consider adding guidance that sufficient time must be provided for the Registrant (data subject) to respond to the verification request, but that there is no need to wait for an affirmative response, unless an email bounces (in which case the Registrar should not proceed with publication). 5) Consider adding that the Registrar should request the Registrant, if self-identified as legal person, to provide a company registration number. 6) Consider making more specific that at this stage the Registrar should ask whether Registrant (data subject) consents to publication of personal data? 7) Consider adding that, as an example, a Registrar could also use the company registration number to verify legal personhood. 8) Consider whether such a tool (to assess whether email addresses include an individual's name or appear to be generic) exists and/or is feasible? 9) Consider reference to this guidance/opinion from B & B * Focusing on the questions identified that bridge the current version of the write up and the B & B advice received. * Other comments are definitely relevant but need to be considered in the context of the write up. * Note proposed principles shared by Milton with the list: 1. The legal/natural distinction is relevant and we need to find a way make it in RDDS without compromising privacy rights. 2. Registrants should be able to self-designate as legal or natural, with no burden of authentication placed on registrars or registries 3. To protect small home offices or NGOs who are technically Legal persons but whose registration data may include Personal data, we need an additional check in the process. 4. As long as they conform with the above 3 principles, registrars/ries (CPs) should be given maximum flexibility to choose the way to differentiate. * Would be helpful to see if anyone disagrees with these principles. On 3, different approaches may be possible. Some have also noted that distinction should focus on personal vs. non-personal data. * 1) Consider adding reference to information requirements in relation to consent? Is already contemplated by RAA section – guidance should be clear. Making the point clearer on who is expected to consent and who the CP is entitled to rely on when it comes to consent may be helpful? Agree with the suggestion but may be more difficult to implement that it sounds? Write up is good at balancing GDPR of protecting personal data with facilitating the publication of non-personal data. Bird & Bird also outlines steps to minimize the risk to CPs if certain steps are followed. Need to be careful to not provide legal advice, consider pointing to the EDPB advice in relation to consent (https://st1.zoom.us/web_client/ehjzr5/html/externalLinkPage.html?ref=https:…) instead as that is authoritative information. * 2) Consider making more specific that the registrant (data subject) needs to have an easy means to correct mistakes? Support for this suggestion as this is one of the multi-layer safeguards that B & B has suggested. Noting that there are obviously challenges with information that has already been published and ‘undoing’ that. Should it be considered to quarantine before release that would allow for correction before information is published? See also q4. * 4) Consider adding guidance that sufficient time must be provided for the Registrant (data subject) to respond to the verification request, but that there is no need to wait for an affirmative response, unless an email bounces (in which case the Registrar should not proceed with publication). This seems to flip opt-out to opt-in – need to be mindful that silence is not the same as consent. B & B guidance is very specific that this is about when there is no personal information involved, so risk is low. Bouncing also may trigger accuracy considerations if the data subject is also the data source. * 3) Consider adding a step that following Registrant confirmation that the registration does not include any personal data, the registrar should contact the provided contact details to confirm that no personal data is present. Sounds like existing requirement in the RAA Whois specification (Verify: the email address of the Registered Name Holder (and, if different, the Account Holder) by sending an email requiring an affirmative response through a tool-based authentication method such as providing a unique code that must be returned in a manner designated by the Registrar, or … (phone call)? Use the provided contact details to contact the entity. Makes sense to add this step as it provides an additional safeguard to avoid getting personal information published. * 5) Consider adding that the Registrar should request the Registrant, if self-identified as legal person, to provide a company registration number. Not all countries may have company registration numbers? Would there then be an expectation that a registrar would verify that information? Corporate identifiers may work well for large corporations, not so much for small business. * Remaining questions to be addressed as homework. Action item #1: EPDP Team to review remaining 4 questions in the comparison document and provided responses to those questions by Monday 19 April. In addition, EPDP Team to identify any further questions that the EPDP Team should consider as a result of the Bird & Bird advice to address any potential inconsistencies or additional safeguards. * EPDP Team to deliberate on remaining questions in the updated write up (see https://docs.google.com/document/d/1whCpXHm3UPmJ-IDSbliveSkwxL679x2U/edit#h…) 1. Example scenarios refer to “publish the data” with publish defined as “provide Registration Data in the publicly accessible Registration Data Directory Services” – Volker has suggested this should be discussed further by the EPDP Team. 2. Example scenario 1-d – Registrar Team has suggested this is too prescriptive and proposed that if any changes are made then the data is treated as natural-person data until the Registrant indicates otherwise via repetition of steps a-c. Others have suggested that Registrant should be requested when updates are made whether this results in changes to data type. EPDP Team to discuss how to proceed. 3. Example scenario 3 – EPDP Team to discuss whether this scenario should be deleted. There were originally some concerns that there would be no registrant / data subject involvement in the determination of data type, but this has been clarified by indicating that the registrant must confirm the determination by the registrar. Is this concern sufficiently addressed or should this scenario be deleted. 4. Use of third party services to verify determination of data type – sentence has been updated based on suggestions made. Does this sufficiently address the concerns? 5. Other? * Confirm next steps Action item #2: EPDP Team to review these questions in the latest version of the write up and provide input, preferably in the form of specific text to be considered by the EPDP Team by Monday 19 April. Consideration of question i. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); b. Review of questions developed by leadership team to determine positions of different groups – please be open minded and be constructive (see https://docs.google.com/document/d/1gMV29jRPQEFGv2psZ2py2_F8cr93OeeA/edit) c. Homework assignment: all teams to provide responses to these questions by Tuesday 20 April at the latest. d. EPDP Team input e. Confirm next steps * Important for all groups to ‘put their cards on the table’ to facilitate the deliberations on this specific question. * Also important to recall relevant recommendations from phase 1 and phase 2 that may have an impact facilitating differentiation and/or could be built upon, for example, in the form of implementation guidance. Action item #3: EPDP Team to respond to questions outlined in the google doc in relation to the question of whether or not changes should be made to existing requirements by Wednesday 21 April and come prepared to the meeting on 22 April to provide a high level summary of the responses provided. 4. Wrap and confirm next EPDP Team meeting (5 minutes): a. EPDP Team Meeting #16 Thursday 22 April at 14.00 UTC - note, placeholder plenary session is being scheduled to allow for a second weekly plenary meeting, if needed. b. Confirm action items c. Confirm questions for ICANN Org, if any * Placeholder time has been identified for a second plenary session each week. Will not commence next week, but anticipate it will happen for the week after (27 April at 14.00 UTC). This does not replace the need for doing homework if progress is to be made. If there is no need for this additional plenary session it can always be cancelled. Berry Cobb GNSO Policy Consultant Principal | BAC in Black Consulting <http://bacinblack.com/> Mob: +1 (720) 839-5735 <https://twitter.com/berrycobb> <https://www.linkedin.com/in/berrycobb/>

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2A | Thursday, 15 April 2021 at 14:00 UTC
by Terri Agnew April 15, 2021

April 15, 2021

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2A call held on Thursday, 15 April 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/3oSUCQ> (attendance included) and the GNSO Master calendar [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…>. These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a panelist, observers can join as an attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 22 April 2021 at 14:00 UTC
by Terri Agnew April 15, 2021

April 15, 2021

Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 22 April 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/4ISUCQ Check your time zone: https://tinyurl.com/ady6y2hj The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Points of Order
by Alan Greenberg April 15, 2021

April 15, 2021

I would like to raise two points of order. Although my preference is for the PDP to generate consensus policy on the Legal/Natural issue, I understand that ultimately that may not be possible. That being said: 1. There have been recent discussions that we should not be creating advice on whether a registrant is a legal or natural person, but rather whether the data items contain personal information. The wording from the EPDP Charter is "Should Contracted Parties be allowed or required to treat legal and natural persons differently, and what mechanism is needed to ensure reliable determination of status?" If there is a need to consider individual data items, that is a secondary issue, but we need to stick to the charter terms. 2. The Key Metrics Considerations part of the EPDP Charter requires the we ensure that we will have metrics to determine the success of our recommendations. As such, if we decide that we will not issue policy recommendation on the legal/natural issue, but rather only guidance, we must also include a policy requirement that contracted parties report on whether or not they are actually following the guidance. If we do not do that, there is no way to measure our ultimate success. Alan

2 1

On the proposed guidance
by Mueller, Milton L April 15, 2021

April 15, 2021

I was reading through two documents setting out in detail the proposed guidance on legal/natural. There seems to be more than one Google doc on this and I am not sure which one is the latest or most official, though I suspect it is the one with various people's comments crawling all over it. I was pretty supportive of the Guidance overall. I had one problem with it, though. I liked the description of HOW the differentiation needed to take place. But in describing WHEN differentiation takes place and WHO would do it, it sets out 3 "high level scenarios". The first two are ok. The third scenario (listed as #5 in the document) is that the Registrar does it for the RNH, based on "inferences." That option just doesn't fly for those of us representing RNH's in this process. We cannot have a registrant's disclosure status or person type determined FOR them by someone else. If we can strike that part of the guidance, I think we can be on our way to a much broader consensus. Dr. Milton L Mueller Georgia Institute of Technology School of Public Policy [IGP_logo_gold block]

12 25

Partial draft re SSAC position on natural/legal discussion
by Steve Crocker April 14, 2021

April 14, 2021

Folks, My work schedule has suffered one of life's inescapable interruptions. In this case, it's good: our granddaughter entered the world this past Saturday. My wife and I have been in San Francisco providing support. Everyone is well, but I'm behind on my participation in this working group. Attached is my partial draft of a composite treatment of the natural vs legal collection of issues. I started writing from front to back but haven't had time to finish. I added a section at the end with the conclusions and recommendations. I will fill in the missing pieces as quickly as I can. Despite the incompleteness, we did have an opportunity in the SSAC work party to review and agree on the recommendations. For ease of access, the recommendations are copied below. Thanks, Steve 1. *Inescapable Requirement: Definition of Roles * Each role must be defined in terms of the authority and responsibilities associated with the role. This definition must be explicitly available to both the people fulfilling the role and the people interacting with the people in those roles. Each person named in a role must be aware of being named and must agree to the obligations associated with the role. The definition must also include an explicit statement of how the information about the person in the role will be disseminated. Information about the registrant is provided by the Account Holder. The Account Holder is effectively an agent of the Registrant and is the only authoritative source of information about the status of the registrant. 2. *Recommendation: Unknown Persons * In addition to definite status of Natural Person or Legal Person, the status of Unknown should be included in the design of the system. 3. *Recommendation: Additional Protection * In addition to whether the registrant is a Natural, Legal or Unknown Person, the status should also include an additional attribute regarding whether the registrant requires special privacy protection. It is an open question as to whether additional privacy protection should be available to any registrant who wishes it or should require justification. At the very least, to facilitate visibility into potentially harmful behaviors, Registrars should avoid unnecessary protection of registration data. 4. *Recommendation: Downgrading * Registrants should have the option of “downgrading” the level of protection for some or all of their data elements. Registrars should have the option of implementing downgrading on a field by field basis or in groups of fields. ICANN should establish a date certain for registrars to implement registrant option to downgrade the sensitivity of their registrations. 5. *Comment: Recourse * If a person named in any role in a registration feels the data is incorrect or is being disseminated improperly, they have recourse via the Registrant. Failing that, they have recourse through ICANN’s compliance process. No additional processes are required. 6. *Recommendation: Org Field * The Org field should *not* be used to determine the registrant’s status. The Registrar should require Legal Persons to provide the Org data element. The Registrar should permit Natural or Unknown registrants to provide or not provide the Org data element. 7. *Recommendation: Transition * ICANN should establish a plan for transitioning Unknown registrations into known status.

1 0

Re: [Gnso-epdp-team] Proposed Agenda EPDP Team Meeting #15 - 15 April at 14.00 UTC
by policy＠bacinblack.com April 14, 2021

April 14, 2021

Dear EPDP Team, We really appreciate the enthusiasm which some of you have started your review of the documents but we would like to encourage you to put your input in the right place: 1. The comparison document/table should be used to flag any further questions or issues that the group should consider based on the advice that has been provided by B & B (see https://docs.google.com/document/d/1jzKGLeTlJFf8-HB70NmAS_fZJvZgJiwO/edit) 2. Any further input, suggestions or proposed edits on the latest version of the write up that are not directly linked to the B & B advice should be made in the form of comments not direct edits in the latest version of the write up (see https://docs.google.com/document/d/1whCpXHm3UPmJ-IDSbliveSkwxL679x2U/edit) Thank for your collaboration! Caitlin, Marika and Berry Berry Cobb GNSO Policy Consultant Principal | BAC in Black Consulting <http://bacinblack.com/> Mob: +1 (720) 839-5735 <https://twitter.com/berrycobb> <https://www.linkedin.com/in/berrycobb/> From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org <mailto:gnso-epdp-team-bounces@icann.org> > on behalf of policy--- via Gnso-epdp-team <gnso-epdp-team(a)icann.org <mailto:gnso-epdp-team@icann.org> > Reply to: "policy(a)bacinblack.com <mailto:policy@bacinblack.com> " <policy(a)bacinblack.com <mailto:policy@bacinblack.com> > Date: Tuesday, 13 April 2021 at 13:49 To: "gnso-epdp-team(a)icann.org <mailto:gnso-epdp-team@icann.org> " <gnso-epdp-team(a)icann.org <mailto:gnso-epdp-team@icann.org> > Subject: [Gnso-epdp-team] Proposed Agenda EPDP Team Meeting #15 - 15 April at 14.00 UTC Dear EPDP Team, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Thursday 15 April at 14.00 UTC. As you will see, the staff support team has produced an updated version of the legal/natural guidance write up. Attached you will find the redline version so you can review the changes that have been made based on the input that was provided by the deadline (note, where no input was provided, no action has been taken). A couple of items have been flagged for further EPDP Team input in the new version (and are also included in the agenda). If there are any items missing that you think require EPDP Team consideration, please flag accordingly. Also included in the agenda you will find a comparison document that compares and contrasts the latest version of the legal/natural guidance write up with the responses received to date from Bird & Bird in relation to legal/natural. This document has been reviewed by the legal committee for completeness. In the third column it identifies a number of questions for EPDP Team consideration. Last but not least, you will also find in the agenda a link to a set of proposed questions for the EPDP Team which are intended to help inform the deliberations on the question of whether any updates are required to the EPDP Phase 1 recommendation on the topic of legal/natural. Note that the approach and document will be further introduced during Thursday’s meeting. Please review these documents in preparation for Thursday’s meeting. Best regards, Caitlin, Marika and Berry ====== EPDP Phase 2A - Meeting #15 Proposed Agenda Thursday 15 April 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) * Update from the legal committee 3. Legal vs. natural (75 minutes) i. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); ii. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. Guidance development a. Continue review of updated write up of guidance proposal * See comparison table developed by Staff Support Team and reviewed by Legal Committee – see https://docs.google.com/document/d/1jzKGLeTlJFf8-HB70NmAS_fZJvZgJiwO/edit * EPDP Team to deliberate on the questions identified in column 3: 1) Consider adding reference to information requirements in relation to consent? 2) Consider making more specific that the registrant (data subject) needs to have an easy means to correct mistakes? 3) Consider adding a step that following Registrant confirmation that the registration does not include any personal data, the registrar should contact the provided contact details to confirm that no personal data is present. 4) Consider adding guidance that sufficient time must be provided for the Registrant (data subject) to respond to the verification request, but that there is no need to wait for an affirmative response, unless an email bounces (in which case the Registrar should not proceed with publication). 5) Consider adding that the Registrar should request the Registrant, if self-identified as legal person, to provide a company registration number. 6) Consider making more specific that at this stage the Registrar should ask whether Registrant (data subject) consents to publication of personal data? 7) Consider adding that, as an example, a Registrar could also use the company registration number to verify legal personhood. 8) Consider whether such a tool (to assess whether email addresses include an individual's name or appear to be generic) exists and/or is feasible? 9) Consider reference to this guidance/opinion from B & B * EPDP Team to deliberate on remaining questions in the updated write up (see https://docs.google.com/document/d/1whCpXHm3UPmJ-IDSbliveSkwxL679x2U/edit#h…) 1. Example scenarios refer to “publish the data” with publish defined as “provide Registration Data in the publicly accessible Registration Data Directory Services” – Volker has suggested this should be discussed further by the EPDP Team. 2. Example scenario 1-d – Registrar Team has suggested this is too prescriptive and proposed that if any changes are made then the data is treated as natural-person data until the Registrant indicates otherwise via repetition of steps a-c. Others have suggested that Registrant should be requested when updates are made whether this results in changes to data type. EPDP Team to discuss how to proceed. 3. Example scenario 3 – EPDP Team to discuss whether this scenario should be deleted. There were originally some concerns that there would be no registrant / data subject involvement in the determination of data type, but this has been clarified by indicating that the registrant must confirm the determination by the registrar. Is this concern sufficiently addressed or should this scenario be deleted. 4. Use of third party services to verify determination of data type – sentence has been updated based on suggestions made. Does this sufficiently address the concerns? 5. Other? * Confirm next steps b. Consideration of question i. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); * Review of questions developed by leadership team to determine positions of different groups – please be open minded and be constructive (see https://docs.google.com/document/d/1gMV29jRPQEFGv2psZ2py2_F8cr93OeeA/edit) * Homework assignment: all teams to provide responses to these questions by Tuesday 20 April at the latest. * EPDP Team input * Confirm next steps 4. Wrap and confirm next EPDP Team meeting (5 minutes): a. EPDP Team Meeting #16 Thursday 22 April at 14.00 UTC - note, placeholder plenary session is being scheduled to allow for a second weekly plenary meeting, if needed. b. Confirm action items c. Confirm questions for ICANN Org, if any Berry Cobb GNSO Policy Consultant Principal | BAC in Black Consulting <http://bacinblack.com/> Mob: +1 (720) 839-5735 <https://twitter.com/berrycobb> <https://www.linkedin.com/in/berrycobb/>

1 0

REMINDER -- Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 15 April 2021 at 14:00 UTC
by Julie Bisland April 14, 2021

April 14, 2021

Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 15 April 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/3oSUCQ Check your time zone: https://tinyurl.com/cfe3f3bf [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/cfe3f3bf__;!!PtGJab4!r_1Y7Cr…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0