April 2021 - Gnso-epdp-team

Proposed Agenda EPDP Team Meeting #15 - 15 April at 14.00 UTC
by policy＠bacinblack.com April 13, 2021

April 13, 2021

Dear EPDP Team, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Thursday 15 April at 14.00 UTC. As you will see, the staff support team has produced an updated version of the legal/natural guidance write up. Attached you will find the redline version so you can review the changes that have been made based on the input that was provided by the deadline (note, where no input was provided, no action has been taken). A couple of items have been flagged for further EPDP Team input in the new version (and are also included in the agenda). If there are any items missing that you think require EPDP Team consideration, please flag accordingly. Also included in the agenda you will find a comparison document that compares and contrasts the latest version of the legal/natural guidance write up with the responses received to date from Bird & Bird in relation to legal/natural. This document has been reviewed by the legal committee for completeness. In the third column it identifies a number of questions for EPDP Team consideration. Last but not least, you will also find in the agenda a link to a set of proposed questions for the EPDP Team which are intended to help inform the deliberations on the question of whether any updates are required to the EPDP Phase 1 recommendation on the topic of legal/natural. Note that the approach and document will be further introduced during Thursday’s meeting. Please review these documents in preparation for Thursday’s meeting. Best regards, Caitlin, Marika and Berry ====== EPDP Phase 2A - Meeting #15 Proposed Agenda Thursday 15 April 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) * Update from the legal committee 3. Legal vs. natural (75 minutes) i. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); ii. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. Guidance development a. Continue review of updated write up of guidance proposal * See comparison table developed by Staff Support Team and reviewed by Legal Committee – see https://docs.google.com/document/d/1jzKGLeTlJFf8-HB70NmAS_fZJvZgJiwO/edit * EPDP Team to deliberate on the questions identified in column 3: 1. Consider adding reference to information requirements in relation to consent? 2. Consider making more specific that the registrant (data subject) needs to have an easy means to correct mistakes? 3. Consider adding a step that following Registrant confirmation that the registration does not include any personal data, the registrar should contact the provided contact details to confirm that no personal data is present. 4. Consider adding guidance that sufficient time must be provided for the Registrant (data subject) to respond to the verification request, but that there is no need to wait for an affirmative response, unless an email bounces (in which case the Registrar should not proceed with publication). 5. Consider adding that the Registrar should request the Registrant, if self-identified as legal person, to provide a company registration number. 6. Consider making more specific that at this stage the Registrar should ask whether Registrant (data subject) consents to publication of personal data? 7. Consider adding that, as an example, a Registrar could also use the company registration number to verify legal personhood. 8. Consider whether such a tool (to assess whether email addresses include an individual's name or appear to be generic) exists and/or is feasible? 9. Consider reference to this guidance/opinion from B & B * EPDP Team to deliberate on remaining questions in the updated write up (see https://docs.google.com/document/d/1whCpXHm3UPmJ-IDSbliveSkwxL679x2U/edit#h…) 1. Example scenarios refer to “publish the data” with publish defined as “provide Registration Data in the publicly accessible Registration Data Directory Services” – Volker has suggested this should be discussed further by the EPDP Team. 2. Example scenario 1-d – Registrar Team has suggested this is too prescriptive and proposed that if any changes are made then the data is treated as natural-person data until the Registrant indicates otherwise via repetition of steps a-c. Others have suggested that Registrant should be requested when updates are made whether this results in changes to data type. EPDP Team to discuss how to proceed. 3. Example scenario 3 – EPDP Team to discuss whether this scenario should be deleted. There were originally some concerns that there would be no registrant / data subject involvement in the determination of data type, but this has been clarified by indicating that the registrant must confirm the determination by the registrar. Is this concern sufficiently addressed or should this scenario be deleted. 4. Use of third party services to verify determination of data type – sentence has been updated based on suggestions made. Does this sufficiently address the concerns? 5. Other? * Confirm next steps b. Consideration of question i. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); * Review of questions developed by leadership team to determine positions of different groups – please be open minded and be constructive (see https://docs.google.com/document/d/1gMV29jRPQEFGv2psZ2py2_F8cr93OeeA/edit) * Homework assignment: all teams to provide responses to these questions by Tuesday 20 April at the latest. * EPDP Team input * Confirm next steps 4. Wrap and confirm next EPDP Team meeting (5 minutes): a. EPDP Team Meeting #16 Thursday 22 April at 14.00 UTC - note, placeholder plenary session is being scheduled to allow for a second weekly plenary meeting, if needed. b. Confirm action items c. Confirm questions for ICANN Org, if any Berry Cobb GNSO Policy Consultant Principal | BAC in Black Consulting <http://bacinblack.com/> Mob: +1 (720) 839-5735 <https://twitter.com/berrycobb> <https://www.linkedin.com/in/berrycobb/>

2 1

Updated Supplemental information to EPDP Phase 2a
by Brian Gutterman April 13, 2021

April 13, 2021

Dear EPDP Team Members, In its 3 March 2021 response<https://mm.icann.org/pipermail/gnso-epdp-team/2021-March/003716.html> to the EPDP Phase 2A Team, ICANN org provided additional information in response to questions asked by the Phase 2A Team during the 26 January 2021 webinar on the Legal and Natural Person Study. In presenting the additional information on 18 March 2021<https://community.icann.org/pages/viewpage.action?pageId=158140502>, ICANN org received questions regarding the ccTLDs’ policies pertaining to the public interest basis for processing registration data as well as the registry operators’ policies on a natural person’s option to consent to have their registration data publicly available. ICANN org has conducted some additional research to answer these questions and has updated the Appendix A document with its findings. Specifically, the results were added to columns I and K of Appendix A, which includes quotes from the corresponding policy, if any. Please do not hesitate to reach out to us with any questions regarding this updated information. Thank you, Brian, Amy, Jared, Karen

2 1

EPDP Phase 2A legal guidance -
by policy＠bacinblack.com April 12, 2021

April 12, 2021

Dear EPDP Team, Attached, please find Bird & Bird’s responses to the Legal Committee’s fourth question regarding options for contact address masking. The question is included in the attached memo. Thank you. Best regards, Caitlin, Marika, and Berry Berry Cobb GNSO Policy Consultant Principal | BAC in Black Consulting <http://bacinblack.com/> Mob: +1 (720) 839-5735 <https://twitter.com/berrycobb> <https://www.linkedin.com/in/berrycobb/>

1 0

EPDP Phase 2A homework
by Drazek, Keith April 12, 2021

April 12, 2021

Dear EPDP Team, The leadership team and staff have taken stock of the current homework and input provided by the deadline (Friday 9 April COB), which was unfortunately very limited. The Staff support team is planning to produce the next iteration by Tuesday 13 April, at the latest, so you have a little bit more time to weigh in on the following questions that have been called out in the google doc (https://docs.google.com/document/d/1OF_bSxXaiGwK_-jWVC8oq-weXMaX7iEVCWWTMhw…) Please review and respond and/or provide feedback to these questions by COB Monday: 1. EPDP Team to consider this suggestion (“rewriting the entire treatment of legal vs natural to focus on the result instead of this tangled approach”) and Steve Crocker to provide proposed language that achieves this approach for the EPDP Team to consider. 2. EPDP Team to consider what tracking can be implemented to measure the extent to which guidance is being followed and who should be responsible for this tracking. 3. EPDP Team to respond to question “why an RDDS flag is not possible in all cases. This would allow escrow and transfers to be effected with minimal registrant inconvenience”? 4. EPDP Team to consider whether additional guidance re. explaining what a legal person and natural persons are, should be added and if so, suggest specific language. 5. Alan G. / EPDP Team to consider whether or not the need for an RDDS-defined field needs to be made specific and if so, who is responsible for creating such a field (does that require a separate recommendation? 6. Question for EPDP Team: should scenario #3 be deleted? Note, NCSG objects to inclusion of this scenario, unless Registrar is barred from inferring registration type.. 7. EPDP Team to consider practical challenges of third party verification and whether this creates any further privacy risks. 8. EPDP Team to consider whether sentence “Registrars may also choose to use a third party to verify that a registrant has correctly identified its data: should be deleted. Again, I have noted the angst concerning our repurposing of last Thursday’s plenary to the Legal Committee, but there has been ample opportunity to advance this work in between plenary sessions, and our plenary deliberations must be informed by our homework if we hope to make timely progress. We will not repurpose any further plenary sessions, and we may add more, but substantive written contributions to the homework documents are required if we hope to make the plenary discussions productive. Best regards, Keith From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> On Behalf Of Drazek, Keith via Gnso-epdp-team Sent: Wednesday, April 7, 2021 3:57 PM To: gnso-epdp-team(a)icann.org Cc: gnso-secs(a)icann.org Subject: [EXTERNAL] Re: [Gnso-epdp-team] EPDP Phase 2A homework Caution: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Hi all, Responding to both Alan and Laureen, I understand the concern about our limited timeframe and losing important plenary session time. The Legal Committee analysis of Bird & Bird feedback is a critical component and gating factor for the full Team’s consideration and deliberation at plenary on those questions/answers. The Legal Committee received the response from B&B on Tuesday morning, which didn’t leave sufficient time to assess the substance before the previously scheduled Legal Committee meeting that same morning. As such, and in light of scheduling difficulties, we chose to repurpose this week’s plenary meeting. Moving forward, we will begin adding meetings (plenary and LC) as needed rather than repurposing. In the meantime, there is plenty of work to be done on the homework and I strongly encourage everyone to provide feedback on the latest draft of the legal/natural document as circulated by Caitlin on Monday (and attached). Repurposing this week’s plenary does not mean work stops, and I’m hopeful that we can continue advancing our work in the document and on the list while the Legal Committee digs in to the B&B response. Thanks and regards, Keith From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Kapin, Laureen via Gnso-epdp-team Sent: Wednesday, April 7, 2021 11:13 AM To: Alan Greenberg <alan.greenberg(a)mcgill.ca<mailto:alan.greenberg@mcgill.ca>>; Caitlin Tubergen <caitlin.tubergen(a)icann.org<mailto:caitlin.tubergen@icann.org>>; gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: [EXTERNAL] Re: [Gnso-epdp-team] EPDP Phase 2A homework Caution: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Hi folks, I’m also concerned with reducing the number of plenary sessions that we have left. As has been emphasized, we are on a streamlined schedule. Hence, I suggest scheduling a make-up session for the recently canceled plenary session and the option to schedule additional plenary sessions if needed to meet our deadlines. Kind regards, Laureen Kapin Counsel for International Consumer Protection Federal Trade Commission (202) 326-3237 From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Alan Greenberg via Gnso-epdp-team Sent: Wednesday, April 7, 2021 10:50 AM To: Caitlin Tubergen <caitlin.tubergen(a)icann.org<mailto:caitlin.tubergen@icann.org>>; gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] EPDP Phase 2A homework I would like to register my disagreement with the decision to cancel another plenary. We only have a very limited number of meetings prior to the drafting and issuance of our draft report. If the Legal Committee needs more time (which is not unreasonable or unexpected), they should be scheduled at other times. At this point, given where we are and what we have to do, I would think that we would be going in the opposite direction and using some Tuesdays for plenaries! There is little need for legal clarity if we do not have a full opportunity to discuss it. Alan At 2021-04-06 04:28 PM, Caitlin Tubergen via Gnso-epdp-team wrote: Dear EPDP Team: As you have likely seen, EPDP Leadership has agreed to repurpose Thursdayâ€™s plenary session for a Legal Committee meeting since we just received legal advice from Bird & Bird. EPDP Support Staff circulated the updated write-up for Legal v. Natural<https://docs.google.com/document/d/1OF_bSxXaiGwK_-jWVC8oq-weXMaX7iEVCWWTMhw…> yesterday. There are several questions called out for EPDP Team response in the document. Thank you to those who have already provided input. In order for the Team to make progress in spite of the repurposed meeting, we kindly ask you to review the updated write-up<https://docs.google.com/document/d/1OF_bSxXaiGwK_-jWVC8oq-weXMaX7iEVCWWTMhw…> and provide feedback in comment form only to the questions posed. You are also welcome to continue providing feedback on the edited text in comment form only. Please provide feedback by COB Friday, 9 April. EPDP Support Staff will review the feedback received and produce an updated version prior to next weekâ€™s plenary meeting. Thank you. Best regards, Berry, Marika, and Caitlin _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://secure-web.cisco.com/1AVe74Mzq03WlTOzMIzj1Mehy7NkC-1zT6e-XbUaKzbs4a…> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy ( https://www.icann.org/privacy/policy<https://secure-web.cisco.com/1IhKNisCZlr_fwTqFNxbeXs0c3g4Xb1VAxSTBXXtkxpsqX…>) and the website Terms of Service ( https://www.icann.org/privacy/tos<https://secure-web.cisco.com/1fy0SmUZAUftOz4N5hAnYk-YpV-4ZZSuujrwrsaGfqEBMX…>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

3 2

EPDP Phase 2A homework
by Caitlin Tubergen April 8, 2021

April 8, 2021

Dear EPDP Team: As you have likely seen, EPDP Leadership has agreed to repurpose Thursday’s plenary session for a Legal Committee meeting since we just received legal advice from Bird & Bird. EPDP Support Staff circulated the updated write-up for Legal v. Natural<https://docs.google.com/document/d/1OF_bSxXaiGwK_-jWVC8oq-weXMaX7iEVCWWTMhw…> yesterday. There are several questions called out for EPDP Team response in the document. Thank you to those who have already provided input. In order for the Team to make progress in spite of the repurposed meeting, we kindly ask you to review the updated write-up<https://docs.google.com/document/d/1OF_bSxXaiGwK_-jWVC8oq-weXMaX7iEVCWWTMhw…> and provide feedback in comment form only to the questions posed. You are also welcome to continue providing feedback on the edited text in comment form only. Please provide feedback by COB Friday, 9 April. EPDP Support Staff will review the feedback received and produce an updated version prior to next week’s plenary meeting. Thank you. Best regards, Berry, Marika, and Caitlin

5 4

Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 15 April 2021 at 14:00 UTC
by Terri Agnew April 6, 2021

April 6, 2021

Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 15 April 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/3oSUCQ Check your time zone: https://tinyurl.com/cfe3f3bf The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Cancelled | Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 08 April 2021 at 14:00 UTC
by Terri Agnew April 6, 2021

April 6, 2021

Per the EPDP-P2A Leadership team decision and consultation with the Legal Committee, the Thursday, 08 April 2021 Plenary call is cancelled and will be re-purposed to continue the Legal Committee’s work. The next Plenary call will be on Thursday, 15 April at 14:00 UTC (invite will be sent shortly). Please remember to remove 08 April from your calendars. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 08 April 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/3ISUCQ Check your time zone: https://tinyurl.com/fvvt48sc [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/fvvt48sc__;!!PtGJab4!sylEWZn…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

EPDP Phase 2A legal guidance - legal v. natural (Q1-2)
by Caitlin Tubergen April 6, 2021

April 6, 2021

Dear EPDP Team, Attached, please find Bird & Bird’s responses to the Legal Committee’s first two questions. The questions are included in the attached memo. Thank you. Best regards, Berry, Marika, and Caitlin

3 2

For your review: Updated Legal v. Natural Write-Up
by Caitlin Tubergen April 5, 2021

April 5, 2021

Dear EPDP Team, Further to the Support Team’s action item to review comments received and provide the next iteration of the Legal v. Natural Write-up, please find a link to the latest (clean) version: https://docs.google.com/document/d/1OF_bSxXaiGwK_-jWVC8oq-weXMaX7iEVCWWTMhw…. Support Staff accepted all changes that appeared noncontroversial, but if you disagree with any changes, please flag them. We have also attached the redline version for further context. Please note there are several questions posed to the Team based on the comments and questions submitted by EPDP Team members. Support Staff wasn't sure how to address these questions/comments or whether there was broad support for what was being suggested. Accordingly, we are looking for input from the EPDP Team to determine if/how to apply those comments. Please review the questions in the Google Doc and come prepared to discuss the questions at the next meeting on Thursday, 8 April at 14:00 UTC. You are also welcome to provide advance feedback in the Google Doc<https://docs.google.com/document/d/1OF_bSxXaiGwK_-jWVC8oq-weXMaX7iEVCWWTMhw…>. Best regards, Berry, Marika, and Caitlin

1 0

Notes and action items - EPDP Phase 2A Meeting #13 - 1 April 2021
by Caitlin Tubergen April 1, 2021

April 1, 2021

Dear EPDP Team, Please find below the notes and action items<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> from today’s EPDP Team meeting. The next EPDP Legal Committee will be Tuesday, 6 April at 14:00 UTC, and the next plenary meeting will be Thursday, 8 April at 14:00 UTC. Best regards, Berry, Marika, and Caitlin -- EPDP Phase 2A - Meeting #13 Proposed Agenda Thursday 1 April 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) * Review of March 2021 Project Package (Berry) * During Phase 1, the Council was eager to receive updates on the status of the EPDP Team’s work. * PDP 3.0 introduced a more rigorous approach to project plans in an effort to increase the accountability for all involved in these projects, including staff, leadership, and members. * Please note the second page of the project package, which is the “situation report”. This is an extract of the project the Council considers in its meeting materials, and it is updated twice per month. The situation report highlights what the team is working on, what it will work on next, and what was completed in the prior period. * With respect to status and health of the project, it is currently denoted as “on target”. The feasibility of unique contacts question is slightly downgraded/behind schedule since the Team is awaiting guidance from its external counsel before considering the question further. * There are statistics regarding participation and attendance. The left-hand column shows the plenary and meeting attendance. * This package will be delivered to the GNSO Council shortly. 3. Legal vs. natural (40 minutes) 1. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); 2. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. Guidance development a. Review updated write up of guidance proposal * See updated draft write up developed by leadership & staff support team (https://docs.google.com/document/d/11AYCPVEKjF--Obp-okojggWv1Z4R2PBjvZFOGu4…) * Within this document, several EPDP Team members have raised the question of definitions with respect to disclosure and publication. Leadership recommends using the language from the Phase 1 IRT draft policy for consistency. * Reactions by EPDP Team: * Does the updated version address input provided to date? * Under the proposed guidance, two thoughts come to mind. There is an enormous focus on legal vs. natural and permission to publish information, and a question re: how to determine if PII is associated with a legal person. Is there a determination that it is OK to make this information available for public access? The question underneath this is how to make this determination. Preference would be to compress and condense the proposed guidance into a simple form – have to make determination whether it is OK or not OK to make the data public. If you cannot get permission from the data subject or make a clear determination based on the data, the data should not be published. Item B provides “as soon as commercially reasonable” – how is this interpreted? It sounds like there is no current requirement to do this, but this is permitted. There will come a time at which ICANN or this group says the time has now come that this is required. * Propose the above questions be put into writing by Steve so the group can further digest. The text quoted is from EPDP Phase 1 Recommendation 6 – this is currently being implemented by ICANN org in conjunction with an Implementation Review Team. This will be a requirement in the future. * Previously asked for registrars to provide further information on how many registrars (if any) have implemented this – still awaiting an answer. * Do not like the definition of publish as this is misleading but defining based on IRT definition is OK. * NCSG had objected strongly to the third option where registrar infers person type. Do not understand step 3 – why isn’t this done at collection? * The paragraph regarding guidance sounds like guidance – would it be better to move this paragraph to the proposed guidance section instead of after the scenarios? * With respect to the definition of publication “to provide registration data in the publicly accessible Registration Data Directory Services”. Want to make sure there are two distinct things – making data publicly accessible (nonpersonal data) and disclosure via the SSAD * To publish, in the context of this group, means publicly available information in the directory (WHOIS, RDAP) as distinct from disclosure which is either through SSAD or a direct request with the contracted party. * Because of different business models that registrars that may employ, inference of person type could be OK – for example, corporate registrars could infer person type b/c of their business type * Difference b/w Scenario 1 and Scenario 2 is the timing at which the data type is chosen by the registrant. This should be two forms of Scenario 1 – the other form would be that the registrant identifies the registrant type at registration and the determination over whether the data is personal could happen at a later time. * With respect to noncommercial companies – legal v. natural is not an easy determinations to make – the determination as to legal personhood is difficult and could vary across a portfolio of domain names. Do not support the idea of making advice binding. The determination of if the guidance is acceptable would be a determination by the data protection commissioner, and co-controllers should err on the side of caution. * The Team is not yet at the point of discussing binding policy recommendations. * Support suggestion of including another flavor where a registrar collects the legal v. natural distinction first and then makes a subsequent determination of if there is personal data. * Would like to have an idea of the registrars on this team of if Rec. 6 has been implemented or not. * Cannot answer for all registrars – but have not yet implemented Rec. 6 b/c waiting for some sort of standard to emerge in the industry. * If there is any update from the Phase 1 IRT that would inform this discussion, please feel free to update the group. * It’s important to not let WHOIS die – the GDPR is an instrument that is not designed to prohibit publication of nonpersonal data. There are contracted parties who wish to make this distinction, but they do not have sufficient guidance. There is no risk to the two-step approach. It’s important to get further guidance from legal counsel to make EPDP Team members more comfortable. * Focused on ensuring what used to be WHOIS is done in compliance with applicable regulation and law and also in the context of making registration data publicly accessible through requests under certain parameters * WHOIS is not necessary for the purposes people have claimed as there are other ways to achieve these goals. * The fact that registrars have requested guidance is not surprising – the question is what can the EPDP Team actually provide in terms of guidance. Some have stated unequivocally that there is no risk; this is simply not true. There is risk. * Several stakeholder groups have been pressing for the data to be in the publicly accessible database. Automated requests in SSAD is short of what several stakeholder groups are asking for. * The guidance document should have a disclaimer that this is not legal advice and people rely it at their own risks, however we should note some of the legal risks. In the guidance document, we should allow for both options – publication in RDDS and automated response in SSAD. * One of the reasons to distinguish b/w legal and natural persons is that you do want to publish the data of corporate entities that is not personal. We have to be careful about making sure that individuals’ records are not published. There are good things about publishing the data of legal persons that are corporations offering services. * The reason we’re having a discussion about definitions is because the definitions used in the document are not the same as the definitions displayed at the beginning of the call – suggest staff ensure that the correct definitions are incorporated into the next iteration of the document. * There is some discussion around adding language that would allow registrars to publish data in the public RDDS. This is not necessary for this document because Phase 1 recommendations already envision this. There is language that requires redaction where GDPR is applicable on personal data and allows for but does not require geographic differentiation. This is already an option for registrars and do not need new policy or guidance for this. Should focus on the intent of this document, which is what guidance can we provide for registrars who are making a distinction b/w legal and natural persons that will enable them to help make this distinction if they would like to * Concept of 1d – any substantive change to the data should reset the confirmation. Disagree – any change should be accompanied by a new confirmation of legal/natural and personal/nonpersonal instead of redacting without re-asking the questions. * When data is collected, the status of that data is what is dispositive. * Document keeps referring to contracted parties making the determination. This is registrars making the determination; registries do not make this determination. * Suggest that Staff make a quick pass for publication vs. disclosure in SSAD * Are there any “cannot live with” aspects remaining? * What incentives, if any, could be considered to promote any guidance agreed to by the EPDP Team? * Confirm next steps - EPDP Team to review the legal v. natural write-up and provide comments (in comment form only) by COB Friday, 2 April. - Support staff to incorporate feedback into next iteration and distribute updated version to EPDP Team by Tuesday, 6 April. 4. Wrap and confirm next EPDP Team meeting (5 minutes): 1. EPDP Team Meeting #14 Thursday 8 April at 14.00 UTC. 2. Confirm action items 3. Confirm questions for ICANN Org, if any

1 0