May 2021 - Gnso-epdp-team - lists.icann.org

Re: [Gnso-epdp-team] Notes and action items - EPDP Phase 2a Meeting#25 - 27 May 2021
by Kapin, Laureen 31 May '21

31 May '21

Thanks for your response Sarah. Seems like we will need to discuss further on Tuesday. We oppose including this language in the Guidance section. Sent via phone. Please excuse typos and/or unintended auto-correct outcomes. Laureen Kapin Federal Trade Commission On May 31, 2021, at 10:36 AM, Sarah Wyld via Gnso-epdp-team <gnso-epdp-team(a)icann.org> wrote: Hello, Thank you to Laureen, Chris, and Melina for your proposed changes. I’m fine with the updates to the introductory paragraph. The RrSG-proposed version relies on guidance that has already been received from relevant data protection authorities; it is not providing legal advice. I have attached an updated version which has footnotes with links to the relevant guidance. Replacing the points a-d with direct quotes from GDPR Art. 5 does not, in my view, bring any added benefit. The reader of this Report can reference the GDPR directly whenever they need to do so. I understand that there is an objection to paraphrasing the GDPR, but there have been no specific concerns raised with these descriptions of how to adhere to these GDPR principles, so although there are legitimate concerns about the deleterious effects of paraphrasing/providing excerpts from Bird & Bird legal memos, I have seen nothing to indicate that the same concerns are at issue here. Overall the actual specific guidance provided by the RrSG team is almost entirely unrepresented in the Initial Report, and removing these points a – d simply finishes the job of erasing it, so I cannot support these alterations or removing section D entirely (as was proposed in one of the input charts). I do see that it may not be a good fit in the Background section and may be more appropriately located in the Guidance section, so I would be in favour of moving it to that part of the report. Thank you. -- Sarah Wyld, CIPP/E Policy & Privacy Manager Pronouns: she/her swyld(a)tucows.com<mailto:swyld@tucows.com> +1.416 535 0123 Ext. 1392 <66DD891F1CD140B8B082E775A55F2328[12469508067].png> From: Kapin, Laureen via Gnso-epdp-team<mailto:gnso-epdp-team@icann.org> Sent: May 28, 2021 6:00 PM To: gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Notes and action items - EPDP Phase 2a Meeting#25 - 27 May 2021 For clarity – the attachment in the prior email reflects the GAC’s current position. We are still hoping to work this through with Sarah. Laureen Kapin Acting Assistant Director Division of Consumer Response and Operations Bureau of Consumer Protection Federal Trade Commission From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> On Behalf Of Kapin, Laureen via Gnso-epdp-team Sent: Friday, May 28, 2021 5:29 PM To: gnso-epdp-team(a)icann.org Subject: Re: [Gnso-epdp-team] Notes and action items - EPDP Phase 2a Meeting #25 - 27 May 2021 Hi folks, We wanted to update you on our deliberations about paragraph D of the Background and Team Observations starting at line 256. We’ve been conferring with Sarah W. on a way to move forward and address our preference to avoid: 1) paraphrasing select parts of the GDPR and 2) providing legal advice rather than policy guidance (other than referencing the legal memos). Our team hasn’t had a chance to finalize our deliberations because of the difference in time zones and competing demands of other time sensitive work but the attached proposal reflects our current thinking. Please excuse formatting and note that the line #s do not match the revised Draft Report because of the edits. Kind regards, Laureen Kapin Acting Assistant Director Division of Consumer Response and Operations Bureau of Consumer Protection Federal Trade Commission From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> On Behalf Of Caitlin Tubergen via Gnso-epdp-team Sent: Thursday, May 27, 2021 2:31 PM To: gnso-epdp-team(a)icann.org Subject: [Gnso-epdp-team] Notes and action items - EPDP Phase 2a Meeting #25 - 27 May 2021 Dear EPDP Team, Please find below the notes and action items from today’s call. Best regards, Berry, Marika, and Caitlin 💥 📣 🛎 🚨 Action Items<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> 🚨 🛎 📣 💥 1. EPDP Team members are to review the input form with the proposed resolution of cannot live with items<https://mm.icann.org/pipermail/gnso-epdp-team/attachments/20210526/923483e1…>, Keith’s email (https://mm.icann.org/pipermail/gnso-epdp-team/2021-May/003937.html) the updated section 3 of the Initial Report (https://drive.google.com/drive/u/0/folders/1TW3Z-s6DzS2QsV_VwJ6iUQTvKVIXQrmG) and indicate what changes/updates are essential FOR THE PURPOSE OF THE PUBLICATION OF THE INITIAL REPORT in this table<https://docs.google.com/document/d/1aaDULVrGIkWXEGfoal8RqkC_baNjmVvujgk1HIy…> BY CLOSE OF BUSINESS, FRIDAY 28 MAY. As such, you are encouraged to focus your input on any clarifying edits and/or questions that should be added to encourage community input. Input table: https://docs.google.com/document/d/1aaDULVrGIkWXEGfoal8RqkC_baNjmVvujgk1HIy…. 2. Deadline for flagging any minor edits / corrections by 16:00 UTC on Friday, 28 May. (https://docs.google.com/document/d/1aaDULVrGIkWXEGfoal8RqkC_baNjmVvujgk1HIy…) 3. RrSG and GAC to come forward with proposal for updated Guidance D to factor in concerns addressed (References to “controller” are not helpful as ICANN has recently avoided ‘admitting’ its controllership. Each CP must determine for itself if/how data protection law might impact its processing. This appears to be quasi-legal advice, which should be avoided. We should also avoid paraphrasing the GDPR) by Friday, 28 May. 4. IPC and GAC reps to come forward with a proposal for footnote 8, “8 The personal/non-personal distinction only applies/is relevant for registrants who have self-identified as legal persons” by Friday, 28 May. 5. RySG to come forward with a proposed question to put forward to the community in relation to the standardized data element to obtain further input on whether changes should be considered to the terminology used or the type of data element proposed by Friday, 28 May. 27. 6. GAC to liaise with RySG to address the concerns of the RySG regarding the GAC-proposed feasibility recommendation. (Note: GAC has suggested the RrSG proposed suggestion could be a viable alternative.) 7. Groups who support including a recommendation on webforms to formulate specific questions for community input factoring in the concerns of other groups that have been expressed on the mailing list. EPDP Phase 2A - Meeting #25 Proposed Agenda Thursday 27 May 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. “Cannot live with” items take-aways * 77 items were addressed as cannot live with, which is very concerning * Each group will be asked to speak for 1-2 minutes about a proposed path forward for the group. * Your group can discuss a path forward in a general sense or discuss specific items * Cannot live with items are typically used to indicate fundamental disagreement for a Final Report. This group is not there yet. We are developing proposed text and questions to seek public comment on. * Struggling with the number of cannot live with items at this stage of the process b. Approach & expected next steps for Initial Report publication 3. Consider any remaining “cannot live with” items identified by EPDP Team members after review of Initial Report input form with proposed solution and redline version of updated Initial Report a. Consider items submitted prior to the meeting * RrSG: Members have approached this group and work with unrealistic expectations regarding changes that are beyond the scope of this group’s work and are unhappy that they cannot achieve what they want. * ALAC: part of the issue is timing. To some extent, maybe if we had more time to talk, digest, and consider these documents, there would have been more time to consult with our constituencies. Many concerns were resolved with the staff issues, but the other issues need to be resolved one-by-one. * BC: This is not just the timing issue. There is also a tone issue. This is about optional guidance; it is not about imposing requirements. In the ICANN model, when the status quo is favored, you have the option to be magnanimous when opposing change. BC has been on both sides; however, BC has never brutally disparaged other interests, but that is happening in this group. * RrSG: Interesting to hear ALAC and BC raise similar concerns as the RrSG. RrSG’s concerns that have been repeatedly raised are hidden in footnotes. It’s important to ensure arguments have equal time. * GAC: Believe the group is closer than we think – confident that we can get to “yes” with everyone being equally unhappy. When GAC reviewed additions from the RySG and saw what was a neutral but barebones description, GAC thought it needed to include the same so that there is a balance. It is fair for everyone to be mindful of wanting to achieve a balanced and objective view in the report as to the state of play and clear indications of where we disagree for the purpose of soliciting public comments. If some groups put in text that tilt the scales, they should expect the other side to respond. It’s fair to ask everyone to forbear but not reasonable to expect groups to not put their perspective down. It may be helpful for groups to mutually disarm. We may need another week to review the changes that Staff has made. * Beyond a week extension, we would need to go back to the Council for a project change request. * NCSG: Think we should modulate our expectations for this report. Even though we are arguing about fine points. It is fair in an initial report – we worked on this for [x] months, there are still firmly-held positions. One side says this, and the other side says this, so that it’s clear to the reader what the two positions are. We should not pretend we have consensus when we don’t. * ALAC: in taking a look at the contentious parts of the report – the introduction is very contentious. With respect to the actual substance and concrete recommendations of the report, the group is closer to consensus. * IPC: More time may be needed to digest the changes. It would be helpful to have the line numbers updated for the new version. * ISPCP: Pleased to review Keith’s email – did not put any can’t live with items in this table. There seems to have been a lot of time devoted to items that are not in scope. What we may be seeing here is a process where items that are out of scope are not included in this report and a process of mourning. We need more time for reflection on the scope. Based on these conversations, it seems that we may be closer than we thought. * SSAC: Concerned with getting the group back on track and working toward consensus. * RySG: RySG has made interventions re: scope. This group has a specific task to go by. EPDP has become a work horse where groups continually bring things to the table. There are a lot of eyes on the MSM; it’s important to follow the process and stay in scope. If we do not agree with the guidance or agree that it will be helpful to CPs, then it is not good guidance. It’s important to point out in FN13 that three of the members of this team believe that this should be mandatory. There has been a mixed message. * Thank you to all for the frank conversation. There is a general view that we are closer than it appears. There is a recognition that we can do some work over the next week and that we need to clearly resolve some of the cannot live with designations. We need everyone to go back to the cannot live with designations. These are significant and mean something when staff and leadership does its analysis to try to resolve issues. The way forward: all groups to review the responses to the cannot live with items, review Keith’s email from yesterday, and the latest version of the Initial Report with the redlines. What needs to be added in terms of questions to ensure we get meaningful input in the public comment forum. b. Confirm next steps 4. Consider items flagged for further discussion and resolution (see list of blue items): a. Should standardized data element recommendation include reference to extensibility? Is this a necessary missing element or can this also be considered after public comment? * This is a field meant to talk about registrant type. There may be value in not unduly restricting this field if we want to expand this field in the future. * Registries do not support this as a field in the public RDDS, but do support this being a standardized data element for registrars who choose to differentiate. Concerned with the fields we have standardized own – this seems to contradict the Team’s own advice that legal/natural distinction is not dispositive for whether the registration contains personal data or not. Concerned that legal/natural/unknown are not the right fields. For that reason, wise of SSAC to suggest some flexibility here. * This is in the RDDS period – a question later on is if this should be public. The Initial Report asks a question about whether this should be sent to the SSAD. Thought “unknown” was changed to “unspecified” since unknown is unclear as to who doesn’t know it. * Seems that RySG is saying the data element should be extensible, could be for example, legal but contains personal data. That statement does not contradict the statement from SSAC. Agree that “unknown” is not as good as “unspecified”. * RySG to include a question for public comment re: this field. The question is around the fields to be standardized, and we need to come to agreement on a question to pose that can help inform the discussion on this. If the text doesn’t have the right fields, we need input on how to get input on what the right fields are. * ALAC is adamant that the field should be added to RDDS, not necessarily the public RDDS. If there are too many values, the field may not have as much utility. * If there are not the right fields, what could they be, what should they be? * This is a question of sorting. This is an initial sorting of legal, natural, or unspecified. The question of whether personal data is present, is a separate analytical issue. This concern is already reflected in the guidance. * The distinction b/w legal and natural is not relevant for all data protection law. The whole idea of managing personal information by asking about legal v. natural misses the point. b. Footnote 5 – GAC to confirm whether this footnote must remain as it is a cannot live with item for the IPC. Footnote was originally added at the request of the GAC. c. LvN Background Information D. – GDPR Principles that may apply. RrSG Team has indicated that this is important guidance to Registrars, others (IPC, GAC, ALAC, GAC) have indicated concerns with this language. GAC & RrSG were assigned action item to come up with a mutually acceptable approach. * GAC has no opposition to referencing principles; however, uncomfortable with paraphrasing the GDPR and picking certain principles over others. * Not in favor of striking section D – it’s important to convey the GDPR principles. This is a way to incorporate the guidance registrars have been trying to provide all along. d. New recommendation (submitted after the deadline) re. LvN Guidance * The guidance does not include the key advice – if the legal registration does not include personal information, it should be published. The “money issue” is omitted – it’s only included in the scenarios, which is not guidance. This issue has been raised all along – this is a real, true cannot live with item. * Support previous comment – we have guidance, which is not mandatory, saying if you choose to differentiate, this is how to do it, but we don’t have the result of it. In other words, every registrar could differentiate, but there is still nothing published. The registry comment is talking about publishing the type, and this is not what the sentence is saying. This is about publishing the actual data, not the flag. * This is something that registrars can decide to do field by field. * Question is to the registries – this feedback is based on a different topic than what the text was. This appears to relate to the publication of the legal/natural flag. * Can agree to a should but not a must * Do not agree with the two-levels of permissiveness – it’s already guidance – why does it also need to say should? e. New recommendation (submitted after the deadline) re. web forms * The target of a PDP should not be “we followed the rules”; the target should be good policy. If we are not going to recommend pseudonymized emails, there is an impact of that decision, and that is why the web form recommendation is suggested. f. New recommendation (submitted after the deadline) re. feasibility * This is not a new concept; this is the crux of these discussions so that it can be identified for public comment. With the registrar’s suggested text, hoping to get to “yes”. * Is this new language being proposed as guidance? * Answer: yes. g. Confirm next steps * Provide an opportunity or a path for including the bracketed language unless there is strong disagreement. * If there is general agreement that this text can be included after additional wordsmithing; however, if there is significant disagreement, may have to set them aside. * Over the next 24-36 hours, please spend time on these outstanding items to get this across the finish line. Plan to schedule meetings on Tuesday and Thursday 5. Public Comment Forum a. EPDP Team to provide suggestions for how to best solicit input from the community and avoid restatements of already known positions and/or information. b. Confirm next steps 6. Homework assignments reminder · By Friday 28 May at 16.00 UTC, EPDP Team to review latest version of the Initial Report and submit any minor edits / non-substantive comments. 7. Wrap and confirm next EPDP Team meeting (5 minutes): 1. EPDP Team Meeting #26 Tuesday 1 June at 14.00 UTC (if necessary) 2. Confirm action items 3. Confirm questions for ICANN Org, if any <66DD891F1CD140B8B082E775A55F2328[12469508067].png> <EPDP 2a Background D.pdf> _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

1 0

Notes and action items - EPDP Phase 2a Meeting #25 - 27 May 2021
by Caitlin Tubergen 31 May '21

31 May '21

Dear EPDP Team, Please find below the notes and action items from today’s call. Best regards, Berry, Marika, and Caitlin 💥 📣 🛎 🚨 Action Items<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> 🚨 🛎 📣 💥 1. EPDP Team members are to review the input form with the proposed resolution of cannot live with items<https://mm.icann.org/pipermail/gnso-epdp-team/attachments/20210526/923483e1…>, Keith’s email (https://mm.icann.org/pipermail/gnso-epdp-team/2021-May/003937.html) the updated section 3 of the Initial Report (https://drive.google.com/drive/u/0/folders/1TW3Z-s6DzS2QsV_VwJ6iUQTvKVIXQrmG) and indicate what changes/updates are essential FOR THE PURPOSE OF THE PUBLICATION OF THE INITIAL REPORT in this table<https://docs.google.com/document/d/1aaDULVrGIkWXEGfoal8RqkC_baNjmVvujgk1HIy…> BY CLOSE OF BUSINESS, FRIDAY 28 MAY. As such, you are encouraged to focus your input on any clarifying edits and/or questions that should be added to encourage community input. Input table: https://docs.google.com/document/d/1aaDULVrGIkWXEGfoal8RqkC_baNjmVvujgk1HIy…. 2. Deadline for flagging any minor edits / corrections by 16:00 UTC on Friday, 28 May. (https://docs.google.com/document/d/1aaDULVrGIkWXEGfoal8RqkC_baNjmVvujgk1HIy…) 3. RrSG and GAC to come forward with proposal for updated Guidance D to factor in concerns addressed (References to “controller” are not helpful as ICANN has recently avoided ‘admitting’ its controllership. Each CP must determine for itself if/how data protection law might impact its processing. This appears to be quasi-legal advice, which should be avoided. We should also avoid paraphrasing the GDPR) by Friday, 28 May. 4. IPC and GAC reps to come forward with a proposal for footnote 8, “8 The personal/non-personal distinction only applies/is relevant for registrants who have self-identified as legal persons” by Friday, 28 May. 5. RySG to come forward with a proposed question to put forward to the community in relation to the standardized data element to obtain further input on whether changes should be considered to the terminology used or the type of data element proposed by Friday, 28 May. 27. 6. GAC to liaise with RySG to address the concerns of the RySG regarding the GAC-proposed feasibility recommendation. (Note: GAC has suggested the RrSG proposed suggestion could be a viable alternative.) 7. Groups who support including a recommendation on webforms to formulate specific questions for community input factoring in the concerns of other groups that have been expressed on the mailing list. EPDP Phase 2A - Meeting #25 Proposed Agenda Thursday 27 May 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. “Cannot live with” items take-aways * 77 items were addressed as cannot live with, which is very concerning * Each group will be asked to speak for 1-2 minutes about a proposed path forward for the group. * Your group can discuss a path forward in a general sense or discuss specific items * Cannot live with items are typically used to indicate fundamental disagreement for a Final Report. This group is not there yet. We are developing proposed text and questions to seek public comment on. * Struggling with the number of cannot live with items at this stage of the process b. Approach & expected next steps for Initial Report publication 3. Consider any remaining “cannot live with” items identified by EPDP Team members after review of Initial Report input form with proposed solution and redline version of updated Initial Report a. Consider items submitted prior to the meeting * RrSG: Members have approached this group and work with unrealistic expectations regarding changes that are beyond the scope of this group’s work and are unhappy that they cannot achieve what they want. * ALAC: part of the issue is timing. To some extent, maybe if we had more time to talk, digest, and consider these documents, there would have been more time to consult with our constituencies. Many concerns were resolved with the staff issues, but the other issues need to be resolved one-by-one. * BC: This is not just the timing issue. There is also a tone issue. This is about optional guidance; it is not about imposing requirements. In the ICANN model, when the status quo is favored, you have the option to be magnanimous when opposing change. BC has been on both sides; however, BC has never brutally disparaged other interests, but that is happening in this group. * RrSG: Interesting to hear ALAC and BC raise similar concerns as the RrSG. RrSG’s concerns that have been repeatedly raised are hidden in footnotes. It’s important to ensure arguments have equal time. * GAC: Believe the group is closer than we think – confident that we can get to “yes” with everyone being equally unhappy. When GAC reviewed additions from the RySG and saw what was a neutral but barebones description, GAC thought it needed to include the same so that there is a balance. It is fair for everyone to be mindful of wanting to achieve a balanced and objective view in the report as to the state of play and clear indications of where we disagree for the purpose of soliciting public comments. If some groups put in text that tilt the scales, they should expect the other side to respond. It’s fair to ask everyone to forbear but not reasonable to expect groups to not put their perspective down. It may be helpful for groups to mutually disarm. We may need another week to review the changes that Staff has made. * Beyond a week extension, we would need to go back to the Council for a project change request. * NCSG: Think we should modulate our expectations for this report. Even though we are arguing about fine points. It is fair in an initial report – we worked on this for [x] months, there are still firmly-held positions. One side says this, and the other side says this, so that it’s clear to the reader what the two positions are. We should not pretend we have consensus when we don’t. * ALAC: in taking a look at the contentious parts of the report – the introduction is very contentious. With respect to the actual substance and concrete recommendations of the report, the group is closer to consensus. * IPC: More time may be needed to digest the changes. It would be helpful to have the line numbers updated for the new version. * ISPCP: Pleased to review Keith’s email – did not put any can’t live with items in this table. There seems to have been a lot of time devoted to items that are not in scope. What we may be seeing here is a process where items that are out of scope are not included in this report and a process of mourning. We need more time for reflection on the scope. Based on these conversations, it seems that we may be closer than we thought. * SSAC: Concerned with getting the group back on track and working toward consensus. * RySG: RySG has made interventions re: scope. This group has a specific task to go by. EPDP has become a work horse where groups continually bring things to the table. There are a lot of eyes on the MSM; it’s important to follow the process and stay in scope. If we do not agree with the guidance or agree that it will be helpful to CPs, then it is not good guidance. It’s important to point out in FN13 that three of the members of this team believe that this should be mandatory. There has been a mixed message. * Thank you to all for the frank conversation. There is a general view that we are closer than it appears. There is a recognition that we can do some work over the next week and that we need to clearly resolve some of the cannot live with designations. We need everyone to go back to the cannot live with designations. These are significant and mean something when staff and leadership does its analysis to try to resolve issues. The way forward: all groups to review the responses to the cannot live with items, review Keith’s email from yesterday, and the latest version of the Initial Report with the redlines. What needs to be added in terms of questions to ensure we get meaningful input in the public comment forum. b. Confirm next steps 4. Consider items flagged for further discussion and resolution (see list of blue items): a. Should standardized data element recommendation include reference to extensibility? Is this a necessary missing element or can this also be considered after public comment? * This is a field meant to talk about registrant type. There may be value in not unduly restricting this field if we want to expand this field in the future. * Registries do not support this as a field in the public RDDS, but do support this being a standardized data element for registrars who choose to differentiate. Concerned with the fields we have standardized own – this seems to contradict the Team’s own advice that legal/natural distinction is not dispositive for whether the registration contains personal data or not. Concerned that legal/natural/unknown are not the right fields. For that reason, wise of SSAC to suggest some flexibility here. * This is in the RDDS period – a question later on is if this should be public. The Initial Report asks a question about whether this should be sent to the SSAD. Thought “unknown” was changed to “unspecified” since unknown is unclear as to who doesn’t know it. * Seems that RySG is saying the data element should be extensible, could be for example, legal but contains personal data. That statement does not contradict the statement from SSAC. Agree that “unknown” is not as good as “unspecified”. * RySG to include a question for public comment re: this field. The question is around the fields to be standardized, and we need to come to agreement on a question to pose that can help inform the discussion on this. If the text doesn’t have the right fields, we need input on how to get input on what the right fields are. * ALAC is adamant that the field should be added to RDDS, not necessarily the public RDDS. If there are too many values, the field may not have as much utility. * If there are not the right fields, what could they be, what should they be? * This is a question of sorting. This is an initial sorting of legal, natural, or unspecified. The question of whether personal data is present, is a separate analytical issue. This concern is already reflected in the guidance. * The distinction b/w legal and natural is not relevant for all data protection law. The whole idea of managing personal information by asking about legal v. natural misses the point. b. Footnote 5 – GAC to confirm whether this footnote must remain as it is a cannot live with item for the IPC. Footnote was originally added at the request of the GAC. c. LvN Background Information D. – GDPR Principles that may apply. RrSG Team has indicated that this is important guidance to Registrars, others (IPC, GAC, ALAC, GAC) have indicated concerns with this language. GAC & RrSG were assigned action item to come up with a mutually acceptable approach. * GAC has no opposition to referencing principles; however, uncomfortable with paraphrasing the GDPR and picking certain principles over others. * Not in favor of striking section D – it’s important to convey the GDPR principles. This is a way to incorporate the guidance registrars have been trying to provide all along. d. New recommendation (submitted after the deadline) re. LvN Guidance * The guidance does not include the key advice – if the legal registration does not include personal information, it should be published. The “money issue” is omitted – it’s only included in the scenarios, which is not guidance. This issue has been raised all along – this is a real, true cannot live with item. * Support previous comment – we have guidance, which is not mandatory, saying if you choose to differentiate, this is how to do it, but we don’t have the result of it. In other words, every registrar could differentiate, but there is still nothing published. The registry comment is talking about publishing the type, and this is not what the sentence is saying. This is about publishing the actual data, not the flag. * This is something that registrars can decide to do field by field. * Question is to the registries – this feedback is based on a different topic than what the text was. This appears to relate to the publication of the legal/natural flag. * Can agree to a should but not a must * Do not agree with the two-levels of permissiveness – it’s already guidance – why does it also need to say should? e. New recommendation (submitted after the deadline) re. web forms * The target of a PDP should not be “we followed the rules”; the target should be good policy. If we are not going to recommend pseudonymized emails, there is an impact of that decision, and that is why the web form recommendation is suggested. f. New recommendation (submitted after the deadline) re. feasibility * This is not a new concept; this is the crux of these discussions so that it can be identified for public comment. With the registrar’s suggested text, hoping to get to “yes”. * Is this new language being proposed as guidance? * Answer: yes. g. Confirm next steps * Provide an opportunity or a path for including the bracketed language unless there is strong disagreement. * If there is general agreement that this text can be included after additional wordsmithing; however, if there is significant disagreement, may have to set them aside. * Over the next 24-36 hours, please spend time on these outstanding items to get this across the finish line. Plan to schedule meetings on Tuesday and Thursday 5. Public Comment Forum a. EPDP Team to provide suggestions for how to best solicit input from the community and avoid restatements of already known positions and/or information. b. Confirm next steps 6. Homework assignments reminder · By Friday 28 May at 16.00 UTC, EPDP Team to review latest version of the Initial Report and submit any minor edits / non-substantive comments. 7. Wrap and confirm next EPDP Team meeting (5 minutes): 1. EPDP Team Meeting #26 Tuesday 1 June at 14.00 UTC (if necessary) 2. Confirm action items 3. Confirm questions for ICANN Org, if any

3 3

Proposed Agenda EPDP Team Meeting #26 on Tuesday 1 June 2021 + homework assignment
by policy＠bacinblack.com 31 May '21

31 May '21

Dear EPDP Team, Please find below the proposed agenda for the next EPDP Team meeting which has been scheduled for tomorrow, Tuesday, at 14.00 UTC. Please note that an updated version of the Initial Report has been created by the staff support team (see attached) – you will find in redline the updates that have been made by the Staff Support team based on the input received by Friday’s deadline (see input form with proposed resolution also attached). In line with last week’s discussion and the input from the RySG team, further emphasis has been put on the proposes questions for community input. These are expected to be the focus of tomorrow’s meeting. To facilitate this discussion, you are encouraged to provide your input in advance of the meeting in this document: https://docs.google.com/document/d/195LOzu25ZspprM5b4ECqwb46gLRfP7Ez/edit . Do note that there are still three items that remain to be resolved that were assigned as action items during last week’s meeting. These items are also flagged accordingly in the latest draft of the Initial Report. We expect groups to confirm by the end of tomorrow, at the latest, how these items have been resolved. If not, leadership will decide how to handle these. As a reminder, these outstanding items are: 1. Footnote 11 – awaiting IPC & GAC confirmation on how different positions are to be reconciled. 2. GDPR references in D) – awaiting GAC & RrSG team confirmation on how different positions are to be reconciled. The GAC did send proposed language to the mailing list on Friday but RrSG has not confirmed yet whether this language is acceptable. 3. Feasibility recommendation – awaiting GAC & RySG confirmation on how different positions are to be reconciled (note, it was suggested during the meeting that the RrSG proposed updated language could be an acceptable compromise). Also as no further suggestions were made in relation to how the topic of web-forms could be included by Friday’s deadline, language has been included that aims to reflect the state of affairs, factoring in the different positions that have been expressed to date. Best regards, Caitlin, Marika and Berry EPDP Phase 2A - Meeting #26 Proposed Agenda Tuesday 1 June 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. Latest version of Initial Report & expected next steps, including potentially unresolved items 3. Initial Report Questions for Community Input (30 minutes) a. Consider input / suggestions received in advance of the meeting b. Confirm next steps 4. Public Comment Forum (15 minutes) a. With focus being on questions for input, should a form approach be used to encourage input on these questions as well as facilitate review of input received? b. Confirm next steps 5. ICANN71 (15 minutes) a. Session has been scheduled <https://71.schedule.icann.org/meetings/oz6vrh2dXs9GkymWj#/?limit=10&sortByF…> for Wednesday 16 June at 14.30 UTC, focused on presenting findings and soliciting community input. Chair expected to present. EPDP Team members encouraged to attend and participate – with focus on how to encourage submissions of new information / ideas that will help inform the EPDP Team’s deliberations. b. Questions / Comments 6. Wrap and confirm next EPDP Team meeting (5 minutes): a. EPDP Team Meeting #27 Thursday 3 June at 14.00 UTC (if necessary) b. Confirm action items c. Confirm questions for ICANN Org, if any

1 0

Re: [Gnso-epdp-team] Notes and action items - EPDP Phase 2a Meeting #25 - 27 May 2021
by Alan Greenberg 31 May '21

31 May '21

I agree with the concept described here, although I differ on some specifics, and I thank Matt, Alan, Marc and Matthew for bringing it to the table. 1. The email address issue was omitted 2. The Web Form issue needs to be included, along with the rationale for why it is needed (lack of endorsing anonymized or similar addresses in the public RDDS). 3. There is a conflict in the message between "(i.e., no changes to the status quo from Phase I)" and the Rec 1 bullet saying no changes to the optional differentiation. The standardized flag is a change/addition to Phase 1 Recs. 4. The dialog on Rec 3 asks whether there should be guidance. Guidance is already in Rec 4. I thought the main point of disagreement is whether the new flag must be used by those Rrs who do choose to differentiate. Given that the focus is asking for input on the various issues that do not have consensus, each issue must be presented with the pro and con positions held by the various EPDP participants. Alan At 2021-05-28 04:42 PM, Crossman, Matthew via Gnso-epdp-team wrote: >All, > >The RySG appreciates the Chairâs clarification >that the Initial Report is intended to share >progress and solicit input, and is not a >representation of consensus on the proposed >outputs. We also recognize the importance of >timely completion of this initial stage of our >work. With that in mind, if the team can agree >on the following constructive suggestions to >ensure that the report appropriately describes >the state of the issues and facilitates >community input on areas where there remains >significant divergence, the RySG is willing to >withdraw our âcannot live withâ items as >blockers for publication of the Initial Report. > > * In general, the report should be > restructured with the aim of soliciting > community input rather than reporting specific > outcomes. For example, each section should > describe the issue/question presented, provide > a description of the teamâs views and areas > of disagreement, and then clearly present > questions to the community where we require additional input. > * Where the Initial Report includes specific > recommendations, the text should clearly note > that there is significant disagreement on each > recommendation and that the team is soliciting > community input to assist in resolving those > disagreements. For clarity in obtaining > feedback, we also suggest that the response to > the charter questions from the GNSO (i.e., no > changes to the status quo from Phase I) should > become a standalone Recommendation #1. > * We propose the following questions for > each of the recommendations (existing questions > in the Initial Report can be incorporated into this list): > * New Rec 1 (answer to charter question): > * Is there new information or inputs > that the Phase 2A team has not considered in > assessing whether to make changes to the > recommendation that Registrars and Registry > Operators may, but are not obligated to, > differentiate between legal and natural persons? > * New Rec 2 (GNSO Council monitoring): > * Is this recommendation necessary > for the GNSO council in considering future > policy work in this area? If yes, in what ways > does this monitoring assist the Council? > * New Rec 3 (Standardized flag): > * Should the working group provide > guidance to registries and registrars who > choose to differentiate between legal and > natural person registrations as to how they > make that distinction in their systems? > * If yes, what field or fields > should be used and what possible values should be included in the guidance? > * New Rec 4 (Differentiation guidance) > * Does the guidance as written > provide sufficient information and resources to > Registrars and Registry Operators who wish to differentiate? > * Are there additional elements that should be included? > * How useful is the legal guidance > (substance and format) in assisting Registrars > and Registry Operators in differentiating? > * As part of ensuring that we receive > informed feedback from the community, out of > context excerpts from the legal memos must be > removed from the main body of the report. As we > have noted, the legal memos are cumulative and > rely on significant assumptions and analysis to > reach a conclusion on risk. The full legal > memos should be appended to the report to give > the reader the full scope of the legal advice > on differentiation, verification, mitigation, and the relevant risks. > >To be clear, we continue to stand by the >concerns and issues we have flagged. If not >appropriately resolved, these concerns may >prevent us from providing consensus support on >the final recommendations. However, we intend >our suggestions above as a constructive proposal >to ensure that the Initial Report is published >as a tool to assist in gathering additional >feedback that may aid in the resolution of existing areas of divergence. > >Look forward to discussing further. > >Thanks, >Matt, Alan, Marc > >From: Gnso-epdp-team ><gnso-epdp-team-bounces(a)icann.org> On Behalf Of >Caitlin Tubergen via Gnso-epdp-team >Sent: Thursday, May 27, 2021 11:31 AM >To: gnso-epdp-team(a)icann.org >Subject: [EXTERNAL] [Gnso-epdp-team] Notes and >action items - EPDP Phase 2a Meeting #25 - 27 May 2021 > > >CAUTION: This email originated from outside of >the organization. Do not click links or open >attachments unless you can confirm the sender and know the content is safe. > >Dear EPDP Team, > >Please find below the notes and action items from todayâs call. > >Best regards, > >Berry, Marika, and Caitlin > ><https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…>Action >Items > > > * EPDP Team members are to > review<https://mm.icann.org/pipermail/gnso-epdp-team/attachments/20210526/923483e1…> > the input form with the proposed resolution of > cannot live with items, Keithâs email > (<https://mm.icann.org/pipermail/gnso-epdp-team/2021-May/003937.html>https://mm.icann.org/pipermail/gnso-epdp-team/2021-May/003937.html) > the updated section 3 of the Initial Report > (<https://drive.google.com/drive/u/0/folders/1TW3Z-s6DzS2QsV_VwJ6iUQTvKVIXQrmG>https://drive.google.com/drive/u/0/folders/1TW3Z-s6DzS2QsV_VwJ6iUQTvKVIXQrmG) > and indicate what changes/updates are essential > FOR THE PURPOSE OF THE PUBLICATION OF THE > INITIAL REPORT in this > <https://docs.google.com/document/d/1aaDULVrGIkWXEGfoal8RqkC_baNjmVvujgk1HIy…>table > BY CLOSE OF BUSINESS, FRIDAY 28 MAY. As such, > you are encouraged to focus your input on any > clarifying edits and/or questions that should > be added to encourage community input. Input > table: > <https://docs.google.com/document/d/1aaDULVrGIkWXEGfoal8RqkC_baNjmVvujgk1HIy…>https://docs.google.com/document/d/1aaDULVrGIkWXEGfoal8RqkC_baNjmVvujgk1HIy…. > > * Deadline for flagging any minor edits / > corrections by 16:00 UTC on Friday, 28 May. > (<https://docs.google.com/document/d/1aaDULVrGIkWXEGfoal8RqkC_baNjmVvujgk1HIy…>https://docs.google.com/document/d/1aaDULVrGIkWXEGfoal8RqkC_baNjmVvujgk1HIy…) > > * RrSG and GAC to come forward with proposal > for updated Guidance D to factor in concerns > addressed (References to âcontrollerâ are > not helpful as ICANN has recently avoided > âadmittingâ its controllership. Each CP > must determine for itself if/how data > protection law might impact its processing. > This appears to be quasi-legal advice, which > should be avoided. We should also avoid > paraphrasing the GDPR) by Friday, 28 May. > * IPC and GAC reps to come forward with a > proposal for footnote 8, â8 The > personal/non-personal distinction only > applies/is relevant for registrants who have > self-identified as legal personsâ by Friday, 28 May. > * RySG to come forward with a proposed > question to put forward to the community in > relation to the standardized data element to > obtain further input on whether changes should > be considered to the terminology used or the > type of data element proposed by Friday, 28 May. 27. > * GAC to liaise with RySG to address the > concerns of the RySG regarding the GAC-proposed > feasibility recommendation. (Note: GAC has > suggested the RrSG proposed suggestion could be a viable alternative.) > * Groups who support including a > recommendation on webforms to formulate > specific questions for community input > factoring in the concerns of other groups that > have been expressed on the mailing list. > >EPDP Phase 2A - Meeting #25 >Proposed Agenda >Thursday 27 May 2021 at 14.00 UTC > > >1. Roll Call & SOI Updates (5 minutes) > > > >2. Welcome & Chair updates (Chair) (5 minutes) > >a. âCannot live withâ items take-aways >- 77 items were addressed as cannot >live with, which is very concerning >- Each group will be asked to speak for >1-2 minutes about a proposed path forward for the group. >- Your group can discuss a path forward >in a general sense or discuss specific items >- Cannot live with items are typically >used to indicate fundamental disagreement for a >Final Report. This group is not there yet. We >are developing proposed text and questions to seek public comment on. >- Struggling with the number of cannot >live with items at this stage of the process > >b. Approach & expected next steps for Initial Report publication > > >3. Consider any remaining >âcannot live withâ items identified by EPDP >Team members after review of Initial Report >input form with proposed solution and redline version of updated Initial Report > >a. Consider items submitted prior to the meeting >- RrSG: Members have approached this >group and work with unrealistic expectations >regarding changes that are beyond the scope of >this groupâs work and are unhappy that they cannot achieve what they want. >- ALAC: part of the issue is timing. To >some extent, maybe if we had more time to talk, >digest, and consider these documents, there >would have been more time to consult with our >constituencies. Many concerns were resolved with >the staff issues, but the other issues need to be resolved one-by-one. >- BC: This is not just the timing >issue. There is also a tone issue. This is about >optional guidance; it is not about imposing >requirements. In the ICANN model, when the >status quo is favored, you have the option to be >magnanimous when opposing change. BC has been on >both sides; however, BC has never brutally >disparaged other interests, but that is happening in this group. >- RrSG: Interesting to hear ALAC and BC >raise similar concerns as the RrSG. RrSGâs >concerns that have been repeatedly raised are >hidden in footnotes. Itâs important to ensure arguments have equal time. >- GAC: Believe the group is closer than >we think confident that we can geet to >âyesâ with everyone being equally unhappy. >When GAC reviewed additions from the RySG and >saw what was a neutral but barebones >description, GAC thought it needed to include >the same so that there is a balance. It is fair >for everyone to be mindful of wanting to achieve >a balanced and objective view in the report as >to the state of play and clear indications of >where we disagree for the purpose of soliciting >public comments. If some groups put in text that >tilt the scales, they should expect the other >side to respond. Itâs fair to ask everyone to >forbear but not reasonable to expect groups to >not put their perspective down. It may be >helpful for groups to mutually disarm. We may >need another week to review the changes that Staff has made. >- Beyond a week extension, we would >need to go back to the Council for a project change request. >- NCSG: Think we should modulate our >expectations for this report. Even though we are >arguing about fine points. It is fair in an >initial report we worked on this for [xx] >months, there are still firmly-held positions. >One side says this, and the other side says >this, so that itâs clear to the reader what >the two positions are. We should not pretend we >have consensus when we donât. >- ALAC: in taking a look at the >contentious parts of the report the >introduction is very contentious. With respect >to the actual substance and concrete >recommendations of the report, the group is closer to consensus. >- IPC: More time may be needed to >digest the changes. It would be helpful to have >the line numbers updated for the new version. >- ISPCP: Pleased to review Keithâs >email did not put any canât live with items >in this table. There seems to have been a lot of >time devoted to items that are not in scope. >What we may be seeing here is a process where >items that are out of scope are not included in >this report and a process of mourning. We need >more time for reflection on the scope. Based on >these conversations, it seems that we may be closer than we thought. >- SSAC: Concerned with getting the >group back on track and working toward consensus. >- RySG: RySG has made interventions re: >scope. This group has a specific task to go by. >EPDP has become a work horse where groups >continually bring things to the table. There are >a lot of eyes on the MSM; itâs important to >follow the process and stay in scope. If we do >not agree with the guidance or agree that it >will be helpful to CPs, then it is not good >guidance. Itâs important to point out in FN13 >that three of the members of this team believe >that this should be mandatory. There has been a mixed message. >- Thank you to all for the frank >conversation. There is a general view that we >are closer than it appears. There is a >recognition that we can do some work over the >next week and that we need to clearly resolve >some of the cannot live with designations. We >need everyone to go back to the cannot live with >designations. These are significant and mean >something when staff and leadership does its >analysis to try to resolve issues. The way >forward: all groups to review the responses to >the cannot live with items, review Keithâs >email from yesterday, and the latest version of >the Initial Report with the redlines. What needs >to be added in terms of questions to ensure we >get meaningful input in the public comment forum. > >b. Confirm next steps > > > >4. Consider items flagged >for further discussion and resolution (see list of blue items): > >a. Should standardized data element >recommendation include reference to >extensibility? Is this a necessary missing >element or can this also be considered after public comment? >- This is a field meant to talk about >registrant type. There may be value in not >unduly restricting this field if we want to expand this field in the future. >- Registries do not support this as a >field in the public RDDS, but do support this >being a standardized data element for registrars >who choose to differentiate. Concerned with the >fields we have standardized own this seems to >contradict the Teamââs own advice that >legal/natural distinction is not dispositive for >whether the registration contains personal data >or not. Concerned that legal/natural/unknown are >not the right fields. For that reason, wise of >SSAC to suggest some flexibility here. >- This is in the RDDS period a >qquestion later on is if this should be public. >The Initial Report asks a question about whether >this should be sent to the SSAD. Thought >âunknownâ was changed to âunspecifiedâ >since unknown is unclear as to who doesnât know it. >- Seems that RySG is saying the data >element should be extensible, could be for >example, legal but contains personal data. That >statement does not contradict the statement from >SSAC. Agree that âunknownâ is not as good as âunspecifiedâ. >- RySG to include a question for public >comment re: this field. The question is around >the fields to be standardized, and we need to >come to agreement on a question to pose that can >help inform the discussion on this. If the text >doesnât have the right fields, we need input >on how to get input on what the right fields are. >- ALAC is adamant that the field should >be added to RDDS, not necessarily the public >RDDS. If there are too many values, the field may not have as much utility. >- If there are not the right fields, >what could they be, what should they be? >- This is a question of sorting. This >is an initial sorting of legal, natural, or >unspecified. The question of whether personal >data is present, is a separate analytical issue. >This concern is already reflected in the guidance. >- The distinction b/w legal and natural >is not relevant for all data protection law. The >whole idea of managing personal information by >asking about legal v. natural misses the point. > >b. Footnote 5 GAC to confirm whether this >footnote must remain as it is a cannot live with >item for the IPC. Footnote was originally added at the request of the GAC. > >c. LvN Background Information D. GDPR >Principlles that may apply. RrSG Team has >indicated that this is important guidance to >Registrars, others (IPC, GAC, ALAC, GAC) have >indicated concerns with this language. GAC & >RrSG were assigned action item to come up with a mutually acceptable approach. >- GAC has no opposition to referencing >principles; however, uncomfortable with >paraphrasing the GDPR and picking certain principles over others. >- Not in favor of striking section D >itâs important to conveyy the GDPR principles. >This is a way to incorporate the guidance >registrars have been trying to provide all along. > >d. New recommendation (submitted after the deadline) re. LvN Guidance >- The guidance does not include the key >advice if the legal registration does not >include personal information, it should be >published. The âmoney issueâ is omitted >itâs only includeed in the scenarios, which is >not guidance. This issue has been raised all >along this is a real, true cannot live with item. >- Support previous comment we have >guidannce, which is not mandatory, saying if you >choose to differentiate, this is how to do it, >but we donât have the result of it. In other >words, every registrar could differentiate, but >there is still nothing published. The registry >comment is talking about publishing the type, >and this is not what the sentence is saying. >This is about publishing the actual data, not the flag. >- This is something that registrars can decide to do field by field. >- Question is to the registries this >feedback is based on a differennt topic than >what the text was. This appears to relate to the >publication of the legal/natural flag. >- Can agree to a should but not a must >- Do not agree with the two-levels of >permissiveness itâs already guidance why >does it at also need to say should? > >e. New recommendation (submitted after the deadline) re. web forms >- The target of a PDP should not be >âwe followed the rulesâ; the target should >be good policy. If we are not going to recommend >pseudonymized emails, there is an impact of that >decision, and that is why the web form recommendation is suggested. > >f. New recommendation (submitted after the deadline) re. feasibility >- This is not a new concept; this is >the crux of these discussions so that it can be >identified for public comment. With the >registrarâs suggested text, hoping to get to âyesâ. >- Is this new language being proposed as guidance? >- Answer: yes. > >g. Confirm next steps >- Provide an opportunity or a path for >including the bracketed language unless there is strong disagreement. >- If there is general agreement that >this text can be included after additional >wordsmithing; however, if there is significant >disagreement, may have to set them aside. >- Over the next 24-36 hours, please >spend time on these outstanding items to get >this across the finish line. Plan to schedule meetings on Tuesday and Thursday > > >5. Public Comment Forum > >a. EPDP Team to provide suggestions for how >to best solicit input from the community and >avoid restatements of already known positions and/or information. > >b. Confirm next steps > > >6. Homework assignments reminder > > >Â· By Friday 28 May at 16.00 UTC, EPDP >Team to review latest version of the Initial >Report and submit any minor edits / non-substantive comments. > > >7. Wrap and confirm next EPDP Team meeting (5 minutes): >a. EPDP Team Meeting #26 Tuesday 1 June at 14.00 UTC (if necessary) >b. Confirm action items >c. Confirm questions for ICANN Org, if any > > > > >_______________________________________________ >Gnso-epdp-team mailing list >Gnso-epdp-team(a)icann.org >https://mm.icann.org/mailman/listinfo/gnso-epdp-team >_______________________________________________ >By submitting your personal data, you consent to >the processing of your personal data for >purposes of subscribing to this mailing list >accordance with the ICANN Privacy Policy >(https://www.icann.org/privacy/policy) and the >website Terms of Service >(https://www.icann.org/privacy/tos). You can >visit the Mailman link above to change your >membership status or configuration, including >unsubscribing, setting digest-style delivery or >disabling delivery altogether (e.g., for a vacation), and so on.

1 0

Re: [Gnso-epdp-team] Notes and action items - EPDP Phase 2a Meeting #25 - 27 May 2021
by Crossman, Matthew 28 May '21

28 May '21

All, The RySG appreciates the Chair’s clarification that the Initial Report is intended to share progress and solicit input, and is not a representation of consensus on the proposed outputs. We also recognize the importance of timely completion of this initial stage of our work. With that in mind, if the team can agree on the following constructive suggestions to ensure that the report appropriately describes the state of the issues and facilitates community input on areas where there remains significant divergence, the RySG is willing to withdraw our “cannot live with” items as blockers for publication of the Initial Report. * In general, the report should be restructured with the aim of soliciting community input rather than reporting specific outcomes. For example, each section should describe the issue/question presented, provide a description of the team’s views and areas of disagreement, and then clearly present questions to the community where we require additional input. * Where the Initial Report includes specific recommendations, the text should clearly note that there is significant disagreement on each recommendation and that the team is soliciting community input to assist in resolving those disagreements. For clarity in obtaining feedback, we also suggest that the response to the charter questions from the GNSO (i.e., no changes to the status quo from Phase I) should become a standalone Recommendation #1. * We propose the following questions for each of the recommendations (existing questions in the Initial Report can be incorporated into this list): * New Rec 1 (answer to charter question): * Is there new information or inputs that the Phase 2A team has not considered in assessing whether to make changes to the recommendation that Registrars and Registry Operators may, but are not obligated to, differentiate between legal and natural persons? * New Rec 2 (GNSO Council monitoring): * Is this recommendation necessary for the GNSO council in considering future policy work in this area? If yes, in what ways does this monitoring assist the Council? * New Rec 3 (Standardized flag): * Should the working group provide guidance to registries and registrars who choose to differentiate between legal and natural person registrations as to how they make that distinction in their systems? * If yes, what field or fields should be used and what possible values should be included in the guidance? * New Rec 4 (Differentiation guidance) * Does the guidance as written provide sufficient information and resources to Registrars and Registry Operators who wish to differentiate? * Are there additional elements that should be included? * How useful is the legal guidance (substance and format) in assisting Registrars and Registry Operators in differentiating? * As part of ensuring that we receive informed feedback from the community, out of context excerpts from the legal memos must be removed from the main body of the report. As we have noted, the legal memos are cumulative and rely on significant assumptions and analysis to reach a conclusion on risk. The full legal memos should be appended to the report to give the reader the full scope of the legal advice on differentiation, verification, mitigation, and the relevant risks. To be clear, we continue to stand by the concerns and issues we have flagged. If not appropriately resolved, these concerns may prevent us from providing consensus support on the final recommendations. However, we intend our suggestions above as a constructive proposal to ensure that the Initial Report is published as a tool to assist in gathering additional feedback that may aid in the resolution of existing areas of divergence. Look forward to discussing further. Thanks, Matt, Alan, Marc From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> On Behalf Of Caitlin Tubergen via Gnso-epdp-team Sent: Thursday, May 27, 2021 11:31 AM To: gnso-epdp-team(a)icann.org Subject: [EXTERNAL] [Gnso-epdp-team] Notes and action items - EPDP Phase 2a Meeting #25 - 27 May 2021 CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe. Dear EPDP Team, Please find below the notes and action items from today’s call. Best regards, Berry, Marika, and Caitlin 💥 📣 🛎 🚨 Action Items<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> 🚨 🛎 📣 💥 1. EPDP Team members are to review the input form with the proposed resolution of cannot live with items<https://mm.icann.org/pipermail/gnso-epdp-team/attachments/20210526/923483e1…>, Keith’s email (https://mm.icann.org/pipermail/gnso-epdp-team/2021-May/003937.html) the updated section 3 of the Initial Report (https://drive.google.com/drive/u/0/folders/1TW3Z-s6DzS2QsV_VwJ6iUQTvKVIXQrmG) and indicate what changes/updates are essential FOR THE PURPOSE OF THE PUBLICATION OF THE INITIAL REPORT in this table<https://docs.google.com/document/d/1aaDULVrGIkWXEGfoal8RqkC_baNjmVvujgk1HIy…> BY CLOSE OF BUSINESS, FRIDAY 28 MAY. As such, you are encouraged to focus your input on any clarifying edits and/or questions that should be added to encourage community input. Input table: https://docs.google.com/document/d/1aaDULVrGIkWXEGfoal8RqkC_baNjmVvujgk1HIy…. 2. Deadline for flagging any minor edits / corrections by 16:00 UTC on Friday, 28 May. (https://docs.google.com/document/d/1aaDULVrGIkWXEGfoal8RqkC_baNjmVvujgk1HIy…) 3. RrSG and GAC to come forward with proposal for updated Guidance D to factor in concerns addressed (References to “controller” are not helpful as ICANN has recently avoided ‘admitting’ its controllership. Each CP must determine for itself if/how data protection law might impact its processing. This appears to be quasi-legal advice, which should be avoided. We should also avoid paraphrasing the GDPR) by Friday, 28 May. 4. IPC and GAC reps to come forward with a proposal for footnote 8, “8 The personal/non-personal distinction only applies/is relevant for registrants who have self-identified as legal persons” by Friday, 28 May. 5. RySG to come forward with a proposed question to put forward to the community in relation to the standardized data element to obtain further input on whether changes should be considered to the terminology used or the type of data element proposed by Friday, 28 May. 27. 6. GAC to liaise with RySG to address the concerns of the RySG regarding the GAC-proposed feasibility recommendation. (Note: GAC has suggested the RrSG proposed suggestion could be a viable alternative.) 7. Groups who support including a recommendation on webforms to formulate specific questions for community input factoring in the concerns of other groups that have been expressed on the mailing list. EPDP Phase 2A - Meeting #25 Proposed Agenda Thursday 27 May 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. “Cannot live with” items take-aways - 77 items were addressed as cannot live with, which is very concerning - Each group will be asked to speak for 1-2 minutes about a proposed path forward for the group. - Your group can discuss a path forward in a general sense or discuss specific items - Cannot live with items are typically used to indicate fundamental disagreement for a Final Report. This group is not there yet. We are developing proposed text and questions to seek public comment on. - Struggling with the number of cannot live with items at this stage of the process b. Approach & expected next steps for Initial Report publication 3. Consider any remaining “cannot live with” items identified by EPDP Team members after review of Initial Report input form with proposed solution and redline version of updated Initial Report a. Consider items submitted prior to the meeting - RrSG: Members have approached this group and work with unrealistic expectations regarding changes that are beyond the scope of this group’s work and are unhappy that they cannot achieve what they want. - ALAC: part of the issue is timing. To some extent, maybe if we had more time to talk, digest, and consider these documents, there would have been more time to consult with our constituencies. Many concerns were resolved with the staff issues, but the other issues need to be resolved one-by-one. - BC: This is not just the timing issue. There is also a tone issue. This is about optional guidance; it is not about imposing requirements. In the ICANN model, when the status quo is favored, you have the option to be magnanimous when opposing change. BC has been on both sides; however, BC has never brutally disparaged other interests, but that is happening in this group. - RrSG: Interesting to hear ALAC and BC raise similar concerns as the RrSG. RrSG’s concerns that have been repeatedly raised are hidden in footnotes. It’s important to ensure arguments have equal time. - GAC: Believe the group is closer than we think – confident that we can get to “yes” with everyone being equally unhappy. When GAC reviewed additions from the RySG and saw what was a neutral but barebones description, GAC thought it needed to include the same so that there is a balance. It is fair for everyone to be mindful of wanting to achieve a balanced and objective view in the report as to the state of play and clear indications of where we disagree for the purpose of soliciting public comments. If some groups put in text that tilt the scales, they should expect the other side to respond. It’s fair to ask everyone to forbear but not reasonable to expect groups to not put their perspective down. It may be helpful for groups to mutually disarm. We may need another week to review the changes that Staff has made. - Beyond a week extension, we would need to go back to the Council for a project change request. - NCSG: Think we should modulate our expectations for this report. Even though we are arguing about fine points. It is fair in an initial report – we worked on this for [x] months, there are still firmly-held positions. One side says this, and the other side says this, so that it’s clear to the reader what the two positions are. We should not pretend we have consensus when we don’t. - ALAC: in taking a look at the contentious parts of the report – the introduction is very contentious. With respect to the actual substance and concrete recommendations of the report, the group is closer to consensus. - IPC: More time may be needed to digest the changes. It would be helpful to have the line numbers updated for the new version. - ISPCP: Pleased to review Keith’s email – did not put any can’t live with items in this table. There seems to have been a lot of time devoted to items that are not in scope. What we may be seeing here is a process where items that are out of scope are not included in this report and a process of mourning. We need more time for reflection on the scope. Based on these conversations, it seems that we may be closer than we thought. - SSAC: Concerned with getting the group back on track and working toward consensus. - RySG: RySG has made interventions re: scope. This group has a specific task to go by. EPDP has become a work horse where groups continually bring things to the table. There are a lot of eyes on the MSM; it’s important to follow the process and stay in scope. If we do not agree with the guidance or agree that it will be helpful to CPs, then it is not good guidance. It’s important to point out in FN13 that three of the members of this team believe that this should be mandatory. There has been a mixed message. - Thank you to all for the frank conversation. There is a general view that we are closer than it appears. There is a recognition that we can do some work over the next week and that we need to clearly resolve some of the cannot live with designations. We need everyone to go back to the cannot live with designations. These are significant and mean something when staff and leadership does its analysis to try to resolve issues. The way forward: all groups to review the responses to the cannot live with items, review Keith’s email from yesterday, and the latest version of the Initial Report with the redlines. What needs to be added in terms of questions to ensure we get meaningful input in the public comment forum. b. Confirm next steps 4. Consider items flagged for further discussion and resolution (see list of blue items): a. Should standardized data element recommendation include reference to extensibility? Is this a necessary missing element or can this also be considered after public comment? - This is a field meant to talk about registrant type. There may be value in not unduly restricting this field if we want to expand this field in the future. - Registries do not support this as a field in the public RDDS, but do support this being a standardized data element for registrars who choose to differentiate. Concerned with the fields we have standardized own – this seems to contradict the Team’s own advice that legal/natural distinction is not dispositive for whether the registration contains personal data or not. Concerned that legal/natural/unknown are not the right fields. For that reason, wise of SSAC to suggest some flexibility here. - This is in the RDDS period – a question later on is if this should be public. The Initial Report asks a question about whether this should be sent to the SSAD. Thought “unknown” was changed to “unspecified” since unknown is unclear as to who doesn’t know it. - Seems that RySG is saying the data element should be extensible, could be for example, legal but contains personal data. That statement does not contradict the statement from SSAC. Agree that “unknown” is not as good as “unspecified”. - RySG to include a question for public comment re: this field. The question is around the fields to be standardized, and we need to come to agreement on a question to pose that can help inform the discussion on this. If the text doesn’t have the right fields, we need input on how to get input on what the right fields are. - ALAC is adamant that the field should be added to RDDS, not necessarily the public RDDS. If there are too many values, the field may not have as much utility. - If there are not the right fields, what could they be, what should they be? - This is a question of sorting. This is an initial sorting of legal, natural, or unspecified. The question of whether personal data is present, is a separate analytical issue. This concern is already reflected in the guidance. - The distinction b/w legal and natural is not relevant for all data protection law. The whole idea of managing personal information by asking about legal v. natural misses the point. b. Footnote 5 – GAC to confirm whether this footnote must remain as it is a cannot live with item for the IPC. Footnote was originally added at the request of the GAC. c. LvN Background Information D. – GDPR Principles that may apply. RrSG Team has indicated that this is important guidance to Registrars, others (IPC, GAC, ALAC, GAC) have indicated concerns with this language. GAC & RrSG were assigned action item to come up with a mutually acceptable approach. - GAC has no opposition to referencing principles; however, uncomfortable with paraphrasing the GDPR and picking certain principles over others. - Not in favor of striking section D – it’s important to convey the GDPR principles. This is a way to incorporate the guidance registrars have been trying to provide all along. d. New recommendation (submitted after the deadline) re. LvN Guidance - The guidance does not include the key advice – if the legal registration does not include personal information, it should be published. The “money issue” is omitted – it’s only included in the scenarios, which is not guidance. This issue has been raised all along – this is a real, true cannot live with item. - Support previous comment – we have guidance, which is not mandatory, saying if you choose to differentiate, this is how to do it, but we don’t have the result of it. In other words, every registrar could differentiate, but there is still nothing published. The registry comment is talking about publishing the type, and this is not what the sentence is saying. This is about publishing the actual data, not the flag. - This is something that registrars can decide to do field by field. - Question is to the registries – this feedback is based on a different topic than what the text was. This appears to relate to the publication of the legal/natural flag. - Can agree to a should but not a must - Do not agree with the two-levels of permissiveness – it’s already guidance – why does it also need to say should? e. New recommendation (submitted after the deadline) re. web forms - The target of a PDP should not be “we followed the rules”; the target should be good policy. If we are not going to recommend pseudonymized emails, there is an impact of that decision, and that is why the web form recommendation is suggested. f. New recommendation (submitted after the deadline) re. feasibility - This is not a new concept; this is the crux of these discussions so that it can be identified for public comment. With the registrar’s suggested text, hoping to get to “yes”. - Is this new language being proposed as guidance? - Answer: yes. g. Confirm next steps - Provide an opportunity or a path for including the bracketed language unless there is strong disagreement. - If there is general agreement that this text can be included after additional wordsmithing; however, if there is significant disagreement, may have to set them aside. - Over the next 24-36 hours, please spend time on these outstanding items to get this across the finish line. Plan to schedule meetings on Tuesday and Thursday 5. Public Comment Forum a. EPDP Team to provide suggestions for how to best solicit input from the community and avoid restatements of already known positions and/or information. b. Confirm next steps 6. Homework assignments reminder · By Friday 28 May at 16.00 UTC, EPDP Team to review latest version of the Initial Report and submit any minor edits / non-substantive comments. 7. Wrap and confirm next EPDP Team meeting (5 minutes): a. EPDP Team Meeting #26 Tuesday 1 June at 14.00 UTC (if necessary) b. Confirm action items c. Confirm questions for ICANN Org, if any

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2A | Thursday, 27 May 2021 at 14:00 UTC
by Terri Agnew 27 May '21

27 May '21

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2A call held on Thursday, 27 May 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/6oSUCQ> (attendance included) and the GNSO Master calendar [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…>. These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a panelist, observers can join as an attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Tuesday, 01 June 2021 at 14:00 UTC
by Terri Agnew 27 May '21

27 May '21

Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Tuesday, 01 June 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 Passcode: Z@S07?t=v5 Observers are able to join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/UwzQCQ Check your time zone: https://tinyurl.com/tfzw59ej The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

FW: MIssing Cant live with
by Kapin, Laureen 27 May '21

27 May '21

Resending Chris's message to full team. Laureen Kapin Acting Assistant Director Division of Consumer Response and Operations Bureau of Consumer Protection Federal Trade Commission From: LEWIS-EVANS, Christopher <Christopher.Lewis-Evans(a)nca.gov.uk> Sent: Thursday, May 27, 2021 9:58 AM To: gnso-secs(a)icann.org Cc: Kapin, Laureen <LKAPIN(a)ftc.gov> Subject: MIssing Cant live with OFFICIAL Afternoon / morning Just going through the documents and have notice that the addition of Rec#14 as a relevant recommendation is missing from the Doc I don't see this as being contentious so wonder if you could add it to the list please. Many Thanks Chris This information is supplied in confidence by the NCA. The NCA is not listed as a Public Authority under the Freedom of Information Act 2000. Any information supplied by, or relating to, the NCA is also subject to an absolute exemption. It may also be subject to exemption under other UK legislation. Onward disclosure may be unlawful, for example, under data protection legislation. Requests for disclosure to the public must be referred to the NCA FOI single point of contact, by email on StatutoryDisclosureTeam(a)nca.gov.uk<mailto:StatutoryDisclosureTeam@nca.gov.uk>. All email sent and received by the NCA is scanned and subject to assessment. Messages sent or received by NCA staff are not private and may be the subject of lawful business monitoring. Email may be passed at any time and without notice to an appropriate branch within the NCA, on authority from the Director General or their Deputy for analysis. This email and any files transmitted with it are intended solely for the individual or entity to whom they are addressed. If you have received this message in error, please contact the sender as soon as possible.

1 0

IMPORTANT: Chair Update and Documents for Thursday's EPDP 2A Plenary
by Drazek, Keith 26 May '21

26 May '21

Hi EPDP 2A Team, Thanks to all who contributed input to the draft Initial Report. Unfortunately, the input received (and now reviewed by the leadership team and staff) indicates we are very far apart and may not be able to reach consensus on publishing an initial report for public comment if groups are not willing to rethink the “cannot live with” items identified . Please read this message very carefully and come prepared to discuss during tomorrow’s plenary. Some Chair observations: 1. “Can’t Live With” designations: By our count, there are now 77 (yes, seventy-seven) items assigned “can’t live with” by a range of groups. This is really troubling after five months of work. First, we are not conducting a consensus call on a Final Report, where we typically use “can’t live with” to indicate areas of fundamental disagreement that would put final consensus assessments at risk, or where a minority statement might be needed. Instead, in this case, at this time, we are working to publish an Initial Report to seek public comment and feedback from the community. I’m really struggling to understand how there can be so many “can’t live withs” for an Initial Report, when we could instead turn challenging text into a question for community feedback. ACTION: All groups need to review their “can’t live with” designations and reconsider or recraft if possible. Note that in the attached table the Staff Support Team has gone through each and has made a number of updates to the Initial Report which hopefully address some of the “cannot live with” items, but there are over 40 items for which no changes have been applied. If we can’t bridge these gaps, I don’t see an obvious path forward for this group. Ahead of tomorrow’s meeting, please share with the list which items remain of a “cannot live with” nature, after having reviewed and taken to heart this message (please use numbering in the attached table to indicate the specific item(s)). 2. Repeating/Relitigating: We continue to see input that re-states previous well-known and long-discussed positions, or re-surfaces issues that were previously addressed. We are at a stage where all groups need to propose compromise text OR questions that will generate public comment feedback to help inform the group’s future deliberations and development of a Final Report. ACTION: All groups need to review their input to ensure we’re working to bridge gaps and refrain from reiterating the same points again and again. 3. Completely new ideas / concepts: There are also a couple of instances where completely new ideas are put forward that have never been raised or discussed previously. How are these “cannot live with” items if these were never brought up previously? There is no limitation in submitting new ideas / concepts to the public comment forum so that due consideration can be given to these by the group, but now doesn’t seem to be the moment to flag these as “cannot live with” (or without). Similarly, “cannot live with” concerns have been raised in relation to text that has been stable for a while, or where there have not been any concerns flagged previously. 4. Next Steps? I’m very concerned we’re on a path towards suspending or terminating the work of this EPDP 2A effort. If we can’t come together on an Initial Report for public comment, we will be challenged to reach any future agreement, even on guidance. I think that’s a terrible shame and I hope that everyone can take a (short) breath and look for opportunities to bring this Initial Report together so we can keep moving forward to a meaningful public comment period. 5. Timing: We are still working toward a publication date of June 1, in recognition that Monday, May 31 is a holiday observed by ICANN Org. If I thought we were getting close and needed an extra few days, I’d be willing and able to push the publication date, but with 77 “can’t live with” designations after five months of work, I don’t see how I can make the case to the GNSO Council that more time (weeks or a month) via a Project Change Request (PCR) would help the group bridge these gaps. We were given 3 months to report to Council and we’re now at 5 months for an Initial Report, as planned and communicated. 6. ACTION FOR ALL: Please review the attached documents, including the Thursday plenary agenda and the “blue items” for discussion. The updated Initial Report document also has some proposed language to try to resolve some of the issues flagged in your input. We still have an opportunity to publish an Initial Report, but it’s time for compromise so we can seek community input. attached: * Proposed Agenda for Thursday’s meeting * Updated version of Initial Report incorporating in redline edits that have been made to address cannot live with items * Initial Report Input Form with the proposed resolution for each item * Blue list of items for discussion during tomorrow’s meeting (these items have been pulled out from the Initial Report Input Form list) Thanks to you all. Best, Keith

1 0

**REMINDER**Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 27 May 2021 at 14:00 UTC
by Julie Bisland 26 May '21

26 May '21

Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 27 May 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Observers are able to join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/6oSUCQ Check your time zone: https://tinyurl.com/bjpc6b8w [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/bjpc6b8w__;!!PtGJab4!orLnO9p…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Andrea

1 0