- Gnso-epdp-team - lists.icann.org

Approved questions from Legal Committee - Batch 1
by Caitlin Tubergen Aug. 29, 2019

Aug. 29, 2019

Dear EPDP Team, On behalf of the Phase 2 EPDP Legal Committee, please find the first set of legal questions the Legal Committee has agreed to send to outside counsel. As a reminder, the below text has been reviewed, edited, and agreed to by a representative group of EPDP Team Members, and, as such, EPDP Leadership would ask the EPDP Team to apply the “cannot live with” standard it its review of the below questions. Thank you. Best regards, Marika, Berry, and Caitlin Questions to Outside Counsel: Batch 1 Consider a System for Standardized Access/Disclosure where: contracted parties “CPs” are contractually required by ICANN to disclose registration data including personal data, data must be disclosed over RDAP to requestors either directly or through an intermediary request accreditation/authorization body, the accreditation is carried out by third party commissioned by ICANN without CP involvement, disclosure takes place in an automated fashion without any manual intervention, data subjects are being duly informed according to ICANN’s contractual requirements of the purposes for which, and types of entities by which, personal data may be processed. CP’s contract with ICANN also requires CP to notify data subject about this potential disclosure and third-party processing before the data subject enters into the registration agreement with the CP, and again annually via the ICANN-required registration data accuracy reminder. CP has done so. Further, assume the following safeguards are in place ICANN or its designee has validated/verified the requestor’s identity, and required in each instance that the requestor: · represents that it has a lawful basis for requesting and processing the data,  · provides its lawful basis, · represents that it is requesting only the data necessary for its purpose,  · agrees to process the data in accordance with GDPR, and  · agrees to EU standard contractual clauses for the data transfer.    ICANN or its designee logs requests for non-public registration data, regularly audits these logs, takes compliance action against suspected abuse, and makes these logs available upon request by the data subject. 1. What risk or liability, if any, would the CP face for the processing activity of disclosure in this context, including the risk of a third party abusing or circumventing the safeguards? 2. Would you deem the criteria and safeguards outlined above sufficient to make disclosure of registration data compliant? If any risk exists, what improved or additional safeguards would eliminate1 this risk? 3. In this scenario, would the CP be a controller or a processor2, and to what extent, if at all, is the CP’s liability impacted by this controller/processor distinction? 4. Only answer if a risk still exists for the CP: If a risk still exists for the CP, what additional safeguards might be required to eliminate CP liability depending on the nature of the disclosure request, i.e. depending on whether data is requested e.g. by private actors pursuing civil claims or law enforcement authorities depending on their jurisdiction or the nature of the crime (misdemeanor or felony) or the associated sanctions (fine, imprisonment or capital punishment)? Footnote 1: “Here it is important to highlight the special role that safeguards may play in reducing the undue impact on the data subjects, and thereby changing the balance of rights and interests to the extent that the data controller’s legitimate interests will not be overridden.“ (https://iapp.org/media/pdf/resource_center/wp217_legitimate-interests_04-20… [iapp.org] Footnote 2: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-busine… [ec.europa.eu] To what extent, if any, are contracted parties liable when a third party that accesses non-public WHOIS data under an accreditation scheme where by the accessor is accredited for the stated purpose, commits to certain reasonable safeguards similar to a code of conduct regarding use of the data, but misrepresents their intended purposes for processing such data, and subsequently processes it in a manner inconsistent with the stated purpose. Under such circumstances, if there is possibility of liability to contracted parties, are there steps that can be taken to mitigate or reduce the risk of liability to the contracted parties? (Formerly Q9) Assuming that there is a policy that allows accredited parties to access non-public WHOIS data through an SSAD (and requires the accredited party to commit to certain reasonable safeguards similar to a code of conduct), is it legally permissible under Article 6(1)(f) to: · define specific categories of requests from accredited parties (e.g. rapid response to a malware attack or contacting a non-responsive IP infringer), for which there can be automated submissions for non-public WHOIS data, without having to manually verify the qualifications of the accredited parties for each individual disclosure request, and/or · enable automated disclosures of such data, without requiring a manual review by the controller or processor of each individual disclosure request. In addition, if it is not possible to automate any of these steps, please provide any guidance for how to perform the balancing test under Article 6(1)(f). For reference, please refer to the following potential safeguards: · Disclosure is required under CP’s contract with ICANN (resulting from Phase 2 EPDP policy). · CP’s contract with ICANN requires CP to notify the data subject of the purposes for which, and types of entities by which, personal data may be processed. CP is required to notify data subject of this with the opportunity to opt out before the data subject enters into the registration agreement with the CP, and again annually via the ICANN-required registration data accuracy reminder. CP has done so. · ICANN or its designee has validated the requestor’s identity, and required that the requestor: o represents that it has a lawful basis for requesting and processing the data, o provides its lawful basis, o represents that it is requesting only the data necessary for its purpose, o agrees to process the data in accordance with GDPR, and o agrees to standard contractual clauses for the data transfer. · ICANN or its designee logs requests for non-public registration data, regularly audits these logs, takes compliance action against suspected abuse, and makes these logs available upon request by the data subject. Under the GDPR, a data controller can disclose personal data to law enforcement of competent authority under Art. 6 1 c GDPR provided the law enforcement authority has the legal authority to create a legal obligation under applicable law. Certain commentators have interpreted “legal obligation” to apply only to legal obligations grounded in EU or Member State law. As to the data controller: a. Consequently, does it follow that the data controller may not rely on Art. 6 1 c GDPR to disclose personal data to law enforcement authorities outside the data controller’s jurisdiction? Alternatively, are there any circumstances in which data controllers could rely on Art. 6 1 c GDPR to disclose personal data to law enforcement authorities outside the data controller’s jurisdiction? b. May the data controller rely on any other legal bases, besides Art. 6 I f GDPR, to disclose personal data to law enforcement authorities outside the data controller’s jurisdiction? As to the law enforcement authority: Given that Art. 6 1 GDPR states that European public authorities cannot use Art. 6 I f GDPR as a legal basis for processing carried out in the performance of their tasks, these public authorities need to have a legal basis so that disclosure can take place based on another legal basis (e.g. Art. 6 I c GDPR). c. In the light of this, is it possible for non-EU-based law enforcement authorities to rely on Art. 6 I f GDPR as a legal basis for their processing? In this context, can the data controller rely on Art. 6 1 f GDPR to disclose the personal data? If non-EU-based law enforcement authorities cannot rely on Art. 6 1 f GDPR as a legal basis for their processing, on what lawful basis can non-EU-based law enforcement rely?

2 1

**REMINDER** Meeting Invitation: Observers GNSO Temp Spec gTLD RD EPDP - Phase 2 call | Thursday, 29 August 2019 at 14:00 UTC
by Julie Bisland Aug. 28, 2019

Aug. 28, 2019

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 29 August 2019 at 14:00 UTC for 120 minutes. (calls will be scheduled for 120 minutes but aim to keep to 90 minutes) 07:00 PDT, 10:00 EDT, 16:00 Paris CEST, 19:00 Karachi PKT, 23:00 Tokyo JST, (Friday) 00:00 Melbourne AEST For other times: https://tinyurl.com/y4eevh45 [tinyurl.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__tinyurl.com_y4eevh45&d…> Agenda Wiki: https://community.icann.org/x/pKajBg The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream02 <https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream02.m3u <https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> If needed, an option to join via telephone has been added for this meeting. Passcode: EPDP Dial in numbers: Country Toll Numbers Freephone/ Toll Free Number ARGENTINA 0800-777-0519 AUSTRALIA ADELAIDE: 61-8-8121-4842 1-800-657-260 AUSTRALIA BRISBANE: 61-7-3102-0944 1-800-657-260 AUSTRALIA CANBERRA: 61-2-6100-1944 1-800-657-260 AUSTRALIA MELBOURNE: 61-3-9010-7713 1-800-657-260 AUSTRALIA PERTH: 61-8-9467-5223 1-800-657-260 AUSTRALIA SYDNEY: 61-2-8205-8129 1-800-657-260 AUSTRIA 43-1-92-81-113 0800-005-259 BELGIUM 32-2-400-9861 0800-3-8795 BRAZIL RIO DE JANEIRO: 55-21-40421490 0800-7610651 BRAZIL SAO PAULO: 55-11-3958-0779 0800-7610651 CHILE 1230-020-2863 CHINA CHINA A: 86-400-810-4789 10800-712-1670 CHINA CHINA B: 86-400-810-4789 10800-120-1670 COLOMBIA 01800-9-156474 CROATIA 080-08-06-309 CZECH REPUBLIC 420-2-25-98-56-64 800-700-177 DENMARK 45-7014-0284 8088-8324 ESTONIA 800-011-1093 FINLAND 358-9-5424-7162 0-800-9-14610 FRANCE LYON: 33-4-26-69-12-85 080-511-1496 FRANCE MARSEILLE: 33-4-86-06-00-85 080-511-1496 FRANCE PARIS: 33-1-70-70-60-72 080-511-1496 GERMANY 49-69-2222-20362 0800-664-4247 GREECE 30-80-1-100-0687 00800-12-7312 HONG KONG 852-3001-3863 800-962-856 HUNGARY 36-1-700-8856 06-800-12755 INDIA INDIA A: 000-800-852-1268 INDIA INDIA B: 000-800-001-6305 INDIA INDIA C: 1800-300-00491 INDONESIA 001-803-011-3982 IRELAND 353-1-246-7646 1800-992-368 ISRAEL 1-80-9216162 ITALY MILAN: 39-02-3600-6007 800-986-383 ITALY ROME: 39-06-8751-6018 800-986-383 ITALY TORINO: 39-011-510-0118 800-986-383 JAPAN OSAKA: 81-6-7878-2631 0066-33-132439 JAPAN TOKYO: 81-3-6868-2631 0066-33-132439 LATVIA 8000-3185 LUXEMBOURG 352-27-000-1364 8002-9246 MALAYSIA 1-800-81-3065 MEXICO GUADALAJARA (JAL): 52-33-3208-7310 001-866-376-9696 MEXICO MEXICO CITY: 52-55-5062-9110 001-866-376-9696 MEXICO MONTERREY: 52-81-2482-0610 001-866-376-9696 NETHERLANDS 31-20-718-8588 0800-023-4378 NEW ZEALAND 64-9-970-4771 0800-447-722 NORWAY 47-21-590-062 800-15157 PANAMA 011-001-800-5072065 PERU 0800-53713 PHILIPPINES 63-2-858-3716 1800-111-42453 POLAND 00-800-1212572 PORTUGAL 8008-14052 ROMANIA 40-31-630-01-79 RUSSIA 8-10-8002-0144011 SAUDI ARABIA 800-8-110087 SINGAPORE 65-6883-9230 800-120-4663 SLOVAK REPUBLIC 421-2-322-422-25 0800-002066 SOUTH AFRICA 080-09-80414 SOUTH KOREA 82-2-6744-1083 00798-14800-7352 SPAIN 34-91-414-25-33 800-300-053 SWEDEN 46-8-566-19-348 0200-884-622 SWITZERLAND 41-44-580-6398 0800-120-032 TAIWAN 886-2-2795-7379 00801-137-797 THAILAND 001-800-1206-66056 TURKEY 00-800-151-0516 UNITED ARAB EMIRATES 8000-35702370 UNITED KINGDOM BIRMINGHAM: 44-121-210-9025 0808-238-6029 UNITED KINGDOM GLASGOW: 44-141-202-3225 0808-238-6029 UNITED KINGDOM LEEDS: 44-113-301-2125 0808-238-6029 UNITED KINGDOM LONDON: 44-20-7108-6370 0808-238-6029 UNITED KINGDOM MANCHESTER: 44-161-601-1425 0808-238-6029 URUGUAY 000-413-598-3421 USA 1-517-345-9004 866-692-5726 VENEZUELA 0800-1-00-3702 VIETNAM 120-11751 Thank you. Kind Regards, Andrea

1 0

**Reminder** Meeting Invitation: Observers GNSO Temp Spec gTLD RD EPDP - Phase 2 Extraordinary call | Thursday, 29 August 2019 at 20:00 UTC
by Julie Bisland Aug. 28, 2019

Aug. 28, 2019

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 29 August 2019 at 20:00 UTC for 120 minutes. (calls will be scheduled for 120 minutes but aim to keep to 90 minutes) 13:00 PDT, 16:00 EDT, 22:00 Paris CEST, (Friday) 01:00 Karachi PKT, (Friday) 05:00 Tokyo JST, (Friday) 06:00 Melbourne AEST For other times: https://tinyurl.com/y2z6kocj [tinyurl.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__tinyurl.com_y2z6kocj&d…> Agenda Wiki: https://community.icann.org/x/EY3kBg The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream02 <https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream02.m3u <https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> If needed, an option to join via telephone has been added for this meeting. Passcode: EPDP Dial in numbers: Country Toll Numbers Freephone/ Toll Free Number ARGENTINA 0800-777-0519 AUSTRALIA ADELAIDE: 61-8-8121-4842 1-800-657-260 AUSTRALIA BRISBANE: 61-7-3102-0944 1-800-657-260 AUSTRALIA CANBERRA: 61-2-6100-1944 1-800-657-260 AUSTRALIA MELBOURNE: 61-3-9010-7713 1-800-657-260 AUSTRALIA PERTH: 61-8-9467-5223 1-800-657-260 AUSTRALIA SYDNEY: 61-2-8205-8129 1-800-657-260 AUSTRIA 43-1-92-81-113 0800-005-259 BELGIUM 32-2-400-9861 0800-3-8795 BRAZIL RIO DE JANEIRO: 55-21-40421490 0800-7610651 BRAZIL SAO PAULO: 55-11-3958-0779 0800-7610651 CHILE 1230-020-2863 CHINA CHINA A: 86-400-810-4789 10800-712-1670 CHINA CHINA B: 86-400-810-4789 10800-120-1670 COLOMBIA 01800-9-156474 CROATIA 080-08-06-309 CZECH REPUBLIC 420-2-25-98-56-64 800-700-177 DENMARK 45-7014-0284 8088-8324 ESTONIA 800-011-1093 FINLAND 358-9-5424-7162 0-800-9-14610 FRANCE LYON: 33-4-26-69-12-85 080-511-1496 FRANCE MARSEILLE: 33-4-86-06-00-85 080-511-1496 FRANCE PARIS: 33-1-70-70-60-72 080-511-1496 GERMANY 49-69-2222-20362 0800-664-4247 GREECE 30-80-1-100-0687 00800-12-7312 HONG KONG 852-3001-3863 800-962-856 HUNGARY 36-1-700-8856 06-800-12755 INDIA INDIA A: 000-800-852-1268 INDIA INDIA B: 000-800-001-6305 INDIA INDIA C: 1800-300-00491 INDONESIA 001-803-011-3982 IRELAND 353-1-246-7646 1800-992-368 ISRAEL 1-80-9216162 ITALY MILAN: 39-02-3600-6007 800-986-383 ITALY ROME: 39-06-8751-6018 800-986-383 ITALY TORINO: 39-011-510-0118 800-986-383 JAPAN OSAKA: 81-6-7878-2631 0066-33-132439 JAPAN TOKYO: 81-3-6868-2631 0066-33-132439 LATVIA 8000-3185 LUXEMBOURG 352-27-000-1364 8002-9246 MALAYSIA 1-800-81-3065 MEXICO GUADALAJARA (JAL): 52-33-3208-7310 001-866-376-9696 MEXICO MEXICO CITY: 52-55-5062-9110 001-866-376-9696 MEXICO MONTERREY: 52-81-2482-0610 001-866-376-9696 NETHERLANDS 31-20-718-8588 0800-023-4378 NEW ZEALAND 64-9-970-4771 0800-447-722 NORWAY 47-21-590-062 800-15157 PANAMA 011-001-800-5072065 PERU 0800-53713 PHILIPPINES 63-2-858-3716 1800-111-42453 POLAND 00-800-1212572 PORTUGAL 8008-14052 ROMANIA 40-31-630-01-79 RUSSIA 8-10-8002-0144011 SAUDI ARABIA 800-8-110087 SINGAPORE 65-6883-9230 800-120-4663 SLOVAK REPUBLIC 421-2-322-422-25 0800-002066 SOUTH AFRICA 080-09-80414 SOUTH KOREA 82-2-6744-1083 00798-14800-7352 SPAIN 34-91-414-25-33 800-300-053 SWEDEN 46-8-566-19-348 0200-884-622 SWITZERLAND 41-44-580-6398 0800-120-032 TAIWAN 886-2-2795-7379 00801-137-797 THAILAND 001-800-1206-66056 TURKEY 00-800-151-0516 UNITED ARAB EMIRATES 8000-35702370 UNITED KINGDOM BIRMINGHAM: 44-121-210-9025 0808-238-6029 UNITED KINGDOM GLASGOW: 44-141-202-3225 0808-238-6029 UNITED KINGDOM LEEDS: 44-113-301-2125 0808-238-6029 UNITED KINGDOM LONDON: 44-20-7108-6370 0808-238-6029 UNITED KINGDOM MANCHESTER: 44-161-601-1425 0808-238-6029 URUGUAY 000-413-598-3421 USA 1-517-345-9004 866-692-5726 VENEZUELA 0800-1-00-3702 VIETNAM 120-11751 Thank you. Kind Regards, Andrea

1 0

Proposed agenda - EPDP Team Meeting #16 on Thursday 29 August at 14.00 UTC
by Marika Konings Aug. 26, 2019

Aug. 26, 2019

Dear EPDP Team, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Thursday 29 August at 14.00 UTC. As a reminder: Groups are welcome to provide additional comments in response to early input in the Early Input Google Doc<https://docs.google.com/document/d/1CXKIZmjBRUO3qRIiNl78S0692EIHDCum/edit> over the next two weeks (by 29 August). Support Staff will consider input received when compiling the Zero Draft document. 29 August 2019 Early Input Google Doc<https://docs.google.com/document/d/1CXKIZmjBRUO3qRIiNl78S0692EIHDCum/edit> Best regards, Caitlin, Berry and Marika =================== EPDP Phase 2 - Meeting #16 Proposed Agenda Thursday, 29 August 2019 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Confirmation of agenda (Chair) 3. Welcome and housekeeping issues (Chair) (5 minutes) a) Update from Legal Committee b) Reminder – contribute to google doc with questions for ICANN CEO / Strawberry Team in preparation for LA F2F meeting (see https://docs.google.com/document/d/1Q_0smZv58- rQ4RF9buAMBmt4PGVSk6gAYyLiPIOlyQU/edit<https://docs.google.com/document/d/1Q_0smZv58-%09rQ4RF9buAMBmt4PGVSk6gAYyLi…>) 4. Use case – second/final reading: When a network is undergoing an attack involving a domain name, and the operator(s) of that network need to contact the domain owner to remediate the security issue (DDOS, Botnet, etc.)<https://docs.google.com/document/d/1eLcD6TpQCW029qgi05BQHGwDA9PW29jM3e9ZhPE…> (SSAC1) a) Overview of updates made in response to input received (SSAC) b) Feedback from EPDP Team c) Confirm next steps 5. Use case – final reading: Online buyers identifying and validating the source or services/ Internet users validating the legitimacy of an email or a website to protect themselves<file:///Users/marika.konings/Documents/Documents/EPDP%20Team%20Phase%202/Online%20buyers%20identifying%20and%20validating%20the%20source%20or%20services/%20Internet%20users%20validating%20the%20legitimacy%20of%20an%20email%20or%20a%20website%20to%20protect%20themselves> (ALAC1) a) Overview of updates made in response to input received (ALAC) b) Feedback from EPDP Team c) Confirm next steps 6. Use case – first reading: Investigation of criminal activity against a victim in the jurisdiction of the investigating EU LEA requesting data from a local data controller<https://community.icann.org/download/attachments/111386876/Use%20Case%20-%2…>. (LEA 2) a) Intro to use case and overview of how/where this use case is different from LEA 1 (GAC) b) Feedback from EPDP Team c) Confirm next steps 7. Any other business (5 minutes) 8. Wrap and confirm next EPDP Team meeting (5 minutes): a) Thursday 29 August 2019 at 20.00 UTC (extraordinary meeting – intro to and initial feedback on zero draft) b) Thursday 5 September 2019 at 14.00 UTC c) Confirm action items d) Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Notes and action items from EPDP Phase 2 Meeting #15 - 22 August 2019
by Caitlin Tubergen Aug. 23, 2019

Aug. 23, 2019

Dear EPDP Team, Please find the notes and action items from today’s EPDP Team meeting below. As a reminder, the EPDP Phase 2 Legal Committee will meet on Tuesday, 27 August. The plenary team will meet twice on Thursday, 29 August: at 14:00 UTC and 20:00 UTC. Thank you. Best regards, Marika, Berry, and Caitlin -- EPDP Phase 2 - Meeting #15 Thursday, 22 August 2019 at 14.00 UTC Action Items ALAC EPDP Team members to review comments received on ALAC 1 (Online buyers identifying and validating the source of goods or services/ Internet users validating the legitimacy of an email or a website to protect themselves) and distribute updated version of the use case by Tuesday, 27 August in preparation for final reading on Thursday, 29 August. Brian King to consider comments made today regarding legal basis and amend the IP use case accordingly. Greg Aaron to update the SSAC use case on crime and abuse investigation by non-law enforcement parties to reflect today’s conversation. For the moment, the Team will park this use case and can revisit in the future when going through the zero draft. EPDP Team Members to add comments from today’s discussion of SSAC use case on operational security in the corresponding Google Doc by tomorrow, Friday, 23 August. SSAC EPDP members to review comments and distribute updated version of the use case by Tuesday, 27 August in preparation for final reading on Thursday, 29 August. Support Staff to create and distribute a Google Doc for EPDP Team members to contribute questions for the face-to-face session with Göran and the Strawberry Team. Notes These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/ZwPVBQ. EPDP Phase 2 - Meeting #15 Proposed Agenda Thursday, 22 August 2019 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) · Attendance will be taken from Zoom room 2. Confirmation of agenda (Chair) 3. Welcome and housekeeping issues (Chair) (5 minutes) a) Confirm timeline for publication of zero draft and planning for F2F meeting: · Circulation of zero draft to the EPDP Team: Tuesday 27 August · Extraordinary EPDP Team meeting to present zero draft and get initial reactions from EPDP Team: Thursday 29 August at 20.00 UTC (note, this meeting will be in addition to the regular EPDP Team meeting at 14.00 UTC) · Conduct survey to assess which aspects of the zero draft are of most concern and as such should be prioritized for the F2F meeting: Monday 2 – Wednesday 4 September. · Confirm priority items for F2F meeting and confirm ‘homework’ for F2F meeting: Thursday 5 September (regular EPDP Team meeting) b) Update from Legal Committee · Legal Committee met on Tuesday to discuss the SSAD legal questions · Legal Committee made progress on questions to be sent to outside counsel - the first batch is awaiting an anchor question · The questions will be sent to the plenary team as soon as available · The questions appear to be very specific and have a lot of qualifiers - caution against too much specificity - the questions should be more general and overarching. Answers to overly specific questions will likely be unhelpful. · Question 3 seems to be vague -- would it be possible to shed more light on this question. · There was a letter from the European Commission that came in after Bird & Bird’s memo. · What within the EC letter needs to be highlighted in the memo? The question is open and vague. The LC may want to consider highlighting specific points that may warrant an updated an answer from the memo. · Questions refer to accreditation and accredited parties - there are significant differences within the team with respect to what those terms mean - is the Legal Committee aware of this? 4. Use case – second/final reading: Providers requesting access required to facilitate due process in the UDRP and URS [docs.google.com] (IP 5) (45 minutes) a) Review updates made to use case to reflect input received (IPC) · Authors of use cases - please remember to alert the EPDP Team when updates have been made to a Google Doc. A summary of the updates made in response to comments will help facilitate discussions. · 6(1)(a) was removed as a lawful basis · 6(1)(b) was kept · 6(1)(c) was kept, but this would be a rare instance · NCSG noted 6(1)(f) is the only appropriate basis, but IPC disagrees and noted the disagreement b) Feedback from EPDP Team · Subsection A · Subsection B · Subsection C · Subsection D and E · This is a 6(1)(f). The contractual obligation does not apply to third parties - registrars do not have a contract with the individual who is requesting the data. · What is the rationale of including 6(1)(c) here? · General comment on all use cases: when EPDP Team members have commented, it appears that use case drafters disagree with the points and do not propose edits or compromises. This would amount to wasted time. · The reason 6(1)(c) was included is because UDRP and URS cases can be appealed - if this appeal happens, processing the data may be necessary to participate in the court proceeding. · 6(1)(f) should be included here. It is important for the Team to do this review. Regarding 6(1)(b), and the Bird & Bird memo - it doesn’t appear 6(1)(b) would apply with the current legal advice. · It’s unacceptable for 6(1)(f) to not be included at all. · Subsection F · Subsection G · Subsection H · Subsection I · Subsection J · “Or” should not be used in the accreditation criteria. If there is going to be processing of gTLD registration data, a combination of this criteria would be needed. · With respect to number 4, why would an entity seeking accreditation or disclosure have to affiliated with a DRP? What does it mean to be affiliated with? · What is the vision of accreditation - who is the accreditation for - URS or UDRP providers? Is the accreditation for entities seeking to file a UDRP or URS complaint? · There are two things happening in this box - one is the points made as “or” b/c you may not have an IP right, but you may work for someone who does, which is why not everything is “and”. Number 4 is the real problem that accreditation can help to fix. Maybe a UDRP provider could be accredited to receive data once a complaint has been filed. · It appears the use case is meant to apply to DRPs and TM holders. These are different user groups, and it should not be conflated into one use case. · This is a good point, and this could be divided into two use cases. The 6(1)(b) processing basis still applies to the Complainant since the data subject is a party to the contract. · Why is there is a 6(1)(b) basis for UDRP providers, but not complainants? · Registrants have signed a contract with registrars that commits them to submit to a DRP. Complainant is an unaffiliated party with a legitimate interest in the data, but there is no contract with complainants. · The Complainant may obtain data with 6(1)(b), but the contract b/w ICANN and DRPs would likely trigger 6(1)(f). Leave two legal bases in and it would be OK. · Subsection K · Subsection L · Subsection M · Subsection N · Subsection O c) Confirm next steps · Action item: Brian to consider comments made today regarding legal basis and amend the case accordingly. 5. Use case – final reading: Investigation of criminal activity where domain names are used. Typical specific example: phishing attack [docs.google.com] (SSAC 3) a) Review updates made to use case to reflect input received (SSAC) · SSAC made a number of edits based on comments received. · If there is a disagreement, how should that be reflected in the use case? · Disagreements need to be bridged through compromise, or, at a minimum, documented within the use case · In some instances, the SSAC use case invokes recitals that NCSG disagrees with. · Safeguard requirements are applicable to the entity that is protecting the data subject · Contracted parties have noted their discomfort with the combination of criminal activity and abusive activity in outlining this use case. There is significant overlap b/w this as written and the previous use case by the GAC. · How do the use cases fit into the final report? The Team understands that these are exercises that allow us to confront issues. The problem comes when including these use cases in the Final Report - if documents are included in the Final Report, there needs to be consensus. Authors cannot use these to be advocates and/or wishlists. The penholder cannot arbitrarily decide that they do not agree with something and arbitrarily decide what the legal basis is. Disagreements, at a minimum, need to documented in the Final Report. · This use case covers criminal use cases and abuse cases, and these need to be separated. · The use cases will not be attached to the Final Report. · It will be helpful to include as much detail in the policy was possible. · This use case does not conflate crime and abuse since these two aspects of the same thing. · Crime and abuse are not disambiguated b/c they cannot be. Phishing is a crime. What can make a difference is which party is dealing with it when. Law enforcement has different bases than private parties. · Regarding safeguards, this is a chicken or egg situation - safeguards may be the same no matter which type of party is making the request. The Team will have to talk about safeguards as a separate subject. Accreditation comes out of safeguards. · It is SSAC’s assumption that entities that get into an accreditation scheme have to meet some sort of bars. · These documents are the only place to capture thoughts and ideas. The parts of the Initial Report that are consensus-based are the recommendations, so it would make sense in places where there are disagreements. · Re: legal bases - the SSAC team looked at the bases from the comments. 6(1)(f) will represent most of the requests here. However, it would be inadvisable to rule other legal bases out. Additional commentary will be added to these legal bases. · The legal basis discussion is what is causing the group to stumble. Suggestion: perhaps the use case could be separated based on the legal basis. · Action item: SSAC to reflect today’s conversation in the use case. For the moment, the Team will park the use case and can revisit in the future when going through the zero draft. b) Feedback from EPDP Team c) Confirm next steps 6. Use case – first reading: When a network is undergoing an attack involving a domain name, and the operator(s) of that network need to contact the domain owner to remediate the security issue (DDOS, Botnet, etc.) (SSAC1) a) Introduction to use case (SSAC) · Domain names are often used either maliciously in DNS-based attacks, DDOS being the most common. · The use case is about a network operator, who is under attack, and needs to contact the domain owner to remediate the security issue. · Pseudonymized data is unlikely to help the issue · Most of the time, these situations need immediate contact - therefore, registrant contact, admin contact, tech contact, phone and email would be required here. · 6(1)(d) - sometimes critical infrastructure like hospitals or power grids could be brought down by network attack, which is why this legal basis was included in the list · In Subsection E, Recital 49 is added b/c this is exactly what Recital 49 is meant for. · Subsection F - Requestor will comply with all GDPR aspects · As far as disclosing the data, same standard safeguards should be applied. · If automation is possible, the hope would be that info could be disclosed in a few seconds. If manual, same-day response would be desirable. b) Feedback from EPDP Team · Consternation with 6(1)(d) as a lawful basis - it would be easier to walk through 6(1)(f) as a contracted party · Urgency of the request is something that should dictate the response and speed of the response. · This is the original purpose of collecting and displaying WHOIS data. 6(1)(d) may make registrars nervous. · Issue with 6(1)(d) - that legal basis is very limited in scope. · It would be helpful for anyone making comments in today’s meeting in the Google Doc itself. c) Confirm next steps 7. Any other business (5 minutes) · In preparation for the Los Angeles F2F, Janis suggested having CEO present during F2F. In order to structure that conversation, Support Staff will create a Google Doc with a few initial questions and EPDP Team members may contribute additional questions. 8. Wrap and confirm next EPDP Team meeting (5 minutes): a) Thursday 29 August 2019 at 14.00 UTC (5 minutes) b) Confirm action items c) Confirm questions for ICANN Org, if any

2 1

Questions for CEO and Strawberry Team
by Caitlin Tubergen Aug. 22, 2019

Aug. 22, 2019

Dear EPDP Team, Further to Support Staff’s action item from today’s meeting, please find the below link to a Google Doc in which you may add questions for Göran Marby or the Strawberry Team: https://docs.google.com/document/d/1Q_0smZv58-rQ4RF9buAMBmt4PGVSk6gAYyLiPIO…. Thank you. Best regards, Marika, Berry, and Caitlin

1 0

Meeting Invitation: Observers GNSO Temp Spec gTLD RD EPDP - Phase 2 Extraordinary call | Thursday, 29 August 2019 at 20:00 UTC
by Andrea Glandon Aug. 22, 2019

Aug. 22, 2019

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 29 August 2019 at 20:00 UTC for 120 minutes. (calls will be scheduled for 120 minutes but aim to keep to 90 minutes) 13:00 PDT, 16:00 EDT, 22:00 Paris CEST, (Friday) 01:00 Karachi PKT, (Friday) 05:00 Tokyo JST, (Friday) 06:00 Melbourne AEST For other times: https://tinyurl.com/y2z6kocj Agenda Wiki: https://community.icann.org/x/EY3kBg The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream02 <https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream02.m3u <https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> If needed, an option to join via telephone has been added for this meeting. Passcode: EPDP Dial in numbers: Country Toll Numbers Freephone/ Toll Free Number ARGENTINA 0800-777-0519 AUSTRALIA ADELAIDE: 61-8-8121-4842 1-800-657-260 AUSTRALIA BRISBANE: 61-7-3102-0944 1-800-657-260 AUSTRALIA CANBERRA: 61-2-6100-1944 1-800-657-260 AUSTRALIA MELBOURNE: 61-3-9010-7713 1-800-657-260 AUSTRALIA PERTH: 61-8-9467-5223 1-800-657-260 AUSTRALIA SYDNEY: 61-2-8205-8129 1-800-657-260 AUSTRIA 43-1-92-81-113 0800-005-259 BELGIUM 32-2-400-9861 0800-3-8795 BRAZIL RIO DE JANEIRO: 55-21-40421490 0800-7610651 BRAZIL SAO PAULO: 55-11-3958-0779 0800-7610651 CHILE 1230-020-2863 CHINA CHINA A: 86-400-810-4789 10800-712-1670 CHINA CHINA B: 86-400-810-4789 10800-120-1670 COLOMBIA 01800-9-156474 CROATIA 080-08-06-309 CZECH REPUBLIC 420-2-25-98-56-64 800-700-177 DENMARK 45-7014-0284 8088-8324 ESTONIA 800-011-1093 FINLAND 358-9-5424-7162 0-800-9-14610 FRANCE LYON: 33-4-26-69-12-85 080-511-1496 FRANCE MARSEILLE: 33-4-86-06-00-85 080-511-1496 FRANCE PARIS: 33-1-70-70-60-72 080-511-1496 GERMANY 49-69-2222-20362 0800-664-4247 GREECE 30-80-1-100-0687 00800-12-7312 HONG KONG 852-3001-3863 800-962-856 HUNGARY 36-1-700-8856 06-800-12755 INDIA INDIA A: 000-800-852-1268 INDIA INDIA B: 000-800-001-6305 INDIA INDIA C: 1800-300-00491 INDONESIA 001-803-011-3982 IRELAND 353-1-246-7646 1800-992-368 ISRAEL 1-80-9216162 ITALY MILAN: 39-02-3600-6007 800-986-383 ITALY ROME: 39-06-8751-6018 800-986-383 ITALY TORINO: 39-011-510-0118 800-986-383 JAPAN OSAKA: 81-6-7878-2631 0066-33-132439 JAPAN TOKYO: 81-3-6868-2631 0066-33-132439 LATVIA 8000-3185 LUXEMBOURG 352-27-000-1364 8002-9246 MALAYSIA 1-800-81-3065 MEXICO GUADALAJARA (JAL): 52-33-3208-7310 001-866-376-9696 MEXICO MEXICO CITY: 52-55-5062-9110 001-866-376-9696 MEXICO MONTERREY: 52-81-2482-0610 001-866-376-9696 NETHERLANDS 31-20-718-8588 0800-023-4378 NEW ZEALAND 64-9-970-4771 0800-447-722 NORWAY 47-21-590-062 800-15157 PANAMA 011-001-800-5072065 PERU 0800-53713 PHILIPPINES 63-2-858-3716 1800-111-42453 POLAND 00-800-1212572 PORTUGAL 8008-14052 ROMANIA 40-31-630-01-79 RUSSIA 8-10-8002-0144011 SAUDI ARABIA 800-8-110087 SINGAPORE 65-6883-9230 800-120-4663 SLOVAK REPUBLIC 421-2-322-422-25 0800-002066 SOUTH AFRICA 080-09-80414 SOUTH KOREA 82-2-6744-1083 00798-14800-7352 SPAIN 34-91-414-25-33 800-300-053 SWEDEN 46-8-566-19-348 0200-884-622 SWITZERLAND 41-44-580-6398 0800-120-032 TAIWAN 886-2-2795-7379 00801-137-797 THAILAND 001-800-1206-66056 TURKEY 00-800-151-0516 UNITED ARAB EMIRATES 8000-35702370 UNITED KINGDOM BIRMINGHAM: 44-121-210-9025 0808-238-6029 UNITED KINGDOM GLASGOW: 44-141-202-3225 0808-238-6029 UNITED KINGDOM LEEDS: 44-113-301-2125 0808-238-6029 UNITED KINGDOM LONDON: 44-20-7108-6370 0808-238-6029 UNITED KINGDOM MANCHESTER: 44-161-601-1425 0808-238-6029 URUGUAY 000-413-598-3421 USA 1-517-345-9004 866-692-5726 VENEZUELA 0800-1-00-3702 VIETNAM 120-11751 Thank you. Kind Regards, Andrea

1 0

Meeting Invitation: Observers GNSO Temp Spec gTLD RD EPDP - Phase 2 call | Thursday, 29 August 2019 at 14:00 UTC
by Andrea Glandon Aug. 22, 2019

Aug. 22, 2019

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 29 August 2019 at 14:00 UTC for 120 minutes. (calls will be scheduled for 120 minutes but aim to keep to 90 minutes) 07:00 PDT, 10:00 EDT, 16:00 Paris CEST, 19:00 Karachi PKT, 23:00 Tokyo JST, (Friday) 00:00 Melbourne AEST For other times: https://tinyurl.com/y4eevh45 Agenda Wiki: https://community.icann.org/x/pKajBg The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream02 <https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream02.m3u <https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> If needed, an option to join via telephone has been added for this meeting. Passcode: EPDP Dial in numbers: Country Toll Numbers Freephone/ Toll Free Number ARGENTINA 0800-777-0519 AUSTRALIA ADELAIDE: 61-8-8121-4842 1-800-657-260 AUSTRALIA BRISBANE: 61-7-3102-0944 1-800-657-260 AUSTRALIA CANBERRA: 61-2-6100-1944 1-800-657-260 AUSTRALIA MELBOURNE: 61-3-9010-7713 1-800-657-260 AUSTRALIA PERTH: 61-8-9467-5223 1-800-657-260 AUSTRALIA SYDNEY: 61-2-8205-8129 1-800-657-260 AUSTRIA 43-1-92-81-113 0800-005-259 BELGIUM 32-2-400-9861 0800-3-8795 BRAZIL RIO DE JANEIRO: 55-21-40421490 0800-7610651 BRAZIL SAO PAULO: 55-11-3958-0779 0800-7610651 CHILE 1230-020-2863 CHINA CHINA A: 86-400-810-4789 10800-712-1670 CHINA CHINA B: 86-400-810-4789 10800-120-1670 COLOMBIA 01800-9-156474 CROATIA 080-08-06-309 CZECH REPUBLIC 420-2-25-98-56-64 800-700-177 DENMARK 45-7014-0284 8088-8324 ESTONIA 800-011-1093 FINLAND 358-9-5424-7162 0-800-9-14610 FRANCE LYON: 33-4-26-69-12-85 080-511-1496 FRANCE MARSEILLE: 33-4-86-06-00-85 080-511-1496 FRANCE PARIS: 33-1-70-70-60-72 080-511-1496 GERMANY 49-69-2222-20362 0800-664-4247 GREECE 30-80-1-100-0687 00800-12-7312 HONG KONG 852-3001-3863 800-962-856 HUNGARY 36-1-700-8856 06-800-12755 INDIA INDIA A: 000-800-852-1268 INDIA INDIA B: 000-800-001-6305 INDIA INDIA C: 1800-300-00491 INDONESIA 001-803-011-3982 IRELAND 353-1-246-7646 1800-992-368 ISRAEL 1-80-9216162 ITALY MILAN: 39-02-3600-6007 800-986-383 ITALY ROME: 39-06-8751-6018 800-986-383 ITALY TORINO: 39-011-510-0118 800-986-383 JAPAN OSAKA: 81-6-7878-2631 0066-33-132439 JAPAN TOKYO: 81-3-6868-2631 0066-33-132439 LATVIA 8000-3185 LUXEMBOURG 352-27-000-1364 8002-9246 MALAYSIA 1-800-81-3065 MEXICO GUADALAJARA (JAL): 52-33-3208-7310 001-866-376-9696 MEXICO MEXICO CITY: 52-55-5062-9110 001-866-376-9696 MEXICO MONTERREY: 52-81-2482-0610 001-866-376-9696 NETHERLANDS 31-20-718-8588 0800-023-4378 NEW ZEALAND 64-9-970-4771 0800-447-722 NORWAY 47-21-590-062 800-15157 PANAMA 011-001-800-5072065 PERU 0800-53713 PHILIPPINES 63-2-858-3716 1800-111-42453 POLAND 00-800-1212572 PORTUGAL 8008-14052 ROMANIA 40-31-630-01-79 RUSSIA 8-10-8002-0144011 SAUDI ARABIA 800-8-110087 SINGAPORE 65-6883-9230 800-120-4663 SLOVAK REPUBLIC 421-2-322-422-25 0800-002066 SOUTH AFRICA 080-09-80414 SOUTH KOREA 82-2-6744-1083 00798-14800-7352 SPAIN 34-91-414-25-33 800-300-053 SWEDEN 46-8-566-19-348 0200-884-622 SWITZERLAND 41-44-580-6398 0800-120-032 TAIWAN 886-2-2795-7379 00801-137-797 THAILAND 001-800-1206-66056 TURKEY 00-800-151-0516 UNITED ARAB EMIRATES 8000-35702370 UNITED KINGDOM BIRMINGHAM: 44-121-210-9025 0808-238-6029 UNITED KINGDOM GLASGOW: 44-141-202-3225 0808-238-6029 UNITED KINGDOM LEEDS: 44-113-301-2125 0808-238-6029 UNITED KINGDOM LONDON: 44-20-7108-6370 0808-238-6029 UNITED KINGDOM MANCHESTER: 44-161-601-1425 0808-238-6029 URUGUAY 000-413-598-3421 USA 1-517-345-9004 866-692-5726 VENEZUELA 0800-1-00-3702 VIETNAM 120-11751 Thank you. Kind Regards, Andrea

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2 | Thursday, 22 August 2019 at 14:00 UTC
by Andrea Glandon Aug. 22, 2019

Aug. 22, 2019

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2 held on Thursday, 22 August 2019 at 14:00 UTC can be found on the agenda wiki page<https://community.icann.org/x/oqajBg> (attendance included) and the GNSO Master calendar <https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_en_group…> . These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call, observers can join via audio cast, listen to the recordings and read the transcript afterwards. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Andrea

1 0

Approved questions from Legal Committee
by Caitlin Tubergen Aug. 21, 2019

Aug. 21, 2019

Dear EPDP Team, During the upcoming EPDP Team meeting, León will present the questions the Legal Committee has thus far agreed to send to outside counsel. As a reminder, the Legal Committee has been reviewing draft legal questions related to an SSAD that were submitted by members of the EPDP Team. Please note the Legal Committee is still in the process of reviewing several questions, including an anchor question related to contracted party liability. The text of the additional questions will be forthcoming. The below text has been reviewed, edited, and agreed to by a representative group of EPDP Team Members, and, as such, EPDP Leadership would ask the EPDP Team to review the questions with a level of deference and apply the “cannot live with” standard when reviewing the below text. Thank you. Best regards, Marika, Berry, and Caitlin -- 1. To what extent, if any, are contracted parties liable when a third party that accesses non-public WHOIS data under an accreditation scheme where by the accessor is accredited for the stated purpose, commits to certain reasonable safeguards similar to a code of conduct regarding use of the data, but misrepresents their intended purposes for processing such data, and subsequently processes it in a manner inconsistent with the stated purpose. Under such circumstances, if there is possibility of liability to contracted parties, are there steps that can be taken to mitigate or reduce the risk of liability to the contracted parties? 2. Assuming that there is a policy that allows accredited parties to access non-public WHOIS data through an SSAD (and requires the accredited party to commit to certain reasonable safeguards similar to a code of conduct), is it legally permissible under Article 6(1)(f) to: · define specific categories of requests from accredited parties (e.g. rapid response to a malware attack or contacting a non-responsive IP infringer), for which there can be automated submissions for non-public WHOIS data, without having to manually verify the qualifications of the accredited parties for each individual disclosure request, and/or · enable automated disclosures of such data, without requiring a manual review by the controller or processor of each individual disclosure request. In addition, if it is not possible to automate any of these steps, please provide any guidance for how to perform the balancing test under Article 6(1)(f). For reference, please refer to the following potential safeguards: · Disclosure is required under CP’s contract with ICANN (resulting from Phase 2 EPDP policy). · CP’s contract with ICANN requires CP to notify the data subject of the purposes for which, and types of entities by which, personal data may be processed. CP is required to notify data subject of this with the opportunity to opt out before the data subject enters into the registration agreement with the CP, and again annually via the ICANN-required registration data accuracy reminder. CP has done so. · ICANN or its designee has validated the requestor’s identity, and required that the requestor: o represents that it has a lawful basis for requesting and processing the data, o provides its lawful basis, o represents that it is requesting only the data necessary for its purpose, o agrees to process the data in accordance with GDPR, and o agrees to standard contractual clauses for the data transfer. · ICANN or its designee logs requests for non-public registration data, regularly audits these logs, takes compliance action against suspected abuse, and makes these logs available upon request by the data subject. In light of the 3 May 2019 correspondence from the European Commission [icann.org] are any updates on the previous memo on 6(1)(b) necessary?

1 0