- Gnso-epdp-team - lists.icann.org

Notes and action items - EPDP Meeting #26 - 22 Oct 2019
by Caitlin Tubergen Oct. 22, 2019

Oct. 22, 2019

Dear EPDP Team: Please find below the notes and action items from today’s EPDP Team meeting. As a reminder, the next EPDP meeting will be Thursday, 24 October at 1400 UTC. Best regards, Marika, Berry, and Caitlin -- Action Items Amr to propose new text re: Building Block d, subpoint c on compatible purposes – for Building Block d based on today’s discussion by Thursday, 24 October. Support Staff to review subpoint d and ensure relevant points are captured in the Auditing building block by Wednesday, 23 October. Chris Lewis-Evans to work with colleagues to update Building Block h, subpoint h by Thursday, 24 October. Support staff to review and revise Building Block h, subpoint i based on today’s discussion by Wednesday, 23 October. EPDP Team to provide concerns and objections (if any) to the Priority 2 next steps proposal by Friday, 25 October. These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/ZwPVBQ. EPDP Phase 2 - Meeting #26 Tuesday, 22 October 2019 at 14.00 UTC Roll Call & SOI Updates (5 minutes) 2. Confirmation of agenda (Chair) 3. Welcome and housekeeping issues (Chair) (5 minutes) Proposed outline for EPDP Plenary Session at ICANN66 This plenary session, previously known as the Cross-Community session, was requested by the GAC and GNSO. EPDP Support Staff drafted questions to discuss in the plenary session. The EPDP Team is welcome to suggest targeted questions that could generate discussion during the plenary session. Questions to ICANN Org (request to provide input by ICANN66) Questions originally raised by James and edited by the EPDP Team were shared informally with ICANN org Would the Team object to Janis asking ICANN org to respond to the questions that were already shared informally? Should these questions be asked to the Board in addition to Org? Janis will send these questions to Goran under his capacity as chair. Status of building blocks The Team has not completed any additional building blocks since the last meeting. Encourage Team members to make an extra effort to provide input and follow through on action items. In the event any member is unable to complete homework by the deadline, please provide an update with an updated deadline. In the next agenda item, Janis has requested agreed items to be highlighted in green. Text highlighted in green should not be questioned unless there was a misunderstanding. Additionally, there are now two new building blocks for auditing and logging requests. Input is sometimes provided very close to the call, which does not give other team members time to provide feedback. Perhaps prior to the Montreal meeting, there will be a date where all documents are frozen so that everyone can work towards a specific deadline. IPC will provide input on the accreditation building block by EOD today. Marc A. and Hadia to include updated text for accreditation shortly. 4. Acceptable use policy [docs.google.com] (building block D and H) – second reading continued Overview of updates made Feedback from EPDP Team Subpoint c Still awaiting updated language from Margie and Amr for subpoint c Margie and Amr have not yet reached agreement on language; they did agree that a requestor could make a request for disclosure under more than one purpose Have difficulty in accepting that the disclosee could change the purpose. If the disclosee is going to state specific purposes, that needs to be the purpose under which they process the data. The requestor cannot make subtle changes to the purposes after receiving the data. If this language is in the law, please specify the problem. The data subject is going to be told that data will be given to people who have a specific standard and/or purpose(s) as stated. The controller/processor cannot say, “or other purposes as updated”. This dilutes the initial notice to the data subject. Also, the data subject will not know who the disclosee is until there is an access request. Article 5 of GDPR – data is not further processed in a matter that incompatible with the purposes for which the data was collected. Agree with the above suggestion, but for one issue. Prevent a situation where someone requests data under false pretenses. There needs to be a safeguard that prevents this. The purposes for which a requestor may request data is not the same as the original purposes for which the data is collected. The requestor has to seek permission from the primary controller on any further processing, and the determination as to whether further processing is incompatible needs to be made by the primary controller. The recipient of the data is now the controller; however, that recipient has no nexus with the registrant. Absent independent oversight, there is now a new controller with data. There are recent examples (like Equifax) to ensure there is a necessity test before release of data and that the recipient of the data will responsibly use the data. The theoretical nature of this discussion is blocking resolution. When we have defined the language which will be presented to the registrant, and when we have discussed some examples of compatible/incompatible, this will be more clear.  Action: Amr to revise the language of subpoint c and provide to the list for discussion by Thursday, 24 October. Margie and Amr do agree that multiple purposes can be submitted for each request. Trying to solve: if after the disclosure has taken place and the requestor comes up with a new purpose that was not disclosed, can the requestor process data for the purpose that was not disclosed? Subpoint d This should be further explained in the auditing section What is the purpose for the requestor to submit the lawful basis for the processing to take place? The controller has to have a lawful basis. The requestor can provide a lawful basis they think the controller may use, but not sure why this is included. Building Block H Subpoint h This has not yet been agreed, so James and Chris L-E are working to update this in advance of Thursday’s call Subpoint i The use of double negatives in not ideal There is one issue of releasing a name and another about releasing identity of a person that may be harmed. It is difficult for a registrar to respond to requests by local law enforcement authorities. This point should be split. How to handle human rights defenders is a difficult problem. Local laws justify sanctions that may be disproportionate to an offense that has taken place. Disclosure requests must not go further than where MLATs are in place. Subpoint a No disagreements from the Team to remove the word “necessary” Confirm next steps 5. Query Policy [docs.google.com] (building block i and l) – second reading continued Overview of updates made Feedback from EPDP Team Subpoint a and accompanying list This is too subjective – what is high-volume to one registrar may be low-volume to another. How can this be implemented to get something that is less subjective. Bullet point six is troublesome – there are undefined terms “mine” and “harvest” are very subjective. Third bullet point notes quotas – this inclusion is problematic. Additionally, rate limiting is also problematic. If someone is submitting a legitimate request, this needs to be accepted and considered. The third bullet should be deleted. Receivers of queries now decide what frequency or number of requests they want to receive unilaterally, but that may not work in the new system. Accordingly, bullet 3 and 6 are problematic. This list includes terms that are present in the 2013 RAA. There are two ways to resolve this: be specific as possible or secondly, roll them all up to commercially reasonable efforts to prevent abuse. Team members need to appreciate that there are bad actors, and the SSAD will be a big target. There needs to be mechanisms to safeguard this system – specific safeguards will allow for bad actors to abuse the system. The system should not handcuff providers to burdensome obligations – a small registrar may not be able to handle this, for example. GDPR requires adequate and technical measures in place to protect data. In the legal world, the measures would not be published. There needs to be volume control. It may be helpful to look how registries did this. One key issue here – there needs to be some reference to proportionality. Registrars range in size radically - what is high-volume to one registrar may be low-volume to another. Just as the Team considers bad acting requestors, the Team also needs to consider bad acting registrars. Users of data and suppliers of data need to have a common understanding. Enumerating abuse may be problematic – perhaps the commercially reasonable approach should be used to give flexibility to the providers. The Team needs to find middle ground so that compliance can take action against bad actors. The commercially reasonable approach is a nonstarter. Support Staff to determine where the “proportionate” idea can be placed. Confirm next steps 6. Priority 2 items – proposed next steps (see attached) Overview of leadership team proposed next steps This document was shared with the agenda. Recommendations factored in the small team’s proposals Privacy/Proxy Questions around how this issue may already be addressed by the PPSAI policy This implementation is currently on hold, but perhaps the implementation review team has taken into account this issue – proposal for support staff to reach out to colleagues on PPSAI for further information Legal vs. Natural Confirm with colleagues re: status of the study and associated timeline. In parallel to study being undertaken, Legal Committee could review what questions (if any) should be submitted prior to the completion of the study. City Field Legal advice came in at the end of Phase 1 Legal committee to review and analyze the legal advice and review additional legal questions that have been proposed Data Retention Staff to confirm what the status of ICANN org’s work to review data retention procedures and see if the retention period recommended in Phase 1 needs to be updated. OCTO Follow up with OCTO colleagues – and see if the position during Phase 1 has changed. Based on feedback received, Team would consider what the appropriate next steps are Uniform Anonymization Legal Committee to review the questions received thus far for the Team to have an informed discussion on this WHOIS Accuracy and ARS This is a topic b/w ICANN org and the GNSO Council – trying to review scope of this work – await further guidance on this before proceeding further. Feedback from EPDP Team Staff should proceed with the next steps The legal vs. natural study is not dependent on the implementation of Phase 1 recommendations. Would Team agree to a lunchtime presentation of the terms of reference to the legal vs. natural study. EPDP Team to provide objections to the Priority 2 proposal by Friday, 25 October. Confirm next steps 7. Wrap and confirm next EPDP Team meeting (5 minutes): Thursday 24 October 2019 at 14.00 UTC Confirm action items Confirm questions for ICANN Org, if any

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2 | Tuesday, 22 October 2019 at 14:00 UTC
by Terri Agnew Oct. 22, 2019

Oct. 22, 2019

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2 held on Tuesday, 22 October 2019 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/display/EOTSFGRD/2019-10-22+EPDP-+Phase+2+call+…> (attendance included) and the GNSO Master calendar <https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_en_group…> . These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call, observers can join via audio cast, listen to the recordings and read the transcript afterwards. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Proposed agenda - EPDP Team meeting #27 on Thursday 24 October at 14.00 UTC
by Marika Konings Oct. 22, 2019

Oct. 22, 2019

Dear EPDP Team, Please find below the proposed agenda for the next EPDP Team meeting which has been scheduled for Thursday 24 October at 14.00 UTC. As discussed during today’s meeting, staff has produced an updated version of the accreditation building block – updates have mainly focused on reorganizing the sections, updating the definitions to align with the descriptions in the building block and making some minor updates in line with discussions to date. To facilitate your review, we have created a clean version as the reorganization basically changed everything in redline, but for those who want to go back to the previous version and previous comments submitted, the link to the previous google doc remains available on the building block wiki page. Please review this new version (https://docs.google.com/document/d/134Vryb2H5fYzC1B_451pfzCA1VHVtreF/edit) ahead of Thursday’s meeting and provide your group’s comments in the google doc. Thanks, Caitlin, Berry and Marika EPDP Phase 2 - Meeting #27 Proposed Agenda Thursday, 24 October 2019 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Confirmation of agenda (Chair) 3. Welcome and housekeeping issues (Chair) (5 minutes) a) Status of building blocks<https://community.icann.org/x/k5ICBw> 4. Accreditation<https://docs.google.com/document/d/134Vryb2H5fYzC1B_451pfzCA1VHVtreF/edit> (building block f and j) – second reading continued (30 minutes) a) Overview of updated version b) Feedback from EPDP Team c) Confirm next steps 5. Terms of use / disclosure agreements / privacy policies<https://docs.google.com/document/d/1eZBzRclRtEXPp1EScDfftnfnv9tneD7ovxmGe84…> (building block m) – first reading a) Review building block b) Feedback from EPDP Team c) Confirm next steps 6. Purposes<https://docs.google.com/document/d/1oBd7fOe7RCso-2zAQrm45WILfRHOG7LDr5Oap-g…> / user groups<https://docs.google.com/document/d/1B2JHP0ue4sAu5u37NtddzmtYs--Q_jg2mfKho-Y…> (building block b and c) a) Consider approach to these building blocks in light of discussions to date b) Feedback from EPDP Team c) Confirm next steps 7. Wrap and confirm next EPDP Team meeting (5 minutes): a) Tuesday 29 October 2019 at 14.00 UTC b) Confirm action items c) Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Meeting Invitation / Observers / GNSO Temp Spec gTLD RD EPDP-P2 call / Thursday, 24 October 2019
by Terri Agnew Oct. 22, 2019

Oct. 22, 2019

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 24 October 2019 at 14:00 UTC for 120 minutes. (calls will be scheduled for 120 minutes but aim to keep to 90 minutes) For other times: https://tinyurl.com/y2kurmq6 Agenda Wiki: https://community.icann.org/x/BYYCBw The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Kind Regards, Terri If needed, an option to join via telephone has been added for this meeting. **New join information - Conference Bridge: Toll-free access number (US and Canada): 800 550 6865 and Toll 213 233 3193 Other telephone numbers found here: http://www.adigo.com/icann Enter passcode on telephone: 7349

1 0

Proposed Agenda - EPDP Team Meeting #26 on Tuesday 14.00 UTC
by Marika Konings Oct. 21, 2019

Oct. 21, 2019

Dear EPDP Team, Please find below the proposed agenda for the next EPDP Team’s meeting which is scheduled for Tuesday 22 October at 14.00 UTC. Please make sure you have reviewed all the documents hyperlinked and attached in advance of the meeting. Best regards, Caitlin, Berry and Marika =============== EPDP Phase 2 - Meeting #26 Proposed Agenda Tuesday, 22 October 2019 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Confirmation of agenda (Chair) 3. Welcome and housekeeping issues (Chair) (5 minutes) a) Proposed outline for EPDP Plenary Session at ICANN66 b) Questions to ICANN Org (request to provide input by ICANN66) c) Status of building blocks<https://community.icann.org/x/k5ICBw> 4. Acceptable use policy<https://docs.google.com/document/d/1irlBo_oE5WqxTir5URaxlpPWTn17cnjDz72L79g…> (building block D and H) – second reading continued a) Overview of updates made b) Feedback from EPDP Team c) Confirm next steps 5. Query Policy<https://docs.google.com/document/d/13boFDslLC00MpuIhQV7yhwq0LPjZ-gz79pTmL-j…> (building block i and l) – second reading continued a) Overview of updates made b) Feedback from EPDP Team c) Confirm next steps 6. Priority 2 items – proposed next steps (see attached) a) Overview of leadership team proposed next steps b) Feedback from EDPD Team c) Confirm next steps 7. Wrap and confirm next EPDP Team meeting (5 minutes): a) Thursday 24 October 2019 at 14.00 UTC b) Confirm action items c) Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

2 1

**Reminder** Meeting Invitation / Observers / GNSO Temp Spec gTLD RD EPDP-P2 call / Tuesday, 22 October 2019 at 14:00 UTC
by Julie Bisland Oct. 21, 2019

Oct. 21, 2019

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Tuesday, 22 October 2019 at 14:00 UTC for 120 minutes. (calls will be scheduled for 120 minutes but aim to keep to 90 minutes) 07:00 PDT, 10:00 EDT, 16:00 Paris CEST, 19:00 Karachi PKT, 23:00 Tokyo JST, (Wednesday) 01:00 Melbourne AEDT For other times: https://tinyurl.com/y4ngx989 [tinyurl.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__tinyurl.com_y4ngx989&d…> Agenda Wiki: https://community.icann.org/x/I5ACBw The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Kind Regards, Andrea If needed, an option to join via telephone has been added for this meeting. **New join information - Conference Bridge: Toll-free access number (US and Canada): 800 550 6865 and Toll 213 233 3193 Other telephone numbers found here: http://www.adigo.com/icann [adigo.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.adigo.com_icann&d=D…> Enter passcode on telephone: 7349

1 0

Re: [Gnso-epdp-team] RrSG Comments: Building Block f/j "Accreditation" and n "Financial Sustainability"
by Caitlin Tubergen Oct. 19, 2019

Oct. 19, 2019

Thank you, James. Support Staff has added the RrSG comments to the respective Building Block Google docs. Have a great weekend. Best regards, Marika, Berry, and Caitlin From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of "James M. Bladel" <jbladel(a)godaddy.com> Date: Friday, October 18, 2019 at 10:26 AM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] RrSG Comments: Building Block f/j "Accreditation" and n "Financial Sustainability" EPDP Colleagues – On behalf of the RrSG, please find attached our comments for the Building Blocks on Accreditation and Financial Sustainability. Thank you, J. ------------- James Bladel GoDaddy

1 0

RrSG Comments: Building Block f/j "Accreditation" and n "Financial Sustainability"
by James M. Bladel Oct. 18, 2019

Oct. 18, 2019

EPDP Colleagues – On behalf of the RrSG, please find attached our comments for the Building Blocks on Accreditation and Financial Sustainability. Thank you, J. ------------- James Bladel GoDaddy

1 0

Accreditation Building block follow up
by Anderson, Marc Oct. 17, 2019

Oct. 17, 2019

All, I'm writing to follow up on the 17 Oct working group discussion on the Accreditation building block: https://docs.google.com/document/d/1zAEBygpoddKOJOfb1whMtaQHcik856aZZc9BoDk… Specifically I want to bring up principle f) which currently reads: The SSAD MUST accommodate requests for access/disclosure from non-accredited organizations or individuals, irrespective of the ultimate accreditation framework; On the call I didn't object to this principle but raised that from my perspective the important point isn't that SSAD MUST accommodate accredited and non-accredited requests but rather that SSAD MUST be accessible to everyone. If the way to accomplish that is for SSAD to support requests from accredited and non-accredited users, then I'm ok with that. I would also be ok with an SSAD system that supports only accredited users, provided that everyone has equivalent opportunity to become accredited. My recollection is that the principle that SSAD MUST accommodate requests from accredited and non-accredited users came about because it wasn't clear at the time that every potential SSAD user would have an opportunity to be accredited. It's not clear to me at this point that we've sufficiently established what accreditation system will be in place to be able to say if accreditation will be available to everyone or not. I raise this again because it was pointed out on the call that an SSAD system that needs to support accredited and non-accredited users will be more complicated (both from a technical implementation perspective and from a decision to disclose perspective) than one that only supports accredited users. What are other's thoughts on this? Is there support to change this principle to SSAD MUST be open to all organizations and individuals and making a determination on how this will be accomplished (via an SSAD system that supports accredited and non-accredited users, or making accreditation a pre-requisite but available to everyone) once accreditation is further flushed out? Best, Marc

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2 | Thursday, 17 October 2019 at 14:00 UTC
by Andrea Glandon Oct. 17, 2019

Oct. 17, 2019

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2 held on Thursday, 17 October 2019 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/A4YCBw> (attendance included) and the GNSO Master calendar <https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_en_group…> . These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call, observers can join via audio cast, listen to the recordings and read the transcript afterwards. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Andrea

1 0