- Gnso-epdp-team - lists.icann.org

EPDP Homework: Updated Draft of Board Letter
by James M. Bladel Oct. 10, 2019

Oct. 10, 2019

Colleagues – Regarding the draft letter to the Board presented on Tuesday, some members were uncomfortable with the wording of the last sentence. Since that call, I’ve been working with our Board liaisons (Becky and Chris) to make some edits. The resulting Revised Draft copied below. To expedite your review, please note that only the final sentence has changed. Thanks— J. ------------- James Bladel GoDaddy Letter from EPDP 2 to ICANN Board on Standardized System for Access/Disclosure (SSAD) To: ICANN Board CC: Goran CC: GNSO Council Dear ICANN Board, We are writing to you at the suggestion of the EPDP 2 Board liaisons. The working group is at a critical junction which requires clear input from the Board in order to further our work to produce realistic, timely, implementable policy recommendations. Specifically, we seek to understand the Board’s position on the scope of operational responsibility and level of liability (related to decision-making on disclosure of non-public registration data) they are willing to accept on behalf of the ICANN organization along with any prerequisites that may need to be met in order to do so. Our goal is to avoid policy recommendations that cement the current situation, where requests for non-public registration data are handled on a case-by-case basis by the registry/registrar in a non-standardized and decentralized manner. We are considering several models for a Standardized System for Access and Disclosure (SSAD), including (but not limited to) the Unified Access Model (UAM) developed by the Technical Study Group. All of the proposed “centralized” SSAD models presume that ICANN will assume an operational role, and, depending upon the model, some degree of responsibility and liability for decisions to disclose non-public data to a third-party requester. In some models, ICANN (or its designee) would approve accrediting bodies, or function as an accrediting body themselves. Some proposed models establish ICANN (or its designee) as the entity that will conduct an initial validation of disclosure requests prior to relaying this request to the appropriate registry or registrar. Other proposed models would require ICANN to play a larger role, either endorsing the legitimacy of the request, or issuing a determination of whether or not the registrar or registry should or must disclose the non-public data to the third party requester. We recognize that our questions are clouded by the uncertainty associated with constructing a model that is compliant with the General Data Protection Regulation (GDPR) and other privacy laws. We are also aware of the work of ICANN org (via the “Strawberry Team”) to engage with data protection authorities to better understand the liability involved in decisions to disclose non-public registration data. As noted above, our goal is to produce realistic, timely, and implementable policy recommendations, and our work requires Board input on the level of involvement and amount of liability they are willing to assume for ICANN org, along with any prerequisites that may need to be met in order to do so. Absent that input, the EPDP work must abandon the centralized SSAD model, and shift its focus to policy recommendations aimed at improving the existing distributed model in which each registry and registrar independently evaluates, applies their own balancing test, and responds to queries on a case by case basis. Thank you, EPDP Phase 2 working group members

9 14

For final review - building block e) retention/destruction of data
by Caitlin Tubergen Oct. 10, 2019

Oct. 10, 2019

Dear EPDP Team, Building Block e (retention and destruction of data) is ready for your final review: https://docs.google.com/document/d/1WMhllLz5Zgm42C4Jfjiqinu32Jwiu_lhuBorzeu… The edit log notes the proposed changes made as a result of Marc A’s suggestions on the email list. Please flag any remaining issues that require further EPDP Team consideration (if any) by Friday 11 October at 22.00 UTC. Thank you. Best regards, Marika, Berry, and Caitlin

2 1

Zoom Security Update
by Nathalie Peregrine Oct. 10, 2019

Oct. 10, 2019

https://www.icann.org/news/blog/zoom-security-update · Author: Ashwin Rangan, SVP Engineering & Chief Information Officer · 10 Oct 2019 · · Zoom recently added new settings to increase security and ensure meeting privacy. These new settings will enforce a password on all new meetings scheduled, but will not affect meetings that have been scheduled prior to 29 September 2019. The only participants who will be required to enter a password are those who join a meeting via the Zoom app and manually type in the meeting ID. Participants who join a meeting via a link in a calendar or e-mail invitation will not be required to enter the password upon joining, as it is included in the URL by default. To learn more about the new settings, please visit the Zoom Help Center and read the FAQ here<https://support.zoom.us/hc/en-us/articles/360033331271>. At the recommendation of ICANN’s internal InfoSec team, these new settings will be enabled immediately. Because the vast majority of ICANN meeting participants join via invitation links, we expect the impact on community members and staff to be minimal. Please reply here or contact the Meetings Technical Services team directly at mts(a)icann.org<mailto:mts@icann.org> if you have any questions or concerns regarding this update. Nathalie Peregrine Manager, Operations Support (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Email: nathalie.peregrine(a)icann.org <nathalie.peregrine(a)icann.org%20> Skype: nathalie.peregrine.icann Find out more about the GNSO by visiting: https://learn.icann.org/ <https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO <https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> See All SO and AC events on the ICANN Global calendar<https://features.icann.org/calendar> Nathalie Peregrine Manager, Operations Support (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Email: nathalie.peregrine(a)icann.org <nathalie.peregrine(a)icann.org%20> Skype: nathalie.peregrine.icann Find out more about the GNSO by visiting: https://learn.icann.org/ <https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO <https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> See All SO and AC events on the ICANN Global calendar<https://features.icann.org/calendar>

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2 | Thursday, 10 October 2019 at 14:00 UTC
by Terri Agnew Oct. 10, 2019

Oct. 10, 2019

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2 held on Thursday, 10 October 2019 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/AYYCBw> (attendance included) and the GNSO Master calendar <https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_en_group…> . These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call, observers can join via audio cast, listen to the recordings and read the transcript afterwards. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Meeting Invitation / Observers / GNSO Temp Spec gTLD RD EPDP-P2 call / Thursday, 17 October 2019
by Terri Agnew Oct. 10, 2019

Oct. 10, 2019

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 17 October 2019 at 14:00 UTC for 120 minutes. (calls will be scheduled for 120 minutes but aim to keep to 90 minutes) 07:00 PDT, 10:00 EDT, 16:00 Paris CEST, 19:00 Karachi PKT, 23:00 Tokyo JST, (Friday) 01:00 Melbourne AEDT For other times: https://tinyurl.com/y3gx4fla Agenda Wiki: https://community.icann.org/x/A4YCBw The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Kind Regards, Terri If needed, an option to join via telephone has been added for this meeting. **New join information - Conference Bridge: Toll-free access number (US and Canada): 800 550 6865 and Toll 213 233 3193 Other telephone numbers found here: http://www.adigo.com/icann Enter passcode on telephone: 7349

1 0

Re: [Gnso-epdp-team] Proposed Agenda - EPDP Team Meeting #24 Thursday 10 October at 14.00 UTC
by Marika Konings Oct. 10, 2019

Oct. 10, 2019

Please note that the hyperlink for item 4 was incorrect. This should have been fixed now. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Tuesday, October 8, 2019 at 14:04 To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Proposed Agenda - EPDP Team Meeting #24 Thursday 10 October at 14.00 UTC Dear EPDP Team, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Thursday 10 October at 14.00 UTC. Best regards, Caitlin, Berry and Marika EPDP Phase 2 - Meeting #24 Proposed Agenda Thursday, 10 October 2019 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Confirmation of agenda (Chair) 3. Welcome and housekeeping issues (Chair) (5 minutes) a) Status of letter to ICANN Board b) Status of building blocks<https://community.icann.org/x/k5ICBw> 4. Accreditation<https://docs.google.com/document/d/1zAEBygpoddKOJOfb1whMtaQHcik856aZZc9BoDk…> (building block f and j) – second reading continued (30 minutes) a) Overview of updates made b) Feedback from EPDP Team c) Confirm next steps 5. Receipt of acknowledgement<https://docs.google.com/document/d/1dSepSTKmaceu3oB1YLpp1wgdrJoERIQq7fg_8Ud…> (building block k) – second reading (15 minutes) a) Overview of updates made following first reading b) Feedback from EPDP Team c) Confirm next steps 6. Response requirements / expectations, including timeline/SLAs<https://docs.google.com/document/d/1KqfkWfbC6gBIrmE3OTTw7MYpThciaMc03Lu6M9s…> (building block g) – first reading (15 minutes) a) Review building block b) Feedback from EPDP Team c) Confirm next steps 7. Wrap and confirm next EPDP Team meeting (5 minutes): a) Thursday 18 October 2019 at 14.00 UTC b) Confirm action items c) Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

3 3

Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter
by Matt Serlin Oct. 10, 2019

Oct. 10, 2019

I believe including that final sentence gets at the heart of the issue with the guidance we are seeking and removing it makes the letter less impactful IMO. Yes, we think the Board and Org do know these things but I think being as explicit as possible with our words will help ensure we get the most clear answer from the Board as possible. Regards, Matt From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of "Mark Svancarek (CELA) via Gnso-epdp-team" <gnso-epdp-team(a)icann.org> Reply-To: "Mark Svancarek (CELA)" <marksv(a)microsoft.com> Date: Wednesday, October 9, 2019 at 3:35 PM To: "James M. Bladel" <jbladel(a)godaddy.com>, "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter I still think it’s better not to close the letter with a threat or even a prediction. The Board and Org know the critical importance of giving us a decision answering this letter. We suggest removing the final sentence. The rest of the letter is great. /marksv From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> On Behalf Of James M. Bladel Sent: Wednesday, October 9, 2019 1:07 PM To: gnso-epdp-team(a)icann.org Subject: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Colleagues – Regarding the draft letter to the Board presented on Tuesday, some members were uncomfortable with the wording of the last sentence. Since that call, I’ve been working with our Board liaisons (Becky and Chris) to make some edits. The resulting Revised Draft copied below. To expedite your review, please note that only the final sentence has changed. Thanks— J. ------------- James Bladel GoDaddy Letter from EPDP 2 to ICANN Board on Standardized System for Access/Disclosure (SSAD) To: ICANN Board CC: Goran CC: GNSO Council Dear ICANN Board, We are writing to you at the suggestion of the EPDP 2 Board liaisons. The working group is at a critical junction which requires clear input from the Board in order to further our work to produce realistic, timely, implementable policy recommendations. Specifically, we seek to understand the Board’s position on the scope of operational responsibility and level of liability (related to decision-making on disclosure of non-public registration data) they are willing to accept on behalf of the ICANN organization along with any prerequisites that may need to be met in order to do so. Our goal is to avoid policy recommendations that cement the current situation, where requests for non-public registration data are handled on a case-by-case basis by the registry/registrar in a non-standardized and decentralized manner. We are considering several models for a Standardized System for Access and Disclosure (SSAD), including (but not limited to) the Unified Access Model (UAM) developed by the Technical Study Group. All of the proposed “centralized” SSAD models presume that ICANN will assume an operational role, and, depending upon the model, some degree of responsibility and liability for decisions to disclose non-public data to a third-party requester. In some models, ICANN (or its designee) would approve accrediting bodies, or function as an accrediting body themselves. Some proposed models establish ICANN (or its designee) as the entity that will conduct an initial validation of disclosure requests prior to relaying this request to the appropriate registry or registrar. Other proposed models would require ICANN to play a larger role, either endorsing the legitimacy of the request, or issuing a determination of whether or not the registrar or registry should or must disclose the non-public data to the third party requester. We recognize that our questions are clouded by the uncertainty associated with constructing a model that is compliant with the General Data Protection Regulation (GDPR) and other privacy laws. We are also aware of the work of ICANN org (via the “Strawberry Team”) to engage with data protection authorities to better understand the liability involved in decisions to disclose non-public registration data. As noted above, our goal is to produce realistic, timely, and implementable policy recommendations, and our work requires Board input on the level of involvement and amount of liability they are willing to assume for ICANN org, along with any prerequisites that may need to be met in order to do so. Absent that input, the EPDP work must abandon the centralized SSAD model, and shift its focus to policy recommendations aimed at improving the existing distributed model in which each registry and registrar independently evaluates, applies their own balancing test, and responds to queries on a case by case basis. Thank you, EPDP Phase 2 working group members

7 9

FW: Updated Language Regarding Purposes
by Margie Milam Oct. 10, 2019

Oct. 10, 2019

Ugh—suggestions for dealing with this? From: Amr Elsadr <aelsadr(a)icannpolicy.ninja> Reply-To: Amr Elsadr <aelsadr(a)icannpolicy.ninja> Date: Wednesday, October 9, 2019 at 4:34 AM To: Margie Milam <margiemilam(a)fb.com> Subject: Re: Updated Language Regarding Purposes Hi Margie, Thanks for this. I’m still having trouble with the reference to Article 5.1.b, and its applicability here. The ICO guidance on the purpose limitation principle has only reinforced this (https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-…<https://urldefense.proofpoint.com/v2/url?u=https-3A__ico.org.uk_for-2Dorgan…>). The explanation of what the principle is, as well as the checklist associated with it all indicate to me that it is applicable to the Data Controller, not a 3rd party/Requestor for disclosure/access. My thinking is that if we are to proceed as you have suggested in your email below, the process needs to loop in the Data Controller, somehow. Some reasons why this might be necessary: 1. It shouldn’t be up to the 3rd party to determine what additional purposes are or are not compatible. Ultimately, the Data Controller and Processor will be held accountable by the data subject, and possibly liable by a DPA for errors in judgment on this, so should be looped in. 2. If the Controller is not (at a minimum) informed of additional purposes for which the personal data will be processed, I’m not sure how the Controller will track and keep records of how the data that was disclosed will be or was processed. 3. If the Data Subject requests access to a report on how its personal data has been processed, it would need to make this request to the Controller with which it is familiar (likely the registrar). If the Controller is not involved in the decision to process the personal data for additional compatible purposes, it will not be in a position to provide the Data Subject with a complete report on how the data was, or is being, processed, at least not until (or if) an audit is conducted. So let’s say there is a scenario where a Requestor has been granted disclosure/access to the personal data for a specific purpose, then discovers that there is(are) additional purpose(s) for which the personal data needs to be processed further. This could be for compatible purposes, or other unrelated ones (but still fulfilling the requirements of a legitimate interest of the Requestor and supported by a legal basis). It’d make sense to me, that in this kind of scenario, some follow-up to the original request for disclosure be available where the Requestor communicates the need for further processing in the SSAD, and that there is some need for the Controller to make a decision on wether to grant permission for this additional processing. Also, since this would be a follow-up to a previously approved disclosure request, it might make sense that the follow-up is flagged for a quicker response time of the request for additional processing of the personal data for additional purposes (compatible or unrelated). This could possibly be reflected in Building Blocks G and K? I know this adds an administrative layer, and slightly slows things down, but it provides more certainty in the process as a whole, doesn’t it? I believe it would be necessary in order to protect the rights of all parties involved, as well as provide the transparency in processing that you referred to in your proposed amendment to subsection C of Building Block D. If you agree with any of this, in principle, we can try some wordsmithing of the proposed amendment. If you have concerns, let’s try to address them first. Thanks again, Margie. Amr On Oct 8, 2019, at 6:53 PM, Margie Milam <margiemilam(a)fb.com<mailto:margiemilam@fb.com>> wrote: Hi Amr – Following up on today’s homework – here’s a link to information from the UK Information Office that can help guide the drafting of this section: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-…<https://urldefense.proofpoint.com/v2/url?u=https-3A__ico.org.uk_for-2Dorgan…> Here’s what I suggest: The building block should use this language: “not incompatible with the original purpose, provided the new purpose is fair, lawful and transparent.” The policy recommendation would also need to include specific disclosures to the registrant, describing the common purposes for 3rd party access, so that the transparency requirement is met. Margie

4 3

RySG comments on lawful basis matrix
by Crossman, Matthew Oct. 10, 2019

Oct. 10, 2019

All, Attached are the RySG comments on the lawful basis / building blocks matrix. Best, Matt Matthew Crossman | Amazon Corporate Counsel gTLD Registry, IP P: 206-266-1103 | C: 530-574-2956 Email: mmcross(a)amazon.com<mailto:mmcross@amazon.com>

1 0

Re: [Gnso-epdp-team] Updated Language Regarding Purposes
by Margie Milam Oct. 9, 2019

Oct. 9, 2019

Message Recall Sent from my iPhone > On Oct 9, 2019, at 11:37 AM, Margie Milam <margiemilam(a)fb.com> wrote: >

1 0