- Gnso-epdp-team - lists.icann.org

Re: [Gnso-epdp-team] [Ext] Re: Proposed agenda and materials for review - EPDP Team meeting Thursday 13 June at 14.00 UTC
by Marika Konings June 17, 2019

June 17, 2019

Thanks, Hadia for your feedback. If other EPDP Team members have additional suggestions or would like to share their thoughts on the approach proposed by Hadia, you are encouraged to do so in advance of tomorrow's EPDP Team meeting. Best regards, Caitlin, Berry and Marika On 6/12/19, 12:58, "Hadia Abdelsalam Mokhtar EL miniawi" <Hadia(a)tra.gov.eg> wrote: Dear Janis, Thank you for outlining the charter section that is in relation to our work, however I do not see any contradiction between what I meant and the charter's question "a1) Under applicable law, what are legitimate purposes for third parties to access registration data? The draft document circulated by staff says that the 3rd party purposes have been inspired/derived from the community responses to a request from ICANN at the end of June 2017 to identify user types and purposes of data elements required by ICANN policies and contracts. So instead of being driven by some data that was collected in 2017 which might include purposes that are not GDPR compliant, why not rely on our work that was developed in phase 1 - which actually stems from ICANN's purposes - and make this our base for identifying the users' types and purposes. Article 5 (1)b of the GDPR - Purpose limitation -says that the data needs to be collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes Using our work as the starting point and base to identify the users and their purposes rather than previously collected data would yield to more up to date results. So yes, my below points are not quite accurate, as for sure we shall need to refer to the third parties purposes when identifying the lawful basis and the data elements. But generally speaking I would like our starting point in identifying the users of the SSAD to be our previous work in phase 1 and not previously collected data that was in relation to the retired WHOIS and was prior to the GDPR and the temp Spec and could be debated forever. I hope my thoughts are clearer this time and better organized Regards Hadia ________________________________ From: Janis Karklins <karklinsj(a)gmail.com> Sent: 12 June 2019 18:45 To: Hadia Abdelsalam Mokhtar EL miniawi Cc: Marika Konings; gnso-epdp-team(a)icann.org Subject: Re: [Gnso-epdp-team] Proposed agenda and materials for review - EPDP Team meeting Thursday 13 June at 14.00 UTC Dear Hadia, Thank you for your mail outlining your view on the scope of our task. I just checked the Charter and found the following tasks: ... (page 7) System for Standardized Access to Non-Public Registration Data Work on this topic shall begin once the gating questions above have been answered and finalized in preparation for the Temporary Specification initial report. The threshold for establishing “answered” for the gating questions shall be consensus of the EPDP Team and non-objection by the GNSO Council. (a) Purposes for Accessing Data – What are the unanswered policy questions that will guide implementation? a1) Under applicable law, what are legitimate purposes for third parties to access registration data? a2) What legal bases exist to support this access? a3) What are the eligibility criteria for access to non-public Registration data? a4) Do those parties/groups consist of different types of third-party requestors? a5) What data elements should each user/party have access to based on their purposes? a6) To what extent can we determine a set of data elements and potential scope (volume) for specific third parties and/or purposes? a7) How can RDAP, that is technically capable, allow Registries/Registrars to accept accreditation tokens and purpose for the query? Once accreditation models are developed by the appropriate accreditors and approved by the relevant legal authorities, how can we ensure that RDAP is technically capable and is ready to accept, log and respond to the accredited requestor’s token? ... How would you reconcile your view with task a1 of the Charter? I simply want to understand different points of view to prepare better for the team meeting tomorrow. Thank you JK On Wed, Jun 12, 2019 at 3:03 PM Hadia Abdelsalam Mokhtar EL miniawi <Hadia(a)tra.gov.eg<mailto:Hadia@tra.gov.eg>> wrote: Dear Staff, Thank you for the submitted document, however I have fundamental comments in relation to the logic through which we are handling the first topic of the SSAD that is defining the user groups and data elements • The EPDP team should be considering only ICANN purposes and not third parties' purposes, for this reason the starting point in defining the users of the system should be the ICANN purposes previously defined in phase1. Whilst purpose 2 could be considered serving the public interest by maintaining the security, stability and resiliency of the DNS in accordance to ICANN's mission and bylaws • So our starting point should be to analyze each of the 7 ICANN purposes to determine 1)who needs to access the registration data in order to fulfill this purpose 2)which parts of the data does he need to access in order to fulfil the purpose • Stemming from the above will originate all of the user groups and categories as well as the data elements, like the ones in the sheets. We must remember that third parties' purposes are not our objectives but fulfilling ICANN's purposes is our objective and in satisfying ICANN's purposes access or disclosure to certain parts of the data is required for several types of users. Kind regards Hadia From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>] On Behalf Of Marika Konings Sent: Tuesday, June 11, 2019 3:41 PM To: gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] Proposed agenda and materials for review - EPDP Team meeting Thursday 13 June at 14.00 UTC Dear EPDP Team, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Thursday 13 June at 14.00 UTC. For agenda item 6c, you will find attached an initial draft of the agenda for the F2F meetings at ICANN65 – if you have any comments or suggestions, you are encouraged to share these. Please also review the document for agenda item 4 in advance of the meeting. Best regards, Caitlin, Berry and Marika ====================== EPDP Phase 2 - Meeting #6 Proposed Agenda Thursday, 13 June 2019 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Confirmation of agenda (Chair) 3. Welcome and housekeeping issues (Chair) (10 minutes) • Working definitions – confirm posting of updated version on wiki • Legal advisory group – nominations received to date • SSAD Priority 1 worksheet status 4. SSAD – Topic c: Define user groups, criteria and purposes / lawful basis per user group (Marika) (40 minutes) a. Review purpose template developed by staff support team (see attached) b. EPDP Team input c. Confirm next steps 5. Presentation by Steve Crocker (40 minutes) a. Presentation b. Q & A 6. Any other business (5 minutes) a. Priority 2 small team meetings update Reminder - Call schedule remaining priority 2 worksheets: • Monday 17 June – 13:00 – 14:30 UTC Potential OCTO Purpose Feasibility of unique contacts to have a uniform anonymized email address • TBC (post ICANN65) Accuracy and WHOIS ARS Deadline for providing input for those that were not able to attend the calls – proposed 20 June 2019. b. Confirm attendance for meeting on Thursday 13 June at 14.00 UTC c. ICANN65 EPDP Team meetings - Initial Draft Agenda (see attached) 7. Wrap and confirm next meeting to be scheduled for Thursday, 13 June at 14.00 UTC (5 minutes) a. Confirm action items b. Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_… ) and the website Terms of Service (https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_… ). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

3 2

legal advice and budget
by Greg Aaron June 17, 2019

June 17, 2019

Janis, if more budget may be needed for legal advice, can you start the process of acquiring it? Marika noted in chat today: "Do also note that there is a limited budget available - passing all these questions on may take up most of that budget which might prevent follow up on any further questions the group may have." This PDP is fundamentally about legal issues, and having access to legal advice is essential. This is a place where ICANN should be spending resources. Please see SAC104, where SSAC raised this issue to the Council last December: "2.2 Legal Advice v The EPDP has been largely about legal issues, but the EPDP team has not [always] had access to neutral, expert, outside legal advice. [Bird & Bird was not retained until late into Phase 1.] This is a notable omission given the consequences and regulatory complexity of the work. The SSAC urges the GNSO Council to re-examine this as further policy-making takes place in 2019 and beyond. This subject is a worthy place to spend ICANN budget given the priority and nature of the work, and a place to apply all the professional tools at ICANN's disposal, in order to carry out ICANN's responsibility to ensure the stable and secure operation of the Internet's unique identifier systems. . neutral legal advice would provide substantial benefit by fostering common understandings, consensus, and confidence in the deliberations and work product. In particular, it may help policy-makers understand the options available to them, given that bodies such as the European Data Protection Board and the national data commissioners are not in a position to answer many questions or evaluate policy proposals." https://www.icann.org/en/system/files/files/sac-104-en.pdf

7 7

Unique Contacts references
by Alex Deacon June 17, 2019

June 17, 2019

Hi. Based on an action I took this morning I have added the following two references to the Unique Contacts worksheet at ( https://docs.google.com/document/d/1meyuNRsq4sMOI6pefJk4jZevaKUsTkVf8_XyW1t…) - EWG Final Report Section V. pp 68-80 - https://www.icann.org/en/system/files/files/final-report-06jun14-en.pdf - Specifies a framework for Contact ID’s associated with Purpose Based Contacts. - Public Whois Attributes, Securely Hashed (WhASH) - https://www.icann.org/en/system/files/correspondence/jevans-to-marby-et-al-… - Describes a method for Hashing Point of Contact Details in Public Domain Name Whois Thanks! Alex ___________ *Alex Deacon* Cole Valley Consulting alex(a)colevalleyconsulting.com +1.415.488.6009

1 0

Recordings, Attendance & Zoom Chat / EPDP-Phase 2 - work on priority 2 worksheets / Monday, 17 June 2019 at 13:00 UTC
by Terri Agnew June 17, 2019

June 17, 2019

Dear all, Please find the attendance attached to this email, and links to the audio recording, zoom recording (audio, visual, rough transcript) and chat below from the The EPDP-Phase 2 work on priority 2 worksheets - Potential OCTO Purpose Feasibility of unique contacts to have a uniform anonymized email address held on Monday, 17 June 2019 at 13:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/roejBg Audio Recording: https://icann.zoom.us/recording/play/UeuiGXKQ4ioHrNASGSCzoKnn1jzcs3SsKzwC4g… Zoom Recording (includes visual and rough transcript. To access the rough transcript, select the Audio Transcript tab): https://icann.zoom.us/recording/share/5g1yWGt_tfoPG7I_YFw5ex2uRBsoatMQzSNcz… Chat: https://icann.zoom.us/recording/download/nDHT3n00Ft2sUO-GlGllWgNhIpHIUP3Bey… ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Terri

1 0

**Update / Change in permissions for Google Doc worksheets
by Terri Agnew June 14, 2019

June 14, 2019

Hello EPDP Team, We are missing a handful of google account email addresses for some team members/ alternates, please send off list to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> to be added. For those team members/ alternates who provided their google account email address, we have adjusted from view only to comments. Have a lovely weekend, Terri From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Friday, June 14, 2019 at 7:36 AM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Change in permissions for Google Doc worksheets Dear EPDP Team, As noted during yesterday’s meeting, we are having issues with non-EPDP Team members making changes to the google docs that are out for review. As a result, we have now switched all worksheets to view only until we have been able to add your google account information individually. This means that for now you are not able to see any edits or comments (in view only mode, these are not visible) but if needed, we can pull down the latest version and post it as a pdf on the wiki page. We hope to have comment settings restored shortly. If you have not done so yet, please send your google account email address off-list to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org>. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Change in permissions for Google Doc worksheets
by Marika Konings June 14, 2019

June 14, 2019

Dear EPDP Team, As noted during yesterday’s meeting, we are having issues with non-EPDP Team members making changes to the google docs that are out for review. As a result, we have now switched all worksheets to view only until we have been able to add your google account information individually. This means that for now you are not able to see any edits or comments (in view only mode, these are not visible) but if needed, we can pull down the latest version and post it as a pdf on the wiki page. We hope to have comment settings restored shortly. If you have not done so yet, please send your google account email address off-list to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org>. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

For your review: updated Priority 2 worksheets
by Caitlin Tubergen June 13, 2019

June 13, 2019

Dear EPDP Team: Thank you to those of you who attended the Priority 2 worksheet calls. For those of you who were unable to attend, please review the updates made to the worksheets and note any concerns with the proposed edits by Thursday, 20 June. Thus far, we have reviewed the following worksheets: Display of information of affiliated vs. accredited privacy/proxy providers: https://docs.google.com/document/d/1izpX2C-RrfAdRgRDwBO9tQuJIBA9Xt38p1MTJgQ… Legal vs. Natural: https://docs.google.com/document/d/1vEetjWuRlf2uvCCUREHf9G7ac5z2hk_sgGiOSJC… Redaction of City Field: https://docs.google.com/document/d/1rdtRLaNm5DiWR_EPei4Oi64FaDauIXEQhnF2Lm_… Data retention: https://docs.google.com/document/d/1xlw1N7omlgPKjag_FnOy03NRvByol8IaJma5zNP… As a result of the review of the legal vs. natural worksheet, the small group agreed to pose the following question to ICANN org: Can ICANN org please provide a list of the current notices registrars are required to provide to registrants? If you have any objection to the above question, please respond to the list by Thursday, 20 June. Best regards, Marika, Berry, and Caitlin

1 0

legal briefing
by Thomas Rickert June 13, 2019

June 13, 2019

Hi Caitlin, During yesterday’s call I made a suggestion for a legal briefing and you asked me to write my proposal to the list, which I gladly do with this note: I think that the entire EPDP Team and our report would benefit from a general briefing on data retention and deletion. This shall inform our work and our report on what retention periods can be applied for what data elements based on what grounds and also how to implement the deletion of data elements after the retention period has expired. While we discussed this in connection with a work sheet, I think a general briefing would be good as we will have to think about retention / deletion questions with respect to access/disclosure and related queries, which may also contain personal data. I am happy to provide more information if you wish. Best, Thomas

2 1

Notes and action items from EPDP Call #6 - 13 June 2019
by Caitlin Tubergen June 13, 2019

June 13, 2019

Dear EPDP Team, Please find the notes and action item’s from today’s EPDP call below. As a reminder, the next EPDP Team meeting will be Thursday, 20 June at 14:00 UTC. The Priority 2 meeting for worksheets on OCTO purpose and feasibility of unique contacts for anonymized email addresses will be Monday, 17 June at 1300 UTC. Thank you. Best regards, Marika, Berry, and Caitlin -- EPDP Meeting #6 13 June 2019 Action Items Thomas Rickert to provide an IP infringement scenario by Tuesday, 18 June to be discussed with the Team during a future meeting. Thomas to coordinate with EPDP Support Staff as necessary. EPDP Team to review the list of third party purposes and provide additions, edits, and comments by Tuesday, 18 June. (Note: please be prepared to discuss Thomas’ example and the law enforcement example during the next meeting on Thursday, 20 June.) EPDP Team members to please provide Google account info to the GNSO Secretariat (gnso-secs(a)icann.org) as soon as possible. Notes These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/ZwPVBQ. 1. Roll Call & SOI Updates (5 minutes) Attendance will be taken from Zoom Remember to mute your microphones upon entry to Zoom, which is typically the first icon on the left on the bottom toolbar. Please state your name before speaking for transcription purposes. Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team 2. Confirmation of agenda (Chair) 3. Welcome and housekeeping issues (Chair) (10 minutes) a. Working definitions – confirm posting of updated version on wiki · Working definitions have been amended as previously discussed and have been posted on the wiki. This will be a reference document we refer to during our work. b. Legal advisory group – nominations received to date · During the last meeting, we agreed to have a representative legal committee, similar to the legal committee from Phase 1. Each group was invited to nominate one person for the representative legal committee and provide the nomination to the Chair in advance of this meeting.  · Margie Milam and Laureen Kapin will be added to the list. · NCSG is concerned with the number of representatives from each group. During Phase 1, it was challenging for NCSG to only have one representative for the group. From a practical perspective, it would be helpful for the NCSG to have 2-3 members instead of one. · If a nominated representative cannot make the meeting, another member of that group could step in. Additionally, the legal committee’s proposals will go before the plenary team. · The Team should strive for how to get the maximum from legal counsel. The added value is not the outcome or the conclusion, but rather, the background work that would go before legal counsel. · Perhaps a mailing list could be set up for this group so that other groups can follow the work and can be continuously engaged. · The meetings of the legal committee will be public, so multiple members may attend, but only legal committee members will be invited to speak. The mailing list will also be publicly archived. · With that understanding, we will await nominations from NCSG and proceed as noted above. c. SSAD Priority 1 worksheet status · Support Staff distributed an email yesterday, noting that the updated worksheet was posted to the wiki. Three versions were posted: the clean version, the redline version, and the archived version. · For the updates made, Support Staff focused on comments regarding the order of topics. Proposed changes to charter questions were not considered at this time. Similarly, substantive comments on topics are visible in the archived version of the worksheet, but were not added to the clean version. · All members should have received an email from GNSO-Secs, asking for google account information so that only authorized users can edit and provide topics due to unauthorized users removing members’ comments. Please send your google account information to the GNSO-Secs at your earliest convenience. · The worksheet will be a living document. 4. SSAD – Topic c: Define user groups, criteria and purposes / lawful basis per user group (Marika) (40 minutes) a. Review purpose template developed by staff support team (see attached) · This document starts with third party purposes/legitimate interests · Further to the discussion during the last meeting, we used the spreadsheet of third party purposes previously submitted to ICANN. · There were a number of third party purposes that noted the ability to contact the registrant, but this seems to have been covered in the Phase 1 recommendations and is not included here. · Support Staff also attempted to develop a template for the third party purposes/legitimate interests. · Support Staff’s understanding is that third party legitimate interests do not have to be identical to the purposes for which the data is collected. · The charter questions refer to purposes for third parties, but the Team may want to consider using a different term. · If the EPDP Team wants to progress, discussion needs to be cooperative. There were some immediate reactions when Marika began to speak. Why is that reaction coming now? Why not provide feedback when the document was posted? We started with groups, then the Team told to use purposes, which is why the document is structured in this way. Please keep the conversation cooperative. b. EPDP Team input · Beginning with purposes makes sense. · Starting with user groups is problematic. We are walking a fine line by trying to create legitimate purposes. We should exercise caution here. · Third parties will need their own purposes for disclosure. With respect to the approach and starting point, we should not start from scratch with data elements that were collected in 2017. · The language during the last meeting was sloppy when we referred to purposes instead of legitimate interests. We need to look at the specific request for specific data elements. For example, for the sake of argument, academic research could be a legitimate third party interest. There is now a problem of people disguising themselves as academics to get data for another reason. What justifies this particular academic research? What about anonymization? · These discussions seem to go in circles. If we refer to the charter questions, they get us where we need to be. We can debate the terminology there, but we shouldn’t get wrapped up in other important details because they will be addressed later on. Suggest sticking to the framework of the charter without getting into the details that will be discussed later. · It may be helpful to talk through a scenario. · The Team does not have to be all-encompassing with the user groups. An ice cream truck may have a legitimate interest, but we may want to exclude certain groups b/c they can avail themselves through other means. Otherwise, we risk getting too granular. · Our presumption in doing this exercise is not that b/c you fall into a group, you automatically get data. Our presumption is that some groups may be easy ones (like a UDRP case) where human review may not be necessary. Academic researchers are so varied and require so much data that manual intervention will likely be necessary. Edge cases will be there, but that is not our problem today. · Third party requests will not be treated the same way they were in the past. The edge cases are instructive and a lot of bulk requests from the past will turn into edge cases. It’s useful to go through the ice cream truck example. · The group seems willing to review one scenario or purpose (preferably not use legal terminology at this stage) and go through a test case. The law enforcement example is interesting - GDPR has a different legal basis - 6(1)(c) - this may take the group down a rabbit hole. Suggestion: let’s look at a scenario that contracted parties deal with everyday. Companies go to contracted parties based on their trademarks due to cybersquatting. · Would it be possible to write up the scenario for our next meeting? · Would the Team be open to Thomas writing up a scenario re: IP infringement to be discussed at a future meeting. c. Confirm next steps · Thomas Rickert to provide a write up of an IP infringement scenario to be discussed with the Team during a future meeting. Thomas to coordinate with staff as necessary. · EPDP Team to review the list of purposes and provide additions, edits, and comments by Tuesday, 18 June. · EPDP Team to review the law enforcement example and be prepared to discuss by the next meeting. 5. Presentation by Steve Crocker (40 minutes) a. Presentation · This group is wrestling precisely the hard problems, but we are building tools that may be helpful. · An informal group, with no charter, no authority, and no funding has been meeting to discuss these issues. The members of the group have been asked not be named, and will be referred to as the Barbecue Group. · The basic intentions over time have been privacy vs. accuracy vs. efficiency. · GDPR has been like throwing dynamite into the logjam. It is a blunt instrument and does not provide detailed guidance. · BBQ is looking at all information - very wide spectrum from publicly available info (DNS records) to sensitive information (credit card info and account passwords). · This is intended to be descriptive, not prescriptive. · Policy flows from various authorities to contracted parties and registrants. · Data flows from the registrants through registrars and registries. · Then you have requests from various requestors. · When an individual registers a domain name, a lot of information is requested and that is the registrar policy. Some of that is determined by the registrar, but a lot of it is determined by the authorities it reports to. · .com and .info are subject to ICANN and GDPR · .cn is governed by national gov’t · The representation of the overhanging authorities is that they specify a set of policies. Registrars collect a lot of data internally that is not passed on to the registry. Registries may or may not leave it up to the registrar. · With an explicit representation of the policy sets and policies, it can point the inconsistencies and bring them to the surface. · Under collection and disclosure, the collection side of this is what data is collected starts with a dictionary of data elements - may include elements not in the Phase 1 report and what the purpose is of each data element. The policy defines whether the data element is required, optional, or forbidden. · On the disclosure side, typically, if you ask for the record related to a particular domain, the collection organization will give the record or not. This group is looking into the variation of this - public access, intermediate access, or law enforcement access. · Each data element has two sensitivity levels: disclosure level - public, if the disclosure level is above public, the acknowledgement level, which is no higher than the disclosure level · Slide 12 is a 100,000 foot level: the distinction b/w the blue and the green: the green is the policy of this particular organization (policy that the registrar has). The blue is the cumulative effect of a series of higher order authorities. · The account holder which is sometimes distinct from the registrant does not get mentioned in any of the policy issues. The registrar knows who the account holder is but that information is not typically passed to the registry. b. Q & A · Sensitivity levels of data/requests was mentioned earlier: sensitive data refers to categories of data in the GDPR. What does sensitivity of requests mean? · Answer: Registrar collects information, someone asks for the record - what they get depends on who they are and what they’re asking for. The requests are not down to “I want this data element but not this”. Instead, they ask for all of the data they can have based on who I am. The DNS records are public. Registrant contact information is sensitive, so there may be different levels of sensitivity. The other half of the question - who gets to see that, and who determines what their privilege is. That will not be determined within this framework. This framework focuses on decision processes. · A particular request would have a detailed request of what data elements are requested, and this was deemed unwieldy. · We require registrars to collect billing contacts - they do not use it for billing, and it is not published in WHOIS, yet we continue to insist that registrars collect that. Putting it all in the same place is helpful. · Is the work you presented funded in whole or in part from a third party or for the benefit of a third party? · Answer: There is no funding from a third party, and the benefit is for the internet. · Will the other BBQ participants disclose their identities? · Answer: It is not something that has been discussed that this time. · For a data request, you have to say who you are, what your legitimate interest, legal basis. · This is not intended to be a design that leads directly to implementation. It is a conceptual framework. It could include different kinds of requests that are below the level of discourse this group is handling. · How does the model take into consideration data flows that cross jurisdictions? · Answer: In some sense, the BBQ group is looking at a uniform picture of Rrs and Rts all over the world. Each Rr is controlled by one or more superior authorities. Can we lay out what the policy sets are for each of those groups. It is intended to apply equally to a ccTLD operating in Europe that is not subject to ICANN but is subject to GDPR and various national requirements. · Did this group do a data protection impact assessment (a DPIA)? Overcollection of data is classic overcollection, and if it still around anywhere (even data escrow), it has to be deleted. If you allow people or organizations to say do not release my data based on the sensitivity, but we have not done that yet. · Answer: This group has not performed a DPIA. · We have the TSG, the BBQ group, an announcement from PwC - question - how can we best synthesize all of these parallel tracks and proposals and synchronize them with the policy questions? · Answer: The other pieces are complementary. In terms of integration, that is a question to Janis. · This presentation is to stimulate the group’s thinking. 6. Any other business (5 minutes) a. Priority 2 small team meetings update Reminder - Call schedule remaining priority 2 worksheets: · Monday 17 June – 13:00 – 14:30 UTC Potential OCTO Purpose Feasibility of unique contacts to have a uniform anonymized email address · TBC (post ICANN65) Accuracy and WHOIS ARS Deadline for providing input for those that were not able to attend the calls – proposed 20 June 2019. Confirm attendance for meeting on Thursday 20 June at 14.00 UTC · Confirmed - next meeting will be Thursday, 20 June at 14:00 UTC 7. Wrap and confirm next meeting to be scheduled for Thursday, 13 June at 14.00 UTC (5 minutes) Confirm action items Confirm questions for ICANN Org, if any

3 2

Recordings, Attendance & Zoom Chat / EPDP - Phase 2 / Thursday, 13 June 2019
by Terri Agnew June 13, 2019

June 13, 2019

Dear all, Please find the attendance attached to this email, and links to the audio recording, zoom recording (audio, visual, rough transcript) and chat below from the EPDP – Phase 2 call held on Thursday, 13 June 2019 at 14:00 UTC. These have also been posted on the agenda wiki page: Audio Recording: https://icann.zoom.us/recording/play/e7zTGEY8-E5IKoDtCUIsAvynS5TQYG8pDN1RXW… Zoom Recording (includes visual and rough transcript. To access the rough transcript, select the Audio Transcript tab): https://icann.zoom.us/recording/share/-ihXiG1OL3Y7ILAgZ8zsY7AYP6KKjVroqZ5hs… Chat: https://icann.zoom.us/recording/download/wwU9PKs2nfUizaGmxpAuVvnzdfbqCnST8J… ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Terri

1 0