- Gnso-epdp-team - lists.icann.org

**Reminder** Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 18 December 2018
by Julie Bisland Dec. 17, 2018

Dec. 17, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/BQvVBQ Thank you. Kind Regards, Andrea

1 0

Additional Information - Accuracy
by Margie Milam Dec. 14, 2018

Dec. 14, 2018

Hi- I was asked to provide further background for the accuracy discussion after yesterday’s EPDP call. Here is some information to frame our further analysis: SCOPE This EPDP was chartered “to determine if the Temporary Specification...should become an ICANN Consensus Policy, as is or with modifications, while complying with the GDPR and other relevant privacy and data protection law.” In order to fully comply with GDPR, data -- the very subject of this EPDP -- is required to be accurate. According to Article 5.1(d) of the GDPR, personal data shall be "accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay." Article 39 also has similar language. Within the GDPR, this is the second of three principles about data standards, along with data minimization and storage limitation that needs to be addressed. While we have had much discussion about data minimization and storage limitations, what’s clearly missing to finalize our deliberations and output about data standards is our discussion about data accuracy requirements. The ico. (Information Commissioner’s Office in the UK) points out in its writings on “Principle (d): Accuracy”<https://urldefense.proofpoint.com/v2/url?u=https-3A__ico.org.uk_for-2Dorgan…> that one of the new features of GDPR as compared to the principles under its predecessor is that there is now a “clearer proactive obligation to take reasonable steps to delete or correct inaccurate personal data.” The ICO notes that while “[t]here are clear links here to the right to rectification, which gives individuals the right to have inaccurate personal data corrected” … “[i]n order to ensure that your records are not inaccurate or misleading in [the case of personal data someone else provides], you must: … * take reasonable steps in the circumstances to ensure the accuracy of the information; and * carefully consider any challenges to the accuracy of the information.” The ico. goes on to say that “The more important it is that the personal data is accurate, the greater the effort you should put into ensuring its accuracy. So if you are using the data to make decisions that may significantly affect the individual concerned or others, you need to put more effort into ensuring accuracy. This may mean you have to get independent confirmation that the data is accurate.” We can all agree that the accuracy of domain name ownership is paramount to collection of WHOIS/Registered Name Holder data in the first instance. In addition, since this data will be used by others (with a lawful interest), ensuring that it is accurate for them is relevant. This isn’t a new concept for discussion, as you may recall that the European Commission’s technical input on ICANN's proposed GDPR-compliant WHOIS models<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_syste…> underscored the GDPR's "Accuracy" principle and made clear that “reasonable steps should be taken to ensure the accuracy of any personal data obtained” for WHOIS databases and that ICANN should be sure to incorporate this requirement in whatever model it adopts. The ico. points out that<https://urldefense.proofpoint.com/v2/url?u=https-3A__ico.org.uk_for-2Dorgan…> “[o]ne of the biggest changes introduced by the GDPR is around accountability – a new data protection principle that says organisations are responsible for, and must be able to demonstrate, compliance with the other principles ... [y]ou now need to be proactive about data protection, and evidence the steps you take to meet your obligations and protect people’s rights.” With the main thrust of the EPDP being to ensure that the WHOIS policies ICANN and the contracted parties adopt comply with the principles of the GDPR, these accountability principles shouldn’t be taken lightly. Consistent with these commitments and the GDPR, accuracy is an issue fully within scope of the EPDP so that ICANN and contracted parties proactively address how they will ensure the accuracy of data in the first place, not just how they rectify inaccurate data brought to their attention after collection -- we simply see no way around the EPDP affirmatively addressing the GDPR’s accuracy principle in our deliberations and output. Especially since accuracy is addressed in the Temp Spec itself (see 4.1), which states ICANN is responsible for “Maintenance of and access to accurate and up-to-date information concerning registered names and name servers”. OUTPUT/COMPLIANCE Dbata accuracy needs to be addressed both proactively as well as retroactively. As the ico. states<https://urldefense.proofpoint.com/v2/url?u=https-3A__ico.org.uk_for-2Dorgan…> “Accountability is not a box-ticking exercise. Being responsible for compliance with the GDPR means that you need to be proactive and organised about your approach to data protection, while demonstrating your compliance means that you must be able to evidence the steps you take to comply.” The ico. goes onto say that “Documenting this information is a great way to take stock of what you do with personal data. Knowing what information you have, where it is and what you do with it makes it much easier for you to comply with other aspects of the GDPR such as making sure that the information you hold about people is accurate and secure.” (emphasis added) To that end, the WHOIS policy developed by the EPDP needs to incorporate steps for contracted parties to be in compliance with the GDPR – accuracy being one facet of compliance. The WHOIS Accuracy Reporting System Reports showed that the accuracy levels are unacceptably low. We see the policy discussion on accuracy focused in three areas: Collection: At intake, we should consider whether the current forms of validation are sufficient. In this regard, it may be useful to include in the ccTLD survey a request to see what validation is done by the EU based ccTLDs. Maintenance: Once data is collected, Article 5 of the GDPR says that data must be “kept up to date”, which seemingly requires some sort of process that could be developed. Rectification: Article 5 of the GDPR says that ICANN and the contracted parties must “ensure that personal data that are inaccurate … are erased or rectified without delay” and so, a uniform method to report and rectify inaccurate data could be considered. Because there are so many facets to this conversation, perhaps the best way to address this is to talk about this in Toronto, at our F2F. All the best, Margie

6 9

Re: [Gnso-epdp-team] Public comment - Google form question
by Caitlin Tubergen Dec. 14, 2018

Dec. 14, 2018

Hi Kristina, Thank you for the question. The short answer is no – yes/no questions are not required to be answered to continue through the Google form. The only exception is the four questions marked with a red asterisk. These questions appear on pp. 1-2 of the form. Specifically, a commenter must fill out their email address, name, affiliation, and answer yes/no to specify if they are answering questions on behalf of another group. Please let me know if you have additional questions. Best regards, Marika, Berry, and Caitlin From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of "Rosette, Kristina via Gnso-epdp-team" <gnso-epdp-team(a)icann.org> Reply-To: "Rosette, Kristina" <rosettek(a)amazon.com> Date: Friday, December 14, 2018 at 8:45 AM To: GNSO EPDP <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Public comment - Google form question Hi, A question has come up about the Google form being used for public comments: For the “yes/no” questions, is the person completing the form required to select “yes” or “no” in order to progress through the form? Thanks!! Kristina Kristina Rosette Senior Corporate Counsel, IP – Domains rosettek(a)amazon.com | 703.407.1354

1 0

Public comment - Google form question
by Rosette, Kristina Dec. 14, 2018

Dec. 14, 2018

Hi, A question has come up about the Google form being used for public comments: For the "yes/no" questions, is the person completing the form required to select "yes" or "no" in order to progress through the form? Thanks!! Kristina Kristina Rosette Senior Corporate Counsel, IP - Domains rosettek(a)amazon.com<mailto:rosettek@amazon.com> | 703.407.1354

1 0

REMINDER: Doodle / Legal Committee Framework (only confirmed reps)
by Terri Agnew Dec. 14, 2018

Dec. 14, 2018

**Reminder, only EPDP Members or Alternates who will be the confirmed rep for each group should complete the doodle. Hello all, Only the confirmed reps for each group, please complete the doodle to schedule a Legal Committee Framework call next week. Doodle: https://doodle.com/poll/2abn9v99y8kwu8hu I have enabled the time zone so that it can be changed to your zone. With kind regards, Terri From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Berry Cobb Sent: Thursday, December 13, 2018 8:54 AM To: gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] ACTION REQUIRED - Legal Committee Framework Hi All, Per today's discussion on establishing the standing legal committee framework, please designate one member or alternate from your respective group. The preference is that committee members are currently practicing attorneys. Where one is not available in your group, then please chose a representative that you think is best capable to manage request for legal advice. Please provide the selection for your respective group to the mailing list by 18 December 2018 prior to our next EPDP call. The following list is a suggestion of who might join the committee, but ultimate a decision for you respective group: * Board - Leon * BC - Margie * IPC - Diane * ISPCP - Thomas * NCSG - Tatiana * RySG - Kristina * RrSG - Volker * GAC - Laureen * ALAC - Alan G. * SSAC - Benedict I've also attached the slide deck that outlines the LC framework, process, guidelines, and budget. Thank you. B Berry Cobb GNSO Policy Consultant @berrycobb

1 0

Recordings, Attendance & AC Chat / GNSO Temp Spec gTLD RD EPDP / Thursday, 13 December 2018
by Andrea Glandon Dec. 13, 2018

Dec. 13, 2018

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Thursday, 13 December 2018 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/AgvVBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-13dec18… AC Recording: https://participate.icann.org/p29j1sxckpa/<https://participate.icann.org/p29j1sxckpa/?OWASP_CSRFTOKEN=3407eab64866f47a…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

ICANN Offices closed from 21 December 2018 EOB to 2 January 2019
by Nathalie Peregrine Dec. 13, 2018

Dec. 13, 2018

Dear all, ICANN offices will be closed for the end of year break. GNSO staff support will therefore end on Friday 21st December 2018 EOB to resume on Wednesday 2nd January 2019. GNSO Staff would like to seize the opportunity to wish you all the merriest of holidays with your loved ones and the very best wishes for 2019! Kind regards, On behalf of the GNSO team Nathalie Nathalie Peregrine Manager, Operations Support (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Email: nathalie.peregrine(a)icann.org <nathalie.peregrine(a)icann.org%20> Skype: nathalie.peregrine.icann Find out more about the GNSO by taking our interactive courses<applewebdata://EB3A6F47-9760-400D-A39B-A7EFFC56B467/learn.icann.org/courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>

1 0

Notes, action items from EPDP Team Meeting #34 - 13 December 2018
by Caitlin Tubergen Dec. 13, 2018

Dec. 13, 2018

Dear All, Please find the notes from today’s EPDP Team call below. Best regards, Marika, Berry, and Caitlin -- EPDP Team Call #34 Thursday, 13 December 2018 14:00 UTC High-level Notes/Actions Kurt to work with Support Staff to capture the geographic differentiation discussion and draft a policy recommendation for the EPDP Team to review. The draft recommendation will provide that research should be explored on the feasibility of a rules engine and following the delivery and outcome of the research, the EPDP Team may recommend further work (perhaps by another PDP WG). These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/ZwPVBQ 1. Roll Call & SOI Updates Attendance will be taken from Adobe Connect Remember to mute your microphones when not speaking and state your name before speaking for transcription purposes. Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) a. Review of outstanding action items b. Other updates, if applicable Due to the potentially large expense of retaining external legal counsel, the Leadership Team met with the Project Cost Support Team (PCST) to discuss options for legal counsel. The proposed approach was used by the CCWG - WS2 The approach is to establish a sub-team, called the EPDP Legal Committee (LC), that will act as an intermediary b/w the EPDP Team and external/internal legal counsel The LC will filter, analyze, refine, and approve requests for legal advice Members would be practicing lawyers or individuals with legal training - preferably one member per team The rationale for the approach is previous success with CCWG-WS2, stewardship of budget, streamlined process Within the SOW, Kurt requested a certain number of business days SLA be included to ensure we get answers as soon as possible EPDP Feedback Concerns about approach - it is difficult for attorneys to be instructed by groups with divergent interests. This may involve a lot of time and money with little gain. Response: we plan to use this approach, but if it is not working, we will reassess. Can we get a degree of assurance that the group will actually take the legal advice received on board? Are the stakeholder groups willing to follow advice that may be against the stakeholder group's position? Response: we hope the Team will respect any guidance received and use it constructively Rather than asking questions, we could describe detailed scenarios and ask if the scenario is compliant with the GDPR. Use cases with proposed solutions would be ideal - is this proposed solution GDPR compliant? General questions may not result in helpful answers. 3. Continue review of list of topics for further discussion Geographic basis Amr recently forwarded recent EDPB guidance to the list - does this memo provide clarity to our discussion? These guidelines were shared by the EDPB a few weeks ago and are available for a public comment process now. A small team discussed the geographic differentiation issue, and the divergent viewpoints were captured in the Initial Report. Targeting criteria - just b/c a data subject is located within the EEA does not mean processing of data falls within GDPR. One criterion is the data subject is targeted by a controller. Geo localization activities may be relevant - also, online tracking (cookies) or personalized targeting. Establishment criteria - main establishment is not the only factor that applies Reading this document highlights additional questions Reading the guidelines shows there are a lot of areas where the GDPR does not apply This guidance is helpful in two ways: (1) putting responsibility on the controller, and the processing activity is not the controlling factor; (2) the guidance also provides some clarity regarding the location of the data subject The guidance pivots on the definition of roles. This introduces complexity for contracted parties, and this only applies to GDPR. This may be an area where we get very targeted legal advice The rules engine approach/chart could be helpful in this context - the guidelines narrow the questions we could ask Scenario-based questions are likely to be responded to with pro forma advice such as analysis would need to be done on a case-by-case basis If the guidance helps the team draw a box around data subjects, it will still be difficult to draw up 50+ rule sets. The guidance demonstrates that this is a complicated issue and shows the difficulty of digital vs. political borders. This appears to be a policy question, not a legal question - does the team want to create a policy where compliance can be enforced? While this looks like a legal question, it is not. This is really a question of dealing with requirements that transcend jurisdiction and gets into challenges that global technology firms are dealing with now. The team should get more legal advice and come to consensus on what is the lowest risk and practical application from a policy perspective The team is ignoring the cost to third parties that access WHOIS data. The EWG report was commissioned by the ICANN Board - once the Board received the report, it initiated the next generation RDS PDP, which was terminated after GDPR/initiation of EPDP. The Team does not have time to work through all of this right now, but needs to not just focus on costs to contracted parties The Team should also consider potential gaming, i.e. targeting customers in the EEA just to avoid publishing data Before the Team agrees to research a rules engine, we should be clear if it would be viable - the team needs to think this through more Ultimately, we will need a rules engine to apply multiple laws, but that is outside of our scope and should not be on our critical path. We need something simple that does not require elaborate rules. Researching does not necessarily mean the team will make this a policy - however analysis would be helpful, and the team could make recommendations to further explore this in a later phase Action: Kurt to summarize this discussion as a policy recommendation for the group to review and ultimately be included in the final report Why does the EPDP Team need to research this - shouldn't this be conducted by a different PDP? Perhaps this could be worked on in the future. This Team is talking about a policy that is not just GDPR compliant - that is why a rules engine is important - we should recommend that the work begin immediately The other thing the group has not yet discussed is the ICANN hub and spoke model Policy Change Impact Analysis Per the charter, there is a need to include a policy impact analysis. The analysis is meant to include metrics to be able to measure the effectiveness of the policy. If the team has ideas for what needs to be captured here, or if anyone wants to volunteer, that would be very helpful. During the charter drafting phase, Stephanie had a particular interest in this section, so she could be a starting point. The bullet points within the Initial Report show what the team is expected to produce It may be premature to determine if the policy achieved its goals given the stage we are in An action item could be to review this after policy recommendations are submitted and submit proposed metrics to the Council. It's difficult to conduct an analysis before we have specific policy recommendations Kurt may consider collaborating with staff to see if an independent resource could be tapped for this exercise. It's hard to dedicate time to this effort if something changes as a result of public comment Our next meeting to be scheduled for Tuesday 18 December 2018 at 14.00 UTC.

1 0

Doodle / Legal Committee Framework (only confirmed reps)
by Terri Agnew Dec. 13, 2018

Dec. 13, 2018

Hello all, Only the confirmed reps for each group, please complete the doodle to schedule a Legal Committee Framework call next week. Doodle: https://doodle.com/poll/2abn9v99y8kwu8hu I have enabled the time zone so that it can be changed to your zone. With kind regards, Terri From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> On Behalf Of Berry Cobb Sent: Thursday, December 13, 2018 8:54 AM To: gnso-epdp-team(a)icann.org Subject: [Gnso-epdp-team] ACTION REQUIRED - Legal Committee Framework Hi All, Per today's discussion on establishing the standing legal committee framework, please designate one member or alternate from your respective group. The preference is that committee members are currently practicing attorneys. Where one is not available in your group, then please chose a representative that you think is best capable to manage request for legal advice. Please provide the selection for your respective group to the mailing list by 18 December 2018 prior to our next EPDP call. The following list is a suggestion of who might join the committee, but ultimate a decision for you respective group: * Board - Leon * BC - Margie * IPC - Diane * ISPCP - Thomas * NCSG - Tatiana * RySG - Kristina * RrSG - Volker * GAC - Laureen * ALAC - Alan G. * SSAC - Benedict I've also attached the slide deck that outlines the LC framework, process, guidelines, and budget. Thank you. B Berry Cobb GNSO Policy Consultant @berrycobb

1 0

Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 18 December 2018
by Andrea Glandon Dec. 13, 2018

Dec. 13, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/BQvVBQ Thank you. Kind Regards, Andrea

1 0