- Gnso-epdp-team - lists.icann.org

Re: [Gnso-epdp-team] Updated data redaction language
by Matt Serlin Nov. 15, 2018

Nov. 15, 2018

Hi Marika, Thanks for sending the updated language…it will be added to the pile ☺ One note though I immediately saw, can you please add the RrSG to the following text: “As such, the NCSG, ISPCP and RySG do not support not redacting this information.” Regards, Matt From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Wednesday, November 14, 2018 at 12:53 PM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Updated data redaction language Dear All, Following yesterday’s discussion, please find attached the updated proposed language for inclusion in the Initial Report in relation to data redaction. Note that this version includes input from Margie and Benedict in relation to the action item from yesterday’s EPDP Team meeting (“Margie to provide language that describes the organizations supporting not redacting the “organization” field. Benedict to provide language to explain systemic risk of not publishing organization field.”). If you have any further comments and/or proposed edits, please share these with the list as soon as possible. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

5 5

Proposed Agenda - EPDP Team Meeting #25
by Marika Konings Nov. 15, 2018

Nov. 15, 2018

Dear All, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 13 November at 14.00 UTC. * In relation to agenda item #3, please find attached an updated version of the proposed language for inclusion in the Initial Report in which staff has aimed to capture some of the input that was received in response to the Initial Report through the google doc, as well as input received on the mailing list. * In relation to agenda item #4, please find attached a table which provides an overview of the changes proposed by EPDP Team members that staff didn’t feel comfortable applying because e.g. either the proposed change is not clear, the proposed change affects previously agreed preliminary agreements / text, or is a substantive change that requires further discussion / consideration by the full EPDP Team (see https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyG… for all comments received to date). In certain cases, staff has proposed a path forward, but would appreciate EPDP Team/commenter feedback before applying this change. Note that a number of comments were made in relation to preliminary recommendations and/or text that is still under consideration. It is the expectation that this input will be raised in the context of those discussions. FYI, staff expects to share an updated version of the Initial Report later today so you can see how other input has been addressed (non-substantial issues) as well as how other aspects are coming together as a result of the EPDP Team work over the last couple of meetings. Best regards, Caitlin, Berry and Marika ====================== EPDP Meeting #25 Agenda Tuesday, 13 November 2018 1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Initial Report finalization status, incl. items remaining to be addressed and schedule for the week ahead * Confirm status and next steps in relation to natural vs. legal and geographic status * Review of outstanding action items * Other updates, if applicable 1. Data Redaction (see attached) Objective of discussion: 1. Confirm language for inclusion in the Initial Report in relation to data redaction as well as email communication * Review latest version of language for inclusion in relation to data redaction * Consider charter questions: f2) Should standardized requirements on registrant contact mechanism be developed? f3) Under what circumstances should third parties be permitted to contact the registrant, and how should contact be facilitated in those circumstances? And related draft recommendation: In relation to facilitating email communication between third parties and the registrant, the EPDP Team recommends that [current requirements in the Temporary Specification that specify that a Registrar MUST provide an email address or a web form to facilitate email communication with the relevant contact, but MUST NOT identify the contact email address or the contact itself, remain in place. [[[Other to be decided]]]. * Confirm next steps, if any 1. Commence review & discussion of comments / input received on Initial Report Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report * Commence review of proposed changes / comments on the Initial Report (see list attached) * Confirm approach for addressing these * Confirm next steps, if any 1. Wrap and confirm next meeting to be scheduled for Wednesday 14 November / Thursday 15 November at 14.00 UTC (dependent on progress made). * Confirm action items * Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

7 6

Language for inclusion in the Initial Report - Natural/legal person and geographic basis
by Marika Konings Nov. 14, 2018

Nov. 14, 2018

Dear All, With the aim of finalizing the proposed language in relation to natural/legal person and geographic basis, please find attached the proposed language for inclusion in the Initial Report . The leadership team & staff tried to address all input and find the right balance in conveying the different points of view without turning this into a lengthy debate between the different perspectives. Do note that for the parts highlighted in yellow, groups can still indicate if they want to have their name associated with a certain position. Thank you for all your input. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

3 2

Personal Information Concerning Legal and Natural Persons
by Amr Elsadr Nov. 14, 2018

Nov. 14, 2018

Hi, In follow-up on action item #2 from yesterday’s call, I’ve made a few edits to the 11 November document on Legal vs Natural Persons. The changes are meant to address what I tried to convey during yesterday’s call; that the real problem we are trying to solve isn’t a distinction between natural and legal persons, but rather how the personal information collected during the registration process is treated, and whether it concerns legal persons or natural persons. In my view, this is the real issue we’ve been trying to tackle, regardless of whether EPDP Team members believe that the distinction should be made via self-identification at the time of registration, or not, as well as whether EPDP Team members believe the distinction should be a requirement on the part of Registrars during the registration process, or optional. The questions we’re asking in the initial report on this issue also seem to me to be soliciting answers to that effect. It isn’t so much of whether the Registrant field in the RDDS indicates a legal or a natural person. The real issue is whether the personal information collected during the registration process concerns a legal or natural person, irrespective of how/if the RNH self-identifies as one or the other. Note that the excerpt from the EDPB letter already included in the document addresses the issue in that manner, so the changes I’m proposing only add consistency and accuracy to how I believe the EPDP Team should be framing the issue. This is also made clear in GDPR Recital 14, which states: > The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person. When I proposed these changes during yesterday’s call, I thought of them as a friendly amendment of sorts - one that only helps to clarify the issue, and make it more visibly specific to the intended audience of the initial report. However, early reactions indicated a possibly different reception than I had anticipated. To be honest, I’m not clear why that is, and would welcome any views expressed along with rationale, whether in support or opposition of the proposed changes. Thanks. Amr

2 2

Responsibilities in Data Processing draft text
by Caitlin Tubergen Nov. 14, 2018

Nov. 14, 2018

Dear EPDP Team, In reviewing outstanding items for the Initial Report, no volunteers came forward to draft text for Charter Questions k2, l4 and m4 regarding responsibilities in processing data. Accordingly, Support Staff drafted the following proposed text: k) ICANN's responsibilities in processing data k2) In addition to any specific duties ICANN may have as data controller, what other obligations should be noted by this EPDP Team, including any duties to registrants that are unique and specific to ICANN’s role as the administrator of policies and contracts governing gTLD domain names? l) Registrar's responsibilities in processing data do registrars undertake solely at ICANN's direction? l4) What are the registrar's responsibilities to the data subject with respect to data processing activities that are under ICANN’s control? m) Registry's responsibilities in processing data m4) What are the registry's responsibilities to the data subject based on the above? Proposed response: The EPDP Team took note of the GDPR requirements and notes that in instances where the EPDP Team has classified ICANN as a Controller, ICANN would be expected to comply with the law. However, the EPDP Team is not recommending additional requirements for ICANN at this time. Similarly, the EPDP Team took note of the GDPR requirements and notes that in instances where the EPDP Team has classified Registries and Registrars as Controllers, or Processors, the Registry and/or Registrar would be expected to comply with the law. However, the EPDP Team is not recommending additional requirements for contracted parties at this time. -- The draft text is also attached for ease of marking up. Please let us know if you have any concerns with the above. Best regards, Marika, Berry and Caitlin

1 0

Updated data redaction language
by Marika Konings Nov. 14, 2018

Nov. 14, 2018

Dear All, Following yesterday’s discussion, please find attached the updated proposed language for inclusion in the Initial Report in relation to data redaction. Note that this version includes input from Margie and Benedict in relation to the action item from yesterday’s EPDP Team meeting (“Margie to provide language that describes the organizations supporting not redacting the “organization” field. Benedict to provide language to explain systemic risk of not publishing organization field.”). If you have any further comments and/or proposed edits, please share these with the list as soon as possible. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Re: [Gnso-epdp-team] [Ext] IPC on UDRP in Initial Report (Part 4, section o))
by Marika Konings Nov. 14, 2018

Nov. 14, 2018

Thanks, Brian. Staff will make note in the draft Initial Report of the IPC’s support for the BC’s suggestion and will reflect that it MAY trigger a change to the UDRP instead of WOULD to factor in that this would likely require further consideration based on the input you provided below. Best regards, Marika From: "King, Brian" <Brian.King(a)markmonitor.com> Date: Wednesday, November 14, 2018 at 1:40 PM To: Marika Konings <marika.konings(a)icann.org>, "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Ext] IPC on UDRP in Initial Report (Part 4, section o)) Hi Marika, The IPC would like to note its support of the BC’s suggestion that pre-filing disclosure “be added to the processing activities for the purpose of coordinating, operationalizing and facilitating policies for resolution of disputes regarding or relating to the registration of domain names (as opposed to the use of such domain names), namely, the UDRP, URS, PDDRP, RRDRP and future-developed domain name registration-related dispute procedures for which it is established that the processing of personal data is necessary.” We do not believe that this would necessarily require a change to the UDRP for a number of reasons, including that 4.a. of the UDRP distinguishes between the assertion that the three UDRP prongs are met, and the subsequent administrative proceeding when the prongs are proved. As one example, this distinction provides opportunity for policy development (e.g. controls and requirements to prevent fishing expeditions) that support pre-filing, post-assertion disclosure in limited circumstances. For completeness, speaking to the point currently included in the Initial Report draft, GDPR redaction is distinguishable from privacy/proxy registrations as the latter has been and can be considered non-dispositive evidence of the bad faith UDRP prong, where the former has not, to my knowledge. To Alan Woods’ sage point in his recent note, the assessment/reasoning for this, in addition to the above-mentioned and BC-mentioned prejudice to brand owners in the UDRP since May 25, is that the lack of pre-filing WHOIS data availability has made the UDRP less effective as evidenced by a 10% decrease in the number of domains per UDRP case filed at WIPO since May 25, and a 21% decrease year-over-year based on my last data pull. Further, 2/3 of the UDRP prongs involve the registrant’s identity, making it extremely difficult and in some cases impossible to draft a good-faith UDRP filing without pre-filing disclosure. Thank you. Brian J. King Director of Internet Policy & Industry Affairs MarkMonitor / Part of Clarivate Analytics Phone: +1 (443) 761-3726 brian.king(a)markmonitor.com<mailto:brian.king@markmonitor.com>

1 0

IPC on UDRP in Initial Report (Part 4, section o))
by King, Brian Nov. 14, 2018

Nov. 14, 2018

Hi Marika, The IPC would like to note its support of the BC's suggestion that pre-filing disclosure "be added to the processing activities for the purpose of coordinating, operationalizing and facilitating policies for resolution of disputes regarding or relating to the registration of domain names (as opposed to the use of such domain names), namely, the UDRP, URS, PDDRP, RRDRP and future-developed domain name registration-related dispute procedures for which it is established that the processing of personal data is necessary." We do not believe that this would necessarily require a change to the UDRP for a number of reasons, including that 4.a. of the UDRP distinguishes between the assertion that the three UDRP prongs are met, and the subsequent administrative proceeding when the prongs are proved. As one example, this distinction provides opportunity for policy development (e.g. controls and requirements to prevent fishing expeditions) that support pre-filing, post-assertion disclosure in limited circumstances. For completeness, speaking to the point currently included in the Initial Report draft, GDPR redaction is distinguishable from privacy/proxy registrations as the latter has been and can be considered non-dispositive evidence of the bad faith UDRP prong, where the former has not, to my knowledge. To Alan Woods' sage point in his recent note, the assessment/reasoning for this, in addition to the above-mentioned and BC-mentioned prejudice to brand owners in the UDRP since May 25, is that the lack of pre-filing WHOIS data availability has made the UDRP less effective as evidenced by a 10% decrease in the number of domains per UDRP case filed at WIPO since May 25, and a 21% decrease year-over-year based on my last data pull. Further, 2/3 of the UDRP prongs involve the registrant's identity, making it extremely difficult and in some cases impossible to draft a good-faith UDRP filing without pre-filing disclosure. Thank you. Brian J. King Director of Internet Policy & Industry Affairs MarkMonitor / Part of Clarivate Analytics Phone: +1 (443) 761-3726 brian.king(a)markmonitor.com<mailto:brian.king@markmonitor.com>

1 0

Proposed Agenda - EPDP Team Meeting #26 - 15 November 2018
by Caitlin Tubergen Nov. 14, 2018

Nov. 14, 2018

Dear EPDP Team, Below, please find the agenda for our next EPDP meeting on Thursday, 15 November. Attached, please find an updated table of comments / input received on the Initial Report. If possible, please review the table in advance of our meeting tomorrow. Thank you. Best regards, Marika, Berry, and Caitlin EPDP Meeting #26 Agenda Thursday, 15 November 2018 Roll Call & SOI Updates (5 minutes) Welcome and Updates from EPDP Team Chair (5 minutes) Review of outstanding action items Other updates, if applicable Thomas Rickert to review proposed language for Responsible Parties for inclusion in the Initial Report. EPDP Team to discuss approach and bring up concerns, if any Confirm next steps, if any Commence review & discussion of comments / input received on Initial Report Objective of discussion: (1) Review proposed changes / comments on the Initial Report that require EPDP Team consideration (2) Agree on if/how these proposed changes / comments are to be applied to the Initial Report Commence review of proposed changes / comments on the Initial Report Confirm approach for addressing these Confirm next steps, if any Wrap and confirm next meeting to be scheduled for Thursday 15 November at 14.00 UTC. Confirm action items Confirm questions for ICANN Org, if any

1 0

***REMINDER*** Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Thursday, 15 November 2018 at 14:00 UTC for 3 hours
by Julie Bisland Nov. 14, 2018

Nov. 14, 2018

**Thursday, 15 November 2018 at 14:00 UTC for 3 hours** Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays at 14:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: Thursday, 15 November 2018 at 14:00 UTC: https://community.icann.org/x/YAPVBQ Thank you. Kind Regards, Terri

2 1