- Gnso-epdp-team - lists.icann.org

Proposed Agenda - EPDP Team Meeting #20
by Marika Konings Oct. 15, 2018

Oct. 15, 2018

Dear All, A special thanks to the team for working so hard over the last couple of weeks. In order to give everyone a small break and allow for sufficient time for preparation for ICANN63, Tuesday’s meeting will be focused on reviewing the agenda for the F2F meetings at ICANN63 and the High Interest Topic Sessions (see agenda below). Best regards, Caitlin, Berry and Marika EPDP Team Meeting #20 Agenda Tuesday, 16 October 2018 1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Confirm status of small teams #1, #2 and #3 * Confirm status of data elements workbooks * Review of outstanding action items * Other updates, if applicable 1. Planning for F2F Meetings at ICANN63 Objective of discussion: (1) Confirm topics to be addressed during ICANN63 (2) Confirm materials to be reviewed in preparation for ICANN63 F2F Meeting (3) Agree on approach for F2F meeting * Review agenda for full day F2F meeting on Saturday & confirm materials to be reviewed prior to meeting (see draft attached) * Review additional slots throughout the week and expected topics to be addressed 1. Planning for High Interest Topic (HIT) Session at ICANN63 Objective of discussion: (1) Agree on agenda for HIT session (2) Confirm speakers for High Interest Topic Session * Review proposed agenda for High Interest Topic (HIT) Session * Confirm presenters for HIT Session 1. Wrap and confirm next meeting to be scheduled for Saturday 20 October from 8.30 – 18.30 CET at ICANN63. * Confirm action items * Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Purpose C
by Alan Greenberg Oct. 15, 2018

Oct. 15, 2018

I have updated Purpose C and a copy is attached. 1. I deleted the various "stream of consciousness dialogue" and tried to just leave in the final conclusions. 2. Under item 9, I further discussed the issue of whether the administrative and technical contact fields are in fact optional (and must either default to the registrant contact information, or have that registrant contact information delivered in lieu of the blank fields when data is made available as later agreed during access discussions) or whether it should be mandatory with instructions to the registrants on options for filling them out as implied in the EDPB letter of 05 July 2018. Alan

3 2

CENTR Survey: Whois status and impacts from GDPR
by Georgios.TSELENTIS＠ec.europa.eu Oct. 12, 2018

Oct. 12, 2018

Dear Kurt, EPDP colleagues, Please find a recent survey among European ccTLDs on impacts from GDPR: The survey report can be found here: https://centr.org/library/library/survey-report/centr-report-whois-status-a… The presentation has been uploaded at: https://centr.org/library/library/external-event/whois-status-and-the-impac… The overview of data collected and published via the WHOIS is available at: https://stats.centr.org/pub_whois Best regards, Georgios

2 2

Recordings, Attendance & AC chat from the GNSO Temp Spec gTLD RD EPDP Small Team Meeting #1 held Thursday, 11 October 2018
by Andrea Glandon Oct. 11, 2018

Oct. 11, 2018

Dear all, Please find the attendance and AC chat attached to this email. The MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP Small Team #3 call held on Thursday, 11 October 2018 at 17:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/jwq8BQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-small-t… AC Recording: https://participate.icann.org/p74zpjvd7rg/<https://participate.icann.org/p74zpjvd7rg/?OWASP_CSRFTOKEN=5aed66bc9d5a449f…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

For your review - draft agenda for EPDP High Interest Topic Session
by Marika Konings Oct. 11, 2018

Oct. 11, 2018

Dear All, Please find attached the draft agenda for the EPDP Team High Interest Topic Session which is scheduled to take place at ICANN63 on Monday 22 October from 15.15 – 16.45 local time. You are encouraged to share any feedback you may have on this draft agenda, but more importantly, please indicate which part you would like to present on behalf of the EPDP Team. As mentioned by Kurt, presenters will be speaking on behalf of the whole team and not representing themselves or their respective group. Staff will be assisting by developing a slide deck that will include the relevant EPDP Team agreements and/or status of deliberations in relation to each of these topics. The leadership may be making further updates, as needed, to the agenda. Thanks, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Notes and action items EPDP Team meeting #19 - Thursday, 11 October
by Caitlin Tubergen Oct. 11, 2018

Oct. 11, 2018

Dear All, Please find below the notes and action items from today’s EPDP Team meeting. Best regards, Marika, Berry and Caitlin High-level Notes/Actions 1. The Leadership Team will be circulating a draft agenda for the High Interest Topic session in Barcelona to the EPDP Team. EPDP Team volunteers are required to come forward to present during the high interest session. 2. If you have been appointed as a lead, please complete the data elements workbooks homework by Monday, October 15. As a reminder, the objective for appointed leads is to review the workbook, flag any updates that need to be made, and flag any outstanding issues that may need to be discussed in Barcelona. 3. Benedict and Farzaneh to submit the completed workbook for the research purpose as soon as possible. 4. The next steps for Purpose B following today’s call are as follows: Please take the time to read the Purpose B workbook that was sent this morning more carefully. If you would like to volunteer to assist in the updated purpose statement and accompanying workbook exercise, please reach out to the Leadership Team, who will put you in touch with Benedict Addis, or you may reach out to Benedict directly. Please consider any policy items the team could put in its initial report with respect to today’s discussion. Notes & Action items EPDP Meeting #19 11 October 2018 These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates Attendance will be taken from Adobe Connect Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair The Leadership Team is looking for volunteers to present during the High Interest Session. Action: Volunteers to come forward to present during the high interest session. Action: Please remember to complete the data elements workbooks homework. Updates are due Monday, October 15. Objective is for appointed leads to go through the workbooks. to flag any updates that need to be made and any outstanding issues that may need to be discussed in Barcelona. Action for Benedict and Farzaneh - please submit worksheet for the research purpose. 3. Recap the F2F agreements in relation to lawful disclosure to third parties (Purpose B) AGREED NEXT STEPS IN RELATION TO LAWFUL DISCLOSURE OF REGISTRATION DATA TO THIRD PARTIES (Purpose B) Facilitate lawful access for legitimate 3rd party interests to data that is already collected and identified herein This is a registry/registrar purpose The group has different viewpoints whether this is also an ICANN Purpose – we will analyze that more. We agree that we want third parties with legitimate interests to be able to have predictable, lawful access, and the EPDP policy must make that clear. (we didn’t define what ‘predictable’ means). We are all going to bring this back to our constituencies. 4. Review data elements workbook for Purpose B (facilitate lawful access) Kristina Rosette distributed the updated Purpose B workbook shortly before this meeting. The updated Purpose B workbook is a joint product of the Ry/Rr Members. Please see latest version of Purpose B Workbook. Objective of discussion: (1) Review data elements workbook for purpose B as completed by registries/registrars Ry (Alan Woods review of workbook): There seems to be a disconnect in what the word purpose means. This is categorically a purpose for ICANN, but that does not mean that this GDPR compliant. The exercise involved answering the questions in isolation. Question 1 - is this lawful as tested against GDPR? The Temp Spec says this is an ICANN purpose. Since ICANN does not have the data, it functionally makes it a Ry/Rr purpose. Question 2 - is the purpose in violation of ICANN's bylaws? Perhaps. Question 3: Description of processing activities: Collection of rt data (Ry/Rr) Storage of rt data (Ry/Rr) Disclosure of rt data (Ry/Rr) Question 4 - is the processing necessary to achieve the purpose? No, b/c it up to the individual contracted party to decide. Question 5 - is there a transfer? Yes - Rr to Ry Question 6 - is publication required? Disclosure of data is publication; however, it is more straightforward to achieve the required balance with data subjects fundamental rights if that disclosure is on a 1:1 basis. Question 8 - what are the data retention requirements to meet the purpose? life of registration + 35 days to allow for the completion of the lifecycle (RGP + pending delete) Question 7 - are there picket fence considerations? The new requirement needs to be formalized in a JCA/DPA. As the team moves through the queue, keep two ideas in mind: 1. legality and how a regulator would look at this under GDPR 2. what is important to you as a stakeholder in the ICANN ecosystem? EPDP Team feedback on Purpose B document: The EPDB in its 5 July letter says not to conflate purposes, but it does not say to ignore the purposes. It is unfair to respond to this with such little time to review this. How did Ry/Rr come up with how disclosure is not part of the ICANN contract? The group is trying to specify the purposes through this exercise. This purpose is stated in the ICANN bylaws. Clarifying question: lawfulness of processing question - under question 1, Rys/Rrs indicate this is not a CPH purpose, how is this purpose lawful under 6(1)(b)? The green box with the lawful basis was prepopulated to assist the groups in identifying the legal basis, so even if 6(1)(b) is noted in the box, that is not what the group is purporting the purpose is. The argument under question 1 about purpose is circular. There are implicitly parts of the ICANN contract that data needs to be made available to third parties. Under question 4, what are the purposes? The current purpose at the top of the page needs to be reworded; however, the purpose used to be detailed and all of the details were taken out during the F2F. Under question 5, why is transfer from registrar to registry necessary to meet this purpose? Under question 6, that is addressing who can get the data, but the real issue is can anyone get the data, if not - there is no purpose. The primary purpose of the purpose was to focus on the facilitating/enabling part. The EPDB has the expectation that ICANN will have a model that focuses on legitimate enabling of access. Would it be beneficial to reword the purpose? The purpose is meant for the facilitation, and this is a 6(1)(b) purpose, and both parties are joint controllers: the contracted parties are 6(1)(b) and ICANN would be 6(1)(f). Any documents to be discussed should be available 24 hours before the meeting. If law enforcement is not a purpose, what is it? The data collected to fulfill a registration agreement, the lawful access part is applied to other contracts as well. There is no reason why law enforcement cannot get this data b/c LEA has a legal right to access data. CPH may not always listen to LEA, but LEA does not need a purpose to access data. One of the ways the team could think aloud: how could the team potentially reframe the purpose so that it more accurately fits as an ICANN purpose? The group changed the purpose to be more vague, and now the vagueness is causing issues. Perhaps the team could go back to discussing: Facilitate lawful access for legitimate 3rd party interests, including those related to consumer protection, cybercrime, law enforcement, DNS Abuse or potential or alleged intellectual property violations, to RDS data that is already collected and identified herein. Part of the reason this is difficult is that many public authorities have their basis in laws. ICANN's public policy purpose is more legally unclear. While it may be sincerely held, it does not offer the same amount of legal cover as others. If any CP is approached by LEA, it would follow a legal obligation to disclose the data. It may be helpful to think about sharing 1:1 pursuant to a legal obligation and then there is publication on a public register - these are two forms of sharing data. CP are concerned that if you go down this path, you are paving the way for centralized model, and that is a concern for several stakeholder groups. How can the Team ignore mitigation of DNS abuse? If the Team uses this language or language close to it, the Team has met the purpose test. The Team still has to go through the processing activity. 1. For prevention, 2. network and information security, 3. indicating possible criminal acts or threats to public security The data subject needs to be made aware of how the data will be processed - being specific would be better in this case. Is this the work product of Rys/Rrs? Yes, this was a joint effort b/w Rys/Rrs. There was a discussion last night about why this team needs legal counsel. The Team continues to conflate the legitimate interests of third parties (LEA, cybercrime, etc.) with the purpose of processing, which is a primary relationship b/w the individual getting a name and the delegated party that provides the ability to register the domain name. The purpose of ICANN is not to set up WHOIS, it is to permit the setting up of domain names. Some of the third party access argument is ICANN after its own purposes but outsourcing it to others - they may not answer everyone's needs. ICANN's mission is not to just register domain names, but to do it in a way that is reliable and secure. ICANN is a private sector entity registered as a corp. in CA - it has not been delegated as a law enforcement authority. The problem is the instrument, and ICANN setting itself up as an instrument. An example would be banks - there are strict limits under banking regulations to get into personal details of individuals. Unfortunately, ICANN does not have the remit that a bank does. Does ICANN have a purpose here? There is a disagreement here over ICANN's remit. Purpose is a loaded term to this group. Even if the group believes it's an ICANN purpose does not give it standing under GDPR. What should accompany this discussion as policy language from this group? Next steps: read what was sent this morning more carefully. 2. some could put together a purpose statement that benedict put in the chat or from LA and run the exercise through the data elements worksheet. 3. are there policy items the team could put in its initial report? (2) Agree on wording of the purpose: (a) is sufficiently specific to meet GDPR requirements (b) anticipates disclosure of data to intended audience for limited purpose (3) Agree on responses to different questions in data elements workbook a) Review data elements workbook for purpose B b) Discuss any outstanding items / questions c) Finalize data elements workbook for purpose B 5. Wrap and confirm next meeting to be scheduled for Tuesday, 16 October at 13.00 UTC. a) Confirm action items b) Confirm questions for ICANN Org, if any

1 0

Recordings, Attendance & AC chat from the GNSO Temp Spec gTLD RD EPDP held Thursday, 11 October 2018
by Andrea Glandon Oct. 11, 2018

Oct. 11, 2018

Dear all, Please find the attendance and AC chat attached to this email. The MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Thursday, 11 October 2018 at 13:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/LQWrBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-11oct18… <https://urldefense.proofpoint.com/v2/url?u=https-3A__audio.icann.org_gnso_g…> AC Recording: https://participate.icann.org/p8sjjonwgj2/<https://participate.icann.org/p8sjjonwgj2/?OWASP_CSRFTOKEN=5aed66bc9d5a449f…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

Comments on the Legal Basis memo
by Alan Woods Oct. 11, 2018

Oct. 11, 2018

Dear all, Please find the jointly prepared CPH comments on the Legal Basis memo. Apologies for the tardiness in getting this to all, but this document covers substantial issues and took some time to do; alas it actually took more time than we even had. As a segue from that comment, please note that this submission is the product of not wishing to delay our team any further. We are therefore we are submitting this with 2 notes: 1) We have not have the opportunity to get our formal SG's approval for this thus is CPH EPDP team effort only, 2) We have a point (highlighted) that is not as of yet agreed between the members of the teams. We are looking forward to further discussion on this! Kind regards Alan [image: Donuts Inc.] <http://donuts.domains> Alan Woods Senior Compliance & Policy Manager, Donuts Inc. ------------------------------ The Victorians, 15-18 Earlsfort Terrace Dublin 2, County Dublin Ireland <https://www.facebook.com/donutstlds> <https://twitter.com/DonutsInc> <https://www.linkedin.com/company/donuts-inc> Please NOTE: This electronic message, including any attachments, may include privileged, confidential and/or inside information owned by Donuts Inc. . Any distribution or use of this communication by anyone other than the intended recipient(s) is strictly prohibited and may be unlawful. If you are not the intended recipient, please notify the sender by replying to this message and then delete it from your system. Thank you.

1 1

Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 16 October 2018 at 13:00 UTC
by Andrea Glandon Oct. 11, 2018

Oct. 11, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesday’s and Thursday’s at 13:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/LwWrBQ Thank you. Kind Regards, Andrea Glandon

1 0

Consolidated RySG RrSG Purpose B Worksheet
by Rosette, Kristina Oct. 11, 2018

Oct. 11, 2018

All, Attached is the Purpose B worksheet completed by representatives of the RySG and RrSG. Two preliminary comments: * We revised the Purpose description to move "identified herein" so it directly modifies data. * When completing the worksheet, we used "purpose" as a legal term of art, and not a synonym for "objective" or "intention." K Kristina Rosette Senior Corporate Counsel, IP - Domains rosettek(a)amazon.com<mailto:rosettek@amazon.com> | 703.407.1354

1 0