- Gnso-epdp-team - lists.icann.org

Recording, Attendance & AC chat from the call to discuss Independent legal counsel to assist the EPDP held on Wednesday, 10 October 2018 at 22:00 UTC.
by Terri Agnew Oct. 10, 2018

Oct. 10, 2018

Dear all, Please find the attendance and AC chat attached to this email. The AC recording below from the call to discuss Independent legal counsel to assist the EPDP held on Wednesday, 10 October 2018 at 22:00 UTC. AC Recording: https://participate.icann.org/p5oj3aetof9/<https://participate.icann.org/p5oj3aetof9/?OWASP_CSRFTOKEN=041a57671b997a4c…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Terri Agnew

1 0

Proposed Agenda - EPDP Team meeting #19 Thursday 11 October at 13.00 UTC
by Caitlin Tubergen Oct. 10, 2018

Oct. 10, 2018

Dear All, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Thursday 11 October at 13.00 UTC. Best regards, Marika, Berry and Caitlin EPDP Meeting #19 Agenda Thursday, 11 October 2018 Roll Call & SOI Updates Welcome and Updates from EPDP Team Chair Recap the F2F agreements in relation to lawful disclosure to third parties (Purpose B) AGREED NEXT STEPS IN RELATION TO LAWFUL DISCLOSURE OF REGISTRATION DATA TO THIRD PARTIES (Purpose B) Facilitate lawful access for legitimate 3rd party interests to data that is already collected and identified herein This is a registry/registrar purpose The group has different viewpoints whether this is also an ICANN Purpose – we will analyze that more. We agree that we want third parties with legitimate interests to be able to have predictable, lawful access, and the EPDP policy must make that clear. (we didn’t define what ‘predictable’ means). We are all going to bring this back to our constituencies. Review data elements workbook for Purpose B (facilitate lawful access) Please see latest version of Purpose B Workbook. Objective of discussion: (1) Review data elements workbook for purpose B as completed by registries/registrars (2) Agree on wording of the purpose: (a) is sufficiently specific to meet GDPR requirements (b) anticipates disclosure of data to intended audience for limited purpose (3) Agree on responses to different questions in data elements workbook Review data elements workbook for purpose B Discuss any outstanding items / questions Finalize data elements workbook for purpose B Wrap and confirm next meeting to be scheduled for Tuesday, 16 October at 13.00 UTC. Confirm action items Confirm questions for ICANN Org, if any

1 0

GNSO Policy Briefing
by Terri Agnew Oct. 10, 2018

Oct. 10, 2018

Dear all, Please find the GNSO Policy Briefing: http://go.icann.org/gnsobriefing With kind regards, Terri --- Terri Agnew Operations Support - GNSO Lead Administrator Internet Corporation for Assigned Names and Numbers (ICANN) Email: terri.agnew(a)icann.org<mailto:terri.agnew@icann.org> Skype ID: terri.agnew.icann Find out more about the GNSO by visiting: https://learn.icann.org/ [learn.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO [twitter.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Follow the GNSO on Facebook: https://www.facebook.com/icanngnso/ [facebook.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.facebook.com_icann…> http://gnso.icann.org/en/ [gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_en_&d=Dw…>

1 0

Pre-ICANN63 Policy Report
by Terri Agnew Oct. 10, 2018

Oct. 10, 2018

Dear all, The Pre-ICANN63 Policy Report has been published: https://go.icann.org/pre63 Thank you. With kind regards, Terri --- Terri Agnew Operations Support - GNSO Lead Administrator Internet Corporation for Assigned Names and Numbers (ICANN) Email: terri.agnew(a)icann.org<mailto:terri.agnew@icann.org> Skype ID: terri.agnew.icann Find out more about the GNSO by visiting: https://learn.icann.org/ [learn.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO [twitter.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Follow the GNSO on Facebook: https://www.facebook.com/icanngnso/ [facebook.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.facebook.com_icann…> http://gnso.icann.org/en/ [gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_en_&d=Dw…>

1 0

Recordings, Attendance & AC chat from the GNSO Temp Spec gTLD RD EPDP Small Team Meeting #3 held Wednesday, 10 October 2018
by Andrea Glandon Oct. 10, 2018

Oct. 10, 2018

Dear all, Please find the attendance and AC chat attached to this email. The MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP Small Team #3 call held on Wednesday, 10 October 2018 at 13:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/8AO8BQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-10oct18… <https://urldefense.proofpoint.com/v2/url?u=https-3A__audio.icann.org_gnso_g…> AC Recording: https://participate.icann.org/p4vtgefqcqa/<https://participate.icann.org/p4vtgefqcqa/?OWASP_CSRFTOKEN=569d53d7fc4c3255…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

**REMINDER** Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call Small team #1 / Thursday, 11 October 2018 at 17:00 UTC
by Julie Bisland Oct. 10, 2018

Oct. 10, 2018

Dear all, Non-members can follow the EPDP small team #1 taking place on Thursday, 11 October 2018 at 17:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/KAWrBQ Thank you. Kind Regards, Terri Agnew

1 0

***REMINDER*** Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Thursday, 11 October 2018 at 13:00 UTC
by Julie Bisland Oct. 10, 2018

Oct. 10, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesday's and Thursday's at 13:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/LQWrBQ Thank you. Kind Regards, Andrea Glandon

1 0

Re: [Gnso-epdp-team] Notes & action items from today's meeting
by Trang Nguyen Oct. 10, 2018

Oct. 10, 2018

Dear All, As per action item #3 below, Dan and I as ICANN Org liaisons reviewed the draft "Lawful Basis" memo<https://community.icann.org/download/attachments/95094053/Lawful%20Basis%20…> circulated on Monday. There are some areas where there is considerable change from the contents of the Temporary Specification, such as redefining and assigning owners to the "purposes", as well as the characterization of the "responsible parties" and their roles. It's understandable that the EPDP Team is considering changes from what was in the Temporary Specification as per the EPDP charter<https://gnso.icann.org/sites/default/files/file/field-file-attach/temp-spec…>. ICANN Org however has been directed<https://www.icann.org/resources/board-material/resolutions-2018-05-17-en> by the Board to implement the Temporary Specification. Accordingly, as liaisons from ICANN Org we are unable to convey an official ICANN position that differs from the Temporary Specification at this time. We will however continue to follow the EPDP Team's discussions carefully and supply whatever information we can to help advance the Team's discussions. Best, Trang and Dan ICANN Org Liaisons From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Tuesday, October 2, 2018 at 9:20 AM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Notes & action items from today's meeting Dear All, Please find below the notes and action items from today’s meeting. In order to facilitate the signing up for the small teams, please use the following link https://docs.google.com/document/d/1ChEYy-cZmT3qTD62-HsoVmddD96m6cbkSOv5dmA…. As a reminder, please self-organize and assign max. 1 member from each group per small team. Call details will be sent to all, but only designated members are expected to attend (view only AC will be available for others interested to follow the deliberations). Best regards, Caitlin, Berry and Marika ============= EPDP Team Meeting #16 Tuesday, 2 October 2018 Notes and Action Items High-level Notes/Actions: Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties t to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Legal Basis document, RySG to provide additional data processing steps by Wednesday 3 October COB. Action item #3: EPDP Team to review lawful basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed to further consider idea of ICANN having direct contract with registrants. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. Questions for ICANN Org from the EPDP Team: None Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates (5 minutes) * Attendance will be taken from Adobe Connect * Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Recap EPDP Team F2F meeting - see high level notes circulated and posted on the wiki (https://community.icann.org/x/rQarBQ) Feedback welcome on what worked well and what didn't. * Meeting schedule going forward - to be discussed under item 5 on the agenda. * Review of outstanding action items - see https://community.icann.org/x/NwSNBQ * Other updates, if applicable 3. Legal basis for purposes and related processing activities Objective of discussion: (1) Agree on legal basis for different purposes and related processing activities a) Review legal basis memo outlining how to differentiate between Art 6.1(b) and Art 6.1(f) and discuss how this can be applied to purposes identified and related processing activities b) Agree on legal basis for purposes and related processing activities * See memo that was circulated prior to this meeting * Lawful test designed by Thomas facilitated the discussions but there was still confusion around what it means "necessary for performance of a contract" * Example found from the UK Information Commissioner's Office - processing must be necessary for the delivery of your part of the contract. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply. * Lawful test in combination with example applies to the EPDP Team purposes. Highlighted in blue is where small team came to agreement on lawful basis, those in orange, based on leadership team assessment. * For purpose A, does this just concern data for WHOIS or is it broader than that - this is focused on the data that is collected by the registrar, regardless of where it is. * Purpose C - focused on registrar communication, but this is mainly for other parties, why is that not included? If it is for other parties, the lawful basis would be 6.1(f). Add second processing activity focused on third parties (6.1(f)). May also be captured under purpose B? * May need to distinguish between what is collected and what goes into an RDDS? For example, in relation to Purpose N. Purpose N not limited to Spec 13, would also include Spec 12 gTLDs. Policy recommendations to cover the circumstances and purposes through which additional data elements are collected, even if those are not published or disclosed through RDDS. * In Purpose A, is a processing activity missing? Responding to requests from Registered Name Holder for purpose A. Should RNH be mentioned as a separate party? RNH is the data subject. * For Purpose A, transmission of registration data - why is this both 6.1(b) and 6.1(f) - isn't protecting against abuse a necessary part of the contract? * For Purpose E, isn't this also 6.1(b) as it is part of the broader requirements? Small team discussed what would present best case for success presenting this to DPAs and agreed on 6.1(f). * BC would support ICANN Org having a direct relationship with registrant to allow for 6.1(b) if this is currently prevented because ICANN does not have a direct contractual relationship with registrants. * For purpose F, why not 6.1(b)? In theory you could abolish contractual compliance and domain name registration would still work, hence 6.1(f) argument. * Need additional processing activity in M for party that files complaint and needs access to information. Needs to be further considered. * Helpful way to lay this out visually, makes it easier to understand. Groups need a bit more time to review and comment. * EPDP Team to review memo and especially link to CIO web-site. * Also note that there where disagreement may persist, this could be called out in the Initial Report as a question for which specific input is requested especially from DPAs. Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties access to this information to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Lawful Basis document, RySG to provide additional data processing steps EPDP Team to review this document and come back with feedback by Wednesday 3 October COB. Action item #3: EPDP Team to review Lawful Basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed Small team to further consider idea of ICANN having direct contract with registrants. 4. Review data elements workbook for purpose C - Enable communication or notification to the Registered Name Holder and/or their delegated parties of technical and/or administrative issues with a Registered Name (see https://community.icann.org/x/5AC8BQ) Objective of discussion: (1) Review data elements workbook for purpose C as completed by small team during LA F2F meeting (2) Agree on data elements needed for this purpose as well as responses to different questions in data elements workbook a) Review data elements workbook for purpose C b) Discuss any outstanding items / questions c) Finalize data elements workbook for purpose C * See data elements workbook for purpose C (see https://community.icann.org/x/5AC8BQ) * Mandatory fields to be collected under 6.1b, optional fields to be collected under 6.1(a) - consent. * What does optional mean? If no admin/tech contact info is provided, does it then default back to the registrant information? * If admin/tech contact info is provided, consent will need to be provided by the admin/tech contact. * If there is no reason to collect the data, would it go against the principle of data minimisation? Is option that is provided to RNH, only those that want to make use of this would opt for it, not a requirement. * In practice it is often a duplicate and no unique information is provided. * You could define two different products: 1 where the registrant acts for all contacts 2 where he / she wishes to designate additional contacts. In such case, both could be 6 I b and collection of third party that would occur based on Art. 14. * Why is making it an optional field problematic? As no one is required to do anything? Under GDPR you will still need to explain why data is collected. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. 5. Share list of outstanding issues and plan for addressing these * See planning document circulated prior to the meeting * How to sign up for small groups? Groups expected to self-organize - ideally max. 1 rep per group. Could use google doc to have an idea of attendance. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. 6. Wrap and confirm next meeting to be scheduled for Thursday 4 October at 13.00 UTC. a) Confirm action items b) Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

8 10

Legal Basis Discussion
by Kurt Pritz Oct. 10, 2018

Oct. 10, 2018

Hi Everyone: Following on Caitlin’s earlier memo that described remaining issues having to do with the determination of Legal Basis, I wish to raise some points in regard to our last full-team meeting where we debated different legal bases for third-party escrow of personal data. . Please excuse another longish email. To facilitate my own understanding and help steer future debate, please let me know where you agree and don’t by number (and if you don’t, why). 1. Whether 6(1)b or 6(1)f applies to Data Escrow is a legal question not a policy question. Once we realized there were differences in team members’ opinion as to whether 6(1)b attached, additional discussion was not fruitful because it was not a policy debate. No one could debate, “6(1)b should be the legal basis for third-party data escrow as a matter of policy.” For the case of Data Escrow, given the current set of facts and elements in GDPR, 6(1)b either is or is not a legal basis for processing to escrow personal data. That will be decided for a DPA. GDPR is a law that has elements and an impartial decider will determine of those elements are met by the data processing described in our policy. 2. It is reasonable for us to debate / discuss whether, under a specific set of circumstances, a legal basis exists for processing data. If we find that a legal basis exists (after determining processing is necessary and principles of minimization are applied), then we include that processing step under our list of purposes. In most (i.e., all or nearly all) cases, we will be correct because we will have done the appropriate analysis. However, it will be for a DPA to review the policy or its implementation before that fact is known for sure. 3. It is our process (and I think our policy) that, in linking a data processing step with a legal basis, we select the first one that clearly attaches, considering them in the following order: a. 6(1)a Consent b. 6(1)b Necessary for performance of contract c. 6(1)f Legitimate interest not overridden by the interests or fundamental rights and freedoms of the data subject If it is debatable whether, say, 6(1)b attaches, we should be able to go on to 6(1)f without having to make the 6(1)b call first. See number 5 below. 4. Regardless of the Legal Basis selected, the same data will processed every time. Taking as an example Data Escrow with a third party provider, the data elements selected must be necessary for the purpose in accordance with the principles of minimization. Then, whether the legal basis is 6(1)b or 6(1)f, the same data will be transmitted to the escrow provider every time. The legal basis test is only performed once, when this new policy in enforced and becomes operational, i.e., where GDPR compliance is demonstrated. I think this is the same in every case. If that is correct, I don’t see why we would urge that one legal basis be selected over another for any reason other than it would be most likely to be accepted by the DPA. 5. At this stage of the game, I don’t understand why we have to pick one legal basis. I understand the practice of ultimately relying on one legal basis, however in the formation of new policy, cannot different scenarios be tested? If several team members think that 6(1)b attaches to data escrow, why must we be forced to either put all our eggs in that basket or ignore it completely? As stated above, this is not a policy decision, it is a legal determination. Why cannot we iterate these issues with DPAs, saying, “Look, this data escrow thing is clearly in the best interests of the data subject and we are only processing the data necessary to accomplish this purpose. We think Art.6(1)b applies here but are not sure. We are certain that 6(1)f applies but if 6(1)b applies that will make our analysis and yours easier.” I don’t think the intent of the new law is to force uninformed decisions. I don’t know of any other arena (except, ironically, maybe the existing Conflict of National Laws Policy) where these choices must be made blindly. Should we be reaching out to DPAs on this issue? I hope you find this a helpful guide to our thinking on this and would appreciate feedback on these thoughts. Best regards, Kurt

3 2

Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call Small team #1/ Thursday, 11 October 2018 at 17:00 UTC
by Terri Agnew Oct. 9, 2018

Oct. 9, 2018

Dear all, Non-members can follow the EPDP small team #1 taking place on Thursday, 11 October 2018 at 17:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u Agenda wiki page: https://community.icann.org/x/KAWrBQ Thank you. Kind Regards, Terri Agnew

1 0