- Gnso-epdp-team - lists.icann.org

Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Thursday, 06 September 2018 at 13:00 UTC
by Andrea Glandon Sept. 4, 2018

Sept. 4, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesday’s and Thursday’s at 13:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/0gONBQ Kind Regards, Andrea Glandon

1 0

Rational regarding Appendix C removal and onward referral
by Alan Woods Sept. 4, 2018

Sept. 4, 2018

Dear team, Please find attached the rationale document as requested, for the suggested removal and onward referral of the contents of Appendix C of the Temp Spec for your review in advance of tomorrow's meeting. Kind regards, Alan Woods [image: Donuts Inc.] <http://donuts.domains> Alan Woods Senior Compliance & Policy Manager, Donuts Inc. ------------------------------ The Victorians, 15-18 Earlsfort Terrace Dublin 2, County Dublin Ireland <https://www.facebook.com/donutstlds> <https://twitter.com/DonutsInc> <https://www.linkedin.com/company/donuts-inc> Please NOTE: This electronic message, including any attachments, may include privileged, confidential and/or inside information owned by Donuts Inc. . Any distribution or use of this communication by anyone other than the intended recipient(s) is strictly prohibited and may be unlawful. If you are not the intended recipient, please notify the sender by replying to this message and then delete it from your system. Thank you.

2 2

Proposed redline on the lawfulness of processing
by Alex Deacon Sept. 4, 2018

Sept. 4, 2018

All, On Thursday I took an action to propose updates that ensures lawfulness of processing is not limited to Article 6.1.f (and thus subject to a balancing test). I've attached a proposed redline for discussion. You will note it addresses Section 4.4 and Appendix C.2 (per my action) and for completeness I also updated Appendix A.4.1 for consistency. Regards, Alex -- ___________ *Alex Deacon* Cole Valley Consulting alex(a)colevalleyconsulting.com +1.415.488.6009

2 2

Project Plan Adjustments and Policy Organization
by Kurt Pritz Sept. 4, 2018

Sept. 4, 2018

Hi Everyone: I am writing to discuss two items. Comments are very welcome. (I apologize for the length of the email.) I. DISCUSSION OF DATA ELEMENTS / ORGANIZATION OF OUR DISCUSSION I took on board the comments made during the last meeting regarding the need to discuss data elements and the apparent skipping from section to section of the Temporary Specification. The project plan essentially follows the path described in the Charter: I.e.: Data Process Purposes —> Data Processing —> Legitimate reasons for disclosure —> Data redaction —> some ancillary but important topics I can see that the examination of the data collected (and therefore available for subsequent types of processing, including disclosure) was not explicitly included. To a certain extent, I think this data set was presumed set (at least by me) to be part of the data redaction discussions. Nonetheless, we cannot describe which data is redacted without specifically describing which data is collected in the first place. With that in mind and the help of Thomas’ work, we will have that topic more explicitly in the agenda today. For organization and jumping from topic to topic, I think we must, at the end of the day, cover each of the sections in the Temporary Specification and decide if and how each topic should be included in the policy. With that in mind we created a project plan that marched through the Temporary Specification in an order that (more-or-less) followed the charter or our common-sense dictates. I included two topics per meeting with the idea that intercessional work would be required on each topic and, after 45 minutes on one topic, we would reach a point of diminishing returns. I think that is still a good approach but we always retain the ability to extend a discussion if we are close to resolution on an issue. II. CONSENSUS POLICY ORGANIZATION REGARDING: PURPOSES FOR PROCESSING gTLD REGISTRATION DATA In our last meeting, I believe we reached a joint understanding of the requirements to be considered a “Lawful Purpose for Processing gTLD Registration Data.” We concluded that these would continue to be categorized under Lawfulness and Purposes of Processing gTLD Registration Data: 4.4.1. – Ability for Registered Name Holder to exercise its rights 4.4.3. – Enabling mechanism for identifying and contacting registered name holder 4.4.4. – Payment and invoicing 4.4.5. – Notification of technical issues 4.4.6. - Notification of commercial or technical changes 4.4.7. – Technical & administrative points of contact 4.4.11. – Safeguarding in case of failure 4.4.12. – Dispute resolution services 4.4.13. – ICANN Contractual Compliance …and these would be memorialized under a different heading: 4.4.2. – Providing access based on legitimate interests not outweighed by the fundamental rights 4.4.8. – Supporting a framework to address consumer protection, investigation of cybercrime, DNS abuse, IP protection 4.4.9. – Framework to address LE needs 4.4.10. – Provision of zone files to Internet users I think this was a great joint understanding of our team (that same understanding only occurred to me in the last several days) and will get us onto determining substance, i.e., the mechanisms for disclosure in the near term. Ashley suggested the latter set be captured in an Appendix. I think that is a good recommendation. As GDPR interpretation evolves or different privacy regimes are adopted, the legitimate reasons (or reasons with a legal basis) for disclosing data to third parties and be changed with adoption of amendments to the Appendix. However, I think the third-party disclosure should be anchored in the Temporary Specification body and incorporate the Appendix by reference. This is similar to other sections of the Temporary Specification. This could be done in one of the two ways in red below and add a new Appendix: 1. Scope 2. Definitions and Interpretation 3. Policy Effective Date 4. Lawfulness and Purposes of Processing gTLD Registration Data * Requirements for Data Disclosure to Third Parties (alternative A) 5. Requirements Applicable to Registry Operators and Registrars 6. Requirements Applicable to Registry Operators Only 7. Requirements Applicable to Registrars Only 7.5 Requirements for Data Disclosure to Third Parties (alternative B) 8. Miscellaneous Appendix A: Registration Data Directory Services Appendix B: Supplemental Data Escrow Requirements Appendix C: Data Processing Requirements Appendix D: Uniform Rapid Suspension Appendix E: Uniform Domain Name Dispute Resolution Policy Appendix F: Bulk Registration Data Access to ICANN Appendix G: Supplemental Procedures to the Transfer Policy Appendix H: Third Party Disclosure Annex: Important Issues for Further Community Action Thanks for taking the time to read and consider this. It came out longer than I planned. Best regards, Kurt

3 2

Additional considerations and materials for Tuesday's meeting
by Marika Konings Sept. 3, 2018

Sept. 3, 2018

Dear All, In follow-up to the agenda that was circulated yesterday, please note that: 1. A preliminary slide deck is attached. In the event that the planned-for input on §4.4 and the appendices is not received in sufficient detail or time for discussion, we also included additional materials and topics. (I.e., the deck is long.) We will tailor the agenda and the slide deck to fit the available meeting time prior to the meeting. 1. We have included input recently received but the agenda and slides will be amended prior to the meeting based on input received in relation to the different action items (thank you to those who have already submitted their proposals!). 1. Proposed modifications to the Temporary Specification that have been submitted will be introduced during Tuesday’s meeting – with substantive discussion in meetings to follow. 1. In last Thursday’s meeting, several mentioned the importance of discussing data elements themselves. This is now item 7 on the agenda. Please find attached an excel spreadsheet that aims to bring together Thomas’s original spreadsheet (attached as a reference) as well as the work that the RDS PDP WG did on this item (factoring in the current purposes and legitimate interests under discussion). As time allows, discussion can begin answering the different charter questions in relation to data elements. 1. Slides have also been included to introduce Appendix A. As stated above, this section was included as a “Plan B” in the event other materials were not received or ripe for discussion. In any case, this is useful reference material that will help you prepare for that discussion. The DSI for Appendix A has also been posted here: https://community.icann.org/x/ExxpBQ. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

1 0

Proposed Agenda - EPDP Team Meeting #10 - 4 September at 13.00 UTC
by Marika Konings Sept. 2, 2018

Sept. 2, 2018

Dear All, Please find below the proposed agenda for Tuesday’s EPDP Team meeting. Note that the agenda is dependent on the timely delivery on the action items from last week’s meeting. As a reminder, you can find the action items and their expected delivery date/time here: https://community.icann.org/x/NwSNBQ. Best regards, Caitlin, Berry and Marika ============ EPDP Meeting #10 Agenda Tuesday, 4 September 2018 1. Roll Call & SOI Updates 1. Welcome and Updates from EPDP Team Chair * Update on status of triage report and expected next steps * Update on status of early input received and proposed approach for considering early input * Other updates, if applicable 1. Proposed modifications to section 4.4 - Registrar / Registry / ICANN processing of data * Review proposed modifications put forward by the Registrar Team * Consider input from EPDP Team members on proposed modifications * Agree on next steps 1. Proposed modifications to section 4.4 – introductory paragraph * Review proposed modification put forward by Alex Deacon * Consider input from EPDP Team members on proposed modifications * Agree on next steps 1. Status update on modifications to section 4 – Third Party Legitimate Interests * revised language for §4.4.2 (Amr Elsadr) * revised language for §4.4.8 (Alex Deacon & Amr Elsadr) * revised language for §4.4.9 (Ashley Heineman) 1. Proposed modifications to Appendix C * Review draft recommendation to ICANN that the subject matter be taken out from consideration by this group and folded into current CPH-ICANN negotiations regarding registration data elements of the RAA and RA. (Alan Woods) * Review proposed amendments to Appendix C, section 2, Lawfulness of Processing, that includes all GDPR mechanisms that allow processing of data (Alex Deacon) * Agree on next steps 1. (Tentative) Data matrix formed from RDS work and Thomas’s chart 1. (Tentative) Introduction to Appendix A 1. Confirm action items and questions for ICANN Org, if any 1. Wrap and confirm next meeting to be scheduled for Thursday 6 September at 13.00 UTC.)

1 0

Section 4 of Temp Spec.
by Kavouss Arasteh Sept. 2, 2018

Sept. 2, 2018

Dear Kurt Dear All Thanks to those who have generously volunteered to look st Section 4 , in particular, certain sub paragraph of that section as well as corresponding parts of Appendix C Having said that I wish to emphasise that it is nit expected to receive new draft from scratch ( total redrafting ) but merely suggesting necessary amendments to the existing text to maintain the relative consistency with the initial documents In addition, the distinguished drafter need to take into account comments already received in TIRAGE from. Various stakeholder groups and ACs as well as those expressed during the discussion( transcriptions, recordings and chats Moreover, it is absolutely necessary to avoid overlapping, repetitions and double application as may contained in other sub paragraphs drafted by others. Some sort of coordination thus nay be required. These suggested drafts should possibly made available 48 hours before the Thursday ( 11th ) meeting which needs to be seen by Kurt before . Agenda of the next meeting should be limited to certain specific issue and not discussing various points at the same time. Attention of respectful drafters are drawn to the fact that several adjectives or terms used which are required to be clearly defined to facilitate the implementation of the suggested / modified sub paragraphs This was raised st various instances and raised by some sub teams Best regards Kavouss

4 5

Re: [Gnso-epdp-team] Factual studies starting to shoot down the "going dark" panic
by Arasteh Sept. 1, 2018

Sept. 1, 2018

Cisco published several reports which is nit supported by public. You may like it but should not be related to redacting nor to the usefulness or otherwise of Whois and is outside the mandate of this group . Moreover,any action if and only if necessary to be taken should be based on multiple studies for long terms for which the inputs, assumptions and statistics should be clearly defined and agreed Regards Have a pleasant week- end Sent from my iPhone > On 1 Sep 2018, at 09:56, Theo Geurts <gtheo(a)xs4all.nl> wrote: > > The Cisco Talos report is basically in line with my personal experience (for years) as a ccTLD registrar who sells ccTLD's where the registry does not publish personal data in the WHOIS. > > Theo >> On 8/31/2018 7:27 PM, farzaneh badii wrote: >> This study supports the argument that WHOIS might not be an essential tool for fighting spam and the world did not see a massive spam apocalypse as it was said it will (it is "a" tool but not essential and most probably replaceable even). Yes it is a short time frame and might not be complete but it is at least based on some data. If there are other studies that provide data that can support the argument that WHOIS is an essential tool for fighting spam (other than all the statements and individual cases) and as a result of compliance with GDPR and redacted personal data of domain name registrants there is an increase in spam, then we can look into them. >> >> I would also like to note that domain name hijacking has decreased according to some registrars as a result of redacted personal info in WHOIS (as was said during our call a couple of weeks ago). Domain name hijacking is an issue domain name registrants especially in developing countries had to deal with for long with almost no recourse nor remedy. They did not have the resources and the knowledge of using UDRP or lodge transfer complaint to get their domain names back. >> >> Privacy in WHOIS might even be good for cybersecurity and protecting trademarks. Why don't we look at it this way too. Not implying that we should not address all other issues that can be raised because of redacted personal information from WHOIS, just saying WHOIS is not that dark because of protection of privacy of domain name registrants. >> >> >> >> >> Farzaneh >> >> >>> On Fri, Aug 31, 2018 at 11:59 AM Arasteh <kavouss.arasteh(a)gmail.com> wrote: >>> Dear All, >>> I am not sure that such study was done fir the whole words or based on some limited area .I do not believe that one could take any conclusion on that >>> Regards >>> Kavouss >>> >>> Sent from my iPhone >>> >>> On 31 Aug 2018, at 17:12, Mueller, Milton L <milton(a)gatech.edu> wrote: >>> >>>> Relevant to the work of this group is the following study from Recorded Future. >>>> >>>> https://www.recordedfuture.com/gdpr-spam-impact/?utm_content=76363539&utm_m… >>>> >>>> >>>> >>>> Entitled “90 Days of GDPR: Minimal Impact on Spam and Domain Registration” >>>> >>>> >>>> >>>> Dr. Milton Mueller >>>> >>>> Professor, School of Public Policy >>>> >>>> Georgia Institute of Technology >>>> >>>> >>>> >>>> <image001.jpg> >>>> >>>> >>>> >>>> _______________________________________________ >>>> Gnso-epdp-team mailing list >>>> Gnso-epdp-team(a)icann.org >>>> https://mm.icann.org/mailman/listinfo/gnso-epdp-team >>> _______________________________________________ >>> Gnso-epdp-team mailing list >>> Gnso-epdp-team(a)icann.org >>> https://mm.icann.org/mailman/listinfo/gnso-epdp-team >> >> >> _______________________________________________ >> Gnso-epdp-team mailing list >> Gnso-epdp-team(a)icann.org >> https://mm.icann.org/mailman/listinfo/gnso-epdp-team

1 0

Pre-emptive request for our consideration of Appendix D&E
by Alan Woods Aug. 31, 2018

Aug. 31, 2018

Dear Kurt and team, In advance of our substantive discussions on the elements of the RPMs within the Temp Spec (Appendix D and E), in the interests of not delaying our deliberations at that time, I believe it prudent for the EPDP team to have the opportunity to review the agreements that ICANN has with the RPM providers, (or at least the Data Processing Agreements), so as to fully consider all safeguards in place, thus tipping the balance in favor of disclosure of the data to the RPM providers. As we already indicated in our triage response, we generally have no issue with the appendix (notwithstanding some process changes on the RPM review side being likely necessary). This does not absolve us however from fully considering the data flow, to confirm the appendices. Our task should be to do a thorough assessment of the required disclosure; documenting the purpose and legal basis for the disclosure; the safeguards applicable to the disclosure; and, in this case, complete our a consideration of the balance of the data subject rights. As the contracted parties do not maintain a direct contractual relationship with any RPM provider, we will therefore need to consider the applicable data processing agreement, to confirm how that data will ultimately be processed by the RPM provider (i.e. drawing inspiration from those elements required under Art 28 of the GDPR - Data Processor Requirements). This will allow for our transparent and well rounded consideration of the data flow, the safeguards in place, leading to a strong outcome for the EPDP consideration of the appendices. As such, I would request that, in the interests of time, the EPDP now requests sight of the relevant documents (whether that be the full agreement or the applicable data processing agreements) from ICANN so that we can duly consider it in the assessment of the appendices when we arrive at that point, in the hopes of moving swiftly along. Kind regards, Alan Woods [image: Donuts Inc.] <http://donuts.domains> Alan Woods Senior Compliance & Policy Manager, Donuts Inc. ------------------------------ The Victorians, 15-18 Earlsfort Terrace Dublin 2, County Dublin Ireland <https://www.facebook.com/donutstlds> <https://twitter.com/DonutsInc> <https://www.linkedin.com/company/donuts-inc> Please NOTE: This electronic message, including any attachments, may include privileged, confidential and/or inside information owned by Donuts Inc. . Any distribution or use of this communication by anyone other than the intended recipient(s) is strictly prohibited and may be unlawful. If you are not the intended recipient, please notify the sender by replying to this message and then delete it from your system. Thank you.

2 1

Re: [Gnso-epdp-team] Responses to early input request
by Marika Konings Aug. 31, 2018

Aug. 31, 2018

Note that early input from the NCSG has just been received as well and has been posted on the same page: https://community.icann.org/x/Ag9pBQ. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Monday, August 27, 2018 at 14:48 To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Responses to early input request For your information, in response to the request for early input, a response was received from the SSAC. Their response, and any further input that may be received has been posted here: https://community.icann.org/x/Ag9pBQ. Staff will make sure to update the background documents section on the wiki with the documents referenced in the SSAC response. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

2 1