- Gnso-epdp-team - lists.icann.org

Re: [Gnso-epdp-team] Correction!!
by Hadia Abdelsalam Mokhtar EL miniawi Aug. 27, 2018

Aug. 27, 2018

Hi Aslam, The charter says " .. complying with the GDPR and other relevant privacy and data protection law .." However this is not the issue nor will it in my opinion add any hurdles to our mission. Best Hadia _______________________________________ From: Aslam Mohamed <gmohamedaslam(a)gmail.com> Sent: 26 August 2018 19:22 To: Hadia Abdelsalam Mokhtar EL miniawi Cc: Mueller, Milton L; Heineman, Ashley; gnso-epdp-team(a)icann.org; Mohamed Aslam Subject: Re: [Gnso-epdp-team] Correction!! Sorry to interrupt Hadia. My understanding is EPDP was tasked to find a way to gain access to WHOIS data without running foul of GDPR and nothing else..compliance with other laws was not part of the EPDP mandate. Anyone to please correct me if my understanding was wrong? Best > On Aug 26, 2018, at 12:51 PM, Hadia Abdelsalam Mokhtar EL miniawi <Hadia(a)tra.gov.eg> wrote: > > Dear All, > > > First off, I would like to mention that it is highly unlikely that ALAC will have alternates present a the F2F meeting, however I have a couple of remarks. First, and as mentioned by others, none of the members represent their personal views but rather the views of their respective group and thus the request for the presence of the alternates is to ensure that the group is well represented and that the alternates are able to step in efficiently and effectively if required to do so. Second, to assume that the alternates and members are present to lobby for what they think is in the best interest of their stakeholder group is not realistic because the mandate of the Temp Spec EPDP team is to ensure that the temp spec as is, or with modifications complies with the GDPR and other relevant laws, so we are all here to work together to ensure compliance, ultimately we all have the same goal. If there are still unresolved items that do not relate to the compliance issue the EPDP team can always recommend future work to the GNSO. > > > Hadia Elminiawi (M.Sc.) > > Director, DNS Entrepreneurship Center > > ________________________________ > From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of Mueller, Milton L <milton(a)gatech.edu> > Sent: 24 August 2018 21:20 > To: Mueller, Milton L; Heineman, Ashley > Cc: gnso-epdp-team(a)icann.org > Subject: [Gnso-epdp-team] Correction!! > > Facepalm. > > I meant THREE (3) fully participating GAC members, not 2. Lost track of their assigned number. > > > From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Mueller, Milton L > Sent: Friday, August 24, 2018 2:41 PM > To: Heineman, Ashley <AHeineman(a)ntia.doc.gov> > Cc: gnso-epdp-team(a)icann.org > Subject: Re: [Gnso-epdp-team] Travel Planning to Los Angeles > > Ashley > I don’t think we need to make a big deal of this. I am fine with letting alternates come, but please let’s stick to the rules in the charter about each unit’s representation. That’s what my colleagues seem to be concerned about, and with good cause. So, e.g., if GAC has 3 or 4 people come, _only_ two of them can participate at a time, and that includes those on the telephone participating remotely. Same deal on our side. Confer all you like in the hallways, chat apps, coffee breaks and Facetime but don’t try to expand the number of full participants assigned to your AC/SG. That’s a basic matter of fairness and of adherence to the group’s charter. > > I really don’t want to have to monitor that during the meeting, but I am telling everyone now I will be watching that like a hawk, and I expect the ePDP chair and ICANN staff to be doing so, also. > > Dr. Milton L Mueller > Professor, School of Public Policy<http://spp.gatech.edu/> > Georgia Institute of Technology > Internet Governance Project > http://internetgovernance.org/ > > > > > From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Heineman, Ashley > Sent: Friday, August 24, 2018 10:32 AM > To: Farzaneh Badiei <farzaneh.badii(a)gmail.com<mailto:farzaneh.badii@gmail.com>>; Ayden Férdeline <icann(a)ferdeline.com<mailto:icann@ferdeline.com>> > Cc: Mark Svancarek \ via Gnso-epdp-team <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> > Subject: Re: [Gnso-epdp-team] Travel Planning to Los Angeles > > > Dear EPDP colleagues, > > > > The United States is concerned that there appears to be a concerted attempt to block the ability of EPDP members and alternates to communicate and confer with each other in real time whether during the regular teleconferences or face to face meetings. To be clear, no one has requested an expansion of the alternates’ role or that alternates speak in addition to members during formal EPDP meetings. No one has requested additional travel support for alternates. Rather, we request that the procedures and protocols for teleconferences and face to face meetings support the ability of members and alternates to confer in real time as they carry out the important and time-sensitive work of the EPDP. > > > > The EPDP Charter clearly articulates that the members are not to represent individual views or positions and thus requires the ability to confer. Nothing in the Charter bars alternates from real time access to meetings or communicating with their primary member colleagues so long as they do not seek to step into to the primary member’s role by addressing remarks to the entire group. > > > > While we fully appreciate and are happy to comply with the EPDP Charter that has limited participation to prescribed numbers, we cannot support overt attempts to stymie openness and transparency as well as the ability of members to confer with colleagues to ensure we are representing the views/formal positions of our SG/C or SO/AC. In the interest of transparency and to promote the efficient work of the EPDP, we urge the EPDP leadership to take steps to ensure that alternates and members are able to attend face to face meetings and teleconferences. > > > > Thanks and I hope we can reach agreement to ensure the successful engagement and ultimate conclusion of the EPDP. > > > > > > ________________________________ > From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Ayden Férdeline <icann(a)ferdeline.com<mailto:icann@ferdeline.com>> > Sent: Friday, August 24, 2018 4:59 AM > To: farzaneh badii > Cc: Mark Svancarek \ via Gnso-epdp-team > Subject: Re: [Gnso-epdp-team] Travel Planning to Los Angeles > > +1 Farzaneh. > > This is not the time to re-write the rules and re-define what is the role of the alternate. The distinction between a member and an alternate is important. > > —Ayden > > On 23 Aug 2018, at 19:05, farzaneh badii <farzaneh.badii(a)gmail.com<mailto:farzaneh.badii@gmail.com>> wrote: > > Dear Kurt > > We have been raising objections about alternates being able to be present at the meeting when they do not replace a member. > > We have provided reasons which I reiterate here: > > 1. Principle: the EPDP membership structure was designed carefully to reach the right balance and representation. Presence of alternates even if they do not speak during the meeting meddles with the balance. Here are my reasons: Alternates can discuss face to face outside of the meeting about the issues, discuss with their counterparts and relay their views much easier so that they can be channeled through the meeting. Nothing inherently wrong with that, but it should not be facilitated either. They can do it on chat, but face to face is more effective. > > 2. Setting precedent: we agreed on the balance of representation and the role of members and alternates at GNSO. We are opening the door to meddling in this role. > > > 3. Unclear intention: What is the intention here exactly? Why are we accommodating this request? I would like to hear why this request was made initially. If the presence of alternates in the room makes no difference, then they can just sit behind their computer and discuss with their colleagues through other means. I am not implying at all that there is a bad intention. But the intention is not clear. Is it to easily replace a member if they are tired in the middle of the meeting? I don't think this is a football match. > > 4. Imbalance of power: Bringing the alternates, in my opinion, adds to the strength of a group and makes it easier for them to deliberate spontaneously. Some groups have the funds to bring in their alternates, some don't. So there will be power imbalance. You could argue that I can just bring in NCSG alternates too. That is not possible. Because they live around the world and we don't have funding to bring them. Also it's against the principle I mentioned above. > > > As a group that has had to fight for being given equal representation in this EPDP, I find it puzzling that accommodating such requests that can bring imbalance of representation is being done so easily. > > > Best > > > > Farzaneh > > > On Thu, Aug 23, 2018 at 12:36 PM Kurt Pritz <kurt(a)kjpritz.com<mailto:kurt@kjpritz.com>> wrote: > Hello Everyone: > > After reviewing the chat and content of our call Tuesday, 21 August, it has been decided to proceed with the meeting in Los Angeles as proposed. (See bullet three, below.) > > 1. Members who are attending in person already should have travel arrangements in process. > > 2. Members unable to attend should have designated their alternates for attendance, who should be in contact with ICANN regarding travel arrangements. (See Alternate Assignment form, https://docs.google.com/forms/d/e/1FAIpQLScuCvS7vKS4MuaXwJmDcUHtOTskg6t5qrS…<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.googl…>) Remote participation is available for members that prefer to participate remotely instead of designating an alternate. > > 3. Members who are attending but will miss a portion of the meeting should designate an alternate who will replace that member when they are gone from the meeting for a significant period. That alternate will be permitted to sit in on the entire three-day meeting but participate only when the member is absent from the meeting. In these cases, alternates will not be provided travel funding. Travel funding is allocated based on the number of members in each group. > > Remote participation will also be available for those members that prefer to participate remotely instead of designating an alternate. > > If any of the above is not clear or if you have questions, you can contact me, Rafik or the ICANN Support Team. > > Through this email, I am asking Terri Agnew to follow up with you to ensure all necessary travel is planned and funded. > > I am looking forward to the meeting and commit to work with the support staff to make the effort on your part worth your while. > > Best regards, > > Kurt > > _______________________________________________ > Gnso-epdp-team mailing list > Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> > https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmm.icann.o…> > > _______________________________________________ > Gnso-epdp-team mailing list > Gnso-epdp-team(a)icann.org > https://mm.icann.org/mailman/listinfo/gnso-epdp-team

1 0

Correction!!
by Mueller, Milton L Aug. 26, 2018

Aug. 26, 2018

Facepalm. I meant THREE (3) fully participating GAC members, not 2. Lost track of their assigned number. From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Mueller, Milton L Sent: Friday, August 24, 2018 2:41 PM To: Heineman, Ashley <AHeineman(a)ntia.doc.gov> Cc: gnso-epdp-team(a)icann.org Subject: Re: [Gnso-epdp-team] Travel Planning to Los Angeles Ashley I don't think we need to make a big deal of this. I am fine with letting alternates come, but please let's stick to the rules in the charter about each unit's representation. That's what my colleagues seem to be concerned about, and with good cause. So, e.g., if GAC has 3 or 4 people come, _only_ two of them can participate at a time, and that includes those on the telephone participating remotely. Same deal on our side. Confer all you like in the hallways, chat apps, coffee breaks and Facetime but don't try to expand the number of full participants assigned to your AC/SG. That's a basic matter of fairness and of adherence to the group's charter. I really don't want to have to monitor that during the meeting, but I am telling everyone now I will be watching that like a hawk, and I expect the ePDP chair and ICANN staff to be doing so, also. Dr. Milton L Mueller Professor, School of Public Policy<http://spp.gatech.edu/> Georgia Institute of Technology Internet Governance Project http://internetgovernance.org/ From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Heineman, Ashley Sent: Friday, August 24, 2018 10:32 AM To: Farzaneh Badiei <farzaneh.badii(a)gmail.com<mailto:farzaneh.badii@gmail.com>>; Ayden Férdeline <icann(a)ferdeline.com<mailto:icann@ferdeline.com>> Cc: Mark Svancarek \ via Gnso-epdp-team <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Travel Planning to Los Angeles Dear EPDP colleagues, The United States is concerned that there appears to be a concerted attempt to block the ability of EPDP members and alternates to communicate and confer with each other in real time whether during the regular teleconferences or face to face meetings. To be clear, no one has requested an expansion of the alternates' role or that alternates speak in addition to members during formal EPDP meetings. No one has requested additional travel support for alternates. Rather, we request that the procedures and protocols for teleconferences and face to face meetings support the ability of members and alternates to confer in real time as they carry out the important and time-sensitive work of the EPDP. The EPDP Charter clearly articulates that the members are not to represent individual views or positions and thus requires the ability to confer. Nothing in the Charter bars alternates from real time access to meetings or communicating with their primary member colleagues so long as they do not seek to step into to the primary member's role by addressing remarks to the entire group. While we fully appreciate and are happy to comply with the EPDP Charter that has limited participation to prescribed numbers, we cannot support overt attempts to stymie openness and transparency as well as the ability of members to confer with colleagues to ensure we are representing the views/formal positions of our SG/C or SO/AC. In the interest of transparency and to promote the efficient work of the EPDP, we urge the EPDP leadership to take steps to ensure that alternates and members are able to attend face to face meetings and teleconferences. Thanks and I hope we can reach agreement to ensure the successful engagement and ultimate conclusion of the EPDP. ________________________________ From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Ayden Férdeline <icann(a)ferdeline.com<mailto:icann@ferdeline.com>> Sent: Friday, August 24, 2018 4:59 AM To: farzaneh badii Cc: Mark Svancarek \ via Gnso-epdp-team Subject: Re: [Gnso-epdp-team] Travel Planning to Los Angeles +1 Farzaneh. This is not the time to re-write the rules and re-define what is the role of the alternate. The distinction between a member and an alternate is important. -Ayden On 23 Aug 2018, at 19:05, farzaneh badii <farzaneh.badii(a)gmail.com<mailto:farzaneh.badii@gmail.com>> wrote: Dear Kurt We have been raising objections about alternates being able to be present at the meeting when they do not replace a member. We have provided reasons which I reiterate here: 1. Principle: the EPDP membership structure was designed carefully to reach the right balance and representation. Presence of alternates even if they do not speak during the meeting meddles with the balance. Here are my reasons: Alternates can discuss face to face outside of the meeting about the issues, discuss with their counterparts and relay their views much easier so that they can be channeled through the meeting. Nothing inherently wrong with that, but it should not be facilitated either. They can do it on chat, but face to face is more effective. 2. Setting precedent: we agreed on the balance of representation and the role of members and alternates at GNSO. We are opening the door to meddling in this role. 3. Unclear intention: What is the intention here exactly? Why are we accommodating this request? I would like to hear why this request was made initially. If the presence of alternates in the room makes no difference, then they can just sit behind their computer and discuss with their colleagues through other means. I am not implying at all that there is a bad intention. But the intention is not clear. Is it to easily replace a member if they are tired in the middle of the meeting? I don't think this is a football match. 4. Imbalance of power: Bringing the alternates, in my opinion, adds to the strength of a group and makes it easier for them to deliberate spontaneously. Some groups have the funds to bring in their alternates, some don't. So there will be power imbalance. You could argue that I can just bring in NCSG alternates too. That is not possible. Because they live around the world and we don't have funding to bring them. Also it's against the principle I mentioned above. As a group that has had to fight for being given equal representation in this EPDP, I find it puzzling that accommodating such requests that can bring imbalance of representation is being done so easily. Best Farzaneh On Thu, Aug 23, 2018 at 12:36 PM Kurt Pritz <kurt(a)kjpritz.com<mailto:kurt@kjpritz.com>> wrote: Hello Everyone: After reviewing the chat and content of our call Tuesday, 21 August, it has been decided to proceed with the meeting in Los Angeles as proposed. (See bullet three, below.) 1. Members who are attending in person already should have travel arrangements in process. 2. Members unable to attend should have designated their alternates for attendance, who should be in contact with ICANN regarding travel arrangements. (See Alternate Assignment form, https://docs.google.com/forms/d/e/1FAIpQLScuCvS7vKS4MuaXwJmDcUHtOTskg6t5qrS…<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.googl…>) Remote participation is available for members that prefer to participate remotely instead of designating an alternate. 3. Members who are attending but will miss a portion of the meeting should designate an alternate who will replace that member when they are gone from the meeting for a significant period. That alternate will be permitted to sit in on the entire three-day meeting but participate only when the member is absent from the meeting. In these cases, alternates will not be provided travel funding. Travel funding is allocated based on the number of members in each group. Remote participation will also be available for those members that prefer to participate remotely instead of designating an alternate. If any of the above is not clear or if you have questions, you can contact me, Rafik or the ICANN Support Team. Through this email, I am asking Terri Agnew to follow up with you to ensure all necessary travel is planned and funded. I am looking forward to the meeting and commit to work with the support staff to make the effort on your part worth your while. Best regards, Kurt _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmm.icann.o…>

2 1

Proposed Agenda - EPDP Team Meeting #8 - 28 August at 13.00 UTC
by Marika Konings Aug. 25, 2018

Aug. 25, 2018

Dear All, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 28 August at 13.00 UTC. Please also take note of the separate message that was sent by Kurt re. homework. Best regards, Caitlin, Berry and Marika EPDP Meeting #8 Agenda Tuesday, 28 August 2018 1. Roll Call & SOI Updates (2 min) 1. Welcome and Updates from EPDP Team Chair (3 min) 1. Reconcile input received on Triage Report, if needed, and confirm report for submission to the GNSO Council (5-10 min) 1. Review of project plan (10 min) (see also section category allocation attached) 1. Touch base on comments received on & review status of: (10-20 min) 1. Appendix D – Uniform Rapid Suspension (see discussion summary index (DSI) at https://community.icann.org/x/ExxpBQ) 1. Appendix E – Uniform Domain Name Resolution Dispute Policy (see DSI at https://community.icann.org/x/ExxpBQ) 1. Appendix G: Supplemental Procedures to the Transfer Policy (see DSI at https://community.icann.org/x/ExxpBQ) 1. Commence deliberations for section 4.4 – Lawfulness and Purpose of Processing gTLD Registration Data (see DSI at https://community.icann.org/x/ExxpBQ) (50 min) 1. Confirm action items and questions for ICANN Org, if any (5 min) 1. Wrap and confirm next meeting to be scheduled for Thursday 30 August at 13.00 UTC.) Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

1 0

Preparation for next meeting with attachment and link
by Kurt Pritz Aug. 24, 2018

Aug. 24, 2018

Dear All: As mentioned, there is a homework assignment for our next meeting. I apologize for this coming out so late but I hope you recorded some of these from the meeting discussion on homework and have been thinking about them. 1. Temporary Specification sections 4.4.1-4.4.13: Please review the attached discussion summary index (DSI) for section 4.4.1-13, as well as your own notes and the record of the triage discussion. Our discussion’s objective is to redline this section so that it complies with GDPR taking into account: · advice provided by the EDPB, · input that has been provided by other members of the EPDP Team, (All the information cited above is included in the DSI.) It will be very helpful if you share proposals regarding each of the with the mailing list as soon as possible, and particularly by Monday 18.00 UTC. The purpose in gathering written comment is so that commonalities can be identified in your proposals in order to better focus the discussion. 2. Appendix D, E and G: Provide proposed edits (using the DSIs if possible) for Appendix D, E and G, having to do with URS, UDRP and Transfers, respectively. Please share your proposed edits to these sections on the mailing list that would address the comments / issues that have been identified. Understanding that these sections have already been put into operation, please flag specific changes that are required to be addressed in the initial report, i.e., are of an urgent nature, needing to be addressed as a matter of priority. Links to all the DSIs will be posted to: https://community.icann.org/x/ExxpBQ <https://community.icann.org/x/ExxpBQ> For the meeting Tuesday, I think having printouts of the DSIs and your Temporary Specification would be handy. In some cases we might decide that certain sections do not affect Temporary Specification compliance with GDPR and can be placed for later discussion. I am working on a discussion flow for our next meeting to make efficient and meaningful use of your time. If you have thoughts on this please let me know. I will follow up on this with my thoughts in a subsequent email. Thanks in advance for providing your thoughts on these issues. Best regards, Kurt

1 0

Preparation for next meeting
by Kurt Pritz Aug. 24, 2018

Aug. 24, 2018

Dear All: As mentioned, there is a homework assignment for our next meeting. I apologize for this coming out so late but I hope you recorded some of these from the meeting discussion on homework and have been thinking about them. 1. Temporary Specification sections 4.4.1-4.4.13: Please review the attached discussion summary index (DSI) for section 4.4.1-13, as well as your own notes and the record of the triage discussion. Our discussion’s objective is to redline this section so that it complies with GDPR taking into account: · advice provided by the EDPB, · input that has been provided by other members of the EPDP Team, (All the information cited above is included in the DSI.) It will be very helpful if you share proposals regarding each of the with the mailing list as soon as possible, and particularly by Monday 18.00 UTC. The purpose in gathering written comment is so that commonalities can be identified in your proposals in order to better focus the discussion. 2. Appendix D, E and G: Provide proposed edits (using the DSIs if possible) for Appendix D, E and G, having to do with URS, UDRP and Transfers, respectively. Please share your proposed edits to these sections on the mailing list that would address the comments / issues that have been identified. Understanding that these sections have already been put into operation, please flag specific changes that are required to be addressed in the initial report, i.e., are of an urgent nature, needing to be addressed as a matter of priority. In some cases we might decide that certain sections do not affect Temporary Specification compliance with GDPR and can be placed for later discussion. I am working on a discussion flow for our next meeting to make efficient and meaningful use of your time. If you have thoughts on this please let me know. I will follow up on this with my thoughts in a subsequent email. Thanks in advance for providing your thoughts on these issues. Best regards, Kurt

1 0

Travel Planning to Los Angeles
by Kurt Pritz Aug. 24, 2018

Aug. 24, 2018

Hello Everyone: After reviewing the chat and content of our call Tuesday, 21 August, it has been decided to proceed with the meeting in Los Angeles as proposed. (See bullet three, below.) 1. Members who are attending in person already should have travel arrangements in process. 2. Members unable to attend should have designated their alternates for attendance, who should be in contact with ICANN regarding travel arrangements. (See Alternate Assignment form, https://docs.google.com/forms/d/e/1FAIpQLScuCvS7vKS4MuaXwJmDcUHtOTskg6t5qrS…) Remote participation is available for members that prefer to participate remotely instead of designating an alternate. 3. Members who are attending but will miss a portion of the meeting should designate an alternate who will replace that member when they are gone from the meeting for a significant period. That alternate will be permitted to sit in on the entire three-day meeting but participate only when the member is absent from the meeting. In these cases, alternates will not be provided travel funding. Travel funding is allocated based on the number of members in each group. Remote participation will also be available for those members that prefer to participate remotely instead of designating an alternate. If any of the above is not clear or if you have questions, you can contact me, Rafik or the ICANN Support Team. Through this email, I am asking Terri Agnew to follow up with you to ensure all necessary travel is planned and funded. I am looking forward to the meeting and commit to work with the support staff to make the effort on your part worth your while. Best regards, Kurt

7 6

Notes and action items from today's EPDP Team Meeting - 23 August 2018
by Caitlin Tubergen Aug. 23, 2018

Aug. 23, 2018

Dear All, Below, please find notes and action items from today’s EPDP Team Call. As a reminder, our next meeting will be Tuesday, 28 August, 13:00 UTC. Best regards, Marika, Berry, and Caitlin EPDP Team Meeting - 23 August 2018 High-level Notes/Actions: Please provide additional input (if any) on the Triage Report by Friday, 24 August at 19.00 UTC. The Triage Report, scheduled for release early next week, will include the following appendices or companion documents: all the survey responses sorted by group and sorted by Temporary Specification section; a print version of the opening statements made by each group; Early Inputs submitted by each group. The Team has now begun substantive discussion of the Temporary Specification. As a tool to aid in these discussions, the support team will distribute discussion summary indexes for each survey section, which provides the relevant Temporary Specification text, related charter question(s), EPDP Team Members’ feedback provided to date (via the triage surveys), related EDPB advice (if any). The discussion summary index also provides a field in which EPDP Team Members may propose modified text. Members of the group raised the utility of performing a privacy impact assessment. Three takeaways were for members to understand the benefits of such an assessment in the work, suggest which elements could be helpful to undertake (given the timeline), and also to ask ICANN if it was planned that an impact assessment will be undertaken. See, https://bit.ly/2OVgeYY. In discussing whether and how other privacy regimes impact our work, the support team pointed out that other privacy regulations can be found at https://bit.ly/2PxFt4I. It was also indicated by Thomas and Alan that, as a generalization, GDPR provides a “high-water mark. I.e., if our work is GDPR compliant, it should be universally compliant. It was suggested that ICANN be asked to perform an assessment to determine if other privacy regimes should be analyzed for possible inclusion into this work. Per the proposed strategy discussed today, the Leadership Team is working together to propose a detailed project plan, which outlines the order in which the EPDP Team will deliberate on the sections of the Temporary Specification. For more detail on the strategy, please refer to the detailed notes. With regard to next steps, there were several recommendations that we examine the purposes of collecting and purposes of accessing data. That input matches with the existing plan to undertake a look at sections 4.4.1-4.4.13 next, which describe the uses of data. The corresponding discussion summary index that will be distributed for this discussion will include the charter questions that might be answered in parallel with this inquiry. As a prerequisite to that discussion, we will discuss the purposes of collecting data. This was discussed in depth in the RDS working group and the support team will document the findings by that working group. All Action Items: Preliminary input on the triage report is due Friday, 24 August. Goal is to submit the triage report early next week. For any groups who plan to respond to the requests to provide early input, please do so as soon as possible. Support Team to provide EPDP Team with output of RDS PDP WG’s work on which data elements are required to register a domain name and maintain that registration. EPDP Team members to look at the discussion summary indexes for Appendix D, E, F and provide recommend redlines (if any) to the email list. We will attempt to address these sections via email rather than take up meeting time with them. Support team to distribute discussion summary index for Section 4.4, as well as RDS findings with regards to the purposes of collecting registrant data. EPDP Team members to review discussion summary index for Section 4.4 in preparation to discuss at next EPDP Team meeting on Tuesday, 28 August at 13.00 UTC These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates Attendance will be taken via the Adobe Connect Room. SOIs must be kept up-to-date. All relevant documentation can be found on the EPDP wiki space. Please remember to state your name before speaking. 2. Welcome and Updates from EPDP Team Chair We will be moving from discussing every section of the Temporary Specification in the triage surveys and turning to a substantive review of specific sections. We will spend the first part of the meeting discussing the strategy for moving forward. 3. Preliminary input on Triage Report (deadline for input: Friday, 24 August at 19:00 UTC) Preliminary input on the triage report is due Friday, 24 August. Goal is to submit the triage report early next week. As a reminder, for any group who would like to respond to the early input requests, please do so as soon as possible. The triage report will be updated to include all submitted comments. 4. Proposed approach for moving forward, including review of proposed project plan A GDPR-compliant specification is required by 25 May, requiring a good portion of our work to be completed in October. GDPR-compliance requires, among other things, that the sections specifying processor requirements must have the consensus support of this team Some prioritization is required that takes into account: The time available Sections that require registrar / registry & other processor actions Issue complexity Which sections are already in operation and functioning Availability of EDPB and other guidance Further guidance is possible (dependent on timing) New questions for EDPB or DPAs Clarification requests of existing guidance But case law and standard practices will be lacking EPDP Team feedback: The goal is to comply with GDPR Any successor should take into account emerging privacy law in other jurisdictions. Aiming to tackle the topic of privacy in a more holistic way would be a more efficient use of our time. Examples could include privacy-by-design principles or a privacy impact assessment What is a privacy impact assessment? Generally, a privacy impact assessment would be a systematic process conducted by government agencies or businesses to reflect on privacy and see how various practices impact individuals Is some sort of survey needed of other privacy regimes? A privacy impact assessment has been around in several jurisdictions for years. The only problem in doing a privacy impact assessment is that it's only as good as the framework you apply, and since there are over 100 national laws around the world, you would have to select the leader or come up with a framework that allows you to select other laws. In the context of emerging legislative and regulatory initiatives that may impact on ICANN, please see https://www.icann.org/en/system/files/files/legislative-regulatory-fy18-23a…. This is something that is actively being tracked. It might not be necessary to select a particular regime for a privacy impact assessment. The GDPR is principle-based, and the principles can be applied broadly. The privacy impact assessment could be based on broad principles. What we are effectively doing in the EPDP is a privacy impact assessment of the temp spec ourselves -- for example, are the purposes connected to a solid legal basis? Doing a privacy impact assessment for ICANN would be a complicated and expensive exercise. Other companies may look at this type of work as a threat assessment -- what are we trying to protect? Who has access to it? Who is using it? Is there a specific question to ask ICANN - whether any of the other regimes create requirements above and beyond the GDPR? Proposed Criteria for Discussion Planning Priority must be assigned to those sections: affected by EDPB advice, i.e., where change is mandated by advice received after the specification was written where the Team has indicated the likelihood that change is required to bring the section into compliance with GDPR Requiring less attention are issues that are not expected to impact the Temporary Specification’s compliance with the GDPR, such as: operations changes to existing consensus policy such as UDRP or Transfers requirements issues that can be settled after the initial report is launched, e.g., SLAs to be negotiated between contracted parties and ICANN, Best practices and reporting requirements where it is thought the Temporary Specification is overly prescriptive Unless a pre-requisite to the issues above, those items that do not direct registry and registrar actions can be considered as time is available such as: background, rationale, justification, administrative sections. Sections affected by EPDB are Category 1. Sections where the Team Indicated Amendment to the Temp Spec is desirable are Category 2. Sections related to transfers, DRPs and require little or no change, are Category 3. Sections involving background, admin are Category 4. For sections where there is pertinent EDPB guidance or where the Team has indicated a likelihood that change is required: Allocate time to ensure a common understanding of: The Temporary Specification section Existing EDPB advice or other authority Previous discussion and the issues raised Deliberate what changes, if any, are required, to ensure that the advice has been addressed. As these are more complex issues the discussion might be plan to extend over (a part of) two or three sequential meetings. If it becomes clear that additional information, research or guidance is necessary, or that progress might be facilitated by offline discussion between two or more parties, then a small group might be assigned work, that will operate based on the task assigned: Populated by interested and necessary parties Working methods (e.g., email, conference) based on the task assigned With delivery set to support a delivery of the initial report This approach is meant to be flexible. For sections that are not expected to impact the Temporary Specification’s compliance with the GDPR, or those items that do not direct registry, registrar and other processor actions: Time will be allocated for a briefing on these items during meetings to review the previous discussion and issues raised. In many cases, attaining consensus might be attained in a brief period. Where addition refinement is necessary an expert group might be asked to provide additional information or recommend an amendment: Ex: where the Temporary Specification recommends content for Privacy Notices to be posted by registrars: a registrar and GDPR expert might be asked to create a better approach Wherever possible, this additional work would be considered and included in the initial report. If not and based on the subject matter, the Team will consider the timing of inserting the new draft into the successor specification for approval. Depending on the review and the approval cycle, inclusion into the successor specification might occur before or after the final report. (This is a ”parking lot” where issues will be recorded and resolved.) EPDP Team Feedback: While not against this approach, using an example - for discussing transfers, you first need to discuss what data goes to a registry. Depending on that outcome, you can then discuss transfers. It's important to have the questions in the correct sequence so that problems don't occur and/or already-proposed changes need to be corrected later in the process. A point of contention between people in the group is whether ICANN has made the legal argument over where information can be collected and later distributed. Who is responsible for building the legal argument? Is it the EPDP team's job or is that ICANN org's job? ICANN may believe it has built the legal argument in the Temp Spec, but there is a question whether that has been satisfied in this group. Perhaps the team can tailor the discussion around the processing of data under GDPR - after doing that, the team can go back and look at ICANN's powers. The EPDP Team needs to deal with the fundamental issues regarding what data needs to be collected and redacted. ICANN org thinks it has already done this, but the team should come to an agreement on the redacted data elements. Purpose and collection is equally fundamental, but it's unlikely the team will come to agreement on that. Agreeing on redacted data elements appears to be a concrete and specific task. Our charter lays out the questions (and the sequence to be used to answer them) quite nicely. Our charter already laid out the sequence, so the team should follow the charter and use that order of how to approach the work. The Team can decide how to tackle the work, but the charter provides a good order to begin with. For example, tackling purposes is critical. If we do not come up with an agreed upon set of purposes for our deliberations, we will never agree on other points. Agree that we need to debate the purposes. The GAC's next meeting is to discuss what data will be provided, and how will the data be transferred. The purpose issue is primary; however, having debated purposes since 2005, there is concern we will never move past that. Some may approach this as what data they would like access to and work backwards to try to get data. What is the plan when we discover we cannot agree on purposes? This EPDP was formed to break this deadlock, and as a group, we have to find a way to move forward. It will be impossible to debate other sections without first agreeing on purposes. People tend to justify data they need and define purposes based on that; however, one thing that we could catch in a privacy impact assessment is what problem are we trying to solve? You may or may not have to collect information to solve a problem. As we discuss purposes, we should come back to the problems we need to solve, like hijacked domain names. The problems may also be a source of contention, but the group may agree on these problems. What the group should aim for is to make sure that the purposes listed do comply with the privacy laws. In terms of going about the work the team needs to do, debates around purpose would happen in category 2, but perhaps the group needs to see the full schedule. Maybe if the group maps the schedule based on the flowchart in the slides, and include the charter questions for each piece of work, the team could see the roadmap and have a better idea of the work going forward. Some members believe the discussion of purpose may be theoretical and abstract, but this is problematic. If purposes of the data to be collected is abstract in theory, the whole Temp Spec is abstract in theory. We are operating in a multi-stakeholder environment – we are trying to retrofit a set of policies and contracts so that it does not violate data protection law and the GDPR. Naturally, we have a hard time determining purpose because many of the stakeholders consider their purpose the same as the registrar’s purpose. The actual purpose for collecting registration data is a very narrow one – it is for the domain name to function. Publishing this data is not a legitimate purpose. The RDS Team raised most of these arguments, and if we have to rehash these arguments, this team will fail. What problem are we trying to solve, and what data do we need? This question is inherently problematic – rather than collecting use cases, we should ask what is ICANN’s purpose. If we continue to focus on what data we need, we lose sight of the problem. If I had a guarantee that if I go to a Ry/Rr and get information in a predictable timeframe, I may never have to see the data (probably unlikely), but this is a possibility. There is a trap for an attractive piece of data and why it should be published, and we should avoid this. Let’s look to the technical people to solve the problems of bulk access. Focusing on the data itself is a bit of a trap. Focusing instead on purposes is very important. ICANN needs to collect data to fulfill its purposes – its purposes are not IP or law enforcement; however, the data is collects may be useful to entities with legitimate purposes. If we recognize the difference between ICANN’s purpose and third-party purposes, the group can make progress. When we confuse third party purpose with the purpose of WHOIS is where we run into trouble. We should first look at what data needs to be collected for domain name registration. Then we can look at what additional data might be required – that could include additional data under consent. Then, you can look at transfer of data to other parties. If we go through that thought process, we can look at what data can be collected in domain name registration. As well as looking at what is necessary for registration contracts, we need to look at ICANN’s mission/coordination role. GDPR recognizes there are legitimate purposes and exemptions – what is missing from our conversation is an assessment of necessity and proportionality. One problem is that we have different opinions on what ICANN’s mission is – one part of ICANN’s mission is to secure a trusted DNS. What does ICANN need to do to achieve that part of our mission – that is where the tie-in to law enforcement and third-party interests lie. The team seems to be confusing several issues – one thing we need to talk about is enforcement of contracts. There is an agreement in the registration agreement that the registrant submits to UDRP disputes. This is squarely within the mission of ICANN and providing a framework for having a trusted DNS. The mission is not that narrow. What the team should do is try to peel the onion. Start by looking at data collected for the registrant – look at what is required to register a domain name and maintain that registration. We are conflating what is required to perform a contract with the overarching goals ICANN has in its mission. The RDS WG already did some of this work. One of the homework assignments is to go back to the RDS WG’s work to look at which data elements are required to register a domain name and maintain that registration. Our future conversations will be guided by discussion summary indexes. For each section (and relevant sub-sections) a scorecard will be prepared to facilitate the deliberations which will include: Current text Identification of category Related charter question(s) Support indicated as result of triage effort DPA/EDPB Advice (if any) Proposed changes / rationale for change (as provided by EPDP Team in response to triage surveys) Information to be completed: Proposed response to charter question(s) High level summary of the deliberations and/or recommendation(s) Proposed modification of text (if appropriate) Level of consensus Data Summary Index to facilitate development of Initial Report The number of meetings we have to get the work done is limited, as displayed on the screen. The leadership team is embarking on how to divide the work in the meetings. 5. Commence deliberations and review of Appendix D – Uniform Rapid Suspension (see discussion summary index) 6. Commence deliberations and review of Appendix E – Uniform Domain Name Resolution Dispute Policy (see discussion summary index) 7. If time allows, commence deliberations and review of Appendix G: Supplemental Procedures to the Transfer Policy (see scorecard attached) 8. Wrap and confirm next meeting to be scheduled for Tuesday 28 August at 13.00 UTC. Action Items: Preliminary input on the triage report is due Friday, 24 August. Goal is to submit the triage report early next week. For any groups who plan to respond to the requests to provide early input, please do so as soon as possible. Support Team to provide EPDP Team with output of RDS PDP WG’s work on which data elements are required to register a domain name and maintain that registration. EPDP Team members to looks at the discussion summary indexes for Appendix D, E, F and provided suggested mark-ups (if any) to the email list Support team to distribute discussion summary index for Section 4.4 EPDP Team members to review discussion summary index for Section 4.4 in preparation to discuss at next EPDP Team meeting on Tuesday, 28 August at 13.00 UTC

1 0

Re: [Gnso-epdp-team] Coordination between ICANN org and EPDP
by Kurt Pritz Aug. 23, 2018

Aug. 23, 2018

Hello Göran: Thanks very much for contacting me and your note I have repeated some your email below so that there is a clear connection between your questions and my responses. Today, ICANN org held a call to provide community leaders with updates regarding various GDPR activities. The slides and recording of the call are available at https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en <https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en>. On the call, a few community leaders reinforced the value of coordination between ICANN org and the EPDP Working Group, particularly around access model. To this end, please share with us any thoughts you might have regarding a process by which: 1) ICANN org can share guidance we receive from the DPAs and European Data Protection Board with the EPDP Working Group. Generally, our Team discussions are appropriately aimed at refining / altering ICANN processes so they are GDPR compliant. So guidance, case law or authoritative opinions received that provides compliance requirements will be extremely helpful. a. Through its many recent actions: engaging with the ICANN community, governments, the EDPB, and others, it is apparent that ICANN is the midst of executing a plan to obtain certainty around the various GDPR provisions. It would be instructive for the EPDP Team if ICANN were to share its plan (or elements of it) so that the team can anticipate the receipt (and timing) of new information. It would also indicate where there is likely no additional information, i.e., where the team would be left to draw conclusions based on the information that is already available. This information would likely cut down on the number of questions the ICANN Org receives from the team. We understand that the plan must have a degree of informality and be flexible, with each step based upon the information received in the step before it. However, where available, it would be instructive to know the planned-for objectives, expected learnings, a set of ultimate questions to be answered, planned inquiries, targets and so on. b. While ICANN has published each communication, the findings or results of those communications have not been organized in anyway of which we know. For example, observers of the back-and-forth between the ICANN Org and the EDPB have offered conclusions that can be drawn from these documents. However, no one has organized those conclusions in a way that might become a rule set or set of guidelines for those reviewing the Temporary Specification or creating an access model. Coincidentally, in today’s EPDP meeting such a request was made: for disclosure of all the communications with the EDPB and DPAs, the staff commentary to those communications, and some organization of same. c. We also wish to hear of developments related to GDPR in other industries, if available, such as: what data processing protocols have been adopted what data processing protocols have been tested in courts what other privacy regimes are in works in other jurisdictions what data is available regarding: the effects of GDPR on malfeasance detection, avoidance other positive or negative effects of GDPR d. Finally, it’d be helpful to be made aware of the details of ICANN’s GDPR implementation plan as ICANN org had to take on the advice of DPAs and the EDPB in fashioning that. (This is a request made from the EPDP team in yesterday’s meeting and so this request has been repeated to the ICANN liaisons working with the EPDP.) 2) How the EPDP Working Group will provide input regarding access to ICANN org to use in our interactions with DPAs and European Data Protection Board to obtain legal guidance that will help guide the Working Group in its work. As you know, we post all information we receive through our blogs and engage with stakeholders, also through communications we post whether through correspondence or comments via gdpr(a)icann.org <mailto:gdpr@icann.org>. a. A point of information: The EPDP team’s third set of deliverables is to provide an, “Initial Report and a Final Report regarding the EPDP Team’s recommendations … for a System for Accredited Access to Non-Public Registration Data.” Work on this could begin as early as the completion and publication of the Initial Report on the Temporary Specification. (The Team stays in close contact with the GNSO Council leadership in pursuit of the deliverables to ensure the spirit and letter of the EPDP Charter is followed.) b. While our current answer to this question is not yet finely honed, it is likely that, from time to time, the EPDP Team will have question regarding the constraints / opportunities imposed by the GDPR. These questions might take the form of a proposed access model (or elements of an access model). The EPDP Team will forward those to ICANN, which, in turn, can test them against its own knowledge base, with DPAs, with the EDPB, or elsewhere. c. As ICANN is a data controller involved in the collection, use and disclosure of the same data that is the subject matter of this Team’s work, it is expected that ICANN will work with the team on the successor to the Temporary Specification and an access model. I hope you find this response helpful. The team is keen to continue an active correspondence with ICANN in order to flesh out the framework provided by GDPR with detailed clarifications, implementation guidance and cases from other, similarly situated industries that have faced many of these same issues. We also plan to remain in close communication with ICANN leaders on this topic, through the ICANN-provided liaisons to the EPDP Team. Sincerely, Kurt > On Aug 14, 2018, at 8:17 AM, Goran Marby <goran.marby(a)icann.org> wrote: > > Kurt, > > Today, ICANN org held a call to provide community leaders with updates regarding various GDPR activities. The slides and recording of the call are available at https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en <https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en>. > > On the call, a few community leaders reinforced the value of coordination between ICANN org and the EPDP Working Group, particularly around access model. To this end, please share with us any thoughts you might have regarding a process by which (1) ICANN org can share guidance we receive from the DPAs and European Data Protection Board with the EPDP Working Group; and (2) How the EPDP Working Group will provide input regarding access to ICANN org to use in our interactions with DPAs and European Data Protection Board to obtain legal guidance that will help guide the Working Group in its work. As you know, we post all information we receive through our blogs and engage with stakeholders, also through communications we post whether through correspondence or comments via gdpr(a)icann.org <mailto:gdpr@icann.org>. I look forward to hearing your thoughts on how we can continue to strengthen our work together toward the common goal of having an access model that is guided by the law and supported by the community. > > Best regards, > > Göran Marby > President & CEO ICANN > +1(310) 578 8690 > > > Cássia Oliveira > Sr. Manager, Office of the President & CEO > cassia.oliveira(a)icann.org <mailto:cassia.oliveira@icann.org> > +1(310) 578 8656

2 1

Recordings, Attendance & AC chat from the GNSO Temp Spec gTLD RD EPDP held Thursday, 23 August 2018
by Andrea Glandon Aug. 23, 2018

Aug. 23, 2018

Dear all, Please find the attendance and AC chat attached to this email. The MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Thursday, 23 August 2018 at 13:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/TRhpBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-23aug18… <https://urldefense.proofpoint.com/v2/url?u=https-3A__audio.icann.org_gnso_g…> AC Recording: https://participate.icann.org/p7gc228iokq/<https://participate.icann.org/p7gc228iokq/?OWASP_CSRFTOKEN=863031ed14eb3300…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ [community.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> Thank you. Kind Regards, Andrea Glandon

1 0

Meeting Invitation / Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 28 August 2018 at 13:00 UTC
by Andrea Glandon Aug. 23, 2018

Aug. 23, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesday’s and Thursday’s at 13:00 UTC via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/UxhpBQ Kind Regards, Andrea Glandon

1 0