- Gnso-epdp-team - lists.icann.org

**Meeting begins in 15 min** Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 22 April 2021 at 14:00 UTC
by Andrea Glandon April 22, 2021

April 22, 2021

Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 22 April 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/4ISUCQ Check your time zone: https://tinyurl.com/ady6y2hj [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/ady6y2hj__;!!PtGJab4!o1oT6KU…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

SSAD as a means of publishing non-personal data
by Alan Greenberg April 22, 2021

April 22, 2021

There continues to be discussion regarding using the SSAD as a means of "publishing" non-personal data. I believe that this discussion is a distraction that takes focus from what we should be working on. I say this for the following reason. 1. The SSAD does not exist, it may never exist, and if the Board does approve it, it will likely take several years to implement (remember we are 2 years into the implementation of Phase 1, and there is no centralized hardware/software to design and implement for that). 2. Although we specified that anyone may be accredited, it is not at all clear the amount of time it will take, nor what fee might be charged. And unless the system allows accreditation without authenticating the identity, this precludes anonymous queries. 3. We specified that the SSAD must be self-funding and that the users must pay for its operating costs. Are those in favour of using the SSAD for public data publishing proposing fees for such requests, or no fees, and if the latter, who will pay for this usage? 4. There are multiple details of Phase 2 Recommendation 8 for Contracted Party Authorization that simply make no sense in this case, yet are part of the approved policy. And changing that policy requires a PDP. 5. There does not seem to be any benefit of routing public-data requests through the SSAD with its myriad rules, regulations and processes when a vanilla RDAP server will suffice. Alan

3 2

A perspective on the relative importance of legal vs natural
by Steve Crocker April 22, 2021

April 22, 2021

Folks, Attached is a short note for your consideration in reference to the three questions under consideration. The last paragraph of this two page note says: The emphasis on determining whether a registrant is a natural person or a legal person is just one part of the overall data access model. It makes a qualitative difference whether or not there is shared confidence in the forthcoming existence of an effective, efficient and timely differentiated access system. No matter where this WG sets the bar regarding distinguishing between legal and natural persons, it is vital to move forward with differentiated access. Further, this WG should say so and its decisions should be in the context of confidence that differentiated access will be part of the overall system. This approach will not obviate the need for distinguishing legal vs natural persons, but it will relieve us of seeing this distinction as the only policy issue related to who will have access to which data. Thanks, Steve

2 1

Write up + RrSG-proposed Guidance
by Sarah Wyld April 22, 2021

April 22, 2021

Good morning team, As the RrSG-proposed Guidance was not fully incorporated into the writeup, we provide this updated version as a suggested method of combining the two: https://docs.google.com/document/d/1kEewYX2OyIi_lGdfnE-3HoUrqp1-etppRD17V_U… Please note that the RrSG-proposed Guidance is specifically the chart (GDPR Principles etc), not the three scenarios (which were included in our previous Guidance document as a summary of the group discussion, not something we created). I’ve also suggested some other changes to the writeup, and included notes in the comments where relevant. I look forward to discussing this at the appropriate time. Thank you. -- Sarah Wyld, CIPP/E Policy & Privacy Manager Pronouns: she/her swyld(a)tucows.com +1.416 535 0123 Ext. 1392

1 0

**Reminder** Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 22 April 2021 at 14:00 UTC
by Andrea Glandon April 21, 2021

April 21, 2021

Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 22 April 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/4ISUCQ Check your time zone: https://tinyurl.com/ady6y2hj [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/ady6y2hj__;!!PtGJab4!o1oT6KU…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Proposed agenda - EPDP Phase 2A Meeting #16 - 22 April 2021
by Caitlin Tubergen April 20, 2021

April 20, 2021

Dear EPDP Team, Below, please find the agenda for the next EPDP Phase 2A plenary meeting. Please review the feasibility memo<https://community.icann.org/display/EOTSFGRD/EPDP+-P2A+Legal+subteam?previe…> in advance of the meeting. Additionally, please take note of the outstanding action item: EPDP Team to respond to questions outlined in the google doc in relation to the question of whether or not changes should be made to existing requirements by Wednesday 21 April and come prepared to the meeting on 22 April to provide a high level summary of the responses provided. <https://docs.google.com/document/d/1gMV29jRPQEFGv2psZ2py2_F8cr93OeeA/edit>https://docs.google.com/document/d/1gMV29jRPQEFGv2psZ2py2_F8cr93OeeA/edit. Best regards, Berry, Marika, and Caitlin -- EPDP Phase 2A - Meeting #16 Proposed Agenda Thursday 22 April 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) * Update from the legal committee – outstanding question 3. Feasibility of unique contacts (30 minutes) 1. Whether or not unique contacts to have a uniform anonymized email address is feasible, and if feasible, whether it should be a requirement. 2. If feasible, but not a requirement, what guidance, if any, can be provided to Contracted Parties who may want to implement uniform anonymized email addresses. a. EPDP Team to consider responses provided by Bird & Bird (see here<https://community.icann.org/download/attachments/155191493/ICANN%20-%20EPDP…>) as well as definitions<https://mm.icann.org/pipermail/gnso-epdp-team/2021-February/003693.html> developed by legal committee · Intro to memo and definitions developed by legal committee (Becky) · EPDP Team to consider what new insights, if any, are provided that will facilitate a response to the question whether or not unique contacts to have a uniform anonymized email address is feasible. · What are the next steps in developing a response for inclusion in the Initial Report? 4. Legal vs. natural (45 minutes) 1. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); 2. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. Consideration of question i. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); a. Each group to provide a high-level summary of responses to questions (see https://docs.google.com/document/d/1gMV29jRPQEFGv2psZ2py2_F8cr93OeeA/edit) · ALAC · BC · GAC · IPC · ISPCP · NCSG · RrSG · RySG · SSAC b. EPDP Team to consider next steps to develop response to question i. c. Confirm next steps Guidance development d. Consider new issues flagged in the write up<https://docs.google.com/document/d/1whCpXHm3UPmJ-IDSbliveSkwxL679x2U/edit#h…>: · Definition of “publish” (note, the write up currently includes the following definition “EPDP-p1-IRT: “Publication”, “Publish”, and “Published” means to provide Registration Data in the publicly accessible Registration Data Directory Services.”) · Any concern about moving “Distinguishing between legal and natural person data alone may not be dispositive, as the data provided by legal persons may include personal data that is protected under data protection law, such as GDPR” to the guidance section? · See 1d – what approach should be taken when a Registrant makes substantive changes to registration data? · Consider whether it would be helpful to add a timeline to scenario 2. · Consider whether scenario 3 should remain. · Other? e. Homework assignment – new version of write up<https://docs.google.com/document/d/1a7MEle3_e-iXbaiZQV5wCD4Pv0414YjLtC2yxJE…> has been developed by Staff Support team based on deliberations on B & B advice during last meeting and input received by deadline. Groups to review latest version and flag any concerns / issues by Friday 23 April at the latest. In the course of next week, ‘final’ draft version is expected to be circulated with the request for groups to flag any cannot live with items. (https://docs.google.com/document/d/1a7MEle3_e-iXbaiZQV5wCD4Pv0414YjLtC2yxJE…) 5. Wrap and confirm next EPDP Team meeting (5 minutes): 1. EPDP Team Meeting #17 Tuesday 27 April at 14.00 UTC 2. Confirm action items 1. Confirm questions for ICANN Org, if any

2 1

FW: On the proposed guidance
by Mueller, Milton L April 20, 2021

April 20, 2021

>" Everyone who is named in a role in a registration must have already been informed > and consented to all of the conditions involved in the role. " This is the ideal. Sadly, this ideal > is very often not the case. Whoa. Of course, Volker, it is possible that a person making a registration for a legal person won’t do it properly. But it is absurd to expect a registrar to be legally responsible for that. How can the registrar be liable for privacy breaches made by the registrant? Indeed, I can’t understand why gaining the consent of the administrative assistant of the xyz department to have their name listed in the whois is a matter for DNS/ICANN policy at all. ICANN policy simply needs to inform registrants that under certain conditions the data will be published. Let’s take an extreme case – suppose a nasty IT manager in a major corporation puts the name, email address and (what the heck) a revenge porn photo of her ex-husband in her company’s registration record. Are you telling me the registrar would be considered responsible for that breach of privacy? Not the nasty IT manager? Show me a legal case in which that kind of liability has been assigned. I doubt you can, but I await the data from CP lawyers who have been involved in these cases. I do know of several cases in which agents for a corporation wrongly listed themselves as the technical and administrative contact, making it possible for them to hijack the name. The registrar was NEVER held liable for that. Reminder: We had to reform Whois/RDS policy because ICANN, as a matter of contractual obligation, required registrars to publish sensitive PII of any and every Registrant. Once we have removed that obligation, and once we have given registrants knowledge of the conditions under which the data in the record should be published, I don’t see why registrars need to worry about some corporation listing the personal email address of someone in their IT department. So if this alleged risk is being cited to scare us away from allowing registrants to self-designate as legal or natural, it is a pretty weak case, imho. --MM From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Volker Greimann via Gnso-epdp-team Sent: Thursday, April 15, 2021 10:10 AM To: Steve Crocker <steve(a)shinkuro.com<mailto:steve@shinkuro.com>> Cc: gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] On the proposed guidance Employees are named by other employees without their knowledge, or remain named long after they leave. From the experience as a registrar dealing with registrants every day, this ideal is an assumption that does not survive contact with reality. -- Volker A. Greimann General Counsel and Policy Manager KEY-SYSTEMS GMBH T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net<http://www.key-systems.net/> Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358. This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached. On Thu, Apr 15, 2021 at 3:36 PM Steve Crocker via Gnso-epdp-team <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> wrote: Laureen, Thanks for your note. With respect to the details under legal person, we believe the issue of consent should be moot. Everyone who is named in a role in a registration must have already been informed and consented to all of the conditions involved in the role. This is a prerequisite for having a working system and is not specific to meeting a privacy regulation. The fact that this requirement is not specified in the existing contractual documentation is an error and needs to be rectified. Steve On Thu, Apr 15, 2021 at 6:28 AM Kapin, Laureen via Gnso-epdp-team <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> wrote: I think we share common ground on many key issues and I would like to build on the many helpful inputs received as to what would be advisable. Goal: publish non-personal, non-protected data to the greatest extent permissible under the GDPR and within low legal risks to data controllers and processors. Note, the description below does not fully detail the advised safeguards which B&B has documented and which we’ve adopted in our prior input because my impression is that we generally agree that the safeguards are prudent. This description merely seeks to identify the key steps that must be taken to ensure that personal data is identified and protected and non-personal data is published. I also highlight the addition of a potential additional safeguard – Confirmation. I think this process incorporates what we’ve discussed and inputs received and could form a useful framework for discussion. Note: • New Registrations: This process applies to new registrations (Steve C. has some useful thoughts on how to deal with existing Registrations) • Publish: When I use the word “publish,” I mean made public directly; not via the SSAD. • Flexibility: Based on input from our Registrar colleagues, we should permit flexibility for how these steps are implemented to account for the varied business models in place. • Timing: All identifications need to take place at the time of registration or shortly thereafter (w/in the 13-day accuracy verification window) and no registration data should be published until the identification, consent, and confirmation process concludes Process: 1. A threshold identification of the registrant as a natural or legal person; a. If natural, registration info redacted b. If legal, further inquiries and advisories (safeguards): i. if the legal person identifies that it has a protected status under the GDPR 1. registration info redacted ii. If the legal person registration contains personal data, advise of consequences (publication) 1. Obtain necessary consents 2. Possible additional safeguard: Ask Registrant to Confirm any identification that will result in publication of contact data (akin to confirming a flight reservation or stock trade) a. Publish 3. If no consent a. Redact 2. Provide quick and easy opportunity to correct any mistakes I hope this is useful. Kind regards, Laureen Kapin Counsel for International Consumer Protection Federal Trade Commission (202) 326-3237 From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Volker Greimann via Gnso-epdp-team Sent: Thursday, April 15, 2021 8:35 AM To: Hadia Abdelsalam Mokhtar EL miniawi <Hadia(a)tra.gov.eg<mailto:Hadia@tra.gov.eg>> Cc: gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] On the proposed guidance I think we need to be cognisant of the current status quo and use that as the basis for our thoughts on the matter: 1) There is no differentiation between legal or natural contacts. 2) The redaction of all contacts is permitted and has become the de-facto standard. 3) We allow consent-based disclosure. 4) NIS 2 may at some point in the future require publication of non-personal information. This leads to two very simple follow-on questions: a) How do we identify such non-personal information? What is really necessary for this end? b) What would publication entail? For a) we and Twobirds identified voluntary self-declaration of the data submitted. As all data is redacted by default, the differentiation of the data subject category is irrelevant as it ultimately only boils down to the declaration of the data subject thatthe data contains no personal information. For b), the term "publish" is undefined. For all we know, it could mean publication in a physical print edition (it doesn't mean that though). But publication within SSAD can very well be sufficient for that definition. There is no reason whatsoever to assume differently. -- Volker A. Greimann General Counsel and Policy Manager KEY-SYSTEMS GMBH T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net<http://www.key-systems.net/> Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358. This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached. [https://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-orange-anima…]<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> Virus-free. www.avast.com<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> On Thu, Apr 15, 2021 at 1:52 PM Hadia Abdelsalam Mokhtar EL miniawi via Gnso-epdp-team <gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org>> wrote: Dear Milton, Thank you for your constructive thoughts. I believe we have a lot to build on. In relation to principle one, I think we all agree that some legal data subjects would want to publish their data in the RDDS, but without your first principle they can only do this through consent. The legal memo received lately from Bird & Bird explains that if CPs publish the data of legal persons based on consent they are at a higher risk than if they publish the data of legal persons based on self-designation. In the latter case CPs might only be liable if they fail to address a complaint. So the question always was: what is the benefit of labeling the data as belonging to a natural or legal person? Of course we all know that GDPR protects the data of natural persons and not legal persons, but the important answer now is that the distinction significantly reduces the liability of CPs. In addition, the distinction is helpful in performing the balancing test in case the data is not published and I am sure if we look into individual use cases we can find much more benefits. Moreover, it could prove to be useful regarding possible upcoming regulations. I would also add that the level of protection assigned to the data elements suggested by Steve provides additional safe guards and flexibility in the implementation. Finally, I join you in being optimistic about our ability to finish this. Kind regards Hadia From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>] On Behalf Of Mueller, Milton L via Gnso-epdp-team Sent: Wednesday, April 14, 2021 10:12 PM To: gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] On the proposed guidance Colleagues: I have only gotten time to review the latest Guidance document and the surrounding debate today. Apologies, but there is a lot going on in my day job. I am disappointed to see that we seem to be going backwards. I see divergence rather than convergence on the way we are approaching the problem. I see no point in adding more noise to the current document via the Comments function. What I would like to try to do is articulate some broad principles about how to deal with the legal/natural distinction. If we can agree on those principles, it will be relatively easy to complete the document. If we cannot/do not agree on those principles, additional wordsmithing and debates over terms will not get us anywhere. So here are the broad principles that I would offer up for debate: 1. The legal/natural distinction is relevant and we need to find a way make it in RDDS without compromising privacy rights. 2. Registrants should be able to self-designate as legal or natural, with no burden of authentication placed on registrars or registries 3. To protect small home offices or NGOs who are technically Legal persons but whose registration data may include Personal data, we need an additional check in the process. 4. As long as they conform with the above 3 principles, registrars/ries (CPs) should be given maximum flexibility to choose the way to differentiate. Principle 1 discussion: If we cannot agree on this (or agree to abandon this principle), _nothing else will fall into place_. Ever. So let’s settle that. Steve and Volker I suspect will disagree with this principle. Steve has argued that the L/N distinction is “not a central concern” and all that matters is whether the registrant’s data is to be made available to anyone. If he is right, we can discard the guidance altogether, because we already have a recommendation to allow the RNH to consent to the publication of their data. Volker has also suggested that it is personal data we need to differentiate, not L/N . I disagree with Steve and Volker on this and so do most of the rest of the group. L/N distinction is a central concern to certain stakeholder groups in the EPDP, because a) GDPR and other data protection laws do not protect it and this process is all about bringing RDS into compliance with privacy law; b) Legal person data could be published and it would provide easier access to their registration data. As a NCSG member I can find no basis for objecting to the publication of WalMart’s, Kroger’s or the local hardware store’s registration data. Any concerns about PII are addressed by principles 2 and 3. Steve is approaching this as an engineer, but this is a policy process, and we will not obtain agreement on a solution unless certain stakeholders are satisfied. If they think it is a central concern, it’s a central concern, that’s how policy/politics work. Principle 2 discussion This is the key principle that keeps NCSG and CPH satisfied. Registrants are in control of how they are designated. Yes, this means that some people will lie. That is just something we will have to accept. One cannot erase that possibility without creating a system that is too burdensome and costly as to outweigh any benefits. Principle 3 discussion This is something everyone seems to agree on already. But it is good to make it explicit, then we can work out how specific our guidance can get, so as to conform to … Principle 4 Avoid being overly prescriptive, but ensure that the other 3 principles are honored. So yes, Volker, we give you maximum flexibility to implement in accordance with different business models, but you can NOT make a designation for a RNH, because it violates principle 2. I truly believe that if we can come to agreement on these 4 principles and use them as the basis for drafting guidance, we can actually finish this. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos) You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. [https://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-orange-anima…]<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> Virus-free. www.avast.com<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos) You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team(a)icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos) You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

7 13

EPDP Team homework reminder
by Caitlin Tubergen April 19, 2021

April 19, 2021

Dear EPDP Team, Please take note of the outstanding homework assignments below. The first two items are due by COB today, Monday, 19 April. 1. Complete review of Bird & Bird advice by comparing it to the latest version of the legal/natural guidance write up. Please review the remaining 4 questions (#6-9) in the comparison document (see https://docs.google.com/document/d/1jzKGLeTlJFf8-HB70NmAS_fZJvZgJiwO/edit [docs.google.com]<https://docs.google.com/document/d/1jzKGLeTlJFf8-HB70NmAS_fZJvZgJiwO/edit%2…>) and provide your group’s responses to these questions. In addition, if you review of the Bird & Bird advice has resulted in additional questions the group should consider in the context of the guidance write up, please add those. The Staff Support Team will use your responses to the questions as well as those discussed on the call to update the write up accordingly to ensure it is consistent with the Bird & Bird advice that has been provided. Your group’s input is expected by Monday 19 April COB at the latest. Please do NOT use this google doc to opine on the write up or to raise any other issues that you think the write up should address. 1. Review the latest version of the guidance write-up and respond to outstanding questions Please review the latest version of the legal/natural guidance write-up (see https://docs.google.com/document/d/1whCpXHm3UPmJ-IDSbliveSkwxL679x2U/edit#h… [docs.google.com]<https://docs.google.com/document/d/1whCpXHm3UPmJ-IDSbliveSkwxL679x2U/edit#h…>) and provide your group’s response to the questions that were identified by the staff support team as a result of the last round of input (also listed below questions #1-4). If you have further comments or suggestions, please add these to the document in the form of comments, preferably including specific text you would like the EPDP Team to consider. The Staff Support Team will use your responses to produce a next iteration of the legal/natural guidance write up. Your group’s input is expected by Monday 19 April COB at the latest. 1. Provide your group’s thoughts on the question of whether updates should be made to the phase 1 recommendation on this topic. Please review and respond to the questions in this document https://docs.google.com/document/d/1gMV29jRPQEFGv2psZ2py2_F8cr93OeeA/edit [docs.google.com]<https://docs.google.com/document/d/1gMV29jRPQEFGv2psZ2py2_F8cr93OeeA/edit%2…> with your group’s position. As outlined during the call, this will facilitate the leadership’s team assessment of where the group is at and a possible path to a response to this specific question. Your group’s input is expected by Wednesday 21 April COB at the latest. Please be prepared to provide a summary overview of your position during the next EPDP Team meeting. Thank you. Best regards, Berry, Marika, and Caitlin

1 0

FW: Points of Order
by Mueller, Milton L April 16, 2021

April 16, 2021

Just addressing Alan’s second point: 2. The Key Metrics Considerations part of the EPDP Charter requires the we ensure that we will have metrics to determine the success of our recommendations. As such, if we decide that we will not issue policy recommendation on the legal/natural issue, but rather only guidance, we must also include a policy requirement that contracted parties report on whether or not they are actually following the guidance. If we do not do that, there is no way to measure our ultimate success. If Legal / Natural differentiation is not mandatory, as I believe it will be and should be, then concepts such as “metrics to determine success” do not make a lot of sense to me. I do not support saddling the CP’s with (yet another) reporting requirement if it pertains to a non-mandatory action. What does it mean to “measure” the “success” of a non-binding recommendation? We can measure how many registrars do differentiate, we can categorize the ways they do it, we can measure a number of other things, but those measurements are best carried out through third party studies, not by individual reports of 700 registrars. Dr. Milton L Mueller Georgia Institute of Technology School of Public Policy [IGP_logo_gold block]

1 0

Homework assignments, notes and action items - EPDP Team Meeting #15
by policy＠bacinblack.com April 15, 2021

April 15, 2021

Dear EPDP Team, Please find below the notes and action items <https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> of today’s meeting. In order to ensure that there is no confusion, here are the instructions for the homework assignments: 1. Complete review of Bird & Bird advice by comparing it to the latest version of the legal/natural guidance write up. Please review the remaining 4 questions (#6-9) in the comparison document (see https://docs.google.com/document/d/1jzKGLeTlJFf8-HB70NmAS_fZJvZgJiwO/edit) and provide your group’s responses to these questions. In addition, if you review of the Bird & Bird advice has resulted in additional questions the group should consider in the context of the guidance write up, please add those. The Staff Support Team will use your responses to the questions as well as those discussed on the call to update the write up accordingly to ensure it is consistent with the Bird & Bird advice that has been provided. Your group’s input is expected by Monday 19 April COB at the latest. Please do NOT use this google doc to opine on the write up or to raise any other issues that you think the write up should address. 2. Review the latest version of the guidance write-up and respond to outstanding questions Please review the latest version of the legal/natural guidance write-up (see https://docs.google.com/document/d/1whCpXHm3UPmJ-IDSbliveSkwxL679x2U/edit#h…) and provide your group’s response to the questions that were identified by the staff support team as a result of the last round of input (also listed below questions #1-4). If you have further comments or suggestions, please add these to the document in the form of comments, preferably including specific text you would like the EPDP Team to consider. The Staff Support Team will use your responses to produce a next iteration of the legal/natural guidance write up. Your group’s input is expected by Monday 19 April COB at the latest. 3. Provide your group’s thoughts on the question of whether updates should be made to the phase 1 recommendation on this topic. Please review and respond to the questions in this document https://docs.google.com/document/d/1gMV29jRPQEFGv2psZ2py2_F8cr93OeeA/edit with your group’s position. As outlined during the call, this will facilitate the leadership’s team assessment of where the group is at and a possible path to a response to this specific question. Your group’s input is expected by Wednesday 21 April COB at the latest. Please be prepared to provide a summary overview of your position during the next EPDP Team meeting. We would like to again express our appreciation for all the dialogue that has taken place on the list, but please make sure to also translate your input into specific suggestions for the documents listed above. Best regards, Caitlin, Marika and Berry ==================== EPDP Phase 2A - Meeting #15 Proposed Agenda Thursday 15 April 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) * Appreciate all the dialogue on the mailing list – really important and encouraging that this discussion is happening. Important now to bring this back to the latest version of the write-up – many/most of the comment on the mailing list seem to be consistent with the latest version of the write-up. If not, it will be important for team members to point this out and focus on how it can be made consistent. * Update from the legal committee (Becky) * Responses have been received to 3 of the 4 questions. One question (q #3) is still pending but expected shortly. Based on the responses received to questions #1 and #2, the staff support team pulled together a comparison chart to compare the B & B advice to the latest version of the write up. Final call of the legal committee is expected to take place to review response to q#3. * Placeholder meeting will be scheduled for the legal committee for next Tuesday. If response to q3 is not received in a timely manner the call will be cancelled. Comments from team: * Any of the parties who are named in the registration data must be informed and knowledgeable about that they have been named and what the responsibilities are in relation to this naming. Doesn’t that make consent moot and take away registrar responsibility as the registrant is already supposed to have dealt with this? * This is an ideal but not a reality of what is going on. Employees for companies may name other employees or officers without their knowledge or do not update when employees leave the company. A registrar cannot rely on this consent given to the registrant – it must confirm itself that consent is present. * Bird & Bird memo pointed out the importance of having a complaint mechanism so that if issues occur, these can be flagged and corrected by the registrar. * Contracted parties are liable for any mistakes – not only about the money, but also reputational damage to consider. * Bird & Bird memo does point to ways in which risk can be reduced for Contracted Parties, noting that liability is reduced by taking reasonable steps to remove personal data from registration data associated with a legal person. 3. Legal vs. natural (75 minutes) i. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); ii. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. Guidance development a. Continue review of updated write up of guidance proposal * See comparison table developed by Staff Support Team and reviewed by Legal Committee – see https://docs.google.com/document/d/1jzKGLeTlJFf8-HB70NmAS_fZJvZgJiwO/edit * EPDP Team to deliberate on the questions identified in column 3: 1) Consider adding reference to information requirements in relation to consent? 2) Consider making more specific that the registrant (data subject) needs to have an easy means to correct mistakes? 3) Consider adding a step that following Registrant confirmation that the registration does not include any personal data, the registrar should contact the provided contact details to confirm that no personal data is present. 4) Consider adding guidance that sufficient time must be provided for the Registrant (data subject) to respond to the verification request, but that there is no need to wait for an affirmative response, unless an email bounces (in which case the Registrar should not proceed with publication). 5) Consider adding that the Registrar should request the Registrant, if self-identified as legal person, to provide a company registration number. 6) Consider making more specific that at this stage the Registrar should ask whether Registrant (data subject) consents to publication of personal data? 7) Consider adding that, as an example, a Registrar could also use the company registration number to verify legal personhood. 8) Consider whether such a tool (to assess whether email addresses include an individual's name or appear to be generic) exists and/or is feasible? 9) Consider reference to this guidance/opinion from B & B * Focusing on the questions identified that bridge the current version of the write up and the B & B advice received. * Other comments are definitely relevant but need to be considered in the context of the write up. * Note proposed principles shared by Milton with the list: 1. The legal/natural distinction is relevant and we need to find a way make it in RDDS without compromising privacy rights. 2. Registrants should be able to self-designate as legal or natural, with no burden of authentication placed on registrars or registries 3. To protect small home offices or NGOs who are technically Legal persons but whose registration data may include Personal data, we need an additional check in the process. 4. As long as they conform with the above 3 principles, registrars/ries (CPs) should be given maximum flexibility to choose the way to differentiate. * Would be helpful to see if anyone disagrees with these principles. On 3, different approaches may be possible. Some have also noted that distinction should focus on personal vs. non-personal data. * 1) Consider adding reference to information requirements in relation to consent? Is already contemplated by RAA section – guidance should be clear. Making the point clearer on who is expected to consent and who the CP is entitled to rely on when it comes to consent may be helpful? Agree with the suggestion but may be more difficult to implement that it sounds? Write up is good at balancing GDPR of protecting personal data with facilitating the publication of non-personal data. Bird & Bird also outlines steps to minimize the risk to CPs if certain steps are followed. Need to be careful to not provide legal advice, consider pointing to the EDPB advice in relation to consent (https://st1.zoom.us/web_client/ehjzr5/html/externalLinkPage.html?ref=https:…) instead as that is authoritative information. * 2) Consider making more specific that the registrant (data subject) needs to have an easy means to correct mistakes? Support for this suggestion as this is one of the multi-layer safeguards that B & B has suggested. Noting that there are obviously challenges with information that has already been published and ‘undoing’ that. Should it be considered to quarantine before release that would allow for correction before information is published? See also q4. * 4) Consider adding guidance that sufficient time must be provided for the Registrant (data subject) to respond to the verification request, but that there is no need to wait for an affirmative response, unless an email bounces (in which case the Registrar should not proceed with publication). This seems to flip opt-out to opt-in – need to be mindful that silence is not the same as consent. B & B guidance is very specific that this is about when there is no personal information involved, so risk is low. Bouncing also may trigger accuracy considerations if the data subject is also the data source. * 3) Consider adding a step that following Registrant confirmation that the registration does not include any personal data, the registrar should contact the provided contact details to confirm that no personal data is present. Sounds like existing requirement in the RAA Whois specification (Verify: the email address of the Registered Name Holder (and, if different, the Account Holder) by sending an email requiring an affirmative response through a tool-based authentication method such as providing a unique code that must be returned in a manner designated by the Registrar, or … (phone call)? Use the provided contact details to contact the entity. Makes sense to add this step as it provides an additional safeguard to avoid getting personal information published. * 5) Consider adding that the Registrar should request the Registrant, if self-identified as legal person, to provide a company registration number. Not all countries may have company registration numbers? Would there then be an expectation that a registrar would verify that information? Corporate identifiers may work well for large corporations, not so much for small business. * Remaining questions to be addressed as homework. Action item #1: EPDP Team to review remaining 4 questions in the comparison document and provided responses to those questions by Monday 19 April. In addition, EPDP Team to identify any further questions that the EPDP Team should consider as a result of the Bird & Bird advice to address any potential inconsistencies or additional safeguards. * EPDP Team to deliberate on remaining questions in the updated write up (see https://docs.google.com/document/d/1whCpXHm3UPmJ-IDSbliveSkwxL679x2U/edit#h…) 1. Example scenarios refer to “publish the data” with publish defined as “provide Registration Data in the publicly accessible Registration Data Directory Services” – Volker has suggested this should be discussed further by the EPDP Team. 2. Example scenario 1-d – Registrar Team has suggested this is too prescriptive and proposed that if any changes are made then the data is treated as natural-person data until the Registrant indicates otherwise via repetition of steps a-c. Others have suggested that Registrant should be requested when updates are made whether this results in changes to data type. EPDP Team to discuss how to proceed. 3. Example scenario 3 – EPDP Team to discuss whether this scenario should be deleted. There were originally some concerns that there would be no registrant / data subject involvement in the determination of data type, but this has been clarified by indicating that the registrant must confirm the determination by the registrar. Is this concern sufficiently addressed or should this scenario be deleted. 4. Use of third party services to verify determination of data type – sentence has been updated based on suggestions made. Does this sufficiently address the concerns? 5. Other? * Confirm next steps Action item #2: EPDP Team to review these questions in the latest version of the write up and provide input, preferably in the form of specific text to be considered by the EPDP Team by Monday 19 April. Consideration of question i. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); b. Review of questions developed by leadership team to determine positions of different groups – please be open minded and be constructive (see https://docs.google.com/document/d/1gMV29jRPQEFGv2psZ2py2_F8cr93OeeA/edit) c. Homework assignment: all teams to provide responses to these questions by Tuesday 20 April at the latest. d. EPDP Team input e. Confirm next steps * Important for all groups to ‘put their cards on the table’ to facilitate the deliberations on this specific question. * Also important to recall relevant recommendations from phase 1 and phase 2 that may have an impact facilitating differentiation and/or could be built upon, for example, in the form of implementation guidance. Action item #3: EPDP Team to respond to questions outlined in the google doc in relation to the question of whether or not changes should be made to existing requirements by Wednesday 21 April and come prepared to the meeting on 22 April to provide a high level summary of the responses provided. 4. Wrap and confirm next EPDP Team meeting (5 minutes): a. EPDP Team Meeting #16 Thursday 22 April at 14.00 UTC - note, placeholder plenary session is being scheduled to allow for a second weekly plenary meeting, if needed. b. Confirm action items c. Confirm questions for ICANN Org, if any * Placeholder time has been identified for a second plenary session each week. Will not commence next week, but anticipate it will happen for the week after (27 April at 14.00 UTC). This does not replace the need for doing homework if progress is to be made. If there is no need for this additional plenary session it can always be cancelled. Berry Cobb GNSO Policy Consultant Principal | BAC in Black Consulting <http://bacinblack.com/> Mob: +1 (720) 839-5735 <https://twitter.com/berrycobb> <https://www.linkedin.com/in/berrycobb/>

1 0