- Gnso-epdp-team - lists.icann.org

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2A | Thursday, 15 April 2021 at 14:00 UTC
by Terri Agnew April 15, 2021

April 15, 2021

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2A call held on Thursday, 15 April 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/3oSUCQ> (attendance included) and the GNSO Master calendar [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…>. These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a panelist, observers can join as an attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 22 April 2021 at 14:00 UTC
by Terri Agnew April 15, 2021

April 15, 2021

Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 22 April 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/4ISUCQ Check your time zone: https://tinyurl.com/ady6y2hj The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Points of Order
by Alan Greenberg April 15, 2021

April 15, 2021

I would like to raise two points of order. Although my preference is for the PDP to generate consensus policy on the Legal/Natural issue, I understand that ultimately that may not be possible. That being said: 1. There have been recent discussions that we should not be creating advice on whether a registrant is a legal or natural person, but rather whether the data items contain personal information. The wording from the EPDP Charter is "Should Contracted Parties be allowed or required to treat legal and natural persons differently, and what mechanism is needed to ensure reliable determination of status?" If there is a need to consider individual data items, that is a secondary issue, but we need to stick to the charter terms. 2. The Key Metrics Considerations part of the EPDP Charter requires the we ensure that we will have metrics to determine the success of our recommendations. As such, if we decide that we will not issue policy recommendation on the legal/natural issue, but rather only guidance, we must also include a policy requirement that contracted parties report on whether or not they are actually following the guidance. If we do not do that, there is no way to measure our ultimate success. Alan

2 1

On the proposed guidance
by Mueller, Milton L April 15, 2021

April 15, 2021

I was reading through two documents setting out in detail the proposed guidance on legal/natural. There seems to be more than one Google doc on this and I am not sure which one is the latest or most official, though I suspect it is the one with various people's comments crawling all over it. I was pretty supportive of the Guidance overall. I had one problem with it, though. I liked the description of HOW the differentiation needed to take place. But in describing WHEN differentiation takes place and WHO would do it, it sets out 3 "high level scenarios". The first two are ok. The third scenario (listed as #5 in the document) is that the Registrar does it for the RNH, based on "inferences." That option just doesn't fly for those of us representing RNH's in this process. We cannot have a registrant's disclosure status or person type determined FOR them by someone else. If we can strike that part of the guidance, I think we can be on our way to a much broader consensus. Dr. Milton L Mueller Georgia Institute of Technology School of Public Policy [IGP_logo_gold block]

12 25

Partial draft re SSAC position on natural/legal discussion
by Steve Crocker April 15, 2021

April 15, 2021

Folks, My work schedule has suffered one of life's inescapable interruptions. In this case, it's good: our granddaughter entered the world this past Saturday. My wife and I have been in San Francisco providing support. Everyone is well, but I'm behind on my participation in this working group. Attached is my partial draft of a composite treatment of the natural vs legal collection of issues. I started writing from front to back but haven't had time to finish. I added a section at the end with the conclusions and recommendations. I will fill in the missing pieces as quickly as I can. Despite the incompleteness, we did have an opportunity in the SSAC work party to review and agree on the recommendations. For ease of access, the recommendations are copied below. Thanks, Steve 1. *Inescapable Requirement: Definition of Roles * Each role must be defined in terms of the authority and responsibilities associated with the role. This definition must be explicitly available to both the people fulfilling the role and the people interacting with the people in those roles. Each person named in a role must be aware of being named and must agree to the obligations associated with the role. The definition must also include an explicit statement of how the information about the person in the role will be disseminated. Information about the registrant is provided by the Account Holder. The Account Holder is effectively an agent of the Registrant and is the only authoritative source of information about the status of the registrant. 2. *Recommendation: Unknown Persons * In addition to definite status of Natural Person or Legal Person, the status of Unknown should be included in the design of the system. 3. *Recommendation: Additional Protection * In addition to whether the registrant is a Natural, Legal or Unknown Person, the status should also include an additional attribute regarding whether the registrant requires special privacy protection. It is an open question as to whether additional privacy protection should be available to any registrant who wishes it or should require justification. At the very least, to facilitate visibility into potentially harmful behaviors, Registrars should avoid unnecessary protection of registration data. 4. *Recommendation: Downgrading * Registrants should have the option of “downgrading” the level of protection for some or all of their data elements. Registrars should have the option of implementing downgrading on a field by field basis or in groups of fields. ICANN should establish a date certain for registrars to implement registrant option to downgrade the sensitivity of their registrations. 5. *Comment: Recourse * If a person named in any role in a registration feels the data is incorrect or is being disseminated improperly, they have recourse via the Registrant. Failing that, they have recourse through ICANN’s compliance process. No additional processes are required. 6. *Recommendation: Org Field * The Org field should *not* be used to determine the registrant’s status. The Registrar should require Legal Persons to provide the Org data element. The Registrar should permit Natural or Unknown registrants to provide or not provide the Org data element. 7. *Recommendation: Transition * ICANN should establish a plan for transitioning Unknown registrations into known status.

1 0

Re: [Gnso-epdp-team] Proposed Agenda EPDP Team Meeting #15 - 15 April at 14.00 UTC
by policy＠bacinblack.com April 14, 2021

April 14, 2021

Dear EPDP Team, We really appreciate the enthusiasm which some of you have started your review of the documents but we would like to encourage you to put your input in the right place: 1. The comparison document/table should be used to flag any further questions or issues that the group should consider based on the advice that has been provided by B & B (see https://docs.google.com/document/d/1jzKGLeTlJFf8-HB70NmAS_fZJvZgJiwO/edit) 2. Any further input, suggestions or proposed edits on the latest version of the write up that are not directly linked to the B & B advice should be made in the form of comments not direct edits in the latest version of the write up (see https://docs.google.com/document/d/1whCpXHm3UPmJ-IDSbliveSkwxL679x2U/edit) Thank for your collaboration! Caitlin, Marika and Berry Berry Cobb GNSO Policy Consultant Principal | BAC in Black Consulting <http://bacinblack.com/> Mob: +1 (720) 839-5735 <https://twitter.com/berrycobb> <https://www.linkedin.com/in/berrycobb/> From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org <mailto:gnso-epdp-team-bounces@icann.org> > on behalf of policy--- via Gnso-epdp-team <gnso-epdp-team(a)icann.org <mailto:gnso-epdp-team@icann.org> > Reply to: "policy(a)bacinblack.com <mailto:policy@bacinblack.com> " <policy(a)bacinblack.com <mailto:policy@bacinblack.com> > Date: Tuesday, 13 April 2021 at 13:49 To: "gnso-epdp-team(a)icann.org <mailto:gnso-epdp-team@icann.org> " <gnso-epdp-team(a)icann.org <mailto:gnso-epdp-team@icann.org> > Subject: [Gnso-epdp-team] Proposed Agenda EPDP Team Meeting #15 - 15 April at 14.00 UTC Dear EPDP Team, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Thursday 15 April at 14.00 UTC. As you will see, the staff support team has produced an updated version of the legal/natural guidance write up. Attached you will find the redline version so you can review the changes that have been made based on the input that was provided by the deadline (note, where no input was provided, no action has been taken). A couple of items have been flagged for further EPDP Team input in the new version (and are also included in the agenda). If there are any items missing that you think require EPDP Team consideration, please flag accordingly. Also included in the agenda you will find a comparison document that compares and contrasts the latest version of the legal/natural guidance write up with the responses received to date from Bird & Bird in relation to legal/natural. This document has been reviewed by the legal committee for completeness. In the third column it identifies a number of questions for EPDP Team consideration. Last but not least, you will also find in the agenda a link to a set of proposed questions for the EPDP Team which are intended to help inform the deliberations on the question of whether any updates are required to the EPDP Phase 1 recommendation on the topic of legal/natural. Note that the approach and document will be further introduced during Thursday’s meeting. Please review these documents in preparation for Thursday’s meeting. Best regards, Caitlin, Marika and Berry ====== EPDP Phase 2A - Meeting #15 Proposed Agenda Thursday 15 April 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) * Update from the legal committee 3. Legal vs. natural (75 minutes) i. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); ii. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. Guidance development a. Continue review of updated write up of guidance proposal * See comparison table developed by Staff Support Team and reviewed by Legal Committee – see https://docs.google.com/document/d/1jzKGLeTlJFf8-HB70NmAS_fZJvZgJiwO/edit * EPDP Team to deliberate on the questions identified in column 3: 1) Consider adding reference to information requirements in relation to consent? 2) Consider making more specific that the registrant (data subject) needs to have an easy means to correct mistakes? 3) Consider adding a step that following Registrant confirmation that the registration does not include any personal data, the registrar should contact the provided contact details to confirm that no personal data is present. 4) Consider adding guidance that sufficient time must be provided for the Registrant (data subject) to respond to the verification request, but that there is no need to wait for an affirmative response, unless an email bounces (in which case the Registrar should not proceed with publication). 5) Consider adding that the Registrar should request the Registrant, if self-identified as legal person, to provide a company registration number. 6) Consider making more specific that at this stage the Registrar should ask whether Registrant (data subject) consents to publication of personal data? 7) Consider adding that, as an example, a Registrar could also use the company registration number to verify legal personhood. 8) Consider whether such a tool (to assess whether email addresses include an individual's name or appear to be generic) exists and/or is feasible? 9) Consider reference to this guidance/opinion from B & B * EPDP Team to deliberate on remaining questions in the updated write up (see https://docs.google.com/document/d/1whCpXHm3UPmJ-IDSbliveSkwxL679x2U/edit#h…) 1. Example scenarios refer to “publish the data” with publish defined as “provide Registration Data in the publicly accessible Registration Data Directory Services” – Volker has suggested this should be discussed further by the EPDP Team. 2. Example scenario 1-d – Registrar Team has suggested this is too prescriptive and proposed that if any changes are made then the data is treated as natural-person data until the Registrant indicates otherwise via repetition of steps a-c. Others have suggested that Registrant should be requested when updates are made whether this results in changes to data type. EPDP Team to discuss how to proceed. 3. Example scenario 3 – EPDP Team to discuss whether this scenario should be deleted. There were originally some concerns that there would be no registrant / data subject involvement in the determination of data type, but this has been clarified by indicating that the registrant must confirm the determination by the registrar. Is this concern sufficiently addressed or should this scenario be deleted. 4. Use of third party services to verify determination of data type – sentence has been updated based on suggestions made. Does this sufficiently address the concerns? 5. Other? * Confirm next steps b. Consideration of question i. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); * Review of questions developed by leadership team to determine positions of different groups – please be open minded and be constructive (see https://docs.google.com/document/d/1gMV29jRPQEFGv2psZ2py2_F8cr93OeeA/edit) * Homework assignment: all teams to provide responses to these questions by Tuesday 20 April at the latest. * EPDP Team input * Confirm next steps 4. Wrap and confirm next EPDP Team meeting (5 minutes): a. EPDP Team Meeting #16 Thursday 22 April at 14.00 UTC - note, placeholder plenary session is being scheduled to allow for a second weekly plenary meeting, if needed. b. Confirm action items c. Confirm questions for ICANN Org, if any Berry Cobb GNSO Policy Consultant Principal | BAC in Black Consulting <http://bacinblack.com/> Mob: +1 (720) 839-5735 <https://twitter.com/berrycobb> <https://www.linkedin.com/in/berrycobb/>

1 0

REMINDER -- Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 15 April 2021 at 14:00 UTC
by Julie Bisland April 14, 2021

April 14, 2021

Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 15 April 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/3oSUCQ Check your time zone: https://tinyurl.com/cfe3f3bf [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/cfe3f3bf__;!!PtGJab4!r_1Y7Cr…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Proposed Agenda EPDP Team Meeting #15 - 15 April at 14.00 UTC
by policy＠bacinblack.com April 13, 2021

April 13, 2021

Dear EPDP Team, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Thursday 15 April at 14.00 UTC. As you will see, the staff support team has produced an updated version of the legal/natural guidance write up. Attached you will find the redline version so you can review the changes that have been made based on the input that was provided by the deadline (note, where no input was provided, no action has been taken). A couple of items have been flagged for further EPDP Team input in the new version (and are also included in the agenda). If there are any items missing that you think require EPDP Team consideration, please flag accordingly. Also included in the agenda you will find a comparison document that compares and contrasts the latest version of the legal/natural guidance write up with the responses received to date from Bird & Bird in relation to legal/natural. This document has been reviewed by the legal committee for completeness. In the third column it identifies a number of questions for EPDP Team consideration. Last but not least, you will also find in the agenda a link to a set of proposed questions for the EPDP Team which are intended to help inform the deliberations on the question of whether any updates are required to the EPDP Phase 1 recommendation on the topic of legal/natural. Note that the approach and document will be further introduced during Thursday’s meeting. Please review these documents in preparation for Thursday’s meeting. Best regards, Caitlin, Marika and Berry ====== EPDP Phase 2A - Meeting #15 Proposed Agenda Thursday 15 April 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) * Update from the legal committee 3. Legal vs. natural (75 minutes) i. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); ii. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. Guidance development a. Continue review of updated write up of guidance proposal * See comparison table developed by Staff Support Team and reviewed by Legal Committee – see https://docs.google.com/document/d/1jzKGLeTlJFf8-HB70NmAS_fZJvZgJiwO/edit * EPDP Team to deliberate on the questions identified in column 3: 1. Consider adding reference to information requirements in relation to consent? 2. Consider making more specific that the registrant (data subject) needs to have an easy means to correct mistakes? 3. Consider adding a step that following Registrant confirmation that the registration does not include any personal data, the registrar should contact the provided contact details to confirm that no personal data is present. 4. Consider adding guidance that sufficient time must be provided for the Registrant (data subject) to respond to the verification request, but that there is no need to wait for an affirmative response, unless an email bounces (in which case the Registrar should not proceed with publication). 5. Consider adding that the Registrar should request the Registrant, if self-identified as legal person, to provide a company registration number. 6. Consider making more specific that at this stage the Registrar should ask whether Registrant (data subject) consents to publication of personal data? 7. Consider adding that, as an example, a Registrar could also use the company registration number to verify legal personhood. 8. Consider whether such a tool (to assess whether email addresses include an individual's name or appear to be generic) exists and/or is feasible? 9. Consider reference to this guidance/opinion from B & B * EPDP Team to deliberate on remaining questions in the updated write up (see https://docs.google.com/document/d/1whCpXHm3UPmJ-IDSbliveSkwxL679x2U/edit#h…) 1. Example scenarios refer to “publish the data” with publish defined as “provide Registration Data in the publicly accessible Registration Data Directory Services” – Volker has suggested this should be discussed further by the EPDP Team. 2. Example scenario 1-d – Registrar Team has suggested this is too prescriptive and proposed that if any changes are made then the data is treated as natural-person data until the Registrant indicates otherwise via repetition of steps a-c. Others have suggested that Registrant should be requested when updates are made whether this results in changes to data type. EPDP Team to discuss how to proceed. 3. Example scenario 3 – EPDP Team to discuss whether this scenario should be deleted. There were originally some concerns that there would be no registrant / data subject involvement in the determination of data type, but this has been clarified by indicating that the registrant must confirm the determination by the registrar. Is this concern sufficiently addressed or should this scenario be deleted. 4. Use of third party services to verify determination of data type – sentence has been updated based on suggestions made. Does this sufficiently address the concerns? 5. Other? * Confirm next steps b. Consideration of question i. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); * Review of questions developed by leadership team to determine positions of different groups – please be open minded and be constructive (see https://docs.google.com/document/d/1gMV29jRPQEFGv2psZ2py2_F8cr93OeeA/edit) * Homework assignment: all teams to provide responses to these questions by Tuesday 20 April at the latest. * EPDP Team input * Confirm next steps 4. Wrap and confirm next EPDP Team meeting (5 minutes): a. EPDP Team Meeting #16 Thursday 22 April at 14.00 UTC - note, placeholder plenary session is being scheduled to allow for a second weekly plenary meeting, if needed. b. Confirm action items c. Confirm questions for ICANN Org, if any Berry Cobb GNSO Policy Consultant Principal | BAC in Black Consulting <http://bacinblack.com/> Mob: +1 (720) 839-5735 <https://twitter.com/berrycobb> <https://www.linkedin.com/in/berrycobb/>

2 1

Updated Supplemental information to EPDP Phase 2a
by Brian Gutterman April 13, 2021

April 13, 2021

Dear EPDP Team Members, In its 3 March 2021 response<https://mm.icann.org/pipermail/gnso-epdp-team/2021-March/003716.html> to the EPDP Phase 2A Team, ICANN org provided additional information in response to questions asked by the Phase 2A Team during the 26 January 2021 webinar on the Legal and Natural Person Study. In presenting the additional information on 18 March 2021<https://community.icann.org/pages/viewpage.action?pageId=158140502>, ICANN org received questions regarding the ccTLDs’ policies pertaining to the public interest basis for processing registration data as well as the registry operators’ policies on a natural person’s option to consent to have their registration data publicly available. ICANN org has conducted some additional research to answer these questions and has updated the Appendix A document with its findings. Specifically, the results were added to columns I and K of Appendix A, which includes quotes from the corresponding policy, if any. Please do not hesitate to reach out to us with any questions regarding this updated information. Thank you, Brian, Amy, Jared, Karen

2 1

EPDP Phase 2A legal guidance -
by policy＠bacinblack.com April 12, 2021

April 12, 2021

Dear EPDP Team, Attached, please find Bird & Bird’s responses to the Legal Committee’s fourth question regarding options for contact address masking. The question is included in the attached memo. Thank you. Best regards, Caitlin, Marika, and Berry Berry Cobb GNSO Policy Consultant Principal | BAC in Black Consulting <http://bacinblack.com/> Mob: +1 (720) 839-5735 <https://twitter.com/berrycobb> <https://www.linkedin.com/in/berrycobb/>

1 0