- Gnso-epdp-team - lists.icann.org

Formal specification of collection and labelling rules for Natural and Legal registrants
by Steve Crocker April 1, 2021

April 1, 2021

Folks, As many of you know, I've been working with a small group to develop a framework for precisely expressing both collection and labeling rules for collectors and access rules for requesters. Attached are two documents. The Excel file has two visible tabs, one for registrants who are either known to be natural persons or whose status is unknown. The other is for legal persons. Both of these represent the ICANN perspective, i.e. the rules that gTLD registries and ICANN accredited registrars are required to adhere to. A couple of points that may feel slightly different from what you're used to: - The collection rule may be specific, e.g. every registrar must collect this data element, or every registrar must make collection of this data element optional, or the rule may allow different registrars to have different rules. The words "Neutral" and "Either" in a cell that's colored brown indicate ICANN imposes no constraint on the registrar or registries. - The data dictionary is inclusive. There may be data elements that are not of interest to ICANN or some registries or registrars. That's not a problem. In these cases the ICANN rule will generally indicate no preference. - In addition to whether the data is or is not collected, a validation level and a sensitivity level is assigned. The validation level ranges from V0 to V3. V0 indicates no validation. V3 indicates the registrar fully validates the accuracy. This scale is essentially the same as what's specified in SSAC's SAC 058 report. The sensitivity level is a slight generalization of public vs private. S0 is public. S1 is private. If someone with access only to public data elements attempts to retrieve data elements at the S1 level, the response will be "redacted." Levels S2 and S3 are more sensitive. - The attributes V3ok and DG indicate whether the registrant is allowed to override the validity and sensitivity labels. V3ok indicates the registrant has the option to request a high level of validation. DGok indicates the registrant has the option of "downgrading" the sensitivity level to public. Not included in this package is the specification of the request side of this system. I'll leave that for another time. Question for the group: Is the specification provided here an accurate representation of the past decisions and current thinking of the EPDP? The slides are a quick briefing on the system. I'll be happy to add further explanation either to the group or individually to anyone who's interested. Thanks, Steve

2 2

**Reminder** Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 01 April 2021 at 14:00 UTC
by Andrea Glandon March 31, 2021

March 31, 2021

**Reminder, some countries will have changed time, please make sure to check time zone link below. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 01 April 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/xYSBCQ Check your time zone: https://tinyurl.com/2vkfwsf9 [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/2vkfwsf9__;!!PtGJab4!qkbRqE-…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Proposed agenda - EPDP Phase 2A - Meeting #13 - 1 April 2021
by Caitlin Tubergen March 31, 2021

March 31, 2021

Dear EPDP Team, Please find below the tentative agenda for Thursday’s meeting, noting it is subject to change depending on the timing of receipt of legal advice. Best regards, Berry, Marika, and Caitlin -- EPDP Phase 2A - Meeting #13 Proposed Agenda Thursday 1 April 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) 3. Legal vs. natural (40 minutes) 1. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); 2. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. Guidance development a. Review updated write up of guidance proposal * See updated draft write up developed by leadership & staff support team (https://docs.google.com/document/d/11AYCPVEKjF--Obp-okojggWv1Z4R2PBjvZFOGu4…) * Reactions by EPDP Team: * Does the updated version address input provided to date? * Are there any “cannot live with” aspects remaining? * What incentives, if any, could be considered to promote any guidance agreed to by the EPDP Team? * Confirm next steps 4. Wrap and confirm next EPDP Team meeting (5 minutes): 1. EPDP Team Meeting #14 Thursday 8 April at 14.00 UTC. 2. Confirm action items 3. Confirm questions for ICANN Org, if any Reset for legal committee meeting 5. Legal Committee meeting (45 minutes) a. Initial review of B & B responses to legal committee questions

1 0

Updated Legal v. Natural Write-up
by Caitlin Tubergen March 30, 2021

March 30, 2021

Dear EPDP Team, As discussed during our last meeting, the staff support team has reviewed and considered the input received during the call and via the Google Doc and has taken another stab at updating the legal/natural guidance write up. To facilitate review, you can find a clean version here: https://docs.google.com/document/d/11AYCPVEKjF--Obp-okojggWv1Z4R2PBjvZFOGu4…. We have also attached a redline version to provide further context and transparency. We hope this updated version strikes the right balance between the different views expressed. We wanted to point out and ask specific input on the following: · An additional scenario was added by Brian K. that seemed to propose flagging data automatically for publication and allowing the registrant to correct this designation at a later stage. As a number of respondents pointed out, this seems contrary to the privacy by default principle. As a result, we have provisionally removed this scenario to allow Brian to further explain his proposal so that the group can consider adding it to the list of examples. · Concerns have also been expressed about the last scenario listed, which originally came from the RrSG proposal. A number of updates have been made, especially in relation to the role of the registrant that may address some/all of these concerns, but if not, the group should consider whether or not this example should remain. Of course, you are welcome to provide input on any of the other aspects of the updated write up. Please use the comment function to provide your suggestions instead of the redline function, as this will allow others to react to your suggestions and will avoid people rewriting others’ suggestions. The deadline for input is Friday, 2 April. The idea is to get this document to a near final state in the course of next week so that it can be parked while the group reviews the responses to the legal advice and starts focusing on the other questions it has been asked to address. Thank you. Best regards, Berry, Marika, and Caitlin

1 0

Notes and action items - EPDP Phase 2A Meeting #12 - 25 March 2021
by Caitlin Tubergen March 25, 2021

March 25, 2021

Dear EPDP Team, Please find below the notes and action items<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> from today’s meeting. The next EPDP Phase 2A meeting is scheduled for Thursday, 1 April at 14:00 UTC. Best regards, Berry, Marika, and Caitlin -- EPDP Phase 2A - Meeting #12 Proposed Agenda Thursday 25 March 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. Status update to GNSO Council – feedback and reactions * Consistent with the message to the EPDP Team, Keith gave an update to the GNSO Council, noting that the Legal Committee has completed its work and the Team is currently awaiting feedback from Bird & Bird. Keith noted he believes there is a path to consensus on guidance to registrars who wish to differentiate; however, it’s premature to determine if there will be consensus on changes to consensus policy recommendations at this time. * Some councilors questioned the timeline, as some believed there should have been a go/no go decision at the end of March; however, Keith pointed to the project plan. * There is an expectation that Philippe will give an update to the Council at its April meeting. * Reminder to please continue making progress in good faith and complete homework in a timely fashion. * EPDP Feedback: * There are approximately 8 meetings left. If the Team spends its time looking at non-consensus recommendations, there may not be enough time to discuss actual consensus recommendations. * Encourage team members to speak to one another and do work outside of the plenary meetings. Also, the leadership and staff paper that was circulated is an opportunity to move things forward. * Bird & Bird’s advice should come in next week. * There has been progress working on the guidance and perhaps the Bird & Bird advice could assist; however, would not make any assumptions that legal advice will be determinative in the policy discussions. 3. Legal vs. natural (60 minutes) 1. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); 2. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. Guidance development a. Development of guidance proposal(s) * See draft write up developed by leadership & staff support team (https://docs.google.com/document/d/14Fs3b_Sz1ij3Tiu58uy0C69DWFHAq1Dp/edit) * Initial reactions by EPDP Team: * Does this accurately capture agreed aspects from the different proposals (RrSG, proposal 1a and thought experiment)? If not, what is missing? * Is it sufficiently high level to allow for flexibility to accommodate different business models, while at the same time providing helpful insights to those that want to differentiate? * What incentives, if any, could be considered to promote any guidance agreed to by the EPDP Team? * This document skips the legal vs. natural differentiation and, instead, looks at personal v. non-personal data. This is confusing. The registrants should first be differentiated by legal v. natural and then review if there is personal data. * There are challenges with trying to retrofit this approach with existing registrations. * The format of the document could be improved: for example, when the document gets to proposed guidance, it lists reminders, which is confusing. Perhaps include the reminders under “background”. * There are three scenarios, and it’s useful to have these here – these do not seem to be providing any guidance. * Data protection law does not apply to legal person data; however, there are difficulties in applying the requisite protections to natural persons, not legal persons. * GDPR exists to protect natural persons and not legal persons. Step 1 is important for compliance with the GDPR. First distinguish b/w legal and natural and then personal v. nonpersonal – indeed, this is for new registrations vs. existing registrations. Some members wish to only distinguish between personal and non-personal data – how can you distinguish only b/w personal and non-personal data – would this be done by asking the registrant or would you do it yourself? Also, would this be mandatory or voluntary? * OK with having a differentiation between legal and natural persons, so long as the registrant is in control of this determination and does not have it made for them. If we do introduce a legal v. natural distinction, and someone checks “legal”, there needs to be assurances that this will not be abused. Surprised to hear that someone said there was no guidance in this document – the document does provide guidance. Hope to get rid of the third scenario, but the other two are acceptable. * In terms of the person type, would not infer this as a registrar – would always have the data subject or domain owner indicate what type of person they are. In terms of required or voluntary, open to understanding the possibilities, but there is already a recommendation on this topic, and have not yet seen anything compelling indicating that this distinction should be mandatory. For example, during the last meeting, registrars explained why flags are difficult to implement. * The last sentence is problematic, as it appears to be providing legal advice to contracted parties. This is not appropriate for a WG to be providing legal advice. This should ultimately be up to the individual entity – these recommendations should not be written or drafted in a way that sounds like legal advice or guidance. * Cannot require manual review at the time of registration – this is not scalable * If it is up to the registrant to determine if data is personal or not personal – this has risks that if a registrant is a natural person, you should assume that all data is personal. If you allow differentiation, this is more compliant. * Appreciate concern for the risks we are addressing here. The domain owner can choose to publish information irrespective of person type – risk of publishing data without a proper legal basis is a greater risk of not having a legal person’s data published. * If all information is redacted, am as protected as I can be because I am not at risk of inadvertently publishing personal data. * Understand this point about greater risk of publishing personal data, however, this distinction could be very confusing. Encourage to further discuss with data protection officers – compare the two-step approach with the one-step approach. * The Team is currently talking about guidance – if it is just guidance, the distinction between legal and natural in a two-step process, have trouble understanding what the resistance is to registrars if it is just guidance. Is it b/c if you agree now, you’re concerned with it becoming mandatory? Please explain. The first step may actually be clarifying. If you check “yes” to this, your rights to data protection may be less strong or your data may be published. If you are a company, are you using your home office for your registration? As long as the registrant is in control of those decisions, this would be OK. * If there is a requirement (and there are discussions of requirements in NIS-2), this would be helpful in the future. Do not see a problem with this step being included in the guidance since it is currently optional. * What incentives, if any, could be considered to promote any guidance agreed to by the EPDP Team? * In Phase 1, the registrant can check a box and then the data will be published – this would likely be done by a computer rather than a person. How do you know that you should return the data? This can be called a flag or something else, but there is something informing the response to the query. * Understand the flag concept to be an additional field in the WHOIS record. This would create consistency. * There is a benefit in formally defining this flag – as this flag could carry on to another provider. * If there is the disclosure of legal persons, this would reduce the number of disclosure requests that would require manual review. * The problem is this is adding this complexity serves no benefit to the customer. * If there is an SSAD a nicely automated request system, you can automatically and quickly get concealed data through this process, and registrars won’t be burdened very much because it will be automated. * It’s important to distinguish between publication and disclosure through the SSAD. * Added SSAD recommendation from the Phase 2 final report within the document because it requires disclosure for domains with no personal data. If a flag is added, the system could be configured to respond automatically to requests. * Recommend avoiding the word “published” – what we mean is “provided in response to an RDS query” as this is more accurate. * Have until the end of day tomorrow to provide additional comments in the document. * Confirm next steps * EPDP Team members have until the end of the week to provide additional feedback, and Staff will then take the input and produce the next version. 4. Feasibility of unique contacts (10 minutes) 1. Whether or not unique contacts to have a uniform anonymized email address is feasible, and if feasible, whether it should be a requirement. 2. ii. If feasible, but not a requirement, what guidance, if any, can be provided to Contracted Parties who may want to implement uniform anonymized email addresses. a. Any issues that can be constructively discussed prior to receipt of legal advice? b. Confirm next steps 5. Wrap and confirm next EPDP Team meeting (5 minutes): 1. EPDP Team Meeting #13 Thursday 1 April at 14.00 UTC. 2. Confirm action items 3. Confirm questions for ICANN Org, if any

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2A | Thursday, 25 March 2021 at 14:00 UTC
by Terri Agnew March 25, 2021

March 25, 2021

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2A call held on Thursday, 25 March 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/WAhtCQ> (attendance included) and the GNSO Master calendar [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…>. These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a panelist, observers can join as an attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 01 April 2021 at 14:00 UTC
by Terri Agnew March 25, 2021

March 25, 2021

**Reminder, some countries will have changed time, please make sure to check time zone link below. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 01 April 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/xYSBCQ Check your time zone: https://tinyurl.com/2vkfwsf9 The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Re: [Gnso-epdp-team] On the proposed guidance
by Alan Greenberg March 24, 2021

March 24, 2021

Volker, I can't speak to other data protection laws, but GDPR requires accuracy "for the purposes for which they are processed" (GDPR Article 5(d). If contact data is collected to enable contact with the registrant, and it is "accurate data of the wrong data subject", then it cannot be used to contact the registrant and it is therefore not accurate. Alan At 2021-03-24 05:07 PM, Volker Greimann via Gnso-epdp-team wrote: >Hi Brian, > >That approach is actually very compliant with >data protection law. Overprotection is not an >issue. If you simply protect all data equally in >a way that would be compliant, you do not need to differentiate. > >Accuracy is shown by demonstrating that the data >is unchanged from the time it was created and >how it was created, by showing that the data >subject has contractually agreed to only provide >accurate data (and correct if outdated), and has >been provided with an annual opportunity to >review the data. That is the level accuracy that >is relevant under the accuracy principle of the GDPR, after all. > >On top of that (Bonus round for extra points >here) the data collection process ensured that >only properly formatted data was collected and >the registrant has been required to verify his email address. > >So reasonable steps to ensure the accuracy have >been taken, the data subject can request a >correction at any time and we will take action >on any indication of inaccuracy of the data. > >But the real problem isn't actually inaccurate >data, in our experience. It is accurate data of the wrong data subject. > >-- >Volker A. Greimann >General Counsel and Policy Manager >KEY-SYSTEMS GMBH > >T: +49 6894 9396901 >M: +49 6894 9396851 >F: +49 6894 9396851 >W: <http://www.key-systems.net/>www.key-systems.net > >Key-Systems GmbH is a company registered at the >local court of Saarbruecken, Germany with the registration no. HR B 18835 >CEO: Oliver Fries and Robert Birkner > >Part of the CentralNic Group PLC (LON: CNIC) a >company registered in England and Wales with company number 8576358. > >This email and any files transmitted are >confidential and intended only for the person(s) >directly addressed. If you are not the intended >recipient, any use, copying, transmission, >distribution, or other forms of dissemination is >strictly prohibited. If you have received this >email in error, please notify the sender >immediately and permanently delete this email >with any files that may be attached. > > >On Wed, Mar 24, 2021 at 9:48 PM King, Brian ><<mailto:Brian.King@markmonitor.com>Brian.King(a)markmonitor.com> wrote: > >Hey Volker, > > > >I suppose my point (and I think Iâm also >paraphrasing an intervention made by Melina >previously) is that approach is not likely to be >compliant with data protection law. > > > >I accept that the concept of accuracy as a >policy matter is not within our remit, but >letâs use accuracy as a data protection >principle how could a controller reasonably >demonstrate too a DPA that the controllerâs >data is accurate, for example, if the controller >has not even assessed whether the data is personal data? > > > > > >Brian J. Kingâ >He/Him/His > >Head of Policy and Advocacy, Intellectual Property Group > > >T +1 443 761 3726â > >Time zone: US Eastern Time > > > ><http://www.clarivate.com>clarivate.com | Accelerating innovation > >Follow us on ><https://www.linkedin.com/company/clarivate>LinkedIn, ><https://twitter.com/clarivate?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr…>Twitter, ><https://www.facebook.com/clarivate/>Facebook >and <https://www.instagram.com/clarivateofficial/?hl=en>Instagram > > > >From: Volker Greimann ><<mailto:vgreimann@key-systems.net>vgreimann(a)key-systems.net> >Sent: Wednesday, March 24, 2021 3:58 PM >To: King, Brian ><<mailto:Brian.King@markmonitor.com>Brian.King(a)markmonitor.com> >Cc: Mueller, Milton L ><<mailto:milton@gatech.edu>milton(a)gatech.edu>; ><mailto:gnso-epdp-team@icann.org>gnso-epdp-team(a)icann.org >Subject: Re: [Gnso-epdp-team] On the proposed guidance > > > >Hi Brian, > > > >the easiest way to comply with data protection >law is to simply treat all registration data as >if it were personal data. No chance of ever >running afoul data protection law if you do that >correctly and it is pretty easy to demonstrate as well. > > > >-- >Volker A. Greimann >General Counsel and Policy Manager >KEY-SYSTEMS GMBH > >T: +49 6894 9396901 >M: +49 6894 9396851 >F: +49 6894 9396851 >W: ><https://urldefense.proofpoint.com/v2/url?u=http-3A__www.key-2Dsystems.net_&…>www.key-systems.net > >Key-Systems GmbH is a company registered at the >local court of Saarbruecken, Germany with the registration no. HR B 18835 >CEO: Oliver Fries and Robert Birkner > >Part of the CentralNic Group PLC (LON: CNIC) a >company registered in England and Wales with company number 8576358. > >This email and any files transmitted are >confidential and intended only for the person(s) >directly addressed. If you are not the intended >recipient, any use, copying, transmission, >distribution, or other forms of dissemination is >strictly prohibited. If you have received this >email in error, please notify the sender >immediately and permanently delete this email >with any files that may be attached. > > > > > >On Wed, Mar 24, 2021 at 5:47 PM King, Brian via >Gnso-epdp-team ><<mailto:gnso-epdp-team@icann.org>gnso-epdp-team(a)icann.org> wrote: > >Hi Milton, > > > >Thank you for the constructive intervention. >Your point is well taken, and I can certainly >see that from the RNH perspective. > > > >One feature of data protection law related to >your point is that it requires data controllers >and processors to be able to demonstrate >compliance with the law. A controller or >processor could doubtfully demonstrate >compliance with data protection law if they had >not determined whether they were actually >processing personal data. In fact, data >protection professionals will tell you that you >absolutely must determine what personal data >youâre processing as the first step toward >compliance with data protection law. It seems >the policy question is: what, if anything, >should contracted parties be required to do >based on the status of the data? Is that right? > > > >As always, weâre happy to work with you and >look forward to finding consensus. > > > > > >Brian J. Kingâ >He/Him/His > >Head of Policy and Advocacy, Intellectual Property Group > > >T +1 443 761 3726â > >Time zone: US Eastern Time > > > ><http://www.clarivate.com>clarivate.com | Accelerating innovation > >Follow us on ><https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_compa…>LinkedIn, ><https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_clarivate-…>Twitter, ><https://urldefense.proofpoint.com/v2/url?u=https-3A__www.facebook.com_clari…>Facebook >and ><https://urldefense.proofpoint.com/v2/url?u=https-3A__www.instagram.com_clar…>Instagram > > > >From: Gnso-epdp-team ><<mailto:gnso-epdp-team-bounces@icann.org>gnso-epdp-team-bounces(a)icann.org> >On Behalf Of Mueller, Milton L via Gnso-epdp-team >Sent: Wednesday, March 24, 2021 11:13 AM >To: <mailto:gnso-epdp-team@icann.org>gnso-epdp-team(a)icann.org >Subject: [Gnso-epdp-team] On the proposed guidance > > > >I was reading through two documents setting out >in detail the proposed guidance on legal/natural. > >There seems to be more than one Google doc on >this and I am not sure which one is the latest >or most official, though I suspect it is the one >with various peopleâs comments crawling all over it. > > > >I was pretty supportive of the Guidance overall. >I had one problem with it, though. > >I liked the description of HOW the >differentiation needed to take place. But in >describing WHEN differentiation takes place and >WHO would do it, it sets out 3 âhigh level scenariosâ. > >The first two are ok. The third scenario (listed >as #5 in the document) is that the Registrar >does it for the RNH, based on âinferences.â > > > >That option just doesnât fly for those of us >representing RNHâs in this process. We cannot >have a registrantâs disclosure status or >person type determined FOR them by someone else. >If we can strike that part of the guidance, I >think we can be on our way to a much broader consensus. > > > >Dr. Milton L Mueller > >Georgia Institute of Technology > >School of Public Policy > >IGP_logo_gold block > > > > >Confidentiality note: This e-mail may contain >confidential information from Clarivate. If you >are not the intended recipient, be aware that >any disclosure, copying, distribution or use of >the contents of this e-mail is strictly >prohibited. If you have received this e-mail in >error, please delete this e-mail and notify the sender immediately. > >_______________________________________________ >Gnso-epdp-team mailing list ><mailto:Gnso-epdp-team@icann.org>Gnso-epdp-team(a)icann.org >https://mm.icann.org/mailman/listinfo/gnso-epdp-team >_______________________________________________ >By submitting your personal data, you consent to >the processing of your personal data for >purposes of subscribing to this mailing list >accordance with the ICANN Privacy Policy >(<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_…>https://www.icann.org/privacy/policy) >and the website Terms of Service >(<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_…>https://www.icann.org/privacy/tos) >You can visit the Mailman link above to change >your membership status or configuration, >including unsubscribing, setting digest-style >delivery or disabling delivery altogether (e.g., for a vacation), and so on. > >Confidentiality note: This e-mail may contain >confidential information from Clarivate. If you >are not the intended recipient, be aware that >any disclosure, copying, distribution or use of >the contents of this e-mail is strictly >prohibited. If you have received this e-mail in >error, please delete this e-mail and notify the sender immediately. > >Content-Type: image/png; name="image001.png" >Content-Disposition: inline; filename="image001.png" >Content-ID: <178660366ac4cff311> >X-Attachment-Id: 178660366ac4cff311 > > >_______________________________________________ >Gnso-epdp-team mailing list >Gnso-epdp-team(a)icann.org >https://mm.icann.org/mailman/listinfo/gnso-epdp-team >_______________________________________________ >By submitting your personal data, you consent to >the processing of your personal data for >purposes of subscribing to this mailing list >accordance with the ICANN Privacy Policy >(https://www.icann.org/privacy/policy) and the >website Terms of Service >(https://www.icann.org/privacy/tos) You can >visit the Mailman link above to change your >membership status or configuration, including >unsubscribing, setting digest-style delivery or >disabling delivery altogether (e.g., for a vacation), and so on.

2 1

**REMINDER** Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 25 March 2021 at 14:00 UTC
by Julie Bisland March 24, 2021

March 24, 2021

**Reminder, some countries will have changed time, please make sure to check time zone link below. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 25 March 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/WAhtCQ Check your time zone: https://tinyurl.com/1ewmtoe7 [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/1ewmtoe7__;!!PtGJab4!q_Prc2v…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

Proposed agenda - EPDP Phase 2A Meeting #12 - 25 March 2021
by Caitlin Tubergen March 23, 2021

March 23, 2021

Dear EPDP Team, Please find below the proposed agenda for the next EPDP Phase 2A meeting on Thursday, 25 March at 14:00 UTC. Best regards, Berry, Marika, and Caitlin -- EPDP Phase 2A - Meeting #12 Proposed Agenda Thursday 25 March 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. Status update to GNSO Council – feedback and reactions 3. Legal vs. natural (60 minutes) 1. Whether any updates are required to the EPDP Phase 1 recommendation on this topic (“Registrars and Registry Operators are permitted to differentiate between registrations of legal and natural persons, but are not obligated to do so“); 2. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons. Guidance development a. Development of guidance proposal(s) * See draft write up developed by leadership & staff support team (https://docs.google.com/document/d/14Fs3b_Sz1ij3Tiu58uy0C69DWFHAq1Dp/edit) * Initial reactions by EPDP Team: * Does this accurately capture agreed aspects from the different proposals (RrSG, proposal 1a and thought experiment)? If not, what is missing? * Is it sufficiently high level to allow for flexibility to accommodate different business models, while at the same time providing helpful insights to those that want to differentiate? * What incentives, if any, could be considered to promote any guidance agreed to by the EPDP Team? * Confirm next steps 4. Feasibility of unique contacts (10 minutes) 1. Whether or not unique contacts to have a uniform anonymized email address is feasible, and if feasible, whether it should be a requirement. 2. ii. If feasible, but not a requirement, what guidance, if any, can be provided to Contracted Parties who may want to implement uniform anonymized email addresses. a. Any issues that can be constructively discussed prior to receipt of legal advice? b. Confirm next steps 5. Wrap and confirm next EPDP Team meeting (5 minutes): 1. EPDP Team Meeting #13 Thursday 1 April at 14.00 UTC. 2. Confirm action items 3. Confirm questions for ICANN Org, if any

1 0