- Gnso-epdp-team - lists.icann.org

REMINDER: EPDP Team homework
by Caitlin Tubergen Feb. 8, 2021

Feb. 8, 2021

Dear EPDP Team: Support Staff has populated the legal v. natural proposals, which were discussed during the last plenary meeting, into the Google Doc<https://docs.google.com/document/d/1N-3HyLJZTBq6tCVB4Ig3ws2Tfjb08RGFP1NTNe1…>. The five proponents (Laureen, Tara, Melina, Milton, and Margie) may wish to edit their proposals<https://docs.google.com/document/d/1N-3HyLJZTBq6tCVB4Ig3ws2Tfjb08RGFP1NTNe1…> in light of Thursday’s discussion. As a reminder, EPDP Leadership has asked the EPDP Team to use the Google Doc<https://docs.google.com/document/d/1N-3HyLJZTBq6tCVB4Ig3ws2Tfjb08RGFP1NTNe1…> to review the proposals and, using a constructive tone, provide input in the white columns, namely: 1. What concerns do you have about this proposed best practice? How could this concern be mitigated? 2. If there is support for the guidance provided (either in this form or modified form), what incentives could be provided to encourage the adoption by Contracted Parties of this guidance? Once EPDP Members have opined on the proposals, the Team will be better positioned to provide input in the orange column (should the Phase 1 rec be changed?). Please provide input by COB Wednesday, 10 February. Please let us know if you have any further questions. Best regards, Berry, Marika, and Caitlin

1 0

Notes and action items - EPDP Phase 2A Meeting #05 - 4 Feb 2021
by Caitlin Tubergen Feb. 4, 2021

Feb. 4, 2021

Dear EPDP Team: Please find below the notes and action items from today’s EPDP Phase 2A meeting. The next meeting of the Legal Committee will be Tuesday, 9 February at 1400 UTC, and the next plenary meeting will be Thursday, 11 February at 1400 UTC. Thank you. Best regards, Berry, Marika, and Caitlin Action Items Please refer to the Google Sheet<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> for Action Items. We will review the action items at the beginning of each call. Notes EPDP Phase 2A - Meeting #05 Thursday 4 February 2021 at 14.00 UTC 1. Roll Call & SOI Updates 2. Welcome & Chair updates (Chair) a. EPDP Phase 2A project package overview (Berry) * The EPDP Team provides a monthly status report to the Council re: the progress of the group. What you see on the screen is the first status report that will be sent to the Council. This will be the commitment to the plan that the Team is required to provide to the Council, including being committed to the delivery dates. The Team does have flexibility in terms of project change requests. * The first slide is a “poor man’s Gantt chart” or the summary timeline that includes delivery dates. This was first presented in early January and showed the original plan to deliver a report by 31 March. The key takeaway for the summary timeline is that the delivery date of the Initial Report has been extended to the end of May. The Chair’s update to the Council is still likely to occur at the ICANN70 virtual meeting, as it is still a requirement for Keith to provide this update on where the Team stands from a probability of meaningful progress perspective. * The reason why the plan has been extended by two months is partly b/c the Team got a slower start than anticipated, and there is greater demand from a legal advice perspective. It also takes into account that the Team is operating under a slower pace (one meeting per week), though, in effect, with the legal committee, there are now two meetings per week. * It should be noted that even though there are now two additional months, there is still very little meeting time, and the Team needs to be aggressive in its work and leverage offline interactions to meaningfully progress its work. * From a project manager perspective (not trying to presuppose an outcome), the plan is built to the end of a recommendations report being delivered to the Council. * This will be sent to the Council on Monday; it will likely be an AOB item during the Council’s next meeting on 18 Feb. * The other work products under PDP 3.0 include the PCST (project cost support team); because there is not a dedicated budget for this short-term effort, expenses are not tracked, and this will not be included in this project package. * There is also a situation report – the core of this document to understand is the status and health of the project. * The Gantt chart project plan looks like an eyesore on this screen, but it breaks down all of the Team’s work. * The last part of the package is the Google sheet<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> to track meetings and action items. Please regularly check in on this, with particular attention to the open action items. * Follow-up question: the chair is still on the hook to give an update to the Council in March, but based on the progress we’re making so far, the Initial Report is targeted for May, and we are asking the Council to approve that as the team’s timeline? * Yes. As part of PDP 3.0, current and future working groups are required to commit to a set of target delivery dates, and this is the plan the leadership team agreed to. The update to the Council in March was a requirement from the beginning. * Is there anything the team should review or comment on re: the project package? * No, it’s pretty finalized, but the Team is welcome to ask questions or spot inconsistencies. In terms of the substance and target dates, those are set in stone – this is more of an FYI of what will be sent to the Council. * Regarding the March timeline, it’s not a formal consensus call, it’s rather a chance or probability of consensus determination from the chair – this is in line with GNSO Council’s requirement. b. Vice-chair confirmation (see https://mm.icann.org/pipermail/gnso-epdp-team/2021-January/003650.html) * We received one expression of interest for a vice-chair from Brian Beckham. Brian submitted his EOI to the group. Historically, the vice-chair has been a member of the EPDP Team, and the team’s charter is unclear as to whether the vice-chair needs to be part of the team. * Accordingly, Keith will go to the Council for its non-objection to Brian being vice-chair as the Team has expressed no objection to the Brian’s appointment. c. Update from legal committee (Becky) * The Legal Committee met and started working its way through the draft questions received from the plenary. The approach is whether the Team has already received sufficient advice from B&B to answer the questions. If not, do the questions relate to items in scope of the EPDP Team? If so, would the question further the work of the group? So far, the Legal Committee is working on refining the questions received. * Feedback: last time around, the legal committee worked under an unanimity basis – is the methodology the same this time around? * The team was not looking for unanimity, but rather consensus of the small group. 3. Legal vs. natural a. Proposed approach for reviewing and refining proposals * See https://mm.icann.org/pipermail/gnso-epdp-team/2021-January/003654.html * Team is asked to review the proposals and opine on the following questions in a constructive manner: * What concerns do you have about this proposed best practice? How could this concern be mitigated? * If there is support for the guidance provided (either in this form or modified form), what incentives could be provided to encourage the adoption by Contracted Parties of this guidance? * Does this guidance provide sufficient risk mitigation to consider changing the EPDP Phase 1 recommendation? If not, why not and what further risk mitigation would be needed to change your opinion? (Note: this column is meant to be filled out later in the process following assessment of the proposed risk mitigation.) * EPDP Team input & suggestions * This seems to focus only on guidance, but what the team should be focusing on is consensus policy. * Note: the rightmost column of the Google doc<https://docs.google.com/document/d/1N-3HyLJZTBq6tCVB4Ig3ws2Tfjb08RGFP1NTNe1…> is reserved for consensus policy considerations, but leadership would like the team to first focus on best practices and guidance so that the team is better positioned to assess whether the best practices/guidance should become consensus policy. b. Continued introduction of proposals for guidance that can be provided to Registrars and Registries who differentiate or want to differentiate between registrations of legal and natural persons · Proponents to introduce proposal (see https://docs.google.com/document/d/1QlM4O_vwx7cQ11DJ_Lx2kqhyyRgDkMXG/edit) * Laureen Kapin (proposal #6) * This part of the proposal deals with whether the registrant provides personal information or not. It is proposing to leverage existing mechanisms that registrars use to communicate with their clients – education, clarification, confirmation, and ability to correct. * In terms of the discussion going on in the legal committee, Volker had suggested perhaps one option to deal with the risk of inadvertently disclosing personal information is to deal with this information via automatic disclosure through the SSAD. * Feedback: making the differentiation b/w personal data vs. legal v. natural is a more constructive approach. Most registrants have automatic renewal set up without anyone ever noticing anything. The more interaction that is required, the more disruptions that occur. In terms of voluntary updates the customer can make, that could be included in the WHOIS Data Reminder Policy (WDRP), that could work. As soon as this becomes a requirement where the customer has to react and do something, this creates chaos. * It only takes one or two issues before there is an existential business problem. Not every registrant pays attention to their domains or manages them as closely as they probably should. Instead of focusing on how to safely disclose data that is redacted, we could focus on building a mechanism for legal entities or natural persons who consent to publication to get them into a declaration state and focus on a path of mandatory redaction and build a safe publication process. * It’s impossible to prevent all registrants from making a mistake, and that is not the team’s goal. The goal is to put CPs in the best possible position to put the risk at near zero so that a registrant doesn’t have a case if data is disclosed because they were properly put on notice of the disclosure risks. * The voluntary publication is already part of Phase 1 – had previously asked if registrars already do this. The Team needs to understand if this is already being done. The question is: is this in place now, or has it been not implemented? * There will have to be some form of standardization because registrars still have to upload the data to some of the registries. If there is something in place industry-wide, there needs to be standardization. Registrars are dealing with a whole infrastructure that has to be taken into account. * The Phase 1 IRT is still doing its work re: Phase 1 recommendations. * Believe registrars already have implemented this, but it’s likely a bespoke process for each registrar. * The legal committee is discussing considering these recommendations via the SSAD in order to minimize risk – want to ensure this is captured as a discussion item. * Tara Whalen (proposal #8) * SSAC is looking for ways to publish appropriate data to help fight cyber-crime. * SSAC reviewed how this is done in other parts of the industry – particularly RIPE NCC and ARIN. * RIPE NCC’s registrants are legal persons, however sometimes natural persons data is published – RIPE NCC provides mechanisms for the removal and correction of personal data and created an acceptable use policy in line with this. * RIPE NCC needs to ensure contactability, which underpins their approach. The approach states that having contact details responsible for internet number resources facilitates internet coordination and is necessary when something goes wrong. * Proposal is to examine at the permission-based grant to see if this can be used for ICANN’s purposes. * This may already have been subject to previous guidance from B&B. See this memo: https://community.icann.org/display/EOTSFGRD/EPDP+-P2+Legal+subteam?preview…) * Just b/c another guy jumps off a tenth-floor window, we shouldn’t do the same. * The language from the previous phase is helpful, but this question still merits further review. * Are there examples of actual legal actions against companies? * When we’re talking about new regulations, it’s difficult to have this certainty. In terms of increased risk, this is very subjective, and it may not be productive to ask this question. * Could there be data breaches b/c of registrant conduct? Yes, there can. But there can be transparency that mitigates this risk. * These are legally-speaking, very separate analyses. The previous memo deals with consent, and we agree that is a problem. That is a very different question than looking at it through a lens of identification of a legal entity. It would be useful to keep in mind that these are two separate questions. * Action to take this back to the legal committee. * Melina Stroungi (proposal #10) * The proposal is at the core of what the team is discussing – in order to assess whether this is feasible, it would be helpful to have a cost-benefit analysis. The question is what the risks and costs are. Laureen’s proposal, for example, shows how to mitigate the liability risks. There are not only risks when implementing something; there are also risks in not differentiating between legal and natural persons. This has not been included in the cost-benefit analysis. * The group needs to consider how the cost-benefit analysis should be structured and to assess whether this is reasonably possible within the timeframe the team has. * Milton Mueller (proposal #3) * Milton was not present on this call, so this proposal was not discussed. * Other * In terms of preliminary discussion going on in the legal committee, does the disclosure of legal person’s data through the SSAD help mitigate the risk of improper disclosure? * The risk is different from disclosure through the SSAD vs. the publication in WHOIS, such as harvesting of data. When the team looks at the disclosure of information – the ways it can be possible is better within SSAD instead of outside of it. * This would mitigate the risk of an inadvertent disclosure, but from the perspective of ensuring that non-personal information has no basis to be shielded, this still has an above-and-beyond layer, which means this proposal still suffers from the same risks as the status quo that data that is not entitled to protection is protected. Do acknowledge that automated disclosure is more streamlined, but this is still an overprotection of information since GDPR does not protect legal person data. * Whether this is outside of GDPR, if there is still a high risk that the data is inside GDPR, this may be a safeguard that we can consider, but we need to look at if the data is protected. * This proposal does not satisfy the needs of other stakeholders in that there is no ability to use the public information to do correlation. Doing a single query via the SSAD will not provide what is necessary to protect victims of a phishing attack. * An additional proposal developed by EWG, which is a verified contact approach, is something the team should consider. * In Phase 2, the team decided the minimum data that should be public. * It is not this team’s job to determine what is allowed with public data; there are certain freedoms that we have no control over. Using the SSAD to get legal data is something the Team discussed in Phase 2, but CPs noted this is still processing of data and therefore could not be automatically disclosed. * What correlation means is – when identifying potentially infringing domain names, there is a challenge to prioritize what to go after first – if a registrant has several infringing domain names, the problems can be more efficiently addressed. This kind of correlation is perfectly legal and is a useful practice that is no longer possible b/c of how ICANN has treated registration data post-GDPR. * The point is that others can use the same tools to figure out who owns a domain name that is politically inconvenient or persecuted speech in certain parts of the world. Cannot allow the case where registrants might get hurt from the same tools when used for evil instead of good. * The minimum data set was decided in Phase 1. During Phase 1, it was decided that differentiation would be decided later. That is what the team is dealing with now. · Q & A by EPDP Team · Confirm next steps 4. Feasibility of unique contacts (see https://docs.google.com/document/d/1e2-rVF2wh-821tct76O50QdWwn4ZcIqS/edit) – if time allows a. Introduction of proposals for options to require unique contacts to have a uniform anonymized email address across domain name registrations that would not result in being treated as publication of personal data · Proponents to introduce proposal * Brian King * Melina Stroungi, Chris Lewis-Evans · Q & A by EPDP Team · Confirm next steps 5. Wrap and confirm next EPDP Team meeting (5 minutes): 1. Meeting #06 Thursday 11 February at 14.00 UTC. 2. Confirm action items 3. Confirm questions for ICANN Org, if any

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2A | Thursday, 04 February 2021 at 14:00 UTC
by Terri Agnew Feb. 4, 2021

Feb. 4, 2021

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2A call held on Thursday, 04 February 2021 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/jIgmCQ> (attendance included) and the GNSO Master calendar [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…>. These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a panelist, observers can join as an attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

January 2021 - EPDP-P2A Project Package
by policy＠bacinblack.com Feb. 4, 2021

Feb. 4, 2021

Dear All, Please find attached the 31 January 2021 EPDP-P2A Project Package. As noted on the call, this will be sent to the GNSO Council on 8 February and will act as the committed plan and milestone deliverable dates that we will be accountable to delivery of the project. Please let me know if you have any questions. Thank you. B Berry Cobb GNSO Policy Consultant Principal | <http://bacinblack.com/> BAC in Black Consulting Mob: +1 (720) 839-5735 <https://twitter.com/berrycobb> <https://www.linkedin.com/in/berrycobb/>

1 0

Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 11 February 2021 at 14:00 UTC
by Terri Agnew Feb. 4, 2021

Feb. 4, 2021

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, zoom webinar room will be made available for the EPDP plenary meetings. As a reminder, the zoom recording, audio recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 11 February 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the Expected Standards of Behavior [icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resource…> Visit the Wiki agenda page: https://community.icann.org/x/j4gmCQ Check your time zone: https://tinyurl.com/y97xxrcy The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

**Reminder** Meeting Invitation | Observers | GNSO Temp Spec gTLD RD EPDP-P2A call | Thursday, 04 February 2021 at 14:00 UTC
by Julie Bisland Feb. 3, 2021

Feb. 3, 2021

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, zoom webinar room will be made available for the EPDP plenary meetings. As a reminder, the zoom recording, audio recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2A is scheduled on Thursday, 04 February 2021 at 14:00 UTC for 90 minutes. Main Zoom Webinar link: https://icann.zoom.us/j/92181477886?pwd=TlJHTU5EY1d3bUxLV2s3UStPS2MxZz09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/92181477886?pwd=TlJHTU5E…> Passcode: Z@S07?t=v5 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the Expected Standards of Behavior [icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resource…> Visit the Wiki agenda page: https://community.icann.org/x/jIgmCQ Check your time zone: https://tinyurl.com/y9lengt8 [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/y9lengt8__;!!PtGJab4!vw-y-hh…> The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile US: +13126266799,,92181477886#,,,,,,0#,,3121016458# or +13462487799,,92181477886#,,,,,,0#,,3121016458# Webinar ID: 921 8147 7886 Passcode: 3121016458 International numbers available: https://icann.zoom.us/u/acVxz9PmJI [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acVxz9PmJI__;!!PtGJab4!p…> Thank you. Kind regards, Terri

1 0

EOI for Vice Chair
by Drazek, Keith Feb. 2, 2021

Feb. 2, 2021

Hi all, In preparation for Thursday’s EPDP Phase 2A plenary call, please find the Expression of Interest from Brian Beckham for the role of Vice Chair. Best, Keith From: BECKHAM Brian <brian.beckham(a)wipo.int> Sent: Wednesday, January 27, 2021 2:04 PM To: Drazek, Keith <kdrazek(a)verisign.com> Cc: caitlin.tubergen(a)icann.org; Berry.Cobb(a)icann.org; marika.konings(a)icann.org Subject: [EXTERNAL] RE: [Ext] RE: Q re Phase 2a Caution: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Hi Keith, all, Please see the attached – I hope this covers the necessary bases, but do of course let me know if further detail would be required or if I can answer any questions. Brian

1 1

Proposed agenda - EPDP Phase 2A Meeting #05 - 4 February 2021
by Caitlin Tubergen Feb. 2, 2021

Feb. 2, 2021

Dear EPDP Team: Please find below the proposed agenda for the next EPDP Phase 2A meeting on Thursday, 4 February at 14:00 UTC. As a reminder, please find outstanding action items here: https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…. Best regards, Berry, Marika, and Caitlin -- EPDP Phase 2A - Meeting #05 Proposed Agenda Thursday 4 February 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (15 minutes) a. EPDP Phase 2A project package overview (Berry) b. Vice-chair confirmation (see https://mm.icann.org/pipermail/gnso-epdp-team/2021-January/003650.html) c. Update from legal committee (Becky) 3. Legal vs. natural (60 minutes) a. Proposed approach for reviewing and refining proposals * See https://mm.icann.org/pipermail/gnso-epdp-team/2021-January/003654.html * EPDP Team input & suggestions b. Continued introduction of proposals for guidance that can be provided to Registrars and Registries who differentiate or want to differentiate between registrations of legal and natural persons · Proponents to introduce proposal (see https://docs.google.com/document/d/1QlM4O_vwx7cQ11DJ_Lx2kqhyyRgDkMXG/edit) * Laureen Kapin (proposal #6) * Tara Whalen (proposal #8) * Melina Stroungi (proposal #10) * Milton Mueller (proposal #3) * Other? · Q & A by EPDP Team · Confirm next steps 4. Feasibility of unique contacts (see https://docs.google.com/document/d/1e2-rVF2wh-821tct76O50QdWwn4ZcIqS/edit) – if time allows a. Introduction of proposals for options to require unique contacts to have a uniform anonymized email address across domain name registrations that would not result in being treated as publication of personal data · Proponents to introduce proposal * Brian King * Melina Stroungi, Chris Lewis-Evans · Q & A by EPDP Team · Confirm next steps 5. Wrap and confirm next EPDP Team meeting (5 minutes): 1. Meeting #06 Thursday 11 February at 14.00 UTC. 2. Confirm action items 3. Confirm questions for ICANN Org, if any

1 0

Legal v. Natural Proposals
by Caitlin Tubergen Jan. 29, 2021

Jan. 29, 2021

Dear EPDP Team: In an effort to continue the constructive progress on the legal vs. natural proposals, the staff support team has developed this google doc: https://docs.google.com/document/d/1N-3HyLJZTBq6tCVB4Ig3ws2Tfjb08RGFP1NTNe1…. As described in the background briefing document<https://community.icann.org/download/attachments/153518176/P2A%20Background…> that was presented during the first meeting, the leadership team has decided to first focus on best practices and proposed methodology regarding how to distinguish between legal and natural person registrations. After reviewing best practices and how differentiation could be done in practice, EPDP leadership believes the team will be better positioned to consider the question of whether the phase 1 recommendation can and should be modified. We don’t expect you to complete these documents yet as Laureen is still due to present part 2 of her proposal, but you are already welcome to provide any input you may have, or any feedback you have on this approach. We note that a number of the other proposals put forward (see here<https://docs.google.com/document/d/1QlM4O_vwx7cQ11DJ_Lx2kqhyyRgDkMXG/edit#h…>) are either similar or focus on specific parts of the proposal that Laureen presented during the call. We would like to ask those that put forward additional proposals that appear linked (Brian, Margie/Mark, Hadia/Alan) to indicate off-list whether they would still like to present their proposals separately or whether you consider these approaches already captured or subsumed by Laureen’s proposal. For next week’s agenda, we will allot time for Laureen to introduce part 2 of her proposal, and Milton, Melina, and Tara to present their proposals. Additionally, we will allot time to any others who have indicated that they would still like to present their proposal if it is different from what Laureen presented. Best regards, Berry, Marika, and Caitlin

1 0

Notes and action items - EPDP Phase 2A Meeting #04 - 28 Jan 2021
by Caitlin Tubergen Jan. 28, 2021

Jan. 28, 2021

Dear EPDP Team, Please find below the notes and a link to the action items from today’s meeting. As a reminder, the Legal Committee will be meeting on Tuesday, 2 February at 14:00 UTC, and the next EPDP Team meeting will be Thursday, 4 February at 14:00 UTC. Best regards, Marika, Berry, and Caitlin Action Items ❗️Please refer to the Google Sheet<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> for Action Items. We will review the action items at the beginning of each call. ❗️ EPDP Phase 2A - Meeting #04 Proposed Agenda Thursday 28 January 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. Update on Council Liaison to EPDP-P2A * The Team will shortly have a GNSO Council liaison to EPDP P2A; this will be formalized at the next Council meeting. Philippe Fouquart has volunteered to serve in this role. b. Update on Legal Committee * Brian Beckham has submitted an expression of interest to the list; the Team should have received this yesterday. * As a reminder, since Brian is not a member of the EPDP Team, if the group is comfortable with Brian as the vice-chair, the Council would need to confirm this is OK. * Please indicate additional questions (if any) for Brian or any objections to his candidacy by COB Wednesday, 3 February, as we would like to formalize this at the next plenary meeting. * The legal committee is now fully formed and will have its first meeting, on Tuesday, 2 February at 1400 UTC. 3. Legal vs. natural (see https://docs.google.com/document/d/1QlM4O_vwx7cQ11DJ_Lx2kqhyyRgDkMXG/edit# [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1QlM4O_vwx7cQ…>) * Each EPDP team member who submitted a proposal will have the opportunity to present the proposal to the team. * Following the brief presentation of the proposal, the Team may respond; however, please provide feedback in a constructive manner. * Please note these are proposals for what registrars may do if they differentiate b/w legal vs. natural. * Question from EPDP Team: why is the group only focused on voluntary differentiation rather than having a discussion about making mandatory differentiation part of a consensus policy? * Response: The Council instructed the EPDP Team to develop best practices and then consider if mandatory differentiation should become consensus policy. * Some proposals only make sense if differentiation is mandatory. * Understand sequencing; however, the endgame for certain stakeholder groups is to find a way that information that is not protected under the GDPR to be published, and that any policy ultimately agreed to is consistency with GDPR. The current policy protects information that is not legally entitled to be protected. * The first question to consider is if any updates are required for EPDP Phase 1 a. Observations from ICANN org webinar · Any remaining questions or missing information on the topic? · Other comments * One interesting thing from the webinar is that the organizations who have differentiated have noted it’s not as onerous as some may have thought. It is worth investigating why these organizations have found this to be easier than one would assume. * There may be value is asking that question; however, this needs to be qualified – have these organizations always differentiated, or was this something they instituted following GDPR? * ICANN org overstepped in this study, as Org weighed the factors in the study but some of the conclusions drawn are wrong * ICANN org noted, during the webinar, that this is a framework and is not meant to be determinative and definitive. It is meant to be a tool to help the group in its deliberations. b. Introduction of proposals for guidance that can be provided to Registrars and Registries who differentiate or want to differentiate between registrations of legal and natural persons · Proponents to introduce proposal * GAC (proposal #5): Fully mindful of the fact that there is a difference in dealing with new registrants vs. legacy registrants, and this proposal is for new registrations, not legacy registrations. The goal is to leverage the legal advice from Bird & Bird. * Upon registration, registrants could identify as legal or natural persons. CPs would be required to use plain language to allow Jane or John Public to understand the difference. There are probably existing models to learn from, as some registrars already do this. In terms of the plain language, focus groups could be used to determine if the language is indeed understandable – the language could then be uniform and required. * Second step would be to send the confirmation to the contact, and technical and admin contact – the email could provide a warning about publication so that the registrant is informed of the consequences. * There could also be a separate verification after that – such as a corporate identification number or some sort of screening process or third-party provider. The EDPB also noted there should be a directive given that legal registrants should NOT be providing personal data in their registration. * Fourth step – if they get it wrong, it should be easy to get it right. * Response: many ccTLDs do similar things; however, registrars still have issues with this. ccTLDs generally focus on one jurisdiction only, while gTLD registrars are dealing with registrants from across the globe. In terms of fixing it if the registrant gets it wrong, there is no putting the genie back in the bottle because the data could have already been harvested. * Emphasize a degree to which GAC’s proposal introduces an unnecessary step. Key question: is the data published or not? If there is an option that says – I want this published – that’s all that is needed. The legal v. natural distinction is confusing and it’s unnecessary if the registrant consents to publication. Do not understand the need for this step. * Under GDPR – is it allowed for a legal person to not have their data disclosed? * Did not hear the GAC proposal invoke corporate registrars. GDPR is silent as to what extent one could voluntarily keep legal person data protected. * The distinction b/w legal and natural is a bit of red herring. The question is does the registration data contain personal information. Having to declare this in the registration path is a bit of a nightmare. An example is Customer A has a user handle for all registrations but now the user handle carries a different meaning. Consent may not be the consent of the data subject. Consent is hard online. * In terms of legacy registrations, this proposal cabins that off and focuses on new registrations. Understand that liability and fines are a concern. The point of this exercise is to go over proposals that minimize liability. As we have all recognized, there is no risk-free or liability-free world. However, if there are procedures in place that will help to minimize liability, we should visit those. Appreciate the suggestion to focus on consent, but focusing on consent does not take us where we need to go because the current policy allows protection of information that has no protection under the GDPR. The law requires certain info to be protected, and the policy goes above and beyond what the law requires. * For new registrants, introducing new handles should not be an issue. In relation to legal person’s data that could include personal data, declaring that there is no personal information is necessary but some of the safeguards suggested by the legal memos suggest using a technical tool to confirm that email addresses of legal persons do not contain personal information. Also, there should be tools for legal persons to correct their data, which is a requirement under Article 16. The legal memos and study provide safeguards in relation to each of the contracted parties’ concerns * The conversation is one-sided, in that it focuses on the privacy side without focusing on the NIS2 directive, which requires the publication of data of legal persons. It’s a good idea to design a policy that considers these issues. * The team is confusing privacy by default and privacy by design – some in the group are focusing on privacy by default. Privacy by design requires a design – we should focus on that. * The question is not if legal data should be protected. What we are talking about is an adjacent problem – we don’t know how we can achieve that in line with the law. Yes, the NIS2 directive notes that legal person data should be published so long as it is in line with data protection law. In terms of privacy by default and privacy be design – in order to have the design, there must be privacy by default. In other words, there was no breach of the data if we were to make a mistake in the design. One core concept in European law is proportionality, and that includes cost of implementation. Is this proportional and feasible, or is this a “in a perfect world scenario”? * NIS2 directive is not something that should be relied b/c it’s a proposal, it is subject to a lot of lobbying and discussion in parliament and when agreed to, it will take years to be transposed into local law. This could be at least five years down the line. How many emails do you expect registrars’ customers to receive? The required notices are numerous and customers already feel spammed by their registrar. * Have not yet heard an argument as to why the team can’t focus on consent rather than a legal v. natural distinction. Someone mentioned that some laws require legal persons to publish their information; however, that is an obligation imposed on the legal person, not the registrar. * With some collaboration and discussion, the team can consider a safety valve that would occur before publication, such as communications with the registrant. These safety valves would provide the registrant an opportunity to not have their information published. If the steps proposed are not enough, would welcome discussion on that. * Privacy by design is getting all of the aspects mentioned in the proposal into the design of the system which reduces the risk of getting information out there. * This may not be a silver bullet, but the team should focus on helping the proposal rather than focusing on getting to zero risk, which is not possible. We’re here to work on how to get to as close to zero risk as possible. * In response to previous characterization that NIS2 is a “legal nothing” is not constructive and minimizes on the EU’s role. There is a clear sign that this is the way the GDPR should be interpreted. There is a lot of talk about the existence of risk and liability, but the Team should try to qualify this. Not every DPA is going to use a nuclear bomb and fine everyone. * In terms of having zero risk here, that is not necessarily true. There is zero risk if there is no publication. * At this time, the NIS2 is a proposal – it will take years to become national law. Once it becomes a valid law, then we can act. * When we talk about privacy by default, there may be other considerations. Do not know how in this plenary we can constructively have a conservation about proportionality. Some people perceive the proportionality of risk to be very high; others think this is very low. * Real-life example: friend who cuts hair and rents a station at a salon. All of the info associated with the LLC is her personal address. Her clients stalked her at her home, and this is a risk that must be considered when legal person data is published. * Circling back to Laureen’s proposal – focus on the first point: notification to registrants to choose if they are legal or natural person and notifying of the risks. * The idea of finding appropriate language will probably look like an ICANN policy report and confuse people. You can ask someone meaningfully if they want their information published very easily, but explaining the difference b/w legal and natural and third party access is too confusing to the average registrant and is overly convoluted. * In the proposal, the term user-friendly – the text needs to be understandable with Joe and Jane Public. This could be an interactive process – it’s an engagement b/w the registrant and the registrar and doing this is part of the process of obtaining a domain name. This is currently being done; we can do some reconnaissance to see how other EU-GDPR compliant entities are doing this already. * Registrants may not speak English as their first language; they may not understand. For many registrars, this will amount to a check-box exercise, and this has inherent risks. · Q & A by EPDP Team · Confirm next steps 4. Feasibility of unique contacts (see https://docs.google.com/document/d/1weQemSQ0-884ILbhmR3OLzUWouyGXMKH/edit [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1weQemSQ0-884…> and https://docs.google.com/document/d/1e2-rVF2wh-821tct76O50QdWwn4ZcIqS/edit [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1e2-rVF2wh-82…>) – if time allows a. Introduction of proposals for options to require unique contacts to have a uniform anonymized email address across domain name registrations that would not result in being treated as publication of personal data · Proponents to introduce proposal · Q & A by EPDP Team · Confirm next steps 5. Wrap and confirm next EPDP Team meeting (5 minutes): a. Meeting #05 Thursday 4 February at 14.00 UTC. b. Confirm action items * EPDP Team members to indicate objections or additional questions (if any) for the vice-chair candidate, Brian Beckham, by COB Wednesday, 3 February. * EPDP Team members who previously prepared proposals for Legal v. Natural and Feasibility of Unique Contacts to be prepared to present proposals to the EPDP Team at the next meeting on 4 February. 1. Confirm questions for ICANN Org, if any * How does ICANN org see its liability risk to enforce mandatory differentiation of legal v. natural persons? For example, the risk for a registry is for 1 zone, for ICANN, the risk is likely for thousands of contracted parties.

1 0