- Gnso-epdp-team - lists.icann.org

Re: [Gnso-epdp-team] Meeting with ICANN staff on legal v. natural study
by Marika Konings Jan. 20, 2021

Jan. 20, 2021

Marc, all, The questions are those that were identified and assigned by the EPDP Team during the last meeting (see https://docs.google.com/document/d/1QlM4O_vwx7cQ11DJ_Lx2kqhyyRgDkMXG/edit - under the heading ICANN org study). Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org> on behalf of "Anderson, Marc via Gnso-epdp-team" <gnso-epdp-team(a)icann.org> Reply to: "Anderson, Marc" <mcanderson(a)verisign.com> Date: Tuesday, 19 January 2021 at 16:03 To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: [Gnso-epdp-team] Meeting with ICANN staff on legal v. natural study Caitlin, Berry and Marika, I see from the workplan & action items document that support staff has sent a list of initial questions on the legal/natural study to ICANN org. “Support Staff to notify internal colleagues of submitted questions relating the ICANN org legal/natural study, and coordinate a time for a presentation on the study, during which submitted questions will be addressed.” Could you share that list of questions with the working group so we are all on the same page heading into our call? Best, Marc

2 1

Proposed Agenda - EPDP Team meeting #3 - Thursday 21 January at 14.00 UTC
by Marika Konings Jan. 19, 2021

Jan. 19, 2021

Dear EPDP Team, Please find below the proposed agenda for Thursday’s EPDP Team meeting. Also, a reminder of the action items due by the end of COB today: Feasibility of unique contacts: * Review terminology, problem statements and provide examples: https://docs.google.com/document/d/1weQemSQ0-884ILbhmR3OLzUWouyGXMKH/edit. * Review assignments of clarifying questions and proposals: https://docs.google.com/document/d/1e2-rVF2wh-821tct76O50QdWwn4ZcIqS/edit Legal / natural: * Review assignments of clarifying questions and proposals: https://docs.google.com/document/d/1QlM4O_vwx7cQ11DJ_Lx2kqhyyRgDkMXG/edit#<https://docs.google.com/document/d/1QlM4O_vwx7cQ11DJ_Lx2kqhyyRgDkMXG/edit> Best regards, Caitlin, Berry and Marika ======================= EPDP Phase 2A - Meeting #03 Proposed Agenda Thursday 21 January 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) 1. Reminder to select your represented member on the Legal Committee 3. Review of Homework Assignments (75 minutes) Feasibility of unique contacts (see https://docs.google.com/document/d/1weQemSQ0-884ILbhmR3OLzUWouyGXMKH/edit and https://docs.google.com/document/d/1e2-rVF2wh-821tct76O50QdWwn4ZcIqS/edit) a. Review of proposed definitions and terminology: · Review EPDP Team input · Confirm common understanding of definitions / terminology b. Review of problem statement: * Review EPDP Team input * Confirm common understanding of problem statement / problems that are expected to be resolved c. Practical application of pseudonymisation · CPH Teams to share examples, if available, of how pseudonymisation is used in practice providing input on questions such as do the different registrars communicate at the time of registration and exchange this unique string along with other personal data of the registrant? Or is there a common database where all strings corresponding to each registration are listed? · Q & A by EPDP Team d. Confirm assignments for clarifying questions · Review input received · Confirm assignments e. Introduction of proposals for options to require unique contacts to have a uniform anonymized email address across domain name registrations that would not result in being treated as publication of personal data · Proponents to introduce proposal · Q & A by EPDP Team · Confirm next steps Legal vs. natural (see https://docs.google.com/document/d/1QlM4O_vwx7cQ11DJ_Lx2kqhyyRgDkMXG/edit#<https://docs.google.com/document/d/1QlM4O_vwx7cQ11DJ_Lx2kqhyyRgDkMXG/edit>) 1. Confirm assignments for clarifying questions · Review input received · Confirm assignments 1. Introduction of proposals for guidance that can be provided to Registrars and Registries who differentiate or want to differentiate between registrations of legal and natural persons (if time allows) · Proponents to introduce proposal · Q & A by EPDP Team · Confirm next steps 1. Confirm next steps * ICANN org webinar to address clarifying questions assigned to ICANN org scheduled for Tuesday 26 January at 14.00 UTC 4. Wrap and confirm next EPDP Team meeting (5 minutes): 1. Meeting #04 Thursday 28 January at 14.00 UTC. 2. Confirm action items 1. Confirm questions for ICANN Org, if any

2 1

REMINDER: Call for Legal Committee Volunteers - EPDP Phase 2A
by Caitlin Tubergen Jan. 19, 2021

Jan. 19, 2021

Dear EPDP Team, This is a friendly reminder for groups to reconfirm or appoint one member to the Phase 2A Legal Committee by COB tomorrow, Wednesday, 20 January. Thank you. Best regards, Marika, Berry, and Caitlin From: Caitlin Tubergen <caitlin.tubergen(a)icann.org> Date: Thursday, January 14, 2021 at 12:39 PM To: "gnso-epdp-team(a)icann.org" <gnso-epdp-team(a)icann.org> Subject: Call for Legal Committee Volunteers - EPDP Phase 2A Dear EPDP Team, As Keith noted during today’s meeting, the EPDP Phase 2A Team will have a Legal Committee, similar to Phase 1 and Phase 2. EPDP Team groups may reconfirm/appoint one member to the Legal Committee by Wednesday, 20 January. Those of you who participated in Phase 1 and 2 will remember we established a Legal Committee to review and revise proposed legal questions to ensure: (1) the questions are truly legal in nature, as opposed to policy or policy implementation questions; (2) the questions are phrased in a neutral manner, avoiding both presumed outcomes as well as constituency positioning; (3) the questions are both apposite and timely to the EPDP Team’s work; and (4) the budget for external legal counsel is being used responsibly. Based on feedback from the team, the membership is representative, i.e., each group may, but is not required to, appoint up to one representative. The appointed representative, where possible, should have legal expertise. Members of the Legal Committee are asked to provide advice based on their legal experience, factoring in all aspects of the conversation, not only that of their respective constituency. The Legal Committee will meet on an as-needed basis. The meetings will be open to anyone from the EPDP Team who would like to attend; however, only the appointed representatives will be invited to speak. Questions agreed to by the entire Legal Committee will be sent to outside counsel for review and forwarded to the EPDP Team as an FYI; please note this means if you have an interest in the Legal Committee’s work and/or have concerns with certain questions, please filter that feedback through your appointed representative. Thank you. Best regards, Marika, Berry, and Caitlin

1 0

Re: [Gnso-epdp-team] [Ext] RE: For your review - feasibility of requiring unique contacts terminology, problem statement and examples
by Marika Konings Jan. 19, 2021

Jan. 19, 2021

Thanks, Melina. Copying in the correct email address for the GNSO EPDP Team (please see message below). We’ll get your access to the google drive sorted shortly. Best regards, Caitlin, Berry and Marika From: STROUNGI Melina <Melina.STROUNGI(a)ec.europa.eu> Date: Tuesday, 19 January 2021 at 12:45 To: "gnso-epdp-team-bounces(a)icann.org" <gnso-epdp-team-bounces(a)icann.org>, Marika Konings <marika.konings(a)icann.org> Cc: NEMIGUENTCHEVA - GRAU Velimira <Velimira.GRAU(a)ec.europa.eu>, "LEWIS-EVANS, Christopher" <Christopher.Lewis-Evans(a)nca.gov.uk>, "Kapin, Laureen" <LKAPIN(a)ftc.gov> Subject: [Ext] RE: For your review - feasibility of requiring unique contacts terminology, problem statement and examples Dear Caitlin, Berry and Marika, Just to let you know that I do not appear to have access to the google docs below. I had requested access since yesterday but it doesn’t seem to have been authorized. In order to meet today’s deadline, please find some initial questions/comments from my side (copying also my GAC colleagues). If someone could insert them in the doc, where appropriate, it would be great. 1. On the B&B definition of pseudonymisation, currently defined as: “The same unique string is used for multiple registrations by a unique data subject.”--> By ‘multiple registrations’ we mean various registrations within the same registrar or within multiple registrars/registries? (Melina/GAC) Why do we need a different definition of pseudonymisation as compared to the one in GDPR? What is the added value of such definition? (Velimira/GAC) 1. According to the description of the specific exercise of Phase 2a, our goal/task is : “Addressing the feasibility of requiring unique contacts to have a uniform anonymized email address across domain name registrations at a given Registrar” Moreover, according to EPDP Team Recommendation #13: “The EPDP Team recommends that the Registrar MUST provide an email address or a web form to facilitate email communication with the relevant contact, but MUST NOT identify the contact email address or the contact itself”. -->Doesn’t this mean that the purpose of Phase 2a has been already defined and is limited to contactibility of the registrant? Or can we still consider including feasibility of correlation or registrations across multiple registrars? (Melina/GAC) 1. ENISA’s report on pseudonymisation techniques states that: ‘however, it is often not the choice of pseudonymisation technique utilised for one or two specific identifiers that causes the most problems; it is the implicit linkability among a set of pseudonyms and other data values that are joined into a more complex data structure’. The issue of linkability is precisely the point that we need to understand and this is precisely why an example of how pseudonymisation would work in the context of registries/registrars would be useful. We need to understand how this ‘unique string’ would be shared (if shared) across registries/registrars, if and to what extent they already exchange internally personal data and if such linkability would be possible from the side of third parties (if yes, how? By hacking/leaking the mapping table for example or also in any other way?). It is crucial for the purpose and success of the whole Phase 2a exercise to have a solid understanding on specific technical implementation details. To that end, specific case examples provided by the contracted parties would be very useful. Best, Melina From: Gnso-epdp-team <gnso-epdp-team-bounces(a)icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Marika Konings Sent: Friday, January 15, 2021 8:56 PM To: gnso-epdp-team(a)icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] For your review - feasibility of requiring unique contacts terminology, problem statement and examples Dear EPDP Team, Per the action items from Thursday’s meeting, the staff support team has tried to pull together terminology, problem statements and examples for your review and input here: https://docs.google.com/document/d/1weQemSQ0-884ILbhmR3OLzUWouyGXMKH/edit<https://urldefense.com/v3/__https:/docs.google.com/document/d/1weQemSQ0-884…>. Please provide your group’s input by Tuesday 19 January COB. Also take note of the other documents that have been posted for review as part of the action items coming out of Thursday’s meeting (see https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…<https://urldefense.com/v3/__https:/docs.google.com/spreadsheets/d/17qLMYb3H…>). Best regards, Caitlin, Berry and Marika

2 1

Meeting with ICANN staff on legal v. natural study
by Anderson, Marc Jan. 19, 2021

Jan. 19, 2021

Caitlin, Berry and Marika, I see from the workplan & action items document that support staff has sent a list of initial questions on the legal/natural study to ICANN org. "Support Staff to notify internal colleagues of submitted questions relating the ICANN org legal/natural study, and coordinate a time for a presentation on the study, during which submitted questions will be addressed." Could you share that list of questions with the working group so we are all on the same page heading into our call? Best, Marc

1 0

Contact Relays
by James M. Bladel Jan. 18, 2021

Jan. 18, 2021

Hi folks – On last Thursday’s call, we spent a chunk of time discussing the merits/efficacy of various Registrar implementations of the Contact Relay requirement. In my view, this is one of htose topics that our group can’t resist debating, and yet it is not within scope for our work in Phase 2A. Our calendar is extremely tight, and I would ask everyone (myself included) to try and avoid these “catnip” topics that burn a lot of call time, but ultimately don’t end up anywhere. Thanks— J.

4 4

For your review - feasibility of requiring unique contacts terminology, problem statement and examples
by Marika Konings Jan. 15, 2021

Jan. 15, 2021

Dear EPDP Team, Per the action items from Thursday’s meeting, the staff support team has tried to pull together terminology, problem statements and examples for your review and input here: https://docs.google.com/document/d/1weQemSQ0-884ILbhmR3OLzUWouyGXMKH/edit. Please provide your group’s input by Tuesday 19 January COB. Also take note of the other documents that have been posted for review as part of the action items coming out of Thursday’s meeting (see https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…) Best regards, Caitlin, Berry and Marika

1 0

Meeting Invitation | Observers | ICANN Org Presentation on Legal v. Natural Study | Tuesday, 26 January 2021 at 14:00 UTC
by Terri Agnew Jan. 14, 2021

Jan. 14, 2021

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, zoom webinar room will be made available for the EPDP plenary meetings. As a reminder, the zoom recording, audio recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The ICANN Org Presentation on Legal v. Natural Study is scheduled on Tuesday, 26 January 2021 at 14:00 UTC for 90 minutes. Zoom room information: Main Zoom Webinar link: https://icann.zoom.us/j/96946470581?pwd=VWRXQnA4aG80bys1OHVyd25kRTNDZz09 Passcode: hBYhfat%C7 Going forward, observers will now join via zoom webinar. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Before joining the call: Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only Please be sure you have read the ICANN Expected Standards of Behavior [icann.org]<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> Visit the Wiki agenda page: https://community.icann.org/x/IwdACQ Check your time zone: https://tinyurl.com/yyrjenmq The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar/2021 [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> If you are joining via audio only: One tap mobile: US: +13017158592,,96946470581#,,,,*5645740310# or +13126266799,,96946470581#,,,,*5645740310# Webinar ID: 969 4647 0581 Passcode: 5645740310 International numbers available: https://icann.zoom.us/u/accaKofAKQ [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/accaKofAKQ__;!!PtGJab4!t…> Thank you. Kind regards, Terri

1 0

Call for Legal Committee Volunteers - EPDP Phase 2A
by Caitlin Tubergen Jan. 14, 2021

Jan. 14, 2021

Dear EPDP Team, As Keith noted during today’s meeting, the EPDP Phase 2A Team will have a Legal Committee, similar to Phase 1 and Phase 2. EPDP Team groups may reconfirm/appoint one member to the Legal Committee by Wednesday, 20 January. Those of you who participated in Phase 1 and 2 will remember we established a Legal Committee to review and revise proposed legal questions to ensure: (1) the questions are truly legal in nature, as opposed to policy or policy implementation questions; (2) the questions are phrased in a neutral manner, avoiding both presumed outcomes as well as constituency positioning; (3) the questions are both apposite and timely to the EPDP Team’s work; and (4) the budget for external legal counsel is being used responsibly. Based on feedback from the team, the membership is representative, i.e., each group may, but is not required to, appoint up to one representative. The appointed representative, where possible, should have legal expertise. Members of the Legal Committee are asked to provide advice based on their legal experience, factoring in all aspects of the conversation, not only that of their respective constituency. The Legal Committee will meet on an as-needed basis. The meetings will be open to anyone from the EPDP Team who would like to attend; however, only the appointed representatives will be invited to speak. Questions agreed to by the entire Legal Committee will be sent to outside counsel for review and forwarded to the EPDP Team as an FYI; please note this means if you have an interest in the Legal Committee’s work and/or have concerns with certain questions, please filter that feedback through your appointed representative. Thank you. Best regards, Marika, Berry, and Caitlin

1 0

Notes and action items - EPDP Phase 2A Meeting #02 - 14 Jan 2021
by Caitlin Tubergen Jan. 14, 2021

Jan. 14, 2021

Dear EPDP Team, Please find below the notes and a link to the action items from today’s meeting. Our next meeting will be Thursday, 21 January at 1400 UTC. Best regards, Marika, Berry, and Caitlin Action Items ❗️Please refer to the Google Sheet<https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8Ad…> for Action Items. We will review the action items at the beginning of each call.❗️ Notes EPDP Phase 2A - Meeting #02 Agenda Thursday 14 January 2021 at 14.00 UTC 1. Roll Call & SOI Updates 2. Welcome & Chair updates (Chair) * Thank you to everyone who contributed to the homework assignments. a. Vice-Chair Selection & Council Liaison selection update The charter foresees that “The EPDP Team, once formed, will select one or two Vice Chairs to assist the Chair. Should at any point a Vice-Chair need to step into the role of Chair, the same expectations with regards to fulfilling the role of chair as outlined in this charter will apply”. * At this time, a GNSO Council liaison has not yet been appointed; however, expect to have news re: the liaison following the next Council meeting. * Received an inquiry from Brian Beckham of WIPO to perform vice-chair duties for Phase 2A. * In reading the charter, it could be interpreted that only EPDP members can serve as vice-chair. In the event the EPDP Team agrees in an appointment of Brian, it may need to be confirmed by the GNSO Council. * Support Staff had a close look of the charter, and it notes once the EPDP Team has formed, the vice-chair is selected – the table in the charter shows a specific count, which includes the chair of the EPDP Team, but no separate count for the vice-chair. Accordingly, that may mean that the vice-chair is expected to come from the EPDP Team. As no volunteers have come forward from the EPDP Team, an appointment of a non-team member may need to be approved by the Council. EPDP Team Feedback: * No opposition provided. Next step will be to communicate to the Council. * Generally speaking, the vice-chair should be a neutral party throughout. 3. Review of Homework Assignments Feasibility of unique contacts (see compilation document attached) a. Review clarifying questions and determine whether these are referred to: Today’s plan is to run through the questions and allow those who put forward the question or concern to explain the contribution at a high-level and focus on how this should be addressed. For example, should the clarifying question be discussed and/or reviewed by: * EPDP Team * Legal committee (if to be referred to legal counsel) * Other b. Review proposals and consider · Clarifying questions · Definitions re: pseudonymization were added by Support Staff, and are pulled directly from the B&B memo (definitions in the legal questions were agreed to by the legal committee) · How should questions about definitions be raised? * This question could potentially be addressed by B&B or experts within the group who have an IT background. The Team may be missing information on how a unique string would work. * Who decides whether pseudonymization is across all registrars or within one registration? This is a decision for the EPDP Team. These terms should be used as they are defined in GDPR. * The point of clarifying question was that certain people did not understand the definitions. The distinction b/w pseudonymization and anonymization is quite clear. Anonymization is unique for each registration, while pseudonymization is unique by registrant. ALAC raised a potentially interesting point about pseudonymization across registrars; that is a technical question for ICANN. These concepts are clear, and our job is to decide which (if any) is allowable. * The Team should take a step back even before discussing these definitions – what are we trying to use these definitions to do? What problem are we trying to solve? This should be determined first. * Agree that the approach to a solution would be better if we know what the problem is. It is not a huge effort for registrars to create a pseudonymized identifier for their customers; however, sharing that identifier with multiple registries and registrars and tracking it over time starts to look less and less like an anonymous or pseudonymous bit of data and looks more like a tracking cookie. Where the team should draw the line is what is allowable under the law, and what problem we are trying to solve. * Processing personal data is not inherently illegal; it depends who is doing it and what they are doing it for. The question is what happens when a pseudonym is shared outside of a contracted party; it is not inherently unlawful. * May need more homework for next meeting with purpose or intent or what we are trying to solve for. * The Team is trying to work toward contactability. The web forms have character limits which are untenable, particularly for noting IP infringement issues. Some web forms do not have free form options. The webforms are unacceptable; we need something more workable. * Correlation is very important for cybersecurity purposes. There are often times when one needs to identify additional domain names associated with a contact, particularly in cybersecurity-related issues like phishing attacks. * The B&B memo concentrated on the effect on the data subject; it didn’t focus on other purposes where pseudonymization this may be lawful. * The Team already has a memo that notes that anonymized and pseudonymized data can be personal data. Circling back to that because some members do not want to accept the previous legal advice is not a good use of time. The legalities of whether a unique identifier can be published – that is a non-starter. * What we are trying to do here is to make sure everyone is clear on the terminology and what solution we are working towards. * The Team does not seem to agree what the memo said: in the hands of a contracted party, this data is personal. In the hands of a third party, the data might be personal data. * Something that is pseudonymous for CPs could be anonymous for a third party. With respect to the B&B memo – the memo is not crystal clear in certain aspects. B&B touches on a DPIA. * Distinction b/w anonymized and pseudonymized in GDPR is clear. However, the definitions in the memo are not clear. What is not really explained – for pseudonymization, could third parties somehow combine this information or have access to these strings and trace back to the individual? * There is already a requirement for registrars to provide * Action: Staff to put together a google doc where everyone can provide further input in advance of the next call. * Laureen’s question re: data retention may be a question for the legal committee to further review. * In one part of the legal memo, there is a reference to masking. Alan and Hadia asked what the relevance of introducing this concept is, when this was not put forward in the legal committee’s question. * It may be helpful to put forward a short side paper on pseudonymization vs. anonymization. * Who should address the question of masking? * Answer: B&B via legal committee * Caution against spending or wasting time with detailed explorations of how pseudonymization works in practice b/c pseudonymization is a form of personal identification. * When we create a new pseudonymized email, that is a new data element for contracted parties to both create and process * This is a tier 2 question – this is about how to implement rather than if we should implement in the first place * Question for registrars re: changing anonymized email addresses over time * There should be a proposal for disclosure of pseudonymized or anonymized emails · Next steps for considering these proposals further Legal vs. natural (see compilation document attached) c. Review clarifying questions and determine whether these are referred to: * EPDP Team * Legal committee (if to be referred to legal counsel) * ICANN org * Other d. Review proposals and consider · Clarifying questions * The first question is a legal question. * Second question: there is already a review process as a part of the SSAD * The NIS2 directive is a proposal and there is nothing in it that makes it mandatory to differentiate b/w legal and natural persons * For questions to ICANN org: do any members of the Team wish to clarify their questions? If not, ICANN org will take these questions into account when providing an update on the study. * Questions re: legal memos can be reviewed by the legal committee. · Next steps for considering these proposals further 4. Wrap and confirm next EPDP Team meeting (5 minutes): - Action: In parallel tracks, ask Brian Beckham for time or give an EOI the group to review and consider. Concurrently, notify the Council and confirm this is OK. -Action: EPDP Team to respond to Legal Committee appointment notice by Wednesday, 20 January. a. Meeting #03 Thursday 21 January at 14.00 UTC. b. Confirm action items c. Confirm questions for ICANN Org, if any

1 0