Dear All, Below, please find the Purpose A Small Team’s tentative agreement regarding an updated description of Purpose A: Proposed Update to Purpose A: “Establish the rights of a Registered Name Holder in a Registered Name and ensuring that the Registered Name Holder may exercise its rights in respect of the Registered Name. Specifically, subject to applicable terms and conditions posted by the registrar, including applicable policies from the registrar, registry, and ICANN, a Registered Name Holder has the following rights with respect to its domain name(s): The right to exclusive use, and to benefit from use; The right to transfer (i.e., the right to sell, gift, sub delegate to others; The right to renew and restore; The right to transfer the name(s) to the registrar of its choice from among registrars authorized to sell domain names in the gTLD of interest; The right to choose its registrar from among registrars authorized to sell domain names in the gTLD of interest.” In answering the question, “[w]hich data elements must be transferred from a registrar to a registry in order for a registrant to exercise each specific right?”, the small team noted the following: With respect to all above-referenced rights, Name Server and Domain Name must be transferred from a registrar to a registry, and is lawful under Art. 6(1)(b) of the GDPR. The registry processes (collection, storage and use) the same registration data under Art. 6(1)(f), and a transfer of the registration data from registrar to registry, where the registry operates a “thick whois,” is lawful under Art. 6(1)(f) of the GDPR. (Note: some members of the small team requested additional information over the precise definition on registration data in this context if it differs from Name Server and Domain Name.) Full registrant data CAN be requested by the Ry based Art. 6(1)(f); Processing for the purpose of administering the application of a Registry Acceptable Use Policy (AUP) (or equivalent); such processing is considered justifiable under the Art. 6(1)(f) balancing test when considering the nature of the data, the envisaged limited use of the data, and the likelihood of the impact on the privacy rights of the Registered Name Holder when weighed against the safety and integrity of the zone. Eligibility requirements, where validated by the Ry can be a reason for Rr Ry transfer based on Art. 6(1)(b). There are cases where the Ry actually does the validation or lets it do by third party at the Rr level, but that would then still be a Ry responsibility. Where Validation is done by the Rr only and commissioned by the Rr, no data transfer based on 6(I)(b). Thank you again to the small team for all of your hard work! Best regards, Marika, Berry and Caitlin