Regarding redaction/deletion, I think I prefer redaction. I defer to James whether redaction is technically more annoying than deletion. From: Trang Nguyen <trang.nguyen@icann.org> Sent: Tuesday, January 22, 2019 3:14 PM To: Mark Svancarek (CELA) <marksv@microsoft.com>; James M. Bladel <jbladel@godaddy.com>; Marika Konings <marika.konings@icann.org>; Sarah Wyld <swyld@tucows.com>; gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] For your review - Proposed language for agreements reached in principle Dear All, Regarding the organization field, ICANN org flagged the following in the AC chat during the Toronto face-to-face meeting last week. We wanted to flag this again for your consideration/discussion as you work to finalize the recommendation: Some registrants use the organization field to identify themselves, an example of this is ICANN where the registrant name is “Domain Administrator” and organization is “ICANN” (https://www.godaddy.com/whois/results.aspx?domain=icann.org"<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.godaddy.com%2Fwhois%2Fresults.aspx%3Fdomain%3Dicann.org%26quot&data=02%7C01%7Cmarksv%40microsoft.com%7C7f80a975b8704a08df0908d680bf4f6b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636837956558277522&sdata=8WCEHSxjgk01VaaLbsJMsFATDheFSk0XgZ%2F6KLPy5x8%3D&reserved=0>;). Under 3(c) in James’s email below, if registrants do not respond the organization field would be deleted. This could result in a number of registrations where identifying information for registrants would no longer be available. It’s unclear if deletion is needed or whether redaction of the information would achieve the intent of the recommendation? Regarding the Natural vs. Legal recommendation, the proposed text of the recommendation says: “…without requiring Registrars to differentiate between registrations of legal and natural persons, although registrars are permitted to make this distinction.” Is the intent of the recommendation to limit the requirement to registrars only, or should the text include registries as well? Best, Dan and Trang ICANN Org Liaisons From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of "Mark Svancarek (CELA) via Gnso-epdp-team" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Reply-To: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>> Date: Tuesday, January 22, 2019 at 8:32 AM To: "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>, Sarah Wyld <swyld@tucows.com<mailto:swyld@tucows.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] For your review - Proposed language for agreements reached in principle Makes sense, thanks for clarifying. From: James M. Bladel <jbladel@godaddy.com<mailto:jbladel@godaddy.com>> Sent: Tuesday, January 22, 2019 8:08 AM To: Mark Svancarek (CELA) <marksv@microsoft.com<mailto:marksv@microsoft.com>>; Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>; Sarah Wyld <swyld@tucows.com<mailto:swyld@tucows.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] For your review - Proposed language for agreements reached in principle I think we need to standardize on what the “Registrant Org” field is telling us. Some registrars use this field to indicate that the Organization is the registrant, so if the end user deletes this information, it has the effect of re-assigning the name to natural person listed as the Registrant. J. From: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>> Date: Tuesday, January 22, 2019 at 8:05 AM To: "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>, Sarah Wyld <swyld@tucows.com<mailto:swyld@tucows.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: RE: [Gnso-epdp-team] For your review - Proposed language for agreements reached in principle I think I agree: can you clarify what this means? * Registration is re-assigned to Registrant (natural person) From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Tuesday, January 22, 2019 6:30 AM To: Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>; Sarah Wyld <swyld@tucows.com<mailto:swyld@tucows.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] For your review - Proposed language for agreements reached in principle Hi Folks – Let’s try to untangle this with the aim on simplicity & minimizing confusion (epdp and registrants). Here are my recollections from Toronto: Between the adoption of ePDP and some future date (Jan 1 2020?) 1. Redact Registrant ORG field. 2. Registrars contact Registrants who have data in this field, and ask them to confirm the data is correct & accurate. 3. Based upon Registrant Action – * Registrant Confirms or Corrects – Data remains n Org field. * Registrant Declines – Data in Org field is DELETED, Registration is re-assigned to Registrant (natural person) * Registrant No Response – Data in Org field is DELETED, Registration is re-assigned to Registrant (natural person) After future date – 1. New registrations would present some disclosure/disclaimer when data is entered in the ORG field * Registrars are free to innovate on the exact process, either an opt-in, or pop-up or locked/grayed out field, etc. 2. ORG will be treated as the legal-person registrant of the domain name, with the Natural Person listed as a point of contact. 3. ORG field will be published, if it contains data. From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> Date: Tuesday, January 22, 2019 at 6:02 AM To: Sarah Wyld <swyld@tucows.com<mailto:swyld@tucows.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] For your review - Proposed language for agreements reached in principle Thanks, Sarah, for flagging this. We actually went back and forth on this looking at the transcript and our understanding was that opt-in was for existing registrations, while opt-out would apply to any new registrations (with the appropriate information being provided to the registrant that the information for the Organization field would be published, unless indicated differently). However, as this was James’s proposal, we would like to ask him to confirm what the original proposal was so that the recommendation can be adjusted, as needed. James, over to you. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Sarah Wyld <swyld@tucows.com<mailto:swyld@tucows.com>> Organization: Tucows Date: Tuesday, January 22, 2019 at 05:36 To: "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] For your review - Proposed language for agreements reached in principle Good morning, I notice a significant difference between the Toronto Day 3 notes and the draft below, regarding the Organization field. Day 3 notes - "Principles for Redaction of Registrant Organization Field" #4: 4. Upon (1) the registration of a Registered Name sponsored by Registrar or (2) the transfer of the sponsorship of a Registered Name to Registrar, the Registrar MUST inform all Registered Name Holders that the Registrant Org field will be redacted unless the Registered Name Holder affirmatively opts in to the publication of the Registrant Org field. Updated Recommendation #9 below: 4. Upon (1) the registration of a Registered Name sponsored by Registrar or (2) the transfer of the sponsorship of a Registered Name to Registrar, the Registrar MUST inform the Registered Name Holder that the Registrant Org field will be published unless the Registered Name Holder affirmatively opts in to redaction of the Registrant Org field. The Org field should be redacted by default, and the Registered Name Holder should be able to opt-in to publication. This aligns with the principle of Privacy by Default and is what we agreed on during the Day 3 meeting. Thanks, -- Sarah Wyld Tucows +1.416 535 0123 Ext. 1392 On 1/22/2019 12:33 AM, Marika Konings wrote: Dear EPDP Team, In Toronto, we reached agreement in principle on several issues but did not have time to develop language to which the team agreed. To move that discussion forward, the support team has developed the proposed language below for discussion and inclusion in the Final Report. Please review this language with your group to ensure it aligns with the agreement that was reached. If you are of the view that it does not conform to the agreement, please: 1. Respond to this message and change the subject line to the topic of the recommendation about which you have concerns; 2. Outline your concerns, focusing on how the proposed language does not reflect the principle agreement reached, and; 3. Propose edits that would address your concerns that are in line with the agreement reached. The deadline for doing so is Thursday 25 January so that there is sufficient time to review and discuss any concerns. If no concerns are raised, this language will be incorporated into the draft Final Report for your review. Best regards, Caitlin, Berry and Marika ========= Based on the discussions during the F2F meeting in Toronto, the following updated language is provided for EPDP Team review on the following topics / recommendations: 1. Natural vs. legal Draft recommendation 1) The EPDP Team recommends that the policy recommendations in this Final Report apply to all gTLD registrations, without requiring Registrars to differentiate between registrations of legal and natural persons, although registrars are permitted to make this distinction. 2) The EPDP Team recommends that as soon as possible ICANN Org undertakes a study, for which the terms of reference are developed in consultation with the community, that considers: * The feasibility and costs of distinguishing between legal and natural persons; * Taking into account examples of industries or other organizations where this has been successfully done; * Consider privacy risks to registrants, and; * Consider the risks of not differentiating. 3) Depending on the timing of the research, whether to inform the scope or make use of its findings, the EPDP team will discuss the Legal vs Natural issue in Phase 2. 1. Consent to publish additional contact information Agreement in principle: In its discussion on consent, the Temporary Specification omitted RNH email as a piece of information to which the registrant could consent to publication. This draft recommendation corrects that omission. Draft recommendation The EPDP Team recommends that, as soon as commercially reasonable, Registrar must provide the opportunity for the Registered Name Holder to provide its Consent to publish additional contact information. 1. Organization Field Agreement in principle: Rather than requiring the publication or redaction of the Organization Field, a phased approach was suggested by Team Members that gained general agreement. Updated Recommendation #9 1. The EPDP Team recommends that Registrars MAY begin redacting the Registrant Org field immediately. 2. For existing registrants: the EPDP Team recommends that Registrars MUST notify all existing Registered Name Holders that the Registrant Org field will be treated as non-personal data for new registrants beginning on [x date - to be agreed upon during the implementation of this Policy], and accordingly, the field will be published for new registrants in the freely-accessible directory beginning on [x date]. However, if existing Registered Name Holders wish to have its Organization field published within the freely-accessible database, it must affirmatively consent to the publication by opting in. If the Registered Name Holder affirmatively opts in to the publication of its existing (or modified) Registrant Organization, the Registrar may publish the Registrant Organization Field immediately and/or on the agreed-upon [x] date. 3. The EPDP Team recommends if the existing Registered Name Holder does not affirmatively opt in to the publication of its Registrant Organization field, the Registrar will show the existing Registrant Organization Field but the field MAY be left blank. 4. Upon (1) the registration of a Registered Name sponsored by Registrar or (2) the transfer of the sponsorship of a Registered Name to Registrar, the Registrar MUST inform the Registered Name Holder that the Registrant Org field will be published unless the Registered Name Holder affirmatively opts in to redaction of the Registrant Org field. 1. Deferring consideration of new proposed purposes to phase 2 Agreement in principle: With regards to proposed Purpose O, the Purpose supporting ARS, and the additional purposes received through public comment, the EPDP Team understands some legal clarification is required as to whether those purposes can fall under existing Purposes. Additional complexities were introduced. Therefore, the Team decided to put off this discussion for Phase 2 where the EPDP Charter makes it clear that additional Purposes are, in fact, anticipated. Draft recommendation The EPDP Team commits to considering in Phase 2 of its work whether additional purposes should be considered to facilitate research carried out by ICANN’s Office of the Chief Technology Officer (OCTO) as well as the continuation of the WHOIS Accuracy Reporting System (ARS). This consideration should be informed by legal guidance on if/how provisions in the GDPR concerning research apply to ICANN Org. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses [nam06.safelinks.protection.outlook.com]<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense...> and visiting the GNSO Newcomer pages [nam06.safelinks.protection.outlook.com]<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense...>. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team [nam06.safelinks.protection.outlook.com]<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense...>