Hi Everyone: There were several items (Recommendations) that we agreed to discuss via email with the idea that we could close on them without taking time for discussion in a meeting. This email concerns Recommendation 7, addressing data disclosures to ICANN Contractual Compliance. The current recommendation states (1) The EPDP Team recommends that updates are made to the contractual requirements for registries and registrars to transfer to ICANN Compliance the domain name registration data that they process when required/requested, consistent with the data elements workbook that analyzes the purpose to handle contractual compliance monitoring requests, audits, and complaints submitted by Registry Operators, Registrars, Registered Name Holders, and other Internet users (see Annex D, Workbook 5). (2) The data elements workbook that analyzes the purpose to handle contractual compliance monitoring requests, audits, and complaints submitted by Registry Operators, Registrars, Registered Name Holders, and other Internet users contains the specifically-identified data elements the EPDP Team recommends be transferred from registries and registrars to ICANN Compliance (see Annex D, Workbook 5). Small Team Discussion (1) The small team indicated that the Workbooks should not be incorporated by reference into the Recommendation as the Workbooks provided justification or background for the Recommendation but were not Policy statements themselves. (2) The small team expressed the concern that the Recommendation, as written, did not comply with the principle of minimization in that the Recommendation as they could be interpreted to mean that the complete data set could be requested for each ICANN Compliance inquiry, whether necessary for that particular inquiry, or not. Proposed updated language recommendation 7 – ICANN Compliance (1) The EPDP Team recommends that updates are made to the contractual requirements concerning the registration data elements for registries and registrars to transfer to ICANN Compliance the domain name registration data that they process when required/requested, consistent with the data elements listed below. [Bolded language added.] (2) The analysis in Annex D describes the data elements and data flow for the purpose for processing data in accordance with ICANN Contractual Compliance monitoring requests, audits, and complaints submitted by Registry Operators, Registrars, Registered Name Holders, and other Internet users. Based on that analysis and EPDP discussion, the EPDP Team recommends that the following data elements be transferred from registries and registrars to ICANN Compliance.* *To clarify, the data elements listed here are the aggregate of data elements that ICANN Compliance may request. For each request, the data elements requested must be narrowly tailored to meet the needs of the request. (E.g., as noted in the Summary of ICANN Organization’s Contractual Compliance Team Data Processing Activities <https://community.icann.org/download/attachments/90774122/Summary-Contractua...>, in validating a complaint, “the Contractual Compliance Team will only request the redacted/masked data elements that are needed to validate the issue(s) outlined in the complaint.”) Action: Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. If there are additional questions for ICANN Compliance that would serve toinform the deliberations on this recommendation, please share these also. Deadline: Friday, 25 January, additional email discussion might follow depending on responses. Thx & best regards, Kurt