Dear All, Please find below the notes and action items from today’s EPDP Team meeting. Best regards, Caitlin, Berry and Marika EPDP Team Meeting #18 Tuesday, 9 October 2018 Notes and Action Items High-level Notes/Actions: Action item #1: Volunteers needed to specify what types of 'rights' are included in purpose A and what does that mean for data elements that need to be transferred to registries. Volunteers that came forward during the call: Kristina Rosette, Emily Taylor, Milton Mueller, Mark Svancarek, Chris Lewis-Evans. Action item #2: Staff to circulate data elements workbook overview of outstanding issues and leads (see attached) Action item #3: Staff to reach out to possible leads for those purposes for which there was no lead confirmed during the call. Action item #4: Leads to publish latest version of respective data elements workbook to EPDP Team mailing list by Monday 15 October at the latest. Questions for ICANN Org from the EPDP Team: None Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates (5 minutes) * Attendance will be taken from Adobe Connect * Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) a) Additional travel support for ICANN63 * The Team members receiving travel support are: Thomas Rickert, Alan Woods, Milton M., Amr E., and Kavouss A. b) Request for independent legal counsel to assist the EPDP * The Leadership Team is requesting more detail including details re: statement of work. * There will be call to discuss this further Wednesday, 10 October at 22:00UTC. * Please note there are budget limitations to the request as well as approval process via the PCST. More details provided tomorrow. c) Lawful basis memo – any other input that should be recorded in the latest version? * Members should read through the updated memo that was circulated to the mailing list yesterday and note where they would like their SG/C/AC added to denote disagreement with the lawful basis identified. d) ICANN63 High Interest Topic Session Planning * The Leadership Team will pass along the draft agenda for the HIT shortly. All groups encouraged to nominate a member to present on the panel. * Presenters are representing the EPDP Team as a whole, not their respective group. e) Review of outstanding action items * Registrars and Registries have outstanding action items that are needed in advance of Thursday's meeting, specifically - Purpose B Workbook. * See https://community.icann.org/x/NwSNBQ for other outstanding items f) Other updates, if applicable 3. Review outstanding questions in relation to charter question c) Transfer of data from Registrar to Registry (blue signifies has not been discussed yet): c1) What data should registrars be required to transfer to the registry? c2) What data is required to fulfill the purpose of a registry registering and resolving a domain name? c3) What data is transferred to the registry because it is necessary to deliver the service of fulfilling a domain registration versus other legitimate purposes as outlined in part (a) above? c4) Is there a legal reason why registrars should not be required to transfer data to the registries, in accordance with previous consensus policy on this point? c5) Should registries have the option to require contact data or not? c6) Is there a valid purpose for the registrant contact data to be transferred to the registry, or should it continue to reside at the registrar? (note: the two items in cursive are the primary focus of today’s discussion, but the others are related and should be used to provide context to the transfer topic as necessary) Objective of discussion: (1) Review outstanding charter questions and review data elements workbook for purpose A with focus on what data elements need to be transferred from registrar to registry (2) Agree on data elements needed to be transferred as well as responses to outstanding charter questions a. Review data elements workbook for Purpose A b. Deliberate on outstanding questions c. Agree on proposed response to charter questions * See documentation circulated by Berry to the mailing list * Issue of transfer and what data needs to get transferred - build this up from the ground up and group's work to data, instead of focusing immediately on existing practices and requirements. * Some issues may come up that are not directly related to transfers. * Purpose A, M and N have all listed processing activities around the transfer of data. * See also latest version of lawful basis memo - tool by which the EPDP Team can identify the lawful basis for each of the processing activities for each purpose. See additional processing activities identified for purpose A. Need to undertake inventory for each processing activity with regards to data elements needed / used. * See data elements matrix - focused on what data elements need to be collected. Second version could be a summary matrix of data elements that are transferred, and possibly a third one further down the line that would focus on data elements for access. * Collect or not column - one data element marked as required for collection will show up here in green, optional elements are yellow, any data element not identified is red. Starter draft of where we are at today - will need to be updated as data elements workbooks get updated. * See Purpose A data elements workbook - redline version. See new section re. lawfulness of processing test. See also new column "fields to be transferred". * Is lawful basis distinction for transfer of data necessary or not? If yes, need to consider data elements for each lawful basis. * Should a small group be tasked to come up with the list of fields to be transferred? * What needs to be transferred from registrar to registry to ensure a working domain name registration? * What is difference between transfer and disclosure? May be helpful to define these so that difference is clear. Talking here about transfer in the context of establishing the rights of the RNH - what data must be transferred in order to ensure this. Not the traditional use of disclosure, but what data is necessary to make the domain name registration operational and properly allocated. * In a data ecosystem, it is necessary to map the various processors. The registry is a processor, and disclosure to them is necessary, in order for the primary purpose of data collection, namely to make the name resolve properly and function. Is it required to register or administer a domain name or to protect the DNS? If so, then possibly. * Is purpose A about allocation of a string to a registrant? If so, what data is needed? Is this broader than just allocating the string? May be taking a too narrow view if focus is solely on allocation of string. Need to be in agreement on what the purpose means to be able to fill out this worksheet. Maybe start with allocation of string as a starting point? Other aspects may already be covered as part of other purposes? * As soon as data gets transferred from registrar to registry, liability comes into play as well as jurisdictional issues. * May need to consider rationale of Thick WHOIS PDP WG, but need to appreciate that this work was undertaken several years ago (pre-GDPR). * Make this registrant centric - it is not about what the registry may want. If this is not the place for registrant rights, it would need to be incorporated somewhere else. * Purpose is specific that it relates to the rights in a registered name, not about the whole eco-system. * Agreement that this is registrant centric, that it relates to the registrant to exercise its rights, disagreement to how far these rights extend into the eco-system. * Let's stick for now on narrowly focused purpose of rights of the RNH in a registered name. If we're looking at the minimum data required to make a domain name actually work, it would only be domain name and nameservers, no personal data is required to be transferred. Going beyond that, you may need to rely on different aspects of the GDPR. Are there any other data elements that are needed, for example updated, created and expiration data? Registries to opine on this. These data elements are not created by or collected from registrar or registrant but these are artefacts of registering or updating a string, created at the registry level. * ICANN has developed a registrant rights document - maybe that could serve as a starting point to fully understand registrant rights in the context of a domain name registration? * Need to look at each right to identify what data elements are needed? For example, to be able to attach a domain name registration, you need to identify the registrant, but you would need to ask who needs to identify the registrant and for which purpose? It may only be the registrar who needs to do this, not the others in the chain (ICANN, registries). * Activation in the DNS and allocation to the registrant are two must fundamental activities. In order to activate in the DNS, you need the name servers. Name servers is currently an optional data element but required to be supported. If a registrant only wants to register a domain name but not have it resolve, it does not need to indicate name servers. * May need to clarify the language around registrant rights? Consider using registrant benefits and responsibilities? Action item #1: Volunteers needed to specify what types of 'rights' are included in purpose A and what does that mean for data elements that need to be transferred to registries. Volunteers that came forward during the call: Kristina Rosette, Emily Taylor, Milton Mueller, Mark Svancarek, Chris Lewis-Evans. 4. Update on status of remaining data elements workbooks & open items Objective of discussion: (1) Confirm status of data elements workbooks (2) Identify volunteers to address any open items a. Review status of remaining data elements workbooks & open items b. Identify volunteers to address any open items & confirm timeline * Staff pulled together this list that aims to provide an overview of the different data elements workbooks and outstanding issues / questions. Objective is to identify a lead for each data elements workbook who would take ‘ownership’ of the data elements workbook with the objective to get it into a near final state by next Monday 15 October to allow for review by the EPDP Team prior to commencing travel to ICANN63. This near final state should include any updates as a result of recent EPDP Team deliberations and/or input that has been received from ICANN Org, as well as identifying any outstanding items that require further EPDP Team consideration. * The data elements workbooks are an essential element for the Initial Report as such it is of key importance that these are carefully reviewed, and any outstanding items are identified so that these can be discussed and resolved either prior or during ICANN63. Action item #2: Staff to circulate data elements workbook overview of outstanding issues and leads (see attached) Action item #3: Staff to reach out to possible leads for those purposes for which there was no lead confirmed during the call. Action item #4: Leads to publish latest version of respective data elements workbook to EPDP Team mailing list by Monday 15 October at the latest. 5. Wrap and confirm next meeting to be scheduled for Thursday 11 October at 13.00 UTC. a. Confirm action items b. Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_...> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...>.