Subject: Re: [Gnso-epdp-team] On the proposed guidance
From: STROUNGI Melina via Gnso-epdp-team <[email-masked]>
To: Volker Greimann <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Date: Tue, 20 Apr 2021 09:47:34 +0000
List-Id: <gnso-epdp-team.icann.org>

Dear Volker,

Thank you for your comments.

Let me come back to your previous email of 15 April (attached) and your email below, in order to hopefully address some of your concerns.

Regarding your argument that ‘the interpretation of the book is only valid if the text actually supports that interpretation’,  this is precisely the case with NIS 2 text. The legislator’s intention behind ‘publication’ is explained in recital 62 of NIS 2 Proposal<https://urldefense.proofpoint.com/v2/url?u=https-3A__digital-2Dstrategy.ec.europa.eu_en_library_proposal-2Ddirective-2Dmeasures-2Dhigh-2Dcommon-2Dlevel-2Dcybersecurity-2Dacross-2Dunion&d=DwMGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=5plLPPsklikF7mOlKrn7C1V5ZxN1jjPWmn1nqmNrhkg&e=>, which explicitly clarifies that “TLD registries and the entities providing domain name registration services for them should make publically available domain name registration data that fall outside the scope of Union data protection rules, such as data that concern legal persons.”

Given the above context, the word ‘publication’ is doubtful to have any other interpretation than the obvious one: ‘publication’ means ‘making publically available’. Publically = to the public.

I understand your wish to do otherwise, but just to bear in mind that such wish is not enough to override the actual wording of the text.

We are doing our best to address everyone’s individual concerns (including yours and lots of your comments and suggestions have already been taken into account), but at the same time we need to ensure that contracted parties who wish to differentiate between legal and natural entities and wish to align their practices with the NIS2 proposal are able to do so. We hope that, even if you do not completely find the provisions to your liking, you are willing to facilitate this group’s hard efforts to make some progress before the May deadline.

To come back to your other point, (i.e., that you are not convinced that the availability of non-personal WHOIS data would contribute to the security, stability and resilience of the DNS), I  trust you are not implying that so many people from all over the world are intensively working on a problem which would be non-existent.

This is what the current situation looks like:

Currently the vast majority of registration data are not available and the majority of requests from different organisations to access such data remain unanswered.

According to a study published in January 2021 by InterIsle Consulting Group, at present, only 13.5% of domains have an actual registrant identified in WHOIS. Registrars and registry operators have used ICANN’s post-GDPR policy to redact contact data from 57.3% of all domains. Adding proxy-protected domains, this means that 86.5% of registrants cannot be identified via WHOIS. According to statistics from Appdetex, during the period January 1, 2020, through September 1, 2020, only 24.6% of 2,933 requests submitted to 158 ICANN-accredited registrars resulted in responses that included registrant data. These statistics are also consistent with the estimate of the PSWG within ICANN that roughly 70% of requests are being denied or ignored.

Even European government agency and law enforcement requests for redacted WHOIS data have been denied. As described in a May 2020 letter from the ICANN President to the European Data Protection Board, requests that have been made by European Data Protection Authorities for access to redacted, nonpublic WHOIS data to assist in their investigations of potential privacy violations have been denied by domain name registrars and registries.

I will not list all complaints and problems reported, but just as an illustration, complaints from law enforcement authorities have been brought to our attention, where WHOIS data would have been critical to help combat online sexual child abuse cases. According to the complainants, the availability of more WHOIS data in public could help to find perpetrators on the internet.

The publication of domain name registration data concerning legal entities is expected to substantially increase the wealth of information available to the public.

According to a study published in 2021 by InterIsle Consulting Group, the data suggests that only around 11.5% of domains may belong to natural persons who are protected by GDPR. This 11.5% may be the percentage of domains that is necessary to protect under GDPR. In contrast, registrars and registry operators have redacted contact data from 57.3% of all domains, or five times the amount that may be necessary.

I trust that the above give a flavour of the actual situation and problems.

It would be beneficial if you could explain why non-personal data of legal persons have been redacted and why you object to the effort of having greater transparency while fully respecting privacy of registrants.

In light of all the conversations, and B&B advice received, it is clear that the argument of potential liability risk due to inadvertent disclosure of personal data does no longer hold value. If you want to diminish this risk, it is clear that you first have to distinguish between natural and legal entities and then further ensure that legal entities do not provide any personal data (or, if they do provide personal data, that they consent to publishing of such personal data). Then in case of a mistake it will be up to the registrant; not the contracted parties. So in our view the liability argument cannot be used as a justification for not taking action – especially given the many problems that such inaction causes and will continue to cause.

Best regards,

Melina

From: Gnso-epdp-team <[email-masked]> On Behalf Of Volker Greimann via Gnso-epdp-team
Sent: Sunday, April 18, 2021 3:04 AM
To: Stephanie E Perrin <[email-masked]>
Cc: GNSO EPDP <[email-masked]>
Subject: Re: [Gnso-epdp-team] On the proposed guidance

I think you both make good points. Our starting point is the current status quo, which I expect will continue on into the far future: All registration data provided as a registrant must be viewed as potential personal information, in a Schroedingers Cat kind-of situation. Until you look at it, you do not know what it is, even though you can make certain assumptions with varying likelihoods. The 2B memo tells us nothing new in that regard.

What it does tell us is that the various methods of determination without looking have risk of various degrees attached.

Miltons proposed registrant-declaration is one of the lower risk ones methods. Stephanie is also right that in a highly competitive market with razor-thin margins, corners will be cut at some point of the channel, especially once you enter the realm of resellers. So Stephanie is absolutely correct in her point that the determination of whether contracted parties can rely on the accuracy of any declaration must be that of the contracted party itself. The declaration of legal status of the registrant ultimately does not help us make that determination. The declaration of content of the data goes a whole lot further in that regard.  Controlling the process where the declaration is made helps even more (hence the requirement to allow post-registration declarations).

As for publication vs. disclosure, after having given this some thought, I still tend to come out on the side of disclosure, but with the following features:

- self-declared data sets would be set to automated disclosure.

- public RDAP could contain a marker/flag/label/something that shows that this data set is available for automated disclosure in SSAD

- Disclosure fees for such data sets in SSAD could be priced lower than non-automated data sets, say half-price

- Access levels for access to such data sets could be lower for users of SSAD. For example, if you just want to access automated-disclosure sets, accreditation could be voluntary, and a mere ID-check application process and a statement of legitimate interest for each request could be possible.

Advantages:

- Increased utility of SSAD

- SSAD User Fees would decrease (higher query volumes overall, lower fees for some queries)

- CP Risk would be limited

- CP handling times for requests would be reduced in case they implement that flag.

I still need to hear what the benefits of the differentiation of data sets and better availability of non-personal information really are, though. In my experience it is not like cyber criminals are setting up legal entities such as STEALATRADEMARK, Inc or VIOLATEACOPYRIGHT, Ltd. left and right to register their domain names. Those kinds of domains are usually registered with perfectly accurate personal data sets. If someone could really make the case of what the perceived benefit to all parties concerned is on this (something I have been asking for from days 1), I'd be happy to hear them. The common argument of security, stability and resilience of the DNS went out of the window the day the Temp Spec first came into effect after all, as neither of the three has been affected by the current vegetative state of the WHOIS (In the sense that it is not quite dead yet, but almost. Machines still keep it alive).

This also would solve the issue of thick vs thin RDAP:

If RDAP only returns the basic data set anyway and never any personal information, there is no longer any need to require registrars to provide RDAP services as there no longer is any concern in supplying said data to the registries for centralised publication. Thick RDAP would be saved.

--
Volker A. Greimann
General Counsel and Policy Manager
KEY-SYSTEMS GMBH

T: +49 6894 9396901
M: +49 6894 9396851
F: +49 6894 9396851
W: www.key-systems.net<https://urldefense.com/v3/__http:/www.key-systems.net/__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxhKRwDSK$>

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835
CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

On Sat, Apr 17, 2021 at 12:19 AM Stephanie E Perrin via Gnso-epdp-team <[email-masked]<mailto:[email-masked]>> wrote:

   Bird and Bird is offering arguments for protection in the event of complaint.  While that protection is welcome and reassuring in terms of risk, I am not certain that we have adequately explained to 2Birds how registration actually takes place.  It would have been beneficial to walk them through a range of different ways to register a domain name.  As we have discussed in the calls, very often non-savvy non-commercial users or small business/home workers use resellers of various kinds to register their domains.  Additional risk creeps in here, WRT whether or not a positive consent has been obtained from relevant employees.  Further risk creeps in when we look at automatic renewals, where the contact data may not be updated.  If updated, have the steps been taken to get consent from new employees?  To me this is key, non-savvy users, and I count myself among them, are not likely to check what an intermediary is doing with respect to the domain renewal or updating.

   Now, of course the argument is that they SHOULD be more diligent and they SHOULD pay attention to the accuracy requirements, but lets deal in facts here.....are they?  As the data controller who is pre-emptively disclosing personal data, allegedly with consent, to unknown (to the contracted party) third parties, the responsibility still rests with the controller.  As I have mentioned, a Facebook or a Google or a Microsoft can get away with treading roughshod over their consent arrangements....not too many folks are going to give up free or necessary services over quibbles in a consent form, even if it is 75 pages long.  However the registrars (and to a lesser extent, the registries) are operating in a highly competitive market.  Once losing my trust, perhaps over a trifling inattention to the accuracy of my data, and I am transferring my domains to another company. Policing a complex reseller market is also rather a difficult matter that we have not discussed at length in our debates on this issue.  I know that the data commissioners as a group do not understand how the accountability for the handling of personal information is transferred in that market, and it would not be surprising if 2Birds did not either.  Bottom line:  accredited registrars are shouldering the risk here, it is their risk, and they would know best whether they can trust the accuracy of the designation of legal personhood.  This is why I think that this designation, in my opinion, should always permit an override by the  contracted parties to treat the data as personal.  I have suggested many many times that commercial organizations should operate on an accreditation basis and be linked to their official registration numbers (business, corporation, municipal licence etc).  Noone ever responds to that idea....if it is totally ridiculous I would certainly like to know why, I am offering it in good faith and I think it would do something useful to stop fraudulent registrations in their names.  However, small business and non-commercial organizations, even if incorporated or in possession of a registration # of some kind have different needs and circumstances, and they are frequently treated differently under data protection law.

   One final point that I have raised a few times.....we tend to focus on enforcement fines and Court costs.  Even if noone ever complains to a DPA or takes a case to Court, where the advice of 2 Birds gives us some comfort that the risk is manageable, and the results would exonerate the contracted parties.....what about reputational damage in the meantime?  Court costs?  Who actually wants to have customers complaining about the practices?  Employee morale, if it is employees who are objecting to the practices?

   I support focusing on whether the data submitted is personal or not, with a fulsome definition and description of same, and full flexibility for contracted parties to err on the side of caution and consider the possibility of  some data being personal after all.  After all, much data is still being disclosed, and noone has adduced strong evidence that the delay in requesting the data (as opposed to getting it from the published data) will have huge repercussions.  What is actually at play here is who is doing the extra work....the requesting party, or the data controller.

   Stephanie Perrin

   On 2021-04-15 10:42 p.m., Mueller, Milton L via Gnso-epdp-team wrote:

      EXTERNAL EMAIL:

      Further legal support from TwoBirds

      14.2           If personal data is erroneously included in published Registration Data, it would in this scenario occur despite substantial (VSC) steps taken by the Contracted Parties, and would be primarily attributable to the actions/omissions of the Registrant.  This is likely to be taken into account by data subjects, data protection supervisory authorities, and courts.

      14.3           The data in question is likely to be low sensitivity.  The scenario being envisaged here (mistaken inclusion of personal data in published Registration Data) seems to be most likely to occur when a legal entity (e.g. a company or non-profit organisation) is registering / maintaining its own domains.  In those scenarios, we assume the personal data that could be disclosed would ordinarily relate to an employee’s work details (e.g. a company email address), not an individual’s private life.  Although the GDPR confers protection even in the workplace, the data in question here may arguably be less capable of causing harm to an individual than data relating to the data subject’s private life.[1]

      14.4           In more sensitive cases (e.g. disclosing that a person works for a company in a sensitive or “embarrassing” sector), a Registrant would be putting itself at serious risk of complaints from its own employees.  Registrants are therefore already incentivised to avoid errors that could have serious consequences for their own staff.

      From: Mueller, Milton L
      Sent: Thursday, April 15, 2021 10:34 PM
      To: [email-masked]<mailto:[email-masked]>
      Subject: RE: [Gnso-epdp-team] On the proposed guidance

      Some legal support for my argument below from Bird & Bird:

      There may even be an argument, based on EU Court of Justice (“CJEU”) caselaw, that this is a situation where Contracted Parties should generally only be liable should they fail to properly address a complaint about the data – i.e. only once they are put on notice about the alleged illegality and thereby have an opportunity to “verify” the merits of the complaint.[1]  This bears some parallels to other EU liability regimes for operators of services online that process – unwittingly – content that violates EU law.[2]  As discussed at footnote 6 below, this is arguably recognised in (at least some) decisions of GDPR supervisory authorities.

      In other words, if personal data finds its way into a published registration record that should not be there, an objection can be lodged with the registrar and they can verify the merits and remove the data.

      Dr. Milton L Mueller

      Georgia Institute of Technology

      School of Public Policy

      Internet Governance Project<https://urldefense.com/v3/__https:/internetgovernance.org/__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxoPMR176$>

      From: Mueller, Milton L
      Sent: Thursday, April 15, 2021 9:14 PM
      To: [email-masked]<mailto:[email-masked]>
      Subject: FW: [Gnso-epdp-team] On the proposed guidance

      >" Everyone who is named in a role in a registration must have already been informed

      > and consented to all of the conditions involved in the role. " This is the ideal. Sadly, this ideal

      > is very often not the case.

      Whoa.

      Of course, Volker, it is possible that a person making a registration for a legal person won’t do it properly. But it is absurd to expect a registrar to be legally responsible for that. How can the registrar be liable for privacy breaches made by the registrant? Indeed, I can’t understand why gaining the consent of the administrative assistant of the xyz department to have their name listed in the whois is a matter for DNS/ICANN policy at all. ICANN policy simply needs to inform registrants that under certain conditions the data will be published.

      Let’s take an extreme case – suppose a nasty IT manager in a major corporation puts the name, email address and (what the heck) a revenge porn photo of her ex-husband in her company’s registration record. Are you telling me the registrar would be considered responsible for that breach of privacy? Not the nasty IT manager?

      Show me a legal case in which that kind of liability has been assigned. I doubt you can, but I await the data from CP lawyers who have been involved in these cases. I do know of several cases in which agents for a corporation wrongly listed themselves as the technical and administrative contact, making it possible for them to hijack the name. The registrar was NEVER held liable for that.

      Reminder: We had to reform Whois/RDS policy because ICANN, as a matter of contractual obligation, required registrars to publish sensitive PII of any and every Registrant. Once we have removed that obligation, and once we have given registrants knowledge of the conditions under which the data in the record should be published, I don’t see why registrars need to worry about some corporation listing the personal email address of someone in their IT department.

      So if this alleged risk is being cited to scare us away from allowing registrants to self-designate as legal or natural, it is a pretty weak case, imho.

      --MM

      From: Gnso-epdp-team <[email-masked]<mailto:[email-masked]>> On Behalf Of Volker Greimann via Gnso-epdp-team
      Sent: Thursday, April 15, 2021 10:10 AM
      To: Steve Crocker <[email-masked]<mailto:[email-masked]>>
      Cc: [email-masked]<mailto:[email-masked]>
      Subject: Re: [Gnso-epdp-team] On the proposed guidance

      Employees are named by other employees without their knowledge, or remain named long after they leave. From the experience as a registrar dealing with registrants every day, this ideal is an assumption that does not survive contact with reality.

      --
      Volker A. Greimann
      General Counsel and Policy Manager
      KEY-SYSTEMS GMBH

      T: +49 6894 9396901
      M: +49 6894 9396851
      F: +49 6894 9396851
      W: www.key-systems.net<https://urldefense.com/v3/__http:/www.key-systems.net/__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxhKRwDSK$>

      Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835
      CEO: Oliver Fries and Robert Birkner

      Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

      This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

      On Thu, Apr 15, 2021 at 3:36 PM Steve Crocker via Gnso-epdp-team <[email-masked]<mailto:[email-masked]>> wrote:

         Laureen,

         Thanks for your note.  With respect to the details under legal person, we believe the issue of consent should be moot.  Everyone who is named in a role in a registration must have already been informed and consented to all of the conditions involved in the role.  This is a prerequisite for having a working system and is not specific to meeting a privacy regulation.  The fact that this requirement is not specified in the existing contractual documentation is an error and needs to be rectified.

         Steve

         On Thu, Apr 15, 2021 at 6:28 AM Kapin, Laureen via Gnso-epdp-team <[email-masked]<mailto:[email-masked]>> wrote:

            I think we share common ground on many key issues and I would like to build on the many helpful inputs received as to what would be advisable.

            Goal: publish non-personal, non-protected data to the greatest extent permissible under the GDPR and within low legal risks to data controllers and processors.  Note, the description below does not fully detail the advised safeguards which B&B has documented and which we’ve adopted in our prior input because my impression is that we generally agree that the safeguards are prudent.  This description merely seeks to identify the key steps that must be taken to ensure that personal data is identified and protected and non-personal data is published.  I also highlight the addition of a potential additional safeguard – Confirmation.  I think this process incorporates what we’ve discussed and inputs received and could form a useful framework for discussion.

            Note:

            •  New Registrations: This process applies to new registrations (Steve C. has some useful thoughts on how to deal with existing Registrations)

            •  Publish: When I use the word “publish,” I mean made public directly; not via the SSAD.

            •  Flexibility: Based on input from our Registrar colleagues, we should permit flexibility for how these steps are implemented to account for the varied business models in place.

            •  Timing: All identifications need to take place at the time of registration or shortly thereafter (w/in the 13-day accuracy verification window) and no registration data should be published until the identification, consent, and confirmation process concludes

            Process:

            1.   A threshold identification of the registrant as a natural or legal person;

            a.   If natural, registration info redacted

            b.   If legal, further inquiries and advisories (safeguards):

                                                     i.    if the legal person identifies that it has a protected status under the GDPR

            1.   registration info redacted

                                                    ii.    If the legal person registration contains personal data, advise of consequences (publication)

            1.   Obtain necessary consents

            2.   Possible additional safeguard: Ask Registrant to Confirm any identification that will result in publication of contact data (akin to confirming a flight reservation or stock trade)

            a.   Publish

            3.   If no consent

            a.   Redact

            2.   Provide quick and easy opportunity to correct any mistakes

            I hope this is useful.

            Kind regards,

            Laureen Kapin

            Counsel for International Consumer Protection

            Federal Trade Commission

            (202) 326-3237

            From: Gnso-epdp-team <[email-masked]<mailto:[email-masked]>> On Behalf Of Volker Greimann via Gnso-epdp-team
            Sent: Thursday, April 15, 2021 8:35 AM
            To: Hadia Abdelsalam Mokhtar EL miniawi <[email-masked]<mailto:[email-masked]>>
            Cc: [email-masked]<mailto:[email-masked]>
            Subject: Re: [Gnso-epdp-team] On the proposed guidance

            I think we need to be cognisant of the current status quo and use that as the basis for our thoughts on the matter:

            1) There is no differentiation between legal or natural contacts.

            2) The redaction of all contacts is permitted and has become the de-facto standard.

            3) We allow consent-based disclosure.

            4) NIS 2 may at some point in the future require publication of non-personal information.

            This leads to two very simple follow-on questions:

            a) How do we identify such non-personal information? What is really necessary for this end?

            b) What would publication entail?

            For a) we and Twobirds identified voluntary self-declaration of the data submitted. As all data is redacted by default, the differentiation of the data subject category is irrelevant as it ultimately only boils down to the declaration of the data subject thatthe data contains no personal information.

            For b), the term "publish" is undefined. For all we know, it could mean publication in a physical print edition (it doesn't mean that though). But publication within SSAD can very well be sufficient for that definition. There is no reason whatsoever to assume differently.

            --
            Volker A. Greimann
            General Counsel and Policy Manager
            KEY-SYSTEMS GMBH

            T: +49 6894 9396901
            M: +49 6894 9396851
            F: +49 6894 9396851
            W: www.key-systems.net<https://urldefense.com/v3/__http:/www.key-systems.net/__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxhKRwDSK$>

            Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835
            CEO: Oliver Fries and Robert Birkner

            Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

            This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

<https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxiSlynfH$>

Virus-free. www.avast.com<https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxiSlynfH$>

            On Thu, Apr 15, 2021 at 1:52 PM Hadia Abdelsalam Mokhtar EL miniawi via Gnso-epdp-team <[email-masked]<mailto:[email-masked]>> wrote:

               Dear Milton,

               Thank you for your constructive thoughts. I believe we have a lot to build on. In relation to principle one, I think we all agree that some legal data subjects would want to publish their data in the RDDS, but without your first principle they can only do this through consent. The legal memo received lately from Bird & Bird explains that if CPs publish the data of legal persons based on consent they are at a higher risk than if they publish the data of legal persons based on self-designation. In the latter case CPs might only be liable if they fail to address a complaint. So the question always was: what is the benefit of labeling the data as belonging to a natural or legal person? Of course we all know that GDPR protects the data of natural persons and not legal persons, but the important answer now is that the distinction significantly reduces the liability of CPs. In addition, the distinction is helpful in performing the balancing test in case the data is not published and I am sure if we look into individual use cases we can find much more benefits. Moreover, it could prove to be useful regarding possible upcoming regulations. I would also add that the level of protection assigned to the data elements suggested by Steve provides additional safe guards and flexibility in the implementation.

               Finally, I join you in being optimistic about our ability to finish this.

               Kind regards

               Hadia

               From: Gnso-epdp-team [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Mueller, Milton L via Gnso-epdp-team
               Sent: Wednesday, April 14, 2021 10:12 PM
               To: [email-masked]<mailto:[email-masked]>
               Subject: Re: [Gnso-epdp-team] On the proposed guidance

               Colleagues:

               I have only gotten time to review the latest Guidance document and the surrounding debate today. Apologies, but there is a lot going on in my day job.

               I am disappointed to see that we seem to be going backwards. I see divergence rather than convergence on the way we are approaching the problem.

               I see no point in adding more noise to the current document via the Comments function. What I would like to try to do is articulate some broad principles about how to deal with the legal/natural distinction. If we can agree on those principles, it will be relatively easy to complete the document. If we cannot/do not agree on those principles, additional wordsmithing and debates over terms will not get us anywhere.

               So here are the broad principles that I would offer up for debate:

               1.       The legal/natural distinction is relevant and we need to find a way make it in RDDS without compromising privacy rights.

               2.       Registrants should be able to self-designate as legal or natural, with no burden of authentication placed on registrars or registries

               3.       To protect small home offices or NGOs who are technically Legal persons but whose registration data may include Personal data, we need an additional check in the process.

               4.       As long as they conform with the above 3 principles, registrars/ries (CPs) should be given maximum flexibility to choose the way to differentiate.

               Principle 1 discussion:

               If we cannot agree on this (or agree to abandon this principle), _nothing else will fall into place_. Ever. So let’s settle that. Steve and Volker I suspect will disagree with this principle. Steve has argued that the L/N distinction is “not a central concern” and all that matters is whether the registrant’s data is to be made available to anyone. If he is right, we can discard the guidance altogether, because we already have a recommendation to allow the RNH to consent to the publication of their data. Volker has also suggested that it is personal data we need to differentiate, not L/N . I disagree with Steve and Volker on this and so do most of the rest of the group. L/N distinction is a central concern to certain stakeholder groups in the EPDP, because a) GDPR and other data protection laws do not protect it and this process is all about bringing RDS into compliance with privacy law; b) Legal person data could be published and it would provide easier access to their registration data. As a NCSG member I can find no basis for objecting to the publication of WalMart’s, Kroger’s or the local hardware store’s registration data. Any concerns about PII are addressed by principles 2 and 3. Steve is approaching this as an engineer, but this is a policy process, and we will not obtain agreement on a solution unless certain stakeholders are satisfied. If they think it is a central concern, it’s a central concern, that’s how policy/politics work.

               Principle 2 discussion

               This is the key principle that keeps NCSG and CPH satisfied. Registrants are in control of how they are designated. Yes, this means that some people will lie. That is just something we will have to accept. One cannot erase that possibility without creating a system that is too burdensome and costly as to outweigh any benefits.

               Principle 3 discussion

               This is something everyone seems to agree on already. But it is good to make it explicit, then we can work out how specific our guidance can get, so as to conform to …

               Principle 4

               Avoid being overly prescriptive, but ensure that the other 3 principles are honored. So yes, Volker, we give you maximum flexibility to implement in accordance with different business models, but you can NOT make a designation for a RNH, because it violates principle 2.

               I truly believe that if we can come to agreement on these 4 principles and use them as the basis for drafting guidance, we can actually finish this.

               _______________________________________________
               Gnso-epdp-team mailing list
               [email-masked]<mailto:[email-masked]>
               https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-team__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxghxMAOY$>
               _______________________________________________
               By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxl5BDJwa$>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxn6b_CGX$>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

<https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxiSlynfH$>

Virus-free. www.avast.com<https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxiSlynfH$>

            _______________________________________________
            Gnso-epdp-team mailing list
            [email-masked]<mailto:[email-masked]>
            https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-team__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxghxMAOY$>
            _______________________________________________
            By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxl5BDJwa$>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxn6b_CGX$>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

         _______________________________________________
         Gnso-epdp-team mailing list
         [email-masked]<mailto:[email-masked]>
         https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-team__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxghxMAOY$>
         _______________________________________________
         By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxl5BDJwa$>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxn6b_CGX$>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

        _____

        _____

      [1] As explained above, we have understood this question to be asking about scenarios where Registrants are legal persons, as per the EDPB quote at paragraph 1.  In respect of individual (natural person) Registrants, the issues will be largely similar: if a natural person incorrectly states that their data is not personal data, then (i) the verification measures should prevent the data from being published, since they will give the data subject an opportunity to correct their mistake; (ii) the mitigating factors and legal arguments described at paragraphs 11.7 and 11.8 and paragraphs 14.1 - 14.6 here, should confer reasonable legal protection for Contracted Parties.

      [1] In its judgement in Case C‑136/17 GC and Others, the CJEU explained that GDPR obligations relating to an erasure (“Right to Be Forgotten”) request apply “to the operator of a search engine in the context of his responsibilities, powers and capabilities as the controller of the processing carried out in connection with the activity of the search engine, on the occasion of a verification performed by that operator, under the supervision of the competent national authorities, following a request by the data subject”.  As the Advocate General explained in that case, “such an operator can act only within the framework of its responsibilities, powers and capabilities. In other words, such an operator may be incapable of ensuring the full effect of the provisions of [EU data protection law], precisely because of its limited responsibilities, powers and capabilities. . . An ex ante control of internet pages which are referenced as the result of a search does not fall within the responsibilities or the capabilities of a search engine.”  It could not know, from the moment it indexed a webpage, that the content of that page was (for example) out of date (as in the original Google Spain / Costeja ruling), or (in the GC and Others case) “special category” or “criminal offence” data for which it required consent.

      [2] See, for example, Article 14<https://urldefense.proofpoint.com/v2/url?u=https-3A__eur-2Dlex.europa.eu_legal-2Dcontent_EN_ALL_-3Furi-3Dcelex-253A32000L0031&d=DwMGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=Ez5vrdh9UP_ePNwSF3McPPcIqyPeVvnna1Q82nGm3Uo&e=> of the e-Commerce Directive 2000/31/EC and its transposition into the national laws of EU/EEA Member States and the UK.

      _______________________________________________
      Gnso-epdp-team mailing list
      [email-masked]<mailto:[email-masked]>
      https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-team__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxghxMAOY$>
      _______________________________________________
      By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxl5BDJwa$>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxn6b_CGX$>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

   _______________________________________________
   Gnso-epdp-team mailing list
   [email-masked]<mailto:[email-masked]>
   https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-team__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxghxMAOY$>
   _______________________________________________
   By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxl5BDJwa$>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxn6b_CGX$>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

Subject: Re: [Gnso-epdp-team] [EXTERNAL] Re: On the proposed guidance
From: Volker Greimann <[email-masked]>
To: STROUNGI Melina <[email-masked]>
Cc: "Mark Svancarek (CELA)" <[email-masked]>, Becky Burr <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Thu, 15 Apr 2021 13:08:17 +0000

Hi Melina,

thank you for providing further background. It is interesting to see what the author intended by each word, however as my old German teacher used to say, the interpretation of the book is only valid if the text actually supports that interpretation. In other words, the intent of the author is irrelevant if it cannot be derived from the text as written. Additionally, this is a proposal, subject to change based on the comments received, subsequent negotiations between the various EU bodies that have a role to play, and ultimately the translation into Member State laws, which you know can differ significantly in details.

" Such data should be available not only via the SSAD but also in public."

The actual text of the draft directive does not support this statement. How the publication is supposed to occur is not mentioned once.

" availability of non-personal data of legal persons would be of paramount importance to the security, stability and resilience of the DNS and the ICANN community as a whole"

I see this argument again and again, yet every single time, it lacks substantiation. In fact, the last 2-3 years have arguably demonstrated the argument to be false, as non-personal data of legal persons has not been publicly available since the very day the GDPR came into effect and yet the security, stability and resiliency of the DNS and the ICANN community has not been impacted. The sky has not fallen, the DNS has remained secure, stable and resilient, DNS abuse has declined, according to ICANNs own numbers. The ICANN community has suffered more from COVID than from GDPR-related lack of disclosure. I therefore reiterate my initial request that the perceived need for any change to existing policy must be demonstrated.

" we are confined by time limitations and an upcoming deadline that approaches very fast"
Full agreement here, so let's not get hung up on pointless debates but try and solve the issue at hand, which is - as Steve has so aptly pointed out - the disclosability of the data, which ultimately hinges on the question of whether
a) personal information is present in the data set, or
b) personal information is not present in the data set.

a) is the case in both data sets of natural persons and legal persons
b) is the case only in legal person data sets that contain no personal information.

Consequently, a) can be disregarded for the question of disclosure (and publication) as the only relevant determination is made in b). Now, it may be _helpful_ to make the determination to exclude a large chunk of registrations from the secondary determination, but by no means is it _required_.

So the first part of the charter question " should it be a requirement" can definitely be answered with a negative. The secondary part "what guidance could there be developed for contracted parties who wish to distinguish between legal and natural persons" can be discussed more broadly once we agree on the answer for the first part.

--
Volker A. Greimann
General Counsel and Policy Manager
KEY-SYSTEMS GMBH

T: +49 6894 9396901
M: +49 6894 9396851
F: +49 6894 9396851
W: https://urldefense.proofpoint.com/v2/url?u=http-3A__www.key-2Dsystems.net&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=vfSfrloxFR8B2wAL2AXA475KKaK0z4UvuaHTgEekvYI&e= <https://urldefense.com/v3/__http://www.key-systems.net/__;!!DOxrgLBm!UaHysXz9Oxg62kDxH0vibL1vx7ZSiEuKCKzMR7MhJ0GLY2D6AQ7ZHFtW22xnfD7v4NXQWoJm$>

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835
CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

[https://urldefense.proofpoint.com/v2/url?u=https-3A__ipmcdn.avast.com_images_icons_icon-2Denvelope-2Dtick-2Dround-2Dorange-2Danimated-2Dno-2Drepeat-2Dv1.gif&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=UaVLlnq79HqVAoC5wBalTwpVEA_OYv_bUvEidjU2gaA&e= ]<https://urldefense.com/v3/__https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail__;!!DOxrgLBm!UaHysXz9Oxg62kDxH0vibL1vx7ZSiEuKCKzMR7MhJ0GLY2D6AQ7ZHFtW22xnfD7v4NqSkXfS$>       Virus-free. https://urldefense.proofpoint.com/v2/url?u=http-3A__www.avast.com&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=STyXQh60VUMHiOd2lD1_aE4FjJtsIW760vcC4f7J3cs&e= <https://urldefense.com/v3/__https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail__;!!DOxrgLBm!UaHysXz9Oxg62kDxH0vibL1vx7ZSiEuKCKzMR7MhJ0GLY2D6AQ7ZHFtW22xnfD7v4NqSkXfS$>

On Thu, Apr 15, 2021 at 2:34 PM STROUNGI Melina via Gnso-epdp-team <[email-masked]<mailto:[email-masked]>> wrote:
Dear all,

Thank you for your comments. I see some very good points made by Mark, Milton, Hadia, Brian and Alan.
I believe we are – almost – all on the same page on the very basic principle of differentiating between legal and natural persons.

@Becky to reply to your message and to clarify any ambiguities on NIS2 Proposal:
I hope it may be helpful to note that I have been personally involved in the drafting of art. 23 of NIS2 Proposal and the accompanying relevant recitals and I was actively involved in the negotiations of every single word of the text and the reasons behind them. I can, thus, 100% confirm what I wrote on the two separate NIS 2 obligation on access and publication. I can also confirm that this is the message that the EC is passing and will continue to pass on to Member States.

The SSAD is designed as an access and disclosure system –under NIS2 light this would mean providing access to specific domain name registration data upon lawful and duly justified requests of legitimate access seekers (such access could entail both personal and non-personal data).

Disclosure via the SSAD would not meet the NIS2 publication requirement. The publication requirement is a separate one and concerns immediate (‘without undue delay after the registration of a domain name’) publication of non-personal data of legal persons. Such data should be available not only via the SSAD but also in public.  This requirement aims at addressing the current problems resulting from redacted WHOIS data, as availability of non-personal data of legal persons would be of paramount importance to the security, stability and resilience of the DNS and the ICANN community as a whole.

Having clarified this I also agree with Alan’s point that, distinction between natural and legal persons not only is in line with the GDPR and NIS2, but also is in scope of EPDP Phase 2a. See here: https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_pages_viewpage.action-3FpageId-3D150177878&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=LIPpoV4c2x7sUl1MhqfrZzCCh8oV-aTY9znr9OPso9Q&e= <https://urldefense.com/v3/__https://community.icann.org/pages/viewpage.action?pageId=150177878__;!!DOxrgLBm!UaHysXz9Oxg62kDxH0vibL1vx7ZSiEuKCKzMR7MhJ0GLY2D6AQ7ZHFtW22xnfD7v4KMMZw0m$>

As we are confined by time limitations and an upcoming deadline that approaches very fast, I would also warmly agree with those who wish that the focus of our remaining efforts remains within the scope of Phase 2a, which concerns the distinction between legal and natural persons (i.e., should it be a requirement and what guidance could there be developed for contracted parties who wish to distinguish between legal and natural persons).

Best regards,
Melina

From: Gnso-epdp-team <[email-masked]<mailto:[email-masked]>> On Behalf Of Mark Svancarek (CELA) via Gnso-epdp-team
Sent: Wednesday, April 14, 2021 9:35 PM
To: Becky Burr <[email-masked]<mailto:[email-masked]>>; Hadia <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Subject: Re: [Gnso-epdp-team] [EXTERNAL] Re: On the proposed guidance

I don’t think this is an over-complication.  It’s an issue which must be clarified and settled.

We’ve already determined that the non-contact non-personal data will be available to anyone for any purpose.  The Registrar field would be an example of such data; ICANN Lookup<https://urldefense.com/v3/__https:/lookup.icann.org/__;!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrA2tjX0T$> is an “always on” example of how such data is made freely available.  We would not consider forcing a user to become accredited in order to get these data via SSAD.  We would also not consider the transmission of such non-personal data to be “disclosure”.  Melina can correct me if I am wrong, but I think we would call such transmission “publishing”.

Now we are discussing non-personal contact data.  Once again, it’s not correct to characterize the transmission of non-personal contact data as “disclosure”, and to do so implies that it’s OK to hide non-personal contact data in spite of it being unprotected by GDPR and required to be “published” under NIS2D.

Given the lack of protection and the obligation to “publish”, it is unworkable if non-personal contact data is only available via SSAD, a system for disclosure which requires accreditation, codes of conduct, and fees.  These non-personal data must be available both via SSAD and via sources such as ICANN Lookup<https://urldefense.com/v3/__https:/lookup.icann.org/__;!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrA2tjX0T$>.

Regarding intermediation of content published on the internet, I’d point to your Vcard at Becky Burr | Harris, Wiltshire & Grannis LLP (hwglaw.com)<https://urldefense.com/v3/__https:/www.hwglaw.com/team/becky-burr/__;!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrDknq_mD$>.  That is an example of personal contact data being made freely available.  I don’t know the details under which you are obliged to publish it, so I won’t make a direct comparison to domain name registration contact data --- but it would be silly if the non-personal contact data of a legal person such as Walmart should be harder to acquire than the personal contact data of an attorney, which is what I think you are acquiescing to below.

Finally, I think there is a meaningful distinction between what Melina is advocating (first determine if the person is legal, then look for the edge case where a legal person has submitted personal data despite being instructed not to do so) and what I think Volker is advocating (disregard legal status entirely and make no effort to ensure that legal entities submit only non-personal data).  The intent of these are different and the outcomes will certainly be different.  Given that Melina’s proposal is in line with my reading of the EPDP Phase 2a Charter, I assert that Melina’s approach is required.

From: Gnso-epdp-team <[email-masked]<mailto:[email-masked]>> On Behalf Of Becky Burr via Gnso-epdp-team
Sent: Wednesday, April 14, 2021 11:33 AM
To: Hadia <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: [EXTERNAL] Re: [Gnso-epdp-team] On the proposed guidance

I think we may be over-complicating this discussion.

Sounds to me like Volker and Melina have different views on what will satisfy the NIS2 requirement that non-personal data be made "publicly available"  / "published without undue delay".  If I'm understanding the point of this discussion, Volker suggests that prompt disclosure of non-personal data upon receipt of an SSAD request may be sufficient.  Melina suggests that non-personal data must be available for non-intermediated access in some "always on" online RDDS database.   If Volker is right, the relevance of the up-front legal/natural distinction is lessened because the disclosure is driven by the character of the data (personal or not personal).  I don't have a view on what NIS2 requires, although access to things that are "published" on the Internet are almost always intermediated in one way or another.

Also, FWIW, I think some ccTLDs differentiate registrant types in order to satisfy nexis requirements.

On Wed, Apr 14, 2021 at 8:36 AM Hadia Abdelsalam Mokhtar EL miniawi via Gnso-epdp-team <[email-masked]<mailto:[email-masked]>> wrote:
Dear Volker and all,

First I would like to thank ICANN org for conducting additional research in relation to the ccTLDs' registration directory service policies. Having briefly looked at Appendix A, I would like to share with you some observations

•         None of the ccTLDs who differentiate between the data of legal and natural persons don't differentiate between the registrants' types.

•         Two ccTLD registries do not differentiate between the publication of the data of the legal and natural persons because they publish the data of both.

•         Four ccTLD registries neither make a differentiate between the registrants' types nor the registrants' registration data.

•         The rest of the ccTLDs who do not differentiate between the publication of the data still differentiate between the registrants' types.

•         It is unclear whether the ccTLD of Slovakia differentiates between the publication of the data. However the registry differentiates between the registrants' types (Legal/natural)

>From the policies' summary, it is clear that in order to look into the issue of differentiating between the processing of the data of legal and natural persons, we need to consider at least two types of classifications. The first is the differentiation  between the registrants' types, which does not necessary lead to the publication of the data and the second is the differentiation between the data type.

Kind regards
Hadia

From: Gnso-epdp-team [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of STROUNGI Melina via Gnso-epdp-team
Sent: Monday, April 12, 2021 5:08 PM
To: Volker Greimann
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [Gnso-epdp-team] On the proposed guidance

Hi Volker,

Thank you for your comments. I thought we had clarified these points during the EPDP discussions but seeing your latest reactions on the guidance doc, I would like to add a few – hopefully – helpful clarifications.

It is very positive to see that the NIS2 Proposal is taken into account; please note that NIS2 Proposal imposes two separate obligations:

-          providing access to specific domain name registration data upon lawful and duly justified requests of legitimate access seekers (this would mean disclosure via the SSAD and could entail both personal and non-personal data)

-          publication, without undue delay after the registration of a domain name, of domain registration data of legal persons which are not personal data (see recital 62 and article 23 (4)). This does not relate to SSAD – the publication requirement is a separate one and concerns providing data in the publicly accessible Registration Data Directory Services.

It is hard to see how your vision, as currently phrased in your email below, meets any of these two requirements.

Regarding your other point, I believe that it does matter to whom the data belongs. Data of natural persons are personal data and therefore should always be protected by default (unless there is consent) and data of legal persons are not protected, so in principle they should be disclosed (unless they contain personal data in which case you may decide to further distinguish and publish only the non-personal data of the legal persons – as also required by the NIS2 Proposal).

Hope this helps. Happy to discuss further.

Best,
Melina

From: Volker Greimann <[email-masked]<mailto:[email-masked]>>
Sent: Thursday, March 25, 2021 4:22 PM
To: STROUNGI Melina (CNECT) <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [Gnso-epdp-team] On the proposed guidance

Hi Melina,

if we differentiated between personal and non-personal data only, it would not matter whom the data belonged to, e.g. a legal person record that contains personal information would be treated as the default: Do not publish.

My vision is that the differentiation would only make a difference in the handling of that data within SSAD where interested parties would be granted quick access to such non-personal data, as required by NIS2.

--
Volker A. Greimann
General Counsel and Policy Manager
KEY-SYSTEMS GMBH

T: +49 6894 9396901
M: +49 6894 9396851
F: +49 6894 9396851
W: https://urldefense.proofpoint.com/v2/url?u=http-3A__www.key-2Dsystems.net&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=vfSfrloxFR8B2wAL2AXA475KKaK0z4UvuaHTgEekvYI&e= <https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2Fwww.key-systems.net*2F__*3B!!DOxrgLBm!S4qH_9yVum0x39KcAPU39X1TMMihgXMy-hSb7xObqmhFvANUMMPXI3VHvYWHCiYE40qLD3GD*24&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775063266*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=*2F1Migb9wb5zfNDJAG3Id6Dw*2F7eolxxvlJBMPfLNpeLc*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrGZwsKFA$>

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835
CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

On Thu, Mar 25, 2021 at 1:19 PM STROUNGI Melina <[email-masked]<mailto:[email-masked]>> wrote:
Hi everyone,

Setting aside various points raised below which are not correct, for the benefit of continuation of a constructive discussion I would like to raise some clarification questions to which written input would be very much appreciated.

@Volker:

1)      I am confused. I understand you and Sarah propose to have a distinction between personal and non-personal data, correct? Yet, below you suggest ‘protecting all data equally’ and that ‘you do not need to differentiate’. So in conclusion what are you proposing? Should you differentiate between personal and non-personal data or you should not differentiate at all (which would mean that you publish zero information)?

2)      In case yours and Sarah’s proposal to distinguish only between personal and non-personal data is still valid:
i. Would you consider making such distinction a requirement or still voluntary?

ii. How exactly would you envisage doing such a distinction in practice? Would you for instance ask the registrants to specify which data are personal or not? Would you have a dedicated team checking manually all data? Any other way?

Thanks for clarifying these points as it would be very useful in view of our today’s EDPP plenary meeting.

Best,
Melina

From: Gnso-epdp-team <[email-masked]<mailto:[email-masked]>> On Behalf Of Volker Greimann via Gnso-epdp-team
Sent: Wednesday, March 24, 2021 10:07 PM
To: King, Brian <[email-masked]<mailto:[email-masked]>>
Cc:
Subject: Re: [Gnso-epdp-team] On the proposed guidance

Hi Brian,

That approach is actually very compliant  with data protection law. Overprotection is not an issue. If you simply protect all data equally in a way that would be compliant, you do not need to differentiate.

Accuracy is shown by demonstrating that the data is unchanged from the time it was created and how it was created, by showing that the data subject has contractually agreed to only provide accurate data (and correct if outdated), and has been provided with an annual opportunity to review the data. That is the level accuracy that is relevant under the accuracy principle of the GDPR, after all.

On top of that (Bonus round for extra points here) the data collection process ensured that only properly formatted data was collected and the registrant has been required to verify his email address.

So reasonable steps to ensure the accuracy have been taken, the data subject can request a correction at any time and we will take action on any indication of inaccuracy of the data.

But the real problem isn't actually inaccurate data, in our experience. It is accurate data of the wrong data subject.

--
Volker A. Greimann
General Counsel and Policy Manager
KEY-SYSTEMS GMBH

T: +49 6894 9396901
M: +49 6894 9396851
F: +49 6894 9396851
W: https://urldefense.proofpoint.com/v2/url?u=http-3A__www.key-2Dsystems.net&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=vfSfrloxFR8B2wAL2AXA475KKaK0z4UvuaHTgEekvYI&e= <https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2Fwww.key-systems.net*2F__*3B!!DOxrgLBm!TNAiZf3EyheqvXxgQ3E8rqWa-Dt70SexlB2mim32VULbMMjhxTpKlwqpqS_s7mXWQO0zZyZM*24&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775068257*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=AK7IBPEHOFl1NiLWEp7VPH8p8upYLx5wg7*2FU6Nf30No*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUl!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrDUrDbrk$>

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835
CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

On Wed, Mar 24, 2021 at 9:48 PM King, Brian <[email-masked]<mailto:[email-masked]>> wrote:
Hey Volker,

I suppose my point (and I think I’m also paraphrasing an intervention made by Melina previously) is that approach is not likely to be compliant with data protection law.

I accept that the concept of accuracy as a policy matter is not within our remit, but let’s use accuracy as a data protection principle – how could a controller reasonably demonstrate to a DPA that the controller’s data is accurate, for example, if the controller has not even assessed whether the data is personal data?

Brian J. King
He/Him/His
Head of Policy and Advocacy, Intellectual Property Group

T +1 443 761 3726
Time zone: US Eastern Time

clarivate.com<https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2Fwww.clarivate.com__*3B!!DOxrgLBm!TNAiZf3EyheqvXxgQ3E8rqWa-Dt70SexlB2mim32VULbMMjhxTpKlwqpqS_s7mXWQCW5YUXp*24&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775073247*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=DrrkLUSB3S8KdPRdVPGkx8gzeS8G48YqqHaTlfS43dk*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrCimv1op$> | Accelerating innovation
Follow us on LinkedIn<https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fwww.linkedin.com*2Fcompany*2Fclarivate__*3B!!DOxrgLBm!TNAiZf3EyheqvXxgQ3E8rqWa-Dt70SexlB2mim32VULbMMjhxTpKlwqpqS_s7mXWQCvxAWKN*24&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775078238*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=1NbXEuqFX2waKAsCHo79uUvkgv37itBz*2B0m32I*2F6NRc*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrB5QoOan$>, Twitter<https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Ftwitter.com*2Fclarivate*3Fref_src*3Dtwsrc*5Egoogle*7Ctwcamp*5Eserp*7Ctwgr*5Eauthor__*3BJSUlJSU!!DOxrgLBm!TNAiZf3EyheqvXxgQ3E8rqWa-Dt70SexlB2mim32VULbMMjhxTpKlwqpqS_s7mXWQD240Aw8*24&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775083229*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=KZXSdWjg1kpCVgX7DBA0iLQeI1biBqmhCXPQeQgvtjg*3D&reserved=0__;JSUlJSUlJSUlJSoqKioqJSUlJSUlJSUlJSUlJSUl!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrBmPMY45$>, Facebook<https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fwww.facebook.com*2Fclarivate*2F__*3B!!DOxrgLBm!TNAiZf3EyheqvXxgQ3E8rqWa-Dt70SexlB2mim32VULbMMjhxTpKlwqpqS_s7mXWQE3OR2v4*24&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775088219*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=*2B60h0OSoi5Q99yvek6dUUfAM119F1JZNpmjrbFVPWzA*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrJk1Vond$> and Instagram<https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fwww.instagram.com*2Fclarivateofficial*2F*3Fhl*3Den__*3B!!DOxrgLBm!TNAiZf3EyheqvXxgQ3E8rqWa-Dt70SexlB2mim32VULbMMjhxTpKlwqpqS_s7mXWQJ4vFbZ1*24&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775093210*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=Sa7BdXNYarL761YQKJ12iO4bpJGA7KRnxbbf0U*2BSXow*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUl!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrDUB4SzE$>

From: Volker Greimann <[email-masked]<mailto:[email-masked]>>
Sent: Wednesday, March 24, 2021 3:58 PM
To: King, Brian <[email-masked]<mailto:[email-masked]>>
Cc: Mueller, Milton L <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Subject: Re: [Gnso-epdp-team] On the proposed guidance

Hi Brian,

the easiest way to comply with data protection law is to simply treat all registration data as if it were personal data. No chance of ever running afoul data protection law if you do that correctly and it is pretty easy to demonstrate as well.

--
Volker A. Greimann
General Counsel and Policy Manager
KEY-SYSTEMS GMBH

T: +49 6894 9396901
M: +49 6894 9396851
F: +49 6894 9396851
W: https://urldefense.proofpoint.com/v2/url?u=http-3A__www.key-2Dsystems.net&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=vfSfrloxFR8B2wAL2AXA475KKaK0z4UvuaHTgEekvYI&e= <https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.proofpoint.com*2Fv2*2Furl*3Fu*3Dhttp-3A__www.key-2Dsystems.net_*26d*3DDwMFaQ*26c*3DOGmtg_3SI10Cogwk-ShFiw*26r*3DqQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA*26m*3DqD32H8OIbs1z3Y2bdkOzGc3mUHIMW_Xp_6ZhFqwuQa8*26s*3DyN8BHspGj3eYe2CXQepAVOhufF1uWv8Ut-PpDdaFw-k*26e*3D&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775098202*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=551aTJeIVxemFuB7v4nHYCajf2dk2jNjdOPydyR27qg*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrNKeBc0L$>

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835
CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

On Wed, Mar 24, 2021 at 5:47 PM King, Brian via Gnso-epdp-team <[email-masked]<mailto:[email-masked]>> wrote:
Hi Milton,

Thank you for the constructive intervention. Your point is well taken, and I can certainly see that from the RNH perspective.

One feature of data protection law related to your point is that it requires data controllers and processors to be able to demonstrate compliance with the law. A controller or processor could doubtfully demonstrate compliance with data protection law if they had not determined whether they were actually processing personal data. In fact, data protection professionals will tell you that you absolutely must determine what personal data you’re processing as the first step toward compliance with data protection law. It seems the policy question is: what, if anything, should contracted parties be required to do based on the status of the data? Is that right?

As always, we’re happy to work with you and look forward to finding consensus.

Brian J. King
He/Him/His
Head of Policy and Advocacy, Intellectual Property Group

T +1 443 761 3726
Time zone: US Eastern Time

clarivate.com<https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2Fwww.clarivate.com__*3B!!DOxrgLBm!TNAiZf3EyheqvXxgQ3E8rqWa-Dt70SexlB2mim32VULbMMjhxTpKlwqpqS_s7mXWQCW5YUXp*24&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775103192*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=V7eIn*2Fz860xTmBwMZfok3du*2FMdmTQOARZzx0txxqqqo*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUl!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrLnVUjxV$> | Accelerating innovation
Follow us on LinkedIn<https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.proofpoint.com*2Fv2*2Furl*3Fu*3Dhttps-3A__www.linkedin.com_company_clarivate*26d*3DDwMFaQ*26c*3DOGmtg_3SI10Cogwk-ShFiw*26r*3DqQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA*26m*3DqD32H8OIbs1z3Y2bdkOzGc3mUHIMW_Xp_6ZhFqwuQa8*26s*3DbTH9-uZa1ulAV7ltM77Kkw6zYbSjQTDRiIhZ5aILoQA*26e*3D&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775108183*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=7hh*2BfVJ2ZLuadR6kopyPwJcMje2xY*2BkyyrVgxMgunjM*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrLgi_VAN$>, Twitter<https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.proofpoint.com*2Fv2*2Furl*3Fu*3Dhttps-3A__twitter.com_clarivate-3Fref-5Fsrc-3Dtwsrc-255Egoogle-257Ctwcamp-255Eserp-257Ctwgr-255Eauthor*26d*3DDwMFaQ*26c*3DOGmtg_3SI10Cogwk-ShFiw*26r*3DqQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA*26m*3DqD32H8OIbs1z3Y2bdkOzGc3mUHIMW_Xp_6ZhFqwuQa8*26s*3DsaAKJDKaijH6v2xkw6R0-WBownX8UIKXMN5zKsYPT58*26e*3D&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775113173*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=5IoaAUjr*2FaDtrC9k9l2GK681DNs*2FAVrvNOJRK*2BC3ct0*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrNe-WaxU$>, Facebook<https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.proofpoint.com*2Fv2*2Furl*3Fu*3Dhttps-3A__www.facebook.com_clarivate_*26d*3DDwMFaQ*26c*3DOGmtg_3SI10Cogwk-ShFiw*26r*3DqQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA*26m*3DqD32H8OIbs1z3Y2bdkOzGc3mUHIMW_Xp_6ZhFqwuQa8*26s*3DguRk82NQpoUPMKHhfkk8hBOD7LbP-ZT0VnzGOCoIzBI*26e*3D&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775118165*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=q9LzDORCCWfYs38JpwBOqxDOCTCiAskOSJFBQ*2F7NnxM*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUl!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrN07WyGk$> and Instagram<https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.proofpoint.com*2Fv2*2Furl*3Fu*3Dhttps-3A__www.instagram.com_clarivateofficial_-3Fhl-3Den*26d*3DDwMFaQ*26c*3DOGmtg_3SI10Cogwk-ShFiw*26r*3DqQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA*26m*3DqD32H8OIbs1z3Y2bdkOzGc3mUHIMW_Xp_6ZhFqwuQa8*26s*3DZZCjD7Z4CkwSecYOp5AXLrFBuQ3VgvD5E7kSFZsW9L4*26e*3D&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775123155*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=LZUT2hJkrpqq6oAafiyY93AeZ0Y5*2BIElyT*2FvQg00xxA*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrIrSbOX-$>

From: Gnso-epdp-team <[email-masked]<mailto:[email-masked]>> On Behalf Of Mueller, Milton L via Gnso-epdp-team
Sent: Wednesday, March 24, 2021 11:13 AM
To: [email-masked]<mailto:[email-masked]>
Subject: [Gnso-epdp-team] On the proposed guidance

I was reading through two documents setting out in detail the proposed guidance on legal/natural.
There seems to be more than one Google doc on this and I am not sure which one is the latest or most official, though I suspect it is the one with various people’s comments crawling all over it.

I was pretty supportive of the Guidance overall. I had one problem with it, though.
I liked the description of HOW the differentiation needed to take place. But in describing WHEN differentiation takes place and WHO would do it, it sets out 3 “high level scenarios”.
The first two are ok. The third scenario (listed as #5 in the document) is that the Registrar does it for the RNH, based on “inferences.”

That option just doesn’t fly for those of us representing RNH’s in this process. We cannot have a registrant’s disclosure status or person type determined FOR them by someone else. If we can strike that part of the guidance, I think we can be on our way to a much broader consensus.

Dr. Milton L Mueller
Georgia Institute of Technology
School of Public Policy
[IGP_logo_gold block]

Confidentiality note: This e-mail may contain confidential information from Clarivate. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this e-mail is strictly prohibited. If you have received this e-mail in error, please delete this e-mail and notify the sender immediately.
_______________________________________________
Gnso-epdp-team mailing list
[email-masked]<mailto:[email-masked]>
https://urldefense.proofpoint.com/v2/url?u=https-3A__mm.icann.org_mailman_listinfo_gnso-2Depdp-2Dteam&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=0mDxsVYvMjNlZVt7T1WG1d3su5W_35Jzbtnhd3H8G_Q&e= <https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.proofpoint.com*2Fv2*2Furl*3Fu*3Dhttps-3A__mm.icann.org_mailman_listinfo_gnso-2Depdp-2Dteam*26d*3DDwMFaQ*26c*3DOGmtg_3SI10Cogwk-ShFiw*26r*3DqQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA*26m*3DqD32H8OIbs1z3Y2bdkOzGc3mUHIMW_Xp_6ZhFqwuQa8*26s*3DKB-Bo9xYcTsaV-lrfJIsfRxB7i_yekkMNRTbi8IUx2s*26e*3D&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775128150*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=H2ANPynAKDzKQLBhECzL9CcbJHMUo7*2FdSZYgEo88B64*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUl!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrHIa2d__$>
_______________________________________________
By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_policy&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=hhVL4UMPyoHI2msETfxYDgoRQFUUZFpOn2PcGqtbQIE&e= <https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.proofpoint.com*2Fv2*2Furl*3Fu*3Dhttps-3A__www.icann.org_privacy_policy*26d*3DDwMFaQ*26c*3DOGmtg_3SI10Cogwk-ShFiw*26r*3DqQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA*26m*3DqD32H8OIbs1z3Y2bdkOzGc3mUHIMW_Xp_6ZhFqwuQa8*26s*3DKI3v50SXH9pcgbjslcb50spSZuwJHRD7_CnwSf_bcXc*26e*3D&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775133136*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=NDZ*2BYKePOzPxclHZgAjRECKNiubTDgtgxx7MMCkFXVc*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUl!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrH_JeK3O$>) and the website Terms of Service (https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_tos&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=s5XJw5lix7BU3ALPpue6_J97VYMDrsn1j-iUhoRi2Ww&e= <https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.proofpoint.com*2Fv2*2Furl*3Fu*3Dhttps-3A__www.icann.org_privacy_tos*26d*3DDwMFaQ*26c*3DOGmtg_3SI10Cogwk-ShFiw*26r*3DqQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA*26m*3DqD32H8OIbs1z3Y2bdkOzGc3mUHIMW_Xp_6ZhFqwuQa8*26s*3DPe4S6hYEUMqw6Eq9DWqbMeaOGnw2zVXTDobhF5xUuY0*26e*3D&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775138127*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=Y8VKBeJalCINEIC7rliHsqnOyrjONW1kRDhJyAmtyL4*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrNuvNea0$>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

Confidentiality note: This e-mail may contain confidential information from Clarivate. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this e-mail is strictly prohibited. If you have received this e-mail in error, please delete this e-mail and notify the sender immediately.
_______________________________________________
Gnso-epdp-team mailing list
[email-masked]<mailto:[email-masked]>
https://urldefense.proofpoint.com/v2/url?u=https-3A__mm.icann.org_mailman_listinfo_gnso-2Depdp-2Dteam&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=0mDxsVYvMjNlZVt7T1WG1d3su5W_35Jzbtnhd3H8G_Q&e= <https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Fmm.icann.org*2Fmailman*2Flistinfo*2Fgnso-epdp-team&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775148110*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=FhYhLs9ZIfeWdQo2ZKzJmRMPvbdNZAiauiOkMwRBQmc*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJQ!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrIlb1dRY$>
_______________________________________________
By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_policy&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=hhVL4UMPyoHI2msETfxYDgoRQFUUZFpOn2PcGqtbQIE&e= <https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Fwww.icann.org*2Fprivacy*2Fpolicy&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775148110*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=eX7HaYSvxHh7a0kVqn0LNrPkCDjoynibiuuxLo0G1kQ*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUl!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrFiUl0Sg$>) and the website Terms of Service (https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_tos&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=s5XJw5lix7BU3ALPpue6_J97VYMDrsn1j-iUhoRi2Ww&e= <https://urldefense.com/v3/__https:/nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Fwww.icann.org*2Fprivacy*2Ftos&data=04*7C01*7Cmarksv*40microsoft.com*7C1fa89fb70c634c80a69c08d8ff73b7e7*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637540219775153100*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=odP*2Fh0hw7IV0xQJrwVfySMr7XGH1Ov8w*2F*2FQs3pUgAmU*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUl!!DOxrgLBm!Sw2huIQRkxq6M2CV8pdbd9i0sPsNMdZA5LTAv03ohTDsoU_C2xQIBIYdLEWoa5ygrPfl7ZbM$>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
_______________________________________________
Gnso-epdp-team mailing list
[email-masked]<mailto:[email-masked]>
https://urldefense.proofpoint.com/v2/url?u=https-3A__mm.icann.org_mailman_listinfo_gnso-2Depdp-2Dteam&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=0mDxsVYvMjNlZVt7T1WG1d3su5W_35Jzbtnhd3H8G_Q&e= <https://urldefense.com/v3/__https://mm.icann.org/mailman/listinfo/gnso-epdp-team__;!!DOxrgLBm!UaHysXz9Oxg62kDxH0vibL1vx7ZSiEuKCKzMR7MhJ0GLY2D6AQ7ZHFtW22xnfD7v4NKcDr2l$>
_______________________________________________
By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_policy&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=hhVL4UMPyoHI2msETfxYDgoRQFUUZFpOn2PcGqtbQIE&e= <https://urldefense.com/v3/__https://www.icann.org/privacy/policy__;!!DOxrgLBm!UaHysXz9Oxg62kDxH0vibL1vx7ZSiEuKCKzMR7MhJ0GLY2D6AQ7ZHFtW22xnfD7v4Heu56iQ$>) and the website Terms of Service (https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_tos&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=s5XJw5lix7BU3ALPpue6_J97VYMDrsn1j-iUhoRi2Ww&e= <https://urldefense.com/v3/__https://www.icann.org/privacy/tos__;!!DOxrgLBm!UaHysXz9Oxg62kDxH0vibL1vx7ZSiEuKCKzMR7MhJ0GLY2D6AQ7ZHFtW22xnfD7v4Dfh2_eS$>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

[https://urldefense.proofpoint.com/v2/url?u=https-3A__ipmcdn.avast.com_images_icons_icon-2Denvelope-2Dtick-2Dround-2Dorange-2Danimated-2Dno-2Drepeat-2Dv1.gif&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=UaVLlnq79HqVAoC5wBalTwpVEA_OYv_bUvEidjU2gaA&e= ]<https://urldefense.com/v3/__https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail__;!!DOxrgLBm!UaHysXz9Oxg62kDxH0vibL1vx7ZSiEuKCKzMR7MhJ0GLY2D6AQ7ZHFtW22xnfD7v4NqSkXfS$>       Virus-free. https://urldefense.proofpoint.com/v2/url?u=http-3A__www.avast.com&d=DwIGaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=nKSCiCiZUY49HTu4JJjOB_DjDc5cFq3698HJa_pTpZU&s=STyXQh60VUMHiOd2lD1_aE4FjJtsIW760vcC4f7J3cs&e= <https://urldefense.com/v3/__https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail__;!!DOxrgLBm!UaHysXz9Oxg62kDxH0vibL1vx7ZSiEuKCKzMR7MhJ0GLY2D6AQ7ZHFtW22xnfD7v4NqSkXfS$>