Hi Amr,

If you recall from our numerous discussions on this topic a main point of contention was around how specific we need to be GDPR compliant.   The IPC has always argued that specificity is required - especially when defining which 3rd parties with legitimate interests may be granted access to non-public whois data.    When we landed on the current wording for purpose 2 during the face to face meeting in Barcelona, I raised the concern that it was my experience that many do not believe that "security, stability and resiliency" include IP interests.    This was confirmed as true by three people in the room.    

So it was and still is crystal clear to me vague language - including the language recently suggested by Milton - does not cover IP.    I'm sure you can appreciate why this is a major concern for us.  The compromise language addressed this major issue for the IPC - allowing us to move forward.  

If we all agree that abuse and intellectual property are legitimate interests then we should state it.  As for why are these called out and others are not, the IPC believes they should all enumerated and plans to respond to Question #1 accordingly. 

I'll also refer you to my email to the list on Sep 12th  (seems to long ago!) where I addressed this exact issue.  

"[...]

Also, as you know personal data needs to be collected for specified, explicit and legitimate purposes.  (Article 5(1)(b)) so given we removed "including but not limited to" we need to be explicit and not use general language.    

In addition the principle of transparency mentioned in recital 39 ("In particular, the specific purposes for which personal data are processed should be explicit and legitimate and determined at the time of collection of the personal data") and 58 ("The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand..." are relevant.    This principal is further defined in Article 12(1) and Article 13(1).     "

Thanks. 
Alex





On Sun, Nov 18, 2018 at 10:38 AM Amr Elsadr <aelsadr@protonmail.ch> wrote:
Hi,

I recall that there were questions/concerns raised by this wording of the recommendation that I don’t believe we ever got around to addressing. I’m not sure what the purpose is of singling out abuse and intellectual property in this recommendation. If there is a reason for doing this, it’d be helpful to understand.

I would imagine that a recommendation that reads similar to what Milton suggested would cover both those categories. There are however, other legitimate interests for which lawful disclosure/access to non-public registration data is something we will need to work out in the next phase of the EPDP, apart from abuse and intellectual property. Why do these two get special status in this recommendation?

Thanks.

Amr

On Nov 18, 2018, at 8:06 PM, Mark Svancarek (CELA) via Gnso-epdp-team <gnso-epdp-team@icann.org> wrote:

I think the awkwardness can be resolved simply by changing
 
“standardized access to non-public registration data portion”
to
“standardized access to [the] non-public registration data portion”.
 
Agree with Alex that we should not revise the compromise verbiage beyond the addition of “the”, above.
 
From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of Alex Deacon
Sent: Sunday, November 18, 2018 10:02 AM
To: milton@gatech.edu
Cc: gnso-epdp-team@icann.org
Subject: Re: [Gnso-epdp-team] Some badly needed wording fixes as we finalize interim report
 
Milton, All,
 
I have to strongly object to Milton's suggestion that the text of Rec #2 be updated as he suggests.   We debated the language for Purpose B (now purpose 2 of Rec #1) for weeks if not months - reviewing many versions and numerous iterations.    By the time we all got to Barcelona the current language of purpose #2 is where we ended up and if you remember I expressed the deep concern the IPC had with the language.   
 
In order to move forward James B. suggested a compromise - resulting in what is now Rec #2 - addressing our concern and allowing us to move forward.  I greatly appreciated (and still appreciate) this pragmatic suggestion from James and was encouraged that there was no objection from any of us in the room.  
 
The request that we change the language of Rec #2 essentially undoes this compromise and puts us back in time many weeks.  A major change to the intent of  a recommendation such as this is inappropriate and must not be allowed.  
 
Regards,
Alex
 
 
On Sat, Nov 17, 2018 at 9:14 PM Mueller, Milton L <milton@gatech.edu> wrote:
All, I have been going through the Exec Summary of the interim report and have found some issues. Most of these are grammar or copy editing fixes that I hope we can accept without controversy. One of them has a substantive element, though. 
 
Footnote 2, page 4: “the EPDP Team anticipates taking a formal consensus call..” 
Shouldn’t this be “WILL take a formal consensus call…” To say "anticipates" sounds like we might not do so if it’s not convenient. We are required to take a consensus call
 
Line 150-151: The wording of Preliminary Rec 2 is awkward and ungrammatical. It now reads:
 
“The EPDP Team commits to develop and coordinate policy in the system for standardized access to non-public registration data portion of this EPDP regarding lawful access for legitimate third-party interests regarding abuse or intellectual property to data identified herein that is already collected.” This should be changed to:
 
“The EPDP Team commits to develop and coordinate policy for disclosure of non-public registration data to third parties with legitimate interests.”
 
Page 6, footnote 3. Delete. I thought we had agreed that after agreeing on Preliminary Agreement #3 that new policies on accuracy were out of scope.
 
Page 6, footnote 4. This can be deleted, as the same text is included later on in page 7, lines 170-172
 
Milton Mueller 
_______________________________________________
Gnso-epdp-team mailing list
Gnso-epdp-team@icann.org
https://mm.icann.org/mailman/listinfo/gnso-epdp-team