Hi Dan: I am sure you have already read Alan’s request below. Can ICANN provide relevant portions of the agreements ICANN has with these dispute resolution providers? They might be the entire agreements with financial terms and other confidential (GDPR-protected?) information redacted. I think this might be the most helpful to avoid the time needed for future requests. You may provide a slimmer set of of contract details if you feel confident, that will address the team’s questions. I assume that there were post-GDPR amendments to these agreements and these should be highlighted as such if that is not already apparent. Let me know if you have questions or, in the name of time saving, you could also contact Alan directly. As you know, time is of the essence, the clock is ticking and so on. Thanks very much and best regards, Kurt
Begin forwarded message:
From: Alan Woods <alan@donuts.email> Subject: [Gnso-epdp-team] Pre-emptive request for our consideration of Appendix D&E Date: September 1, 2018 at 4:34:48 AM GMT+10 To: gnso-epdp-team@icann.org
Dear Kurt and team,
In advance of our substantive discussions on the elements of the RPMs within the Temp Spec (Appendix D and E), in the interests of not delaying our deliberations at that time, I believe it prudent for the EPDP team to have the opportunity to review the agreements that ICANN has with the RPM providers, (or at least the Data Processing Agreements), so as to fully consider all safeguards in place, thus tipping the balance in favor of disclosure of the data to the RPM providers.
As we already indicated in our triage response, we generally have no issue with the appendix (notwithstanding some process changes on the RPM review side being likely necessary). This does not absolve us however from fully considering the data flow, to confirm the appendices. Our task should be to do a thorough assessment of the required disclosure; documenting the purpose and legal basis for the disclosure; the safeguards applicable to the disclosure; and, in this case, complete our a consideration of the balance of the data subject rights. As the contracted parties do not maintain a direct contractual relationship with any RPM provider, we will therefore need to consider the applicable data processing agreement, to confirm how that data will ultimately be processed by the RPM provider (i.e. drawing inspiration from those elements required under Art 28 of the GDPR - Data Processor Requirements). This will allow for our transparent and well rounded consideration of the data flow, the safeguards in place, leading to a strong outcome for the EPDP consideration of the appendices.
As such, I would request that, in the interests of time, the EPDP now requests sight of the relevant documents (whether that be the full agreement or the applicable data processing agreements) from ICANN so that we can duly consider it in the assessment of the appendices when we arrive at that point, in the hopes of moving swiftly along.
Kind regards,
Alan Woods
<http://donuts.domains/> Alan Woods Senior Compliance & Policy Manager, Donuts Inc. The Victorians, 15-18 Earlsfort Terrace Dublin 2, County Dublin Ireland
<https://www.facebook.com/donutstlds> <https://twitter.com/DonutsInc> <https://www.linkedin.com/company/donuts-inc> Please NOTE: This electronic message, including any attachments, may include privileged, confidential and/or inside information owned by Donuts Inc. . Any distribution or use of this communication by anyone other than the intended recipient(s) is strictly prohibited and may be unlawful. If you are not the intended recipient, please notify the sender by replying to this message and then delete it from your system. Thank you. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team