Hello All,

Regarding Recommendation #1, ICANN org has the following questions and would appreciate clarification from EPDP Team:

• There are processing activities related to public WHOIS, which could contain personal data, it would be helpful if the EPDP Team could clarify which purpose(s) this processing activity would fall under.
• Purpose 6: Does the text of this purpose mean that registration data could no longer be used for policies and procedures not specified in the purpose, such as those policies and procedures listed at https://www.icann.org/resources/pages/appendix-11-2013-07-08-en?

Best,

Dan & Trang

ICANN Org Liaisons

From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of Sarah Wyld <swyld@tucows.com>
Organization: Tucows
Date: Friday, January 25, 2019 at 1:14 PM
To: "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org>
Subject: [Gnso-epdp-team] Recommendation 1 Purpose 1 - RrSG Comments

Hello All,

For Recommendation 1 Purpose 1, the RrSG has the following comments:

• Rename this to: Further Processing of Data.

• Within the ICANN context we want to process data collected for a different purpose to be further processed for research purposes
  • What is research within the ICANN context? And does it have scientific purposes?
  • Is the ARS Reporting system research, or as the name indicates a reporting system that flags possible incorrect data? And is this not already in scope of the GDPR?
  • Art 89 and relevant recitals in scope due to whatever research is within the ICANN context?
  • Depending on the research do Art 17 and 21 apply?
• In short with the above in mind, what does the WG think is research and does it require processing of personal data?

-- 
Sarah Wyld
Domains Product Team
Tucows
+1.416 535 0123 Ext. 1392