Agreed. This sets the bar so low that there is effectively no bar, and sets the stage for rampant abuse and fishing expeditions. I believe everyone agreed that Registrars should disclose personal information in response to an actual (not “potential”) UDRP filing, so let’s focus there. J. ------------- James Bladel GoDaddy From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of Lindsay Hamilton-Reid <lindsay.hamilton-reid@fasthosts.com> Date: Thursday, November 8, 2018 at 04:59 To: Amr Elsadr <aelsadr@icannpolicy.ninja>, "milton@gatech.edu" <milton@gatech.edu> Cc: "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Purpose M - UDRP Information Hi all In addition to Amr and Milton, a potential UDRP case is not sufficient reason to disclose the data. You don’t need the data to file a UDPR case anyway. Once the information is filed, we would then disclose the data as required by the UDRP process. Come on everyone, let’s keep the suggestions within the law. Many thanks Lindsay Lindsay Hamilton-Reid Senior Legal Counsel Direct: +44 (0)1452 509145 | Mobile: +44 (0)7720 091147 | Email: Lindsay.Hamilton-Reid@1and1.co.uk<mailto:Lindsay.Hamilton-Reid@1and1.co.uk> www.fasthosts.co.uk<http://www.fasthosts.co.uk/> www.1and1.co.uk<http://www.1and1.co.uk/> [fh-1and1] © 2015 All rights reserved. Fasthosts is the trading name of Fasthosts Internet Limited. Company registration no. 03656438. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 720821857. 1&1 is the trading name of 1&1 Internet Limited. Company registration no. 03953678. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 752539027. This message (including any attachments) is confidential and may be legally privileged. If you are not the intended recipient, you should not disclose, copy or use any part of it - please delete all copies immediately and notify 1&1 on 0844 335 1211 or Fasthosts on 0333 0142 700. Any statements, opinions or information in this message are provided by the author, not on behalf of 1&1 and/or Fasthosts, unless subsequently confirmed by an individual who is authorised to represent 1&1 and/or Fasthosts. [linkedin]<http://www.linkedin.com/company/fasthosts-internet-ltd>[twitter]<https://twitter.com/Fasthosts>[facebook]<https://www.facebook.com/fasthostsinternet>[gplus]<https://plus.google.com/u/0/b/107582097021398424605/+fasthosts/posts>[blog]<http://blogs.fasthosts.co.uk/>[youtube]<http://www.youtube.com/user/Fasthostsinternet> From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Amr Elsadr Sent: 08 November 2018 10:54 To: milton@gatech.edu Cc: gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] Purpose M - UDRP Information Hi, I would add that although this is true: On Nov 6, 2018, at 1:16 AM, Margie Milam <margiemilam@fb.com<mailto:margiemilam@fb.com>> wrote: Hi Marika & All – Yes this is different than Purpose B because it has a direct contractual basis, meaning that the registrant has agreed in the registration statement to submit to dispute resolution proceedings such as the UDRP/URS. The UDRP would be broken if there was no contractual basis to require the registrant to submit to these proceedings. RNHs do not agree in their registration agreements to submit to “Potential” dispute resolution proceedings, namely UDRP/URS, but only to DRPs that have been formally filed. So as Caitlin pointed out, the rules of the UDRP would need to be amended to allow for this, as they currently do not. The same is true for the actual domain name registration agreements, which justifies 61b as a lawful basis for Purpose M. Unless both of these changes take place, I don’t see how 61b could be applicable to disclosure of redacted RNH data prior to a UDRP being launched. It would seem to me that these changes are out-of-scope of this EPDP, and are better taken up on the Review of all RPMs in all gTLDs PDP. When/if that is taken up on that PDP, part of the review should certainly address the concern that Milton has raised below. For now, we should restrict our policy recommendations to how the UDRP and URS have always worked. Thanks. Amr On Nov 8, 2018, at 11:35 AM, Mueller, Milton L <milton@gatech.edu<mailto:milton@gatech.edu>> wrote: Caitlin and fellow ePDP members: “Potential” UDRP complainants? This cannot be a serious proposal. Anyone in the world with a trademark is a “potential” complainant under the UDRP. This is in reality a request for automatic disclosure of PII to anyone who wants it, a transparent attempt to return to a public Whois. So, no, this is not supported by the ePDP; it should not even be listed in the interim report as a proposed change because it is almost certainly not legal under GDPR. Dr. Milton L. Mueller Professor, School of Public Policy Georgia Institute of Technology From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Caitlin Tubergen Sent: Wednesday, November 7, 2018 5:52 PM To: Margie Milam <margiemilam@fb.com<mailto:margiemilam@fb.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Purpose M - UDRP Information Hi Margie and Team, Thank you for the clarification. If we understand correctly, the BC is of the view that disclosure of Personally Identifiable Information to a third party (the complainant) BEFORE filing a UDRP proceeding is necessary in order for the registrar to fulfil its obligations under its agreement with the Registered Name Holder. Accordingly, the BC would like disclosure of RNH Personally Identifiable Information to potential UDRP complainants included in the Purpose M workbook as a processing activity under 6(1)(b) lawful basis and a corresponding note added to the Initial Report. Please note this would likely require a change to the UDPR Rules to consider this step as an integral part of the UDRP. In order to determine if this proposed change is supported by the rest of the EPDP Team, please share on the mailing list if you recommend this change to Data Elements Workbook M and the related changes to the UDRP – and if so, describe the change. Depending on the level of support, these updates will either be made, or it will be called out as a proposed change supported by certain groups on which further input can be requested during the public comment period. Thank you. Best regards, Marika, Berry and Caitlin From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Margie Milam <margiemilam@fb.com<mailto:margiemilam@fb.com>> Date: Monday, November 5, 2018 at 3:17 PM To: Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Purpose M - UDRP Information Hi Marika & All – Yes this is different than Purpose B because it has a direct contractual basis, meaning that the registrant has agreed in the registration statement to submit to dispute resolution proceedings such as the UDRP/URS. The UDRP would be broken if there was no contractual basis to require the registrant to submit to these proceedings. As a result, there is no balancing test to be applied (like what occurs under Purpose B), and thus there is no possibility of the registrar not providing the data to a potential complainant for the UDRP. Right now, we are experiencing this very situation in response to our requests under the Temp. Spec. Some registrars will NOT provide the data to the potential complainant but instead we receive a response to “file a UDRP” which is not the appropriate response under the Temp Spec. Access is needed before the filing to make the determination of whether to file at all. With respect to your additional question – we are asking for this to be an additional step before filing a UDRP, and would need to be noted in the Initial Report. I am happy to explain further on tomorrow’s call if necessary. All the best, Margie From: Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> Date: Sunday, November 4, 2018 at 9:32 To: Margie Milam <margiemilam@fb.com<mailto:margiemilam@fb.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Purpose M - UDRP Information Thanks, Margie. Per the action item, could you provide further details as to how this disclosure to the complainant is different from the disclosure that is already foreseen under Purpose B (“Maintaining the security, stability and resiliency of the Domain Name System in accordance with ICANN’s mission through the enabling of lawful access for legitimate third-party interests to data elements collected for other purposes identified herein”)? Also, if this disclosure is deemed consistent with Purpose M, in your view, does this mean the UDRP would need to be modified accordingly as it currently does not foresee a step in which the complainant reaches out to the registrar for this information before filing a UDRP? If so, this would need to be noted accordingly in the Initial Report. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Margie Milam <margiemilam@fb.com<mailto:margiemilam@fb.com>> Date: Friday, November 2, 2018 at 8:00 PM To: "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] Purpose M - UDRP Information Hi- Following up on the action items for this item, please find attached our suggested changes to Purpose M, which include input from the IPC and the BC. We have asked for these additions because it is important to ensure that the complainant is able to fully assess the strength of the claim and the nature of the bad faith of the registrant in order to prove the elements of the dispute resolution process (URS/UDRP). To avoid the filing of ungrounded UDRP complaints, this purpose is fulfilled by making the disclosure before the complaint is filed. Also with regard to the other dispute resolution processes, we note that PDDRPs can be brought based on systemic registrant behavior, and thus there may be instances where this purpose would be relied on to access registrant contact data. Under the PDDRP, the subject matter of the dispute is the gTLD and its use by the operator - including any second-level domain names registered to the registry operator or a related third-party, to the extent the registry operator is complicit in trademark infringement. Similarly RRDRPs are available to complainants to prove a registry is not complying with its registration restrictions, which may require access to registration data, as it relates to the registration restriction. For example, if there is a TLD that is limited to registrants located in a particular geographic region, those elements would need to be accessed for this purpose. There are also registries that have specific RPMs that would fall under this purpose. For example some registries have voluntarily adopted RPMs in their contracts, which would also appear to fall in this Purpose M category (for example, .XXX added a “Rapid Evaluation Service Policy” procedure in their registry agreement to address abusive registrations). Finally, to address Kristina’s concern about potential abuse, there are ways to address this so that it is not grounds for a phishing expedition, such as: * Requiring the trademark holder to represent that they have a good faith intent to file a UDRP or other dispute resolution mechanism or cybersquatting action * Dispute resolution providers should be able to audit requests to ensure that the requester filed a UDRP/URS or legal complaint, or in good faith determined that no grounds existed. Have a great weekend everybody! Margie
