Dear Kurt, Thank you for your note. We do continue to have some concerns with recommendation 6 regarding data escrow providers, particularly as it relates to the roles and responsibilities of ICANN, the contracted parties, and escrow providers in the processing of gTLD registration data. We would appreciate further discussions with the EPDP Team on this topic. Regarding paragraph 5 of your email, we’re unclear about the statement that “the EPDP Team has identified ICANN as the controller and the contracted parties and data escrow providers as processors.” We were under the impression that the discussion on this topic is still open as (1) we were asked to provide a table/graph that details the data escrow arrangements, and (2) we haven’t seen any analyses on this or documentation of consensus calls from the EPDP Team on this topic. If this is not correct, then please clarify for us. We’ve attached here a draft summary of the key points of these data escrow arrangements and look forward to continuing discussions with the EPDP Team. Related, we’d like to make the EPDP Team aware that as part of the implementation of the Temp Spec (Appendix B), there is a set of parallel conversations going on regarding the necessary arrangements between ICANN, the data escrow providers, and contracted parties, which might help to inform the EPDP Team’s discussion on this topic as well. Thanks again for your email and we look forward to continuing discussions with the EPDP Team on this topic. Best, Dan and Trang ICANN Org Liaisons From: Kurt Pritz <kurt@kjpritz.com> Date: Friday, December 14, 2018 at 3:06 PM To: Daniel Halloran <daniel.halloran@icann.org>, Trang Nguyen <trang.nguyen@icann.org> Cc: GNSO EPDP <gnso-epdp-team@icann.org> Subject: [Ext] Question to ICANN re: Data Escrow Data Processing Agreements Dear Dan and Trang: I am writing to you in your capacity as the ICANN organisation liaisons to the EPDP Team. As you may recall, the EPDP Team discussed Recommendation #6 from its Initial Report [gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_sites_de...> during its meeting<https://community.icann.org/display/EOTSFGRD/2018-12-04+EPDP+Team+call+%2331> on 4 December 2018. The EPDP Team agreed to update the language of Recommendation #6 to the following: “[t]he EPDP Team recommends that ICANN Org develop legally-compliant data processing agreements with the data escrow providers.” While you are likely aware of this recommendation, the EPDP Team thought it important to request in writing that ICANN commence development of legally-compliant data processing agreements with its approved data escrow providers. The EPDP Team discussed and documented<https://community.icann.org/display/EOTSFGRD/e.+Data+Elements+Workbooks> the associated processing activities and responsible parties for registrar data escrow and registry data escrow. Please refer to Purpose E data processing workbooks<https://community.icann.org/display/EOTSFGRD/e.+Data+Elements+Workbooks> for additional information. In its analysis, the EPDP Team has identified ICANN as the controller and the contracted parties and data escrow providers as processors. Accordingly, the EPDP Team encourages you to proceed with developing legally-compliant data processing agreements with those roles as described here and in the Initial Report. If ICANN org disagrees with or wishes to discuss the EPDP Team’s request, analyis or assessment, please engage with the EPDP Team at your earliest convenience and in time to inform its deliberations as it prepares its Final Report. This, we think, will require a response prior to the end of year ICANN shutdown. Thanks very much for taking time to consider this. Sincerely, Kurt