I fully agree with Marc on this point. In our recommendations, we can not specify something in the temporary specification remain in place as there is a clear expiration date of that document. I support Marc’s text below as a recommendation, which reads: “The EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.” Regards, Matt From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of "Anderson, Marc via Gnso-epdp-team" <gnso-epdp-team@icann.org> Reply-To: "Anderson, Marc" <mcanderson@verisign.com> Date: Wednesday, February 6, 2019 at 6:42 PM To: "kurt@kjpritz.com" <kurt@kjpritz.com>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Fwd: Geographic Basis - Recommendation for inclusion in the Final Report This is intended to be administrative feedback and not at all related to the substance of the recommendation. Can we avoid saying that certain language in the temporary specification should “remain in place”? Once the one year period is up, the language in the temporary specification can no longer “remain in place”. We can confirm it as policy, reject it or recommend modifications to it. This also provides an example of where simply referencing the temporary specification will lead to implementation headaches. As written, sections 2.1 and 3 of the temp spec are specifically noted. Section 2.1 provides the instructions that the requirements in sections 2 and 4 MUST be applied. This includes language that conflicts with other recommendations such as section 2.6 which covers privacy/proxy. Unpacking what is intended by this recommendation from its literal meaning can lead to implementation challenges and delays. Going back and re-reading sections 2.1 and 3 of the temp spec may leave someone confused as to what we intended in our recommendation, particularly if that someone has not been a part of our deliberations. On the other hand the “for the avoidance of doubt” part of the recommendation is clear and to the point. “The EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.” To avoid confusion later, we should consider using just that language, or if there is specific language in sections 2.1 and 3 that are needed, include it in the text of the recommendation itself. Thanks, Marc From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of Kurt Pritz Sent: Tuesday, February 05, 2019 1:43 PM To: EPDP <gnso-epdp-team@icann.org> Subject: [EXTERNAL] [Gnso-epdp-team] Fwd: Geographic Basis - Recommendation for inclusion in the Final Report Hi Everyone: In reference to Kristina’s recommendation for the Geographic Basis discussion below, I have noticed positive feedback thus far. Could those who are interested please comment on this proposal and signal a request for additional discussion if you wish to advocate for different text. Please respond today if possible so that we can schedule the discussion if need be but, in an case, by tomorrow (Wednesday) at the latest. Thx & regards, Kurt Begin forwarded message: From: "Rosette, Kristina via Gnso-epdp-team" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] FW: Geographic Basis - Recommendation for inclusion in the Final Report Date: February 3, 2019 at 5:58:52 AM PST To: EPDP <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Reply-To: "Rosette, Kristina" <rosettek@amazon.com<mailto:rosettek@amazon.com>> Hi, Here’s where I’ve landed and what I propose . (Additions from Kurt’s initial text in bold, deletions in strike through). The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators , i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic, t: * The EPDP Team may reconsider this recommendation in phase 2 of its work. , an * Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. -*- Clean version: The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic, the EPDP Team may reconsider this recommendation in phase 2 of its work. K From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Rosette, Kristina via Gnso-epdp-team Sent: Tuesday, January 29, 2019 9:13 PM To: EPDP <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report Hi, I’m still trying to come up with language for the first part of the recommendation that may address my concerns, Amr’s and Farzaneh’s. In the meantime, my understanding about the rule set idea was similar to Farzaneh’s. K From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of farzaneh badii Sent: Tuesday, January 29, 2019 9:03 AM To: Amr Elsadr <aelsadr@icannpolicy.ninja<mailto:aelsadr@icannpolicy.ninja>> Cc: EPDP <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report Thanks Kurt. I agree with Amr but I don't think Appendix A, section 2.1 and 3 should be included. Those clauses are not about Geo differentiation of "registrants" only. Also I saw the draft final version of the report and there is no consensus to discuss the feasibility conditions and methodology for the development of a rule set, Milton also recorded our objection about this multiple times. Why did it end up in the recommendation again? I suggest deleting the "consider the feasibility ..." bullet point. If we want to dig this topic out again and waste hours of our time discuss whether to do a study on the feasibility of how to provide less data protection for those who are not located in the EU, then we can decide on that in phase 2. Farzaneh On Fri, Jan 25, 2019 at 3:32 PM Amr Elsadr <aelsadr@icannpolicy.ninja<mailto:aelsadr@icannpolicy.ninja>> wrote: Hi Kurt, Thanks for this. It seems fine to me, except that I’m not clear why we would wish for the final report to suggest that the EPDP Team “agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis”. The emphasis here is on the word “should”. I don’t believe this is accurate, as there have been a number of views expressed on why differentiation between registrants on a geographic basis should NOT be done. A few are mentioned in your email below, but several others are not. These might not have been brought up very recently, such as during the review of public comments. However, they certainly were in the discussions leading up to the publication of the initial report. I believe there is still divergence within the EPDP Team on whether Contracted Parties should do anything at all in the context of this recommendation. Furthermore, the Temp Spec doesn’t indicate whether or not Contracted PartiesSHOULD do anything here either. It only says that those Contracted Parties to whom section 2.1 of appendix A is applicable to MUST apply the requirements in sections 2 and 4 of the same appendix, and that those to whom section 3 of appendix A are applicable MAY do the same. I would prefer that the recommendation be amended to simply say: The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic: * The EPDP Team may reconsider this recommendation in phase 2 of its work, an * Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. In practically implementable terms, this achieves the same purpose of the recommendation language you proposed, without suggesting the EPDP Team has reached consensus on whether or not geo differentiation of registrants SHOULD be done. Thanks. Amr On Jan 25, 2019, at 6:05 PM, Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>> wrote: Hi Everyone: With the ongoing goal of progressing issues via email, the leadership and support teams have considered the review of public comment made during the recent plenary conference call and suggests the following language to capture the agreement in principle that was developed on making Geographic Distinctions. Based on that discussion the recommendation below is proposed for EPDP Team consideration. Team Discussion The Initial Report did not contain a Recommendation for the handling of personal data based on geographical considerations. Instead, the Initial Report asked three questions so that the community input could provide a guide for the EPDP Teams deliberations leading to the Final Report. Those questions were: h) Applicability of Data Processing Requirements h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis? h2) Is there a legal basis for Contracted Parties to differentiate between registrants on a geographic basis? The EPDP Team considered the public comment and developed the following thoughts in its deliberations in addressing the charter questions: * The EPDP Team discussed this extensively (as documented in the Initial Report) as well as in the context of the review on the public comments received on the Initial Report. In relation to part of charter question h1, the EPDP Team agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis; * However, the EPDP Team members have divergent views on whether differentiation on a geographic basis should be required. * Recognizing that ICANN is a Data Controller in many scenarios and that ICANN may be considered “established” in Europe (within the meaning of the GDPR), the EPDP Team discussed whether those factors would have an effect upon the discussion and determining GDPR-compliant outcomes. It became clear that legal guidance in relation to the applicability of GDPR in the context of ICANN having an ‘establishment’ in Europe could further inform requirements. * The EPDP Team also discussed the possibility of developing a set of rules for guiding the making of geographical distinctions in an GDPR-compliant manner (akin to the EWG hypothesized “rules engine”). The Team agreed that creating this set of rules was a complex task (just as it would be for individual registrars) and agreed such development could not occur within the remit of this Phase I EPDP. Such a development would also be dependent on the response to the aforementioned legal guidance. EPDP Team Recommendation (a new recommendation as there was none in the Initial Report) The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic: * The EPDP Team may reconsider this recommendation in phase 2 of its work, an * Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. Action Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. If there are additional questions for ICANN Compliance that would serve to inform the deliberations on this recommendation, please share these also. Deadline: Tuesday, 29 January, additional email discussion might follow depending on responses. Best regards, Kurt _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team________________________... Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team