Dear EPDP Team,
Thanks to all those who
worked on the updated Rec 12, especially Alex Deacon, it was
good to be able to work from your thoughtful updates. I have
attached a revised version of this Recommendation, however I'm
not sure that my tracked changes were successful, here's
hoping.
The RrSG supports the
proposed ""Format by which requests should be made and
responses are provided"", as well as the requirement for the
CP to publish information on their website about how to make a
disclosure request.
It is unclear exactly which text in the Temp. Spec. is to be
updated with the phrase ""requests for lawful disclosure.”
This may be acceptable, if it is limited to the title of the
section; otherwise it would be appreciated if this could be
clarified.
The RrSG does not support a requirement to include a link to
this process in any RDS response, as this may conflict with
the CL&D Policy or the RDAP Profile which remains in
progress with the RDAP WG.
The RrSG notes that the specific legal basis for disclosure
may play a role in determining what information should be
included in the disclosure request, so this can be the minimum
set but it may not work for all scenarios. That said, the
proposed set of information required in the request is
appropriate.
Regarding the timelines for responses, the RrSG would support
the second version of the text: "Contracted Parties must
acknowledge receipt of a Reasonable Disclosure Request without
unreasonable delay, but ordinarily not more than 2 business
days from receipt."
If a timeline for processing and responding to the disclosure
requests must be defined in this EPDP, it should be 30 days,
in order to align with the Art. 12 GDPR timeframe for
providing information to the data subject.
Finally, regarding the proposed four types of responses to a
disclosure request, requiring specific information to be
included in the response is too detailed. We should expect the
CP to provide a reasonably detailed response, including the
info that the Controller determines should be disclosed.
Blanket denials must be permitted where justified, with the
decision made by the CP.
Thank you,
-- Sarah Wyld Domains Product Team Tucows +1.416 535 0123 Ext. 1392