Hi Caitlin, Adding to Amr’s response, I would like to ask a follow up question to ICANN: 1. Has ICANN given any thought to scenarios where the „Organization“ field might contain personal information? 2. As the Organization field shall be populated on an optional basis, has ICANN given any thought to a consent requirement or, where another legal basis than Art. 6 I a GDPR was considered, what legal basis shall be applicable based on what rationale? Thanks, Thomas
Am 18.11.2018 um 13:48 schrieb Amr Elsadr <aelsadr@icannpolicy.ninja>:
Hi,
Thanks for this, Caitlin, and thanks to whoever took the time to write up the responses to the questions.
Regarding the answer to the first question on Purpose M, the response says that the PDDRP rules and the RRDRP rules each require the complainant to provide the name and address of the current owner of an at-issue domain name registration related to the dispute, to the best of the Complainant’s knowledge. This, to me, suggests that the requirement to have this information during the submission of the complaint is not absolutely required for either one of the two DRPs in question to proceed.
Having said that, we’ve received no input on how use or processing of registration data at later stages in the process might be done, noting the part of the response on the current wording of Purpose M. I don’t think we got all the information we need from this response, although we might have some of it.
Will certainly take this into consideration moving forward, nonetheless.
Thanks again.
Amr
On Nov 15, 2018, at 10:56 PM, Caitlin Tubergen <caitlin.tubergen@icann.org <mailto:caitlin.tubergen@icann.org>> wrote:
Dear EPDP Team,
Below, please find answers to questions the EPDP Team posed to ICANN org:
QUESTION: The Temporary Specification for gTLD Registration Data EPDP Team is currently considering language on a “Purpose M <https://community.icann.org/display/EOTSFGRD/e.+Data+Elements+Workbooks?preview=/96207076/96212248/Purpose%20M%20-%20Data_Elements_Processing_Workbook%20-%2022%20October%202018_clean.docx>” regarding ICANN’s role in coordinating the development and implementation of policies concerning ICANN’s dispute resolution processes in the context of domain name registrations. Two of the processes currently being considered within scope of this purpose are the PDDRP <https://www.icann.org/resources/pages/pddrp-2014-01-09-en> (Post Delegation Dispute Resolution Process) and the RRDRP <https://www.icann.org/resources/pages/rrdrp-2014-01-09-en> (Registry Restrictions Dispute Resolution Process). It would particularly be very helpful and important to the EPDP Team if ICANN could provide clarification on any point within the processes of PDDRPs and RRDRPs where processing of gTLD Registration Data is necessary for the dispute resolution processes to be completed. This clarification should identify which (if any) data elements within gTLD Registration Data are necessary, as well as all parties involved in the processing activities.
RESPONSE: The PDDRP rules <http://newgtlds.icann.org/en/applicants/agb/pddrp-rules-15oct13-en.pdf> and the RRDRP rules <http://newgtlds.icann.org/en/applicants/agb/rrdrp-rules-15oct13-en.pdf> each require the complainant (a trademark holder in PDDRP proceedings; an established institution in the relevant community in RRDRP proceedings) to “provide the name and address of the current owner of any at-issue domain name registration related to the dispute, to the best of the Complainant’s knowledge[.]” See PDDRP Rules, Section 3(b)(iv); RRDRP Rules, Section 3(b)(iv). The dispute resolution provider is required to serve the respondent (the registry operator) with a copy of the complaint, and to retain information related to the provider’s transmission of the complaint. Thus, these procedures may result in the complainant, provider, and/or respondent’s processing of gTLD registration data.
It should be noted that neither of these procedures have been used yet. ICANN org would not process gTLD registration data in proceedings of either of these procedures because they are administered by independent dispute resolution service providers. However, if either procedure is used and ICANN org receives a panel’s decision, then that decision would include gTLD registration data.
On another note, the current wording of Purpose M states: “coordinating the development and implementation of policies concerning ICANN’s dispute resolution processes in the context of domain name registrations.” It is unclear how developing and implementation of policy would involve processing of gTLD registration data or personal data.
QUESTION: What is the rationale for not redacting organization field in the Temporary Specification?
RESPONSE:
Including the registrant organization field was determined to be consistent with ICANN org’s stated goal of complying with the GDPR while maintaining the WHOIS system to the greatest extent possible. The name of an organization refers to a legal person and not a natural person and therefore is arguably not covered under the GDPR. Additionally, the organization field is an optional field for registrants so to the extent that the registrant provides the organization name, the Temp Spec allows for publication of that information.
Leading up to the development of the Temporary Specification, ICANN org consulted with the community and the DPAs to determine which data elements should continue to be made publicly available. Through the data matrix <https://www.icann.org/en/system/files/files/gdpr-dataflow-matrix-whois-06nov...> exercise where ICANN org asked contracted parties and interested stakeholders to identify user types and purposes of data elements required by ICANN policies and contracts, 40 user purposes for the registrant organization field were identified.
For reference, Section 5.5.16(i) of the Interim Model for Compliance with ICANN Agreements and Policies in Relation to the European Union’s General Data Protection Regulation (also called the Cookbook <https://www.icann.org/en/system/files/files/gdpr-compliance-interim-model-08...>) states that “the registrant “organization” would be required to be published (if applicable) so that registrations of legal entities would readily include the name of the entity.”
-- Thank you.
Best regards,
Marika, Berry, and Caitlin
<smime.p7s>
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team