Hi Milton,

 

Thank you for the constructive intervention. Your point is well taken, and I can certainly see that from the RNH perspective.

 

One feature of data protection law related to your point is that it requires data controllers and processors to be able to demonstrate compliance with the law. A controller or processor could doubtfully demonstrate compliance with data protection law if they had not determined whether they were actually processing personal data. In fact, data protection professionals will tell you that you absolutely must determine what personal data you’re processing as the first step toward compliance with data protection law. It seems the policy question is: what, if anything, should contracted parties be required to do based on the status of the data? Is that right?

 

As always, we’re happy to work with you and look forward to finding consensus.

 

 

 

 

I was reading through two documents setting out in detail the proposed guidance on legal/natural.

There seems to be more than one Google doc on this and I am not sure which one is the latest or most official, though I suspect it is the one with various people’s comments crawling all over it.

 

I was pretty supportive of the Guidance overall. I had one problem with it, though.

I liked the description of HOW the differentiation needed to take place. But in describing WHEN differentiation takes place and WHO would do it, it sets out 3 “high level scenarios”.

The first two are ok. The third scenario (listed as #5 in the document) is that the Registrar does it for the RNH, based on “inferences.”

 

That option just doesn’t fly for those of us representing RNH’s in this process. We cannot have a registrant’s disclosure status or person type determined FOR them by someone else. If we can strike that part of the guidance, I think we can be on our way to a much broader consensus.

 

Dr. Milton L Mueller

Georgia Institute of Technology

School of Public Policy