Hi All, Here’s a PDF of Hadia’s visio file. B Berry Cobb @berrycobb GNSO Policy Consultant From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of Hadia Abdelsalam Mokhtar EL miniawi Sent: Tuesday, February 25, 2020 08:55 To: Janis Karklins <karklinsj@gmail.com>; EPDP <gnso-epdp-team@icann.org>; gnso-epdp-lead@icann.org Cc: Hadia El Miniawi <hadiaminiawi@yahoo.com> Subject: Re: [Gnso-epdp-team] Guiding questions for the small team meeting on automation Hi All, Please find attached a simple flowchart that I have prepared to guide us in determining the legality of the automated decision making. The flowchart is based on article 22 and the ICO online guide Kind regards Hadia From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Janis Karklins Sent: Monday, February 24, 2020 7:59 AM To: EPDP; gnso-epdp-lead@icann.org <mailto:gnso-epdp-lead@icann.org> Subject: [Gnso-epdp-team] Guiding questions for the small team meeting on automation Dear small team volunteers, Thank you for volunteering to further review the proposals for automated disclosure decisions that were submitted by Mark SV for EPDP Team consideration. As a reminder, the EPDP Team put forward in its Initial Report that “Disclosure decisions should be automated only where technically and commercially feasible and legally permissible”. Please review the latest version of the document (see <https://community.icann.org/x/BhSJBw> https://community.icann.org/x/BhSJBw for the latest version) prior to the meeting and consider for each of the proposals the following question: * Are disclosure decisions in these proposals technically feasible? If yes, how would this be done? If no, why not? * Are disclosure decisions in these proposals legally permissible? If not, why not and what safeguards would need to be put in place that would make the proposals legally permissible? Are there specific legal questions that the legal committee should further consider that would provide further insight into the legal permissibility of these proposals? * Considering the Belgian DPA input that “the GDPR would not prohibit the automation of various functions in an access model. It is not how the disclosure decision is made that matters, but to be able to demonstrate that any algorithm automating decision-making considers the criteria required for such a decision to be compliant with the GDPR”, what criteria would need to be in place to demonstrate compliance for each proposal? * Are there any other proposals that should be considered at this stage? As reminder, the call is scheduled for Tuesday 25 February at 14.00 UTC. Best regards