Dear EPDP Team, In an effort to organize the outstanding issues in the Initial Report, ICANN Support Staff has created the attached Outstanding Issues Table. As previously noted, all outstanding issues in the Initial Report are highlighted in either blue, which denotes items currently under discussion, or red, which denotes items that have not been discussed. The table is intended to serve as a tool to assist in organizing the outstanding issues, and it’s divided into three categories, which denote the proposed method of review as follows: Outstanding Items to be Discussed by Mailing List, followed by EPDP Team Call Outstanding Items where an EPDP Volunteer is needed to draft proposed answers to Charter Questions Outstanding Items to be addressed via Mailing List, followed by call only if call is deemed necessary Admin or Policy Issues to be addressed via Mailing List The table also details: the corresponding Initial Report page(s) overarching topic specific issue proposed deadline relevant notes (which may include, for example, an email or wiki reference) Below, please find a high-level summary of the issues in each category. Items to be introduced via email, followed by EPDP Team call Purpose M (UDRP) – the remaining issue is disclosure of data subject information to possible UDRP Complainant, prior to filing the complaint. Since UDRP has not yet commenced: (a) is Purpose B sufficient for this data disclosure; (b) do the UDRP Rules need to be updated to reflect this new processing activity? Note: disclosure to complainant is not currently required under the UDRP Rules. Geographic Basis Differentiation – EPDP Team to discuss two compromise approaches (email from Monday, 5 November). Legal vs. Natural Persons-- EPDP Team to discuss two compromise approaches (email from Monday, 5 November). Disclosure of Technical Contact – EPDP team to confirm the proposed language that notes if a registrant optionally provides technical contact information, it should be that registrars must obtain the required consent in order to disclose this information Redaction of Registration Data – The EPDP Team recommends that redaction must be applied as follows to the data elements that are included in the initial report table. These data elements were discussed but had not received the full consensus of the group and should be discussed before going to public comment as an open issue: 1. Registrant Organization (currently shown as published) 2. Registrant City (currently shown as redacted) 3. Registrant State / Province (currently shown as redacted) Responsible Parties – Does the EPDP Team agree with the designation of responsible parties within the responsible parties document? Please refer specifically to the provided definition of joint controller within the document. Items where an EPDP Volunteer is needed to draft proposed answers to Charter Questions Data Processing Terms – EPDP Team Member needed to draft responses to Charter Questions k2, l4, m4, having to do with responsibilities in processing data. This is the replacement for language in sections 5-7 in the temporary specification. Issues to be addressed via email thread Data Escrow - On Thursday’s call, EPDP members noted ICANN should take geographical implications into account during the registry/registrar transition process. Support staff has drafted the following language: [The EPDP Team recommends that when designating a gaining registrar or emergency back-end registry operator (“EBERO”) to take over for a registrar or registry operator, ICANN shall consider the geographical implications. For example, if the failing registrar/registry is located within the European Economic Area and therefore subject to the GDPR, ICANN shall endeavor to appoint a gaining registrar or EBERO within the EEA, and ICANN shall update its procedures accordingly.][1] Data Retention - Does the EPDP Team agree with a de facto data retention period of registration period + one year? (The one year period conforms to the specific statute of limitations under the Transfer Dispute Resolution Policy.) Third-party Beneficiaries - A suggestion was made during the LA F2F meeting with respect to third-party beneficiaries – are there any concerns about adding this preliminary recommendation to the report? [The EPDP Team recommends that identification of Data Controllers & Processors or other recommendations made in this report will not affect “No Third-Party Beneficiary” clauses in existing ICANN-Contracted Party agreements.] Admin or Policy Issues to be addressed when Initial Report is Completed Sunsetting WHOIS 30-day Comment Period Draft language and preliminary recommendations concerning: Corresponding Consensus Policy updates Policy implementation (avoidance of gap b/w Temp Spec expiry and Policy Effective Date) Policy impact change analysis Thank you. Best regards, Marika, Berry and Caitlin [1] With respect to gaining registrars, ICANN shall update its De-Accredited Registrar Transition Procedure. With respect to EBEROs, ICANN shall update its gTLD Registry Transition processes.