Dear All, For your information, please find below the notes and action items of small team #2, which met last week to discuss: h) Applicability of Data Processing Requirements h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis? h2) Is there a legal basis for Contracted Parties to differentiate between registrants on a geographic basis? Best regards, Marika, Berry and Caitlin Small Group 2 High-level agreements (Geographic Basis) Charter question h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis? 1. The group seems to agree that contracted parties should be permitted to differentiate on a geographic basis, but there is not agreement whether differentiation should be required or explored. 2. The members who believe geographical differentiation should NOT be required identified several concerns. Specifically, those not in support noted: the actual location of the registrant is not alone dispositive of whether GDPR applies especially because of the widespread industry use of additional processors (e.g., backend registry service providers and resellers for registry operators and registrars, respectively). data subjects need to be informed at the time of collection about how their personal data is being processed, i.e. what data is collected, to whom it is transferred, how long it is stored etc. Also, information on the data subject’s rights needs to be provided, such as the right of access, right to rectification, right to erasure and the right to data portability. Not having a common approach for all registered name holders would give some RNHs these rights, while others would not get such rights. That would potentially lead to two classes of RNHs, which should be avoided. ICANN is about “one world - one Internet”, i.e., global standards and interoperability. Such interoperability would be lost and fragmentation in the marketplace would occur if there were no requirement for taking a single approach at the global level. there are significant liability implications for Contracted Parties if they are incorrect any consensus policy needs to be commercially reasonable and implementable, and in the current market place, differentiation based on geographic location will be difficult to scale ICANN policies should not create competitive advantages for some contracted parties over others - such as a policy may result in certain ICANN accredited Registrars and/or gTLD Registry Operators to seem less appealing to customers (RNHs) due to their establishment in jurisdictions with less stringent privacy protection 3. The members who believe geographical differentiation SHOULD be required; however, they identified several concerns. Specifically, those in support of required differentiation noted: When GDPR was adopted, the global nature of the DNS was not taken into account. It therefore may be shortsighted of the EPDP Team to just focus on GDPR. Applying GDPR to all registrants would undermine the role of sovereign states to be able to enforce their own laws and regulations. Businesses are always required to take into account local laws when choosing to do business with various countries; therefore, cost is not necessarily a persuasive argument to not require differentiation. The Expert Working Group developed a rules engine; perhaps the group can recommend future exploration of the EWG rules engine to see if it is feasible. 4. Some expressed that one option for future exploration could be to consider the EWG rules engine to see if this is a feasible differentiation mechanism or if a differentiation mechanism could be developed in the future. For background, the EWG Report reflected the consensus position of experts convened by the ICANN Board of Directors in 2012 to propose a new policy for WHOIS that complied with applicable privacy regulations, including GDPR. The EWG Report states: The RDS could provide for a legal compartmentalization. Specifically, data elements could be tagged according to the applicable law for the data subject (i.e., the Registrant) and treated accordingly. To achieve this legal compartmentalization, the RDS could implement a “rules engine” that would apply the applicable data protection laws to each specific transfer. More specifically, “rules engine” refers to a feature that could be implemented within the RDS to manage (a) the storage, collection and processing of domain name information based on Registrant, Contact, Registrar, Registry, and RDS jurisdictions (represented by the following data elements: Registrant and Contact Country Code, Registrar and Registry Jurisdictions), and (b) data protection laws of the applicable jurisdictions, in accordance with ICANN's future defined policy for the RDS. The EWG then made the following recommendation: 107. An information system to apply data protection laws (i.e., a “rules engine”) and localization of RDS data storage must be considered as two means of implementing the high level of data protection required. This must be ensured through standard contractual clauses, which flow from a logical privacy policy for the RDS ecosystem. Charter question h2) Is there a legal basis for Contracted Parties to differentiate b/w registrants on a geographic basis? Yes, there is a legal basis for contracted parties to differentiate b/w registrants on a geographic basis. However, the location of the registrant alone is not a dispositive indicator if the GDPR applies. If the controller or any processor is within the EU, the GDPR will also apply. These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates (5 minutes) Attendance will be taken from Adobe Connect Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. h) Applicability of Data Processing Requirements h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis? · The group needs to define the data subject. There are five possible options: o 1. Anyone who is physically located within the borders of the EU, so his data is being processed while he resides in the EU - that would include tourists or people on business trips (and this could extend to months) o 2. A resident of the EU (that is a non EU citizen who has residency in an EU country) and is within the EU borders o 3. An EU citizen who is within the EU borders o 4. An EU citizen or resident who is physically located anywhere and whose data is being processed o 5. A data subject who is located anywhere and his data is being processed in the EU · The group should work on a policy with the type of data covered by GDPR and the types of data that are not. · The group needs to distinguish two layers: (1) what is compliant with GDPR; (2) the policy. Regarding compliance, it's not just entities/persons in the EU, we must also discuss controllers/processors. The policy question to ask: do we want fragmentation in the marketplace - do we want operators to distinguish b/w those who fall under GDPR and who don't? ICANN is about avoiding fragmentation and interoperability of the marketplace. Accordingly, it may be preferred to registries/registrars to treat all customers the same. · From a policy perspective, this is not the first time that privacy and data protection laws has come up at ICANN. We need to be compliant with GDPR, but the policy should not be restricted to GDPR as privacy laws will change over time. It would be more straightforward across the board if the policy didn't only apply to the EU. Contracted parties should not have to differentiate on a geographic basis. · The group needs to focus on where the processing activities are occurring - does the controlling/processing activities occur in the EU? Q: How does the group feel about the proposal that registry/registrar should apply the same standards across the board for data processing? · Registry operators should not be required to differentiate b/w registrars on a geographic basis for the following reasons: o the actual location of the registrant is not alone dispositive of whether GDPR applies o significant liability implications of being wrong o importantly for registries, practical implementation consideration. The RySG believes that any consensus policy needs to be commercially reasonable and implementable. There could be a situation where a Ry (the controller) is not in the EU, the RNH is not in the EU, but the backend provider is. There is also a large reseller market in the registrar space. There are some scaling issues in thinking of all of the various scenarios. · From a policy point of view, it would be better to have a non-fragmented internet. From a practical and implementation point of view, this may not be an easy thing to do. · There was a consensus recommendation that came out of the EWG - they came up with the rules engine, which was the approach to apply the applicable policy for privacy laws. When GDPR was adopted, the DNS was not taken into account. It is shortsighted of us to just focus on GDPR. · The contracted parties may be permitted to differentiate b/w registrants on a geographic basis - the policy should not be applied in a universal manner. The group needs to also take into account data protection laws worldwide. · The group is trying to cope with policy vs. practical implementation issues. Being mindful of the Team's scope, which is to try to make the Temp Spec permanent and not a blue-sky redesign. Is specific geographic implementation possible? o 1. Many countries are busy implementing their own privacy laws, partly b/c they want to set themselves up as a trading partner with the EU. o 2. The GDPR covers EU citizens data. o 3. The group is stuck with the ICANN model. There is a clear legal obligation for the publishing and processing of data. Any outcome of the discussion needs to be commercially reasonable. The only feasible and commercially reasonable position we can use at the moment is to implement the Temp Spec globally, but there may well be PDPs aimed at recognizing resellers that could help in identifying properly European individuals in the system. · ICANN has done a lot over the years to strengthen registrant rights. It is hard to explain to some registrants that they do not have the same rights as other registrants. Registrars needs to inform registrants about what data is used and for what - does this group want registrars to have to differentiate by registrant - this could lead to confusion and fragmentation. · There is also an issue of sovereignty. To apply EU rules to non-EU entities is not a good result. · We all, as companies, have to comply with the laws that apply to us. Just because it is costly is not a persuasive argument. · Cost of implementation should be a consideration and is a persuasive point. The cost for law enforcement and IP to access redacted data is also significant. The issue here is shifting the cost from one entity to another. · The Team should look at the matter from a policy point view saying that I would rather not see a fragmented Internet and all registrants to have the same level of protection everywhere · From a practical and implementation point of view, it will be very difficult to differentiate between registrants based on location; however, it is up to the registries and registrars to speak to this. · The future of the Internet and evolving technologies promises the need for global policies. In addition, and the Team must take into consideration the impact of its decisions on the business and industry. Recap: 1. The group would agree that contracted parties should be permitted to differentiate, but there is not agreement whether differentiation should be required. 2. The group thinks more work can be done regarding implementation of differentiation, e.g., associated costs, practicalities, etc. · Based on interventions by group members (Thomas, Hadia, Emily, Amr) there are group members that contracted parties should not be required to differentiate based on geographic basis - this may be rough consensus. · The small team should not use the term consensus as that term has a specific meaning in the GNSO. · We've addressed the legal basis in Charter Question h2. · For h1, it would be best to summarize the key issues identified. · Could part of the recommendation be to explore the EWG's rule engine?