Dear Kurt and Team: To get us started on the daunting task of drafting replacement language for Section 4.4 of the Temp Spec, we propose to split the processing topics of section 4.4 into categories which parallel the structure of GDPR. The two processing categories we propose are: 1. Those which support the purposes of controllers and others related to the performance of their contracts (registrars, registries, and ICANN) 2. Those which support the purposes of third parties under applicable legal grounds (performance of contract, consent, and legitimate interest) Some items in Section 4.4 of the existing Temp Spec will apply to both categories; some will apply to only one. Even when an item applies to both categories, we propose to discuss the appropriate language separately and in the context of the specific category only. By removing conflation of purposes between parties, this split will facilitate discussion and lead to a more productive drafting process. Further discussion will determine whether ICANN needs to be uniquely broken into its own third category, or whether this two-way split will suffice. A "strawman" breakdown is as follows: Section of existing Temp Spec Processing to achieve the purposes of Controllers Processing to achieve the purposes of Third Parties 4.4.1 Yes - 4.4.2 Yes Yes 4.4.3 Yes Yes 4.4.4 Yes - 4.4.5 Yes Yes 4.4.6 Yes - 4.4.7 Yes - 4.4.8 Yes Yes 4.4.9 Yes Yes 4.4.10 Yes Yes 4.4.11 Yes - 4.4.12 Yes Yes 4.4.13 Yes - /marksv