Hello, Thank you to Laureen, Chris, and Melina for your proposed changes. I’m fine with the updates to the introductory paragraph. The RrSG-proposed version relies on guidance that has already been received from relevant data protection authorities; it is not providing legal advice. I have attached an updated version which has footnotes with links to the relevant guidance. Replacing the points a-d with direct quotes from GDPR Art. 5 does not, in my view, bring any added benefit. The reader of this Report can reference the GDPR directly whenever they need to do so. I understand that there is an objection to paraphrasing the GDPR, but there have been no specific concerns raised with these descriptions of how to adhere to these GDPR principles, so although there are legitimate concerns about the deleterious effects of paraphrasing/providing excerpts from Bird & Bird legal memos, I have seen nothing to indicate that the same concerns are at issue here. Overall the actual specific guidance provided by the RrSG team is almost entirely unrepresented in the Initial Report, and removing these points a – d simply finishes the job of erasing it, so I cannot support these alterations or removing section D entirely (as was proposed in one of the input charts). I do see that it may not be a good fit in the Background section and may be more appropriately located in the Guidance section, so I would be in favour of moving it to that part of the report. Thank you. -- Sarah Wyld, CIPP/E Policy & Privacy Manager Pronouns: she/her swyld@tucows.com +1.416 535 0123 Ext. 1392 From: Kapin, Laureen via Gnso-epdp-team Sent: May 28, 2021 6:00 PM To: gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] Notes and action items - EPDP Phase 2a Meeting#25 - 27 May 2021 For clarity – the attachment in the prior email reflects the GAC’s current position. We are still hoping to work this through with Sarah. Laureen Kapin Acting Assistant Director Division of Consumer Response and Operations Bureau of Consumer Protection Federal Trade Commission From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of Kapin, Laureen via Gnso-epdp-team Sent: Friday, May 28, 2021 5:29 PM To: gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] Notes and action items - EPDP Phase 2a Meeting #25 - 27 May 2021 Hi folks, We wanted to update you on our deliberations about paragraph D of the Background and Team Observations starting at line 256. We’ve been conferring with Sarah W. on a way to move forward and address our preference to avoid: 1) paraphrasing select parts of the GDPR and 2) providing legal advice rather than policy guidance (other than referencing the legal memos). Our team hasn’t had a chance to finalize our deliberations because of the difference in time zones and competing demands of other time sensitive work but the attached proposal reflects our current thinking. Please excuse formatting and note that the line #s do not match the revised Draft Report because of the edits. Kind regards, Laureen Kapin Acting Assistant Director Division of Consumer Response and Operations Bureau of Consumer Protection Federal Trade Commission From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of Caitlin Tubergen via Gnso-epdp-team Sent: Thursday, May 27, 2021 2:31 PM To: gnso-epdp-team@icann.org Subject: [Gnso-epdp-team] Notes and action items - EPDP Phase 2a Meeting #25 - 27 May 2021 Dear EPDP Team, Please find below the notes and action items from today’s call. Best regards, Berry, Marika, and Caitlin 💥 📣 🛎 🚨 Action Items 🚨 🛎 📣 💥 1. EPDP Team members are to review the input form with the proposed resolution of cannot live with items, Keith’s email (https://mm.icann.org/pipermail/gnso-epdp-team/2021-May/003937.html) the updated section 3 of the Initial Report (https://drive.google.com/drive/u/0/folders/1TW3Z-s6DzS2QsV_VwJ6iUQTvKVIXQrmG) and indicate what changes/updates are essential FOR THE PURPOSE OF THE PUBLICATION OF THE INITIAL REPORT in this table BY CLOSE OF BUSINESS, FRIDAY 28 MAY. As such, you are encouraged to focus your input on any clarifying edits and/or questions that should be added to encourage community input. Input table: https://docs.google.com/document/d/1aaDULVrGIkWXEGfoal8RqkC_baNjmVvujgk1HIyo.... 2. Deadline for flagging any minor edits / corrections by 16:00 UTC on Friday, 28 May. (https://docs.google.com/document/d/1aaDULVrGIkWXEGfoal8RqkC_baNjmVvujgk1HIyo...) 3. RrSG and GAC to come forward with proposal for updated Guidance D to factor in concerns addressed (References to “controller” are not helpful as ICANN has recently avoided ‘admitting’ its controllership. Each CP must determine for itself if/how data protection law might impact its processing. This appears to be quasi-legal advice, which should be avoided. We should also avoid paraphrasing the GDPR) by Friday, 28 May. 4. IPC and GAC reps to come forward with a proposal for footnote 8, “8 The personal/non-personal distinction only applies/is relevant for registrants who have self-identified as legal persons” by Friday, 28 May. 5. RySG to come forward with a proposed question to put forward to the community in relation to the standardized data element to obtain further input on whether changes should be considered to the terminology used or the type of data element proposed by Friday, 28 May. 27. 6. GAC to liaise with RySG to address the concerns of the RySG regarding the GAC-proposed feasibility recommendation. (Note: GAC has suggested the RrSG proposed suggestion could be a viable alternative.) 7. Groups who support including a recommendation on webforms to formulate specific questions for community input factoring in the concerns of other groups that have been expressed on the mailing list. EPDP Phase 2A - Meeting #25 Proposed Agenda Thursday 27 May 2021 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (Chair) (5 minutes) a. “Cannot live with” items take-aways - 77 items were addressed as cannot live with, which is very concerning - Each group will be asked to speak for 1-2 minutes about a proposed path forward for the group. - Your group can discuss a path forward in a general sense or discuss specific items - Cannot live with items are typically used to indicate fundamental disagreement for a Final Report. This group is not there yet. We are developing proposed text and questions to seek public comment on. - Struggling with the number of cannot live with items at this stage of the process b. Approach & expected next steps for Initial Report publication 3. Consider any remaining “cannot live with” items identified by EPDP Team members after review of Initial Report input form with proposed solution and redline version of updated Initial Report a. Consider items submitted prior to the meeting - RrSG: Members have approached this group and work with unrealistic expectations regarding changes that are beyond the scope of this group’s work and are unhappy that they cannot achieve what they want. - ALAC: part of the issue is timing. To some extent, maybe if we had more time to talk, digest, and consider these documents, there would have been more time to consult with our constituencies. Many concerns were resolved with the staff issues, but the other issues need to be resolved one-by-one. - BC: This is not just the timing issue. There is also a tone issue. This is about optional guidance; it is not about imposing requirements. In the ICANN model, when the status quo is favored, you have the option to be magnanimous when opposing change. BC has been on both sides; however, BC has never brutally disparaged other interests, but that is happening in this group. - RrSG: Interesting to hear ALAC and BC raise similar concerns as the RrSG. RrSG’s concerns that have been repeatedly raised are hidden in footnotes. It’s important to ensure arguments have equal time. - GAC: Believe the group is closer than we think – confident that we can get to “yes” with everyone being equally unhappy. When GAC reviewed additions from the RySG and saw what was a neutral but barebones description, GAC thought it needed to include the same so that there is a balance. It is fair for everyone to be mindful of wanting to achieve a balanced and objective view in the report as to the state of play and clear indications of where we disagree for the purpose of soliciting public comments. If some groups put in text that tilt the scales, they should expect the other side to respond. It’s fair to ask everyone to forbear but not reasonable to expect groups to not put their perspective down. It may be helpful for groups to mutually disarm. We may need another week to review the changes that Staff has made. - Beyond a week extension, we would need to go back to the Council for a project change request. - NCSG: Think we should modulate our expectations for this report. Even though we are arguing about fine points. It is fair in an initial report – we worked on this for [x] months, there are still firmly-held positions. One side says this, and the other side says this, so that it’s clear to the reader what the two positions are. We should not pretend we have consensus when we don’t. - ALAC: in taking a look at the contentious parts of the report – the introduction is very contentious. With respect to the actual substance and concrete recommendations of the report, the group is closer to consensus. - IPC: More time may be needed to digest the changes. It would be helpful to have the line numbers updated for the new version. - ISPCP: Pleased to review Keith’s email – did not put any can’t live with items in this table. There seems to have been a lot of time devoted to items that are not in scope. What we may be seeing here is a process where items that are out of scope are not included in this report and a process of mourning. We need more time for reflection on the scope. Based on these conversations, it seems that we may be closer than we thought. - SSAC: Concerned with getting the group back on track and working toward consensus. - RySG: RySG has made interventions re: scope. This group has a specific task to go by. EPDP has become a work horse where groups continually bring things to the table. There are a lot of eyes on the MSM; it’s important to follow the process and stay in scope. If we do not agree with the guidance or agree that it will be helpful to CPs, then it is not good guidance. It’s important to point out in FN13 that three of the members of this team believe that this should be mandatory. There has been a mixed message. - Thank you to all for the frank conversation. There is a general view that we are closer than it appears. There is a recognition that we can do some work over the next week and that we need to clearly resolve some of the cannot live with designations. We need everyone to go back to the cannot live with designations. These are significant and mean something when staff and leadership does its analysis to try to resolve issues. The way forward: all groups to review the responses to the cannot live with items, review Keith’s email from yesterday, and the latest version of the Initial Report with the redlines. What needs to be added in terms of questions to ensure we get meaningful input in the public comment forum. b. Confirm next steps 4. Consider items flagged for further discussion and resolution (see list of blue items): a. Should standardized data element recommendation include reference to extensibility? Is this a necessary missing element or can this also be considered after public comment? - This is a field meant to talk about registrant type. There may be value in not unduly restricting this field if we want to expand this field in the future. - Registries do not support this as a field in the public RDDS, but do support this being a standardized data element for registrars who choose to differentiate. Concerned with the fields we have standardized own – this seems to contradict the Team’s own advice that legal/natural distinction is not dispositive for whether the registration contains personal data or not. Concerned that legal/natural/unknown are not the right fields. For that reason, wise of SSAC to suggest some flexibility here. - This is in the RDDS period – a question later on is if this should be public. The Initial Report asks a question about whether this should be sent to the SSAD. Thought “unknown” was changed to “unspecified” since unknown is unclear as to who doesn’t know it. - Seems that RySG is saying the data element should be extensible, could be for example, legal but contains personal data. That statement does not contradict the statement from SSAC. Agree that “unknown” is not as good as “unspecified”. - RySG to include a question for public comment re: this field. The question is around the fields to be standardized, and we need to come to agreement on a question to pose that can help inform the discussion on this. If the text doesn’t have the right fields, we need input on how to get input on what the right fields are. - ALAC is adamant that the field should be added to RDDS, not necessarily the public RDDS. If there are too many values, the field may not have as much utility. - If there are not the right fields, what could they be, what should they be? - This is a question of sorting. This is an initial sorting of legal, natural, or unspecified. The question of whether personal data is present, is a separate analytical issue. This concern is already reflected in the guidance. - The distinction b/w legal and natural is not relevant for all data protection law. The whole idea of managing personal information by asking about legal v. natural misses the point. b. Footnote 5 – GAC to confirm whether this footnote must remain as it is a cannot live with item for the IPC. Footnote was originally added at the request of the GAC. c. LvN Background Information D. – GDPR Principles that may apply. RrSG Team has indicated that this is important guidance to Registrars, others (IPC, GAC, ALAC, GAC) have indicated concerns with this language. GAC & RrSG were assigned action item to come up with a mutually acceptable approach. - GAC has no opposition to referencing principles; however, uncomfortable with paraphrasing the GDPR and picking certain principles over others. - Not in favor of striking section D – it’s important to convey the GDPR principles. This is a way to incorporate the guidance registrars have been trying to provide all along. d. New recommendation (submitted after the deadline) re. LvN Guidance - The guidance does not include the key advice – if the legal registration does not include personal information, it should be published. The “money issue” is omitted – it’s only included in the scenarios, which is not guidance. This issue has been raised all along – this is a real, true cannot live with item. - Support previous comment – we have guidance, which is not mandatory, saying if you choose to differentiate, this is how to do it, but we don’t have the result of it. In other words, every registrar could differentiate, but there is still nothing published. The registry comment is talking about publishing the type, and this is not what the sentence is saying. This is about publishing the actual data, not the flag. - This is something that registrars can decide to do field by field. - Question is to the registries – this feedback is based on a different topic than what the text was. This appears to relate to the publication of the legal/natural flag. - Can agree to a should but not a must - Do not agree with the two-levels of permissiveness – it’s already guidance – why does it also need to say should? e. New recommendation (submitted after the deadline) re. web forms - The target of a PDP should not be “we followed the rules”; the target should be good policy. If we are not going to recommend pseudonymized emails, there is an impact of that decision, and that is why the web form recommendation is suggested. f. New recommendation (submitted after the deadline) re. feasibility - This is not a new concept; this is the crux of these discussions so that it can be identified for public comment. With the registrar’s suggested text, hoping to get to “yes”. - Is this new language being proposed as guidance? - Answer: yes. g. Confirm next steps - Provide an opportunity or a path for including the bracketed language unless there is strong disagreement. - If there is general agreement that this text can be included after additional wordsmithing; however, if there is significant disagreement, may have to set them aside. - Over the next 24-36 hours, please spend time on these outstanding items to get this across the finish line. Plan to schedule meetings on Tuesday and Thursday 5. Public Comment Forum a. EPDP Team to provide suggestions for how to best solicit input from the community and avoid restatements of already known positions and/or information. b. Confirm next steps 6. Homework assignments reminder • By Friday 28 May at 16.00 UTC, EPDP Team to review latest version of the Initial Report and submit any minor edits / non-substantive comments. 7. Wrap and confirm next EPDP Team meeting (5 minutes): a. EPDP Team Meeting #26 Tuesday 1 June at 14.00 UTC (if necessary) b. Confirm action items c. Confirm questions for ICANN Org, if any
