Geographic Basis - Recommendation for inclusion in the Final Report
Hi Everyone: With the ongoing goal of progressing issues via email, the leadership and support teams have considered the review of public comment made during the recent plenary conference call and suggests the following language to capture the agreement in principle that was developed on making Geographic Distinctions. Based on that discussion the recommendation below is proposed for EPDP Team consideration. Team Discussion The Initial Report did not contain a Recommendation for the handling of personal data based on geographical considerations. Instead, the Initial Report asked three questions so that the community input could provide a guide for the EPDP Teams deliberations leading to the Final Report. Those questions were: h) Applicability of Data Processing Requirements h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis? h2) Is there a legal basis for Contracted Parties to differentiate between registrants on a geographic basis? The EPDP Team considered the public comment and developed the following thoughts in its deliberations in addressing the charter questions: The EPDP Team discussed this extensively (as documented in the Initial Report) as well as in the context of the review on the public comments received on the Initial Report. In relation to part of charter question h1, the EPDP Team agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis; However, the EPDP Team members have divergent views on whether differentiation on a geographic basis should be required. Recognizing that ICANN is a Data Controller in many scenarios and that ICANN may be considered “established” in Europe (within the meaning of the GDPR), the EPDP Team discussed whether those factors would have an effect upon the discussion and determining GDPR-compliant outcomes. It became clear that legal guidance in relation to the applicability of GDPR in the context of ICANN having an ‘establishment’ in Europe could further inform requirements. The EPDP Team also discussed the possibility of developing a set of rules for guiding the making of geographical distinctions in an GDPR-compliant manner (akin to the EWG hypothesized “rules engine”). The Team agreed that creating this set of rules was a complex task (just as it would be for individual registrars) and agreed such development could not occur within the remit of this Phase I EPDP. Such a development would also be dependent on the response to the aforementioned legal guidance. EPDP Team Recommendation (a new recommendation as there was none in the Initial Report) The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic: The EPDP Team may reconsider this recommendation in phase 2 of its work, an Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. Action Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. If there are additional questions for ICANN Compliance that would serve to inform the deliberations on this recommendation, please share these also. Deadline: Tuesday, 29 January, additional email discussion might follow depending on responses. Best regards, Kurt
Dear Kurt Thank you again for the text, I suggest to amend the text as follows: *EPDP Team Recommendation (a new recommendation as there was none in the Initial Report)*The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted/* ,to the extent practicable ,*differentiate *may ,to the extent praticable, *differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic: - The EPDP Team may reconsider( i*ntends to consider * this recommendation in phase 2 of its work,* i.e. to study *the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions - Regards - Kavouss On Fri, Jan 25, 2019 at 5:06 PM Kurt Pritz <kurt@kjpritz.com> wrote:
Hi Everyone:
With the ongoing goal of progressing issues via email, the leadership and support teams have considered the review of public comment made during the recent plenary conference call and suggests the following language to capture the agreement in principle that was developed on making Geographic Distinctions.
Based on that discussion the recommendation below is proposed for EPDP Team consideration.
*Team Discussion*
The Initial Report did not contain a Recommendation for the handling of personal data based on geographical considerations. Instead, the Initial Report asked three questions so that the community input could provide a guide for the EPDP Teams deliberations leading to the Final Report. Those questions were:
h) Applicability of Data Processing Requirements
h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis?
h2) Is there a legal basis for Contracted Parties to differentiate between registrants on a geographic basis?
The EPDP Team considered the public comment and developed the following thoughts in its deliberations in addressing the charter questions:
- The EPDP Team discussed this extensively (as documented in the Initial Report) as well as in the context of the review on the public comments received on the Initial Report. In relation to part of charter question h1, the EPDP Team agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis; - However, the EPDP Team members have divergent views on whether differentiation on a geographic basis should be required. - Recognizing that ICANN is a Data Controller in many scenarios and that ICANN may be considered “established” in Europe (within the meaning of the GDPR), the EPDP Team discussed whether those factors would have an effect upon the discussion and determining GDPR-compliant outcomes. It became clear that legal guidance in relation to the applicability of GDPR in the context of ICANN having an ‘establishment’ in Europe could further inform requirements. - The EPDP Team also discussed the possibility of developing a set of rules for guiding the making of geographical distinctions in an GDPR-compliant manner (akin to the EWG hypothesized “rules engine”). The Team agreed that creating this set of rules was a complex task (just as it would be for individual registrars) and agreed such development could not occur within the remit of this Phase I EPDP. Such a development would also be dependent on the response to the aforementioned legal guidance.
*EPDP Team Recommendation (a new recommendation as there was none in the Initial Report)* The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic:
- The EPDP Team may reconsider this recommendation in phase 2 of its work, an - Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
*Action*
Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. If there are additional questions for ICANN Compliance that would serve to inform the deliberations on this recommendation, please share these also.
Deadline: Tuesday, 29 January, additional email discussion might follow depending on responses.
Best regards,
Kurt
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Hi Kurt, Thanks for this. It seems fine to me, except that I’m not clear why we would wish for the final report to suggest that the EPDP Team “agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis”. The emphasis here is on the word “should”. I don’t believe this is accurate, as there have been a number of views expressed on why differentiation between registrants on a geographic basis should NOT be done. A few are mentioned in your email below, but several others are not. These might not have been brought up very recently, such as during the review of public comments. However, they certainly were in the discussions leading up to the publication of the initial report. I believe there is still divergence within the EPDP Team on whether Contracted Parties should do anything at all in the context of this recommendation. Furthermore, the Temp Spec doesn’t indicate whether or not Contracted Parties SHOULD do anything here either. It only says that those Contracted Parties to whom section 2.1 of appendix A is applicable to MUST apply the requirements in sections 2 and 4 of the same appendix, and that those to whom section 3 of appendix A are applicable MAY do the same. I would prefer that the recommendation be amended to simply say:
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic:
- The EPDP Team may reconsider this recommendation in phase 2 of its work, an - Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
In practically implementable terms, this achieves the same purpose of the recommendation language you proposed, without suggesting the EPDP Team has reached consensus on whether or not geo differentiation of registrants SHOULD be done. Thanks. Amr
On Jan 25, 2019, at 6:05 PM, Kurt Pritz <kurt@kjpritz.com> wrote:
Hi Everyone:
With the ongoing goal of progressing issues via email, the leadership and support teams have considered the review of public comment made during the recent plenary conference call and suggests the following language to capture the agreement in principle that was developed on making Geographic Distinctions.
Based on that discussion the recommendation below is proposed for EPDP Team consideration.
Team Discussion
The Initial Report did not contain a Recommendation for the handling of personal data based on geographical considerations. Instead, the Initial Report asked three questions so that the community input could provide a guide for the EPDP Teams deliberations leading to the Final Report. Those questions were:
h) Applicability of Data Processing Requirements
h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis?
h2) Is there a legal basis for Contracted Parties to differentiate between registrants on a geographic basis?
The EPDP Team considered the public comment and developed the following thoughts in its deliberations in addressing the charter questions:
- The EPDP Team discussed this extensively (as documented in the Initial Report) as well as in the context of the review on the public comments received on the Initial Report. In relation to part of charter question h1, the EPDP Team agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis; - However, the EPDP Team members have divergent views on whether differentiation on a geographic basis should be required. - Recognizing that ICANN is a Data Controller in many scenarios and that ICANN may be considered “established” in Europe (within the meaning of the GDPR), the EPDP Team discussed whether those factors would have an effect upon the discussion and determining GDPR-compliant outcomes. It became clear that legal guidance in relation to the applicability of GDPR in the context of ICANN having an ‘establishment’ in Europe could further inform requirements. - The EPDP Team also discussed the possibility of developing a set of rules for guiding the making of geographical distinctions in an GDPR-compliant manner (akin to the EWG hypothesized “rules engine”). The Team agreed that creating this set of rules was a complex task (just as it would be for individual registrars) and agreed such development could not occur within the remit of this Phase I EPDP. Such a development would also be dependent on the response to the aforementioned legal guidance.
EPDP Team Recommendation (a new recommendation as there was none in the Initial Report) The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic:
- The EPDP Team may reconsider this recommendation in phase 2 of its work, an - Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
Action
Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. If there are additional questions for ICANN Compliance that would serve to inform the deliberations on this recommendation, please share these also.
Deadline: Tuesday, 29 January, additional email discussion might follow depending on responses.
Best regards,
Kurt
Thanks Kurt. I agree with Amr but I don't think Appendix A, section 2.1 and 3 should be included. Those clauses are not about Geo differentiation of "registrants" only. Also I saw the draft final version of the report and there is no consensus to discuss the feasibility conditions and methodology for the development of a rule set, Milton also recorded our objection about this multiple times. Why did it end up in the recommendation again? I suggest deleting the "consider the feasibility ..." bullet point. If we want to dig this topic out again and waste hours of our time discuss whether to do a study on the feasibility of how to provide less data protection for those who are not located in the EU, then we can decide on that in phase 2. Farzaneh On Fri, Jan 25, 2019 at 3:32 PM Amr Elsadr <aelsadr@icannpolicy.ninja> wrote:
Hi Kurt,
Thanks for this. It seems fine to me, except that I’m not clear why we would wish for the final report to suggest that the EPDP Team *“agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis”*.
The emphasis here is on the word “should”. I don’t believe this is accurate, as there have been a number of views expressed on why differentiation between registrants on a geographic basis should NOT be done. A few are mentioned in your email below, but several others are not. These might not have been brought up very recently, such as during the review of public comments. However, they certainly were in the discussions leading up to the publication of the initial report.
I believe there is still divergence within the EPDP Team on whether Contracted Parties should do anything at all in the context of this recommendation. Furthermore, the Temp Spec doesn’t indicate whether or not Contracted Parties *SHOULD* do anything here either. It only says that those Contracted Parties to whom section 2.1 of appendix A is applicable to *MUST* apply the requirements in sections 2 and 4 of the same appendix, and that those to whom section 3 of appendix A are applicable *MAY* do the same.
I would prefer that the recommendation be amended to simply say:
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of *Appendix A of* the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic:
- The EPDP Team may reconsider this recommendation in phase 2 of its work, an - Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
In practically implementable terms, this achieves the same purpose of the recommendation language you proposed, without suggesting the EPDP Team has reached consensus on whether or not geo differentiation of registrants SHOULD be done.
Thanks.
Amr
On Jan 25, 2019, at 6:05 PM, Kurt Pritz <kurt@kjpritz.com> wrote:
Hi Everyone:
With the ongoing goal of progressing issues via email, the leadership and support teams have considered the review of public comment made during the recent plenary conference call and suggests the following language to capture the agreement in principle that was developed on making Geographic Distinctions.
Based on that discussion the recommendation below is proposed for EPDP Team consideration.
*Team Discussion*
The Initial Report did not contain a Recommendation for the handling of personal data based on geographical considerations. Instead, the Initial Report asked three questions so that the community input could provide a guide for the EPDP Teams deliberations leading to the Final Report. Those questions were:
h) Applicability of Data Processing Requirements
h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis?
h2) Is there a legal basis for Contracted Parties to differentiate between registrants on a geographic basis?
The EPDP Team considered the public comment and developed the following thoughts in its deliberations in addressing the charter questions:
- The EPDP Team discussed this extensively (as documented in the Initial Report) as well as in the context of the review on the public comments received on the Initial Report. In relation to part of charter question h1, the EPDP Team agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis; - However, the EPDP Team members have divergent views on whether differentiation on a geographic basis should be required. - Recognizing that ICANN is a Data Controller in many scenarios and that ICANN may be considered “established” in Europe (within the meaning of the GDPR), the EPDP Team discussed whether those factors would have an effect upon the discussion and determining GDPR-compliant outcomes. It became clear that legal guidance in relation to the applicability of GDPR in the context of ICANN having an ‘establishment’ in Europe could further inform requirements. - The EPDP Team also discussed the possibility of developing a set of rules for guiding the making of geographical distinctions in an GDPR-compliant manner (akin to the EWG hypothesized “rules engine”). The Team agreed that creating this set of rules was a complex task (just as it would be for individual registrars) and agreed such development could not occur within the remit of this Phase I EPDP. Such a development would also be dependent on the response to the aforementioned legal guidance.
*EPDP Team Recommendation (a new recommendation as there was none in the Initial Report)* The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic:
- The EPDP Team may reconsider this recommendation in phase 2 of its work, an - Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
*Action*
Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. If there are additional questions for ICANN Compliance that would serve to inform the deliberations on this recommendation, please share these also.
Deadline: Tuesday, 29 January, additional email discussion might follow depending on responses.
Best regards,
Kurt
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Hi, I’m still trying to come up with language for the first part of the recommendation that may address my concerns, Amr’s and Farzaneh’s. In the meantime, my understanding about the rule set idea was similar to Farzaneh’s. K From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of farzaneh badii Sent: Tuesday, January 29, 2019 9:03 AM To: Amr Elsadr <aelsadr@icannpolicy.ninja> Cc: EPDP <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report Thanks Kurt. I agree with Amr but I don't think Appendix A, section 2.1 and 3 should be included. Those clauses are not about Geo differentiation of "registrants" only. Also I saw the draft final version of the report and there is no consensus to discuss the feasibility conditions and methodology for the development of a rule set, Milton also recorded our objection about this multiple times. Why did it end up in the recommendation again? I suggest deleting the "consider the feasibility ..." bullet point. If we want to dig this topic out again and waste hours of our time discuss whether to do a study on the feasibility of how to provide less data protection for those who are not located in the EU, then we can decide on that in phase 2. Farzaneh On Fri, Jan 25, 2019 at 3:32 PM Amr Elsadr <aelsadr@icannpolicy.ninja<mailto:aelsadr@icannpolicy.ninja>> wrote: Hi Kurt, Thanks for this. It seems fine to me, except that I’m not clear why we would wish for the final report to suggest that the EPDP Team “agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis”. The emphasis here is on the word “should”. I don’t believe this is accurate, as there have been a number of views expressed on why differentiation between registrants on a geographic basis should NOT be done. A few are mentioned in your email below, but several others are not. These might not have been brought up very recently, such as during the review of public comments. However, they certainly were in the discussions leading up to the publication of the initial report. I believe there is still divergence within the EPDP Team on whether Contracted Parties should do anything at all in the context of this recommendation. Furthermore, the Temp Spec doesn’t indicate whether or not Contracted Parties SHOULD do anything here either. It only says that those Contracted Parties to whom section 2.1 of appendix A is applicable to MUST apply the requirements in sections 2 and 4 of the same appendix, and that those to whom section 3 of appendix A are applicable MAY do the same. I would prefer that the recommendation be amended to simply say: The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic: * The EPDP Team may reconsider this recommendation in phase 2 of its work, an * Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. In practically implementable terms, this achieves the same purpose of the recommendation language you proposed, without suggesting the EPDP Team has reached consensus on whether or not geo differentiation of registrants SHOULD be done. Thanks. Amr On Jan 25, 2019, at 6:05 PM, Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>> wrote: Hi Everyone: With the ongoing goal of progressing issues via email, the leadership and support teams have considered the review of public comment made during the recent plenary conference call and suggests the following language to capture the agreement in principle that was developed on making Geographic Distinctions. Based on that discussion the recommendation below is proposed for EPDP Team consideration. Team Discussion The Initial Report did not contain a Recommendation for the handling of personal data based on geographical considerations. Instead, the Initial Report asked three questions so that the community input could provide a guide for the EPDP Teams deliberations leading to the Final Report. Those questions were: h) Applicability of Data Processing Requirements h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis? h2) Is there a legal basis for Contracted Parties to differentiate between registrants on a geographic basis? The EPDP Team considered the public comment and developed the following thoughts in its deliberations in addressing the charter questions: * The EPDP Team discussed this extensively (as documented in the Initial Report) as well as in the context of the review on the public comments received on the Initial Report. In relation to part of charter question h1, the EPDP Team agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis; * However, the EPDP Team members have divergent views on whether differentiation on a geographic basis should be required. * Recognizing that ICANN is a Data Controller in many scenarios and that ICANN may be considered “established” in Europe (within the meaning of the GDPR), the EPDP Team discussed whether those factors would have an effect upon the discussion and determining GDPR-compliant outcomes. It became clear that legal guidance in relation to the applicability of GDPR in the context of ICANN having an ‘establishment’ in Europe could further inform requirements. * The EPDP Team also discussed the possibility of developing a set of rules for guiding the making of geographical distinctions in an GDPR-compliant manner (akin to the EWG hypothesized “rules engine”). The Team agreed that creating this set of rules was a complex task (just as it would be for individual registrars) and agreed such development could not occur within the remit of this Phase I EPDP. Such a development would also be dependent on the response to the aforementioned legal guidance. EPDP Team Recommendation (a new recommendation as there was none in the Initial Report) The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic: * The EPDP Team may reconsider this recommendation in phase 2 of its work, an * Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. Action Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. If there are additional questions for ICANN Compliance that would serve to inform the deliberations on this recommendation, please share these also. Deadline: Tuesday, 29 January, additional email discussion might follow depending on responses. Best regards, Kurt _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Dear All, We need to find sdome language which could get the agreement of all of us Pehaps AMR text could be further considred as the solution Regards Kavouss On Wed, Jan 30, 2019 at 3:13 AM Rosette, Kristina via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:
Hi,
I’m still trying to come up with language for the first part of the recommendation that may address my concerns, Amr’s and Farzaneh’s.
In the meantime, my understanding about the rule set idea was similar to Farzaneh’s.
K
*From:* Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] *On Behalf Of *farzaneh badii *Sent:* Tuesday, January 29, 2019 9:03 AM *To:* Amr Elsadr <aelsadr@icannpolicy.ninja> *Cc:* EPDP <gnso-epdp-team@icann.org> *Subject:* Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report
Thanks Kurt.
I agree with Amr but I don't think Appendix A, section 2.1 and 3 should be included. Those clauses are not about Geo differentiation of "registrants" only.
Also I saw the draft final version of the report and there is no consensus to discuss the feasibility conditions and methodology for the development of a rule set, Milton also recorded our objection about this multiple times. Why did it end up in the recommendation again? I suggest deleting the "consider the feasibility ..." bullet point. If we want to dig this topic out again and waste hours of our time discuss whether to do a study on the feasibility of how to provide less data protection for those who are not located in the EU, then we can decide on that in phase 2.
Farzaneh
On Fri, Jan 25, 2019 at 3:32 PM Amr Elsadr <aelsadr@icannpolicy.ninja> wrote:
Hi Kurt,
Thanks for this. It seems fine to me, except that I’m not clear why we would wish for the final report to suggest that the EPDP Team *“agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis”*.
The emphasis here is on the word “should”. I don’t believe this is accurate, as there have been a number of views expressed on why differentiation between registrants on a geographic basis should NOT be done. A few are mentioned in your email below, but several others are not. These might not have been brought up very recently, such as during the review of public comments. However, they certainly were in the discussions leading up to the publication of the initial report.
I believe there is still divergence within the EPDP Team on whether Contracted Parties should do anything at all in the context of this recommendation. Furthermore, the Temp Spec doesn’t indicate whether or not Contracted Parties *SHOULD* do anything here either. It only says that those Contracted Parties to whom section 2.1 of appendix A is applicable to *MUST* apply the requirements in sections 2 and 4 of the same appendix, and that those to whom section 3 of appendix A are applicable *MAY* do the same.
I would prefer that the recommendation be amended to simply say:
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of *Appendix A of* the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic:
- The EPDP Team may reconsider this recommendation in phase 2 of its work, an - Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
In practically implementable terms, this achieves the same purpose of the recommendation language you proposed, without suggesting the EPDP Team has reached consensus on whether or not geo differentiation of registrants SHOULD be done.
Thanks.
Amr
On Jan 25, 2019, at 6:05 PM, Kurt Pritz <kurt@kjpritz.com> wrote:
Hi Everyone:
With the ongoing goal of progressing issues via email, the leadership and support teams have considered the review of public comment made during the recent plenary conference call and suggests the following language to capture the agreement in principle that was developed on making Geographic Distinctions.
Based on that discussion the recommendation below is proposed for EPDP Team consideration.
*Team Discussion*
The Initial Report did not contain a Recommendation for the handling of personal data based on geographical considerations. Instead, the Initial Report asked three questions so that the community input could provide a guide for the EPDP Teams deliberations leading to the Final Report. Those questions were:
h) Applicability of Data Processing Requirements
h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis?
h2) Is there a legal basis for Contracted Parties to differentiate between registrants on a geographic basis?
The EPDP Team considered the public comment and developed the following thoughts in its deliberations in addressing the charter questions:
- The EPDP Team discussed this extensively (as documented in the Initial Report) as well as in the context of the review on the public comments received on the Initial Report. In relation to part of charter question h1, the EPDP Team agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis; - However, the EPDP Team members have divergent views on whether differentiation on a geographic basis should be required. - Recognizing that ICANN is a Data Controller in many scenarios and that ICANN may be considered “established” in Europe (within the meaning of the GDPR), the EPDP Team discussed whether those factors would have an effect upon the discussion and determining GDPR-compliant outcomes. It became clear that legal guidance in relation to the applicability of GDPR in the context of ICANN having an ‘establishment’ in Europe could further inform requirements. - The EPDP Team also discussed the possibility of developing a set of rules for guiding the making of geographical distinctions in an GDPR-compliant manner (akin to the EWG hypothesized “rules engine”). The Team agreed that creating this set of rules was a complex task (just as it would be for individual registrars) and agreed such development could not occur within the remit of this Phase I EPDP. Such a development would also be dependent on the response to the aforementioned legal guidance.
*EPDP Team Recommendation (a new recommendation as there was none in the Initial Report) * The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic:
- The EPDP Team may reconsider this recommendation in phase 2 of its work, an - Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
*Action*
Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. If there are additional questions for ICANN Compliance that would serve to inform the deliberations on this recommendation, please share these also.
Deadline: Tuesday, 29 January, additional email discussion might follow depending on responses.
Best regards,
Kurt
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Hi, Here’s where I’ve landed and what I propose . (Additions from Kurt’s initial text in bold, deletions in strike through). The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators , i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic, t: * The EPDP Team may reconsider this recommendation in phase 2 of its work. , an * Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. -*- Clean version: The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic, the EPDP Team may reconsider this recommendation in phase 2 of its work. K From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Rosette, Kristina via Gnso-epdp-team Sent: Tuesday, January 29, 2019 9:13 PM To: EPDP <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report Hi, I’m still trying to come up with language for the first part of the recommendation that may address my concerns, Amr’s and Farzaneh’s. In the meantime, my understanding about the rule set idea was similar to Farzaneh’s. K From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of farzaneh badii Sent: Tuesday, January 29, 2019 9:03 AM To: Amr Elsadr <aelsadr@icannpolicy.ninja<mailto:aelsadr@icannpolicy.ninja>> Cc: EPDP <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report Thanks Kurt. I agree with Amr but I don't think Appendix A, section 2.1 and 3 should be included. Those clauses are not about Geo differentiation of "registrants" only. Also I saw the draft final version of the report and there is no consensus to discuss the feasibility conditions and methodology for the development of a rule set, Milton also recorded our objection about this multiple times. Why did it end up in the recommendation again? I suggest deleting the "consider the feasibility ..." bullet point. If we want to dig this topic out again and waste hours of our time discuss whether to do a study on the feasibility of how to provide less data protection for those who are not located in the EU, then we can decide on that in phase 2. Farzaneh On Fri, Jan 25, 2019 at 3:32 PM Amr Elsadr <aelsadr@icannpolicy.ninja<mailto:aelsadr@icannpolicy.ninja>> wrote: Hi Kurt, Thanks for this. It seems fine to me, except that I’m not clear why we would wish for the final report to suggest that the EPDP Team “agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis”. The emphasis here is on the word “should”. I don’t believe this is accurate, as there have been a number of views expressed on why differentiation between registrants on a geographic basis should NOT be done. A few are mentioned in your email below, but several others are not. These might not have been brought up very recently, such as during the review of public comments. However, they certainly were in the discussions leading up to the publication of the initial report. I believe there is still divergence within the EPDP Team on whether Contracted Parties should do anything at all in the context of this recommendation. Furthermore, the Temp Spec doesn’t indicate whether or not Contracted Parties SHOULD do anything here either. It only says that those Contracted Parties to whom section 2.1 of appendix A is applicable to MUST apply the requirements in sections 2 and 4 of the same appendix, and that those to whom section 3 of appendix A are applicable MAY do the same. I would prefer that the recommendation be amended to simply say: The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic: * The EPDP Team may reconsider this recommendation in phase 2 of its work, an * Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. In practically implementable terms, this achieves the same purpose of the recommendation language you proposed, without suggesting the EPDP Team has reached consensus on whether or not geo differentiation of registrants SHOULD be done. Thanks. Amr On Jan 25, 2019, at 6:05 PM, Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>> wrote: Hi Everyone: With the ongoing goal of progressing issues via email, the leadership and support teams have considered the review of public comment made during the recent plenary conference call and suggests the following language to capture the agreement in principle that was developed on making Geographic Distinctions. Based on that discussion the recommendation below is proposed for EPDP Team consideration. Team Discussion The Initial Report did not contain a Recommendation for the handling of personal data based on geographical considerations. Instead, the Initial Report asked three questions so that the community input could provide a guide for the EPDP Teams deliberations leading to the Final Report. Those questions were: h) Applicability of Data Processing Requirements h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis? h2) Is there a legal basis for Contracted Parties to differentiate between registrants on a geographic basis? The EPDP Team considered the public comment and developed the following thoughts in its deliberations in addressing the charter questions: * The EPDP Team discussed this extensively (as documented in the Initial Report) as well as in the context of the review on the public comments received on the Initial Report. In relation to part of charter question h1, the EPDP Team agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis; * However, the EPDP Team members have divergent views on whether differentiation on a geographic basis should be required. * Recognizing that ICANN is a Data Controller in many scenarios and that ICANN may be considered “established” in Europe (within the meaning of the GDPR), the EPDP Team discussed whether those factors would have an effect upon the discussion and determining GDPR-compliant outcomes. It became clear that legal guidance in relation to the applicability of GDPR in the context of ICANN having an ‘establishment’ in Europe could further inform requirements. * The EPDP Team also discussed the possibility of developing a set of rules for guiding the making of geographical distinctions in an GDPR-compliant manner (akin to the EWG hypothesized “rules engine”). The Team agreed that creating this set of rules was a complex task (just as it would be for individual registrars) and agreed such development could not occur within the remit of this Phase I EPDP. Such a development would also be dependent on the response to the aforementioned legal guidance. EPDP Team Recommendation (a new recommendation as there was none in the Initial Report) The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic: * The EPDP Team may reconsider this recommendation in phase 2 of its work, an * Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. Action Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. If there are additional questions for ICANN Compliance that would serve to inform the deliberations on this recommendation, please share these also. Deadline: Tuesday, 29 January, additional email discussion might follow depending on responses. Best regards, Kurt _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Hi, This looks good to me. Thanks. Amr Sent from Mobile On Sun, Feb 3, 2019 at 3:58 PM, Rosette, Kristina via Gnso-epdp-team <gnso-epdp-team@icann.org> wrote:
Hi,
Here’s where I’ve landed and what I propose . (Additions from Kurt’s initial text in bold, deletions in strike through).
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators , i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic, t:
- The EPDP Team may reconsider this recommendation in phase 2 of its work. , an
- Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
-*-
Clean version:
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic, the EPDP Team may reconsider this recommendation in phase 2 of its work.
K
From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Rosette, Kristina via Gnso-epdp-team Sent: Tuesday, January 29, 2019 9:13 PM To: EPDP <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report
Hi,
I’m still trying to come up with language for the first part of the recommendation that may address my concerns, Amr’s and Farzaneh’s.
In the meantime, my understanding about the rule set idea was similar to Farzaneh’s.
K
From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of farzaneh badii Sent: Tuesday, January 29, 2019 9:03 AM To: Amr Elsadr <aelsadr@icannpolicy.ninja> Cc: EPDP <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report
Thanks Kurt.
I agree with Amr but I don't think Appendix A, section 2.1 and 3 should be included. Those clauses are not about Geo differentiation of "registrants" only.
Also I saw the draft final version of the report and there is no consensus to discuss the feasibility conditions and methodology for the development of a rule set, Milton also recorded our objection about this multiple times. Why did it end up in the recommendation again? I suggest deleting the "consider the feasibility ..." bullet point. If we want to dig this topic out again and waste hours of our time discuss whether to do a study on the feasibility of how to provide less data protection for those who are not located in the EU, then we can decide on that in phase 2.
Farzaneh
On Fri, Jan 25, 2019 at 3:32 PM Amr Elsadr <aelsadr@icannpolicy.ninja> wrote:
Hi Kurt,
Thanks for this. It seems fine to me, except that I’m not clear why we would wish for the final report to suggest that the EPDP Team “agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis”.
The emphasis here is on the word “should”. I don’t believe this is accurate, as there have been a number of views expressed on why differentiation between registrants on a geographic basis should NOT be done. A few are mentioned in your email below, but several others are not. These might not have been brought up very recently, such as during the review of public comments. However, they certainly were in the discussions leading up to the publication of the initial report.
I believe there is still divergence within the EPDP Team on whether Contracted Parties should do anything at all in the context of this recommendation. Furthermore, the Temp Spec doesn’t indicate whether or not Contracted Parties SHOULD do anything here either. It only says that those Contracted Parties to whom section 2.1 of appendix A is applicable to MUST apply the requirements in sections 2 and 4 of the same appendix, and that those to whom section 3 of appendix A are applicable MAY do the same.
I would prefer that the recommendation be amended to simply say:
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic:
- The EPDP Team may reconsider this recommendation in phase 2 of its work, an
- Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
In practically implementable terms, this achieves the same purpose of the recommendation language you proposed, without suggesting the EPDP Team has reached consensus on whether or not geo differentiation of registrants SHOULD be done.
Thanks.
Amr
On Jan 25, 2019, at 6:05 PM, Kurt Pritz <kurt@kjpritz.com> wrote:
Hi Everyone:
With the ongoing goal of progressing issues via email, the leadership and support teams have considered the review of public comment made during the recent plenary conference call and suggests the following language to capture the agreement in principle that was developed on making Geographic Distinctions.
Based on that discussion the recommendation below is proposed for EPDP Team consideration.
Team Discussion
The Initial Report did not contain a Recommendation for the handling of personal data based on geographical considerations. Instead, the Initial Report asked three questions so that the community input could provide a guide for the EPDP Teams deliberations leading to the Final Report. Those questions were:
h) Applicability of Data Processing Requirements
h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis?
h2) Is there a legal basis for Contracted Parties to differentiate between registrants on a geographic basis?
The EPDP Team considered the public comment and developed the following thoughts in its deliberations in addressing the charter questions:
- The EPDP Team discussed this extensively (as documented in the Initial Report) as well as in the context of the review on the public comments received on the Initial Report. In relation to part of charter question h1, the EPDP Team agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis;
- However, the EPDP Team members have divergent views on whether differentiation on a geographic basis should be required.
- Recognizing that ICANN is a Data Controller in many scenarios and that ICANN may be considered “established” in Europe (within the meaning of the GDPR), the EPDP Team discussed whether those factors would have an effect upon the discussion and determining GDPR-compliant outcomes. It became clear that legal guidance in relation to the applicability of GDPR in the context of ICANN having an ‘establishment’ in Europe could further inform requirements.
- The EPDP Team also discussed the possibility of developing a set of rules for guiding the making of geographical distinctions in an GDPR-compliant manner (akin to the EWG hypothesized “rules engine”). The Team agreed that creating this set of rules was a complex task (just as it would be for individual registrars) and agreed such development could not occur within the remit of this Phase I EPDP. Such a development would also be dependent on the response to the aforementioned legal guidance.
EPDP Team Recommendation (a new recommendation as there was none in the Initial Report) The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic:
- The EPDP Team may reconsider this recommendation in phase 2 of its work, an
- Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
Action
Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. If there are additional questions for ICANN Compliance that would serve to inform the deliberations on this recommendation, please share these also.
Deadline: Tuesday, 29 January, additional email discussion might follow depending on responses.
Best regards,
Kurt
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Great for me. Thank Kristina. (PS i'm catching up on my backlog in reverse order so this may have moved on .. but I am on board regardless!) Alan [image: Donuts Inc.] <http://donuts.domains> Alan Woods Senior Compliance & Policy Manager, Donuts Inc. ------------------------------ The Victorians, 15-18 Earlsfort Terrace Dublin 2, County Dublin Ireland <https://www.facebook.com/donutstlds> <https://twitter.com/DonutsInc> <https://www.linkedin.com/company/donuts-inc> Please NOTE: This electronic message, including any attachments, may include privileged, confidential and/or inside information owned by Donuts Inc. . Any distribution or use of this communication by anyone other than the intended recipient(s) is strictly prohibited and may be unlawful. If you are not the intended recipient, please notify the sender by replying to this message and then delete it from your system. Thank you. On Sun, Feb 3, 2019 at 2:05 PM Amr Elsadr <aelsadr@icannpolicy.ninja> wrote:
Hi,
This looks good to me.
Thanks.
Amr
Sent from Mobile
On Sun, Feb 3, 2019 at 3:58 PM, Rosette, Kristina via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:
Hi,
Here’s where I’ve landed and what I propose . (Additions from Kurt’s initial text in bold, deletions in strike through).
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of *Appendix A to *the Temporary Specification remain in place. *For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators *, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic*, t*:
- The EPDP Team may reconsider this recommendation in phase 2 of its work*. *, an - Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
-*-
Clean version:
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic, the EPDP Team may reconsider this recommendation in phase 2 of its work.
K
*From:* Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] *On Behalf Of *Rosette, Kristina via Gnso-epdp-team *Sent:* Tuesday, January 29, 2019 9:13 PM *To:* EPDP <gnso-epdp-team@icann.org> *Subject:* Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report
Hi,
I’m still trying to come up with language for the first part of the recommendation that may address my concerns, Amr’s and Farzaneh’s.
In the meantime, my understanding about the rule set idea was similar to Farzaneh’s.
K
*From:* Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org <gnso-epdp-team-bounces@icann.org>] *On Behalf Of *farzaneh badii *Sent:* Tuesday, January 29, 2019 9:03 AM *To:* Amr Elsadr <aelsadr@icannpolicy.ninja> *Cc:* EPDP <gnso-epdp-team@icann.org> *Subject:* Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report
Thanks Kurt.
I agree with Amr but I don't think Appendix A, section 2.1 and 3 should be included. Those clauses are not about Geo differentiation of "registrants" only.
Also I saw the draft final version of the report and there is no consensus to discuss the feasibility conditions and methodology for the development of a rule set, Milton also recorded our objection about this multiple times. Why did it end up in the recommendation again? I suggest deleting the "consider the feasibility ..." bullet point. If we want to dig this topic out again and waste hours of our time discuss whether to do a study on the feasibility of how to provide less data protection for those who are not located in the EU, then we can decide on that in phase 2.
Farzaneh
On Fri, Jan 25, 2019 at 3:32 PM Amr Elsadr <aelsadr@icannpolicy.ninja> wrote:
Hi Kurt,
Thanks for this. It seems fine to me, except that I’m not clear why we would wish for the final report to suggest that the EPDP Team *“agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis”*.
The emphasis here is on the word “should”. I don’t believe this is accurate, as there have been a number of views expressed on why differentiation between registrants on a geographic basis should NOT be done. A few are mentioned in your email below, but several others are not. These might not have been brought up very recently, such as during the review of public comments. However, they certainly were in the discussions leading up to the publication of the initial report.
I believe there is still divergence within the EPDP Team on whether Contracted Parties should do anything at all in the context of this recommendation. Furthermore, the Temp Spec doesn’t indicate whether or not Contracted Parties *SHOULD* do anything here either. It only says that those Contracted Parties to whom section 2.1 of appendix A is applicable to *MUST* apply the requirements in sections 2 and 4 of the same appendix, and that those to whom section 3 of appendix A are applicable *MAY* do the same.
I would prefer that the recommendation be amended to simply say:
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of *Appendix A of* the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic:
- The EPDP Team may reconsider this recommendation in phase 2 of its work, an - Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
In practically implementable terms, this achieves the same purpose of the recommendation language you proposed, without suggesting the EPDP Team has reached consensus on whether or not geo differentiation of registrants SHOULD be done.
Thanks.
Amr
On Jan 25, 2019, at 6:05 PM, Kurt Pritz <kurt@kjpritz.com> wrote:
Hi Everyone:
With the ongoing goal of progressing issues via email, the leadership and support teams have considered the review of public comment made during the recent plenary conference call and suggests the following language to capture the agreement in principle that was developed on making Geographic Distinctions.
Based on that discussion the recommendation below is proposed for EPDP Team consideration.
*Team Discussion*
The Initial Report did not contain a Recommendation for the handling of personal data based on geographical considerations. Instead, the Initial Report asked three questions so that the community input could provide a guide for the EPDP Teams deliberations leading to the Final Report. Those questions were:
h) Applicability of Data Processing Requirements
h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis?
h2) Is there a legal basis for Contracted Parties to differentiate between registrants on a geographic basis?
The EPDP Team considered the public comment and developed the following thoughts in its deliberations in addressing the charter questions:
- The EPDP Team discussed this extensively (as documented in the Initial Report) as well as in the context of the review on the public comments received on the Initial Report. In relation to part of charter question h1, the EPDP Team agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis; - However, the EPDP Team members have divergent views on whether differentiation on a geographic basis should be required. - Recognizing that ICANN is a Data Controller in many scenarios and that ICANN may be considered “established” in Europe (within the meaning of the GDPR), the EPDP Team discussed whether those factors would have an effect upon the discussion and determining GDPR-compliant outcomes. It became clear that legal guidance in relation to the applicability of GDPR in the context of ICANN having an ‘establishment’ in Europe could further inform requirements. - The EPDP Team also discussed the possibility of developing a set of rules for guiding the making of geographical distinctions in an GDPR-compliant manner (akin to the EWG hypothesized “rules engine”). The Team agreed that creating this set of rules was a complex task (just as it would be for individual registrars) and agreed such development could not occur within the remit of this Phase I EPDP. Such a development would also be dependent on the response to the aforementioned legal guidance.
*EPDP Team Recommendation (a new recommendation as there was none in the Initial Report) * The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic:
- The EPDP Team may reconsider this recommendation in phase 2 of its work, an - Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
*Action*
Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. If there are additional questions for ICANN Compliance that would serve to inform the deliberations on this recommendation, please share these also.
Deadline: Tuesday, 29 January, additional email discussion might follow depending on responses.
Best regards,
Kurt
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Hi Everyone: In reference to Kristina’s recommendation for the Geographic Basis discussion below, I have noticed positive feedback thus far. Could those who are interested please comment on this proposal and signal a request for additional discussion if you wish to advocate for different text. Please respond today if possible so that we can schedule the discussion if need be but, in an case, by tomorrow (Wednesday) at the latest. Thx & regards, Kurt
Begin forwarded message:
From: "Rosette, Kristina via Gnso-epdp-team" <gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] FW: Geographic Basis - Recommendation for inclusion in the Final Report Date: February 3, 2019 at 5:58:52 AM PST To: EPDP <gnso-epdp-team@icann.org> Reply-To: "Rosette, Kristina" <rosettek@amazon.com>
Hi,
Here’s where I’ve landed and what I propose . (Additions from Kurt’s initial text in bold, deletions in strike through).
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators , i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic, t: The EPDP Team may reconsider this recommendation in phase 2 of its work. , an Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. -*-
Clean version:
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic, the EPDP Team may reconsider this recommendation in phase 2 of its work.
K
From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Rosette, Kristina via Gnso-epdp-team Sent: Tuesday, January 29, 2019 9:13 PM To: EPDP <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report
Hi,
I’m still trying to come up with language for the first part of the recommendation that may address my concerns, Amr’s and Farzaneh’s.
In the meantime, my understanding about the rule set idea was similar to Farzaneh’s.
K
From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org <mailto:gnso-epdp-team-bounces@icann.org>] On Behalf Of farzaneh badii Sent: Tuesday, January 29, 2019 9:03 AM To: Amr Elsadr <aelsadr@icannpolicy.ninja <mailto:aelsadr@icannpolicy.ninja>> Cc: EPDP <gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report
Thanks Kurt.
I agree with Amr but I don't think Appendix A, section 2.1 and 3 should be included. Those clauses are not about Geo differentiation of "registrants" only.
Also I saw the draft final version of the report and there is no consensus to discuss the feasibility conditions and methodology for the development of a rule set, Milton also recorded our objection about this multiple times. Why did it end up in the recommendation again? I suggest deleting the "consider the feasibility ..." bullet point. If we want to dig this topic out again and waste hours of our time discuss whether to do a study on the feasibility of how to provide less data protection for those who are not located in the EU, then we can decide on that in phase 2.
Farzaneh
On Fri, Jan 25, 2019 at 3:32 PM Amr Elsadr <aelsadr@icannpolicy.ninja <mailto:aelsadr@icannpolicy.ninja>> wrote: Hi Kurt,
Thanks for this. It seems fine to me, except that I’m not clear why we would wish for the final report to suggest that the EPDP Team “agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis”.
The emphasis here is on the word “should”. I don’t believe this is accurate, as there have been a number of views expressed on why differentiation between registrants on a geographic basis should NOT be done. A few are mentioned in your email below, but several others are not. These might not have been brought up very recently, such as during the review of public comments. However, they certainly were in the discussions leading up to the publication of the initial report.
I believe there is still divergence within the EPDP Team on whether Contracted Parties should do anything at all in the context of this recommendation. Furthermore, the Temp Spec doesn’t indicate whether or not Contracted PartiesSHOULD do anything here either. It only says that those Contracted Parties to whom section 2.1 of appendix A is applicable to MUST apply the requirements in sections 2 and 4 of the same appendix, and that those to whom section 3 of appendix A are applicable MAY do the same.
I would prefer that the recommendation be amended to simply say:
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic: The EPDP Team may reconsider this recommendation in phase 2 of its work, an Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. In practically implementable terms, this achieves the same purpose of the recommendation language you proposed, without suggesting the EPDP Team has reached consensus on whether or not geo differentiation of registrants SHOULD be done.
Thanks.
Amr
On Jan 25, 2019, at 6:05 PM, Kurt Pritz <kurt@kjpritz.com <mailto:kurt@kjpritz.com>> wrote:
Hi Everyone: With the ongoing goal of progressing issues via email, the leadership and support teams have considered the review of public comment made during the recent plenary conference call and suggests the following language to capture the agreement in principle that was developed on making Geographic Distinctions. Based on that discussion the recommendation below is proposed for EPDP Team consideration.
Team Discussion The Initial Report did not contain a Recommendation for the handling of personal data based on geographical considerations. Instead, the Initial Report asked three questions so that the community input could provide a guide for the EPDP Teams deliberations leading to the Final Report. Those questions were:
h) Applicability of Data Processing Requirements
h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis?
h2) Is there a legal basis for Contracted Parties to differentiate between registrants on a geographic basis?
The EPDP Team considered the public comment and developed the following thoughts in its deliberations in addressing the charter questions: The EPDP Team discussed this extensively (as documented in the Initial Report) as well as in the context of the review on the public comments received on the Initial Report. In relation to part of charter question h1, the EPDP Team agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis; However, the EPDP Team members have divergent views on whether differentiation on a geographic basis should be required. Recognizing that ICANN is a Data Controller in many scenarios and that ICANN may be considered “established” in Europe (within the meaning of the GDPR), the EPDP Team discussed whether those factors would have an effect upon the discussion and determining GDPR-compliant outcomes. It became clear that legal guidance in relation to the applicability of GDPR in the context of ICANN having an ‘establishment’ in Europe could further inform requirements. The EPDP Team also discussed the possibility of developing a set of rules for guiding the making of geographical distinctions in an GDPR-compliant manner (akin to the EWG hypothesized “rules engine”). The Team agreed that creating this set of rules was a complex task (just as it would be for individual registrars) and agreed such development could not occur within the remit of this Phase I EPDP. Such a development would also be dependent on the response to the aforementioned legal guidance.
EPDP Team Recommendation (a new recommendation as there was none in the Initial Report)
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic: The EPDP Team may reconsider this recommendation in phase 2 of its work, an Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
Action Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. If there are additional questions for ICANN Compliance that would serve to inform the deliberations on this recommendation, please share these also. Deadline: Tuesday, 29 January, additional email discussion might follow depending on responses.
Best regards, Kurt
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team>_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team________________________... Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team>
This is intended to be administrative feedback and not at all related to the substance of the recommendation. Can we avoid saying that certain language in the temporary specification should “remain in place”? Once the one year period is up, the language in the temporary specification can no longer “remain in place”. We can confirm it as policy, reject it or recommend modifications to it. This also provides an example of where simply referencing the temporary specification will lead to implementation headaches. As written, sections 2.1 and 3 of the temp spec are specifically noted. Section 2.1 provides the instructions that the requirements in sections 2 and 4 MUST be applied. This includes language that conflicts with other recommendations such as section 2.6 which covers privacy/proxy. Unpacking what is intended by this recommendation from its literal meaning can lead to implementation challenges and delays. Going back and re-reading sections 2.1 and 3 of the temp spec may leave someone confused as to what we intended in our recommendation, particularly if that someone has not been a part of our deliberations. On the other hand the “for the avoidance of doubt” part of the recommendation is clear and to the point. “The EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.” To avoid confusion later, we should consider using just that language, or if there is specific language in sections 2.1 and 3 that are needed, include it in the text of the recommendation itself. Thanks, Marc From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of Kurt Pritz Sent: Tuesday, February 05, 2019 1:43 PM To: EPDP <gnso-epdp-team@icann.org> Subject: [EXTERNAL] [Gnso-epdp-team] Fwd: Geographic Basis - Recommendation for inclusion in the Final Report Hi Everyone: In reference to Kristina’s recommendation for the Geographic Basis discussion below, I have noticed positive feedback thus far. Could those who are interested please comment on this proposal and signal a request for additional discussion if you wish to advocate for different text. Please respond today if possible so that we can schedule the discussion if need be but, in an case, by tomorrow (Wednesday) at the latest. Thx & regards, Kurt Begin forwarded message: From: "Rosette, Kristina via Gnso-epdp-team" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] FW: Geographic Basis - Recommendation for inclusion in the Final Report Date: February 3, 2019 at 5:58:52 AM PST To: EPDP <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Reply-To: "Rosette, Kristina" <rosettek@amazon.com<mailto:rosettek@amazon.com>> Hi, Here’s where I’ve landed and what I propose . (Additions from Kurt’s initial text in bold, deletions in strike through). The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators , i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic, t: * The EPDP Team may reconsider this recommendation in phase 2 of its work. , an * Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. -*- Clean version: The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic, the EPDP Team may reconsider this recommendation in phase 2 of its work. K From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Rosette, Kristina via Gnso-epdp-team Sent: Tuesday, January 29, 2019 9:13 PM To: EPDP <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report Hi, I’m still trying to come up with language for the first part of the recommendation that may address my concerns, Amr’s and Farzaneh’s. In the meantime, my understanding about the rule set idea was similar to Farzaneh’s. K From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of farzaneh badii Sent: Tuesday, January 29, 2019 9:03 AM To: Amr Elsadr <aelsadr@icannpolicy.ninja<mailto:aelsadr@icannpolicy.ninja>> Cc: EPDP <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report Thanks Kurt. I agree with Amr but I don't think Appendix A, section 2.1 and 3 should be included. Those clauses are not about Geo differentiation of "registrants" only. Also I saw the draft final version of the report and there is no consensus to discuss the feasibility conditions and methodology for the development of a rule set, Milton also recorded our objection about this multiple times. Why did it end up in the recommendation again? I suggest deleting the "consider the feasibility ..." bullet point. If we want to dig this topic out again and waste hours of our time discuss whether to do a study on the feasibility of how to provide less data protection for those who are not located in the EU, then we can decide on that in phase 2. Farzaneh On Fri, Jan 25, 2019 at 3:32 PM Amr Elsadr <aelsadr@icannpolicy.ninja<mailto:aelsadr@icannpolicy.ninja>> wrote: Hi Kurt, Thanks for this. It seems fine to me, except that I’m not clear why we would wish for the final report to suggest that the EPDP Team “agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis”. The emphasis here is on the word “should”. I don’t believe this is accurate, as there have been a number of views expressed on why differentiation between registrants on a geographic basis should NOT be done. A few are mentioned in your email below, but several others are not. These might not have been brought up very recently, such as during the review of public comments. However, they certainly were in the discussions leading up to the publication of the initial report. I believe there is still divergence within the EPDP Team on whether Contracted Parties should do anything at all in the context of this recommendation. Furthermore, the Temp Spec doesn’t indicate whether or not Contracted PartiesSHOULD do anything here either. It only says that those Contracted Parties to whom section 2.1 of appendix A is applicable to MUST apply the requirements in sections 2 and 4 of the same appendix, and that those to whom section 3 of appendix A are applicable MAY do the same. I would prefer that the recommendation be amended to simply say: The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic: * The EPDP Team may reconsider this recommendation in phase 2 of its work, an * Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. In practically implementable terms, this achieves the same purpose of the recommendation language you proposed, without suggesting the EPDP Team has reached consensus on whether or not geo differentiation of registrants SHOULD be done. Thanks. Amr On Jan 25, 2019, at 6:05 PM, Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>> wrote: Hi Everyone: With the ongoing goal of progressing issues via email, the leadership and support teams have considered the review of public comment made during the recent plenary conference call and suggests the following language to capture the agreement in principle that was developed on making Geographic Distinctions. Based on that discussion the recommendation below is proposed for EPDP Team consideration. Team Discussion The Initial Report did not contain a Recommendation for the handling of personal data based on geographical considerations. Instead, the Initial Report asked three questions so that the community input could provide a guide for the EPDP Teams deliberations leading to the Final Report. Those questions were: h) Applicability of Data Processing Requirements h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis? h2) Is there a legal basis for Contracted Parties to differentiate between registrants on a geographic basis? The EPDP Team considered the public comment and developed the following thoughts in its deliberations in addressing the charter questions: * The EPDP Team discussed this extensively (as documented in the Initial Report) as well as in the context of the review on the public comments received on the Initial Report. In relation to part of charter question h1, the EPDP Team agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis; * However, the EPDP Team members have divergent views on whether differentiation on a geographic basis should be required. * Recognizing that ICANN is a Data Controller in many scenarios and that ICANN may be considered “established” in Europe (within the meaning of the GDPR), the EPDP Team discussed whether those factors would have an effect upon the discussion and determining GDPR-compliant outcomes. It became clear that legal guidance in relation to the applicability of GDPR in the context of ICANN having an ‘establishment’ in Europe could further inform requirements. * The EPDP Team also discussed the possibility of developing a set of rules for guiding the making of geographical distinctions in an GDPR-compliant manner (akin to the EWG hypothesized “rules engine”). The Team agreed that creating this set of rules was a complex task (just as it would be for individual registrars) and agreed such development could not occur within the remit of this Phase I EPDP. Such a development would also be dependent on the response to the aforementioned legal guidance. EPDP Team Recommendation (a new recommendation as there was none in the Initial Report) The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic: * The EPDP Team may reconsider this recommendation in phase 2 of its work, an * Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. Action Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. If there are additional questions for ICANN Compliance that would serve to inform the deliberations on this recommendation, please share these also. Deadline: Tuesday, 29 January, additional email discussion might follow depending on responses. Best regards, Kurt _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team________________________... Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team
I fully agree with Marc on this point. In our recommendations, we can not specify something in the temporary specification remain in place as there is a clear expiration date of that document. I support Marc’s text below as a recommendation, which reads: “The EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.” Regards, Matt From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of "Anderson, Marc via Gnso-epdp-team" <gnso-epdp-team@icann.org> Reply-To: "Anderson, Marc" <mcanderson@verisign.com> Date: Wednesday, February 6, 2019 at 6:42 PM To: "kurt@kjpritz.com" <kurt@kjpritz.com>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Fwd: Geographic Basis - Recommendation for inclusion in the Final Report This is intended to be administrative feedback and not at all related to the substance of the recommendation. Can we avoid saying that certain language in the temporary specification should “remain in place”? Once the one year period is up, the language in the temporary specification can no longer “remain in place”. We can confirm it as policy, reject it or recommend modifications to it. This also provides an example of where simply referencing the temporary specification will lead to implementation headaches. As written, sections 2.1 and 3 of the temp spec are specifically noted. Section 2.1 provides the instructions that the requirements in sections 2 and 4 MUST be applied. This includes language that conflicts with other recommendations such as section 2.6 which covers privacy/proxy. Unpacking what is intended by this recommendation from its literal meaning can lead to implementation challenges and delays. Going back and re-reading sections 2.1 and 3 of the temp spec may leave someone confused as to what we intended in our recommendation, particularly if that someone has not been a part of our deliberations. On the other hand the “for the avoidance of doubt” part of the recommendation is clear and to the point. “The EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.” To avoid confusion later, we should consider using just that language, or if there is specific language in sections 2.1 and 3 that are needed, include it in the text of the recommendation itself. Thanks, Marc From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of Kurt Pritz Sent: Tuesday, February 05, 2019 1:43 PM To: EPDP <gnso-epdp-team@icann.org> Subject: [EXTERNAL] [Gnso-epdp-team] Fwd: Geographic Basis - Recommendation for inclusion in the Final Report Hi Everyone: In reference to Kristina’s recommendation for the Geographic Basis discussion below, I have noticed positive feedback thus far. Could those who are interested please comment on this proposal and signal a request for additional discussion if you wish to advocate for different text. Please respond today if possible so that we can schedule the discussion if need be but, in an case, by tomorrow (Wednesday) at the latest. Thx & regards, Kurt Begin forwarded message: From: "Rosette, Kristina via Gnso-epdp-team" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] FW: Geographic Basis - Recommendation for inclusion in the Final Report Date: February 3, 2019 at 5:58:52 AM PST To: EPDP <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Reply-To: "Rosette, Kristina" <rosettek@amazon.com<mailto:rosettek@amazon.com>> Hi, Here’s where I’ve landed and what I propose . (Additions from Kurt’s initial text in bold, deletions in strike through). The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators , i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic, t: * The EPDP Team may reconsider this recommendation in phase 2 of its work. , an * Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. -*- Clean version: The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic, the EPDP Team may reconsider this recommendation in phase 2 of its work. K From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Rosette, Kristina via Gnso-epdp-team Sent: Tuesday, January 29, 2019 9:13 PM To: EPDP <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report Hi, I’m still trying to come up with language for the first part of the recommendation that may address my concerns, Amr’s and Farzaneh’s. In the meantime, my understanding about the rule set idea was similar to Farzaneh’s. K From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of farzaneh badii Sent: Tuesday, January 29, 2019 9:03 AM To: Amr Elsadr <aelsadr@icannpolicy.ninja<mailto:aelsadr@icannpolicy.ninja>> Cc: EPDP <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report Thanks Kurt. I agree with Amr but I don't think Appendix A, section 2.1 and 3 should be included. Those clauses are not about Geo differentiation of "registrants" only. Also I saw the draft final version of the report and there is no consensus to discuss the feasibility conditions and methodology for the development of a rule set, Milton also recorded our objection about this multiple times. Why did it end up in the recommendation again? I suggest deleting the "consider the feasibility ..." bullet point. If we want to dig this topic out again and waste hours of our time discuss whether to do a study on the feasibility of how to provide less data protection for those who are not located in the EU, then we can decide on that in phase 2. Farzaneh On Fri, Jan 25, 2019 at 3:32 PM Amr Elsadr <aelsadr@icannpolicy.ninja<mailto:aelsadr@icannpolicy.ninja>> wrote: Hi Kurt, Thanks for this. It seems fine to me, except that I’m not clear why we would wish for the final report to suggest that the EPDP Team “agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis”. The emphasis here is on the word “should”. I don’t believe this is accurate, as there have been a number of views expressed on why differentiation between registrants on a geographic basis should NOT be done. A few are mentioned in your email below, but several others are not. These might not have been brought up very recently, such as during the review of public comments. However, they certainly were in the discussions leading up to the publication of the initial report. I believe there is still divergence within the EPDP Team on whether Contracted Parties should do anything at all in the context of this recommendation. Furthermore, the Temp Spec doesn’t indicate whether or not Contracted PartiesSHOULD do anything here either. It only says that those Contracted Parties to whom section 2.1 of appendix A is applicable to MUST apply the requirements in sections 2 and 4 of the same appendix, and that those to whom section 3 of appendix A are applicable MAY do the same. I would prefer that the recommendation be amended to simply say: The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic: * The EPDP Team may reconsider this recommendation in phase 2 of its work, an * Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. In practically implementable terms, this achieves the same purpose of the recommendation language you proposed, without suggesting the EPDP Team has reached consensus on whether or not geo differentiation of registrants SHOULD be done. Thanks. Amr On Jan 25, 2019, at 6:05 PM, Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>> wrote: Hi Everyone: With the ongoing goal of progressing issues via email, the leadership and support teams have considered the review of public comment made during the recent plenary conference call and suggests the following language to capture the agreement in principle that was developed on making Geographic Distinctions. Based on that discussion the recommendation below is proposed for EPDP Team consideration. Team Discussion The Initial Report did not contain a Recommendation for the handling of personal data based on geographical considerations. Instead, the Initial Report asked three questions so that the community input could provide a guide for the EPDP Teams deliberations leading to the Final Report. Those questions were: h) Applicability of Data Processing Requirements h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis? h2) Is there a legal basis for Contracted Parties to differentiate between registrants on a geographic basis? The EPDP Team considered the public comment and developed the following thoughts in its deliberations in addressing the charter questions: * The EPDP Team discussed this extensively (as documented in the Initial Report) as well as in the context of the review on the public comments received on the Initial Report. In relation to part of charter question h1, the EPDP Team agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis; * However, the EPDP Team members have divergent views on whether differentiation on a geographic basis should be required. * Recognizing that ICANN is a Data Controller in many scenarios and that ICANN may be considered “established” in Europe (within the meaning of the GDPR), the EPDP Team discussed whether those factors would have an effect upon the discussion and determining GDPR-compliant outcomes. It became clear that legal guidance in relation to the applicability of GDPR in the context of ICANN having an ‘establishment’ in Europe could further inform requirements. * The EPDP Team also discussed the possibility of developing a set of rules for guiding the making of geographical distinctions in an GDPR-compliant manner (akin to the EWG hypothesized “rules engine”). The Team agreed that creating this set of rules was a complex task (just as it would be for individual registrars) and agreed such development could not occur within the remit of this Phase I EPDP. Such a development would also be dependent on the response to the aforementioned legal guidance. EPDP Team Recommendation (a new recommendation as there was none in the Initial Report) The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic: * The EPDP Team may reconsider this recommendation in phase 2 of its work, an * Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. Action Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. If there are additional questions for ICANN Compliance that would serve to inform the deliberations on this recommendation, please share these also. Deadline: Tuesday, 29 January, additional email discussion might follow depending on responses. Best regards, Kurt _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team________________________... Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Sounds good to me too. Thanks, Marc. Amr
On Feb 7, 2019, at 4:16 AM, Matt Serlin <matt@brandsight.com> wrote:
I fully agree with Marc on this point. In our recommendations, we can not specify something in the temporary specification remain in place as there is a clear expiration date of that document.
I support Marc’s text below as a recommendation, which reads:
“The EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.”
Regards,
Matt
From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of "Anderson, Marc via Gnso-epdp-team" <gnso-epdp-team@icann.org> Reply-To: "Anderson, Marc" <mcanderson@verisign.com> Date: Wednesday, February 6, 2019 at 6:42 PM To: "kurt@kjpritz.com" <kurt@kjpritz.com>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Fwd: Geographic Basis - Recommendation for inclusion in the Final Report
This is intended to be administrative feedback and not at all related to the substance of the recommendation.
Can we avoid saying that certain language in the temporary specification should “remain in place”? Once the one year period is up, the language in the temporary specification can no longer “remain in place”. We can confirm it as policy, reject it or recommend modifications to it.
This also provides an example of where simply referencing the temporary specification will lead to implementation headaches. As written, sections 2.1 and 3 of the temp spec are specifically noted. Section 2.1 provides the instructions that the requirements in sections 2 and 4 MUST be applied. This includes language that conflicts with other recommendations such as section 2.6 which covers privacy/proxy. Unpacking what is intended by this recommendation from its literal meaning can lead to implementation challenges and delays.
Going back and re-reading sections 2.1 and 3 of the temp spec may leave someone confused as to what we intended in our recommendation, particularly if that someone has not been a part of our deliberations. On the other hand the “for the avoidance of doubt” part of the recommendation is clear and to the point. “The EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.” To avoid confusion later, we should consider using just that language, or if there is specific language in sections 2.1 and 3 that are needed, include it in the text of the recommendation itself.
Thanks, Marc
From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of Kurt Pritz Sent: Tuesday, February 05, 2019 1:43 PM To: EPDP <gnso-epdp-team@icann.org> Subject: [EXTERNAL] [Gnso-epdp-team] Fwd: Geographic Basis - Recommendation for inclusion in the Final Report
Hi Everyone:
In reference to Kristina’s recommendation for the Geographic Basis discussion below, I have noticed positive feedback thus far. Could those who are interested please comment on this proposal and signal a request for additional discussion if you wish to advocate for different text.
Please respond today if possible so that we can schedule the discussion if need be but, in an case, by tomorrow (Wednesday) at the latest.
Thx & regards,
Kurt
Begin forwarded message:
From: "Rosette, Kristina via Gnso-epdp-team" <gnso-epdp-team@icann.org>
Subject: [Gnso-epdp-team] FW: Geographic Basis - Recommendation for inclusion in the Final Report
Date: February 3, 2019 at 5:58:52 AM PST
To: EPDP <gnso-epdp-team@icann.org>
Reply-To: "Rosette, Kristina" <rosettek@amazon.com>
Hi,
Here’s where I’ve landed and what I propose . (Additions from Kurt’s initial text in bold, deletions in strike through).
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators , i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic, t:
- The EPDP Team may reconsider this recommendation in phase 2 of its work. , an
- Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
-*-
Clean version:
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic, the EPDP Team may reconsider this recommendation in phase 2 of its work.
K
From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Rosette, Kristina via Gnso-epdp-team Sent: Tuesday, January 29, 2019 9:13 PM To: EPDP <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report
Hi,
I’m still trying to come up with language for the first part of the recommendation that may address my concerns, Amr’s and Farzaneh’s.
In the meantime, my understanding about the rule set idea was similar to Farzaneh’s.
K
From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of farzaneh badii Sent: Tuesday, January 29, 2019 9:03 AM To: Amr Elsadr <aelsadr@icannpolicy.ninja> Cc: EPDP <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report
Thanks Kurt.
I agree with Amr but I don't think Appendix A, section 2.1 and 3 should be included. Those clauses are not about Geo differentiation of "registrants" only.
Also I saw the draft final version of the report and there is no consensus to discuss the feasibility conditions and methodology for the development of a rule set, Milton also recorded our objection about this multiple times. Why did it end up in the recommendation again? I suggest deleting the "consider the feasibility ..." bullet point. If we want to dig this topic out again and waste hours of our time discuss whether to do a study on the feasibility of how to provide less data protection for those who are not located in the EU, then we can decide on that in phase 2.
Farzaneh
On Fri, Jan 25, 2019 at 3:32 PM Amr Elsadr <aelsadr@icannpolicy.ninja> wrote:
Hi Kurt,
Thanks for this. It seems fine to me, except that I’m not clear why we would wish for the final report to suggest that the EPDP Team “agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis”.
The emphasis here is on the word “should”. I don’t believe this is accurate, as there have been a number of views expressed on why differentiation between registrants on a geographic basis should NOT be done. A few are mentioned in your email below, but several others are not. These might not have been brought up very recently, such as during the review of public comments. However, they certainly were in the discussions leading up to the publication of the initial report.
I believe there is still divergence within the EPDP Team on whether Contracted Parties should do anything at all in the context of this recommendation. Furthermore, the Temp Spec doesn’t indicate whether or not Contracted PartiesSHOULD do anything here either. It only says that those Contracted Parties to whom section 2.1 of appendix A is applicable to MUST apply the requirements in sections 2 and 4 of the same appendix, and that those to whom section 3 of appendix A are applicable MAY do the same.
I would prefer that the recommendation be amended to simply say:
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic:
- The EPDP Team may reconsider this recommendation in phase 2 of its work, an
- Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
In practically implementable terms, this achieves the same purpose of the recommendation language you proposed, without suggesting the EPDP Team has reached consensus on whether or not geo differentiation of registrants SHOULD be done.
Thanks.
Amr
On Jan 25, 2019, at 6:05 PM, Kurt Pritz <kurt@kjpritz.com> wrote:
Hi Everyone:
With the ongoing goal of progressing issues via email, the leadership and support teams have considered the review of public comment made during the recent plenary conference call and suggests the following language to capture the agreement in principle that was developed on making Geographic Distinctions.
Based on that discussion the recommendation below is proposed for EPDP Team consideration.
Team Discussion
The Initial Report did not contain a Recommendation for the handling of personal data based on geographical considerations. Instead, the Initial Report asked three questions so that the community input could provide a guide for the EPDP Teams deliberations leading to the Final Report. Those questions were:
h) Applicability of Data Processing Requirements
h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis?
h2) Is there a legal basis for Contracted Parties to differentiate between registrants on a geographic basis?
The EPDP Team considered the public comment and developed the following thoughts in its deliberations in addressing the charter questions:
- The EPDP Team discussed this extensively (as documented in the Initial Report) as well as in the context of the review on the public comments received on the Initial Report. In relation to part of charter question h1, the EPDP Team agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis;
- However, the EPDP Team members have divergent views on whether differentiation on a geographic basis should be required.
- Recognizing that ICANN is a Data Controller in many scenarios and that ICANN may be considered “established” in Europe (within the meaning of the GDPR), the EPDP Team discussed whether those factors would have an effect upon the discussion and determining GDPR-compliant outcomes. It became clear that legal guidance in relation to the applicability of GDPR in the context of ICANN having an ‘establishment’ in Europe could further inform requirements.
- The EPDP Team also discussed the possibility of developing a set of rules for guiding the making of geographical distinctions in an GDPR-compliant manner (akin to the EWG hypothesized “rules engine”). The Team agreed that creating this set of rules was a complex task (just as it would be for individual registrars) and agreed such development could not occur within the remit of this Phase I EPDP. Such a development would also be dependent on the response to the aforementioned legal guidance.
EPDP Team Recommendation (a new recommendation as there was none in the Initial Report) The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic:
- The EPDP Team may reconsider this recommendation in phase 2 of its work, an
- Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
Action
Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. If there are additional questions for ICANN Compliance that would serve to inform the deliberations on this recommendation, please share these also.
Deadline: Tuesday, 29 January, additional email discussion might follow depending on responses.
Best regards,
Kurt
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team________________________... Gnso-epdp-team mailing listGnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
I think this is a really important point, thanks for raising it Marc. We should avoid cross referencing in general, and repeat the desired language in our own text. Stephanie Perrin On 2019-02-06 20:42, Anderson, Marc via Gnso-epdp-team wrote: This is intended to be administrative feedback and not at all related to the substance of the recommendation. Can we avoid saying that certain language in the temporary specification should “remain in place”? Once the one year period is up, the language in the temporary specification can no longer “remain in place”. We can confirm it as policy, reject it or recommend modifications to it. This also provides an example of where simply referencing the temporary specification will lead to implementation headaches. As written, sections 2.1 and 3 of the temp spec are specifically noted. Section 2.1 provides the instructions that the requirements in sections 2 and 4 MUST be applied. This includes language that conflicts with other recommendations such as section 2.6 which covers privacy/proxy. Unpacking what is intended by this recommendation from its literal meaning can lead to implementation challenges and delays. Going back and re-reading sections 2.1 and 3 of the temp spec may leave someone confused as to what we intended in our recommendation, particularly if that someone has not been a part of our deliberations. On the other hand the “for the avoidance of doubt” part of the recommendation is clear and to the point. “The EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.” To avoid confusion later, we should consider using just that language, or if there is specific language in sections 2.1 and 3 that are needed, include it in the text of the recommendation itself. Thanks, Marc From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org><mailto:gnso-epdp-team-bounces@icann.org> On Behalf Of Kurt Pritz Sent: Tuesday, February 05, 2019 1:43 PM To: EPDP <gnso-epdp-team@icann.org><mailto:gnso-epdp-team@icann.org> Subject: [EXTERNAL] [Gnso-epdp-team] Fwd: Geographic Basis - Recommendation for inclusion in the Final Report Hi Everyone: In reference to Kristina’s recommendation for the Geographic Basis discussion below, I have noticed positive feedback thus far. Could those who are interested please comment on this proposal and signal a request for additional discussion if you wish to advocate for different text. Please respond today if possible so that we can schedule the discussion if need be but, in an case, by tomorrow (Wednesday) at the latest. Thx & regards, Kurt Begin forwarded message: From: "Rosette, Kristina via Gnso-epdp-team" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] FW: Geographic Basis - Recommendation for inclusion in the Final Report Date: February 3, 2019 at 5:58:52 AM PST To: EPDP <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Reply-To: "Rosette, Kristina" <rosettek@amazon.com<mailto:rosettek@amazon.com>> Hi, Here’s where I’ve landed and what I propose . (Additions from Kurt’s initial text in bold, deletions in strike through). The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators , i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic, t: * The EPDP Team may reconsider this recommendation in phase 2 of its work. , an * Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. -*- Clean version: The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic, the EPDP Team may reconsider this recommendation in phase 2 of its work. K From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Rosette, Kristina via Gnso-epdp-team Sent: Tuesday, January 29, 2019 9:13 PM To: EPDP <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report Hi, I’m still trying to come up with language for the first part of the recommendation that may address my concerns, Amr’s and Farzaneh’s. In the meantime, my understanding about the rule set idea was similar to Farzaneh’s. K From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of farzaneh badii Sent: Tuesday, January 29, 2019 9:03 AM To: Amr Elsadr <aelsadr@icannpolicy.ninja<mailto:aelsadr@icannpolicy.ninja>> Cc: EPDP <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report Thanks Kurt. I agree with Amr but I don't think Appendix A, section 2.1 and 3 should be included. Those clauses are not about Geo differentiation of "registrants" only. Also I saw the draft final version of the report and there is no consensus to discuss the feasibility conditions and methodology for the development of a rule set, Milton also recorded our objection about this multiple times. Why did it end up in the recommendation again? I suggest deleting the "consider the feasibility ..." bullet point. If we want to dig this topic out again and waste hours of our time discuss whether to do a study on the feasibility of how to provide less data protection for those who are not located in the EU, then we can decide on that in phase 2. Farzaneh On Fri, Jan 25, 2019 at 3:32 PM Amr Elsadr <aelsadr@icannpolicy.ninja<mailto:aelsadr@icannpolicy.ninja>> wrote: Hi Kurt, Thanks for this. It seems fine to me, except that I’m not clear why we would wish for the final report to suggest that the EPDP Team “agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis”. The emphasis here is on the word “should”. I don’t believe this is accurate, as there have been a number of views expressed on why differentiation between registrants on a geographic basis should NOT be done. A few are mentioned in your email below, but several others are not. These might not have been brought up very recently, such as during the review of public comments. However, they certainly were in the discussions leading up to the publication of the initial report. I believe there is still divergence within the EPDP Team on whether Contracted Parties should do anything at all in the context of this recommendation. Furthermore, the Temp Spec doesn’t indicate whether or not Contracted PartiesSHOULD do anything here either. It only says that those Contracted Parties to whom section 2.1 of appendix A is applicable to MUST apply the requirements in sections 2 and 4 of the same appendix, and that those to whom section 3 of appendix A are applicable MAY do the same. I would prefer that the recommendation be amended to simply say: The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic: * The EPDP Team may reconsider this recommendation in phase 2 of its work, an * Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. In practically implementable terms, this achieves the same purpose of the recommendation language you proposed, without suggesting the EPDP Team has reached consensus on whether or not geo differentiation of registrants SHOULD be done. Thanks. Amr On Jan 25, 2019, at 6:05 PM, Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>> wrote: Hi Everyone: With the ongoing goal of progressing issues via email, the leadership and support teams have considered the review of public comment made during the recent plenary conference call and suggests the following language to capture the agreement in principle that was developed on making Geographic Distinctions. Based on that discussion the recommendation below is proposed for EPDP Team consideration. Team Discussion The Initial Report did not contain a Recommendation for the handling of personal data based on geographical considerations. Instead, the Initial Report asked three questions so that the community input could provide a guide for the EPDP Teams deliberations leading to the Final Report. Those questions were: h) Applicability of Data Processing Requirements h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis? h2) Is there a legal basis for Contracted Parties to differentiate between registrants on a geographic basis? The EPDP Team considered the public comment and developed the following thoughts in its deliberations in addressing the charter questions: * The EPDP Team discussed this extensively (as documented in the Initial Report) as well as in the context of the review on the public comments received on the Initial Report. In relation to part of charter question h1, the EPDP Team agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis; * However, the EPDP Team members have divergent views on whether differentiation on a geographic basis should be required. * Recognizing that ICANN is a Data Controller in many scenarios and that ICANN may be considered “established” in Europe (within the meaning of the GDPR), the EPDP Team discussed whether those factors would have an effect upon the discussion and determining GDPR-compliant outcomes. It became clear that legal guidance in relation to the applicability of GDPR in the context of ICANN having an ‘establishment’ in Europe could further inform requirements. * The EPDP Team also discussed the possibility of developing a set of rules for guiding the making of geographical distinctions in an GDPR-compliant manner (akin to the EWG hypothesized “rules engine”). The Team agreed that creating this set of rules was a complex task (just as it would be for individual registrars) and agreed such development could not occur within the remit of this Phase I EPDP. Such a development would also be dependent on the response to the aforementioned legal guidance. EPDP Team Recommendation (a new recommendation as there was none in the Initial Report) The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic: * The EPDP Team may reconsider this recommendation in phase 2 of its work, an * Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. Action Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. If there are additional questions for ICANN Compliance that would serve to inform the deliberations on this recommendation, please share these also. Deadline: Tuesday, 29 January, additional email discussion might follow depending on responses. Best regards, Kurt _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team________________________... Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Hi all, We have discussed this topic at length and outlined the complexity of Registries, Registrars, Resellers and Backend Service Providers in particular. Whilst I do see that there is a need to allow for certain parties not to follow GDPR, I thought we emerging consensus earlier that that should be the exception rather than the rule. I would have thought that a waiver process could address that need and that we would otherwise go for one consistent approach as much as we can. Now that the CP an make a free choice to opt in or out based on the geographic location, how is this visible to the RNH or other data subjects involved? How do we avoid that data is moving from the GDPR compliant regime to a non-compliant regime when domain names are transferred to another registrar. How does the RNH know what the protection level is if a CP does not treat all registration data the same depending on where the RNH is based? Can both Rys and Rrs have that choice if the results are contradictory (Rr takes the global approach, but the Ry does not?). I am not trying to be difficult at this late stage, but I am not sure this works out. But then again, I may have missed something :-). Thanks for reading thus far. Best, Thomas
Am 07.02.2019 um 16:26 schrieb Stephanie Perrin <stephanie.perrin@mail.utoronto.ca>:
I think this is a really important point, thanks for raising it Marc. We should avoid cross referencing in general, and repeat the desired language in our own text.
Stephanie Perrin
On 2019-02-06 20:42, Anderson, Marc via Gnso-epdp-team wrote:
This is intended to be administrative feedback and not at all related to the substance of the recommendation.
Can we avoid saying that certain language in the temporary specification should “remain in place”? Once the one year period is up, the language in the temporary specification can no longer “remain in place”. We can confirm it as policy, reject it or recommend modifications to it.
This also provides an example of where simply referencing the temporary specification will lead to implementation headaches. As written, sections 2.1 and 3 of the temp spec are specifically noted. Section 2.1 provides the instructions that the requirements in sections 2 and 4 MUST be applied. This includes language that conflicts with other recommendations such as section 2.6 which covers privacy/proxy. Unpacking what is intended by this recommendation from its literal meaning can lead to implementation challenges and delays.
Going back and re-reading sections 2.1 and 3 of the temp spec may leave someone confused as to what we intended in our recommendation, particularly if that someone has not been a part of our deliberations. On the other hand the “for the avoidance of doubt” part of the recommendation is clear and to the point. “The EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.” To avoid confusion later, we should consider using just that language, or if there is specific language in sections 2.1 and 3 that are needed, include it in the text of the recommendation itself.
Thanks, Marc
From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> <mailto:gnso-epdp-team-bounces@icann.org> On Behalf Of Kurt Pritz Sent: Tuesday, February 05, 2019 1:43 PM To: EPDP <gnso-epdp-team@icann.org> <mailto:gnso-epdp-team@icann.org> Subject: [EXTERNAL] [Gnso-epdp-team] Fwd: Geographic Basis - Recommendation for inclusion in the Final Report
Hi Everyone:
In reference to Kristina’s recommendation for the Geographic Basis discussion below, I have noticed positive feedback thus far. Could those who are interested please comment on this proposal and signal a request for additional discussion if you wish to advocate for different text.
Please respond today if possible so that we can schedule the discussion if need be but, in an case, by tomorrow (Wednesday) at the latest.
Thx & regards,
Kurt
Begin forwarded message:
From: "Rosette, Kristina via Gnso-epdp-team" <gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] FW: Geographic Basis - Recommendation for inclusion in the Final Report Date: February 3, 2019 at 5:58:52 AM PST To: EPDP <gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>> Reply-To: "Rosette, Kristina" <rosettek@amazon.com <mailto:rosettek@amazon.com>>
Hi,
Here’s where I’ve landed and what I propose . (Additions from Kurt’s initial text in bold, deletions in strike through).
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators , i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic, t: The EPDP Team may reconsider this recommendation in phase 2 of its work. , an Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. -*-
Clean version:
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A to the Temporary Specification remain in place. For the avoidance of doubt, the EPDP Team recommends that Registrars and Registry Operators are permitted to differentiate between registrants on a geographic basis, but are not obligated to do so. Based on the legal guidance that is provided on this topic, the EPDP Team may reconsider this recommendation in phase 2 of its work.
K
From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org <mailto:gnso-epdp-team-bounces@icann.org>] On Behalf Of Rosette, Kristina via Gnso-epdp-team Sent: Tuesday, January 29, 2019 9:13 PM To: EPDP <gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report
Hi,
I’m still trying to come up with language for the first part of the recommendation that may address my concerns, Amr’s and Farzaneh’s.
In the meantime, my understanding about the rule set idea was similar to Farzaneh’s.
K
From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org <mailto:gnso-epdp-team-bounces@icann.org>] On Behalf Of farzaneh badii Sent: Tuesday, January 29, 2019 9:03 AM To: Amr Elsadr <aelsadr@icannpolicy.ninja <mailto:aelsadr@icannpolicy.ninja>> Cc: EPDP <gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Geographic Basis - Recommendation for inclusion in the Final Report
Thanks Kurt.
I agree with Amr but I don't think Appendix A, section 2.1 and 3 should be included. Those clauses are not about Geo differentiation of "registrants" only.
Also I saw the draft final version of the report and there is no consensus to discuss the feasibility conditions and methodology for the development of a rule set, Milton also recorded our objection about this multiple times. Why did it end up in the recommendation again? I suggest deleting the "consider the feasibility ..." bullet point. If we want to dig this topic out again and waste hours of our time discuss whether to do a study on the feasibility of how to provide less data protection for those who are not located in the EU, then we can decide on that in phase 2.
Farzaneh
On Fri, Jan 25, 2019 at 3:32 PM Amr Elsadr <aelsadr@icannpolicy.ninja <mailto:aelsadr@icannpolicy.ninja>> wrote: Hi Kurt,
Thanks for this. It seems fine to me, except that I’m not clear why we would wish for the final report to suggest that the EPDP Team “agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis”.
The emphasis here is on the word “should”. I don’t believe this is accurate, as there have been a number of views expressed on why differentiation between registrants on a geographic basis should NOT be done. A few are mentioned in your email below, but several others are not. These might not have been brought up very recently, such as during the review of public comments. However, they certainly were in the discussions leading up to the publication of the initial report.
I believe there is still divergence within the EPDP Team on whether Contracted Parties should do anything at all in the context of this recommendation. Furthermore, the Temp Spec doesn’t indicate whether or not Contracted PartiesSHOULD do anything here either. It only says that those Contracted Parties to whom section 2.1 of appendix A is applicable to MUST apply the requirements in sections 2 and 4 of the same appendix, and that those to whom section 3 of appendix A are applicable MAY do the same.
I would prefer that the recommendation be amended to simply say:
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of Appendix A of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic: The EPDP Team may reconsider this recommendation in phase 2 of its work, an Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions. In practically implementable terms, this achieves the same purpose of the recommendation language you proposed, without suggesting the EPDP Team has reached consensus on whether or not geo differentiation of registrants SHOULD be done.
Thanks.
Amr
On Jan 25, 2019, at 6:05 PM, Kurt Pritz <kurt@kjpritz.com <mailto:kurt@kjpritz.com>> wrote:
Hi Everyone: With the ongoing goal of progressing issues via email, the leadership and support teams have considered the review of public comment made during the recent plenary conference call and suggests the following language to capture the agreement in principle that was developed on making Geographic Distinctions. Based on that discussion the recommendation below is proposed for EPDP Team consideration.
Team Discussion The Initial Report did not contain a Recommendation for the handling of personal data based on geographical considerations. Instead, the Initial Report asked three questions so that the community input could provide a guide for the EPDP Teams deliberations leading to the Final Report. Those questions were:
h) Applicability of Data Processing Requirements
h1) Should Registry Operators and Registrars (“Contracted Parties”) be permitted or required to differentiate between registrants on a geographic basis?
h2) Is there a legal basis for Contracted Parties to differentiate between registrants on a geographic basis?
The EPDP Team considered the public comment and developed the following thoughts in its deliberations in addressing the charter questions: The EPDP Team discussed this extensively (as documented in the Initial Report) as well as in the context of the review on the public comments received on the Initial Report. In relation to part of charter question h1, the EPDP Team agrees that contracted parties should be (and are) permitted to differentiate between registrants on a geographic basis; However, the EPDP Team members have divergent views on whether differentiation on a geographic basis should be required. Recognizing that ICANN is a Data Controller in many scenarios and that ICANN may be considered “established” in Europe (within the meaning of the GDPR), the EPDP Team discussed whether those factors would have an effect upon the discussion and determining GDPR-compliant outcomes. It became clear that legal guidance in relation to the applicability of GDPR in the context of ICANN having an ‘establishment’ in Europe could further inform requirements. The EPDP Team also discussed the possibility of developing a set of rules for guiding the making of geographical distinctions in an GDPR-compliant manner (akin to the EWG hypothesized “rules engine”). The Team agreed that creating this set of rules was a complex task (just as it would be for individual registrars) and agreed such development could not occur within the remit of this Phase I EPDP. Such a development would also be dependent on the response to the aforementioned legal guidance.
EPDP Team Recommendation (a new recommendation as there was none in the Initial Report)
The EPDP Team recommends that the existing requirements of §§ 2.1 and 3 of the Temporary Specification remain in place, i.e., contracted parties should (and are) permitted to differentiate between registrants on a geographic basis, but are not obligated to do so.
Based on the legal guidance that is provided on this topic: The EPDP Team may reconsider this recommendation in phase 2 of its work, an Consider the feasibility conditions and methodology for the development of a rule set for making decisions on geographic distinctions.
Action Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation should be discussed. If there are additional questions for ICANN Compliance that would serve to inform the deliberations on this recommendation, please share these also. Deadline: Tuesday, 29 January, additional email discussion might follow depending on responses.
Best regards, Kurt
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team> _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team________________________... <https://mm.icann.org/mailman/listinfo/gnso-epdp-team_______________________________________________> Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team>
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team>_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
participants (10)
-
Alan Woods -
Amr Elsadr -
Anderson, Marc -
farzaneh badii -
Kavouss Arasteh -
Kurt Pritz -
Matt Serlin -
Rosette, Kristina -
Stephanie Perrin -
Thomas Rickert