Thank you Marika & Milton, Marika (and team) thank you for your continuing patience. Although the majority of my team members are (hopefully) still sleeping at this hour, this is my opinion, I will say that although the modifications better represents the divergence of views, I still think that it fails to impart the fact that we are not merely looking at a clash of opinion. we are looking at a breaking point. I can only speak for myself, but I certainly am not taking such a stance because I think we need to simply duke it out and have more back and forth. I do so because, in the context of this EPDP, the suggestion that differentiation is a basic policy obligation,flies in the face of reason (a reasonableness which is enshrined in Art 32 GDPR by the by), and is ignoring, point blank the concerns of the Contracted Parties who will remain liable for the fallout of a bad policy. Why create a policy, that in our expert opinion and years of implementation experience, that we are telling you will not work and will not be capable of implementation? (Apologies i intended to end my email here but then responses came in) To Hadia's point, I too will restate, yes, we do have a job to do. That job is to either confirm the Temp Spec wording, as is, in a consensus policy, or where the Temp Spec wording is not sufficient to bring us into compliance, to recommend such changes as we deem necessary. The goal remains to bring the Contracted parties processing of data in line with the requirements of the GDPR. You have unfortunately misunderstood the contracted parties stance. The contracted parties statement is that we shall not accept any policy, which we believe does the opposite of this goal i.e. where the suggested policy actually impedes our ability to attain or maintain such compliance with the law, or worse still, will recklessly lead us into a deeper situation of breach of that law (although it should be patently clear, to avoid doubt, distinguishing Natural / legal and geographic applications fall squarely into the latter). So our stance is perfectly reasonable. I am dismayed that there appears to be some within the ePDP whose goal continues to appear to be the pursuit of theor own goals, over that of ensuring the vindication of the rights of the registrant. I don't claim to be a white knight in this, the CPH is equally driven by ensuring we are not sanctioned for the breach of such law, but the net effect is the same. Some in the ePDP are simply making unreasonable demands of the CPH. And there are only so many more times we can remind of A) the scope of the ePDP and failing that the B) the state of the art, the cost of implementation and the likely effect that such unreasonable insistence will have on all the parties involved. hence our perfectly reasonable, and at this point completely expected statement. To further clarify Hadia, between "new obligations" and "any changes to the contracts". Again this is clearly not the point of the statement. Changes to the contracts (i.e. such as the Consensus Policy) which are necessary to bring us into compliance with the law are expected and welcome (the CPH have been asking for such changes for over 2 years now). Additional contractual obligations, such as the creation of a new system and technology, and the enforcement of unreasonable requirements that only intensify the risk of breach, which are also not necessary to achieve the Temp Spec goals, are not on the table for the ePDP. Kind regards, Alan [image: Donuts Inc.] <http://donuts.domains> Alan Woods Senior Compliance & Policy Manager, Donuts Inc. ------------------------------ The Victorians, 15-18 Earlsfort Terrace Dublin 2, County Dublin Ireland <https://www.facebook.com/donutstlds> <https://twitter.com/DonutsInc> <https://www.linkedin.com/company/donuts-inc> Please NOTE: This electronic message, including any attachments, may include privileged, confidential and/or inside information owned by Donuts Inc. . Any distribution or use of this communication by anyone other than the intended recipient(s) is strictly prohibited and may be unlawful. If you are not the intended recipient, please notify the sender by replying to this message and then delete it from your system. Thank you. On Thu, Nov 8, 2018 at 9:39 AM Mueller, Milton L <milton@gatech.edu> wrote:

Thanks, Marika

Your proposed changes are quite good. My only request would be that the bullet point you added about risks, namely

· The difficulty of distinguishing between the two at the point of registration could lead to the unintended publication of the private data of many natural persons.

Be placed first in the list, as we consider that to be the primary problem, and the other bullet points as less significant.

Appreciate your rapid update!

*From:* Marika Konings [mailto:marika.konings@icann.org] *Sent:* Wednesday, November 7, 2018 9:56 PM *To:* Lindsay Hamilton-Reid <lindsay.hamilton-reid@fasthosts.com>; Mueller, Milton L <milton@gatech.edu> *Cc:* Kurt Pritz <kurt@kjpritz.com>; gnso-epdp-team@icann.org *Subject:* Re: [Ext] Re: [Gnso-epdp-team] NCSG reactions to (part of) the interim report

Milton, Lindsay, thank you for your input. Staff has made some proposed updates to reflect your feedback (see redlines on first two pages of the attached document). Hopefully this addresses accurately where things currently stand from all perspectives.

Best regards,

Caitlin, Berry and Marika

*From: *Lindsay Hamilton-Reid <lindsay.hamilton-reid@fasthosts.com> *Date: *Wednesday, November 7, 2018 at 3:13 PM *To: *"Mueller, Milton L" <milton@gatech.edu> *Cc: *Marika Konings <marika.konings@icann.org>, Kurt Pritz < kurt@kjpritz.com>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> *Subject: *[Ext] Re: [Gnso-epdp-team] NCSG reactions to (part of) the interim report

+1 Milton.

In addition to Milton’s email below, these points have been made repeatedly by the NCSG and the CPH. The Interim Report should reflect the differences in opinion and that there is no consensus on this point and many others.

Many thanks

Lindsay

Sent from my iPhone

On 7 Nov 2018, at 21:05, Mueller, Milton L <milton@gatech.edu> wrote:

Marika

NCSG cannot accept big portions of the proposed text regarding the legal/natural persons distinction. We note that the text disregards statements from the contracted parties and NCSG. We would respectfully ask you to revise the text in a way that respects and reflects clearly stated and strongly held positions of at least three stakeholder groups.

To be specific, the CPH has stated, in regard to the legal/natural persons and geographic distinctions:

“Contracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations.”

NCSG shares this opposition to requiring distinctions between legal and natural persons and geographic distinctions. In our comment on small team 1 we stated:

“The main risk is that the difficulty of distinguishing between the two at the point of registration could lead to the unintended publication of the private data of many natural persons.”

This assessment of risk is not reflected in the report.

We also proposed deleting the entire paragraph on research because researching how various entities make this distinction basically assumes that making this distinction is a live option for the ePDP. In terms of consensus requirements, all indications are that it is not a real option.

It is abundantly clear that no requirement for a distinction between legal and natural persons will survive a consensus recommendation process. At least three stakeholder groups – ¾ of the GNSO and roughly half of the ePDP – are rejecting it as an option. We think the report should move the process forward by explicitly recognizing this fact.

Instead, we have Kurt stating on list that there was “an agreement” to do research on the feasibility of differentiating between natural and legal persons. This statement can only come from completely disregarding the interventions NCSG members made in Barcelona, on the latest call, and in an email sent Tuesday to the list by Amr elSadr. To quote from Amr’s email regarding Kurt’s statement regarding research:

“I don’t believe that [research on legal/natural] was, in any way, reflective of a consensus to proceed with this recommendation among the Small Team members. To me, it was only an acknowledgement that this view was expressed, discussed, and subsequently required consideration by the whole team.”

Kurt has not responded to this email.

We will raise these concerns on the call tomorrow.

In general, I think the team is in danger of losing sight of its primary mission, which is to quickly bring Whois into compliance with GDPR and to turn the temp spec into a legitimate policy. It seems that some people are seizing on the debate over the temp spec to impose new requirements on contracted parties. I understand that the chair and staff are trying their best to move things along, but we are disturbed by an apparent tendency to ignore or disregard clear position statements from SGs. One of the most important jobs of the ePDP chair is to recognize where consensus exists and where it does not. Some proposals are just not real options: they will never survive a council vote or a consensus call in the ePDP. It is unthinkable that the chair or staff would substitute their own preferences for the rough consensus of the working group.

Let’s recognize the parameters of what people can live with and move forward from there. Eliminating options is progress, too.

Milton Mueller, on behalf of NCSG

*From:* Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org <gnso-epdp-team-bounces@icann.org>] *On Behalf Of *Marika Konings *Sent:* Monday, November 5, 2018 11:49 PM *To:* Kurt Pritz <kurt@kjpritz.com>; gnso-epdp-team@icann.org *Subject:* Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2

Following on from Kurt’s message, please find hereby the proposed language for inclusion in the Initial Report. Attached is the document that would be linked so that those interested would be able to review the different perspectives and proposals put forward.

*h3) Should Contracted Parties be allowed or required to treat legal and natural persons differently, and what mechanism is needed to ensure reliable determination of status? *

*h4) Is there a legal basis for Contracted Parties to treat legal and natural persons differently?*

*h5) What are the risks associated with differentiation of registrant status as legal or natural persons across multiple jurisdictions? (See EDPB letter of 5 July 2018).*

The EPDP Team discussed these questions extensively (see [include link to attached document which includes the different proposals]) and although the EPDP Team agrees that Contracted Parties should be allowed to treat legal and natural persons differently, the EPDP Team did not agree on whether this should be required and/or what further steps could or should be undertaken to determine what mechanism is needed to ensure reliable determination of status.

The EPDP Team further agrees under GDPR there is a legal basis to treat legal and natural persons differently, but does not agree on whether that means Contracted Parties should be required to do so, or whether the challenges and legal risks involved in doing so result in leaving this optional. Similarly, the EPDP Team discussed the implication of other data protection regimes which could have different requirements that impact both natural and/or legal persons that would need to be factored in.

The EPDP Team identified a number of risks, including:

- While legal persons don’t have the same protections under GDPR, natural persons employed by a legal person (and who may be designated as the registrant, admin or technical contact) are still natural persons enjoying rights and protections under GDPR. Some noted that this risk may be minimized through clear explanatory language beneath each field when filling in data fields within domain name registrations. - There may be situations in which it can be difficult to separate the data of natural persons from that of legal persons. This can be the case, for example, if the legal person is a sole proprietorship, if the name of a person appears in the company’s name, if the business address is a natural person’s residence, or if an email address is assigned to a single individual (“john.doe@company.example.com” as opposed to “ info@company.example.com.

The EPDP has discussed whether this risk may be somewhat mitigated through educational resources. Some in the EPDP Team expressed caution, as a stated necessity to rely on educational resources may not be considered to be compatible with the concepts of privacy by default or privacy by design i.e. where additional ‘educational resources’ are deemed necessary, the process itself is likely not established or presented in a sufficiently clear manner.

To help further inform the EPDP Team’s deliberations on this topic as the team works towards a Final Report, the EPDP Team would like to request that GDD staff, who will design the implementation of these policy recommendations, commences research by investigating how ccTLDs and contracted parties currently distinguish between natural and legal persons to inform the EPDP Team.

In addition, the EPDP Team would like to request input on the following questions in relation to this topic:

· Are there examples from other industries or areas, e.g. ccTLDs, where a mechanism has been successfully developed and implemented to distinguish between natural and legal person, factoring in some of the challenges identified above?

· Should the EPDP Team decide to recommend requiring distinguishing between natural and legal persons, how should implementation be carried out, especially considering legacy registrations?

· Should the EPDP Team decide to recommend that further research is undertaken, beyond the information that GDD staff may encounter, what and how should this research be carried out?

· (For the EDPB) If registrars allow registrants to self-identify at the time as a natural or legal person, who will be held liable if the registrant incorrectly self-identifies and personal information is publicly displayed? Apart from self-identification, are there any other ways in which risk of liability could be mitigated by registrars?

The research requested and input on these charter questions will help the EPDP Team further analyze if it is possible and desirable to make this distinction in the context of domain name registrations, in a manner that is commercially reasonable, implementable and does not result in unreasonable liability for contracted parties.

Best regards,

Caitlin, Berry and Marika

*From: *Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of Kurt Pritz <kurt@kjpritz.com> *Date: *Monday, November 5, 2018 at 7:45 PM *To: *"gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> *Subject: *Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2

Hi Everyone:

After all of this thought and writing, I think we have two paths forward that are relatively straightforward to describe. Rather than recap the arguments made here, I will just go right into my recommendations for next step and why. The Support Team will follow this with a better summation of what has transpired and how that leads to the recommendations below.

It is clear that camps within our the team are at loggerheads with regard to how geographic basis and natural v legal persons should be handled within the proposed policy recommendations.

*Current situation and recent developments:*

Coming out of the small group meeting #1 during a teleconference, there was an agreement in principle that it was necessary to perform research in order to inform the policy discussion regarding the feasibility of differentiating between legal and natural persons. That agreement survived its initial introduction into the whole team where the comments centered around: (1) the adjectives used to describe the sense of urgency concerning the work, and (2) sharpening the detail regarding steps to be taken after the research. (There was never an agreement about how to proceed regarding differentiation of data subjects based on geographical considerations.)

Starting Friday, substantial markups to the legal v natural agreement on doing research initiated this current three-day email chain.

*Preferred Recommendation (there are two):*

Go back to the agreement in principle that was reached in the small team with representatives from all groups to undertake research to determine if, how and to what extent we can distinguish between legal and natural persons. Then extend that research on to the geographic basis issue. A small group of us can contribute to the terms of reference for this research after the initial report is issued.

*Here is my rationale for this recommendation:*

1) The various arguments laid out in all these emails on this list make the case themselves for the need to do research.

For example, if the ICO says that processors can rely on data subject-provided information, does that mean that personal information mistakenly disclosed can be published without liability? We don’t know. We are setting up this and other questions for DPAs. Isn’t that … research?

There are other scenarios in the emails that will take research to sort through: whether ccTLD experiences are relevant, or whether a registrant boarding a train and leaving the EU for China while another registrant boarding a ferry for Marseilles will both be protected by GDPR. All this takes research to sort out.

Nearly all of the emails on this list have to do with scenarios in support of one position or another - but all need to be studied in order for us to determine if and how distinctions can be made.

2) Many of the arguments laid out are conclusory or without authority. I don’t think the research can have a preordained outcome. To make one point for each line of thinking:

a) In the case of natural vs legal data subjects, some seek to build in in an implementation plan without knowing if or to what degree a solution is implementable

b) In the case of Geographical distinctions between registrants, some are stating that such a distinction is categorically unimplementable without authority or evidence provided.

I think the “truth will out” on these questions and we should not try to push research or our arguments to a pre-ordained outcome.

3) This will provide time to take the effects of existing laws in other jurisdictions into account - if that is deemed desirable.

4) This will take this discussion out of the critical path of finishing our reports, without leaving a blank.

5) The results of the research still must be considered by this team (or its successor) and a consensus derived. Research informs policy; it does not create policy.

6) If we agree to this approach, we can start the research now. If we temporize, there will be little done that will resolve this issue set over the next few months. Taking action in an attempt to understand all the complexity is the responsible thing to do.

7) These are complicated questions and research-based policy-making is required to answer them. How do we meet the timeline and still act in a thorough, detailed manner? By launching research and, in the meantime, going back to the rest of our questions. Whatever our policy conclusions are, even if we are deadlocked in several months time, we should be informed by information garnered from DPAs and other sources.

*The only other recommendation: *

MemorialIze the differences between the two sides on each of the two issues, explaining the arguments for each and asking for public comment on these issues.

*Here is my rationale for and against this recommendation:*

1) It will allow us to publish the initial report and, properly framed, can garner specific public comment.

However, other factors really argue against maintaining the current status and not taking some action:

2) In the time allotted for public comment, no commenter will be able to perform any meaningful research either. There might be reference to a study that partially informs our work, but not a dispositive study. At the end of the comment period, we are likely to be in the same place.

3) It is hard to see how the public comment will differ from our discussion, in this list, to date.

4) Even if we take the preferred research path above, we can still conduct the comment period on the current position of the parties.

5) If we have no outcome on this issue, the result, to me, is unknown and represent a risk to all parties at the table.

*Conclusion*

I thought is was remarkable that we came together and agreed to undertake this research on this difficult topic. It was a significant, meaningful compromise that embodied our reason for being here.

I don’t see anything in all the emails that indicate another compromise is possible unless that discussion is informed with significant, new information. I believe the appropriate path for this group is to recognize the differences cannot be resolved without something new and to take this path.

Talk to you soon and best regards,

Kurt

On Nov 5, 2018, at 4:38 PM, Mark Svancarek (CELA) via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:

Sorry for being dense, I still have questions.

1. It is not surprising that the addition of a new process step would generate short term inefficiencies. It’s 5 years later – are the verification rates improved from 2014? 2. How would an optional “let me self-identify as a corporation” capability be likely to cause verification disruptions?

/marksv

*From:* James M. Bladel <jbladel@godaddy.com> *Sent:* Monday, November 5, 2018 13:28 *To:* Mark Svancarek (CELA) <marksv@microsoft.com>; gnso-epdp-team@icann.org *Subject:* Re: Contracted Parties and Small Teams #1 and #2

Mark –

Shortly following the launch of the 2013 RAA’s requirements for WHOIS Verification, registrars noted that approx. 800,000 domains had been suspended in the first few months. The number continued to climb for a few years, and most were categorized as “false positives”

Here’s some coverage of that data at the time.

https://domainnamewire.com/2014/06/24/over-800000-domain-names-suspended-due... [na01.safelinks.protection.outlook.com] <https://urldefense.proofpoint.com/v2/url?u=https-3A__na01.safelinks.protecti...>

Any program that depends on Registrant self-categorization, self-declaration, or receipt & acting upon a notice has a huge error factor. For GoDaddy in 2014, the RAA verification rate was in the high 70% or low 80%, meaning that service to tens of thousands of customers was delayed or disrupted.

It’s this experience that causes Contracted Parties (but particularly Registrars) to be skeptical of any requirement to just “send an email” or “have the Registrant check a box.” It doesn’t scale.

J.

-------------

*James Bladel*

GoDaddy

*From: *"Mark Svancarek (CELA)" <marksv@microsoft.com> *Date: *Monday, November 5, 2018 at 15:14 *To: *"James M. Bladel" <jbladel@godaddy.com>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> *Subject: *RE: Contracted Parties and Small Teams #1 and #2

James, can you clarify this:

*“**many of whom could lose access to their registrations.”*

*From:* Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> *On Behalf Of *James M. Bladel *Sent:* Monday, November 5, 2018 10:57 *To:* gnso-epdp-team@icann.org *Subject:* [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2

ePDP Colleagues and WG Leadership -

This morning, Registry and Registrar representatives met to discuss the status of potential recommendations from Small Group #1 (Legal vs. Natural) and Small Group #2 (Geographic Regions) in our Draft Initial Report.

We concluded that there are some legal bases supporting these distinctions under GDPR and other data protection laws, and note that our Initial Report supports this. However, we reiterate our numerous high-level concerns against making any Consensus Policy recommendations for contractual requirements in these areas.

Our concerns involve:

- Legal - Aside from GDPR, other data protection laws are less clear on the distinction between legal and natural persons. Future regulations may contain contrary requirements. Furthermore, data of legal entities may contain or consist of personal information of natural persons, which would be entitled to protection under the GDPR and similar data protection regimes. Likewise, the geographic distinctions also create uncertainties.

- Technical - Contracted Parties are uniquely situated to assess the current level of the technological means available to us, and it is our stated position that a technical basis to reliably and confidently make such a distinction does not exist. Especially because any distinction schema would be dependent upon Registrant Self-Identification, which is fraught with error.

- Commercial - Developing and deploying this technology will involve significant costs, which may be prohibitive for smaller organizations and a barrier to market entry. Regardless of whether the distinction(s) are applied to new registrations or legacy domain names, it would be a logistical nightmare for Contracted Parties, and a source of confusion for Registrants, many of whom could lose access to their registrations.

- Asymmetrical Risks vs. Benefits - Contracted Parties would assume all regulatory risks of such an obligations, exclusively for the benefit of unburdened third parties.

- Scope - The distinction between Legal and Natural persons, or geographic regions, does not currently exist in the Domain Name System. Therefore, any recommendation mandating this change is outside the scope of the ePDP, and possibly the “picket fence” of Registrar and Registry contracts.

As a result, and for the avoidance of doubt, Contracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations.

Thank you,

J.

-------------

*James Bladel*

GoDaddy

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team

Dear All, Staff followed up with Alan to see how the language could be modified per his comments below. You will find his proposed updates to the language in the attached version. Per Milton’s request, we’ve also switched around the bullet point. Best regards, Caitlin, Berry and Marika From: Alan Woods <alan@donuts.email> Date: Thursday, November 8, 2018 at 4:53 AM To: "milton@gatech.edu" <milton@gatech.edu> Cc: Marika Konings <marika.konings@icann.org>, Lindsay Hamilton-Reid <lindsay.hamilton-reid@fasthosts.com>, GNSO EPDP <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Thank you Marika & Milton, Marika (and team) thank you for your continuing patience. Although the majority of my team members are (hopefully) still sleeping at this hour, this is my opinion, I will say that although the modifications better represents the divergence of views, I still think that it fails to impart the fact that we are not merely looking at a clash of opinion. we are looking at a breaking point. I can only speak for myself, but I certainly am not taking such a stance because I think we need to simply duke it out and have more back and forth. I do so because, in the context of this EPDP, the suggestion that differentiation is a basic policy obligation,flies in the face of reason (a reasonableness which is enshrined in Art 32 GDPR by the by), and is ignoring, point blank the concerns of the Contracted Parties who will remain liable for the fallout of a bad policy. Why create a policy, that in our expert opinion and years of implementation experience, that we are telling you will not work and will not be capable of implementation? (Apologies i intended to end my email here but then responses came in) To Hadia's point, I too will restate, yes, we do have a job to do. That job is to either confirm the Temp Spec wording, as is, in a consensus policy, or where the Temp Spec wording is not sufficient to bring us into compliance, to recommend such changes as we deem necessary. The goal remains to bring the Contracted parties processing of data in line with the requirements of the GDPR. You have unfortunately misunderstood the contracted parties stance. The contracted parties statement is that we shall not accept any policy, which we believe does the opposite of this goal i.e. where the suggested policy actually impedes our ability to attain or maintain such compliance with the law, or worse still, will recklessly lead us into a deeper situation of breach of that law (although it should be patently clear, to avoid doubt, distinguishing Natural / legal and geographic applications fall squarely into the latter). So our stance is perfectly reasonable. I am dismayed that there appears to be some within the ePDP whose goal continues to appear to be the pursuit of theor own goals, over that of ensuring the vindication of the rights of the registrant. I don't claim to be a white knight in this, the CPH is equally driven by ensuring we are not sanctioned for the breach of such law, but the net effect is the same. Some in the ePDP are simply making unreasonable demands of the CPH. And there are only so many more times we can remind of A) the scope of the ePDP and failing that the B) the state of the art, the cost of implementation and the likely effect that such unreasonable insistence will have on all the parties involved. hence our perfectly reasonable, and at this point completely expected statement. To further clarify Hadia, between "new obligations" and "any changes to the contracts". Again this is clearly not the point of the statement. Changes to the contracts (i.e. such as the Consensus Policy) which are necessary to bring us into compliance with the law are expected and welcome (the CPH have been asking for such changes for over 2 years now). Additional contractual obligations, such as the creation of a new system and technology, and the enforcement of unreasonable requirements that only intensify the risk of breach, which are also not necessary to achieve the Temp Spec goals, are not on the table for the ePDP. Kind regards, Alan [Image removed by sender. Donuts Inc.][donuts.domains]<https://urldefense.proofpoint.com/v2/url?u=http-3A__donuts.domains&d=DwMFaQ&...> Alan Woods Senior Compliance & Policy Manager, Donuts Inc. ________________________________ The Victorians, 15-18 Earlsfort Terrace Dublin 2, County Dublin Ireland [Image removed by sender.][facebook.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.facebook.com_donuts...> [Image removed by sender.] [twitter.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_DonutsInc&d...> [Image removed by sender.] [linkedin.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_compan...> Please NOTE: This electronic message, including any attachments, may include privileged, confidential and/or inside information owned by Donuts Inc. . Any distribution or use of this communication by anyone other than the intended recipient(s) is strictly prohibited and may be unlawful. If you are not the intended recipient, please notify the sender by replying to this message and then delete it from your system. Thank you. On Thu, Nov 8, 2018 at 9:39 AM Mueller, Milton L <milton@gatech.edu<mailto:milton@gatech.edu>> wrote: Thanks, Marika Your proposed changes are quite good. My only request would be that the bullet point you added about risks, namely • The difficulty of distinguishing between the two at the point of registration could lead to the unintended publication of the private data of many natural persons. Be placed first in the list, as we consider that to be the primary problem, and the other bullet points as less significant. Appreciate your rapid update! From: Marika Konings [mailto:marika.konings@icann.org<mailto:marika.konings@icann.org>] Sent: Wednesday, November 7, 2018 9:56 PM To: Lindsay Hamilton-Reid <lindsay.hamilton-reid@fasthosts.com<mailto:lindsay.hamilton-reid@fasthosts.com>>; Mueller, Milton L <milton@gatech.edu<mailto:milton@gatech.edu>> Cc: Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Ext] Re: [Gnso-epdp-team] NCSG reactions to (part of) the interim report Milton, Lindsay, thank you for your input. Staff has made some proposed updates to reflect your feedback (see redlines on first two pages of the attached document). Hopefully this addresses accurately where things currently stand from all perspectives. Best regards, Caitlin, Berry and Marika From: Lindsay Hamilton-Reid <lindsay.hamilton-reid@fasthosts.com<mailto:lindsay.hamilton-reid@fasthosts.com>> Date: Wednesday, November 7, 2018 at 3:13 PM To: "Mueller, Milton L" <milton@gatech.edu<mailto:milton@gatech.edu>> Cc: Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>, Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Ext] Re: [Gnso-epdp-team] NCSG reactions to (part of) the interim report +1 Milton. In addition to Milton’s email below, these points have been made repeatedly by the NCSG and the CPH. The Interim Report should reflect the differences in opinion and that there is no consensus on this point and many others. Many thanks Lindsay Sent from my iPhone On 7 Nov 2018, at 21:05, Mueller, Milton L <milton@gatech.edu<mailto:milton@gatech.edu>> wrote: Marika NCSG cannot accept big portions of the proposed text regarding the legal/natural persons distinction. We note that the text disregards statements from the contracted parties and NCSG. We would respectfully ask you to revise the text in a way that respects and reflects clearly stated and strongly held positions of at least three stakeholder groups. To be specific, the CPH has stated, in regard to the legal/natural persons and geographic distinctions: “Contracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations.” NCSG shares this opposition to requiring distinctions between legal and natural persons and geographic distinctions. In our comment on small team 1 we stated: “The main risk is that the difficulty of distinguishing between the two at the point of registration could lead to the unintended publication of the private data of many natural persons.” This assessment of risk is not reflected in the report. We also proposed deleting the entire paragraph on research because researching how various entities make this distinction basically assumes that making this distinction is a live option for the ePDP. In terms of consensus requirements, all indications are that it is not a real option. It is abundantly clear that no requirement for a distinction between legal and natural persons will survive a consensus recommendation process. At least three stakeholder groups – ¾ of the GNSO and roughly half of the ePDP – are rejecting it as an option. We think the report should move the process forward by explicitly recognizing this fact. Instead, we have Kurt stating on list that there was “an agreement” to do research on the feasibility of differentiating between natural and legal persons. This statement can only come from completely disregarding the interventions NCSG members made in Barcelona, on the latest call, and in an email sent Tuesday to the list by Amr elSadr. To quote from Amr’s email regarding Kurt’s statement regarding research: “I don’t believe that [research on legal/natural] was, in any way, reflective of a consensus to proceed with this recommendation among the Small Team members. To me, it was only an acknowledgement that this view was expressed, discussed, and subsequently required consideration by the whole team.” Kurt has not responded to this email. We will raise these concerns on the call tomorrow. In general, I think the team is in danger of losing sight of its primary mission, which is to quickly bring Whois into compliance with GDPR and to turn the temp spec into a legitimate policy. It seems that some people are seizing on the debate over the temp spec to impose new requirements on contracted parties. I understand that the chair and staff are trying their best to move things along, but we are disturbed by an apparent tendency to ignore or disregard clear position statements from SGs. One of the most important jobs of the ePDP chair is to recognize where consensus exists and where it does not. Some proposals are just not real options: they will never survive a council vote or a consensus call in the ePDP. It is unthinkable that the chair or staff would substitute their own preferences for the rough consensus of the working group. Let’s recognize the parameters of what people can live with and move forward from there. Eliminating options is progress, too. Milton Mueller, on behalf of NCSG From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Marika Konings Sent: Monday, November 5, 2018 11:49 PM To: Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 Following on from Kurt’s message, please find hereby the proposed language for inclusion in the Initial Report. Attached is the document that would be linked so that those interested would be able to review the different perspectives and proposals put forward. h3) Should Contracted Parties be allowed or required to treat legal and natural persons differently, and what mechanism is needed to ensure reliable determination of status? h4) Is there a legal basis for Contracted Parties to treat legal and natural persons differently? h5) What are the risks associated with differentiation of registrant status as legal or natural persons across multiple jurisdictions? (See EDPB letter of 5 July 2018). The EPDP Team discussed these questions extensively (see [include link to attached document which includes the different proposals]) and although the EPDP Team agrees that Contracted Parties should be allowed to treat legal and natural persons differently, the EPDP Team did not agree on whether this should be required and/or what further steps could or should be undertaken to determine what mechanism is needed to ensure reliable determination of status. The EPDP Team further agrees under GDPR there is a legal basis to treat legal and natural persons differently, but does not agree on whether that means Contracted Parties should be required to do so, or whether the challenges and legal risks involved in doing so result in leaving this optional. Similarly, the EPDP Team discussed the implication of other data protection regimes which could have different requirements that impact both natural and/or legal persons that would need to be factored in. The EPDP Team identified a number of risks, including: * While legal persons don’t have the same protections under GDPR, natural persons employed by a legal person (and who may be designated as the registrant, admin or technical contact) are still natural persons enjoying rights and protections under GDPR. Some noted that this risk may be minimized through clear explanatory language beneath each field when filling in data fields within domain name registrations. * There may be situations in which it can be difficult to separate the data of natural persons from that of legal persons. This can be the case, for example, if the legal person is a sole proprietorship, if the name of a person appears in the company’s name, if the business address is a natural person’s residence, or if an email address is assigned to a single individual (“john.doe@company.example.com<mailto:john.doe@company.example.com>” as opposed to “info@company.example.com<mailto:info@company.example.com>. The EPDP has discussed whether this risk may be somewhat mitigated through educational resources. Some in the EPDP Team expressed caution, as a stated necessity to rely on educational resources may not be considered to be compatible with the concepts of privacy by default or privacy by design i.e. where additional ‘educational resources’ are deemed necessary, the process itself is likely not established or presented in a sufficiently clear manner. To help further inform the EPDP Team’s deliberations on this topic as the team works towards a Final Report, the EPDP Team would like to request that GDD staff, who will design the implementation of these policy recommendations, commences research by investigating how ccTLDs and contracted parties currently distinguish between natural and legal persons to inform the EPDP Team. In addition, the EPDP Team would like to request input on the following questions in relation to this topic: • Are there examples from other industries or areas, e.g. ccTLDs, where a mechanism has been successfully developed and implemented to distinguish between natural and legal person, factoring in some of the challenges identified above? • Should the EPDP Team decide to recommend requiring distinguishing between natural and legal persons, how should implementation be carried out, especially considering legacy registrations? • Should the EPDP Team decide to recommend that further research is undertaken, beyond the information that GDD staff may encounter, what and how should this research be carried out? • (For the EDPB) If registrars allow registrants to self-identify at the time as a natural or legal person, who will be held liable if the registrant incorrectly self-identifies and personal information is publicly displayed? Apart from self-identification, are there any other ways in which risk of liability could be mitigated by registrars? The research requested and input on these charter questions will help the EPDP Team further analyze if it is possible and desirable to make this distinction in the context of domain name registrations, in a manner that is commercially reasonable, implementable and does not result in unreasonable liability for contracted parties. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>> Date: Monday, November 5, 2018 at 7:45 PM To: "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 Hi Everyone: After all of this thought and writing, I think we have two paths forward that are relatively straightforward to describe. Rather than recap the arguments made here, I will just go right into my recommendations for next step and why. The Support Team will follow this with a better summation of what has transpired and how that leads to the recommendations below. It is clear that camps within our the team are at loggerheads with regard to how geographic basis and natural v legal persons should be handled within the proposed policy recommendations. Current situation and recent developments: Coming out of the small group meeting #1 during a teleconference, there was an agreement in principle that it was necessary to perform research in order to inform the policy discussion regarding the feasibility of differentiating between legal and natural persons. That agreement survived its initial introduction into the whole team where the comments centered around: (1) the adjectives used to describe the sense of urgency concerning the work, and (2) sharpening the detail regarding steps to be taken after the research. (There was never an agreement about how to proceed regarding differentiation of data subjects based on geographical considerations.) Starting Friday, substantial markups to the legal v natural agreement on doing research initiated this current three-day email chain. Preferred Recommendation (there are two): Go back to the agreement in principle that was reached in the small team with representatives from all groups to undertake research to determine if, how and to what extent we can distinguish between legal and natural persons. Then extend that research on to the geographic basis issue. A small group of us can contribute to the terms of reference for this research after the initial report is issued. Here is my rationale for this recommendation: 1) The various arguments laid out in all these emails on this list make the case themselves for the need to do research. For example, if the ICO says that processors can rely on data subject-provided information, does that mean that personal information mistakenly disclosed can be published without liability? We don’t know. We are setting up this and other questions for DPAs. Isn’t that … research? There are other scenarios in the emails that will take research to sort through: whether ccTLD experiences are relevant, or whether a registrant boarding a train and leaving the EU for China while another registrant boarding a ferry for Marseilles will both be protected by GDPR. All this takes research to sort out. Nearly all of the emails on this list have to do with scenarios in support of one position or another - but all need to be studied in order for us to determine if and how distinctions can be made. 2) Many of the arguments laid out are conclusory or without authority. I don’t think the research can have a preordained outcome. To make one point for each line of thinking: a) In the case of natural vs legal data subjects, some seek to build in in an implementation plan without knowing if or to what degree a solution is implementable b) In the case of Geographical distinctions between registrants, some are stating that such a distinction is categorically unimplementable without authority or evidence provided. I think the “truth will out” on these questions and we should not try to push research or our arguments to a pre-ordained outcome. 3) This will provide time to take the effects of existing laws in other jurisdictions into account - if that is deemed desirable. 4) This will take this discussion out of the critical path of finishing our reports, without leaving a blank. 5) The results of the research still must be considered by this team (or its successor) and a consensus derived. Research informs policy; it does not create policy. 6) If we agree to this approach, we can start the research now. If we temporize, there will be little done that will resolve this issue set over the next few months. Taking action in an attempt to understand all the complexity is the responsible thing to do. 7) These are complicated questions and research-based policy-making is required to answer them. How do we meet the timeline and still act in a thorough, detailed manner? By launching research and, in the meantime, going back to the rest of our questions. Whatever our policy conclusions are, even if we are deadlocked in several months time, we should be informed by information garnered from DPAs and other sources. The only other recommendation: MemorialIze the differences between the two sides on each of the two issues, explaining the arguments for each and asking for public comment on these issues. Here is my rationale for and against this recommendation: 1) It will allow us to publish the initial report and, properly framed, can garner specific public comment. However, other factors really argue against maintaining the current status and not taking some action: 2) In the time allotted for public comment, no commenter will be able to perform any meaningful research either. There might be reference to a study that partially informs our work, but not a dispositive study. At the end of the comment period, we are likely to be in the same place. 3) It is hard to see how the public comment will differ from our discussion, in this list, to date. 4) Even if we take the preferred research path above, we can still conduct the comment period on the current position of the parties. 5) If we have no outcome on this issue, the result, to me, is unknown and represent a risk to all parties at the table. Conclusion I thought is was remarkable that we came together and agreed to undertake this research on this difficult topic. It was a significant, meaningful compromise that embodied our reason for being here. I don’t see anything in all the emails that indicate another compromise is possible unless that discussion is informed with significant, new information. I believe the appropriate path for this group is to recognize the differences cannot be resolved without something new and to take this path. Talk to you soon and best regards, Kurt On Nov 5, 2018, at 4:38 PM, Mark Svancarek (CELA) via Gnso-epdp-team <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> wrote: Sorry for being dense, I still have questions. 1. It is not surprising that the addition of a new process step would generate short term inefficiencies. It’s 5 years later – are the verification rates improved from 2014? 2. How would an optional “let me self-identify as a corporation” capability be likely to cause verification disruptions? /marksv From: James M. Bladel <jbladel@godaddy.com<mailto:jbladel@godaddy.com>> Sent: Monday, November 5, 2018 13:28 To: Mark Svancarek (CELA) <marksv@microsoft.com<mailto:marksv@microsoft.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: Contracted Parties and Small Teams #1 and #2 Mark – Shortly following the launch of the 2013 RAA’s requirements for WHOIS Verification, registrars noted that approx. 800,000 domains had been suspended in the first few months. The number continued to climb for a few years, and most were categorized as “false positives” Here’s some coverage of that data at the time. https://domainnamewire.com/2014/06/24/over-800000-domain-names-suspended-due... [na01.safelinks.protection.outlook.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__na01.safelinks.protecti...> Any program that depends on Registrant self-categorization, self-declaration, or receipt & acting upon a notice has a huge error factor. For GoDaddy in 2014, the RAA verification rate was in the high 70% or low 80%, meaning that service to tens of thousands of customers was delayed or disrupted. It’s this experience that causes Contracted Parties (but particularly Registrars) to be skeptical of any requirement to just “send an email” or “have the Registrant check a box.” It doesn’t scale. J. ------------- James Bladel GoDaddy From: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>> Date: Monday, November 5, 2018 at 15:14 To: "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: RE: Contracted Parties and Small Teams #1 and #2 James, can you clarify this: “many of whom could lose access to their registrations.” From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Monday, November 5, 2018 10:57 To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 ePDP Colleagues and WG Leadership - This morning, Registry and Registrar representatives met to discuss the status of potential recommendations from Small Group #1 (Legal vs. Natural) and Small Group #2 (Geographic Regions) in our Draft Initial Report. We concluded that there are some legal bases supporting these distinctions under GDPR and other data protection laws, and note that our Initial Report supports this. However, we reiterate our numerous high-level concerns against making any Consensus Policy recommendations for contractual requirements in these areas. Our concerns involve: * Legal - Aside from GDPR, other data protection laws are less clear on the distinction between legal and natural persons. Future regulations may contain contrary requirements. Furthermore, data of legal entities may contain or consist of personal information of natural persons, which would be entitled to protection under the GDPR and similar data protection regimes. Likewise, the geographic distinctions also create uncertainties. * Technical - Contracted Parties are uniquely situated to assess the current level of the technological means available to us, and it is our stated position that a technical basis to reliably and confidently make such a distinction does not exist. Especially because any distinction schema would be dependent upon Registrant Self-Identification, which is fraught with error. * Commercial - Developing and deploying this technology will involve significant costs, which may be prohibitive for smaller organizations and a barrier to market entry. Regardless of whether the distinction(s) are applied to new registrations or legacy domain names, it would be a logistical nightmare for Contracted Parties, and a source of confusion for Registrants, many of whom could lose access to their registrations. * Asymmetrical Risks vs. Benefits - Contracted Parties would assume all regulatory risks of such an obligations, exclusively for the benefit of unburdened third parties. * Scope - The distinction between Legal and Natural persons, or geographic regions, does not currently exist in the Domain Name System. Therefore, any recommendation mandating this change is outside the scope of the ePDP, and possibly the “picket fence” of Registrar and Registry contracts. As a result, and for the avoidance of doubt, Contracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations. Thank you, J. ------------- James Bladel GoDaddy _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team

Hi Hadia The point of that statement is that the CPH will not accept any contractual changes from ICANN in relation to GDPR. We already have to comply with the GDPR regardless of any contractual obligations with ICANN, with some of which contractual obligations currently, we are unable to comply. It appears that certain parties are making suggestions that are attempting to put further contractual obligations on the CPH which are not required under GDPR and in fact, are out of the scope of this EPDP. Many thanks Lindsay Lindsay Hamilton-Reid Senior Legal Counsel Direct: +44 (0)1452 509145 | Mobile: +44 (0)7720 091147 | Email: Lindsay.Hamilton-Reid@1and1.co.uk<mailto:Lindsay.Hamilton-Reid@1and1.co.uk> www.fasthosts.co.uk<http://www.fasthosts.co.uk/> www.1and1.co.uk<http://www.1and1.co.uk/> [fh-1and1] © 2015 All rights reserved. Fasthosts is the trading name of Fasthosts Internet Limited. Company registration no. 03656438. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 720821857. 1&1 is the trading name of 1&1 Internet Limited. Company registration no. 03953678. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 752539027. This message (including any attachments) is confidential and may be legally privileged. If you are not the intended recipient, you should not disclose, copy or use any part of it - please delete all copies immediately and notify 1&1 on 0844 335 1211 or Fasthosts on 0333 0142 700. Any statements, opinions or information in this message are provided by the author, not on behalf of 1&1 and/or Fasthosts, unless subsequently confirmed by an individual who is authorised to represent 1&1 and/or Fasthosts. [linkedin]<http://www.linkedin.com/company/fasthosts-internet-ltd>[twitter]<https://twitter.com/Fasthosts>[facebook]<https://www.facebook.com/fasthostsinternet>[gplus]<https://plus.google.com/u/0/b/107582097021398424605/+fasthosts/posts>[blog]<http://blogs.fasthosts.co.uk/>[youtube]<http://www.youtube.com/user/Fasthostsinternet> From: Hadia Abdelsalam Mokhtar EL miniawi [mailto:Hadia@tra.gov.eg] Sent: 08 November 2018 10:08 To: Marika Konings <marika.konings@icann.org>; Lindsay Hamilton-Reid <lindsay.hamilton-reid@fasthosts.com>; Mueller, Milton L <milton@gatech.edu> Cc: gnso-epdp-team@icann.org Subject: RE: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Thank you Milton and Lindsay for your inputs and thank you Marika for putting all this together. Reading the proposed language by Milton and Lindsay for "h5" I was quite surprised to see the following statement " Specifically, Contracted Parties, supported by the NCSG, stated that they “oppose/reject any recommendations for new contractual requirements in the EPDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations”. I would like to remind us all that the temporary specification was in pursuance to the procedures related to the changes in the existing requirements in the registrar accreditation and registry agreements "contracts" to bring them in compliance with the GDPR. That is changes to the existing requirements are inevitable. The EPDP team was chartered to determine if the temp. Spec. should remain as is or with modifications, by no means can we say that we are going to oppose and reject any recommendations to new contractual requirements, any changes by definition lead to new contractual agreements. The proposed statement brings the work of this group to an end. It is impossible to have it as the base of our work when the work of the team will mainly reflect on the contracts. Whether the requirements are new or old will depend on what this groups reaches. That being said I am sure that we can reach consensus on what the CPs regard as possible or not possible to include. I would like to assure you that no one would like to see the CPs taking risks or having their businesses suffer, however to state that you refuse any changes to the requirements of the contractual agreements contradicts with the work that you are part of. P.S. Moreover the aforementioned statement is out of scope as I cannot see how it responds to the original question of "h5" What are the risks associated with differentiation of registrant status as legal or natural persons across multiple jurisdictions? Kindest Regards Hadia From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Marika Konings Sent: Thursday, November 08, 2018 4:56 AM To: Lindsay Hamilton-Reid; Mueller, Milton L Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Milton, Lindsay, thank you for your input. Staff has made some proposed updates to reflect your feedback (see redlines on first two pages of the attached document). Hopefully this addresses accurately where things currently stand from all perspectives. Best regards, Caitlin, Berry and Marika From: Lindsay Hamilton-Reid <lindsay.hamilton-reid@fasthosts.com<mailto:lindsay.hamilton-reid@fasthosts.com>> Date: Wednesday, November 7, 2018 at 3:13 PM To: "Mueller, Milton L" <milton@gatech.edu<mailto:milton@gatech.edu>> Cc: Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>, Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Ext] Re: [Gnso-epdp-team] NCSG reactions to (part of) the interim report +1 Milton. In addition to Milton’s email below, these points have been made repeatedly by the NCSG and the CPH. The Interim Report should reflect the differences in opinion and that there is no consensus on this point and many others. Many thanks Lindsay Sent from my iPhone On 7 Nov 2018, at 21:05, Mueller, Milton L <milton@gatech.edu<mailto:milton@gatech.edu>> wrote: Marika NCSG cannot accept big portions of the proposed text regarding the legal/natural persons distinction. We note that the text disregards statements from the contracted parties and NCSG. We would respectfully ask you to revise the text in a way that respects and reflects clearly stated and strongly held positions of at least three stakeholder groups. To be specific, the CPH has stated, in regard to the legal/natural persons and geographic distinctions: “Contracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations.” NCSG shares this opposition to requiring distinctions between legal and natural persons and geographic distinctions. In our comment on small team 1 we stated: “The main risk is that the difficulty of distinguishing between the two at the point of registration could lead to the unintended publication of the private data of many natural persons.” This assessment of risk is not reflected in the report. We also proposed deleting the entire paragraph on research because researching how various entities make this distinction basically assumes that making this distinction is a live option for the ePDP. In terms of consensus requirements, all indications are that it is not a real option. It is abundantly clear that no requirement for a distinction between legal and natural persons will survive a consensus recommendation process. At least three stakeholder groups – ¾ of the GNSO and roughly half of the ePDP – are rejecting it as an option. We think the report should move the process forward by explicitly recognizing this fact. Instead, we have Kurt stating on list that there was “an agreement” to do research on the feasibility of differentiating between natural and legal persons. This statement can only come from completely disregarding the interventions NCSG members made in Barcelona, on the latest call, and in an email sent Tuesday to the list by Amr elSadr. To quote from Amr’s email regarding Kurt’s statement regarding research: “I don’t believe that [research on legal/natural] was, in any way, reflective of a consensus to proceed with this recommendation among the Small Team members. To me, it was only an acknowledgement that this view was expressed, discussed, and subsequently required consideration by the whole team.” Kurt has not responded to this email. We will raise these concerns on the call tomorrow. In general, I think the team is in danger of losing sight of its primary mission, which is to quickly bring Whois into compliance with GDPR and to turn the temp spec into a legitimate policy. It seems that some people are seizing on the debate over the temp spec to impose new requirements on contracted parties. I understand that the chair and staff are trying their best to move things along, but we are disturbed by an apparent tendency to ignore or disregard clear position statements from SGs. One of the most important jobs of the ePDP chair is to recognize where consensus exists and where it does not. Some proposals are just not real options: they will never survive a council vote or a consensus call in the ePDP. It is unthinkable that the chair or staff would substitute their own preferences for the rough consensus of the working group. Let’s recognize the parameters of what people can live with and move forward from there. Eliminating options is progress, too. Milton Mueller, on behalf of NCSG From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Marika Konings Sent: Monday, November 5, 2018 11:49 PM To: Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 Following on from Kurt’s message, please find hereby the proposed language for inclusion in the Initial Report. Attached is the document that would be linked so that those interested would be able to review the different perspectives and proposals put forward. h3) Should Contracted Parties be allowed or required to treat legal and natural persons differently, and what mechanism is needed to ensure reliable determination of status? h4) Is there a legal basis for Contracted Parties to treat legal and natural persons differently? h5) What are the risks associated with differentiation of registrant status as legal or natural persons across multiple jurisdictions? (See EDPB letter of 5 July 2018). The EPDP Team discussed these questions extensively (see [include link to attached document which includes the different proposals]) and although the EPDP Team agrees that Contracted Parties should be allowed to treat legal and natural persons differently, the EPDP Team did not agree on whether this should be required and/or what further steps could or should be undertaken to determine what mechanism is needed to ensure reliable determination of status. The EPDP Team further agrees under GDPR there is a legal basis to treat legal and natural persons differently, but does not agree on whether that means Contracted Parties should be required to do so, or whether the challenges and legal risks involved in doing so result in leaving this optional. Similarly, the EPDP Team discussed the implication of other data protection regimes which could have different requirements that impact both natural and/or legal persons that would need to be factored in. The EPDP Team identified a number of risks, including: * While legal persons don’t have the same protections under GDPR, natural persons employed by a legal person (and who may be designated as the registrant, admin or technical contact) are still natural persons enjoying rights and protections under GDPR. Some noted that this risk may be minimized through clear explanatory language beneath each field when filling in data fields within domain name registrations. * There may be situations in which it can be difficult to separate the data of natural persons from that of legal persons. This can be the case, for example, if the legal person is a sole proprietorship, if the name of a person appears in the company’s name, if the business address is a natural person’s residence, or if an email address is assigned to a single individual (“john.doe@company.example.com<mailto:john.doe@company.example.com>” as opposed to “info@company.example.com<mailto:info@company.example.com>. The EPDP has discussed whether this risk may be somewhat mitigated through educational resources. Some in the EPDP Team expressed caution, as a stated necessity to rely on educational resources may not be considered to be compatible with the concepts of privacy by default or privacy by design i.e. where additional ‘educational resources’ are deemed necessary, the process itself is likely not established or presented in a sufficiently clear manner. To help further inform the EPDP Team’s deliberations on this topic as the team works towards a Final Report, the EPDP Team would like to request that GDD staff, who will design the implementation of these policy recommendations, commences research by investigating how ccTLDs and contracted parties currently distinguish between natural and legal persons to inform the EPDP Team. In addition, the EPDP Team would like to request input on the following questions in relation to this topic: · Are there examples from other industries or areas, e.g. ccTLDs, where a mechanism has been successfully developed and implemented to distinguish between natural and legal person, factoring in some of the challenges identified above? · Should the EPDP Team decide to recommend requiring distinguishing between natural and legal persons, how should implementation be carried out, especially considering legacy registrations? · Should the EPDP Team decide to recommend that further research is undertaken, beyond the information that GDD staff may encounter, what and how should this research be carried out? · (For the EDPB) If registrars allow registrants to self-identify at the time as a natural or legal person, who will be held liable if the registrant incorrectly self-identifies and personal information is publicly displayed? Apart from self-identification, are there any other ways in which risk of liability could be mitigated by registrars? The research requested and input on these charter questions will help the EPDP Team further analyze if it is possible and desirable to make this distinction in the context of domain name registrations, in a manner that is commercially reasonable, implementable and does not result in unreasonable liability for contracted parties. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>> Date: Monday, November 5, 2018 at 7:45 PM To: "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 Hi Everyone: After all of this thought and writing, I think we have two paths forward that are relatively straightforward to describe. Rather than recap the arguments made here, I will just go right into my recommendations for next step and why. The Support Team will follow this with a better summation of what has transpired and how that leads to the recommendations below. It is clear that camps within our the team are at loggerheads with regard to how geographic basis and natural v legal persons should be handled within the proposed policy recommendations. Current situation and recent developments: Coming out of the small group meeting #1 during a teleconference, there was an agreement in principle that it was necessary to perform research in order to inform the policy discussion regarding the feasibility of differentiating between legal and natural persons. That agreement survived its initial introduction into the whole team where the comments centered around: (1) the adjectives used to describe the sense of urgency concerning the work, and (2) sharpening the detail regarding steps to be taken after the research. (There was never an agreement about how to proceed regarding differentiation of data subjects based on geographical considerations.) Starting Friday, substantial markups to the legal v natural agreement on doing research initiated this current three-day email chain. Preferred Recommendation (there are two): Go back to the agreement in principle that was reached in the small team with representatives from all groups to undertake research to determine if, how and to what extent we can distinguish between legal and natural persons. Then extend that research on to the geographic basis issue. A small group of us can contribute to the terms of reference for this research after the initial report is issued. Here is my rationale for this recommendation: 1) The various arguments laid out in all these emails on this list make the case themselves for the need to do research. For example, if the ICO says that processors can rely on data subject-provided information, does that mean that personal information mistakenly disclosed can be published without liability? We don’t know. We are setting up this and other questions for DPAs. Isn’t that … research? There are other scenarios in the emails that will take research to sort through: whether ccTLD experiences are relevant, or whether a registrant boarding a train and leaving the EU for China while another registrant boarding a ferry for Marseilles will both be protected by GDPR. All this takes research to sort out. Nearly all of the emails on this list have to do with scenarios in support of one position or another - but all need to be studied in order for us to determine if and how distinctions can be made. 2) Many of the arguments laid out are conclusory or without authority. I don’t think the research can have a preordained outcome. To make one point for each line of thinking: a) In the case of natural vs legal data subjects, some seek to build in in an implementation plan without knowing if or to what degree a solution is implementable b) In the case of Geographical distinctions between registrants, some are stating that such a distinction is categorically unimplementable without authority or evidence provided. I think the “truth will out” on these questions and we should not try to push research or our arguments to a pre-ordained outcome. 3) This will provide time to take the effects of existing laws in other jurisdictions into account - if that is deemed desirable. 4) This will take this discussion out of the critical path of finishing our reports, without leaving a blank. 5) The results of the research still must be considered by this team (or its successor) and a consensus derived. Research informs policy; it does not create policy. 6) If we agree to this approach, we can start the research now. If we temporize, there will be little done that will resolve this issue set over the next few months. Taking action in an attempt to understand all the complexity is the responsible thing to do. 7) These are complicated questions and research-based policy-making is required to answer them. How do we meet the timeline and still act in a thorough, detailed manner? By launching research and, in the meantime, going back to the rest of our questions. Whatever our policy conclusions are, even if we are deadlocked in several months time, we should be informed by information garnered from DPAs and other sources. The only other recommendation: MemorialIze the differences between the two sides on each of the two issues, explaining the arguments for each and asking for public comment on these issues. Here is my rationale for and against this recommendation: 1) It will allow us to publish the initial report and, properly framed, can garner specific public comment. However, other factors really argue against maintaining the current status and not taking some action: 2) In the time allotted for public comment, no commenter will be able to perform any meaningful research either. There might be reference to a study that partially informs our work, but not a dispositive study. At the end of the comment period, we are likely to be in the same place. 3) It is hard to see how the public comment will differ from our discussion, in this list, to date. 4) Even if we take the preferred research path above, we can still conduct the comment period on the current position of the parties. 5) If we have no outcome on this issue, the result, to me, is unknown and represent a risk to all parties at the table. Conclusion I thought is was remarkable that we came together and agreed to undertake this research on this difficult topic. It was a significant, meaningful compromise that embodied our reason for being here. I don’t see anything in all the emails that indicate another compromise is possible unless that discussion is informed with significant, new information. I believe the appropriate path for this group is to recognize the differences cannot be resolved without something new and to take this path. Talk to you soon and best regards, Kurt On Nov 5, 2018, at 4:38 PM, Mark Svancarek (CELA) via Gnso-epdp-team <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> wrote: Sorry for being dense, I still have questions. 1. It is not surprising that the addition of a new process step would generate short term inefficiencies. It’s 5 years later – are the verification rates improved from 2014? 2. How would an optional “let me self-identify as a corporation” capability be likely to cause verification disruptions? /marksv From: James M. Bladel <jbladel@godaddy.com<mailto:jbladel@godaddy.com>> Sent: Monday, November 5, 2018 13:28 To: Mark Svancarek (CELA) <marksv@microsoft.com<mailto:marksv@microsoft.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: Contracted Parties and Small Teams #1 and #2 Mark – Shortly following the launch of the 2013 RAA’s requirements for WHOIS Verification, registrars noted that approx. 800,000 domains had been suspended in the first few months. The number continued to climb for a few years, and most were categorized as “false positives” Here’s some coverage of that data at the time. https://domainnamewire.com/2014/06/24/over-800000-domain-names-suspended-due... [na01.safelinks.protection.outlook.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__na01.safelinks.protecti...> Any program that depends on Registrant self-categorization, self-declaration, or receipt & acting upon a notice has a huge error factor. For GoDaddy in 2014, the RAA verification rate was in the high 70% or low 80%, meaning that service to tens of thousands of customers was delayed or disrupted. It’s this experience that causes Contracted Parties (but particularly Registrars) to be skeptical of any requirement to just “send an email” or “have the Registrant check a box.” It doesn’t scale. J. ------------- James Bladel GoDaddy From: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>> Date: Monday, November 5, 2018 at 15:14 To: "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: RE: Contracted Parties and Small Teams #1 and #2 James, can you clarify this: “many of whom could lose access to their registrations.” From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Monday, November 5, 2018 10:57 To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 ePDP Colleagues and WG Leadership - This morning, Registry and Registrar representatives met to discuss the status of potential recommendations from Small Group #1 (Legal vs. Natural) and Small Group #2 (Geographic Regions) in our Draft Initial Report. We concluded that there are some legal bases supporting these distinctions under GDPR and other data protection laws, and note that our Initial Report supports this. However, we reiterate our numerous high-level concerns against making any Consensus Policy recommendations for contractual requirements in these areas. Our concerns involve: * Legal - Aside from GDPR, other data protection laws are less clear on the distinction between legal and natural persons. Future regulations may contain contrary requirements. Furthermore, data of legal entities may contain or consist of personal information of natural persons, which would be entitled to protection under the GDPR and similar data protection regimes. Likewise, the geographic distinctions also create uncertainties. * Technical - Contracted Parties are uniquely situated to assess the current level of the technological means available to us, and it is our stated position that a technical basis to reliably and confidently make such a distinction does not exist. Especially because any distinction schema would be dependent upon Registrant Self-Identification, which is fraught with error. * Commercial - Developing and deploying this technology will involve significant costs, which may be prohibitive for smaller organizations and a barrier to market entry. Regardless of whether the distinction(s) are applied to new registrations or legacy domain names, it would be a logistical nightmare for Contracted Parties, and a source of confusion for Registrants, many of whom could lose access to their registrations. * Asymmetrical Risks vs. Benefits - Contracted Parties would assume all regulatory risks of such an obligations, exclusively for the benefit of unburdened third parties. * Scope - The distinction between Legal and Natural persons, or geographic regions, does not currently exist in the Domain Name System. Therefore, any recommendation mandating this change is outside the scope of the ePDP, and possibly the “picket fence” of Registrar and Registry contracts. As a result, and for the avoidance of doubt, Contracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations. Thank you, J. ------------- James Bladel GoDaddy _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team

Hi Hadia Well that is not necessarily the impression that the CPH are getting. It just seems that certain parties wish to forward their own agenda at the expense of the CPH. As one of my colleagues on the CPH pointed out, this group’s mandate is to develop consensus policy, not contractual language. The other stakeholders are not the ones that will be held liable or indeed open to risk. I think it would be appropriate if all stakeholders were to remember that. Many thanks Lindsay Lindsay Hamilton-Reid Senior Legal Counsel Direct: +44 (0)1452 509145 | Mobile: +44 (0)7720 091147 | Email: Lindsay.Hamilton-Reid@1and1.co.uk<mailto:Lindsay.Hamilton-Reid@1and1.co.uk> www.fasthosts.co.uk<http://www.fasthosts.co.uk/> www.1and1.co.uk<http://www.1and1.co.uk/> [fh-1and1] © 2015 All rights reserved. Fasthosts is the trading name of Fasthosts Internet Limited. Company registration no. 03656438. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 720821857. 1&1 is the trading name of 1&1 Internet Limited. Company registration no. 03953678. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 752539027. This message (including any attachments) is confidential and may be legally privileged. If you are not the intended recipient, you should not disclose, copy or use any part of it - please delete all copies immediately and notify 1&1 on 0844 335 1211 or Fasthosts on 0333 0142 700. Any statements, opinions or information in this message are provided by the author, not on behalf of 1&1 and/or Fasthosts, unless subsequently confirmed by an individual who is authorised to represent 1&1 and/or Fasthosts. [linkedin]<http://www.linkedin.com/company/fasthosts-internet-ltd>[twitter]<https://twitter.com/Fasthosts>[facebook]<https://www.facebook.com/fasthostsinternet>[gplus]<https://plus.google.com/u/0/b/107582097021398424605/+fasthosts/posts>[blog]<http://blogs.fasthosts.co.uk/>[youtube]<http://www.youtube.com/user/Fasthostsinternet> From: Hadia Abdelsalam Mokhtar EL miniawi [mailto:Hadia@tra.gov.eg] Sent: 08 November 2018 10:31 To: Lindsay Hamilton-Reid <lindsay.hamilton-reid@fasthosts.com>; Marika Konings <marika.konings@icann.org>; Mueller, Milton L <milton@gatech.edu> Cc: gnso-epdp-team@icann.org Subject: RE: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Hi Lindsay, I assure you that no one would like to see the CPs suffer and we can all work together to ensure that. However the proposed statement is far beyond the explained intended meaning, you are putting very harsh conditions for the group to follow which are impossible to meet. Moreover I don't find it correct for any stakeholder group to put conditions for the others to obey. Best Hadia From: Lindsay Hamilton-Reid [mailto:lindsay.hamilton-reid@fasthosts.com] Sent: Thursday, November 08, 2018 12:17 PM To: Hadia Abdelsalam Mokhtar EL miniawi; Marika Konings; Mueller, Milton L Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: RE: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Hi Hadia The point of that statement is that the CPH will not accept any contractual changes from ICANN in relation to GDPR. We already have to comply with the GDPR regardless of any contractual obligations with ICANN, with some of which contractual obligations currently, we are unable to comply. It appears that certain parties are making suggestions that are attempting to put further contractual obligations on the CPH which are not required under GDPR and in fact, are out of the scope of this EPDP. Many thanks Lindsay Lindsay Hamilton-Reid Senior Legal Counsel Direct: +44 (0)1452 509145 | Mobile: +44 (0)7720 091147 | Email: Lindsay.Hamilton-Reid@1and1.co.uk<mailto:Lindsay.Hamilton-Reid@1and1.co.uk> www.fasthosts.co.uk<http://www.fasthosts.co.uk/> www.1and1.co.uk<http://www.1and1.co.uk/> [fh-1and1] © 2015 All rights reserved. Fasthosts is the trading name of Fasthosts Internet Limited. Company registration no. 03656438. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 720821857. 1&1 is the trading name of 1&1 Internet Limited. Company registration no. 03953678. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 752539027. This message (including any attachments) is confidential and may be legally privileged. If you are not the intended recipient, you should not disclose, copy or use any part of it - please delete all copies immediately and notify 1&1 on 0844 335 1211 or Fasthosts on 0333 0142 700. Any statements, opinions or information in this message are provided by the author, not on behalf of 1&1 and/or Fasthosts, unless subsequently confirmed by an individual who is authorised to represent 1&1 and/or Fasthosts. [linkedin]<http://www.linkedin.com/company/fasthosts-internet-ltd>[twitter]<https://twitter.com/Fasthosts>[facebook]<https://www.facebook.com/fasthostsinternet>[gplus]<https://plus.google.com/u/0/b/107582097021398424605/+fasthosts/posts>[blog]<http://blogs.fasthosts.co.uk/>[youtube]<http://www.youtube.com/user/Fasthostsinternet> From: Hadia Abdelsalam Mokhtar EL miniawi [mailto:Hadia@tra.gov.eg] Sent: 08 November 2018 10:08 To: Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>; Lindsay Hamilton-Reid <lindsay.hamilton-reid@fasthosts.com<mailto:lindsay.hamilton-reid@fasthosts.com>>; Mueller, Milton L <milton@gatech.edu<mailto:milton@gatech.edu>> Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: RE: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Thank you Milton and Lindsay for your inputs and thank you Marika for putting all this together. Reading the proposed language by Milton and Lindsay for "h5" I was quite surprised to see the following statement " Specifically, Contracted Parties, supported by the NCSG, stated that they “oppose/reject any recommendations for new contractual requirements in the EPDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations”. I would like to remind us all that the temporary specification was in pursuance to the procedures related to the changes in the existing requirements in the registrar accreditation and registry agreements "contracts" to bring them in compliance with the GDPR. That is changes to the existing requirements are inevitable. The EPDP team was chartered to determine if the temp. Spec. should remain as is or with modifications, by no means can we say that we are going to oppose and reject any recommendations to new contractual requirements, any changes by definition lead to new contractual agreements. The proposed statement brings the work of this group to an end. It is impossible to have it as the base of our work when the work of the team will mainly reflect on the contracts. Whether the requirements are new or old will depend on what this groups reaches. That being said I am sure that we can reach consensus on what the CPs regard as possible or not possible to include. I would like to assure you that no one would like to see the CPs taking risks or having their businesses suffer, however to state that you refuse any changes to the requirements of the contractual agreements contradicts with the work that you are part of. P.S. Moreover the aforementioned statement is out of scope as I cannot see how it responds to the original question of "h5" What are the risks associated with differentiation of registrant status as legal or natural persons across multiple jurisdictions? Kindest Regards Hadia From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Marika Konings Sent: Thursday, November 08, 2018 4:56 AM To: Lindsay Hamilton-Reid; Mueller, Milton L Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Milton, Lindsay, thank you for your input. Staff has made some proposed updates to reflect your feedback (see redlines on first two pages of the attached document). Hopefully this addresses accurately where things currently stand from all perspectives. Best regards, Caitlin, Berry and Marika From: Lindsay Hamilton-Reid <lindsay.hamilton-reid@fasthosts.com<mailto:lindsay.hamilton-reid@fasthosts.com>> Date: Wednesday, November 7, 2018 at 3:13 PM To: "Mueller, Milton L" <milton@gatech.edu<mailto:milton@gatech.edu>> Cc: Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>, Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Ext] Re: [Gnso-epdp-team] NCSG reactions to (part of) the interim report +1 Milton. In addition to Milton’s email below, these points have been made repeatedly by the NCSG and the CPH. The Interim Report should reflect the differences in opinion and that there is no consensus on this point and many others. Many thanks Lindsay Sent from my iPhone On 7 Nov 2018, at 21:05, Mueller, Milton L <milton@gatech.edu<mailto:milton@gatech.edu>> wrote: Marika NCSG cannot accept big portions of the proposed text regarding the legal/natural persons distinction. We note that the text disregards statements from the contracted parties and NCSG. We would respectfully ask you to revise the text in a way that respects and reflects clearly stated and strongly held positions of at least three stakeholder groups. To be specific, the CPH has stated, in regard to the legal/natural persons and geographic distinctions: “Contracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations.” NCSG shares this opposition to requiring distinctions between legal and natural persons and geographic distinctions. In our comment on small team 1 we stated: “The main risk is that the difficulty of distinguishing between the two at the point of registration could lead to the unintended publication of the private data of many natural persons.” This assessment of risk is not reflected in the report. We also proposed deleting the entire paragraph on research because researching how various entities make this distinction basically assumes that making this distinction is a live option for the ePDP. In terms of consensus requirements, all indications are that it is not a real option. It is abundantly clear that no requirement for a distinction between legal and natural persons will survive a consensus recommendation process. At least three stakeholder groups – ¾ of the GNSO and roughly half of the ePDP – are rejecting it as an option. We think the report should move the process forward by explicitly recognizing this fact. Instead, we have Kurt stating on list that there was “an agreement” to do research on the feasibility of differentiating between natural and legal persons. This statement can only come from completely disregarding the interventions NCSG members made in Barcelona, on the latest call, and in an email sent Tuesday to the list by Amr elSadr. To quote from Amr’s email regarding Kurt’s statement regarding research: “I don’t believe that [research on legal/natural] was, in any way, reflective of a consensus to proceed with this recommendation among the Small Team members. To me, it was only an acknowledgement that this view was expressed, discussed, and subsequently required consideration by the whole team.” Kurt has not responded to this email. We will raise these concerns on the call tomorrow. In general, I think the team is in danger of losing sight of its primary mission, which is to quickly bring Whois into compliance with GDPR and to turn the temp spec into a legitimate policy. It seems that some people are seizing on the debate over the temp spec to impose new requirements on contracted parties. I understand that the chair and staff are trying their best to move things along, but we are disturbed by an apparent tendency to ignore or disregard clear position statements from SGs. One of the most important jobs of the ePDP chair is to recognize where consensus exists and where it does not. Some proposals are just not real options: they will never survive a council vote or a consensus call in the ePDP. It is unthinkable that the chair or staff would substitute their own preferences for the rough consensus of the working group. Let’s recognize the parameters of what people can live with and move forward from there. Eliminating options is progress, too. Milton Mueller, on behalf of NCSG From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Marika Konings Sent: Monday, November 5, 2018 11:49 PM To: Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 Following on from Kurt’s message, please find hereby the proposed language for inclusion in the Initial Report. Attached is the document that would be linked so that those interested would be able to review the different perspectives and proposals put forward. h3) Should Contracted Parties be allowed or required to treat legal and natural persons differently, and what mechanism is needed to ensure reliable determination of status? h4) Is there a legal basis for Contracted Parties to treat legal and natural persons differently? h5) What are the risks associated with differentiation of registrant status as legal or natural persons across multiple jurisdictions? (See EDPB letter of 5 July 2018). The EPDP Team discussed these questions extensively (see [include link to attached document which includes the different proposals]) and although the EPDP Team agrees that Contracted Parties should be allowed to treat legal and natural persons differently, the EPDP Team did not agree on whether this should be required and/or what further steps could or should be undertaken to determine what mechanism is needed to ensure reliable determination of status. The EPDP Team further agrees under GDPR there is a legal basis to treat legal and natural persons differently, but does not agree on whether that means Contracted Parties should be required to do so, or whether the challenges and legal risks involved in doing so result in leaving this optional. Similarly, the EPDP Team discussed the implication of other data protection regimes which could have different requirements that impact both natural and/or legal persons that would need to be factored in. The EPDP Team identified a number of risks, including: * While legal persons don’t have the same protections under GDPR, natural persons employed by a legal person (and who may be designated as the registrant, admin or technical contact) are still natural persons enjoying rights and protections under GDPR. Some noted that this risk may be minimized through clear explanatory language beneath each field when filling in data fields within domain name registrations. * There may be situations in which it can be difficult to separate the data of natural persons from that of legal persons. This can be the case, for example, if the legal person is a sole proprietorship, if the name of a person appears in the company’s name, if the business address is a natural person’s residence, or if an email address is assigned to a single individual (“john.doe@company.example.com<mailto:john.doe@company.example.com>” as opposed to “info@company.example.com<mailto:info@company.example.com>. The EPDP has discussed whether this risk may be somewhat mitigated through educational resources. Some in the EPDP Team expressed caution, as a stated necessity to rely on educational resources may not be considered to be compatible with the concepts of privacy by default or privacy by design i.e. where additional ‘educational resources’ are deemed necessary, the process itself is likely not established or presented in a sufficiently clear manner. To help further inform the EPDP Team’s deliberations on this topic as the team works towards a Final Report, the EPDP Team would like to request that GDD staff, who will design the implementation of these policy recommendations, commences research by investigating how ccTLDs and contracted parties currently distinguish between natural and legal persons to inform the EPDP Team. In addition, the EPDP Team would like to request input on the following questions in relation to this topic: • Are there examples from other industries or areas, e.g. ccTLDs, where a mechanism has been successfully developed and implemented to distinguish between natural and legal person, factoring in some of the challenges identified above? • Should the EPDP Team decide to recommend requiring distinguishing between natural and legal persons, how should implementation be carried out, especially considering legacy registrations? • Should the EPDP Team decide to recommend that further research is undertaken, beyond the information that GDD staff may encounter, what and how should this research be carried out? • (For the EDPB) If registrars allow registrants to self-identify at the time as a natural or legal person, who will be held liable if the registrant incorrectly self-identifies and personal information is publicly displayed? Apart from self-identification, are there any other ways in which risk of liability could be mitigated by registrars? The research requested and input on these charter questions will help the EPDP Team further analyze if it is possible and desirable to make this distinction in the context of domain name registrations, in a manner that is commercially reasonable, implementable and does not result in unreasonable liability for contracted parties. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>> Date: Monday, November 5, 2018 at 7:45 PM To: "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 Hi Everyone: After all of this thought and writing, I think we have two paths forward that are relatively straightforward to describe. Rather than recap the arguments made here, I will just go right into my recommendations for next step and why. The Support Team will follow this with a better summation of what has transpired and how that leads to the recommendations below. It is clear that camps within our the team are at loggerheads with regard to how geographic basis and natural v legal persons should be handled within the proposed policy recommendations. Current situation and recent developments: Coming out of the small group meeting #1 during a teleconference, there was an agreement in principle that it was necessary to perform research in order to inform the policy discussion regarding the feasibility of differentiating between legal and natural persons. That agreement survived its initial introduction into the whole team where the comments centered around: (1) the adjectives used to describe the sense of urgency concerning the work, and (2) sharpening the detail regarding steps to be taken after the research. (There was never an agreement about how to proceed regarding differentiation of data subjects based on geographical considerations.) Starting Friday, substantial markups to the legal v natural agreement on doing research initiated this current three-day email chain. Preferred Recommendation (there are two): Go back to the agreement in principle that was reached in the small team with representatives from all groups to undertake research to determine if, how and to what extent we can distinguish between legal and natural persons. Then extend that research on to the geographic basis issue. A small group of us can contribute to the terms of reference for this research after the initial report is issued. Here is my rationale for this recommendation: 1) The various arguments laid out in all these emails on this list make the case themselves for the need to do research. For example, if the ICO says that processors can rely on data subject-provided information, does that mean that personal information mistakenly disclosed can be published without liability? We don’t know. We are setting up this and other questions for DPAs. Isn’t that … research? There are other scenarios in the emails that will take research to sort through: whether ccTLD experiences are relevant, or whether a registrant boarding a train and leaving the EU for China while another registrant boarding a ferry for Marseilles will both be protected by GDPR. All this takes research to sort out. Nearly all of the emails on this list have to do with scenarios in support of one position or another - but all need to be studied in order for us to determine if and how distinctions can be made. 2) Many of the arguments laid out are conclusory or without authority. I don’t think the research can have a preordained outcome. To make one point for each line of thinking: a) In the case of natural vs legal data subjects, some seek to build in in an implementation plan without knowing if or to what degree a solution is implementable b) In the case of Geographical distinctions between registrants, some are stating that such a distinction is categorically unimplementable without authority or evidence provided. I think the “truth will out” on these questions and we should not try to push research or our arguments to a pre-ordained outcome. 3) This will provide time to take the effects of existing laws in other jurisdictions into account - if that is deemed desirable. 4) This will take this discussion out of the critical path of finishing our reports, without leaving a blank. 5) The results of the research still must be considered by this team (or its successor) and a consensus derived. Research informs policy; it does not create policy. 6) If we agree to this approach, we can start the research now. If we temporize, there will be little done that will resolve this issue set over the next few months. Taking action in an attempt to understand all the complexity is the responsible thing to do. 7) These are complicated questions and research-based policy-making is required to answer them. How do we meet the timeline and still act in a thorough, detailed manner? By launching research and, in the meantime, going back to the rest of our questions. Whatever our policy conclusions are, even if we are deadlocked in several months time, we should be informed by information garnered from DPAs and other sources. The only other recommendation: MemorialIze the differences between the two sides on each of the two issues, explaining the arguments for each and asking for public comment on these issues. Here is my rationale for and against this recommendation: 1) It will allow us to publish the initial report and, properly framed, can garner specific public comment. However, other factors really argue against maintaining the current status and not taking some action: 2) In the time allotted for public comment, no commenter will be able to perform any meaningful research either. There might be reference to a study that partially informs our work, but not a dispositive study. At the end of the comment period, we are likely to be in the same place. 3) It is hard to see how the public comment will differ from our discussion, in this list, to date. 4) Even if we take the preferred research path above, we can still conduct the comment period on the current position of the parties. 5) If we have no outcome on this issue, the result, to me, is unknown and represent a risk to all parties at the table. Conclusion I thought is was remarkable that we came together and agreed to undertake this research on this difficult topic. It was a significant, meaningful compromise that embodied our reason for being here. I don’t see anything in all the emails that indicate another compromise is possible unless that discussion is informed with significant, new information. I believe the appropriate path for this group is to recognize the differences cannot be resolved without something new and to take this path. Talk to you soon and best regards, Kurt On Nov 5, 2018, at 4:38 PM, Mark Svancarek (CELA) via Gnso-epdp-team <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> wrote: Sorry for being dense, I still have questions. 1. It is not surprising that the addition of a new process step would generate short term inefficiencies. It’s 5 years later – are the verification rates improved from 2014? 2. How would an optional “let me self-identify as a corporation” capability be likely to cause verification disruptions? /marksv From: James M. Bladel <jbladel@godaddy.com<mailto:jbladel@godaddy.com>> Sent: Monday, November 5, 2018 13:28 To: Mark Svancarek (CELA) <marksv@microsoft.com<mailto:marksv@microsoft.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: Contracted Parties and Small Teams #1 and #2 Mark – Shortly following the launch of the 2013 RAA’s requirements for WHOIS Verification, registrars noted that approx. 800,000 domains had been suspended in the first few months. The number continued to climb for a few years, and most were categorized as “false positives” Here’s some coverage of that data at the time. https://domainnamewire.com/2014/06/24/over-800000-domain-names-suspended-due... [na01.safelinks.protection.outlook.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__na01.safelinks.protecti...> Any program that depends on Registrant self-categorization, self-declaration, or receipt & acting upon a notice has a huge error factor. For GoDaddy in 2014, the RAA verification rate was in the high 70% or low 80%, meaning that service to tens of thousands of customers was delayed or disrupted. It’s this experience that causes Contracted Parties (but particularly Registrars) to be skeptical of any requirement to just “send an email” or “have the Registrant check a box.” It doesn’t scale. J. ------------- James Bladel GoDaddy From: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>> Date: Monday, November 5, 2018 at 15:14 To: "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: RE: Contracted Parties and Small Teams #1 and #2 James, can you clarify this: “many of whom could lose access to their registrations.” From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Monday, November 5, 2018 10:57 To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 ePDP Colleagues and WG Leadership - This morning, Registry and Registrar representatives met to discuss the status of potential recommendations from Small Group #1 (Legal vs. Natural) and Small Group #2 (Geographic Regions) in our Draft Initial Report. We concluded that there are some legal bases supporting these distinctions under GDPR and other data protection laws, and note that our Initial Report supports this. However, we reiterate our numerous high-level concerns against making any Consensus Policy recommendations for contractual requirements in these areas. Our concerns involve: * Legal - Aside from GDPR, other data protection laws are less clear on the distinction between legal and natural persons. Future regulations may contain contrary requirements. Furthermore, data of legal entities may contain or consist of personal information of natural persons, which would be entitled to protection under the GDPR and similar data protection regimes. Likewise, the geographic distinctions also create uncertainties. * Technical - Contracted Parties are uniquely situated to assess the current level of the technological means available to us, and it is our stated position that a technical basis to reliably and confidently make such a distinction does not exist. Especially because any distinction schema would be dependent upon Registrant Self-Identification, which is fraught with error. * Commercial - Developing and deploying this technology will involve significant costs, which may be prohibitive for smaller organizations and a barrier to market entry. Regardless of whether the distinction(s) are applied to new registrations or legacy domain names, it would be a logistical nightmare for Contracted Parties, and a source of confusion for Registrants, many of whom could lose access to their registrations. * Asymmetrical Risks vs. Benefits - Contracted Parties would assume all regulatory risks of such an obligations, exclusively for the benefit of unburdened third parties. * Scope - The distinction between Legal and Natural persons, or geographic regions, does not currently exist in the Domain Name System. Therefore, any recommendation mandating this change is outside the scope of the ePDP, and possibly the “picket fence” of Registrar and Registry contracts. As a result, and for the avoidance of doubt, Contracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations. Thank you, J. ------------- James Bladel GoDaddy _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team

Alan, that may well be the case but it’s not up to this group to draft contractual language. That should be between ICANN and the CPH. This group is to provide recommendations. My concern is that there won’t be consensus on the recommendations. My point was that that certain parties are not taking into consideration the liability and risk of the CPH. Lindsay Lindsay Hamilton-Reid Senior Legal Counsel Direct: +44 (0)1452 509145 | Mobile: +44 (0)7720 091147 | Email: Lindsay.Hamilton-Reid@1and1.co.uk<mailto:Lindsay.Hamilton-Reid@1and1.co.uk> www.fasthosts.co.uk<http://www.fasthosts.co.uk/> www.1and1.co.uk<http://www.1and1.co.uk/> [fh-1and1] © 2015 All rights reserved. Fasthosts is the trading name of Fasthosts Internet Limited. Company registration no. 03656438. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 720821857. 1&1 is the trading name of 1&1 Internet Limited. Company registration no. 03953678. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 752539027. This message (including any attachments) is confidential and may be legally privileged. If you are not the intended recipient, you should not disclose, copy or use any part of it - please delete all copies immediately and notify 1&1 on 0844 335 1211 or Fasthosts on 0333 0142 700. Any statements, opinions or information in this message are provided by the author, not on behalf of 1&1 and/or Fasthosts, unless subsequently confirmed by an individual who is authorised to represent 1&1 and/or Fasthosts. [linkedin]<http://www.linkedin.com/company/fasthosts-internet-ltd>[twitter]<https://twitter.com/Fasthosts>[facebook]<https://www.facebook.com/fasthostsinternet>[gplus]<https://plus.google.com/u/0/b/107582097021398424605/+fasthosts/posts>[blog]<http://blogs.fasthosts.co.uk/>[youtube]<http://www.youtube.com/user/Fasthostsinternet> From: Alan Greenberg [mailto:alan.greenberg@mcgill.ca] Sent: 08 November 2018 14:15 To: Lindsay Hamilton-Reid <lindsay.hamilton-reid@fasthosts.com>; Hadia Abdelsalam Mokhtar EL miniawi <Hadia@tra.gov.eg>; Marika Konings <marika.konings@icann.org>; Mueller, Milton L <milton@gatech.edu> Cc: gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Lindsay, by definition "Consensus Policy" is either language that will be translated to contractual language, or at times to minimize implementation effort, may actually be contractual language. If you don't accept that, you don't accept the concept of a PDP leading to Consensus Policy. Alan At 08/11/2018 05:51 AM, Lindsay Hamilton-Reid wrote: Hi Hadia Well that is not necessarily the impression that the CPH are getting. It just seems that certain parties wish to forward their own agenda at the expense of the CPH. As one of my colleagues on the CPH pointed out, this group’s mandate is to develop consensus policy, not contractual language. The other stakeholders are not the ones that will be held liable or indeed open to risk. I think it would be appropriate if all stakeholders were to remember that. Many thanks Lindsay Lindsay Hamilton-Reid Senior Legal Counsel Direct: +44 (0)1452 509145 | Mobile: +44 (0)7720 091147 | Email: Lindsay.Hamilton-Reid@1and1.co.uk<mailto:Lindsay.Hamilton-Reid@1and1.co.uk> www.fasthosts.co.uk <http://www.fasthosts.co.uk /> www.1and1.co.uk<http://www.1and1.co.uk/> [fh-1and1] © 2015 All rights reserved. Fasthosts is the trading name of Fasthosts Internet Limited. Company registration no. 03656438. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 720821857. 1&1 is the trading name of 1&1 Internet Limited. Company registration no. 03953678. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 752539027. This message (including any attachments) is confidential and may be legally privileged. If you are not the intended recipient, you should not disclose, copy or use any part of it - please delete all copies immediately and notify 1&1 on 0844 335 1211 or Fasthosts on 0333 0142 700. Any statements, opinions or information in this message are provided by the author, not on behalf of 1&1 and/or Fasthosts, unless subsequently confirmed by an individual who is authorised to represent 1&1 and/or Fasthosts. [linkedin]<http://www.linkedin.com/company/fasthosts-internet-ltd>[twitter]<https://twitter.com/Fasthosts>[facebook]<https://www.facebook.com/fasthostsinternet>[gplus]<https://plus.google.com/u/0/b/107582097021398424605/+fasthosts/posts>[blog]<http://blogs.fasthosts.co.uk/>[youtube]<http://www.youtube.com/user/Fasthostsinternet> From: Hadia Abdelsalam Mokhtar EL miniawi [ mailto:Hadia@tra.gov.eg] Sent: 08 November 2018 10:31 To: Lindsay Hamilton-Reid <lindsay.hamilton-reid@fasthosts.com<mailto:lindsay.hamilton-reid@fasthosts.com>>; Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>; Mueller, Milton L <milton@gatech.edu<mailto:milton@gatech.edu>> Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: RE: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Hi Lindsay, I assure you that no one would like to see the CPs suffer and we can all work together to ensure that. However the proposed statement is far beyond the explained intended meaning, you are putting very harsh conditions for the group to follow which are impossible to meet. Moreover I don't find it correct for any stakeholder group to put conditions for the others to obey. Best Hadia From: Lindsay Hamilton-Reid [ mailto:lindsay.hamilton-reid@fasthosts.com] Sent: Thursday, November 08, 2018 12:17 PM To: Hadia Abdelsalam Mokhtar EL miniawi; Marika Konings; Mueller, Milton L Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: RE: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Hi Hadia The point of that statement is that the CPH will not accept any contractual changes from ICANN in relation to GDPR. We already have to comply with the GDPR regardless of any contractual obligations with ICANN, with some of which contractual obligations currently, we are unable to comply. It appears that certain parties are making suggestions that are attempting to put further contractual obligations on the CPH which are not required under GDPR and in fact, are out of the scope of this EPDP. Many thanks Lindsay Lindsay Hamilton-Reid Senior Legal Counsel Direct: +44 (0)1452 509145 | Mobile: +44 (0)7720 091147 | Email: Lindsay.Hamilton-Reid@1and1.co.uk<mailto:Lindsay.Hamilton-Reid@1and1.co.uk> www.fasthosts.co.uk <http://www.fasthosts.co.uk /> www.1and1.co.uk<http://www.1and1.co.uk/> [fh-1and1] © 2015 All rights reserved. Fasthosts is the trading name of Fasthosts Internet Limited. Company registration no. 03656438. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 720821857. 1&1 is the trading name of 1&1 Internet Limited. Company registration no. 03953678. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 752539027. This message (including any attachments) is confidential and may be legally privileged. If you are not the intended recipient, you should not disclose, copy or use any part of it - please delete all copies immediately and notify 1&1 on 0844 335 1211 or Fasthosts on 0333 0142 700. Any statements, opinions or information in this message are provided by the author, not on behalf of 1&1 and/or Fasthosts, unless subsequently confirmed by an individual who is authorised to represent 1&1 and/or Fasthosts. [linkedin]<http://www.linkedin.com/company/fasthosts-internet-ltd>[twitter]<https://twitter.com/Fasthosts>[facebook]<https://www.facebook.com/fasthostsinternet>[gplus]<https://plus.google.com/u/0/b/107582097021398424605/+fasthosts/posts>[blog]<http://blogs.fasthosts.co.uk/>[youtube]<http://www.youtube.com/user/Fasthostsinternet> From: Hadia Abdelsalam Mokhtar EL miniawi [mailto:Hadia@tra.gov.eg] Sent: 08 November 2018 10:08 To: Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org> >; Lindsay Hamilton-Reid < lindsay.hamilton-reid@fasthosts.com<mailto:lindsay.hamilton-reid@fasthosts.com>>; Mueller, Milton L <milton@gatech.edu<mailto:milton@gatech.edu>> Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: RE: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Thank you Milton and Lindsay for your inputs and thank you Marika for putting all this together. Reading the proposed language by Milton and Lindsay for "h5" I was quite surprised to see the following statement " Specifically, Contracted Parties, supported by the NCSG, stated that they “oppose/reject any recommendations for new contractual requirements in the EPDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations”. I would like to remind us all that the temporary specification was in pursuance to the procedures related to the changes in the existing requirements in the registrar accreditation and registry agreements "contracts" to bring them in compliance with the GDPR. That is changes to the existing requirements are inevitable. The EPDP team was chartered to determine if the temp. Spec. should remain as is or with modifications, by no means can we say that we are going to oppose and reject any recommendations to new contractual requirements, any changes by definition lead to new contractual agreements. The proposed statement brings the work of this group to an end. It is impossible to have it as the base of our work when the work of the team will mainly reflect on the contracts. Whether the requirements are new or old will depend on what this groups reaches. That being said I am sure that we can reach consensus on what the CPs regard as possible or not possible to include. I would like to assure you that no one would like to see the CPs taking risks or having their businesses suffer, however to state that you refuse any changes to the requirements of the contractual agreements contradicts with the work that you are part of. P.S. Moreover the aforementioned statement is out of scope as I cannot see how it responds to the original question of "h5" What are the risks associated with differentiation of registrant status as legal or natural persons across multiple jurisdictions? Kindest Regards Hadia From: Gnso-epdp-team [ mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Marika Konings Sent: Thursday, November 08, 2018 4:56 AM To: Lindsay Hamilton-Reid; Mueller, Milton L Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Milton, Lindsay, thank you for your input. Staff has made some proposed updates to reflect your feedback (see redlines on first two pages of the attached document). Hopefully this addresses accurately where things currently stand from all perspectives. Best regards, Caitlin, Berry and Marika From: Lindsay Hamilton-Reid < lindsay.hamilton-reid@fasthosts.com<mailto:lindsay.hamilton-reid@fasthosts.com>> Date: Wednesday, November 7, 2018 at 3:13 PM To: "Mueller, Milton L" <milton@gatech.edu<mailto:milton@gatech.edu>> Cc: Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org> >, Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>>, " gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> > Subject: [Ext] Re: [Gnso-epdp-team] NCSG reactions to (part of) the interim report +1 Milton. In addition to Milton’s email below, these points have been made repeatedly by the NCSG and the CPH. The Interim Report should reflect the differences in opinion and that there is no consensus on this point and many others. Many thanks Lindsay Sent from my iPhone On 7 Nov 2018, at 21:05, Mueller, Milton L <milton@gatech.edu<mailto:milton@gatech.edu>> wrote: Marika NCSG cannot accept big portions of the proposed text regarding the legal/natural persons distinction. We note that the text disregards statements from the contracted parties and NCSG. We would respectfully ask you to revise the text in a way that respects and reflects clearly stated and strongly held positions of at least three stakeholder groups. To be specific, the CPH has stated, in regard to the legal/natural persons and geographic distinctions: “Contracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations.” NCSG shares this opposition to requiring distinctions between legal and natural persons and geographic distinctions. In our comment on small team 1 we stated: “The main risk is that the difficulty of distinguishing between the two at the point of registration could lead to the unintended publication of the private data of many natural persons.” This assessment of risk is not reflected in the report. We also proposed deleting the entire paragraph on research because researching how various entities make this distinction basically assumes that making this distinction is a live option for the ePDP. In terms of consensus requirements, all indications are that it is not a real option. It is abundantly clear that no requirement for a distinction between legal and natural persons will survive a consensus recommendation process. At least three stakeholder groups – ¾ of the GGNSO and roughly half of the ePDP – are rejecting it as an option. We think the report should move the process forward by explicitly recognizing this fact. Instead, we have Kurt stating on list that there was “an agreement” to do research on the feasibility of differentiating between natural and legal persons. This statement can only come from completely disregarding the interventions NCSG members made in Barcelona, on the latest call, and in an email sent Tuesday to the list by Amr elSadr. To quote from Amr’s email regarding Kurt’s statement regarding research: “I don’t believe that [research on legal/natural] was, in any way, reflective of a consensus to proceed with this recommendation among the Small Team members. To me, it was only an acknowledgement that this view was expressed, discussed, and subsequently required consideration by the whole team.” Kurt has not responded to this email. We will raise these concerns on the call tomorrow. In general, I think the team is in danger of losing sight of its primary mission, which is to quickly bring Whois into compliance with GDPR and to turn the temp spec into a legitimate policy. It seems that some people are seizing on the debate over the temp spec to impose new requirements on contracted parties. I understand that the chair and staff are trying their best to move things along, but we are disturbed by an apparent tendency to ignore or disregard clear position statements from SGs. One of the most important jobs of the ePDP chair is to recognize where consensus exists and where it does not. Some proposals are just not real options: they will never survive a council vote or a consensus call in the ePDP. It is unthinkable that the chair or staff would substitute their own preferences for the rough consensus of the working group. Let’s recognize the parameters of what people can live with and move forward from there. Eliminating options is progress, too. Milton Mueller, on behalf of NCSG From: Gnso-epdp-team [ mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Marika Konings Sent: Monday, November 5, 2018 11:49 PM To: Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 Following on from Kurt’s message, please find hereby the proposed language for inclusion in the Initial Report. Attached is the document that would be linked so that those interested would be able to review the different perspectives and proposals put forward. h3) Should Contracted Parties be allowed or required to treat legal and natural persons differently, and what mechanism is needed to ensure reliable determination of status? h4) Is there a legal basis for Contracted Parties to treat legal and natural persons differently? h5) What are the risks associated with differentiation of registrant status as legal or natural persons across multiple jurisdictions? (See EDPB letter of 5 July 2018). The EPDP Team discussed these questions extensively (see [include link to attached document which includes the different proposals]) and although the EPDP Team agrees that Contracted Parties should be allowed to treat legal and natural persons differently, the EPDP Team did not agree on whether this should be required and/or what further steps could or should be undertaken to determine what mechanism is needed to ensure reliable determination of status. The EPDP Team further agrees under GDPR there is a legal basis to treat legal and natural persons differently, but does not agree on whether that means Contracted Parties should be required to do so, or whether the challenges and legal risks involved in doing so result in leaving this optional. Similarly, the EPDP Team discussed the implication of other data protection regimes which could have different requirements that impact both natural and/or legal persons that would need to be factored in. The EPDP Team identified a number of risks, including: While legal persons don’t have the same protections under GDPR, natural persons employed by a legal person (and who may be designated as the registrant, admin or technical contact) are still natural persons enjoying rights and protections under GDPR. Some noted that this risk may be minimized through clear explanatory language beneath each field when filling in data fields within domain name registrations. There may be situations in which it can be difficult to separate the data of natural persons from that of legal persons. This can be the case, for example, if the legal person is a sole proprietorship, if the name of a person appears in the company’s name, if the business address is a natural person’s residence, or if an email address is assigned to a single individual (“ john.doe@company.example.com<mailto:john.doe@company.example.com>” as opposed to “info@company.example.com<mailto:info@company.example.com> . The EPDP has discussed whether this risk may be somewhat mitigated through educational resources. Some in the EPDP Team expressed caution, as a stated necessity to rely on educational resources may not be considered to be compatible with the concepts of privacy by default or privacy by design i.e. where additional ‘educational resources’ are deemed necessary, the process itself is likely not established or presented in a sufficiently clear manner. To help further inform the EPDP Team’s deliberations on this topic as the team works towards a Final Report, the EPDP Team would like to request that GDD staff, who will design the implementation of these policy recommendations, commences research by investigating how ccTLDs and contracted parties currently distinguish between natural and legal persons to inform the EPDP Team. In addition, the EPDP Team would like to request input on the following questions in relation to this topic: · Are there examples from other industries or areas, e.g. ccTLDs, where a mechanism has been successfully developed and implemented to distinguish between natural and legal person, factoring in some of the challenges identified above? · Should the EPDP Team decide to recommend requiring distinguishing between natural and legal persons, how should implementation be carried out, especially considering legacy registrations? · Should the EPDP Team decide to recommend that further research is undertaken, beyond the information that GDD staff may encounter, what and how should this research be carried out? · (For the EDPB) If registrars allow registrants to self-identify at the time as a natural or legal person, who will be held liable if the registrant incorrectly self-identifies and personal information is publicly displayed? Apart from self-identification, are there any other ways in which risk of liability could be mitigated by registrars? The research requested and input on these charter questions will help the EPDP Team further analyze if it is possible and desirable to make this distinction in the context of domain name registrations, in a manner that is commercially reasonable, implementable and does not result in unreasonable liability for contracted parties. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team < gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>> Date: Monday, November 5, 2018 at 7:45 PM To: " gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> > Subject: Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 Hi Everyone: After all of this thought and writing, I think we have two paths forward that are relatively straightforward to describe. Rather than recap the arguments made here, I will just go right into my recommendations for next step and why. The Support Team will follow this with a better summation of what has transpired and how that leads to the recommendations below. It is clear that camps within our the team are at loggerheads with regard to how geographic basis and natural v legal persons should be handled within the proposed policy recommendations. Current situation and recent developments: Coming out of the small group meeting #1 during a teleconference, there was an agreement in principle that it was necessary to perform research in order to inform the policy discussion regarding the feasibility of differentiating between legal and natural persons. That agreement survived its initial introduction into the whole team where the comments centered around: (1) the adjectives used to describe the sense of urgency concerning the work, and (2) sharpening the detail regarding steps to be taken after the research. (There was never an agreement about how to proceed regarding differentiation of data subjects based on geographical considerations.) Starting Friday, substantial markups to the legal v natural agreement on doing research initiated this current three-day email chain. Preferred Recommendation (there are two): Go back to the agreement in principle that was reached in the small team with representatives from all groups to undertake research to determine if, how and to what extent we can distinguish between legal and natural persons. Then extend that research on to the geographic basis issue. A small group of us can contribute to the terms of reference for this research after the initial report is issued. Here is my rationale for this recommendation: 1) The various arguments laid out in all these emails on this list make the case themselves for the need to do research. For example, if the ICO says that processors can rely on data subject-provided information, does that mean that personal information mistakenly disclosed can be published without liability? We don’t know. We are setting up this and other questions for DPAs. Isn’t that … research? There are other scenarios in the emails that will take research to sort through: whether ccTLD experiences are relevant, or whether a registrant boarding a train and leaving the EU for China while another registrant boarding a ferry for Marseilles will both be protected by GDPR. All this takes research to sort out. Nearly all of the emails on this list have to do with scenarios in support of one position or another - but all need to be studied in order for us to determine if and how distinctions can be made. 2) Many of the arguments laid out are conclusory or without authority. I don’t think the research can have a preordained outcome. To make one point for each line of thinking: a) In the case of natural vs legal data subjects, some seek to build in in an implementation plan without knowing if or to what degree a solution is implementable b) In the case of Geographical distinctions between registrants, some are stating that such a distinction is categorically unimplementable without authority or evidence provided. I think the “truth will out” on these questions and we should not try to push research or our arguments to a pre-ordained outcome. 3) This will provide time to take the effects of existing laws in other jurisdictions into account - if that is deemed desirable. 4) This will take this discussion out of the critical path of finishing our reports, without leaving a blank. 5) The results of the research still must be considered by this team (or its successor) and a consensus derived. Research informs policy; it does not create policy. 6) If we agree to this approach, we can start the research now. If we temporize, there will be little done that will resolve this issue set over the next few months. Taking action in an attempt to understand all the complexity is the responsible thing to do. 7) These are complicated questions and research-based policy-making is required to answer them. How do we meet the timeline and still act in a thorough, detailed manner? By launching research and, in the meantime, going back to the rest of our questions. Whatever our policy conclusions are, even if we are deadlocked in several months time, we should be informed by information garnered from DPAs and other sources. The only other recommendation: MemorialIze the differences between the two sides on each of the two issues, explaining the arguments for each and asking for public comment on these issues. Here is my rationale for and against this recommendation: 1) It will allow us to publish the initial report and, properly framed, can garner specific public comment. However, other factors really argue against maintaining the current status and not taking some action: 2) In the time allotted for public comment, no commenter will be able to perform any meaningful research either. There might be reference to a study that partially informs our work, but not a dispositive study. At the end of the comment period, we are likely to be in the same place. 3) It is hard to see how the public comment will differ from our discussion, in this list, to date. 4) Even if we take the preferred research path above, we can still conduct the comment period on the current position of the parties. 5) If we have no outcome on this issue, the result, to me, is unknown and represent a risk to all parties at the table. Conclusion I thought is was remarkable that we came together and agreed to undertake this research on this difficult topic. It was a significant, meaningful compromise that embodied our reason for being here. I don’t see anything in all the emails that indicate another compromise is possible unless that discussion is informed with significant, new information. I believe the appropriate path for this group is to recognize the differences cannot be resolved without something new and to take this path. Talk to you soon and best regards, Kurt On Nov 5, 2018, at 4:38 PM, Mark Svancarek (CELA) via Gnso-epdp-team <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> > wrote: Sorry for being dense, I still have questions. It is not surprising that the addition of a new process step would generate short term inefficiencies. It’s 5 years later – are the verification rates improved from 20014? How would an optional “let me self-identify as a corporation” capability be likely to cause verification disruptions? /marksv From: James M. Bladel <jbladel@godaddy.com<mailto:jbladel@godaddy.com>> Sent: Monday, November 5, 2018 13:28 To: Mark Svancarek (CELA) <marksv@microsoft.com<mailto:marksv@microsoft.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: Contracted Parties and Small Teams #1 and #2 Mark – Shortly following the launch of the 2013 RAA’s requirements for WHOIS Verification, registrars noted that approx. 800,000 domains had been suspended in the first few months. The number continued to climb for a few years, and most were categorized as “false positives” Here’s some coverage of that data at the time. https://domainnamewire.com/2014/06/24/over-800000-domain-names-suspended-due... [na01.safelinks.protection.outlook.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__na01.safelinks.protecti...> Any program that depends on Registrant self-categorization, self-declaration, or receipt & acting upon a notice has a huge error factor. For GoDaddy in 2014, the RAA verification rate was in the high 70% or low 80%, meaning that service to tens of thousands of customers was delayed or disrupted. It’s this experience that causes Contracted Parties (but particularly Registrars) to be skeptical of any requirement to just “send an email” or “have the Registrant check a box.” It doesn’t scale. J. ------------- James Bladel GoDaddy From: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>> Date: Monday, November 5, 2018 at 15:14 To: "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, " gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> > Subject: RE: Contracted Parties and Small Teams #1 and #2 James, can you clarify this: “many of whom could lose access to their registrations.” From: Gnso-epdp-team < gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Monday, November 5, 2018 10:57 To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 ePDP Colleagues and WG Leadership - This morning, Registry and Registrar representatives met to discuss the status of potential recommendations from Small Group #1 (Legal vs. Natural) and Small Group #2 (Geographic Regions) in our Draft Initial Report. We concluded that there are some legal bases supporting these distinctions under GDPR and other data protection laws, and note that our Initial Report supports this. However, we reiterate our numerous high-level concerns against making any Consensus Policy recommendations for contractual requirements in these areas. Our concerns involve: Legal - Aside from GDPR, other data protection laws are less clear on the distinction between legal and natural persons. Future regulations may contain contrary requirements. Furthermore, data of legal entities may contain or consist of personal information of natural persons, which would be entitled to protection under the GDPR and similar data protection regimes. Likewise, the geographic distinctions also create uncertainties. Technical - Contracted Parties are uniquely situated to assess the current level of the technological means available to us, and it is our stated position that a technical basis to reliably and confidently make such a distinction does not exist. Especially because any distinction schema would be dependent upon Registrant Self-Identification, which is fraught with error. Commercial - Developing and deploying this technology will involve significant costs, which may be prohibitive for smaller organizations and a barrier to market entry. Regardless of whether the distinction(s) are applied to new registrations or legacy domain names, it would be a logistical nightmare for Contracted Parties, and a source of confusion for Registrants, many of whom could lose access to their registrations. Asymmetrical Risks vs. Benefits - Contracted Parties would assume all regulatory risks of such an obligations, exclusively for the benefit of unburdened third parties. Scope - The distinction between Legal and Natural persons, or geographic regions, does not currently exist in the Domain Name System. Therefore, any recommendation mandating this change is outside the scope of the ePDP, and possibly the “picket fence” of Registrar and Registry contracts. As a result, and for the avoidance of doubt, Contracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations. Thank you, J. ------------- James Bladel GoDaddy _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team

Alan, that’s fine to explore solutions so long as they remain within the remit of this EPDP and within the law. We seem to get side tracked very easily. Lindsay Hamilton-Reid Senior Legal Counsel Direct: +44 (0)1452 509145 | Mobile: +44 (0)7720 091147 | Email: Lindsay.Hamilton-Reid@1and1.co.uk<mailto:Lindsay.Hamilton-Reid@1and1.co.uk> www.fasthosts.co.uk<http://www.fasthosts.co.uk/> www.1and1.co.uk<http://www.1and1.co.uk/> [fh-1and1] © 2015 All rights reserved. Fasthosts is the trading name of Fasthosts Internet Limited. Company registration no. 03656438. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 720821857. 1&1 is the trading name of 1&1 Internet Limited. Company registration no. 03953678. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 752539027. This message (including any attachments) is confidential and may be legally privileged. If you are not the intended recipient, you should not disclose, copy or use any part of it - please delete all copies immediately and notify 1&1 on 0844 335 1211 or Fasthosts on 0333 0142 700. Any statements, opinions or information in this message are provided by the author, not on behalf of 1&1 and/or Fasthosts, unless subsequently confirmed by an individual who is authorised to represent 1&1 and/or Fasthosts. [linkedin]<http://www.linkedin.com/company/fasthosts-internet-ltd>[twitter]<https://twitter.com/Fasthosts>[facebook]<https://www.facebook.com/fasthostsinternet>[gplus]<https://plus.google.com/u/0/b/107582097021398424605/+fasthosts/posts>[blog]<http://blogs.fasthosts.co.uk/>[youtube]<http://www.youtube.com/user/Fasthostsinternet> From: Alan Greenberg [mailto:alan.greenberg@mcgill.ca] Sent: 08 November 2018 14:59 To: Lindsay Hamilton-Reid <lindsay.hamilton-reid@fasthosts.com>; Hadia Abdelsalam Mokhtar EL miniawi <Hadia@tra.gov.eg>; Marika Konings <marika.konings@icann.org>; Mueller, Milton L <milton@gatech.edu> Cc: gnso-epdp-team@icann.org Subject: RE: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Lindsay, ultimately, any recommendations of the EPDP need to be approved by the GNSO and although no GNSO Stakeholder Group has a veto, the Rr and Ry SGs together do have a veto. SO nothing coming out of this group will get through the GNSO without agreement of at least one of the CP SG. Hopefully we all understand this. That should not prohibit exploring solutions that ultimately we may find agreement on. Alan At 08/11/2018 09:23 AM, Lindsay Hamilton-Reid wrote: Alan, that may well be the case but it’s not up to this group to draft contractual language. That should be between ICANN and the CPH. This group is to provide recommendations. My concern is that there won’t be consensus on the recommendations. My point was that that certain parties are not taking into consideration the liability and risk of the CPH. Lindsay Lindsay Hamilton-Reid Senior Legal Counsel Direct: +44 (0)1452 509145 | Mobile: +44 (0)7720 091147 | Email: Lindsay.Hamilton-Reid@1and1.co.uk<mailto:Lindsay.Hamilton-Reid@1and1.co.uk> www.fasthosts.co.uk <http://www.fasthosts.co.uk /> www.1and1.co.uk<http://www.1and1.co.uk/> [fh-1and1] © 2015 All rights reserved. Fasthosts is the trading name of Fasthosts Internet Limited. Company registration no. 03656438. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 720821857. 1&1 is the trading name of 1&1 Internet Limited. Company registration no. 03953678. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 752539027. This message (including any attachments) is confidential and may be legally privileged. If you are not the intended recipient, you should not disclose, copy or use any part of it - please delete all copies immediately and notify 1&1 on 0844 335 1211 or Fasthosts on 0333 0142 700. Any statements, opinions or information in this message are provided by the author, not on behalf of 1&1 and/or Fasthosts, unless subsequently confirmed by an individual who is authorised to represent 1&1 and/or Fasthosts. [linkedin]<http://www.linkedin.com/company/fasthosts-internet-ltd>[twitter]<https://twitter.com/Fasthosts>[facebook]<https://www.facebook.com/fasthostsinternet>[gplus]<https://plus.google.com/u/0/b/107582097021398424605/+fasthosts/posts>[blog]<http://blogs.fasthosts.co.uk/>[youtube]<http://www.youtube.com/user/Fasthostsinternet> From: Alan Greenberg [ mailto:alan.greenberg@mcgill.ca] Sent: 08 November 2018 14:15 To: Lindsay Hamilton-Reid <lindsay.hamilton-reid@fasthosts.com<mailto:lindsay.hamilton-reid@fasthosts.com>>; Hadia Abdelsalam Mokhtar EL miniawi <Hadia@tra.gov.eg<mailto:Hadia@tra.gov.eg>>; Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>; Mueller, Milton L <milton@gatech.edu<mailto:milton@gatech.edu>> Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Lindsay, by definition "Consensus Policy" is either language that will be translated to contractual language, or at times to minimize implementation effort, may actually be contractual language. If you don't accept that, you don't accept the concept of a PDP leading to Consensus Policy. Alan At 08/11/2018 05:51 AM, Lindsay Hamilton-Reid wrote: Hi Hadia Well that is not necessarily the impression that the CPH are getting. It just seems that certain parties wish to forward their own agenda at the expense of the CPH. As one of my colleagues on the CPH pointed out, this group’s mandate is is to develop consensus policy, not contractual language. The other stakeholders are not the ones that will be held liable or indeed open to risk. I think it would be appropriate if all stakeholders were to remember that. Many thanks Lindsay Lindsay Hamilton-Reid Senior Legal Counsel Direct: +44 (0)1452 509145 | Mobile: +44 (0)7720 091147 | Email: Lindsay.Hamilton-Reid@1and1.co.uk<mailto:Lindsay.Hamilton-Reid@1and1.co.uk> www.fasthosts.co.uk<http://www.fasthosts.co.uk/> www.1and1.co.uk<http://www.1and1.co.uk/> [fh-1and1] © 2015 All rights reserved. Fasthosts is the trading name of Fasthosts Internet Limited. Company registration no. 03656438. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 720821857. 1&1 is the trading name of 1&1 Internet Limited. Company registration no. 03953678. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 752539027. This message (including any attachments) is confidential and may be legally privileged. If you are not the intended recipient, you should not disclose, copy or use any part of it - please delete all copies immediately and notify 1&1 on 0844 335 1211 or Fasthosts on 0333 0142 700. Any statements, opinions or information in this message are provided by the author, not on behalf of 1&1 and/or Fasthosts, unless subsequently confirmed by an individual who is authorised to represent 1&1 and/or Fasthosts. [linkedin]<http://www.linkedin.com/company/fasthosts-internet-ltd>[twitter]<https://twitter.com/Fasthosts>[facebook]<https://www.facebook.com/fasthostsinternet>[gplus]<https://plus.google.com/u/0/b/107582097021398424605/+fasthosts/posts>[blog]<http://blogs.fasthosts.co.uk/>[youtube]<http://www.youtube.com/user/Fasthostsinternet> From: Hadia Abdelsalam Mokhtar EL miniawi [ mailto:Hadia@tra.gov.eg] Sent: 08 November 2018 10:31 To: Lindsay Hamilton-Reid < lindsay.hamilton-reid@fasthosts.com<mailto:lindsay.hamilton-reid@fasthosts.com>>; Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org> >; Mueller, Milton L <milton@gatech.edu<mailto:milton@gatech.edu>> Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: RE: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Hi Lindsay, I assure you that no one would like to see the CPs suffer and we can all work together to ensure that. However the proposed statement is far beyond the explained intended meaning, you are putting very harsh conditions for the group to follow which are impossible to meet. Moreover I don't find it correct for any stakeholder group to put conditions for the others to obey. Best Hadia From: Lindsay Hamilton-Reid [ mailto:lindsay.hamilton-reid@fasthosts.com] Sent: Thursday, November 08, 2018 12:17 PM To: Hadia Abdelsalam Mokhtar EL miniawi; Marika Konings; Mueller, Milton L Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: RE: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Hi Hadia The point of that statement is that the CPH will not accept any contractual changes from ICANN in relation to GDPR. We already have to comply with the GDPR regardless of any contractual obligations with ICANN, with some of which contractual obligations currently, we are unable to comply. It appears that certain parties are making suggestions that are attempting to put further contractual obligations on the CPH which are not required under GDPR and in fact, are out of the scope of this EPDP. Many thanks Lindsay Lindsay Hamilton-Reid Senior Legal Counsel Direct: +44 (0)1452 509145 | Mobile: +44 (0)7720 091147 | Email: Lindsay.Hamilton-Reid@1and1.co.uk<mailto:Lindsay.Hamilton-Reid@1and1.co.uk> www.fasthosts.co.uk<http://www.fasthosts.co.uk/> www.1and1.co.uk<http://www.1and1.co.uk/> [fh-1and1] © 2015 All rights reserved. Fasthosts is the trading name of Fasthosts Internet Limited. Company registration no. 03656438. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 720821857. 1&1 is the trading name of 1&1 Internet Limited. Company registration no. 03953678. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 752539027. This message (including any attachments) is confidential and may be legally privileged. If you are not the intended recipient, you should not disclose, copy or use any part of it - please delete all copies immediately and notify 1&1 on 0844 335 1211 or Fasthosts on 0333 0142 700. Any statements, opinions or information in this message are provided by the author, not on behalf of 1&1 and/or Fasthosts, unless subsequently confirmed by an individual who is authorised to represent 1&1 and/or Fasthosts. [linkedin]<http://www.linkedin.com/company/fasthosts-internet-ltd>[twitter]<https://twitter.com/Fasthosts>[facebook]<https://www.facebook.com/fasthostsinternet>[gplus]<https://plus.google.com/u/0/b/107582097021398424605/+fasthosts/posts>[blog]<http://blogs.fasthosts.co.uk/>[youtube]<http://www.youtube.com/user/Fasthostsinternet> From: Hadia Abdelsalam Mokhtar EL miniawi [mailto:Hadia@tra.gov.eg] Sent: 08 November 2018 10:08 To: Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org> >; Lindsay Hamilton-Reid < lindsay.hamilton-reid@fasthosts.com<mailto:lindsay.hamilton-reid@fasthosts.com>>; Mueller, Milton L <milton@gatech.edu<mailto:milton@gatech.edu>> Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: RE: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Thank you Milton and Lindsay for your inputs and thank you Marika for putting all this together. Reading the proposed language by Milton and Lindsay for "h5" I was quite surprised to see the following statement " Specifically, Contracted Parties, supported by the NCSG, stated that they “oppose/reject any rececommendations for new contractual requirements in the EPDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations”. I would like to remind us alll that the temporary specification was in pursuance to the procedures related to the changes in the existing requirements in the registrar accreditation and registry agreements "contracts" to bring them in compliance with the GDPR. That is changes to the existing requirements are inevitable. The EPDP team was chartered to determine if the temp. Spec. should remain as is or with modifications, by no means can we say that we are going to oppose and reject any recommendations to new contractual requirements, any changes by definition lead to new contractual agreements. The proposed statement brings the work of this group to an end. It is impossible to have it as the base of our work when the work of the team will mainly reflect on the contracts. Whether the requirements are new or old will depend on what this groups reaches. That being said I am sure that we can reach consensus on what the CPs regard as possible or not possible to include. I would like to assure you that no one would like to see the CPs taking risks or having their businesses suffer, however to state that you refuse any changes to the requirements of the contractual agreements contradicts with the work that you are part of. P.S. Moreover the aforementioned statement is out of scope as I cannot see how it responds to the original question of "h5" What are the risks associated with differentiation of registrant status as legal or natural persons across multiple jurisdictions? Kindest Regards Hadia From: Gnso-epdp-team [ mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Marika Konings Sent: Thursday, November 08, 2018 4:56 AM To: Lindsay Hamilton-Reid; Mueller, Milton L Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] [Ext] Re: NCSG reactions to (part of) the interim report Milton, Lindsay, thank you for your input. Staff has made some proposed updates to reflect your feedback (see redlines on first two pages of the attached document). Hopefully this addresses accurately where things currently stand from all perspectives. Best regards, Caitlin, Berry and Marika From: Lindsay Hamilton-Reid < lindsay.hamilton-reid@fasthosts.com<mailto:lindsay.hamilton-reid@fasthosts.com>> Date: Wednesday, November 7, 2018 at 3:13 PM To: "Mueller, Milton L" <milton@gatech.edu<mailto:milton@gatech.edu>> Cc: Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org> >, Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>>, " gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> > Subject: [Ext] Re: [Gnso-epdp-team] NCSG reactions to (part of) the interim report +1 Milton. In addition to Milton’s email below, these poinoints have been made repeatedly by the NCSG and the CPH. The Interim Report should reflect the differences in opinion and that there is no consensus on this point and many others. Many thanks Lindsay Sent from my iPhone On 7 Nov 2018, at 21:05, Mueller, Milton L <milton@gatech.edu<mailto:milton@gatech.edu>> wrote: Marika NCSG cannot accept big portions of the proposed text regarding the legal/natural persons distinction. We note that the text disregards statements from the contracted parties and NCSG. We would respectfully ask you to revise the text in a way that respects and reflects clearly stated and strongly held positions of at least three stakeholder groups. To be specific, the CPH has stated, in regard to the legal/natural persons and geographic distinctions: “œContracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations.” NCSG shares this opposition to requiring distinctions between legal and natural persons and geographic distinctions. In our comment on small team 1 we stated: “The main risk is that ththe difficulty of distinguishing between the two at the point of registration could lead to the unintended publication of the private data of many natural persons.†This assessment of risk is not reflected in the report. We also proposed deleting the entire paragraph on research because researching how various entities make this distinction basically assumes that making this distinction is a live option for the ePDP. In terms of consensus requirements, all indications are that it is not a real option. It is abundantly clear that no requirement for a distinction between legal and natural persons will survive a consensus recommendation process. At least three stakeholder groups – ¾ of the GGNSO and rroughly half of the ePDP – are rejecting it as an optiion. We think the report should move the process forward by explicitly recognizing this fact. Instead, we have Kurt stating on list that there was “an agreement” to do research on the feasibilility of differentiating between natural and legal persons. This statement can only come from completely disregarding the interventions NCSG members made in Barcelona, on the latest call, and in an email sent Tuesday to the list by Amr elSadr. To quote from Amr’s email regardinding Kurt’s statement regarding research: “I don’t believe that [research earch on legal/natural] was, in any way, reflective of a consensus to proceed with this recommendation among the Small Team members. To me, it was only an acknowledgement that this view was expressed, discussed, and subsequently required consideration by the whole team.” Kurt has not responded to this email. We will raise these concerns on the call tomorrow. In general, I think the team is in danger of losing sight of its primary mission, which is to quickly bring Whois into compliance with GDPR and to turn the temp spec into a legitimate policy. It seems that some people are seizing on the debate over the temp spec to impose new requirements on contracted parties. I understand that the chair and staff are trying their best to move things along, but we are disturbed by an apparent tendency to ignore or disregard clear position statements from SGs. One of the most important jobs of the ePDP chair is to recognize where consensus exists and where it does not. Some proposals are just not real options: they will never survive a council vote or a consensus call in the ePDP. It is unthinkable that the chair or staff would substitute their own preferences for the rough consensus of the working group. Let’s recognize the parameters of what people ce can live with and move forward from there. Eliminating options is progress, too. Milton Mueller, on behalf of NCSG From: Gnso-epdp-team [ mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Marika Konings Sent: Monday, November 5, 2018 11:49 PM To: Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 Following on from Kurt’s message, please find hereby the proposedsed language for inclusion in the Initial Report. Attached is the document that would be linked so that those interested would be able to review the different perspectives and proposals put forward. h3) Should Contracted Parties be allowed or required to treat legal and natural persons differently, and what mechanism is needed to ensure reliable determination of status? h4) Is there a legal basis for Contracted Parties to treat legal and natural persons differently? h5) What are the risks associated with differentiation of registrant status as legal or natural persons across multiple jurisdictions? (See EDPB letter of 5 July 2018). The EPDP Team discussed these questions extensively (see [include link to attached document which includes the different proposals]) and although the EPDP Team agrees that Contracted Parties should be allowed to treat legal and natural persons differently, the EPDP Team did not agree on whether this should be required and/or what further steps could or should be undertaken to determine what mechanism is needed to ensure reliable determination of status. The EPDP Team further agrees under GDPR there is a legal basis to treat legal and natural persons differently, but does not agree on whether that means Contracted Parties should be required to do so, or whether the challenges and legal risks involved in doing so result in leaving this optional. Similarly, the EPDP Team discussed the implication of other data protection regimes which could have different requirements that impact both natural and/or legal persons that would need to be factored in. The EPDP Team identified a number of risks, including: While legal persons don’t have the same protectictions under GDPR, natural persons employed by a legal person (and who may be designated as the registrant, admin or technical contact) are still natural persons enjoying rights and protections under GDPR. Some noted that this risk may be minimized through clear explanatory language beneath each field when filling in data fields within domain name registrations. There may be situations in which it can be difficult to separate the data of natural persons from that of legal persons. This can be the case, for example, if the legal person is a sole proprietorship, if the name of a person appears in the company’s name, if the business address is a natuatural person’s residence, or if an email address is is assigned to a single individual (“ john.doe@company.example.com<mailto:j:john.doe@company.example.com>” as opposed to “ info@company.example.com<mailto:ito:info@company.example.com> . The EPDP has discussed whether this risk may be somewhat mitigated through educational resources. Some in the EPDP Team expressed caution, as a stated necessity to rely on educational resources may not be considered to be compatible with the concepts of privacy by default or privacy by design i.e. where additional ‘educational resources’ are deemed necessary, sary, the process itself is likely not established or presented in a sufficiently clear manner. To help further inform the EPDP Team’s deliberationions on this topic as the team works towards a Final Report, the EPDP Team would like to request that GDD staff, who will design the implementation of these policy recommendations, commences research by investigating how ccTLDs and contracted parties currently distinguish between natural and legal persons to inform the EPDP Team. In addition, the EPDP Team would like to request input on the following questions in relation to this topic: · Are there examples from other industries or areas, e.g. ccTLDs, where a mechanism has been successfully developed and implemented to distinguish between natural and legal person, factoring in some of the challenges identified above? · Should the EPDP Team decide to recommend requiring distinguishing between natural and legal persons, how should implementation be carried out, especially considering legacy registrations? · Should the EPDP Team decide to recommend that further research is undertaken, beyond the information that GDD staff may encounter, what and how should this research be carried out? · (For the EDPB) If registrars allow registrants to self-identify at the time as a natural or legal person, who will be held liable if the registrant incorrectly self-identifies and personal information is publicly displayed? Apart from self-identification, are there any other ways in which risk of liability could be mitigated by registrars? The research requested and input on these charter questions will help the EPDP Team further analyze if it is possible and desirable to make this distinction in the context of domain name registrations, in a manner that is commercially reasonable, implementable and does not result in unreasonable liability for contracted parties. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team < gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Kurt Pritz <kurt@kjpritz.com<mailto:kurt@kjpritz.com>> Date: Monday, November 5, 2018 at 7:45 PM To: " gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> > Subject: Re: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 Hi Everyone: After all of this thought and writing, I think we have two paths forward that are relatively straightforward to describe. Rather than recap the arguments made here, I will just go right into my recommendations for next step and why. The Support Team will follow this with a better summation of what has transpired and how that leads to the recommendations below. It is clear that camps within our the team are at loggerheads with regard to how geographic basis and natural v legal persons should be handled within the proposed policy recommendations. Current situation and recent developments: Coming out of the small group meeting #1 during a teleconference, there was an agreement in principle that it was necessary to perform research in order to inform the policy discussion regarding the feasibility of differentiating between legal and natural persons. That agreement survived its initial introduction into the whole team where the comments centered around: (1) the adjectives used to describe the sense of urgency concerning the work, and (2) sharpening the detail regarding steps to be taken after the research. (There was never an agreement about how to proceed regarding differentiation of data subjects based on geographical considerations.) Starting Friday, substantial markups to the legal v natural agreement on doing research initiated this current three-day email chain. Preferred Recommendation (there are two): Go back to the agreement in principle that was reached in the small team with representatives from all groups to undertake research to determine if, how and to what extent we can distinguish between legal and natural persons. Then extend that research on to the geographic basis issue. A small group of us can contribute to the terms of reference for this research after the initial report is issued. Here is my rationale for this recommendation: 1) The various arguments laid out in all these emails on this list make the case themselves for the need to do research. For example, if the ICO says that processors can rely on data subject-provided information, does that mean that personal information mistakenly disclosed can be published without liability? We don’t know. We are setting up this and other quesuestions for DPAs. Isn’t that … research? There are other scenarios in the emails that will take research to sort through: whether ccTLD experiences are relevant, or whether a registrant boarding a train and leaving the EU for China while another registrant boarding a ferry for Marseilles will both be protected by GDPR. All this takes research to sort out. Nearly all of the emails on this list have to do with scenarios in support of one position or another - but all need to be studied in order for us to determine if and how distinctions can be made. 2) Many of the arguments laid out are conclusory or without authority. I don’t think the researcarch can have a preordained outcome. To make one point for each line of thinking: a) In the case of natural vs legal data subjects, some seek to build in in an implementation plan without knowing if or to what degree a solution is implementable b) In the case of Geographical distinctions between registrants, some are stating that such a distinction is categorically unimplementable without authority or evidence provided. I think the “truth will out” on these qse questions and we should not try to push research or our arguments to a pre-ordained outcome. 3) This will provide time to take the effects of existing laws in other jurisdictions into account - if that is deemed desirable. 4) This will take this discussion out of the critical path of finishing our reports, without leaving a blank. 5) The results of the research still must be considered by this team (or its successor) and a consensus derived. Research informs policy; it does not create policy. 6) If we agree to this approach, we can start the research now. If we temporize, there will be little done that will resolve this issue set over the next few months. Taking action in an attempt to understand all the complexity is the responsible thing to do. 7) These are complicated questions and research-based policy-making is required to answer them. How do we meet the timeline and still act in a thorough, detailed manner? By launching research and, in the meantime, going back to the rest of our questions. Whatever our policy conclusions are, even if we are deadlocked in several months time, we should be informed by information garnered from DPAs and other sources. The only other recommendation: MemorialIze the differences between the two sides on each of the two issues, explaining the arguments for each and asking for public comment on these issues. Here is my rationale for and against this recommendation: 1) It will allow us to publish the initial report and, properly framed, can garner specific public comment. However, other factors really argue against maintaining the current status and not taking some action: 2) In the time allotted for public comment, no commenter will be able to perform any meaningful research either. There might be reference to a study that partially informs our work, but not a dispositive study. At the end of the comment period, we are likely to be in the same place. 3) It is hard to see how the public comment will differ from our discussion, in this list, to date. 4) Even if we take the preferred research path above, we can still conduct the comment period on the current position of the parties. 5) If we have no outcome on this issue, the result, to me, is unknown and represent a risk to all parties at the table. Conclusion I thought is was remarkable that we came together and agreed to undertake this research on this difficult topic. It was a significant, meaningful compromise that embodied our reason for being here. I don’t see anything in in all the emails that indicate another compromise is possible unless that discussion is informed with significant, new information. I believe the appropriate path for this group is to recognize the differences cannot be resolved without something new and to take this path. Talk to you soon and best regards, Kurt On Nov 5, 2018, at 4:38 PM, Mark Svancarek (CELA) via Gnso-epdp-team <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> > wrote: Sorry for being dense, I still have questions. It is not surprising that the addition of a new process step would generate short term inefficiencies. It’s 5 years later – are the verification rates improproved from 20014? How would an optional “letet me self-identify as a corporation” capability be likely to cause verification disruptions? /marksv From: James M. Bladel <jbladel@godaddy.com<mailto:jbladel@godaddy.com>> Sent: Monday, November 5, 2018 13:28 To: Mark Svancarek (CELA) <marksv@microsoft.com<mailto:marksv@microsoft.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: Contracted Parties and Small Teams #1 and #2 Mark – Shortly following the launch of the 2013 RAAâ€â„„¢s requirements for WHOIS Verification, registrars noted that approx. 800,000 domains had been suspended in the first few months. The number continued to climb for a few years, and most were categorized as “false positivives” Here’s some covcoverage of that data at the time. https://domainnamewire.com/2014/06/24/over-800000-domain-names-suspended-due... [na01.safelinks.protection.outlook.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__na01.safelinks.protecti...> Any program that depends on Registrant self-categorization, self-declaration, or receipt & acting upon a notice has a huge error factor. For GoDaddy in 2014, the RAA verification rate was in the high 70% or low 80%, meaning that service to tens of thousands of customers was delayed or disrupted. It’s this is experience that causes Contracted Parties (but particularly Registrars) to be skeptical of any requirement to just “send an email” or “have the Regise Registrant check a box.” It doesn’t scat scale. J. ------------- James Bladel GoDaddy From: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>> Date: Monday, November 5, 2018 at 15:14 To: "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, " gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> > Subject: RE: Contracted Parties and Small Teams #1 and #2 James, can you clarify this: “many of whom couldld lose access to their registrations.” From: Gnso-epdp-team < gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Monday, November 5, 2018 10:57 To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] Contracted Parties and Small Teams #1 and #2 ePDP Colleagues and WG Leadership - This morning, Registry and Registrar representatives met to discuss the status of potential recommendations from Small Group #1 (Legal vs. Natural) and Small Group #2 (Geographic Regions) in our Draft Initial Report. We concluded that there are some legal bases supporting these distinctions under GDPR and other data protection laws, and note that our Initial Report supports this. However, we reiterate our numerous high-level concerns against making any Consensus Policy recommendations for contractual requirements in these areas. Our concerns involve: Legal - Aside from GDPR, other data protection laws are less clear on the distinction between legal and natural persons. Future regulations may contain contrary requirements. Furthermore, data of legal entities may contain or consist of personal information of natural persons, which would be entitled to protection under the GDPR and similar data protection regimes. Likewise, the geographic distinctions also create uncertainties. Technical - Contracted Parties are uniquely situated to assess the current level of the technological means available to us, and it is our stated position that a technical basis to reliably and confidently make such a distinction does not exist. Especially because any distinction schema would be dependent upon Registrant Self-Identification, which is fraught with error. Commercial - Developing and deploying this technology will involve significant costs, which may be prohibitive for smaller organizations and a barrier to market entry. Regardless of whether the distinction(s) are applied to new registrations or legacy domain names, it would be a logistical nightmare for Contracted Parties, and a source of confusion for Registrants, many of whom could lose access to their registrations. Asymmetrical Risks vs. Benefits - Contracted Parties would assume all regulatory risks of such an obligations, exclusively for the benefit of unburdened third parties. Scope - The distinction between Legal and Natural persons, or geographic regions, does not currently exist in the Domain Name System. Therefore, any recommendation mandating this change is outside the scope of the ePDP, and possibly the “picket f fence” of Registrar and Registry contracts. As a result, and for the avoidance of doubt, Contracted Parties oppose/reject any recommendations for new contractual requirements in the ePDP Draft Initial Report, and will remain opposed to these recommendations as we move towards final recommendations. Thank you, J. ------------- James Bladel GoDaddy _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team