Re: [Gnso-epdp-team] Notes & action items from today's meeting
Dear All, As per action item #3 below, Dan and I as ICANN Org liaisons reviewed the draft "Lawful Basis" memo<https://community.icann.org/download/attachments/95094053/Lawful%20Basis%20f...> circulated on Monday. There are some areas where there is considerable change from the contents of the Temporary Specification, such as redefining and assigning owners to the "purposes", as well as the characterization of the "responsible parties" and their roles. It's understandable that the EPDP Team is considering changes from what was in the Temporary Specification as per the EPDP charter<https://gnso.icann.org/sites/default/files/file/field-file-attach/temp-spec-...>. ICANN Org however has been directed<https://www.icann.org/resources/board-material/resolutions-2018-05-17-en> by the Board to implement the Temporary Specification. Accordingly, as liaisons from ICANN Org we are unable to convey an official ICANN position that differs from the Temporary Specification at this time. We will however continue to follow the EPDP Team's discussions carefully and supply whatever information we can to help advance the Team's discussions. Best, Trang and Dan ICANN Org Liaisons From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of Marika Konings <marika.konings@icann.org> Date: Tuesday, October 2, 2018 at 9:20 AM To: "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] Notes & action items from today's meeting Dear All, Please find below the notes and action items from today’s meeting. In order to facilitate the signing up for the small teams, please use the following link https://docs.google.com/document/d/1ChEYy-cZmT3qTD62-HsoVmddD96m6cbkSOv5dmAj.... As a reminder, please self-organize and assign max. 1 member from each group per small team. Call details will be sent to all, but only designated members are expected to attend (view only AC will be available for others interested to follow the deliberations). Best regards, Caitlin, Berry and Marika ============= EPDP Team Meeting #16 Tuesday, 2 October 2018 Notes and Action Items High-level Notes/Actions: Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties t to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Legal Basis document, RySG to provide additional data processing steps by Wednesday 3 October COB. Action item #3: EPDP Team to review lawful basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed to further consider idea of ICANN having direct contract with registrants. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. Questions for ICANN Org from the EPDP Team: None Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates (5 minutes) * Attendance will be taken from Adobe Connect * Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Recap EPDP Team F2F meeting - see high level notes circulated and posted on the wiki (https://community.icann.org/x/rQarBQ). Feedback welcome on what worked well and what didn't. * Meeting schedule going forward - to be discussed under item 5 on the agenda. * Review of outstanding action items - see https://community.icann.org/x/NwSNBQ * Other updates, if applicable 3. Legal basis for purposes and related processing activities Objective of discussion: (1) Agree on legal basis for different purposes and related processing activities a) Review legal basis memo outlining how to differentiate between Art 6.1(b) and Art 6.1(f) and discuss how this can be applied to purposes identified and related processing activities b) Agree on legal basis for purposes and related processing activities * See memo that was circulated prior to this meeting * Lawful test designed by Thomas facilitated the discussions but there was still confusion around what it means "necessary for performance of a contract" * Example found from the UK Information Commissioner's Office - processing must be necessary for the delivery of your part of the contract. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply. * Lawful test in combination with example applies to the EPDP Team purposes. Highlighted in blue is where small team came to agreement on lawful basis, those in orange, based on leadership team assessment. * For purpose A, does this just concern data for WHOIS or is it broader than that - this is focused on the data that is collected by the registrar, regardless of where it is. * Purpose C - focused on registrar communication, but this is mainly for other parties, why is that not included? If it is for other parties, the lawful basis would be 6.1(f). Add second processing activity focused on third parties (6.1(f)). May also be captured under purpose B? * May need to distinguish between what is collected and what goes into an RDDS? For example, in relation to Purpose N. Purpose N not limited to Spec 13, would also include Spec 12 gTLDs. Policy recommendations to cover the circumstances and purposes through which additional data elements are collected, even if those are not published or disclosed through RDDS. * In Purpose A, is a processing activity missing? Responding to requests from Registered Name Holder for purpose A. Should RNH be mentioned as a separate party? RNH is the data subject. * For Purpose A, transmission of registration data - why is this both 6.1(b) and 6.1(f) - isn't protecting against abuse a necessary part of the contract? * For Purpose E, isn't this also 6.1(b) as it is part of the broader requirements? Small team discussed what would present best case for success presenting this to DPAs and agreed on 6.1(f). * BC would support ICANN Org having a direct relationship with registrant to allow for 6.1(b) if this is currently prevented because ICANN does not have a direct contractual relationship with registrants. * For purpose F, why not 6.1(b)? In theory you could abolish contractual compliance and domain name registration would still work, hence 6.1(f) argument. * Need additional processing activity in M for party that files complaint and needs access to information. Needs to be further considered. * Helpful way to lay this out visually, makes it easier to understand. Groups need a bit more time to review and comment. * EPDP Team to review memo and especially link to CIO web-site. * Also note that there where disagreement may persist, this could be called out in the Initial Report as a question for which specific input is requested especially from DPAs. Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties access to this information to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Lawful Basis document, RySG to provide additional data processing steps EPDP Team to review this document and come back with feedback by Wednesday 3 October COB. Action item #3: EPDP Team to review Lawful Basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed Small team to further consider idea of ICANN having direct contract with registrants. 4. Review data elements workbook for purpose C - Enable communication or notification to the Registered Name Holder and/or their delegated parties of technical and/or administrative issues with a Registered Name (see https://community.icann.org/x/5AC8BQ) Objective of discussion: (1) Review data elements workbook for purpose C as completed by small team during LA F2F meeting (2) Agree on data elements needed for this purpose as well as responses to different questions in data elements workbook a) Review data elements workbook for purpose C b) Discuss any outstanding items / questions c) Finalize data elements workbook for purpose C * See data elements workbook for purpose C (see https://community.icann.org/x/5AC8BQ) * Mandatory fields to be collected under 6.1b, optional fields to be collected under 6.1(a) - consent. * What does optional mean? If no admin/tech contact info is provided, does it then default back to the registrant information? * If admin/tech contact info is provided, consent will need to be provided by the admin/tech contact. * If there is no reason to collect the data, would it go against the principle of data minimisation? Is option that is provided to RNH, only those that want to make use of this would opt for it, not a requirement. * In practice it is often a duplicate and no unique information is provided. * You could define two different products: 1 where the registrant acts for all contacts 2 where he / she wishes to designate additional contacts. In such case, both could be 6 I b and collection of third party that would occur based on Art. 14. * Why is making it an optional field problematic? As no one is required to do anything? Under GDPR you will still need to explain why data is collected. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. 5. Share list of outstanding issues and plan for addressing these * See planning document circulated prior to the meeting * How to sign up for small groups? Groups expected to self-organize - ideally max. 1 rep per group. Could use google doc to have an idea of attendance. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. 6. Wrap and confirm next meeting to be scheduled for Thursday 4 October at 13.00 UTC. a) Confirm action items b) Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_...> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...>.
Hi Trang- It is really important that ICANN Org meaningfully participate in this EPDP. If ICANN Org believes it is constrained because of the Board resolution, then please ask the Board for approval to participate. Our Board liaisons should be able to facilitate that approval for you. All the best, Margie From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of Trang Nguyen <trang.nguyen@icann.org> Date: Thursday, October 4, 2018 at 8:28 AM To: Marika Konings <marika.konings@icann.org>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting Dear All, As per action item #3 below, Dan and I as ICANN Org liaisons reviewed the draft "Lawful Basis" memo<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_dow...> circulated on Monday. There are some areas where there is considerable change from the contents of the Temporary Specification, such as redefining and assigning owners to the "purposes", as well as the characterization of the "responsible parties" and their roles. It's understandable that the EPDP Team is considering changes from what was in the Temporary Specification as per the EPDP charter<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_sites_de...>. ICANN Org however has been directed<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resources...> by the Board to implement the Temporary Specification. Accordingly, as liaisons from ICANN Org we are unable to convey an official ICANN position that differs from the Temporary Specification at this time. We will however continue to follow the EPDP Team's discussions carefully and supply whatever information we can to help advance the Team's discussions. Best, Trang and Dan ICANN Org Liaisons From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of Marika Konings <marika.konings@icann.org> Date: Tuesday, October 2, 2018 at 9:20 AM To: "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] Notes & action items from today's meeting Dear All, Please find below the notes and action items from today’s meeting. In order to facilitate the signing up for the small teams, please use the following link https://docs.google.com/document/d/1ChEYy-cZmT3qTD62-HsoVmddD96m6cbkSOv5dmAjmpY/edit?usp=sharing<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_document_d_1ChEYy-2DcZmT3qTD62-2DHsoVmddD96m6cbkSOv5dmAjmpY_edit-3Fusp-3Dsharing&d=DwMGaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8&m=JtF_A8u6pVp4jWEAz4x6Hu2ZCsRt7Ds2ULRTS-2bKxg&s=Dk1S6b3UpbiFdn0iBX0PrLrYeQbnpJplhgvjJITfUX8&e=>. As a reminder, please self-organize and assign max. 1 member from each group per small team. Call details will be sent to all, but only designated members are expected to attend (view only AC will be available for others interested to follow the deliberations). Best regards, Caitlin, Berry and Marika ============= EPDP Team Meeting #16 Tuesday, 2 October 2018 Notes and Action Items High-level Notes/Actions: Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties t to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Legal Basis document, RySG to provide additional data processing steps by Wednesday 3 October COB. Action item #3: EPDP Team to review lawful basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed to further consider idea of ICANN having direct contract with registrants. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. Questions for ICANN Org from the EPDP Team: None Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates (5 minutes) * Attendance will be taken from Adobe Connect * Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Recap EPDP Team F2F meeting - see high level notes circulated and posted on the wiki (https://community.icann.org/x/rQarBQ<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_rQarBQ&d=DwMGaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8&m=JtF_A8u6pVp4jWEAz4x6Hu2ZCsRt7Ds2ULRTS-2bKxg&s=Wg2hMhXv7SE1NQTE2wRZrOKssGG_VP8Or4q_bmKg3sw&e=>). Feedback welcome on what worked well and what didn't. * Meeting schedule going forward - to be discussed under item 5 on the agenda. * Review of outstanding action items - see https://community.icann.org/x/NwSNBQ * Other updates, if applicable 3. Legal basis for purposes and related processing activities Objective of discussion: (1) Agree on legal basis for different purposes and related processing activities a) Review legal basis memo outlining how to differentiate between Art 6.1(b) and Art 6.1(f) and discuss how this can be applied to purposes identified and related processing activities b) Agree on legal basis for purposes and related processing activities * See memo that was circulated prior to this meeting * Lawful test designed by Thomas facilitated the discussions but there was still confusion around what it means "necessary for performance of a contract" * Example found from the UK Information Commissioner's Office - processing must be necessary for the delivery of your part of the contract. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply. * Lawful test in combination with example applies to the EPDP Team purposes. Highlighted in blue is where small team came to agreement on lawful basis, those in orange, based on leadership team assessment. * For purpose A, does this just concern data for WHOIS or is it broader than that - this is focused on the data that is collected by the registrar, regardless of where it is. * Purpose C - focused on registrar communication, but this is mainly for other parties, why is that not included? If it is for other parties, the lawful basis would be 6.1(f). Add second processing activity focused on third parties (6.1(f)). May also be captured under purpose B? * May need to distinguish between what is collected and what goes into an RDDS? For example, in relation to Purpose N. Purpose N not limited to Spec 13, would also include Spec 12 gTLDs. Policy recommendations to cover the circumstances and purposes through which additional data elements are collected, even if those are not published or disclosed through RDDS. * In Purpose A, is a processing activity missing? Responding to requests from Registered Name Holder for purpose A. Should RNH be mentioned as a separate party? RNH is the data subject. * For Purpose A, transmission of registration data - why is this both 6.1(b) and 6.1(f) - isn't protecting against abuse a necessary part of the contract? * For Purpose E, isn't this also 6.1(b) as it is part of the broader requirements? Small team discussed what would present best case for success presenting this to DPAs and agreed on 6.1(f). * BC would support ICANN Org having a direct relationship with registrant to allow for 6.1(b) if this is currently prevented because ICANN does not have a direct contractual relationship with registrants. * For purpose F, why not 6.1(b)? In theory you could abolish contractual compliance and domain name registration would still work, hence 6.1(f) argument. * Need additional processing activity in M for party that files complaint and needs access to information. Needs to be further considered. * Helpful way to lay this out visually, makes it easier to understand. Groups need a bit more time to review and comment. * EPDP Team to review memo and especially link to CIO web-site. * Also note that there where disagreement may persist, this could be called out in the Initial Report as a question for which specific input is requested especially from DPAs. Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties access to this information to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Lawful Basis document, RySG to provide additional data processing steps EPDP Team to review this document and come back with feedback by Wednesday 3 October COB. Action item #3: EPDP Team to review Lawful Basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed Small team to further consider idea of ICANN having direct contract with registrants. 4. Review data elements workbook for purpose C - Enable communication or notification to the Registered Name Holder and/or their delegated parties of technical and/or administrative issues with a Registered Name (see https://community.icann.org/x/5AC8BQ) Objective of discussion: (1) Review data elements workbook for purpose C as completed by small team during LA F2F meeting (2) Agree on data elements needed for this purpose as well as responses to different questions in data elements workbook a) Review data elements workbook for purpose C b) Discuss any outstanding items / questions c) Finalize data elements workbook for purpose C * See data elements workbook for purpose C (see https://community.icann.org/x/5AC8BQ) * Mandatory fields to be collected under 6.1b, optional fields to be collected under 6.1(a) - consent. * What does optional mean? If no admin/tech contact info is provided, does it then default back to the registrant information? * If admin/tech contact info is provided, consent will need to be provided by the admin/tech contact. * If there is no reason to collect the data, would it go against the principle of data minimisation? Is option that is provided to RNH, only those that want to make use of this would opt for it, not a requirement. * In practice it is often a duplicate and no unique information is provided. * You could define two different products: 1 where the registrant acts for all contacts 2 where he / she wishes to designate additional contacts. In such case, both could be 6 I b and collection of third party that would occur based on Art. 14. * Why is making it an optional field problematic? As no one is required to do anything? Under GDPR you will still need to explain why data is collected. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. 5. Share list of outstanding issues and plan for addressing these * See planning document circulated prior to the meeting * How to sign up for small groups? Groups expected to self-organize - ideally max. 1 rep per group. Could use google doc to have an idea of attendance. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. 6. Wrap and confirm next meeting to be scheduled for Thursday 4 October at 13.00 UTC. a) Confirm action items b) Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_...> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...>.
I agree with Margie. I hope that you will be able to participate more fully in the future. /marksv From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of Margie Milam Sent: Monday, October 8, 2018 16:55 To: Trang Nguyen <trang.nguyen@icann.org> Cc: gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting Hi Trang- It is really important that ICANN Org meaningfully participate in this EPDP. If ICANN Org believes it is constrained because of the Board resolution, then please ask the Board for approval to participate. Our Board liaisons should be able to facilitate that approval for you. All the best, Margie From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Trang Nguyen <trang.nguyen@icann.org<mailto:trang.nguyen@icann.org>> Date: Thursday, October 4, 2018 at 8:28 AM To: Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting Dear All, As per action item #3 below, Dan and I as ICANN Org liaisons reviewed the draft "Lawful Basis" memo<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....> circulated on Monday. There are some areas where there is considerable change from the contents of the Temporary Specification, such as redefining and assigning owners to the "purposes", as well as the characterization of the "responsible parties" and their roles. It's understandable that the EPDP Team is considering changes from what was in the Temporary Specification as per the EPDP charter<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....>. ICANN Org however has been directed<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....> by the Board to implement the Temporary Specification. Accordingly, as liaisons from ICANN Org we are unable to convey an official ICANN position that differs from the Temporary Specification at this time. We will however continue to follow the EPDP Team's discussions carefully and supply whatever information we can to help advance the Team's discussions. Best, Trang and Dan ICANN Org Liaisons From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> Date: Tuesday, October 2, 2018 at 9:20 AM To: "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] Notes & action items from today's meeting Dear All, Please find below the notes and action items from today’s meeting. In order to facilitate the signing up for the small teams, please use the following link https://docs.google.com/document/d/1ChEYy-cZmT3qTD62-HsoVmddD96m6cbkSOv5dmAjmpY/edit?usp=sharing<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__docs.google.com_document_d_1ChEYy-2DcZmT3qTD62-2DHsoVmddD96m6cbkSOv5dmAjmpY_edit-3Fusp-3Dsharing%26d%3DDwMGaQ%26c%3D5VD0RTtNlTh3ycd41b3MUw%26r%3D_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8%26m%3DJtF_A8u6pVp4jWEAz4x6Hu2ZCsRt7Ds2ULRTS-2bKxg%26s%3DDk1S6b3UpbiFdn0iBX0PrLrYeQbnpJplhgvjJITfUX8%26e%3D&data=02%7C01%7Cmarksv%40microsoft.com%7Ce542851ec79444aa393508d62d797f18%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636746397184936786&sdata=enCllGI8YaHgbMqPW19Ll8nlPfsx2GhHsBucDmLEpm4%3D&reserved=0>. As a reminder, please self-organize and assign max. 1 member from each group per small team. Call details will be sent to all, but only designated members are expected to attend (view only AC will be available for others interested to follow the deliberations). Best regards, Caitlin, Berry and Marika ============= EPDP Team Meeting #16 Tuesday, 2 October 2018 Notes and Action Items High-level Notes/Actions: Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties t to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Legal Basis document, RySG to provide additional data processing steps by Wednesday 3 October COB. Action item #3: EPDP Team to review lawful basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed to further consider idea of ICANN having direct contract with registrants. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. Questions for ICANN Org from the EPDP Team: None Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates (5 minutes) * Attendance will be taken from Adobe Connect * Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Recap EPDP Team F2F meeting - see high level notes circulated and posted on the wiki (https://community.icann.org/x/rQarBQ<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__community.icann.org_x_rQarBQ%26d%3DDwMGaQ%26c%3D5VD0RTtNlTh3ycd41b3MUw%26r%3D_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8%26m%3DJtF_A8u6pVp4jWEAz4x6Hu2ZCsRt7Ds2ULRTS-2bKxg%26s%3DWg2hMhXv7SE1NQTE2wRZrOKssGG_VP8Or4q_bmKg3sw%26e%3D&data=02%7C01%7Cmarksv%40microsoft.com%7Ce542851ec79444aa393508d62d797f18%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636746397184936786&sdata=%2FfHjoyyR1ptZJw%2F2%2B%2FAhs0PEnIXq3mPfzUnT%2F1q5bdo%3D&reserved=0>). Feedback welcome on what worked well and what didn't. * Meeting schedule going forward - to be discussed under item 5 on the agenda. * Review of outstanding action items - see https://community.icann.org/x/NwSNBQ * Other updates, if applicable 3. Legal basis for purposes and related processing activities Objective of discussion: (1) Agree on legal basis for different purposes and related processing activities a) Review legal basis memo outlining how to differentiate between Art 6.1(b) and Art 6.1(f) and discuss how this can be applied to purposes identified and related processing activities b) Agree on legal basis for purposes and related processing activities * See memo that was circulated prior to this meeting * Lawful test designed by Thomas facilitated the discussions but there was still confusion around what it means "necessary for performance of a contract" * Example found from the UK Information Commissioner's Office - processing must be necessary for the delivery of your part of the contract. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply. * Lawful test in combination with example applies to the EPDP Team purposes. Highlighted in blue is where small team came to agreement on lawful basis, those in orange, based on leadership team assessment. * For purpose A, does this just concern data for WHOIS or is it broader than that - this is focused on the data that is collected by the registrar, regardless of where it is. * Purpose C - focused on registrar communication, but this is mainly for other parties, why is that not included? If it is for other parties, the lawful basis would be 6.1(f). Add second processing activity focused on third parties (6.1(f)). May also be captured under purpose B? * May need to distinguish between what is collected and what goes into an RDDS? For example, in relation to Purpose N. Purpose N not limited to Spec 13, would also include Spec 12 gTLDs. Policy recommendations to cover the circumstances and purposes through which additional data elements are collected, even if those are not published or disclosed through RDDS. * In Purpose A, is a processing activity missing? Responding to requests from Registered Name Holder for purpose A. Should RNH be mentioned as a separate party? RNH is the data subject. * For Purpose A, transmission of registration data - why is this both 6.1(b) and 6.1(f) - isn't protecting against abuse a necessary part of the contract? * For Purpose E, isn't this also 6.1(b) as it is part of the broader requirements? Small team discussed what would present best case for success presenting this to DPAs and agreed on 6.1(f). * BC would support ICANN Org having a direct relationship with registrant to allow for 6.1(b) if this is currently prevented because ICANN does not have a direct contractual relationship with registrants. * For purpose F, why not 6.1(b)? In theory you could abolish contractual compliance and domain name registration would still work, hence 6.1(f) argument. * Need additional processing activity in M for party that files complaint and needs access to information. Needs to be further considered. * Helpful way to lay this out visually, makes it easier to understand. Groups need a bit more time to review and comment. * EPDP Team to review memo and especially link to CIO web-site. * Also note that there where disagreement may persist, this could be called out in the Initial Report as a question for which specific input is requested especially from DPAs. Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties access to this information to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Lawful Basis document, RySG to provide additional data processing steps EPDP Team to review this document and come back with feedback by Wednesday 3 October COB. Action item #3: EPDP Team to review Lawful Basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed Small team to further consider idea of ICANN having direct contract with registrants. 4. Review data elements workbook for purpose C - Enable communication or notification to the Registered Name Holder and/or their delegated parties of technical and/or administrative issues with a Registered Name (see https://community.icann.org/x/5AC8BQ) Objective of discussion: (1) Review data elements workbook for purpose C as completed by small team during LA F2F meeting (2) Agree on data elements needed for this purpose as well as responses to different questions in data elements workbook a) Review data elements workbook for purpose C b) Discuss any outstanding items / questions c) Finalize data elements workbook for purpose C * See data elements workbook for purpose C (see https://community.icann.org/x/5AC8BQ) * Mandatory fields to be collected under 6.1b, optional fields to be collected under 6.1(a) - consent. * What does optional mean? If no admin/tech contact info is provided, does it then default back to the registrant information? * If admin/tech contact info is provided, consent will need to be provided by the admin/tech contact. * If there is no reason to collect the data, would it go against the principle of data minimisation? Is option that is provided to RNH, only those that want to make use of this would opt for it, not a requirement. * In practice it is often a duplicate and no unique information is provided. * You could define two different products: 1 where the registrant acts for all contacts 2 where he / she wishes to designate additional contacts. In such case, both could be 6 I b and collection of third party that would occur based on Art. 14. * Why is making it an optional field problematic? As no one is required to do anything? Under GDPR you will still need to explain why data is collected. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. 5. Share list of outstanding issues and plan for addressing these * See planning document circulated prior to the meeting * How to sign up for small groups? Groups expected to self-organize - ideally max. 1 rep per group. Could use google doc to have an idea of attendance. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. 6. Wrap and confirm next meeting to be scheduled for Thursday 4 October at 13.00 UTC. a) Confirm action items b) Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....> and visiting the GNSO Newcomer pages<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....>.
Hi Trang, all, Let me support Margie’s request. It is of paramount importance to the success of this group to be able to obtain reliable feedback from ICANN Org. You might also remember that I asked Chris to get a written confirmation from ICANN Org confirming that ICANN will in fact enter into the required agreements as suggested by the policy coming out of this group. These would be a Joint Controller Agreement and Data Processing Agreements. Just imagine if we came up with recommendations that ICANN org would not be willing or able to operationalize. This would be a waist of resources and embarrassment on world stage. I would also appreciate if the Board members on our team could chime in. Thanks and kind regards, Thomas
Am 09.10.2018 um 01:54 schrieb Margie Milam <margiemilam@fb.com>:
Hi Trang-
It is really important that ICANN Org meaningfully participate in this EPDP. If ICANN Org believes it is constrained because of the Board resolution, then please ask the Board for approval to participate. Our Board liaisons should be able to facilitate that approval for you.
All the best, Margie
From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org <mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Trang Nguyen <trang.nguyen@icann.org <mailto:trang.nguyen@icann.org>> Date: Thursday, October 4, 2018 at 8:28 AM To: Marika Konings <marika.konings@icann.org <mailto:marika.konings@icann.org>>, "gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting
Dear All,
As per action item #3 below, Dan and I as ICANN Org liaisons reviewed the draft "Lawful Basis" memo <https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_dow...> circulated on Monday. There are some areas where there is considerable change from the contents of the Temporary Specification, such as redefining and assigning owners to the "purposes", as well as the characterization of the "responsible parties" and their roles.
It's understandable that the EPDP Team is considering changes from what was in the Temporary Specification as per the EPDP charter <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_sites_de...>. ICANN Org however has been directed <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resources...> by the Board to implement the Temporary Specification. Accordingly, as liaisons from ICANN Org we are unable to convey an official ICANN position that differs from the Temporary Specification at this time. We will however continue to follow the EPDP Team's discussions carefully and supply whatever information we can to help advance the Team's discussions.
Best,
Trang and Dan ICANN Org Liaisons
From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org <mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Marika Konings <marika.konings@icann.org <mailto:marika.konings@icann.org>> Date: Tuesday, October 2, 2018 at 9:20 AM To: "gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] Notes & action items from today's meeting
Dear All,
Please find below the notes and action items from today’s meeting. In order to facilitate the signing up for the small teams, please use the following link https://docs.google.com/document/d/1ChEYy-cZmT3qTD62-HsoVmddD96m6cbkSOv5dmAj... <https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_documen...>. As a reminder, please self-organize and assign max. 1 member from each group per small team. Call details will be sent to all, but only designated members are expected to attend (view only AC will be available for others interested to follow the deliberations).
Best regards,
Caitlin, Berry and Marika
=============
EPDP Team Meeting #16 Tuesday, 2 October 2018 Notes and Action Items
High-level Notes/Actions:
Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties t to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)).
Action item #2: Regarding the Legal Basis document, RySG to provide additional data processing steps by Wednesday 3 October COB.
Action item #3: EPDP Team to review lawful basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations
Action item #4: Leadership to develop methodology to be developed to further consider idea of ICANN having direct contract with registrants.
Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important.
Action item #6: EPDP Team to review planning and schedule and share any feedback on the list.
Questions for ICANN Org from the EPDP Team: None
Notes & Action items
These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ <https://community.icann.org/x/2IpHBQ>.
1. Roll Call & SOI Updates (5 minutes)
Attendance will be taken from Adobe Connect Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team.
2. Welcome and Updates from EPDP Team Chair (5 minutes) Recap EPDP Team F2F meeting - see high level notes circulated and posted on the wiki (https://community.icann.org/x/rQarBQ <https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_r...>). Feedback welcome on what worked well and what didn't. Meeting schedule going forward - to be discussed under item 5 on the agenda. Review of outstanding action items - see https://community.icann.org/x/NwSNBQ <https://community.icann.org/x/NwSNBQ> Other updates, if applicable
3. Legal basis for purposes and related processing activities Objective of discussion: (1) Agree on legal basis for different purposes and related processing activities a) Review legal basis memo outlining how to differentiate between Art 6.1(b) and Art 6.1(f) and discuss how this can be applied to purposes identified and related processing activities b) Agree on legal basis for purposes and related processing activities See memo that was circulated prior to this meeting Lawful test designed by Thomas facilitated the discussions but there was still confusion around what it means "necessary for performance of a contract" Example found from the UK Information Commissioner's Office - processing must be necessary for the delivery of your part of the contract. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply. Lawful test in combination with example applies to the EPDP Team purposes. Highlighted in blue is where small team came to agreement on lawful basis, those in orange, based on leadership team assessment. For purpose A, does this just concern data for WHOIS or is it broader than that - this is focused on the data that is collected by the registrar, regardless of where it is. Purpose C - focused on registrar communication, but this is mainly for other parties, why is that not included? If it is for other parties, the lawful basis would be 6.1(f). Add second processing activity focused on third parties (6.1(f)). May also be captured under purpose B? May need to distinguish between what is collected and what goes into an RDDS? For example, in relation to Purpose N. Purpose N not limited to Spec 13, would also include Spec 12 gTLDs. Policy recommendations to cover the circumstances and purposes through which additional data elements are collected, even if those are not published or disclosed through RDDS. In Purpose A, is a processing activity missing? Responding to requests from Registered Name Holder for purpose A. Should RNH be mentioned as a separate party? RNH is the data subject. For Purpose A, transmission of registration data - why is this both 6.1(b) and 6.1(f) - isn't protecting against abuse a necessary part of the contract? For Purpose E, isn't this also 6.1(b) as it is part of the broader requirements? Small team discussed what would present best case for success presenting this to DPAs and agreed on 6.1(f). BC would support ICANN Org having a direct relationship with registrant to allow for 6.1(b) if this is currently prevented because ICANN does not have a direct contractual relationship with registrants. For purpose F, why not 6.1(b)? In theory you could abolish contractual compliance and domain name registration would still work, hence 6.1(f) argument. Need additional processing activity in M for party that files complaint and needs access to information. Needs to be further considered. Helpful way to lay this out visually, makes it easier to understand. Groups need a bit more time to review and comment. EPDP Team to review memo and especially link to CIO web-site. Also note that there where disagreement may persist, this could be called out in the Initial Report as a question for which specific input is requested especially from DPAs.
Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties access to this information to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)).
Action item #2: Regarding the Lawful Basis document, RySG to provide additional data processing steps EPDP Team to review this document and come back with feedback by Wednesday 3 October COB.
Action item #3: EPDP Team to review Lawful Basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations
Action item #4: Leadership to develop methodology to be developed Small team to further consider idea of ICANN having direct contract with registrants.
4. Review data elements workbook for purpose C - Enable communication or notification to the Registered Name Holder and/or their delegated parties of technical and/or administrative issues with a Registered Name (see https://community.icann.org/x/5AC8BQ <https://community.icann.org/x/5AC8BQ>) Objective of discussion: (1) Review data elements workbook for purpose C as completed by small team during LA F2F meeting (2) Agree on data elements needed for this purpose as well as responses to different questions in data elements workbook a) Review data elements workbook for purpose C b) Discuss any outstanding items / questions c) Finalize data elements workbook for purpose C See data elements workbook for purpose C (see https://community.icann.org/x/5AC8BQ <https://community.icann.org/x/5AC8BQ>) Mandatory fields to be collected under 6.1b, optional fields to be collected under 6.1(a) - consent. What does optional mean? If no admin/tech contact info is provided, does it then default back to the registrant information? If admin/tech contact info is provided, consent will need to be provided by the admin/tech contact. If there is no reason to collect the data, would it go against the principle of data minimisation? Is option that is provided to RNH, only those that want to make use of this would opt for it, not a requirement. In practice it is often a duplicate and no unique information is provided. You could define two different products: 1 where the registrant acts for all contacts 2 where he / she wishes to designate additional contacts. In such case, both could be 6 I b and collection of third party that would occur based on Art. 14. Why is making it an optional field problematic? As no one is required to do anything? Under GDPR you will still need to explain why data is collected.
Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important.
5. Share list of outstanding issues and plan for addressing these See planning document circulated prior to the meeting How to sign up for small groups? Groups expected to self-organize - ideally max. 1 rep per group. Could use google doc to have an idea of attendance.
Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. 6. Wrap and confirm next meeting to be scheduled for Thursday 4 October at 13.00 UTC. a) Confirm action items b) Confirm questions for ICANN Org, if any
Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org <mailto:marika.konings@icann.org>
Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses <https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_...> and visiting the GNSO Newcomer pages <https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...>.
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team>
Hi Trang, All- I strongly support Margie and Thomas on this matter. I am a new-comer to this stage but see clearly that in this EPDP and in past working groups there has been an incredible amount of time, energy and resources put into answering questions and making thoughtful recommendations to set-up ICANN to function operationally within a legally compliant, efficient and the capacity to address modern privacy and data protection considerations and multi-stakeholder needs. To move forward and accomplish the goals needed here and for ICANN going forward, there needs to be reliable feedback and clear and open communication from ICANN Org. We all have the ultimate goal of assisting with a productive and compliant set-up of ICANN and a functioning framework for all. Sincerely, Diane Diane Plaut General Counsel and Privacy Officer [cid:image001.png@01D3CA70.18FC1D40] Direct +1 646-899-2806 diane.plaut@corsearch.com<mailto:diane.plaut@corsearch.com> 220 West 42nd Street, 11th Floor, New York, NY 10036, United States www.corsearch.com<http://www.corsearch.com/> Join Corsearch on Twitter<https://twitter.com/corsearch> Linkedin<https://www.linkedin.com/company/2593860/> Trademarks + Brands<http://trademarksandbrands.corsearch.com/> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241) Corsearch.USCustomerService@corsearch.com<mailto:Corsearch.USCustomerService@corsearch.com> Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession. From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of Thomas Rickert <epdp@gdpr.ninja> Date: Tuesday, October 9, 2018 at 4:12 AM To: Margie Milam <margiemilam@fb.com> Cc: "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting Hi Trang, all, Let me support Margie’s request. It is of paramount importance to the success of this group to be able to obtain reliable feedback from ICANN Org. You might also remember that I asked Chris to get a written confirmation from ICANN Org confirming that ICANN will in fact enter into the required agreements as suggested by the policy coming out of this group. These would be a Joint Controller Agreement and Data Processing Agreements. Just imagine if we came up with recommendations that ICANN org would not be willing or able to operationalize. This would be a waist of resources and embarrassment on world stage. I would also appreciate if the Board members on our team could chime in. Thanks and kind regards, Thomas Am 09.10.2018 um 01:54 schrieb Margie Milam <margiemilam@fb.com<mailto:margiemilam@fb.com>>: Hi Trang- It is really important that ICANN Org meaningfully participate in this EPDP. If ICANN Org believes it is constrained because of the Board resolution, then please ask the Board for approval to participate. Our Board liaisons should be able to facilitate that approval for you. All the best, Margie From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Trang Nguyen <trang.nguyen@icann.org<mailto:trang.nguyen@icann.org>> Date: Thursday, October 4, 2018 at 8:28 AM To: Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting Dear All, As per action item #3 below, Dan and I as ICANN Org liaisons reviewed the draft "Lawful Basis" memo<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_dow...> circulated on Monday. There are some areas where there is considerable change from the contents of the Temporary Specification, such as redefining and assigning owners to the "purposes", as well as the characterization of the "responsible parties" and their roles. It's understandable that the EPDP Team is considering changes from what was in the Temporary Specification as per the EPDP charter<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_sites_de...>. ICANN Org however has been directed<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resources...> by the Board to implement the Temporary Specification. Accordingly, as liaisons from ICANN Org we are unable to convey an official ICANN position that differs from the Temporary Specification at this time. We will however continue to follow the EPDP Team's discussions carefully and supply whatever information we can to help advance the Team's discussions. Best, Trang and Dan ICANN Org Liaisons From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> Date: Tuesday, October 2, 2018 at 9:20 AM To: "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] Notes & action items from today's meeting Dear All, Please find below the notes and action items from today’s meeting. In order to facilitate the signing up for the small teams, please use the following link https://docs.google.com/document/d/1ChEYy-cZmT3qTD62-HsoVmddD96m6cbkSOv5dmAjmpY/edit?usp=sharing<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_document_d_1ChEYy-2DcZmT3qTD62-2DHsoVmddD96m6cbkSOv5dmAjmpY_edit-3Fusp-3Dsharing&d=DwMGaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8&m=JtF_A8u6pVp4jWEAz4x6Hu2ZCsRt7Ds2ULRTS-2bKxg&s=Dk1S6b3UpbiFdn0iBX0PrLrYeQbnpJplhgvjJITfUX8&e=>. As a reminder, please self-organize and assign max. 1 member from each group per small team. Call details will be sent to all, but only designated members are expected to attend (view only AC will be available for others interested to follow the deliberations). Best regards, Caitlin, Berry and Marika ============= EPDP Team Meeting #16 Tuesday, 2 October 2018 Notes and Action Items High-level Notes/Actions: Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties t to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Legal Basis document, RySG to provide additional data processing steps by Wednesday 3 October COB. Action item #3: EPDP Team to review lawful basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed to further consider idea of ICANN having direct contract with registrants. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. Questions for ICANN Org from the EPDP Team: None Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ<https://community.icann.org/x/2IpHBQ>. 1. Roll Call & SOI Updates (5 minutes) * Attendance will be taken from Adobe Connect * Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Recap EPDP Team F2F meeting - see high level notes circulated and posted on the wiki (https://community.icann.org/x/rQarBQ<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_rQarBQ&d=DwMGaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8&m=JtF_A8u6pVp4jWEAz4x6Hu2ZCsRt7Ds2ULRTS-2bKxg&s=Wg2hMhXv7SE1NQTE2wRZrOKssGG_VP8Or4q_bmKg3sw&e=>). Feedback welcome on what worked well and what didn't. * Meeting schedule going forward - to be discussed under item 5 on the agenda. * Review of outstanding action items - see https://community.icann.org/x/NwSNBQ<https://community.icann.org/x/NwSNBQ> * Other updates, if applicable 3. Legal basis for purposes and related processing activities Objective of discussion: (1) Agree on legal basis for different purposes and related processing activities a) Review legal basis memo outlining how to differentiate between Art 6.1(b) and Art 6.1(f) and discuss how this can be applied to purposes identified and related processing activities b) Agree on legal basis for purposes and related processing activities * See memo that was circulated prior to this meeting * Lawful test designed by Thomas facilitated the discussions but there was still confusion around what it means "necessary for performance of a contract" * Example found from the UK Information Commissioner's Office - processing must be necessary for the delivery of your part of the contract. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply. * Lawful test in combination with example applies to the EPDP Team purposes. Highlighted in blue is where small team came to agreement on lawful basis, those in orange, based on leadership team assessment. * For purpose A, does this just concern data for WHOIS or is it broader than that - this is focused on the data that is collected by the registrar, regardless of where it is. * Purpose C - focused on registrar communication, but this is mainly for other parties, why is that not included? If it is for other parties, the lawful basis would be 6.1(f). Add second processing activity focused on third parties (6.1(f)). May also be captured under purpose B? * May need to distinguish between what is collected and what goes into an RDDS? For example, in relation to Purpose N. Purpose N not limited to Spec 13, would also include Spec 12 gTLDs. Policy recommendations to cover the circumstances and purposes through which additional data elements are collected, even if those are not published or disclosed through RDDS. * In Purpose A, is a processing activity missing? Responding to requests from Registered Name Holder for purpose A. Should RNH be mentioned as a separate party? RNH is the data subject. * For Purpose A, transmission of registration data - why is this both 6.1(b) and 6.1(f) - isn't protecting against abuse a necessary part of the contract? * For Purpose E, isn't this also 6.1(b) as it is part of the broader requirements? Small team discussed what would present best case for success presenting this to DPAs and agreed on 6.1(f). * BC would support ICANN Org having a direct relationship with registrant to allow for 6.1(b) if this is currently prevented because ICANN does not have a direct contractual relationship with registrants. * For purpose F, why not 6.1(b)? In theory you could abolish contractual compliance and domain name registration would still work, hence 6.1(f) argument. * Need additional processing activity in M for party that files complaint and needs access to information. Needs to be further considered. * Helpful way to lay this out visually, makes it easier to understand. Groups need a bit more time to review and comment. * EPDP Team to review memo and especially link to CIO web-site. * Also note that there where disagreement may persist, this could be called out in the Initial Report as a question for which specific input is requested especially from DPAs. Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties access to this information to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Lawful Basis document, RySG to provide additional data processing steps EPDP Team to review this document and come back with feedback by Wednesday 3 October COB. Action item #3: EPDP Team to review Lawful Basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed Small team to further consider idea of ICANN having direct contract with registrants. 4. Review data elements workbook for purpose C - Enable communication or notification to the Registered Name Holder and/or their delegated parties of technical and/or administrative issues with a Registered Name (see https://community.icann.org/x/5AC8BQ<https://community.icann.org/x/5AC8BQ>) Objective of discussion: (1) Review data elements workbook for purpose C as completed by small team during LA F2F meeting (2) Agree on data elements needed for this purpose as well as responses to different questions in data elements workbook a) Review data elements workbook for purpose C b) Discuss any outstanding items / questions c) Finalize data elements workbook for purpose C * See data elements workbook for purpose C (see https://community.icann.org/x/5AC8BQ<https://community.icann.org/x/5AC8BQ>) * Mandatory fields to be collected under 6.1b, optional fields to be collected under 6.1(a) - consent. * What does optional mean? If no admin/tech contact info is provided, does it then default back to the registrant information? * If admin/tech contact info is provided, consent will need to be provided by the admin/tech contact. * If there is no reason to collect the data, would it go against the principle of data minimisation? Is option that is provided to RNH, only those that want to make use of this would opt for it, not a requirement. * In practice it is often a duplicate and no unique information is provided. * You could define two different products: 1 where the registrant acts for all contacts 2 where he / she wishes to designate additional contacts. In such case, both could be 6 I b and collection of third party that would occur based on Art. 14. * Why is making it an optional field problematic? As no one is required to do anything? Under GDPR you will still need to explain why data is collected. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. 5. Share list of outstanding issues and plan for addressing these * See planning document circulated prior to the meeting * How to sign up for small groups? Groups expected to self-organize - ideally max. 1 rep per group. Could use google doc to have an idea of attendance. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. 6. Wrap and confirm next meeting to be scheduled for Thursday 4 October at 13.00 UTC. a) Confirm action items b) Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_...> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...>. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://mm.icann.org/mailman/listinfo/gnso-epdp-team>
I am not sure I agree. I think it is up to us to make the policy, and the Board to implement it after we do. The board passed a temporary policy because of the emergency situation, they are just waiting for us to come up with a real, legitimate policy/ Board liaisons are nice to clarify certain issues, but we don’t need board approval for any of our decisions. --MM From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Plaut, Diane Sent: Tuesday, October 9, 2018 11:30 AM To: Thomas Rickert <epdp@gdpr.ninja>; Margie Milam <margiemilam@fb.com> Cc: gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting Hi Trang, All- I strongly support Margie and Thomas on this matter. I am a new-comer to this stage but see clearly that in this EPDP and in past working groups there has been an incredible amount of time, energy and resources put into answering questions and making thoughtful recommendations to set-up ICANN to function operationally within a legally compliant, efficient and the capacity to address modern privacy and data protection considerations and multi-stakeholder needs. To move forward and accomplish the goals needed here and for ICANN going forward, there needs to be reliable feedback and clear and open communication from ICANN Org. We all have the ultimate goal of assisting with a productive and compliant set-up of ICANN and a functioning framework for all. Sincerely, Diane Diane Plaut General Counsel and Privacy Officer [cid:image001.png@01D3CA70.18FC1D40] Direct +1 646-899-2806 diane.plaut@corsearch.com<mailto:diane.plaut@corsearch.com> 220 West 42nd Street, 11th Floor, New York, NY 10036, United States www.corsearch.com<http://www.corsearch.com/> Join Corsearch on Twitter<https://twitter.com/corsearch> Linkedin<https://www.linkedin.com/company/2593860/> Trademarks + Brands<http://trademarksandbrands.corsearch.com/> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241) Corsearch.USCustomerService@corsearch.com<mailto:Corsearch.USCustomerService@corsearch.com> Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession. From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Thomas Rickert <epdp@gdpr.ninja<mailto:epdp@gdpr.ninja>> Date: Tuesday, October 9, 2018 at 4:12 AM To: Margie Milam <margiemilam@fb.com<mailto:margiemilam@fb.com>> Cc: "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting Hi Trang, all, Let me support Margie’s request. It is of paramount importance to the success of this group to be able to obtain reliable feedback from ICANN Org. You might also remember that I asked Chris to get a written confirmation from ICANN Org confirming that ICANN will in fact enter into the required agreements as suggested by the policy coming out of this group. These would be a Joint Controller Agreement and Data Processing Agreements. Just imagine if we came up with recommendations that ICANN org would not be willing or able to operationalize. This would be a waist of resources and embarrassment on world stage. I would also appreciate if the Board members on our team could chime in. Thanks and kind regards, Thomas Am 09.10.2018 um 01:54 schrieb Margie Milam <margiemilam@fb.com<mailto:margiemilam@fb.com>>: Hi Trang- It is really important that ICANN Org meaningfully participate in this EPDP. If ICANN Org believes it is constrained because of the Board resolution, then please ask the Board for approval to participate. Our Board liaisons should be able to facilitate that approval for you. All the best, Margie From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Trang Nguyen <trang.nguyen@icann.org<mailto:trang.nguyen@icann.org>> Date: Thursday, October 4, 2018 at 8:28 AM To: Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting Dear All, As per action item #3 below, Dan and I as ICANN Org liaisons reviewed the draft "Lawful Basis" memo<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_dow...> circulated on Monday. There are some areas where there is considerable change from the contents of the Temporary Specification, such as redefining and assigning owners to the "purposes", as well as the characterization of the "responsible parties" and their roles. It's understandable that the EPDP Team is considering changes from what was in the Temporary Specification as per the EPDP charter<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_sites_de...>. ICANN Org however has been directed<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resources...> by the Board to implement the Temporary Specification. Accordingly, as liaisons from ICANN Org we are unable to convey an official ICANN position that differs from the Temporary Specification at this time. We will however continue to follow the EPDP Team's discussions carefully and supply whatever information we can to help advance the Team's discussions. Best, Trang and Dan ICANN Org Liaisons From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> Date: Tuesday, October 2, 2018 at 9:20 AM To: "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] Notes & action items from today's meeting Dear All, Please find below the notes and action items from today’s meeting. In order to facilitate the signing up for the small teams, please use the following link https://docs.google.com/document/d/1ChEYy-cZmT3qTD62-HsoVmddD96m6cbkSOv5dmAjmpY/edit?usp=sharing<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_document_d_1ChEYy-2DcZmT3qTD62-2DHsoVmddD96m6cbkSOv5dmAjmpY_edit-3Fusp-3Dsharing&d=DwMGaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8&m=JtF_A8u6pVp4jWEAz4x6Hu2ZCsRt7Ds2ULRTS-2bKxg&s=Dk1S6b3UpbiFdn0iBX0PrLrYeQbnpJplhgvjJITfUX8&e=>. As a reminder, please self-organize and assign max. 1 member from each group per small team. Call details will be sent to all, but only designated members are expected to attend (view only AC will be available for others interested to follow the deliberations). Best regards, Caitlin, Berry and Marika ============= EPDP Team Meeting #16 Tuesday, 2 October 2018 Notes and Action Items High-level Notes/Actions: Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties t to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Legal Basis document, RySG to provide additional data processing steps by Wednesday 3 October COB. Action item #3: EPDP Team to review lawful basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed to further consider idea of ICANN having direct contract with registrants. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. Questions for ICANN Org from the EPDP Team: None Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates (5 minutes) * Attendance will be taken from Adobe Connect * Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Recap EPDP Team F2F meeting - see high level notes circulated and posted on the wiki (https://community.icann.org/x/rQarBQ<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_rQarBQ&d=DwMGaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8&m=JtF_A8u6pVp4jWEAz4x6Hu2ZCsRt7Ds2ULRTS-2bKxg&s=Wg2hMhXv7SE1NQTE2wRZrOKssGG_VP8Or4q_bmKg3sw&e=>). Feedback welcome on what worked well and what didn't. * Meeting schedule going forward - to be discussed under item 5 on the agenda. * Review of outstanding action items - see https://community.icann.org/x/NwSNBQ * Other updates, if applicable 3. Legal basis for purposes and related processing activities Objective of discussion: (1) Agree on legal basis for different purposes and related processing activities a) Review legal basis memo outlining how to differentiate between Art 6.1(b) and Art 6.1(f) and discuss how this can be applied to purposes identified and related processing activities b) Agree on legal basis for purposes and related processing activities * See memo that was circulated prior to this meeting * Lawful test designed by Thomas facilitated the discussions but there was still confusion around what it means "necessary for performance of a contract" * Example found from the UK Information Commissioner's Office - processing must be necessary for the delivery of your part of the contract. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply. * Lawful test in combination with example applies to the EPDP Team purposes. Highlighted in blue is where small team came to agreement on lawful basis, those in orange, based on leadership team assessment. * For purpose A, does this just concern data for WHOIS or is it broader than that - this is focused on the data that is collected by the registrar, regardless of where it is. * Purpose C - focused on registrar communication, but this is mainly for other parties, why is that not included? If it is for other parties, the lawful basis would be 6.1(f). Add second processing activity focused on third parties (6.1(f)). May also be captured under purpose B? * May need to distinguish between what is collected and what goes into an RDDS? For example, in relation to Purpose N. Purpose N not limited to Spec 13, would also include Spec 12 gTLDs. Policy recommendations to cover the circumstances and purposes through which additional data elements are collected, even if those are not published or disclosed through RDDS. * In Purpose A, is a processing activity missing? Responding to requests from Registered Name Holder for purpose A. Should RNH be mentioned as a separate party? RNH is the data subject. * For Purpose A, transmission of registration data - why is this both 6.1(b) and 6.1(f) - isn't protecting against abuse a necessary part of the contract? * For Purpose E, isn't this also 6.1(b) as it is part of the broader requirements? Small team discussed what would present best case for success presenting this to DPAs and agreed on 6.1(f). * BC would support ICANN Org having a direct relationship with registrant to allow for 6.1(b) if this is currently prevented because ICANN does not have a direct contractual relationship with registrants. * For purpose F, why not 6.1(b)? In theory you could abolish contractual compliance and domain name registration would still work, hence 6.1(f) argument. * Need additional processing activity in M for party that files complaint and needs access to information. Needs to be further considered. * Helpful way to lay this out visually, makes it easier to understand. Groups need a bit more time to review and comment. * EPDP Team to review memo and especially link to CIO web-site. * Also note that there where disagreement may persist, this could be called out in the Initial Report as a question for which specific input is requested especially from DPAs. Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties access to this information to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Lawful Basis document, RySG to provide additional data processing steps EPDP Team to review this document and come back with feedback by Wednesday 3 October COB. Action item #3: EPDP Team to review Lawful Basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed Small team to further consider idea of ICANN having direct contract with registrants. 4. Review data elements workbook for purpose C - Enable communication or notification to the Registered Name Holder and/or their delegated parties of technical and/or administrative issues with a Registered Name (see https://community.icann.org/x/5AC8BQ) Objective of discussion: (1) Review data elements workbook for purpose C as completed by small team during LA F2F meeting (2) Agree on data elements needed for this purpose as well as responses to different questions in data elements workbook a) Review data elements workbook for purpose C b) Discuss any outstanding items / questions c) Finalize data elements workbook for purpose C * See data elements workbook for purpose C (see https://community.icann.org/x/5AC8BQ) * Mandatory fields to be collected under 6.1b, optional fields to be collected under 6.1(a) - consent. * What does optional mean? If no admin/tech contact info is provided, does it then default back to the registrant information? * If admin/tech contact info is provided, consent will need to be provided by the admin/tech contact. * If there is no reason to collect the data, would it go against the principle of data minimisation? Is option that is provided to RNH, only those that want to make use of this would opt for it, not a requirement. * In practice it is often a duplicate and no unique information is provided. * You could define two different products: 1 where the registrant acts for all contacts 2 where he / she wishes to designate additional contacts. In such case, both could be 6 I b and collection of third party that would occur based on Art. 14. * Why is making it an optional field problematic? As no one is required to do anything? Under GDPR you will still need to explain why data is collected. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. 5. Share list of outstanding issues and plan for addressing these * See planning document circulated prior to the meeting * How to sign up for small groups? Groups expected to self-organize - ideally max. 1 rep per group. Could use google doc to have an idea of attendance. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. 6. Wrap and confirm next meeting to be scheduled for Thursday 4 October at 13.00 UTC. a) Confirm action items b) Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_...> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...>. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team
I agree with Milton that we are making the policy, and we have broad discretion to do so, and I understand the desire of the Board to ensure that org isn’t improperly interjecting into the process. But I am also concerned that we could go down a path that the Board will reject. Maybe that’s my newness to the process showing. Maybe they won’t have that discretion. But if they do, I think it would be prudent for org to let us know if we are veering toward such a situation. If my concern is unfounded, please disregard. From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of Mueller, Milton L Sent: Tuesday, October 9, 2018 09:09 To: Plaut, Diane <Diane.Plaut@corsearch.com>; Thomas Rickert <epdp@gdpr.ninja>; Margie Milam <margiemilam@fb.com> Cc: gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting I am not sure I agree. I think it is up to us to make the policy, and the Board to implement it after we do. The board passed a temporary policy because of the emergency situation, they are just waiting for us to come up with a real, legitimate policy/ Board liaisons are nice to clarify certain issues, but we don’t need board approval for any of our decisions. --MM From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Plaut, Diane Sent: Tuesday, October 9, 2018 11:30 AM To: Thomas Rickert <epdp@gdpr.ninja<mailto:epdp@gdpr.ninja>>; Margie Milam <margiemilam@fb.com<mailto:margiemilam@fb.com>> Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting Hi Trang, All- I strongly support Margie and Thomas on this matter. I am a new-comer to this stage but see clearly that in this EPDP and in past working groups there has been an incredible amount of time, energy and resources put into answering questions and making thoughtful recommendations to set-up ICANN to function operationally within a legally compliant, efficient and the capacity to address modern privacy and data protection considerations and multi-stakeholder needs. To move forward and accomplish the goals needed here and for ICANN going forward, there needs to be reliable feedback and clear and open communication from ICANN Org. We all have the ultimate goal of assisting with a productive and compliant set-up of ICANN and a functioning framework for all. Sincerely, Diane Diane Plaut General Counsel and Privacy Officer [cid:image001.png@01D3CA70.18FC1D40] Direct +1 646-899-2806 diane.plaut@corsearch.com<mailto:diane.plaut@corsearch.com> 220 West 42nd Street, 11th Floor, New York, NY 10036, United States www.corsearch.com<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.corsearc...> Join Corsearch on Twitter<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com...> Linkedin<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedi...> Trademarks + Brands<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Ftrademarksan...> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241) Corsearch.USCustomerService@corsearch.com<mailto:Corsearch.USCustomerService@corsearch.com> Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession. From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Thomas Rickert <epdp@gdpr.ninja<mailto:epdp@gdpr.ninja>> Date: Tuesday, October 9, 2018 at 4:12 AM To: Margie Milam <margiemilam@fb.com<mailto:margiemilam@fb.com>> Cc: "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting Hi Trang, all, Let me support Margie’s request. It is of paramount importance to the success of this group to be able to obtain reliable feedback from ICANN Org. You might also remember that I asked Chris to get a written confirmation from ICANN Org confirming that ICANN will in fact enter into the required agreements as suggested by the policy coming out of this group. These would be a Joint Controller Agreement and Data Processing Agreements. Just imagine if we came up with recommendations that ICANN org would not be willing or able to operationalize. This would be a waist of resources and embarrassment on world stage. I would also appreciate if the Board members on our team could chime in. Thanks and kind regards, Thomas Am 09.10.2018 um 01:54 schrieb Margie Milam <margiemilam@fb.com<mailto:margiemilam@fb.com>>: Hi Trang- It is really important that ICANN Org meaningfully participate in this EPDP. If ICANN Org believes it is constrained because of the Board resolution, then please ask the Board for approval to participate. Our Board liaisons should be able to facilitate that approval for you. All the best, Margie From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Trang Nguyen <trang.nguyen@icann.org<mailto:trang.nguyen@icann.org>> Date: Thursday, October 4, 2018 at 8:28 AM To: Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting Dear All, As per action item #3 below, Dan and I as ICANN Org liaisons reviewed the draft "Lawful Basis" memo<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....> circulated on Monday. There are some areas where there is considerable change from the contents of the Temporary Specification, such as redefining and assigning owners to the "purposes", as well as the characterization of the "responsible parties" and their roles. It's understandable that the EPDP Team is considering changes from what was in the Temporary Specification as per the EPDP charter<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....>. ICANN Org however has been directed<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....> by the Board to implement the Temporary Specification. Accordingly, as liaisons from ICANN Org we are unable to convey an official ICANN position that differs from the Temporary Specification at this time. We will however continue to follow the EPDP Team's discussions carefully and supply whatever information we can to help advance the Team's discussions. Best, Trang and Dan ICANN Org Liaisons From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> Date: Tuesday, October 2, 2018 at 9:20 AM To: "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] Notes & action items from today's meeting Dear All, Please find below the notes and action items from today’s meeting. In order to facilitate the signing up for the small teams, please use the following link https://docs.google.com/document/d/1ChEYy-cZmT3qTD62-HsoVmddD96m6cbkSOv5dmAjmpY/edit?usp=sharing<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__docs.google.com_document_d_1ChEYy-2DcZmT3qTD62-2DHsoVmddD96m6cbkSOv5dmAjmpY_edit-3Fusp-3Dsharing%26d%3DDwMGaQ%26c%3D5VD0RTtNlTh3ycd41b3MUw%26r%3D_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8%26m%3DJtF_A8u6pVp4jWEAz4x6Hu2ZCsRt7Ds2ULRTS-2bKxg%26s%3DDk1S6b3UpbiFdn0iBX0PrLrYeQbnpJplhgvjJITfUX8%26e%3D&data=02%7C01%7Cmarksv%40microsoft.com%7Ce590718a9457418f709f08d62e019ec4%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636746981840614250&sdata=f5kM4VRI1NWPCp7oATSDSWUqr5WFFcmIf4kZ621Er4c%3D&reserved=0>. As a reminder, please self-organize and assign max. 1 member from each group per small team. Call details will be sent to all, but only designated members are expected to attend (view only AC will be available for others interested to follow the deliberations). Best regards, Caitlin, Berry and Marika ============= EPDP Team Meeting #16 Tuesday, 2 October 2018 Notes and Action Items High-level Notes/Actions: Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties t to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Legal Basis document, RySG to provide additional data processing steps by Wednesday 3 October COB. Action item #3: EPDP Team to review lawful basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed to further consider idea of ICANN having direct contract with registrants. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. Questions for ICANN Org from the EPDP Team: None Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.icann.org%2Fx%2F2IpHBQ&data=02%7C01%7Cmarksv%40microsoft.com%7Ce590718a9457418f709f08d62e019ec4%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636746981840614250&sdata=C6pDgg9QnN0sCT2I6q5xeOce4nFOLIgowe4aEN0YQ5s%3D&reserved=0>. 1. Roll Call & SOI Updates (5 minutes) * Attendance will be taken from Adobe Connect * Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Recap EPDP Team F2F meeting - see high level notes circulated and posted on the wiki (https://community.icann.org/x/rQarBQ<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__community.icann.org_x_rQarBQ%26d%3DDwMGaQ%26c%3D5VD0RTtNlTh3ycd41b3MUw%26r%3D_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8%26m%3DJtF_A8u6pVp4jWEAz4x6Hu2ZCsRt7Ds2ULRTS-2bKxg%26s%3DWg2hMhXv7SE1NQTE2wRZrOKssGG_VP8Or4q_bmKg3sw%26e%3D&data=02%7C01%7Cmarksv%40microsoft.com%7Ce590718a9457418f709f08d62e019ec4%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636746981840614250&sdata=MB0Ji4C5GXA2u3XyuJzSjuCnuThv%2FPNIpS%2B6TUESv%2BM%3D&reserved=0>). Feedback welcome on what worked well and what didn't. * Meeting schedule going forward - to be discussed under item 5 on the agenda. * Review of outstanding action items - see https://community.icann.org/x/NwSNBQ<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.icann.org%2Fx%2FNwSNBQ&data=02%7C01%7Cmarksv%40microsoft.com%7Ce590718a9457418f709f08d62e019ec4%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636746981840614250&sdata=KUmsPB8dkKILLtA0JwhAdM1eNX9M2YPJap2CYLDTSTY%3D&reserved=0> * Other updates, if applicable 3. Legal basis for purposes and related processing activities Objective of discussion: (1) Agree on legal basis for different purposes and related processing activities a) Review legal basis memo outlining how to differentiate between Art 6.1(b) and Art 6.1(f) and discuss how this can be applied to purposes identified and related processing activities b) Agree on legal basis for purposes and related processing activities * See memo that was circulated prior to this meeting * Lawful test designed by Thomas facilitated the discussions but there was still confusion around what it means "necessary for performance of a contract" * Example found from the UK Information Commissioner's Office - processing must be necessary for the delivery of your part of the contract. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply. * Lawful test in combination with example applies to the EPDP Team purposes. Highlighted in blue is where small team came to agreement on lawful basis, those in orange, based on leadership team assessment. * For purpose A, does this just concern data for WHOIS or is it broader than that - this is focused on the data that is collected by the registrar, regardless of where it is. * Purpose C - focused on registrar communication, but this is mainly for other parties, why is that not included? If it is for other parties, the lawful basis would be 6.1(f). Add second processing activity focused on third parties (6.1(f)). May also be captured under purpose B? * May need to distinguish between what is collected and what goes into an RDDS? For example, in relation to Purpose N. Purpose N not limited to Spec 13, would also include Spec 12 gTLDs. Policy recommendations to cover the circumstances and purposes through which additional data elements are collected, even if those are not published or disclosed through RDDS. * In Purpose A, is a processing activity missing? Responding to requests from Registered Name Holder for purpose A. Should RNH be mentioned as a separate party? RNH is the data subject. * For Purpose A, transmission of registration data - why is this both 6.1(b) and 6.1(f) - isn't protecting against abuse a necessary part of the contract? * For Purpose E, isn't this also 6.1(b) as it is part of the broader requirements? Small team discussed what would present best case for success presenting this to DPAs and agreed on 6.1(f). * BC would support ICANN Org having a direct relationship with registrant to allow for 6.1(b) if this is currently prevented because ICANN does not have a direct contractual relationship with registrants. * For purpose F, why not 6.1(b)? In theory you could abolish contractual compliance and domain name registration would still work, hence 6.1(f) argument. * Need additional processing activity in M for party that files complaint and needs access to information. Needs to be further considered. * Helpful way to lay this out visually, makes it easier to understand. Groups need a bit more time to review and comment. * EPDP Team to review memo and especially link to CIO web-site. * Also note that there where disagreement may persist, this could be called out in the Initial Report as a question for which specific input is requested especially from DPAs. Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties access to this information to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Lawful Basis document, RySG to provide additional data processing steps EPDP Team to review this document and come back with feedback by Wednesday 3 October COB. Action item #3: EPDP Team to review Lawful Basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed Small team to further consider idea of ICANN having direct contract with registrants. 4. Review data elements workbook for purpose C - Enable communication or notification to the Registered Name Holder and/or their delegated parties of technical and/or administrative issues with a Registered Name (see https://community.icann.org/x/5AC8BQ<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.icann.org%2Fx%2F5AC8BQ&data=02%7C01%7Cmarksv%40microsoft.com%7Ce590718a9457418f709f08d62e019ec4%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636746981840614250&sdata=LJzmchYnIsBPDh%2FEnFhfJwaz6cjfmQRbMxFLLRoRwX0%3D&reserved=0>) Objective of discussion: (1) Review data elements workbook for purpose C as completed by small team during LA F2F meeting (2) Agree on data elements needed for this purpose as well as responses to different questions in data elements workbook a) Review data elements workbook for purpose C b) Discuss any outstanding items / questions c) Finalize data elements workbook for purpose C * See data elements workbook for purpose C (see https://community.icann.org/x/5AC8BQ<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.icann.org%2Fx%2F5AC8BQ&data=02%7C01%7Cmarksv%40microsoft.com%7Ce590718a9457418f709f08d62e019ec4%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636746981840614250&sdata=LJzmchYnIsBPDh%2FEnFhfJwaz6cjfmQRbMxFLLRoRwX0%3D&reserved=0>) * Mandatory fields to be collected under 6.1b, optional fields to be collected under 6.1(a) - consent. * What does optional mean? If no admin/tech contact info is provided, does it then default back to the registrant information? * If admin/tech contact info is provided, consent will need to be provided by the admin/tech contact. * If there is no reason to collect the data, would it go against the principle of data minimisation? Is option that is provided to RNH, only those that want to make use of this would opt for it, not a requirement. * In practice it is often a duplicate and no unique information is provided. * You could define two different products: 1 where the registrant acts for all contacts 2 where he / she wishes to designate additional contacts. In such case, both could be 6 I b and collection of third party that would occur based on Art. 14. * Why is making it an optional field problematic? As no one is required to do anything? Under GDPR you will still need to explain why data is collected. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. 5. Share list of outstanding issues and plan for addressing these * See planning document circulated prior to the meeting * How to sign up for small groups? Groups expected to self-organize - ideally max. 1 rep per group. Could use google doc to have an idea of attendance. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. 6. Wrap and confirm next meeting to be scheduled for Thursday 4 October at 13.00 UTC. a) Confirm action items b) Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....> and visiting the GNSO Newcomer pages<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....>. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmm.icann.org%2Fmailman%2Flistinfo%2Fgnso-epdp-team&data=02%7C01%7Cmarksv%40microsoft.com%7Ce590718a9457418f709f08d62e019ec4%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636746981840614250&sdata=zfaa6Fhig0O6kfvvbtZya027JsrvoooChxYFs8Wqby8%3D&reserved=0>
During the work of the CCWG Accountability, the Board said (not once) that they would reject our recommendations based on global public interest considerations. I want to make sure we test the waters now in order to avoid a train crash later. Thomas
Am 09.10.2018 um 18:50 schrieb Mark Svancarek (CELA) <marksv@microsoft.com>:
I agree with Milton that we are making the policy, and we have broad discretion to do so, and I understand the desire of the Board to ensure that org isn’t improperly interjecting into the process.
But I am also concerned that we could go down a path that the Board will reject. Maybe that’s my newness to the process showing. Maybe they won’t have that discretion. But if they do, I think it would be prudent for org to let us know if we are veering toward such a situation.
If my concern is unfounded, please disregard.
From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org <mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Mueller, Milton L Sent: Tuesday, October 9, 2018 09:09 To: Plaut, Diane <Diane.Plaut@corsearch.com <mailto:Diane.Plaut@corsearch.com>>; Thomas Rickert <epdp@gdpr.ninja <mailto:epdp@gdpr.ninja>>; Margie Milam <margiemilam@fb.com <mailto:margiemilam@fb.com>> Cc: gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting
I am not sure I agree. I think it is up to us to make the policy, and the Board to implement it after we do. The board passed a temporary policy because of the emergency situation, they are just waiting for us to come up with a real, legitimate policy/ Board liaisons are nice to clarify certain issues, but we don’t need board approval for any of our decisions.
--MM
From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org <mailto:gnso-epdp-team-bounces@icann.org>] On Behalf Of Plaut, Diane Sent: Tuesday, October 9, 2018 11:30 AM To: Thomas Rickert <epdp@gdpr.ninja <mailto:epdp@gdpr.ninja>>; Margie Milam <margiemilam@fb.com <mailto:margiemilam@fb.com>> Cc: gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting
Hi Trang, All-
I strongly support Margie and Thomas on this matter. I am a new-comer to this stage but see clearly that in this EPDP and in past working groups there has been an incredible amount of time, energy and resources put into answering questions and making thoughtful recommendations to set-up ICANN to function operationally within a legally compliant, efficient and the capacity to address modern privacy and data protection considerations and multi-stakeholder needs. To move forward and accomplish the goals needed here and for ICANN going forward, there needs to be reliable feedback and clear and open communication from ICANN Org.
We all have the ultimate goal of assisting with a productive and compliant set-up of ICANN and a functioning framework for all.
Sincerely,
Diane
Diane Plaut General Counsel and Privacy Officer <image001.png> Direct +1 646-899-2806 > diane.plaut@corsearch.com <mailto:diane.plaut@corsearch.com> 220 West 42nd Street, 11th Floor, New York, NY 10036, United States > www.corsearch.com <https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.corsearc...> Join Corsearch on Twitter <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com...> Linkedin <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedi...> Trademarks + Brands <https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Ftrademarksan...> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241) > Corsearch.USCustomerService@corsearch.com <mailto:Corsearch.USCustomerService@corsearch.com>
Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession.
From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org <mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Thomas Rickert <epdp@gdpr.ninja <mailto:epdp@gdpr.ninja>> Date: Tuesday, October 9, 2018 at 4:12 AM To: Margie Milam <margiemilam@fb.com <mailto:margiemilam@fb.com>> Cc: "gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting
Hi Trang, all, <> Let me support Margie’s request.
It is of paramount importance to the success of this group to be able to obtain reliable feedback from ICANN Org.
You might also remember that I asked Chris to get a written confirmation from ICANN Org confirming that ICANN will in fact enter into the required agreements as suggested by the policy coming out of this group. These would be a Joint Controller Agreement and Data Processing Agreements.
Just imagine if we came up with recommendations that ICANN org would not be willing or able to operationalize. This would be a waist of resources and embarrassment on world stage.
I would also appreciate if the Board members on our team could chime in.
Thanks and kind regards, Thomas
Am 09.10.2018 um 01:54 schrieb Margie Milam <margiemilam@fb.com <mailto:margiemilam@fb.com>>:
Hi Trang-
It is really important that ICANN Org meaningfully participate in this EPDP. If ICANN Org believes it is constrained because of the Board resolution, then please ask the Board for approval to participate. Our Board liaisons should be able to facilitate that approval for you.
All the best, Margie
From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org <mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Trang Nguyen <trang.nguyen@icann.org <mailto:trang.nguyen@icann.org>> Date: Thursday, October 4, 2018 at 8:28 AM To: Marika Konings <marika.konings@icann.org <mailto:marika.konings@icann.org>>, "gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting
Dear All,
As per action item #3 below, Dan and I as ICANN Org liaisons reviewed the draft "Lawful Basis" memo <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....> circulated on Monday. There are some areas where there is considerable change from the contents of the Temporary Specification, such as redefining and assigning owners to the "purposes", as well as the characterization of the "responsible parties" and their roles.
It's understandable that the EPDP Team is considering changes from what was in the Temporary Specification as per the EPDP charter <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....>. ICANN Org however has been directed <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....> by the Board to implement the Temporary Specification. Accordingly, as liaisons from ICANN Org we are unable to convey an official ICANN position that differs from the Temporary Specification at this time. We will however continue to follow the EPDP Team's discussions carefully and supply whatever information we can to help advance the Team's discussions.
Best,
Trang and Dan ICANN Org Liaisons
From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org <mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Marika Konings <marika.konings@icann.org <mailto:marika.konings@icann.org>> Date: Tuesday, October 2, 2018 at 9:20 AM To: "gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] Notes & action items from today's meeting
Dear All,
Please find below the notes and action items from today’s meeting. In order to facilitate the signing up for the small teams, please use the following link https://docs.google.com/document/d/1ChEYy-cZmT3qTD62-HsoVmddD96m6cbkSOv5dmAj... <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....>. As a reminder, please self-organize and assign max. 1 member from each group per small team. Call details will be sent to all, but only designated members are expected to attend (view only AC will be available for others interested to follow the deliberations).
Best regards,
Caitlin, Berry and Marika
=============
EPDP Team Meeting #16 Tuesday, 2 October 2018 Notes and Action Items
High-level Notes/Actions:
Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties t to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)).
Action item #2: Regarding the Legal Basis document, RySG to provide additional data processing steps by Wednesday 3 October COB.
Action item #3: EPDP Team to review lawful basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations
Action item #4: Leadership to develop methodology to be developed to further consider idea of ICANN having direct contract with registrants.
Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important.
Action item #6: EPDP Team to review planning and schedule and share any feedback on the list.
Questions for ICANN Org from the EPDP Team: None
Notes & Action items
These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.i...>.
1. Roll Call & SOI Updates (5 minutes)
Attendance will be taken from Adobe Connect Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team.
2. Welcome and Updates from EPDP Team Chair (5 minutes) Recap EPDP Team F2F meeting - see high level notes circulated and posted on the wiki (https://community.icann.org/x/rQarBQ <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....>). Feedback welcome on what worked well and what didn't. Meeting schedule going forward - to be discussed under item 5 on the agenda. Review of outstanding action items - see https://community.icann.org/x/NwSNBQ <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.i...> Other updates, if applicable
3. Legal basis for purposes and related processing activities Objective of discussion: (1) Agree on legal basis for different purposes and related processing activities a) Review legal basis memo outlining how to differentiate between Art 6.1(b) and Art 6.1(f) and discuss how this can be applied to purposes identified and related processing activities b) Agree on legal basis for purposes and related processing activities See memo that was circulated prior to this meeting Lawful test designed by Thomas facilitated the discussions but there was still confusion around what it means "necessary for performance of a contract" Example found from the UK Information Commissioner's Office - processing must be necessary for the delivery of your part of the contract. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply. Lawful test in combination with example applies to the EPDP Team purposes. Highlighted in blue is where small team came to agreement on lawful basis, those in orange, based on leadership team assessment. For purpose A, does this just concern data for WHOIS or is it broader than that - this is focused on the data that is collected by the registrar, regardless of where it is. Purpose C - focused on registrar communication, but this is mainly for other parties, why is that not included? If it is for other parties, the lawful basis would be 6.1(f). Add second processing activity focused on third parties (6.1(f)). May also be captured under purpose B? May need to distinguish between what is collected and what goes into an RDDS? For example, in relation to Purpose N. Purpose N not limited to Spec 13, would also include Spec 12 gTLDs. Policy recommendations to cover the circumstances and purposes through which additional data elements are collected, even if those are not published or disclosed through RDDS. In Purpose A, is a processing activity missing? Responding to requests from Registered Name Holder for purpose A. Should RNH be mentioned as a separate party? RNH is the data subject. For Purpose A, transmission of registration data - why is this both 6.1(b) and 6.1(f) - isn't protecting against abuse a necessary part of the contract? For Purpose E, isn't this also 6.1(b) as it is part of the broader requirements? Small team discussed what would present best case for success presenting this to DPAs and agreed on 6.1(f). BC would support ICANN Org having a direct relationship with registrant to allow for 6.1(b) if this is currently prevented because ICANN does not have a direct contractual relationship with registrants. For purpose F, why not 6.1(b)? In theory you could abolish contractual compliance and domain name registration would still work, hence 6.1(f) argument. Need additional processing activity in M for party that files complaint and needs access to information. Needs to be further considered. Helpful way to lay this out visually, makes it easier to understand. Groups need a bit more time to review and comment. EPDP Team to review memo and especially link to CIO web-site. Also note that there where disagreement may persist, this could be called out in the Initial Report as a question for which specific input is requested especially from DPAs.
Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties access to this information to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)).
Action item #2: Regarding the Lawful Basis document, RySG to provide additional data processing steps EPDP Team to review this document and come back with feedback by Wednesday 3 October COB.
Action item #3: EPDP Team to review Lawful Basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations
Action item #4: Leadership to develop methodology to be developed Small team to further consider idea of ICANN having direct contract with registrants.
4. Review data elements workbook for purpose C - Enable communication or notification to the Registered Name Holder and/or their delegated parties of technical and/or administrative issues with a Registered Name (see https://community.icann.org/x/5AC8BQ <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.i...>) Objective of discussion: (1) Review data elements workbook for purpose C as completed by small team during LA F2F meeting (2) Agree on data elements needed for this purpose as well as responses to different questions in data elements workbook a) Review data elements workbook for purpose C b) Discuss any outstanding items / questions c) Finalize data elements workbook for purpose C See data elements workbook for purpose C (see https://community.icann.org/x/5AC8BQ <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.i...>) Mandatory fields to be collected under 6.1b, optional fields to be collected under 6.1(a) - consent. What does optional mean? If no admin/tech contact info is provided, does it then default back to the registrant information? If admin/tech contact info is provided, consent will need to be provided by the admin/tech contact. If there is no reason to collect the data, would it go against the principle of data minimisation? Is option that is provided to RNH, only those that want to make use of this would opt for it, not a requirement. In practice it is often a duplicate and no unique information is provided. You could define two different products: 1 where the registrant acts for all contacts 2 where he / she wishes to designate additional contacts. In such case, both could be 6 I b and collection of third party that would occur based on Art. 14. Why is making it an optional field problematic? As no one is required to do anything? Under GDPR you will still need to explain why data is collected.
Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important.
5. Share list of outstanding issues and plan for addressing these See planning document circulated prior to the meeting How to sign up for small groups? Groups expected to self-organize - ideally max. 1 rep per group. Could use google doc to have an idea of attendance.
Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. 6. Wrap and confirm next meeting to be scheduled for Thursday 4 October at 13.00 UTC. a) Confirm action items b) Confirm questions for ICANN Org, if any
Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org <mailto:marika.konings@icann.org>
Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....> and visiting the GNSO Newcomer pages <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....>.
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmm.icann.or...>
I agree that the processing activities as well as ICANN org feedback and input are absolutely necessary for the success of the work of the EPDP team, but to ask the board to commit to entering into agreements as suggested by the policy coming out of this group without knowing the agreements that they are going to commit to I think is impossible. Kindest Regards Hadia From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Thomas Rickert Sent: Tuesday, October 09, 2018 7:39 PM To: Mark Svancarek (CELA) Cc: gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting During the work of the CCWG Accountability, the Board said (not once) that they would reject our recommendations based on global public interest considerations. I want to make sure we test the waters now in order to avoid a train crash later. Thomas Am 09.10.2018 um 18:50 schrieb Mark Svancarek (CELA) <marksv@microsoft.com<mailto:marksv@microsoft.com>>: I agree with Milton that we are making the policy, and we have broad discretion to do so, and I understand the desire of the Board to ensure that org isn’t improperly interjecting into the process. But I am also concerned that we could go down a path that the Board will reject. Maybe that’s my newness to the process showing. Maybe they won’t have that discretion. But if they do, I think it would be prudent for org to let us know if we are veering toward such a situation. If my concern is unfounded, please disregard. From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Mueller, Milton L Sent: Tuesday, October 9, 2018 09:09 To: Plaut, Diane <Diane.Plaut@corsearch.com<mailto:Diane.Plaut@corsearch.com>>; Thomas Rickert <epdp@gdpr.ninja<mailto:epdp@gdpr.ninja>>; Margie Milam <margiemilam@fb.com<mailto:margiemilam@fb.com>> Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting I am not sure I agree. I think it is up to us to make the policy, and the Board to implement it after we do. The board passed a temporary policy because of the emergency situation, they are just waiting for us to come up with a real, legitimate policy/ Board liaisons are nice to clarify certain issues, but we don’t need board approval for any of our decisions. --MM From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Plaut, Diane Sent: Tuesday, October 9, 2018 11:30 AM To: Thomas Rickert <epdp@gdpr.ninja<mailto:epdp@gdpr.ninja>>; Margie Milam <margiemilam@fb.com<mailto:margiemilam@fb.com>> Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting Hi Trang, All- I strongly support Margie and Thomas on this matter. I am a new-comer to this stage but see clearly that in this EPDP and in past working groups there has been an incredible amount of time, energy and resources put into answering questions and making thoughtful recommendations to set-up ICANN to function operationally within a legally compliant, efficient and the capacity to address modern privacy and data protection considerations and multi-stakeholder needs. To move forward and accomplish the goals needed here and for ICANN going forward, there needs to be reliable feedback and clear and open communication from ICANN Org. We all have the ultimate goal of assisting with a productive and compliant set-up of ICANN and a functioning framework for all. Sincerely, Diane Diane Plaut General Counsel and Privacy Officer <image001.png> Direct +1 646-899-2806 diane.plaut@corsearch.com<mailto:diane.plaut@corsearch.com> 220 West 42nd Street, 11th Floor, New York, NY 10036, United States www.corsearch.com<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.corsearc...> Join Corsearch on Twitter<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com...> Linkedin<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedi...> Trademarks + Brands<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Ftrademarksan...> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241) Corsearch.USCustomerService@corsearch.com<mailto:Corsearch.USCustomerService@corsearch.com> Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession. From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Thomas Rickert <epdp@gdpr.ninja<mailto:epdp@gdpr.ninja>> Date: Tuesday, October 9, 2018 at 4:12 AM To: Margie Milam <margiemilam@fb.com<mailto:margiemilam@fb.com>> Cc: "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting Hi Trang, all, Let me support Margie’s request. It is of paramount importance to the success of this group to be able to obtain reliable feedback from ICANN Org. You might also remember that I asked Chris to get a written confirmation from ICANN Org confirming that ICANN will in fact enter into the required agreements as suggested by the policy coming out of this group. These would be a Joint Controller Agreement and Data Processing Agreements. Just imagine if we came up with recommendations that ICANN org would not be willing or able to operationalize. This would be a waist of resources and embarrassment on world stage. I would also appreciate if the Board members on our team could chime in. Thanks and kind regards, Thomas Am 09.10.2018 um 01:54 schrieb Margie Milam <margiemilam@fb.com<mailto:margiemilam@fb.com>>: Hi Trang- It is really important that ICANN Org meaningfully participate in this EPDP. If ICANN Org believes it is constrained because of the Board resolution, then please ask the Board for approval to participate. Our Board liaisons should be able to facilitate that approval for you. All the best, Margie From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Trang Nguyen <trang.nguyen@icann.org<mailto:trang.nguyen@icann.org>> Date: Thursday, October 4, 2018 at 8:28 AM To: Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting Dear All, As per action item #3 below, Dan and I as ICANN Org liaisons reviewed the draft "Lawful Basis" memo<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....> circulated on Monday. There are some areas where there is considerable change from the contents of the Temporary Specification, such as redefining and assigning owners to the "purposes", as well as the characterization of the "responsible parties" and their roles. It's understandable that the EPDP Team is considering changes from what was in the Temporary Specification as per the EPDP charter<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....>. ICANN Org however has been directed<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....> by the Board to implement the Temporary Specification. Accordingly, as liaisons from ICANN Org we are unable to convey an official ICANN position that differs from the Temporary Specification at this time. We will however continue to follow the EPDP Team's discussions carefully and supply whatever information we can to help advance the Team's discussions. Best, Trang and Dan ICANN Org Liaisons From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> Date: Tuesday, October 2, 2018 at 9:20 AM To: "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] Notes & action items from today's meeting Dear All, Please find below the notes and action items from today’s meeting. In order to facilitate the signing up for the small teams, please use the following link https://docs.google.com/document/d/1ChEYy-cZmT3qTD62-HsoVmddD96m6cbkSOv5dmAjmpY/edit?usp=sharing<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__docs.google.com_document_d_1ChEYy-2DcZmT3qTD62-2DHsoVmddD96m6cbkSOv5dmAjmpY_edit-3Fusp-3Dsharing%26d%3DDwMGaQ%26c%3D5VD0RTtNlTh3ycd41b3MUw%26r%3D_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8%26m%3DJtF_A8u6pVp4jWEAz4x6Hu2ZCsRt7Ds2ULRTS-2bKxg%26s%3DDk1S6b3UpbiFdn0iBX0PrLrYeQbnpJplhgvjJITfUX8%26e%3D&data=02%7C01%7Cmarksv%40microsoft.com%7Ce590718a9457418f709f08d62e019ec4%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636746981840614250&sdata=f5kM4VRI1NWPCp7oATSDSWUqr5WFFcmIf4kZ621Er4c%3D&reserved=0>. As a reminder, please self-organize and assign max. 1 member from each group per small team. Call details will be sent to all, but only designated members are expected to attend (view only AC will be available for others interested to follow the deliberations). Best regards, Caitlin, Berry and Marika ============= EPDP Team Meeting #16 Tuesday, 2 October 2018 Notes and Action Items High-level Notes/Actions: Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties t to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Legal Basis document, RySG to provide additional data processing steps by Wednesday 3 October COB. Action item #3: EPDP Team to review lawful basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed to further consider idea of ICANN having direct contract with registrants. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. Questions for ICANN Org from the EPDP Team: None Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.icann.org%2Fx%2F2IpHBQ&data=02%7C01%7Cmarksv%40microsoft.com%7Ce590718a9457418f709f08d62e019ec4%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636746981840614250&sdata=C6pDgg9QnN0sCT2I6q5xeOce4nFOLIgowe4aEN0YQ5s%3D&reserved=0>. 1. Roll Call & SOI Updates (5 minutes) * Attendance will be taken from Adobe Connect * Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Recap EPDP Team F2F meeting - see high level notes circulated and posted on the wiki (https://community.icann.org/x/rQarBQ<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__community.icann.org_x_rQarBQ%26d%3DDwMGaQ%26c%3D5VD0RTtNlTh3ycd41b3MUw%26r%3D_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8%26m%3DJtF_A8u6pVp4jWEAz4x6Hu2ZCsRt7Ds2ULRTS-2bKxg%26s%3DWg2hMhXv7SE1NQTE2wRZrOKssGG_VP8Or4q_bmKg3sw%26e%3D&data=02%7C01%7Cmarksv%40microsoft.com%7Ce590718a9457418f709f08d62e019ec4%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636746981840614250&sdata=MB0Ji4C5GXA2u3XyuJzSjuCnuThv%2FPNIpS%2B6TUESv%2BM%3D&reserved=0>). Feedback welcome on what worked well and what didn't. * Meeting schedule going forward - to be discussed under item 5 on the agenda. * Review of outstanding action items - see https://community.icann.org/x/NwSNBQ<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.icann.org%2Fx%2FNwSNBQ&data=02%7C01%7Cmarksv%40microsoft.com%7Ce590718a9457418f709f08d62e019ec4%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636746981840614250&sdata=KUmsPB8dkKILLtA0JwhAdM1eNX9M2YPJap2CYLDTSTY%3D&reserved=0> * Other updates, if applicable 3. Legal basis for purposes and related processing activities Objective of discussion: (1) Agree on legal basis for different purposes and related processing activities a) Review legal basis memo outlining how to differentiate between Art 6.1(b) and Art 6.1(f) and discuss how this can be applied to purposes identified and related processing activities b) Agree on legal basis for purposes and related processing activities * See memo that was circulated prior to this meeting * Lawful test designed by Thomas facilitated the discussions but there was still confusion around what it means "necessary for performance of a contract" * Example found from the UK Information Commissioner's Office - processing must be necessary for the delivery of your part of the contract. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply. * Lawful test in combination with example applies to the EPDP Team purposes. Highlighted in blue is where small team came to agreement on lawful basis, those in orange, based on leadership team assessment. * For purpose A, does this just concern data for WHOIS or is it broader than that - this is focused on the data that is collected by the registrar, regardless of where it is. * Purpose C - focused on registrar communication, but this is mainly for other parties, why is that not included? If it is for other parties, the lawful basis would be 6.1(f). Add second processing activity focused on third parties (6.1(f)). May also be captured under purpose B? * May need to distinguish between what is collected and what goes into an RDDS? For example, in relation to Purpose N. Purpose N not limited to Spec 13, would also include Spec 12 gTLDs. Policy recommendations to cover the circumstances and purposes through which additional data elements are collected, even if those are not published or disclosed through RDDS. * In Purpose A, is a processing activity missing? Responding to requests from Registered Name Holder for purpose A. Should RNH be mentioned as a separate party? RNH is the data subject. * For Purpose A, transmission of registration data - why is this both 6.1(b) and 6.1(f) - isn't protecting against abuse a necessary part of the contract? * For Purpose E, isn't this also 6.1(b) as it is part of the broader requirements? Small team discussed what would present best case for success presenting this to DPAs and agreed on 6.1(f). * BC would support ICANN Org having a direct relationship with registrant to allow for 6.1(b) if this is currently prevented because ICANN does not have a direct contractual relationship with registrants. * For purpose F, why not 6.1(b)? In theory you could abolish contractual compliance and domain name registration would still work, hence 6.1(f) argument. * Need additional processing activity in M for party that files complaint and needs access to information. Needs to be further considered. * Helpful way to lay this out visually, makes it easier to understand. Groups need a bit more time to review and comment. * EPDP Team to review memo and especially link to CIO web-site. * Also note that there where disagreement may persist, this could be called out in the Initial Report as a question for which specific input is requested especially from DPAs. Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties access to this information to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Lawful Basis document, RySG to provide additional data processing steps EPDP Team to review this document and come back with feedback by Wednesday 3 October COB. Action item #3: EPDP Team to review Lawful Basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed Small team to further consider idea of ICANN having direct contract with registrants. 4. Review data elements workbook for purpose C - Enable communication or notification to the Registered Name Holder and/or their delegated parties of technical and/or administrative issues with a Registered Name (see https://community.icann.org/x/5AC8BQ<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.icann.org%2Fx%2F5AC8BQ&data=02%7C01%7Cmarksv%40microsoft.com%7Ce590718a9457418f709f08d62e019ec4%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636746981840614250&sdata=LJzmchYnIsBPDh%2FEnFhfJwaz6cjfmQRbMxFLLRoRwX0%3D&reserved=0>) Objective of discussion: (1) Review data elements workbook for purpose C as completed by small team during LA F2F meeting (2) Agree on data elements needed for this purpose as well as responses to different questions in data elements workbook a) Review data elements workbook for purpose C b) Discuss any outstanding items / questions c) Finalize data elements workbook for purpose C * See data elements workbook for purpose C (see https://community.icann.org/x/5AC8BQ<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.icann.org%2Fx%2F5AC8BQ&data=02%7C01%7Cmarksv%40microsoft.com%7Ce590718a9457418f709f08d62e019ec4%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636746981840614250&sdata=LJzmchYnIsBPDh%2FEnFhfJwaz6cjfmQRbMxFLLRoRwX0%3D&reserved=0>) * Mandatory fields to be collected under 6.1b, optional fields to be collected under 6.1(a) - consent. * What does optional mean? If no admin/tech contact info is provided, does it then default back to the registrant information? * If admin/tech contact info is provided, consent will need to be provided by the admin/tech contact. * If there is no reason to collect the data, would it go against the principle of data minimisation? Is option that is provided to RNH, only those that want to make use of this would opt for it, not a requirement. * In practice it is often a duplicate and no unique information is provided. * You could define two different products: 1 where the registrant acts for all contacts 2 where he / she wishes to designate additional contacts. In such case, both could be 6 I b and collection of third party that would occur based on Art. 14. * Why is making it an optional field problematic? As no one is required to do anything? Under GDPR you will still need to explain why data is collected. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. 5. Share list of outstanding issues and plan for addressing these * See planning document circulated prior to the meeting * How to sign up for small groups? Groups expected to self-organize - ideally max. 1 rep per group. Could use google doc to have an idea of attendance. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. 6. Wrap and confirm next meeting to be scheduled for Thursday 4 October at 13.00 UTC. a) Confirm action items b) Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....> and visiting the GNSO Newcomer pages<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense....>. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmm.icann.org%2Fmailman%2Flistinfo%2Fgnso-epdp-team&data=02%7C01%7Cmarksv%40microsoft.com%7Ce590718a9457418f709f08d62e019ec4%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636746981840614250&sdata=zfaa6Fhig0O6kfvvbtZya027JsrvoooChxYFs8Wqby8%3D&reserved=0>
Hi Margie Thank you for raising this point. I also support your proposal. ICANN determines a great deal of how the data comprised in WHOIS records is processed, and before the temporary specification was imposed it was ICANN that required publication of WHOIS data. As James B said in a recent call, it is important that ICANN's voice is heard in the EPDP. Best wishes Emily On Tue, Oct 9, 2018 at 12:55 AM Margie Milam <margiemilam@fb.com> wrote:
Hi Trang-
It is really important that ICANN Org meaningfully participate in this EPDP. If ICANN Org believes it is constrained because of the Board resolution, then please ask the Board for approval to participate. Our Board liaisons should be able to facilitate that approval for you.
All the best,
Margie
*From: *Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of Trang Nguyen <trang.nguyen@icann.org> *Date: *Thursday, October 4, 2018 at 8:28 AM *To: *Marika Konings <marika.konings@icann.org>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> *Subject: *Re: [Gnso-epdp-team] Notes & action items from today's meeting
Dear All,
As per action item #3 below, Dan and I as ICANN Org liaisons reviewed the draft "Lawful Basis" memo <https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_dow...> circulated on Monday. There are some areas where there is considerable change from the contents of the Temporary Specification, such as redefining and assigning owners to the "purposes", as well as the characterization of the "responsible parties" and their roles.
It's understandable that the EPDP Team is considering changes from what was in the Temporary Specification as per the EPDP charter <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_sites_de...>. ICANN Org however has been directed <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resources...> by the Board to implement the Temporary Specification. Accordingly, as liaisons from ICANN Org we are unable to convey an official ICANN position that differs from the Temporary Specification at this time. We will however continue to follow the EPDP Team's discussions carefully and supply whatever information we can to help advance the Team's discussions.
Best,
Trang and Dan
ICANN Org Liaisons
*From: *Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of Marika Konings <marika.konings@icann.org> *Date: *Tuesday, October 2, 2018 at 9:20 AM *To: *"gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> *Subject: *[Gnso-epdp-team] Notes & action items from today's meeting
Dear All,
Please find below the notes and action items from today’s meeting. In order to facilitate the signing up for the small teams, please use the following link https://docs.google.com/document/d/1ChEYy-cZmT3qTD62-HsoVmddD96m6cbkSOv5dmAj... <https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_documen...>. As a reminder, please self-organize and assign max. 1 member from each group per small team. Call details will be sent to all, but only designated members are expected to attend (view only AC will be available for others interested to follow the deliberations).
Best regards,
Caitlin, Berry and Marika
=============
EPDP Team Meeting #16
Tuesday, 2 October 2018
Notes and Action Items
*High-level Notes/Actions:*
*Action item #1: *add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties t to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)).
*Action item #2: *Regarding the Legal Basis document, RySG to provide additional data processing steps by Wednesday 3 October COB.
*Action item #3: *EPDP Team to review lawful basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations
*Action item #4: *Leadership to develop methodology to be developed to further consider idea of ICANN having direct contract with registrants.
*Action item #5: *Alan Greenberg to write statement why optional provision of admin/tech contact is important.
*Action item #6: *EPDP Team to review planning and schedule and share any feedback on the list.
*Questions for ICANN Org from the EPDP Team:*
None
*Notes & Action items*
*These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ <https://community.icann.org/x/2IpHBQ>.*
*1. Roll Call & SOI Updates (5 minutes)*
- Attendance will be taken from Adobe Connect - Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. - Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team.
*2. Welcome and Updates from EPDP Team Chair (5 minutes)*
- Recap EPDP Team F2F meeting - see high level notes circulated and posted on the wiki (https://community.icann.org/x/rQarBQ <https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_r...>). Feedback welcome on what worked well and what didn't. - Meeting schedule going forward - to be discussed under item 5 on the agenda. - Review of outstanding action items - see https://community.icann.org/x/NwSNBQ - Other updates, if applicable
*3. Legal basis for purposes and related processing activities*
Objective of discussion:
(1) Agree on legal basis for different purposes and related processing activities
a) Review legal basis memo outlining how to differentiate between Art 6.1(b) and Art 6.1(f) and discuss how this can be applied to purposes identified and related processing activities
b) Agree on legal basis for purposes and related processing activities
- See memo that was circulated prior to this meeting - Lawful test designed by Thomas facilitated the discussions but there was still confusion around what it means "necessary for performance of a contract" - Example found from the UK Information Commissioner's Office - processing must be necessary for the delivery of your part of the contract. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply. - Lawful test in combination with example applies to the EPDP Team purposes. Highlighted in blue is where small team came to agreement on lawful basis, those in orange, based on leadership team assessment. - For purpose A, does this just concern data for WHOIS or is it broader than that - this is focused on the data that is collected by the registrar, regardless of where it is. - Purpose C - focused on registrar communication, but this is mainly for other parties, why is that not included? If it is for other parties, the lawful basis would be 6.1(f). Add second processing activity focused on third parties (6.1(f)). May also be captured under purpose B? - May need to distinguish between what is collected and what goes into an RDDS? For example, in relation to Purpose N. Purpose N not limited to Spec 13, would also include Spec 12 gTLDs. Policy recommendations to cover the circumstances and purposes through which additional data elements are collected, even if those are not published or disclosed through RDDS. - In Purpose A, is a processing activity missing? Responding to requests from Registered Name Holder for purpose A. Should RNH be mentioned as a separate party? RNH is the data subject. - For Purpose A, transmission of registration data - why is this both 6.1(b) and 6.1(f) - isn't protecting against abuse a necessary part of the contract? - For Purpose E, isn't this also 6.1(b) as it is part of the broader requirements? Small team discussed what would present best case for success presenting this to DPAs and agreed on 6.1(f). - BC would support ICANN Org having a direct relationship with registrant to allow for 6.1(b) if this is currently prevented because ICANN does not have a direct contractual relationship with registrants. - For purpose F, why not 6.1(b)? In theory you could abolish contractual compliance and domain name registration would still work, hence 6.1(f) argument. - Need additional processing activity in M for party that files complaint and needs access to information. Needs to be further considered. - Helpful way to lay this out visually, makes it easier to understand. Groups need a bit more time to review and comment. - EPDP Team to review memo and especially link to CIO web-site. - Also note that there where disagreement may persist, this could be called out in the Initial Report as a question for which specific input is requested especially from DPAs.
*Action item #1: *add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties access to this information to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)).
*Action item #2: *Regarding the Lawful Basis document, RySG to provide additional data processing steps EPDP Team to review this document and come back with feedback by Wednesday 3 October COB.
*Action item #3: *EPDP Team to review Lawful Basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations
*Action item #4: *Leadership to develop methodology to be developed Small team to further consider idea of ICANN having direct contract with registrants.
*4. Review data elements workbook for purpose C - Enable communication or notification to the Registered Name Holder and/or their delegated parties of technical and/or administrative issues with a Registered Name (see https://community.icann.org/x/5AC8BQ <https://community.icann.org/x/5AC8BQ>)*
Objective of discussion:
(1) Review data elements workbook for purpose C as completed by small team during LA F2F meeting
(2) Agree on data elements needed for this purpose as well as responses to different questions in data elements workbook
a) Review data elements workbook for purpose C
b) Discuss any outstanding items / questions
c) Finalize data elements workbook for purpose C
- See data elements workbook for purpose C (see https://community.icann.org/x/5AC8BQ) - Mandatory fields to be collected under 6.1b, optional fields to be collected under 6.1(a) - consent. - What does optional mean? If no admin/tech contact info is provided, does it then default back to the registrant information? - If admin/tech contact info is provided, consent will need to be provided by the admin/tech contact. - If there is no reason to collect the data, would it go against the principle of data minimisation? Is option that is provided to RNH, only those that want to make use of this would opt for it, not a requirement. - In practice it is often a duplicate and no unique information is provided. - You could define two different products: 1 where the registrant acts for all contacts 2 where he / she wishes to designate additional contacts. In such case, both could be 6 I b and collection of third party that would occur based on Art. 14. - Why is making it an optional field problematic? As no one is required to do anything? Under GDPR you will still need to explain why data is collected.
*Action item #5: *Alan Greenberg to write statement why optional provision of admin/tech contact is important.
*5. Share list of outstanding issues and plan for addressing these*
- See planning document circulated prior to the meeting - How to sign up for small groups? Groups expected to self-organize - ideally max. 1 rep per group. Could use google doc to have an idea of attendance.
*Action item #6: *EPDP Team to review planning and schedule and share any feedback on the list.
*6. Wrap and confirm next meeting to be scheduled for Thursday 4 October at 13.00 UTC.*
a) Confirm action items
b) Confirm questions for ICANN Org, if any
*Marika Konings*
*Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) *
*Email: **marika.konings@icann.org* <marika.konings@icann.org>
*Follow the GNSO via Twitter @ICANN_GNSO*
*Find out more about the GNSO by taking our **interactive courses* <https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_gnso&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=7_PQAir-9nJQ2uB2cWiTDDDo5Hfy5HL9rSTe65iXLVM&m=5DXgId95wrCsHi--pxTiJD7bMB9r-T5ytCn7od3CF2Q&s=Cg5uQf0yAfw-qlFZ0WNBfsLmmtBNUiH0SuI6Vg-gXBQ&e=>* and visiting the **GNSO Newcomer pages* <https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...> *. *
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
-- Emily Taylor CEO, Oxford Information Labs *MA (Cantab), Solicitor (non-practising), MBA, * *A**ssociate Fellow, Chatham House; Editor, Journal of Cyber Policy* Lincoln House, Pony Road, Oxford OX4 2RD | T: 01865 582885 E: emily.taylor@oxil.co.uk | D: 01865 582811 | M: +44 7540 049322 <http://explore.tandfonline.com/cfp/pgas/rcyb-cfp-2017> Registered office: Lincoln House, 4 Pony Road, Oxford OX4 2RD. Registered in England and Wales No. 4520925. VAT No. 799526263 .
Hi Margie and all, I totally agree that ICANN org voice is required and essential for the success of the work of the EPDP team Kindest Regards Hadia From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Emily Taylor Sent: Tuesday, October 09, 2018 10:37 AM To: Margie Milam Cc: EPDP Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting Hi Margie Thank you for raising this point. I also support your proposal. ICANN determines a great deal of how the data comprised in WHOIS records is processed, and before the temporary specification was imposed it was ICANN that required publication of WHOIS data. As James B said in a recent call, it is important that ICANN's voice is heard in the EPDP. Best wishes Emily On Tue, Oct 9, 2018 at 12:55 AM Margie Milam <margiemilam@fb.com<mailto:margiemilam@fb.com>> wrote: Hi Trang- It is really important that ICANN Org meaningfully participate in this EPDP. If ICANN Org believes it is constrained because of the Board resolution, then please ask the Board for approval to participate. Our Board liaisons should be able to facilitate that approval for you. All the best, Margie From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Trang Nguyen <trang.nguyen@icann.org<mailto:trang.nguyen@icann.org>> Date: Thursday, October 4, 2018 at 8:28 AM To: Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] Notes & action items from today's meeting Dear All, As per action item #3 below, Dan and I as ICANN Org liaisons reviewed the draft "Lawful Basis" memo<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_dow...> circulated on Monday. There are some areas where there is considerable change from the contents of the Temporary Specification, such as redefining and assigning owners to the "purposes", as well as the characterization of the "responsible parties" and their roles. It's understandable that the EPDP Team is considering changes from what was in the Temporary Specification as per the EPDP charter<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_sites_de...>. ICANN Org however has been directed<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resources...> by the Board to implement the Temporary Specification. Accordingly, as liaisons from ICANN Org we are unable to convey an official ICANN position that differs from the Temporary Specification at this time. We will however continue to follow the EPDP Team's discussions carefully and supply whatever information we can to help advance the Team's discussions. Best, Trang and Dan ICANN Org Liaisons From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> Date: Tuesday, October 2, 2018 at 9:20 AM To: "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: [Gnso-epdp-team] Notes & action items from today's meeting Dear All, Please find below the notes and action items from today’s meeting. In order to facilitate the signing up for the small teams, please use the following link https://docs.google.com/document/d/1ChEYy-cZmT3qTD62-HsoVmddD96m6cbkSOv5dmAjmpY/edit?usp=sharing<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_document_d_1ChEYy-2DcZmT3qTD62-2DHsoVmddD96m6cbkSOv5dmAjmpY_edit-3Fusp-3Dsharing&d=DwMGaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8&m=JtF_A8u6pVp4jWEAz4x6Hu2ZCsRt7Ds2ULRTS-2bKxg&s=Dk1S6b3UpbiFdn0iBX0PrLrYeQbnpJplhgvjJITfUX8&e=>. As a reminder, please self-organize and assign max. 1 member from each group per small team. Call details will be sent to all, but only designated members are expected to attend (view only AC will be available for others interested to follow the deliberations). Best regards, Caitlin, Berry and Marika ============= EPDP Team Meeting #16 Tuesday, 2 October 2018 Notes and Action Items High-level Notes/Actions: Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties t to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Legal Basis document, RySG to provide additional data processing steps by Wednesday 3 October COB. Action item #3: EPDP Team to review lawful basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed to further consider idea of ICANN having direct contract with registrants. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. Questions for ICANN Org from the EPDP Team: None Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/2IpHBQ. 1. Roll Call & SOI Updates (5 minutes) * Attendance will be taken from Adobe Connect * Please remember to mute your microphones when not speaking, and state your name before speaking for transcription purposes. * Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Recap EPDP Team F2F meeting - see high level notes circulated and posted on the wiki (https://community.icann.org/x/rQarBQ<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_rQarBQ&d=DwMGaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8&m=JtF_A8u6pVp4jWEAz4x6Hu2ZCsRt7Ds2ULRTS-2bKxg&s=Wg2hMhXv7SE1NQTE2wRZrOKssGG_VP8Or4q_bmKg3sw&e=>). Feedback welcome on what worked well and what didn't. * Meeting schedule going forward - to be discussed under item 5 on the agenda. * Review of outstanding action items - see https://community.icann.org/x/NwSNBQ * Other updates, if applicable 3. Legal basis for purposes and related processing activities Objective of discussion: (1) Agree on legal basis for different purposes and related processing activities a) Review legal basis memo outlining how to differentiate between Art 6.1(b) and Art 6.1(f) and discuss how this can be applied to purposes identified and related processing activities b) Agree on legal basis for purposes and related processing activities * See memo that was circulated prior to this meeting * Lawful test designed by Thomas facilitated the discussions but there was still confusion around what it means "necessary for performance of a contract" * Example found from the UK Information Commissioner's Office - processing must be necessary for the delivery of your part of the contract. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply. * Lawful test in combination with example applies to the EPDP Team purposes. Highlighted in blue is where small team came to agreement on lawful basis, those in orange, based on leadership team assessment. * For purpose A, does this just concern data for WHOIS or is it broader than that - this is focused on the data that is collected by the registrar, regardless of where it is. * Purpose C - focused on registrar communication, but this is mainly for other parties, why is that not included? If it is for other parties, the lawful basis would be 6.1(f). Add second processing activity focused on third parties (6.1(f)). May also be captured under purpose B? * May need to distinguish between what is collected and what goes into an RDDS? For example, in relation to Purpose N. Purpose N not limited to Spec 13, would also include Spec 12 gTLDs. Policy recommendations to cover the circumstances and purposes through which additional data elements are collected, even if those are not published or disclosed through RDDS. * In Purpose A, is a processing activity missing? Responding to requests from Registered Name Holder for purpose A. Should RNH be mentioned as a separate party? RNH is the data subject. * For Purpose A, transmission of registration data - why is this both 6.1(b) and 6.1(f) - isn't protecting against abuse a necessary part of the contract? * For Purpose E, isn't this also 6.1(b) as it is part of the broader requirements? Small team discussed what would present best case for success presenting this to DPAs and agreed on 6.1(f). * BC would support ICANN Org having a direct relationship with registrant to allow for 6.1(b) if this is currently prevented because ICANN does not have a direct contractual relationship with registrants. * For purpose F, why not 6.1(b)? In theory you could abolish contractual compliance and domain name registration would still work, hence 6.1(f) argument. * Need additional processing activity in M for party that files complaint and needs access to information. Needs to be further considered. * Helpful way to lay this out visually, makes it easier to understand. Groups need a bit more time to review and comment. * EPDP Team to review memo and especially link to CIO web-site. * Also note that there where disagreement may persist, this could be called out in the Initial Report as a question for which specific input is requested especially from DPAs. Action item #1: add to Purpose C a second processing activity that is focused on disclosure of technical contacts to third parties access to this information to communicate or notify RNH of technical and/or administrative issues (third parties 6.1(f)). Action item #2: Regarding the Lawful Basis document, RySG to provide additional data processing steps EPDP Team to review this document and come back with feedback by Wednesday 3 October COB. Action item #3: EPDP Team to review Lawful Basis memo and proposed designations for each purpose and processing activity and communicate by Wednesday COB any objections to the proposed designations Action item #4: Leadership to develop methodology to be developed Small team to further consider idea of ICANN having direct contract with registrants. 4. Review data elements workbook for purpose C - Enable communication or notification to the Registered Name Holder and/or their delegated parties of technical and/or administrative issues with a Registered Name (see https://community.icann.org/x/5AC8BQ) Objective of discussion: (1) Review data elements workbook for purpose C as completed by small team during LA F2F meeting (2) Agree on data elements needed for this purpose as well as responses to different questions in data elements workbook a) Review data elements workbook for purpose C b) Discuss any outstanding items / questions c) Finalize data elements workbook for purpose C * See data elements workbook for purpose C (see https://community.icann.org/x/5AC8BQ) * Mandatory fields to be collected under 6.1b, optional fields to be collected under 6.1(a) - consent. * What does optional mean? If no admin/tech contact info is provided, does it then default back to the registrant information? * If admin/tech contact info is provided, consent will need to be provided by the admin/tech contact. * If there is no reason to collect the data, would it go against the principle of data minimisation? Is option that is provided to RNH, only those that want to make use of this would opt for it, not a requirement. * In practice it is often a duplicate and no unique information is provided. * You could define two different products: 1 where the registrant acts for all contacts 2 where he / she wishes to designate additional contacts. In such case, both could be 6 I b and collection of third party that would occur based on Art. 14. * Why is making it an optional field problematic? As no one is required to do anything? Under GDPR you will still need to explain why data is collected. Action item #5: Alan Greenberg to write statement why optional provision of admin/tech contact is important. 5. Share list of outstanding issues and plan for addressing these * See planning document circulated prior to the meeting * How to sign up for small groups? Groups expected to self-organize - ideally max. 1 rep per group. Could use google doc to have an idea of attendance. Action item #6: EPDP Team to review planning and schedule and share any feedback on the list. 6. Wrap and confirm next meeting to be scheduled for Thursday 4 October at 13.00 UTC. a) Confirm action items b) Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_...> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...>. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team -- Emily Taylor CEO, Oxford Information Labs MA (Cantab), Solicitor (non-practising), MBA, Associate Fellow, Chatham House; Editor, Journal of Cyber Policy Lincoln House, Pony Road, Oxford OX4 2RD | T: 01865 582885 E: emily.taylor@oxil.co.uk<mailto:emily.taylor@oxil.co.uk> | D: 01865 582811 | M: +44 7540 049322 [https://drive.google.com/a/oxil.co.uk/uc?id=1-3eDLYPfLpkj30Jc34NcbkD1xt8NQpU8&export=download][https://docs.google.com/a/oxil.co.uk/uc?id=0B7sS_6djDxsHNm92d21jM21HMDQ&export=download]<http://explore.tandfonline.com/cfp/pgas/rcyb-cfp-2017> Registered office: Lincoln House, 4 Pony Road, Oxford OX4 2RD. Registered in England and Wales No. 4520925. VAT No. 799526263 .
participants (8)
-
Emily Taylor -
Hadia Abdelsalam Mokhtar EL miniawi -
Margie Milam -
Mark Svancarek (CELA) -
Mueller, Milton L -
Plaut, Diane -
Thomas Rickert -
Trang Nguyen