Fwd: Responses to EPDP Questions
Dear All, Please find below additional responses from ICANN Org to a number of outstanding questions. We’ll get these posted shortly on the related wiki page. Best regards, Caitlin, Berry and Marika ————————————— The EPDP Team previously requested a summary of ICANN org’s contacts and engagements with the EPDP and DPAs. ICANN org provided a response, which is provided again below for reference: QUESTION: Can ICANN summarize in some searchable form the contacts and engagements with the EDPB and/or other DPAs in relation to the Temporary Specification for gTLD Registration Data? RESPONSE: ICANN org has been open and transparent with our engagements with the EDPB and DPAs. All of the formal written communications from EDPB and DPAs are published on ICANN correspondence. In addition, we’ve had informal verbal conversations with the EDPB and DPAs to educate, inform, and ask for guidance. Summaries of those informal conversations are published in blogs. To assist the EPDP Team in its work, ICANN org will provide the EPDP Team with a compiled list of correspondence received and blogs published thus far, including the topic of each correspondence/blog. As follow-up to the above response, attached is a summary of correspondence between ICANN org and the EPDP/DPAs, as well as announcements and blogs relating to ICANN org’s GDPR-related efforts. The document is marked as draft so that the EPDP Team can review and provide suggestions for re-organization or re-structuring of the content to best meet the EPDP Team’s needs. QUESTION: For which ICANN policies is admin/tech contact information currently a required data element and/or referenced in the policy? RESPONSE: Administrative and technical contact information is referenced in the following ICANN policies and procedures: * Registry Registration Data Directory Services Consistent Labeling and Display Policy<https://www.icann.org/resources/pages/rdds-labeling-policy-2017-02-01-en>. Output requirements for administrative and technical contact information. * Thick WHOIS Transition Policy for .COM, .NET, .JOBS<https://www.icann.org/resources/pages/thick-whois-transition-policy-2017-02-...>. Guidance to registry operators for handling output of administrative and technical contact information where no data exists in the SRS during the period when registrars begin sending Thick WHOIS data to registry operators for all new registrations. * Rules for Uniform Domain Name Dispute Resolution Policy<https://www.icann.org/resources/pages/udrp-rules-2015-03-11-en>. Notifications of complaints include administrative and technical contacts information. * WHOIS Data Reminder Policy<https://www.icann.org/en/resources/registrars/consensus-policies/wdrp>. WDRP notices may be presented to the registrant either directly or through the administrative contact. * Transfer Policy<https://www.icann.org/resources/pages/transfer-policy-2016-06-01-en>. Administrative contact along with the registered name holder have the authority to approve or deny a transfer request. Because of this role, the administrative contact is referenced in parts of the transfer process as well as in the Registrar Transfer Dispute Resolution Policy. * Uniform Rapid Suspension System (URS) Rules<http://newgtlds.icann.org/en/applicants/urs/rules-28jun13-en.pdf>. Notifications of complaints include administrative and technical contacts information. QUESTION: We have spent most of this meeting exploring the role of compliance at ICANN, in order to support a proposal that ICANN has an implicit contract with the registrant and that therefore 6 1 b applies as a grounds for processing. This would also facilitate ICANN operating a UAM on behalf of those who want the data. It might also explain Goran’s initiative in seeking some kind of recognition by EU authorities that ICANN has a kind of quasi-regulator status, as the authority vested with the responsibility to manage the DNS. Given that all of this is outside the current configuration of ICANN as data controller, which would be more clear had we done a DPIA and had we adequate data maps to work with….can we either get back to our Charter questions that we were mandated to address by the GNSO, or get a full explanation of what is going on and why we continue to be focused on the access question. RESPONSE: This request appears to be directed at the EPDP Team and not ICANN org as ICANN org does not dictate the direction of the EPDP Team’s discussion. QUESTION: Why hasn’t a Data Protection Impact Assessment been carried out to clarify data flows and ICANN’s relationship with the data subject in light of its acknowledged role as a joint controller and Article 35 of the GDPR? RESPONSE: This question was also asked during the Data Protection/Privacy Update Webinar hosted by ICANN org on 8 October 2018. John Jeffrey, ICANN’s General Counsel and Secretary provided the following response: “This is something that has been considered since the very beginning. One of the issues is when to do that in a way that is most timely and useful and how to do that. We continue to evolve the thinking of how the interpretation of GDPR applies to WHOIS. We have a number of questions which have been addressed directly to the DPAs and the EDPB and we’ve have an ongoing discussion with the EC about how to interpret the GDPR. We believe that those are a better format at this point than doing the assessment, but we continue to evaluate whether that assessment would be the right thing to do and when.” The presentation for the webinar is posted here<https://www.icann.org/en/system/files/files/presentation-data-protection-pri...>, and the Adobe Connect recording is here<https://participate.icann.org/p29vt2uxodx/>. The question and response start at 0:27:00 in the Adobe Connect recording.
Hi Marika, thanks for sharing this. Not sure how others read the answers, but I think that the rationale for not doing a DPIA is not satisfactory. I do not see any reason why a DPIA cannot be carried out. It would be hugely beneficial to our group to inform the balancing of rights discussions we will need to have. I have two more follow-up question we might want to ask, if the EPDP team agrees. 1. Has ICANN org commissioned any legal assessment or carried out legal assessments internally with respect to registration data? If so, can such documents please be shared with the EPDP team? 2. We understand that ICANN has not yet established a record of processing activities. ICANN is required to have such document, see Art. 30 GDPR. For the work of our group, it would be very helpful to obtain the record of processing activities to the extent that registration data is concerned. Thanks and kind regards, Thomas
Am 09.10.2018 um 05:17 schrieb Marika Konings <marika.konings@icann.org>:
Dear All,
Please find below additional responses from ICANN Org to a number of outstanding questions. We’ll get these posted shortly on the related wiki page.
Best regards,
Caitlin, Berry and Marika
—————————————
The EPDP Team previously requested a summary of ICANN org’s contacts and engagements with the EPDP and DPAs. ICANN org provided a response, which is provided again below for reference:
QUESTION: Can ICANN summarize in some searchable form the contacts and engagements with the EDPB and/or other DPAs in relation to the Temporary Specification for gTLD Registration Data?
RESPONSE: ICANN org has been open and transparent with our engagements with the EDPB and DPAs. All of the formal written communications from EDPB and DPAs are published on ICANN correspondence. In addition, we’ve had informal verbal conversations with the EDPB and DPAs to educate, inform, and ask for guidance. Summaries of those informal conversations are published in blogs. To assist the EPDP Team in its work, ICANN org will provide the EPDP Team with a compiled list of correspondence received and blogs published thus far, including the topic of each correspondence/blog.
As follow-up to the above response, attached is a summary of correspondence between ICANN org and the EPDP/DPAs, as well as announcements and blogs relating to ICANN org’s GDPR-related efforts. The document is marked as draft so that the EPDP Team can review and provide suggestions for re-organization or re-structuring of the content to best meet the EPDP Team’s needs.
QUESTION: For which ICANN policies is admin/tech contact information currently a required data element and/or referenced in the policy?
RESPONSE: Administrative and technical contact information is referenced in the following ICANN policies and procedures:
Registry Registration Data Directory Services Consistent Labeling and Display Policy <https://www.icann.org/resources/pages/rdds-labeling-policy-2017-02-01-en>. Output requirements for administrative and technical contact information. Thick WHOIS Transition Policy for .COM, .NET, .JOBS <https://www.icann.org/resources/pages/thick-whois-transition-policy-2017-02-...>. Guidance to registry operators for handling output of administrative and technical contact information where no data exists in the SRS during the period when registrars begin sending Thick WHOIS data to registry operators for all new registrations. Rules for Uniform Domain Name Dispute Resolution Policy <https://www.icann.org/resources/pages/udrp-rules-2015-03-11-en>. Notifications of complaints include administrative and technical contacts information. WHOIS Data Reminder Policy <https://www.icann.org/en/resources/registrars/consensus-policies/wdrp>. WDRP notices may be presented to the registrant either directly or through the administrative contact. Transfer Policy <https://www.icann.org/resources/pages/transfer-policy-2016-06-01-en>. Administrative contact along with the registered name holder have the authority to approve or deny a transfer request. Because of this role, the administrative contact is referenced in parts of the transfer process as well as in the Registrar Transfer Dispute Resolution Policy. Uniform Rapid Suspension System (URS) Rules <http://newgtlds.icann.org/en/applicants/urs/rules-28jun13-en.pdf>. Notifications of complaints include administrative and technical contacts information.
QUESTION: We have spent most of this meeting exploring the role of compliance at ICANN, in order to support a proposal that ICANN has an implicit contract with the registrant and that therefore 6 1 b applies as a grounds for processing. This would also facilitate ICANN operating a UAM on behalf of those who want the data. It might also explain Goran’s initiative in seeking some kind of recognition by EU authorities that ICANN has a kind of quasi-regulator status, as the authority vested with the responsibility to manage the DNS. Given that all of this is outside the current configuration of ICANN as data controller, which would be more clear had we done a DPIA and had we adequate data maps to work with….can we either get back to our Charter questions that we were mandated to address by the GNSO, or get a full explanation of what is going on and why we continue to be focused on the access question.
RESPONSE: This request appears to be directed at the EPDP Team and not ICANN org as ICANN org does not dictate the direction of the EPDP Team’s discussion.
QUESTION: Why hasn’t a Data Protection Impact Assessment been carried out to clarify data flows and ICANN’s relationship with the data subject in light of its acknowledged role as a joint controller and Article 35 of the GDPR?
RESPONSE: This question was also asked during the Data Protection/Privacy Update Webinar hosted by ICANN org on 8 October 2018. John Jeffrey, ICANN’s General Counsel and Secretary provided the following response:
“This is something that has been considered since the very beginning. One of the issues is when to do that in a way that is most timely and useful and how to do that. We continue to evolve the thinking of how the interpretation of GDPR applies to WHOIS. We have a number of questions which have been addressed directly to the DPAs and the EDPB and we’ve have an ongoing discussion with the EC about how to interpret the GDPR. We believe that those are a better format at this point than doing the assessment, but we continue to evaluate whether that assessment would be the right thing to do and when.”
The presentation for the webinar is posted here <https://www.icann.org/en/system/files/files/presentation-data-protection-pri...>, and the Adobe Connect recording is here <https://participate.icann.org/p29vt2uxodx/>. The question and response start at 0:27:00 in the Adobe Connect recording.
<DPA Advice Summary-DRAFT.xlsx> _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team>
I support Thomas's questions. ICANN org and the CEO continue repeating the narrative that they are in need of legal clarity but their only focus seems to be on access to personal data of the domain name registrants. We need clarity about the risks that ICANN data processing requirements pose for domain name registrants. ICANN org has been receiving some very good advice from the authorities they mention. However, whenever the advice would likely lead to not violating domain name registrants privacy, ICANN has comfortably ignored it or even challenged it! ICANN's reluctance to accept legal clarity when it's provided with one (both by EDPB and the German court) and lack of respect for the privacy rights of domain name registrants are just evident. the ICANN "community" has never had consensus over prioritization and urgency of access to domain name registrants personal information to the third parties. Only some groups' priority is to have access to personal information of domain name registrants. Other groups priorities are: protecting registrants personal information and compliance with data protection laws! ICANN org insistence to ask questions solely about access shows its bias and nothing more. When are we going to have webinars and discussions about mitigating risks that can be posed to domain name registrants? ICANN needs to be working on another document called: A Unified Data Protection Model for Domain Name Registrants. How about seeking legal and policy clarity on that! Farzaneh On Tue, Oct 9, 2018 at 2:29 AM Thomas Rickert <epdp@gdpr.ninja> wrote:
Hi Marika, thanks for sharing this.
Not sure how others read the answers, but I think that the rationale for not doing a DPIA is not satisfactory. I do not see any reason why a DPIA cannot be carried out. It would be hugely beneficial to our group to inform the balancing of rights discussions we will need to have.
I have two more follow-up question we might want to ask, if the EPDP team agrees.
1. Has ICANN org commissioned any legal assessment or carried out legal assessments internally with respect to registration data? If so, can such documents please be shared with the EPDP team?
2. We understand that ICANN has not yet established a record of processing activities. ICANN is required to have such document, see Art. 30 GDPR. For the work of our group, it would be very helpful to obtain the record of processing activities to the extent that registration data is concerned.
Thanks and kind regards, Thomas
Am 09.10.2018 um 05:17 schrieb Marika Konings <marika.konings@icann.org>:
Dear All,
Please find below additional responses from ICANN Org to a number of outstanding questions. We’ll get these posted shortly on the related wiki page.
Best regards,
Caitlin, Berry and Marika
—————————————
The EPDP Team previously requested a summary of ICANN org’s contacts and engagements with the EPDP and DPAs. ICANN org provided a response, which is provided again below for reference:
QUESTION: Can ICANN summarize in some searchable form the contacts and engagements with the EDPB and/or other DPAs in relation to the Temporary Specification for gTLD Registration Data?
RESPONSE: ICANN org has been open and transparent with our engagements with the EDPB and DPAs. All of the formal written communications from EDPB and DPAs are published on ICANN correspondence. In addition, we’ve had informal verbal conversations with the EDPB and DPAs to educate, inform, and ask for guidance. Summaries of those informal conversations are published in blogs. To assist the EPDP Team in its work, ICANN org will provide the EPDP Team with a compiled list of correspondence received and blogs published thus far, including the topic of each correspondence/blog.
As follow-up to the above response, attached is a summary of correspondence between ICANN org and the EPDP/DPAs, as well as announcements and blogs relating to ICANN org’s GDPR-related efforts. The document is marked as draft so that the EPDP Team can review and provide suggestions for re-organization or re-structuring of the content to best meet the EPDP Team’s needs.
QUESTION: For which ICANN policies is admin/tech contact information currently a required data element and/or referenced in the policy?
RESPONSE: Administrative and technical contact information is referenced in the following ICANN policies and procedures:
- Registry Registration Data Directory Services Consistent Labeling and Display Policy <https://www.icann.org/resources/pages/rdds-labeling-policy-2017-02-01-en>. Output requirements for administrative and technical contact information. - Thick WHOIS Transition Policy for .COM, .NET, .JOBS <https://www.icann.org/resources/pages/thick-whois-transition-policy-2017-02-...>. Guidance to registry operators for handling output of administrative and technical contact information where no data exists in the SRS during the period when registrars begin sending Thick WHOIS data to registry operators for all new registrations. - Rules for Uniform Domain Name Dispute Resolution Policy <https://www.icann.org/resources/pages/udrp-rules-2015-03-11-en>. Notifications of complaints include administrative and technical contacts information. - WHOIS Data Reminder Policy <https://www.icann.org/en/resources/registrars/consensus-policies/wdrp>. WDRP notices may be presented to the registrant either directly or through the administrative contact. - Transfer Policy <https://www.icann.org/resources/pages/transfer-policy-2016-06-01-en>. Administrative contact along with the registered name holder have the authority to approve or deny a transfer request. Because of this role, the administrative contact is referenced in parts of the transfer process as well as in the Registrar Transfer Dispute Resolution Policy. - Uniform Rapid Suspension System (URS) Rules <http://newgtlds.icann.org/en/applicants/urs/rules-28jun13-en.pdf>. Notifications of complaints include administrative and technical contacts information.
QUESTION: We have spent most of this meeting exploring the role of compliance at ICANN, in order to support a proposal that ICANN has an implicit contract with the registrant and that therefore 6 1 b applies as a grounds for processing. This would also facilitate ICANN operating a UAM on behalf of those who want the data. It might also explain Goran’s initiative in seeking some kind of recognition by EU authorities that ICANN has a kind of quasi-regulator status, as the authority vested with the responsibility to manage the DNS. Given that all of this is outside the current configuration of ICANN as data controller, which would be more clear had we done a DPIA and had we adequate data maps to work with….can we either get back to our Charter questions that we were mandated to address by the GNSO, or get a full explanation of what is going on and why we continue to be focused on the access question.
RESPONSE: This request appears to be directed at the EPDP Team and not ICANN org as ICANN org does not dictate the direction of the EPDP Team’s discussion.
QUESTION: Why hasn’t a Data Protection Impact Assessment been carried out to clarify data flows and ICANN’s relationship with the data subject in light of its acknowledged role as a joint controller and Article 35 of the GDPR?
RESPONSE: This question was also asked during the Data Protection/Privacy Update Webinar hosted by ICANN org on 8 October 2018. John Jeffrey, ICANN’s General Counsel and Secretary provided the following response:
“This is something that has been considered since the very beginning. One of the issues is when to do that in a way that is most timely and useful and how to do that. We continue to evolve the thinking of how the interpretation of GDPR applies to WHOIS. We have a number of questions which have been addressed directly to the DPAs and the EDPB and we’ve have an ongoing discussion with the EC about how to interpret the GDPR. We believe that those are a better format at this point than doing the assessment, but we continue to evaluate whether that assessment would be the right thing to do and when.”
The presentation for the webinar is posted here <https://www.icann.org/en/system/files/files/presentation-data-protection-pri...>, and the Adobe Connect recording is here <https://participate.icann.org/p29vt2uxodx/>. The question and response start at 0:27:00 in the Adobe Connect recording.
<DPA Advice Summary-DRAFT.xlsx>
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
I agree Thomas, Either a DPIA should have been carried out by ICANN ORG prior to the 25th of May, or ICANN ORG has documented why a DPIA is not required. Seems both are missing and ICANN ORG cannot demonstrate compliance regarding Art 35 of the GDPR? Best, Theo Geurts Thomas Rickert schreef op 2018-10-09 08:29 AM:
Hi Marika, thanks for sharing this.
Not sure how others read the answers, but I think that the rationale for not doing a DPIA is not satisfactory. I do not see any reason why a DPIA cannot be carried out. It would be hugely beneficial to our group to inform the balancing of rights discussions we will need to have.
I have two more follow-up question we might want to ask, if the EPDP team agrees.
1. Has ICANN org commissioned any legal assessment or carried out legal assessments internally with respect to registration data? If so, can such documents please be shared with the EPDP team?
2. We understand that ICANN has not yet established a record of processing activities. ICANN is required to have such document, see Art. 30 GDPR. For the work of our group, it would be very helpful to obtain the record of processing activities to the extent that registration data is concerned.
Thanks and kind regards, Thomas
Am 09.10.2018 um 05:17 schrieb Marika Konings <marika.konings@icann.org>:
Dear All,
Please find below additional responses from ICANN Org to a number of outstanding questions. We’ll get these posted shortly on the related wiki page.
Best regards,
Caitlin, Berry and Marika
—————————————
The EPDP Team previously requested a summary of ICANN org’s contacts and engagements with the EPDP and DPAs. ICANN org provided a response, which is provided again below for reference:
QUESTION: Can ICANN summarize in some searchable form the contacts and engagements with the EDPB and/or other DPAs in relation to the Temporary Specification for gTLD Registration Data?
RESPONSE: ICANN org has been open and transparent with our engagements with the EDPB and DPAs. All of the formal written communications from EDPB and DPAs are published on ICANN correspondence. In addition, we’ve had informal verbal conversations with the EDPB and DPAs to educate, inform, and ask for guidance. Summaries of those informal conversations are published in blogs. To assist the EPDP Team in its work, ICANN org will provide the EPDP Team with a compiled list of correspondence received and blogs published thus far, including the topic of each correspondence/blog.
As follow-up to the above response, attached is a summary of correspondence between ICANN org and the EPDP/DPAs, as well as announcements and blogs relating to ICANN org’s GDPR-related efforts. The document is marked as draft so that the EPDP Team can review and provide suggestions for re-organization or re-structuring of the content to best meet the EPDP Team’s needs.
QUESTION: For which ICANN policies is admin/tech contact information currently a required data element and/or referenced in the policy?
RESPONSE: Administrative and technical contact information is referenced in the following ICANN policies and procedures:
Registry Registration Data Directory Services Consistent Labeling and Display Policy <https://www.icann.org/resources/pages/rdds-labeling-policy-2017-02-01-en>. Output requirements for administrative and technical contact information. Thick WHOIS Transition Policy for .COM, .NET, .JOBS <https://www.icann.org/resources/pages/thick-whois-transition-policy-2017-02-...>. Guidance to registry operators for handling output of administrative and technical contact information where no data exists in the SRS during the period when registrars begin sending Thick WHOIS data to registry operators for all new registrations. Rules for Uniform Domain Name Dispute Resolution Policy <https://www.icann.org/resources/pages/udrp-rules-2015-03-11-en>. Notifications of complaints include administrative and technical contacts information. WHOIS Data Reminder Policy <https://www.icann.org/en/resources/registrars/consensus-policies/wdrp>. WDRP notices may be presented to the registrant either directly or through the administrative contact. Transfer Policy <https://www.icann.org/resources/pages/transfer-policy-2016-06-01-en>. Administrative contact along with the registered name holder have the authority to approve or deny a transfer request. Because of this role, the administrative contact is referenced in parts of the transfer process as well as in the Registrar Transfer Dispute Resolution Policy. Uniform Rapid Suspension System (URS) Rules <http://newgtlds.icann.org/en/applicants/urs/rules-28jun13-en.pdf>. Notifications of complaints include administrative and technical contacts information.
QUESTION: We have spent most of this meeting exploring the role of compliance at ICANN, in order to support a proposal that ICANN has an implicit contract with the registrant and that therefore 6 1 b applies as a grounds for processing. This would also facilitate ICANN operating a UAM on behalf of those who want the data. It might also explain Goran’s initiative in seeking some kind of recognition by EU authorities that ICANN has a kind of quasi-regulator status, as the authority vested with the responsibility to manage the DNS. Given that all of this is outside the current configuration of ICANN as data controller, which would be more clear had we done a DPIA and had we adequate data maps to work with….can we either get back to our Charter questions that we were mandated to address by the GNSO, or get a full explanation of what is going on and why we continue to be focused on the access question.
RESPONSE: This request appears to be directed at the EPDP Team and not ICANN org as ICANN org does not dictate the direction of the EPDP Team’s discussion.
QUESTION: Why hasn’t a Data Protection Impact Assessment been carried out to clarify data flows and ICANN’s relationship with the data subject in light of its acknowledged role as a joint controller and Article 35 of the GDPR?
RESPONSE: This question was also asked during the Data Protection/Privacy Update Webinar hosted by ICANN org on 8 October 2018. John Jeffrey, ICANN’s General Counsel and Secretary provided the following response:
“This is something that has been considered since the very beginning. One of the issues is when to do that in a way that is most timely and useful and how to do that. We continue to evolve the thinking of how the interpretation of GDPR applies to WHOIS. We have a number of questions which have been addressed directly to the DPAs and the EDPB and we’ve have an ongoing discussion with the EC about how to interpret the GDPR. We believe that those are a better format at this point than doing the assessment, but we continue to evaluate whether that assessment would be the right thing to do and when.”
The presentation for the webinar is posted here <https://www.icann.org/en/system/files/files/presentation-data-protection-pri...>, and the Adobe Connect recording is here <https://participate.icann.org/p29vt2uxodx/>. The question and response start at 0:27:00 in the Adobe Connect recording.
<DPA Advice Summary-DRAFT.xlsx> _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team>
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Absolutely agree with Thomas on this, The answer provided does not explain why a basic aspect of GDPR compliance has not been initiated, the result of which would be of immense help and support to the efforts of the EPDP. As noted at the last team meeting, ICANN are the subject matter experts here, they know their flows and expectations better than the EPDP team's combined acumen. We should be presented with the record of processing activities / data processing map, so that we can consider the reality of current, 'as is' processing situation so as to assess if the Temp Spec, in its current form is sufficient to confirm basic GDPR compliance. Kind regards, Alan [image: Donuts Inc.] <http://donuts.domains> Alan Woods Senior Compliance & Policy Manager, Donuts Inc. ------------------------------ The Victorians, 15-18 Earlsfort Terrace Dublin 2, County Dublin Ireland <https://www.facebook.com/donutstlds> <https://twitter.com/DonutsInc> <https://www.linkedin.com/company/donuts-inc> Please NOTE: This electronic message, including any attachments, may include privileged, confidential and/or inside information owned by Donuts Inc. . Any distribution or use of this communication by anyone other than the intended recipient(s) is strictly prohibited and may be unlawful. If you are not the intended recipient, please notify the sender by replying to this message and then delete it from your system. Thank you. On Tue, Oct 9, 2018 at 9:07 AM gtheo <gtheo@xs4all.nl> wrote:
I agree Thomas,
Either a DPIA should have been carried out by ICANN ORG prior to the 25th of May, or ICANN ORG has documented why a DPIA is not required. Seems both are missing and ICANN ORG cannot demonstrate compliance regarding Art 35 of the GDPR?
Best,
Theo Geurts
Thomas Rickert schreef op 2018-10-09 08:29 AM:
Hi Marika, thanks for sharing this.
Not sure how others read the answers, but I think that the rationale for not doing a DPIA is not satisfactory. I do not see any reason why a DPIA cannot be carried out. It would be hugely beneficial to our group to inform the balancing of rights discussions we will need to have.
I have two more follow-up question we might want to ask, if the EPDP team agrees.
1. Has ICANN org commissioned any legal assessment or carried out legal assessments internally with respect to registration data? If so, can such documents please be shared with the EPDP team?
2. We understand that ICANN has not yet established a record of processing activities. ICANN is required to have such document, see Art. 30 GDPR. For the work of our group, it would be very helpful to obtain the record of processing activities to the extent that registration data is concerned.
Thanks and kind regards, Thomas
Am 09.10.2018 um 05:17 schrieb Marika Konings <marika.konings@icann.org>:
Dear All,
Please find below additional responses from ICANN Org to a number of outstanding questions. We’ll get these posted shortly on the related wiki page.
Best regards,
Caitlin, Berry and Marika
—————————————
The EPDP Team previously requested a summary of ICANN org’s contacts and engagements with the EPDP and DPAs. ICANN org provided a response, which is provided again below for reference:
QUESTION: Can ICANN summarize in some searchable form the contacts and engagements with the EDPB and/or other DPAs in relation to the Temporary Specification for gTLD Registration Data?
RESPONSE: ICANN org has been open and transparent with our engagements with the EDPB and DPAs. All of the formal written communications from EDPB and DPAs are published on ICANN correspondence. In addition, we’ve had informal verbal conversations with the EDPB and DPAs to educate, inform, and ask for guidance. Summaries of those informal conversations are published in blogs. To assist the EPDP Team in its work, ICANN org will provide the EPDP Team with a compiled list of correspondence received and blogs published thus far, including the topic of each correspondence/blog.
As follow-up to the above response, attached is a summary of correspondence between ICANN org and the EPDP/DPAs, as well as announcements and blogs relating to ICANN org’s GDPR-related efforts. The document is marked as draft so that the EPDP Team can review and provide suggestions for re-organization or re-structuring of the content to best meet the EPDP Team’s needs.
QUESTION: For which ICANN policies is admin/tech contact information currently a required data element and/or referenced in the policy?
RESPONSE: Administrative and technical contact information is referenced in the following ICANN policies and procedures:
Registry Registration Data Directory Services Consistent Labeling and Display Policy < https://www.icann.org/resources/pages/rdds-labeling-policy-2017-02-01-en>.
Output requirements for administrative and technical contact information. Thick WHOIS Transition Policy for .COM, .NET, .JOBS < https://www.icann.org/resources/pages/thick-whois-transition-policy-2017-02-...>.
Guidance to registry operators for handling output of administrative and technical contact information where no data exists in the SRS during the period when registrars begin sending Thick WHOIS data to registry operators for all new registrations. Rules for Uniform Domain Name Dispute Resolution Policy <https://www.icann.org/resources/pages/udrp-rules-2015-03-11-en>. Notifications of complaints include administrative and technical contacts information. WHOIS Data Reminder Policy <https://www.icann.org/en/resources/registrars/consensus-policies/wdrp>.
WDRP notices may be presented to the registrant either directly or through the administrative contact. Transfer Policy <https://www.icann.org/resources/pages/transfer-policy-2016-06-01-en>.
Administrative contact along with the registered name holder have the authority to approve or deny a transfer request. Because of this role, the administrative contact is referenced in parts of the transfer process as well as in the Registrar Transfer Dispute Resolution Policy. Uniform Rapid Suspension System (URS) Rules <http://newgtlds.icann.org/en/applicants/urs/rules-28jun13-en.pdf>. Notifications of complaints include administrative and technical contacts information.
QUESTION: We have spent most of this meeting exploring the role of compliance at ICANN, in order to support a proposal that ICANN has an implicit contract with the registrant and that therefore 6 1 b applies as a grounds for processing. This would also facilitate ICANN operating a UAM on behalf of those who want the data. It might also explain Goran’s initiative in seeking some kind of recognition by EU authorities that ICANN has a kind of quasi-regulator status, as the authority vested with the responsibility to manage the DNS. Given that all of this is outside the current configuration of ICANN as data controller, which would be more clear had we done a DPIA and had we adequate data maps to work with….can we either get back to our Charter questions that we were mandated to address by the GNSO, or get a full explanation of what is going on and why we continue to be focused on the access question.
RESPONSE: This request appears to be directed at the EPDP Team and not ICANN org as ICANN org does not dictate the direction of the EPDP Team’s discussion.
QUESTION: Why hasn’t a Data Protection Impact Assessment been carried out to clarify data flows and ICANN’s relationship with the data subject in light of its acknowledged role as a joint controller and Article 35 of the GDPR?
RESPONSE: This question was also asked during the Data Protection/Privacy Update Webinar hosted by ICANN org on 8 October 2018. John Jeffrey, ICANN’s General Counsel and Secretary provided the following response:
“This is something that has been considered since the very beginning. One of the issues is when to do that in a way that is most timely and useful and how to do that. We continue to evolve the thinking of how the interpretation of GDPR applies to WHOIS. We have a number of questions which have been addressed directly to the DPAs and the EDPB and we’ve have an ongoing discussion with the EC about how to interpret the GDPR. We believe that those are a better format at this point than doing the assessment, but we continue to evaluate whether that assessment would be the right thing to do and when.”
The presentation for the webinar is posted here < https://www.icann.org/en/system/files/files/presentation-data-protection-pri...>,
and the Adobe Connect recording is here <https://participate.icann.org/p29vt2uxodx/>. The question and response start at 0:27:00 in the Adobe Connect recording.
<DPA Advice Summary-DRAFT.xlsx> _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team>
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
https://www.cnil.fr/en/open-source-pia-software-helps-carry-out-data-protect... Theo Alan Woods schreef op 2018-10-09 11:04 AM:
Absolutely agree with Thomas on this,
The answer provided does not explain why a basic aspect of GDPR compliance has not been initiated, the result of which would be of immense help and support to the efforts of the EPDP. As noted at the last team meeting, ICANN are the subject matter experts here, they know their flows and expectations better than the EPDP team's combined acumen. We should be presented with the record of processing activities / data processing map, so that we can consider the reality of current, 'as is' processing situation so as to assess if the Temp Spec, in its current form is sufficient to confirm basic GDPR compliance.
Kind regards,
Alan
[image: Donuts Inc.] <http://donuts.domains> Alan Woods Senior Compliance & Policy Manager, Donuts Inc. ------------------------------ The Victorians, 15-18 Earlsfort Terrace Dublin 2, County Dublin Ireland
<https://www.facebook.com/donutstlds> <https://twitter.com/DonutsInc> <https://www.linkedin.com/company/donuts-inc>
Please NOTE: This electronic message, including any attachments, may include privileged, confidential and/or inside information owned by Donuts Inc. . Any distribution or use of this communication by anyone other than the intended recipient(s) is strictly prohibited and may be unlawful. If you are not the intended recipient, please notify the sender by replying to this message and then delete it from your system. Thank you.
On Tue, Oct 9, 2018 at 9:07 AM gtheo <gtheo@xs4all.nl> wrote:
I agree Thomas,
Either a DPIA should have been carried out by ICANN ORG prior to the 25th of May, or ICANN ORG has documented why a DPIA is not required. Seems both are missing and ICANN ORG cannot demonstrate compliance regarding Art 35 of the GDPR?
Best,
Theo Geurts
Thomas Rickert schreef op 2018-10-09 08:29 AM:
Hi Marika, thanks for sharing this.
Not sure how others read the answers, but I think that the rationale for not doing a DPIA is not satisfactory. I do not see any reason why a DPIA cannot be carried out. It would be hugely beneficial to our group to inform the balancing of rights discussions we will need to have.
I have two more follow-up question we might want to ask, if the EPDP team agrees.
1. Has ICANN org commissioned any legal assessment or carried out legal assessments internally with respect to registration data? If so, can such documents please be shared with the EPDP team?
2. We understand that ICANN has not yet established a record of processing activities. ICANN is required to have such document, see Art. 30 GDPR. For the work of our group, it would be very helpful to obtain the record of processing activities to the extent that registration data is concerned.
Thanks and kind regards, Thomas
Am 09.10.2018 um 05:17 schrieb Marika Konings <marika.konings@icann.org>:
Dear All,
Please find below additional responses from ICANN Org to a number of outstanding questions. We’ll get these posted shortly on the related wiki page.
Best regards,
Caitlin, Berry and Marika
—————————————
The EPDP Team previously requested a summary of ICANN org’s contacts and engagements with the EPDP and DPAs. ICANN org provided a response, which is provided again below for reference:
QUESTION: Can ICANN summarize in some searchable form the contacts and engagements with the EDPB and/or other DPAs in relation to the Temporary Specification for gTLD Registration Data?
RESPONSE: ICANN org has been open and transparent with our engagements with the EDPB and DPAs. All of the formal written communications from EDPB and DPAs are published on ICANN correspondence. In addition, we’ve had informal verbal conversations with the EDPB and DPAs to educate, inform, and ask for guidance. Summaries of those informal conversations are published in blogs. To assist the EPDP Team in its work, ICANN org will provide the EPDP Team with a compiled list of correspondence received and blogs published thus far, including the topic of each correspondence/blog.
As follow-up to the above response, attached is a summary of correspondence between ICANN org and the EPDP/DPAs, as well as announcements and blogs relating to ICANN org’s GDPR-related efforts. The document is marked as draft so that the EPDP Team can review and provide suggestions for re-organization or re-structuring of the content to best meet the EPDP Team’s needs.
QUESTION: For which ICANN policies is admin/tech contact information currently a required data element and/or referenced in the policy?
RESPONSE: Administrative and technical contact information is referenced in the following ICANN policies and procedures:
Registry Registration Data Directory Services Consistent Labeling and Display Policy < https://www.icann.org/resources/pages/rdds-labeling-policy-2017-02-01-en>.
Output requirements for administrative and technical contact information. Thick WHOIS Transition Policy for .COM, .NET, .JOBS < https://www.icann.org/resources/pages/thick-whois-transition-policy-2017-02-...>.
Guidance to registry operators for handling output of administrative and technical contact information where no data exists in the SRS during the period when registrars begin sending Thick WHOIS data to registry operators for all new registrations. Rules for Uniform Domain Name Dispute Resolution Policy <https://www.icann.org/resources/pages/udrp-rules-2015-03-11-en>. Notifications of complaints include administrative and technical contacts information. WHOIS Data Reminder Policy <https://www.icann.org/en/resources/registrars/consensus-policies/wdrp>.
WDRP notices may be presented to the registrant either directly or through the administrative contact. Transfer Policy <https://www.icann.org/resources/pages/transfer-policy-2016-06-01-en>.
Administrative contact along with the registered name holder have the authority to approve or deny a transfer request. Because of this role, the administrative contact is referenced in parts of the transfer process as well as in the Registrar Transfer Dispute Resolution Policy. Uniform Rapid Suspension System (URS) Rules <http://newgtlds.icann.org/en/applicants/urs/rules-28jun13-en.pdf>. Notifications of complaints include administrative and technical contacts information.
QUESTION: We have spent most of this meeting exploring the role of compliance at ICANN, in order to support a proposal that ICANN has an implicit contract with the registrant and that therefore 6 1 b applies as a grounds for processing. This would also facilitate ICANN operating a UAM on behalf of those who want the data. It might also explain Goran’s initiative in seeking some kind of recognition by EU authorities that ICANN has a kind of quasi-regulator status, as the authority vested with the responsibility to manage the DNS. Given that all of this is outside the current configuration of ICANN as data controller, which would be more clear had we done a DPIA and had we adequate data maps to work with….can we either get back to our Charter questions that we were mandated to address by the GNSO, or get a full explanation of what is going on and why we continue to be focused on the access question.
RESPONSE: This request appears to be directed at the EPDP Team and not ICANN org as ICANN org does not dictate the direction of the EPDP Team’s discussion.
QUESTION: Why hasn’t a Data Protection Impact Assessment been carried out to clarify data flows and ICANN’s relationship with the data subject in light of its acknowledged role as a joint controller and Article 35 of the GDPR?
RESPONSE: This question was also asked during the Data Protection/Privacy Update Webinar hosted by ICANN org on 8 October 2018. John Jeffrey, ICANN’s General Counsel and Secretary provided the following response:
“This is something that has been considered since the very beginning. One of the issues is when to do that in a way that is most timely and useful and how to do that. We continue to evolve the thinking of how the interpretation of GDPR applies to WHOIS. We have a number of questions which have been addressed directly to the DPAs and the EDPB and we’ve have an ongoing discussion with the EC about how to interpret the GDPR. We believe that those are a better format at this point than doing the assessment, but we continue to evaluate whether that assessment would be the right thing to do and when.”
The presentation for the webinar is posted here < https://www.icann.org/en/system/files/files/presentation-data-protection-pri...>,
and the Adobe Connect recording is here <https://participate.icann.org/p29vt2uxodx/>. The question and response start at 0:27:00 in the Adobe Connect recording.
<DPA Advice Summary-DRAFT.xlsx> _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team>
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
participants (5)
-
Alan Woods -
farzaneh badii -
gtheo -
Marika Konings -
Thomas Rickert