ICANN Procedure for Handling WHOIS Conflicts with Privacy Law
Dear All, Per the action item from today’s meeting, please find attached the staff assessment and next steps report on the Revised ICANN Procedure for Handling WHOIS Conflicts with Privacy Law which was published in May 2017. As there were specific questions in relation to the origin of the procedure, I’ve excerpted the background section from this document below. As noted, the GNSO Council has already agreed to form an Implementation Advisory Group to review the procedure and adopted a charter for this effort in February of this year (see https://gnso.icann.org/en/council/resolutions#201802). However, due to workload issues and the pending EPDP, the Council delayed the call for volunteers and agreed during its most recent meeting to decide when the call for volunteers should be launched following the publication of the Initial Report on the Temporary Specification by the EPDP Team. Best regards, Caitlin, Berry and Marika ============================ Background (from https://www.icann.org/en/system/files/files/whois-privacy-conflicts-procedur...). In November 2005, the GNSO concluded a policy development process<https://gnso.icann.org/en/issues/whois-privacy/council-rpt-18jan06.htm> (PDP) on Whois conflicts with privacy law which recommended that “In order to facilitate reconciliation of any conflicts between local/national mandatory privacy laws or regulations and applicable provisions of the ICANN contract regarding the collection, display and distribution of personal data via the gTLD Whois service, ICANN should: 1. Develop and publicly document a Procedure for dealing with the situation in which a registrar or registry can credibly demonstrate that it is legally prevented by local/national privacy laws or regulations from fully complying with applicable provisions of its ICANN contract regarding the collection, display and distribution of personal data via Whois. 2. Create goals for the procedure which include: * Ensuring that ICANN staff is informed of a conflict at the earliest appropriate juncture; * Resolving the conflict, if possible, in a manner conducive to ICANN's Mission, applicable Core Values, and the stability and uniformity of the Whois system; * Providing a mechanism for the recognition, if appropriate, in circumstances where the conflict cannot be otherwise resolved, of an exception to contractual obligations to those registries/registrars to which the specific conflict applies with regard to collection, display and distribution of personally identifiable data via Whois; and * Preserving sufficient flexibility for ICANN staff to respond to particular factual situations as they arise”. The ICANN Board of Directors adopted the recommendations in May 2006 and directed staff to develop such a Procedure. A draft Procedure was posted for public comment, and input was specifically solicited from the Governmental Advisory Committee (GAC). The GAC recommended adding a provision, which was included as section 1.4 in the procedure, urging a registrar or registry to work with relevant national governments to ensure adherence to domestic and international law, as well as applicable international conventions. If the Whois requirements require changes that ICANN determines prevent compliance with contractual Whois obligations, ICANN may refrain, on a provisional basis, from taking enforcement action for non-compliance, while ICANN prepares a public report and recommendation and submits it to the ICANN Board for a decision. Given that to date no registrar or registry operator has formally invoked the Whois Procedure, and yet numerous concerns have arisen from contracted parties and the wider community, ICANN launched a review in 2014, as provided in the Whois Procedure’s final clause. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-efforts.htm#newcomers>.
This statement seems to support Milton’s claim on today’s call that the WHOIS Conflicts with Privacy Law procedure has never been invoked:
On 21 Aug 2018, at 20:55, Marika Konings <marika.konings@icann.org> wrote:
Given that to date no registrar or registry operator has formally invoked the Whois Procedure
Kind regards, Ayden Férdeline
On 21 Aug 2018, at 20:55, Marika Konings <marika.konings@icann.org> wrote:
Dear All,
Per the action item from today’s meeting, please find attached the staff assessment and next steps report on the Revised ICANN Procedure for Handling WHOIS Conflicts with Privacy Law which was published in May 2017. As there were specific questions in relation to the origin of the procedure, I’ve excerpted the background section from this document below. As noted, the GNSO Council has already agreed to form an Implementation Advisory Group to review the procedure and adopted a charter for this effort in February of this year (see https://gnso.icann.org/en/council/resolutions#201802). However, due to workload issues and the pending EPDP, the Council delayed the call for volunteers and agreed during its most recent meeting to decide when the call for volunteers should be launched following the publication of the Initial Report on the Temporary Specification by the EPDP Team.
Best regards,
Caitlin, Berry and Marika
============================
Background (from https://www.icann.org/en/system/files/files/whois-privacy-conflicts-procedur...).
In November 2005, the GNSO concluded [a policy development process](https://gnso.icann.org/en/issues/whois-privacy/council-rpt-18jan06.htm) (PDP) on Whois conflicts with privacy law which recommended that “In order to facilitate reconciliation of any conflicts between local/national mandatory privacy laws or regulations and applicable provisions of the ICANN contract regarding the collection, display and distribution of personal data via the gTLD Whois service, ICANN should:
- Develop and publicly document a Procedure for dealing with the situation in which a registrar or registry can credibly demonstrate that it is legally prevented by local/national privacy laws or regulations from fully complying with applicable provisions of its ICANN contract regarding the collection, display and distribution of personal data via Whois.
- Create goals for the procedure which include:
- Ensuring that ICANN staff is informed of a conflict at the earliest appropriate juncture;
- Resolving the conflict, if possible, in a manner conducive to ICANN's Mission, applicable Core Values, and the stability and uniformity of the Whois system;
- Providing a mechanism for the recognition, if appropriate, in circumstances where the conflict cannot be otherwise resolved, of an exception to contractual obligations to those registries/registrars to which the specific conflict applies with regard to collection, display and distribution of personally identifiable data via Whois; and
- Preserving sufficient flexibility for ICANN staff to respond to particular factual situations as they arise”.
The ICANN Board of Directors adopted the recommendations in May 2006 and directed staff to develop such a Procedure. A draft Procedure was posted for public comment, and input was specifically solicited from the Governmental Advisory Committee (GAC). The GAC recommended adding a provision, which was included as section 1.4 in the procedure, urging a registrar or registry to work with relevant national governments to ensure adherence to domestic and international law, as well as applicable international conventions.
If the Whois requirements require changes that ICANN determines prevent compliance with contractual Whois obligations, ICANN may refrain, on a provisional basis, from taking enforcement action for non-compliance, while ICANN prepares a public report and recommendation and submits it to the ICANN Board for a decision. Given that to date no registrar or registry operator has formally invoked the Whois Procedure, and yet numerous concerns have arisen from contracted parties and the wider community, ICANN launched a review in 2014, as provided in the Whois Procedure’s final clause.
Marika Konings
Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN)
Email: marika.konings@icann.org
Follow the GNSO via Twitter @ICANN_GNSO
Find out more about the GNSO by taking our [interactive courses](http://learn.icann.org/courses/gnso) and visiting the [GNSO Newcomer pages](http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-e...).
<whois-privacy-conflicts-procedure-03may17-en.pdf>
I think that’s a misreading, sorry. It seems that35 waivers have been granted in 5 years. Here’s a clarification from Steve (posting on his behalf since he’s an alternate): If we read a little further into that May-2017 staff report<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7Cc160deec3036483229ce08d607aa6194%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C636704825701106839&sdata=8Zfl0MG%2F6e3J%2F1ewA7EcBULz%2BB%2B0ITF8v3zzM90JT5k%3D&reserved=0>, you’ll see that 35 registrars used a process similar to the Whois Conflicts policy to obtain waivers to contract requirements about retaining registrant data – based on applicable privacy laws (see excerpt from staff report below). It’s unfortunate we diverted today’s discussion the Whois Conflicts Policy, since the wide use of ICANN’s Data Retention Waiver Process is sufficient to explain the point we made about TempSpec Appendix C “Data Processing Requirements”. That is, we should rely on ICANN policy and processes to grant a waiver if/when applicable law conflicts with registrant data requirements in Registry and registrar agreements. But look at the first line of TempSpec App C.1 “Principles for Processing”: “Each Controller will observe the following principles to govern its Processing of Personal Data contained in Registration Data, except as required by applicable laws or regulations”. (italics added) That TempSpec text could imply that each registrar and registry can decide on its own to ignore any principles for processing – without first obtaining a waiver of the contractual requirement from ICANN. Here’s that excerpt from that May-2017 staff report<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7Cc160deec3036483229ce08d607aa6194%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C636704825701106839&sdata=8Zfl0MG%2F6e3J%2F1ewA7EcBULz%2BB%2B0ITF8v3zzM90JT5k%3D&reserved=0>, showing that 35 registrars have obtained waivers to contract requirements about retaining registrant data – based on applicable privacy laws: The 2013 Registrar Accreditation Agreement (“RAA”) Data Retention Waiver Process Under this Requests process, a registrar may request a compliance waiver of the data retention requirements, by presenting ICANN with a written opinion from a nationally recognized law firm, or ruling or written guidance from a government body that states that collecting or retaining one or more data elements in the manner required by the specification violates applicable law. A general assertion that the data collection and Data Retention Specification requirements are unlawful is not sufficient. Rather, the waiver request must specify the applicable law, the specific allegedly offending data collection and/or retention requirement(s), and the manner in which the collection and/or retention violates the law. This specificity helps ICANN to determine the appropriate limitations on the scope and duration of data collection and retention requirements when granting the waiver. This also helps ICANN balance the interests of the registrar, governments, and the broader Internet community when considering granting such waivers. In addition, if ICANN has previously waived compliance with the requirements for a registrar located in the same jurisdiction and the applying registrar is subject to the same applicable law, the registrar may request the same waiver. The 2013 RAA calls for ICANN and the registrar to discuss data retention waiver requests in good faith in an effort to reach a mutually acceptable resolution. The Data Retention Specification contemplates potential future modifications to the Whois Procedure in section 2 of the RAA.4 Because each country may interpret its data privacy requirements differently, ICANN is working through each of the submitted requests country-by-country. The complexity and diversity of national privacy laws has resulted in considerable investments of time and resources by ICANN and registrars alike. In countries with data privacy laws applicable to registrars, ICANN has found that restrictions generally permit the retention of registration data, but only for legitimate purposes, and for a period no longer than is necessary for the purposes for which the data were collected or for which they are further processed. What constitutes a legitimate purpose and how long data can be retained are complicated questions, and the answers may vary from one country to the next, even within the EU. As of April 2017, a total of 35 Data Retention Waivers were granted to registrars. From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of Ayden Férdeline Sent: Tuesday, August 21, 2018 12:56 To: gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] ICANN Procedure for Handling WHOIS Conflicts with Privacy Law This statement seems to support Milton’s claim on today’s call that the WHOIS Conflicts with Privacy Law procedure has never been invoked: On 21 Aug 2018, at 20:55, Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> wrote: Given that to date no registrar or registry operator has formally invoked the Whois Procedure Kind regards, Ayden Férdeline On 21 Aug 2018, at 20:55, Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> wrote: Dear All, Per the action item from today’s meeting, please find attached the staff assessment and next steps report on the Revised ICANN Procedure for Handling WHOIS Conflicts with Privacy Law which was published in May 2017. As there were specific questions in relation to the origin of the procedure, I’ve excerpted the background section from this document below. As noted, the GNSO Council has already agreed to form an Implementation Advisory Group to review the procedure and adopted a charter for this effort in February of this year (see https://gnso.icann.org/en/council/resolutions#201802<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgnso.icann.org%2Fen%2Fcouncil%2Fresolutions%23201802&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952399814&sdata=WJqXY9ZS9EFT1m1avYwLzQHbT3o6l2AAon%2BU%2FoeY7j0%3D&reserved=0>). However, due to workload issues and the pending EPDP, the Council delayed the call for volunteers and agreed during its most recent meeting to decide when the call for volunteers should be launched following the publication of the Initial Report on the Temporary Specification by the EPDP Team. Best regards, Caitlin, Berry and Marika ============================ Background (from https://www.icann.org/en/system/files/files/whois-privacy-conflicts-procedure-03may17-en.pdf<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952399814&sdata=Gk6O8uK6dnajSzeV8xv%2F3rUx6fm5RXETNHjWMVjm%2FCg%3D&reserved=0>). In November 2005, the GNSO concluded a policy development process<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgnso.icann.org%2Fen%2Fissues%2Fwhois-privacy%2Fcouncil-rpt-18jan06.htm&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952409822&sdata=Vc7EwlUp9RjKtSOSRtAvcXfXuQhAzpduNwCo9bRHZA4%3D&reserved=0> (PDP) on Whois conflicts with privacy law which recommended that “In order to facilitate reconciliation of any conflicts between local/national mandatory privacy laws or regulations and applicable provisions of the ICANN contract regarding the collection, display and distribution of personal data via the gTLD Whois service, ICANN should: 1. Develop and publicly document a Procedure for dealing with the situation in which a registrar or registry can credibly demonstrate that it is legally prevented by local/national privacy laws or regulations from fully complying with applicable provisions of its ICANN contract regarding the collection, display and distribution of personal data via Whois. 2. Create goals for the procedure which include: * Ensuring that ICANN staff is informed of a conflict at the earliest appropriate juncture; * Resolving the conflict, if possible, in a manner conducive to ICANN's Mission, applicable Core Values, and the stability and uniformity of the Whois system; * Providing a mechanism for the recognition, if appropriate, in circumstances where the conflict cannot be otherwise resolved, of an exception to contractual obligations to those registries/registrars to which the specific conflict applies with regard to collection, display and distribution of personally identifiable data via Whois; and * Preserving sufficient flexibility for ICANN staff to respond to particular factual situations as they arise”. The ICANN Board of Directors adopted the recommendations in May 2006 and directed staff to develop such a Procedure. A draft Procedure was posted for public comment, and input was specifically solicited from the Governmental Advisory Committee (GAC). The GAC recommended adding a provision, which was included as section 1.4 in the procedure, urging a registrar or registry to work with relevant national governments to ensure adherence to domestic and international law, as well as applicable international conventions. If the Whois requirements require changes that ICANN determines prevent compliance with contractual Whois obligations, ICANN may refrain, on a provisional basis, from taking enforcement action for non-compliance, while ICANN prepares a public report and recommendation and submits it to the ICANN Board for a decision. Given that to date no registrar or registry operator has formally invoked the Whois Procedure, and yet numerous concerns have arisen from contracted parties and the wider community, ICANN launched a review in 2014, as provided in the Whois Procedure’s final clause. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flearn.icann.org%2Fcourses%2Fgnso&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952409822&sdata=IwV%2FoVI35K1EpCsySXi%2ByVQChRcCkxVZFMjmgqyureM%3D&reserved=0> and visiting the GNSO Newcomer pages<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fgnso.icann.org%2Fsites%2Fgnso.icann.org%2Ffiles%2Fgnso%2Fpresentations%2Fpolicy-efforts.htm%23newcomers&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952419826&sdata=oJHiPRaRApE8LTrNGVIfVKoEUFwgo1xunGCxfTFi4q8%3D&reserved=0>. <whois-privacy-conflicts-procedure-03may17-en.pdf>
Actually Mark, Ayden is correct and yours is a misreading. You are confusing the RAA’s Data Retention Waiver Process with the Handling Whois Conflicts with Law procedure. They are, as your colleague says, “similar” in intent, but they are not the same. One is in the RAA, the other is not. So Ayden and I are correct, the Whois process has never been used; and your colleague is correct, the other procedure has been used 35 times. Having established some facts, it might be useful to back up and ask what this discussion is about and why it is relevant. In my opinion, this discussion is only relevant because some people seem to be suggesting that the Whois Conflicts with Law procedure can somehow rescue ICANN from the need to implement or revise the temp spec. If that is not your argument, and I have misinterpreted the significance of this discussion, then we can all save a lot of effort if you can explain why you think either the Whois Conflict w Law Procedure or the Data Retention Waiver Process are relevant to our ePDP. --MM From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Mark Svancarek (CELA) via Gnso-epdp-team Sent: Tuesday, August 21, 2018 5:16 PM To: Ayden Férdeline <icann@ferdeline.com>; gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] ICANN Procedure for Handling WHOIS Conflicts with Privacy Law I think that’s a misreading, sorry. It seems that35 waivers have been granted in 5 years. Here’s a clarification from Steve (posting on his behalf since he’s an alternate): If we read a little further into that May-2017 staff report<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7Cc160deec3036483229ce08d607aa6194%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C636704825701106839&sdata=8Zfl0MG%2F6e3J%2F1ewA7EcBULz%2BB%2B0ITF8v3zzM90JT5k%3D&reserved=0>, you’ll see that 35 registrars used a process similar to the Whois Conflicts policy to obtain waivers to contract requirements about retaining registrant data – based on applicable privacy laws (see excerpt from staff report below). It’s unfortunate we diverted today’s discussion the Whois Conflicts Policy, since the wide use of ICANN’s Data Retention Waiver Process is sufficient to explain the point we made about TempSpec Appendix C “Data Processing Requirements”. That is, we should rely on ICANN policy and processes to grant a waiver if/when applicable law conflicts with registrant data requirements in Registry and registrar agreements. But look at the first line of TempSpec App C.1 “Principles for Processing”: “Each Controller will observe the following principles to govern its Processing of Personal Data contained in Registration Data, except as required by applicable laws or regulations”. (italics added) That TempSpec text could imply that each registrar and registry can decide on its own to ignore any principles for processing – without first obtaining a waiver of the contractual requirement from ICANN. Here’s that excerpt from that May-2017 staff report<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7Cc160deec3036483229ce08d607aa6194%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C636704825701106839&sdata=8Zfl0MG%2F6e3J%2F1ewA7EcBULz%2BB%2B0ITF8v3zzM90JT5k%3D&reserved=0>, showing that 35 registrars have obtained waivers to contract requirements about retaining registrant data – based on applicable privacy laws: The 2013 Registrar Accreditation Agreement (“RAA”) Data Retention Waiver Process Under this Requests process, a registrar may request a compliance waiver of the data retention requirements, by presenting ICANN with a written opinion from a nationally recognized law firm, or ruling or written guidance from a government body that states that collecting or retaining one or more data elements in the manner required by the specification violates applicable law. A general assertion that the data collection and Data Retention Specification requirements are unlawful is not sufficient. Rather, the waiver request must specify the applicable law, the specific allegedly offending data collection and/or retention requirement(s), and the manner in which the collection and/or retention violates the law. This specificity helps ICANN to determine the appropriate limitations on the scope and duration of data collection and retention requirements when granting the waiver. This also helps ICANN balance the interests of the registrar, governments, and the broader Internet community when considering granting such waivers. In addition, if ICANN has previously waived compliance with the requirements for a registrar located in the same jurisdiction and the applying registrar is subject to the same applicable law, the registrar may request the same waiver. The 2013 RAA calls for ICANN and the registrar to discuss data retention waiver requests in good faith in an effort to reach a mutually acceptable resolution. The Data Retention Specification contemplates potential future modifications to the Whois Procedure in section 2 of the RAA.4 Because each country may interpret its data privacy requirements differently, ICANN is working through each of the submitted requests country-by-country. The complexity and diversity of national privacy laws has resulted in considerable investments of time and resources by ICANN and registrars alike. In countries with data privacy laws applicable to registrars, ICANN has found that restrictions generally permit the retention of registration data, but only for legitimate purposes, and for a period no longer than is necessary for the purposes for which the data were collected or for which they are further processed. What constitutes a legitimate purpose and how long data can be retained are complicated questions, and the answers may vary from one country to the next, even within the EU. As of April 2017, a total of 35 Data Retention Waivers were granted to registrars. From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Ayden Férdeline Sent: Tuesday, August 21, 2018 12:56 To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] ICANN Procedure for Handling WHOIS Conflicts with Privacy Law This statement seems to support Milton’s claim on today’s call that the WHOIS Conflicts with Privacy Law procedure has never been invoked: On 21 Aug 2018, at 20:55, Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> wrote: Given that to date no registrar or registry operator has formally invoked the Whois Procedure Kind regards, Ayden Férdeline On 21 Aug 2018, at 20:55, Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> wrote: Dear All, Per the action item from today’s meeting, please find attached the staff assessment and next steps report on the Revised ICANN Procedure for Handling WHOIS Conflicts with Privacy Law which was published in May 2017. As there were specific questions in relation to the origin of the procedure, I’ve excerpted the background section from this document below. As noted, the GNSO Council has already agreed to form an Implementation Advisory Group to review the procedure and adopted a charter for this effort in February of this year (see https://gnso.icann.org/en/council/resolutions#201802<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgnso.icann.org%2Fen%2Fcouncil%2Fresolutions%23201802&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952399814&sdata=WJqXY9ZS9EFT1m1avYwLzQHbT3o6l2AAon%2BU%2FoeY7j0%3D&reserved=0>). However, due to workload issues and the pending EPDP, the Council delayed the call for volunteers and agreed during its most recent meeting to decide when the call for volunteers should be launched following the publication of the Initial Report on the Temporary Specification by the EPDP Team. Best regards, Caitlin, Berry and Marika ============================ Background (from https://www.icann.org/en/system/files/files/whois-privacy-conflicts-procedure-03may17-en.pdf<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952399814&sdata=Gk6O8uK6dnajSzeV8xv%2F3rUx6fm5RXETNHjWMVjm%2FCg%3D&reserved=0>). In November 2005, the GNSO concluded a policy development process<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgnso.icann.org%2Fen%2Fissues%2Fwhois-privacy%2Fcouncil-rpt-18jan06.htm&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952409822&sdata=Vc7EwlUp9RjKtSOSRtAvcXfXuQhAzpduNwCo9bRHZA4%3D&reserved=0> (PDP) on Whois conflicts with privacy law which recommended that “In order to facilitate reconciliation of any conflicts between local/national mandatory privacy laws or regulations and applicable provisions of the ICANN contract regarding the collection, display and distribution of personal data via the gTLD Whois service, ICANN should: 1. Develop and publicly document a Procedure for dealing with the situation in which a registrar or registry can credibly demonstrate that it is legally prevented by local/national privacy laws or regulations from fully complying with applicable provisions of its ICANN contract regarding the collection, display and distribution of personal data via Whois. 2. Create goals for the procedure which include: * Ensuring that ICANN staff is informed of a conflict at the earliest appropriate juncture; * Resolving the conflict, if possible, in a manner conducive to ICANN's Mission, applicable Core Values, and the stability and uniformity of the Whois system; * Providing a mechanism for the recognition, if appropriate, in circumstances where the conflict cannot be otherwise resolved, of an exception to contractual obligations to those registries/registrars to which the specific conflict applies with regard to collection, display and distribution of personally identifiable data via Whois; and * Preserving sufficient flexibility for ICANN staff to respond to particular factual situations as they arise”. The ICANN Board of Directors adopted the recommendations in May 2006 and directed staff to develop such a Procedure. A draft Procedure was posted for public comment, and input was specifically solicited from the Governmental Advisory Committee (GAC). The GAC recommended adding a provision, which was included as section 1.4 in the procedure, urging a registrar or registry to work with relevant national governments to ensure adherence to domestic and international law, as well as applicable international conventions. If the Whois requirements require changes that ICANN determines prevent compliance with contractual Whois obligations, ICANN may refrain, on a provisional basis, from taking enforcement action for non-compliance, while ICANN prepares a public report and recommendation and submits it to the ICANN Board for a decision. Given that to date no registrar or registry operator has formally invoked the Whois Procedure, and yet numerous concerns have arisen from contracted parties and the wider community, ICANN launched a review in 2014, as provided in the Whois Procedure’s final clause. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flearn.icann.org%2Fcourses%2Fgnso&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952409822&sdata=IwV%2FoVI35K1EpCsySXi%2ByVQChRcCkxVZFMjmgqyureM%3D&reserved=0> and visiting the GNSO Newcomer pages<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fgnso.icann.org%2Fsites%2Fgnso.icann.org%2Ffiles%2Fgnso%2Fpresentations%2Fpolicy-efforts.htm%23newcomers&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952419826&sdata=oJHiPRaRApE8LTrNGVIfVKoEUFwgo1xunGCxfTFi4q8%3D&reserved=0>. <whois-privacy-conflicts-procedure-03may17-en.pdf>
I concede that my use of “misreading” was wrong. Sorry about that. I suggest we back up a bit further when determining what the discussion is about and why it’s relevant. Go back past any mention of Handling Whois Conflicts with Law procedure. (I further concede that it was not a great example of existing consensus policy for this discussion.) The original comment was “The language above [“obligations subject to local laws” ] creates uncertainty by failing both to reference existing consensus policy and by leaving applicability of local law subject to each party’s interpretations.“ Perhaps I could have made my point better by referencing RAA and data retention waivers. (I have less institutional memory than some others; perhaps that is also not the best example.) The intent was to express that we should acknowledge the existence of existing obligations and processes and determine when it is appropriate to conform to them. As for “somehow rescue ICANN from the need to implement or revise the temp spec”, I think you have me mistaken for someone else. /marksv From: Mueller, Milton L <milton@gatech.edu> Sent: Tuesday, August 21, 2018 14:36 To: Mark Svancarek (CELA) <marksv@microsoft.com>; Ayden Férdeline <icann@ferdeline.com> Cc: gnso-epdp-team@icann.org Subject: RE: [Gnso-epdp-team] ICANN Procedure for Handling WHOIS Conflicts with Privacy Law Actually Mark, Ayden is correct and yours is a misreading. You are confusing the RAA’s Data Retention Waiver Process with the Handling Whois Conflicts with Law procedure. They are, as your colleague says, “similar” in intent, but they are not the same. One is in the RAA, the other is not. So Ayden and I are correct, the Whois process has never been used; and your colleague is correct, the other procedure has been used 35 times. Having established some facts, it might be useful to back up and ask what this discussion is about and why it is relevant. In my opinion, this discussion is only relevant because some people seem to be suggesting that the Whois Conflicts with Law procedure can somehow rescue ICANN from the need to implement or revise the temp spec. If that is not your argument, and I have misinterpreted the significance of this discussion, then we can all save a lot of effort if you can explain why you think either the Whois Conflict w Law Procedure or the Data Retention Waiver Process are relevant to our ePDP. --MM From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of Mark Svancarek (CELA) via Gnso-epdp-team Sent: Tuesday, August 21, 2018 5:16 PM To: Ayden Férdeline <icann@ferdeline.com<mailto:icann@ferdeline.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] ICANN Procedure for Handling WHOIS Conflicts with Privacy Law I think that’s a misreading, sorry. It seems that35 waivers have been granted in 5 years. Here’s a clarification from Steve (posting on his behalf since he’s an alternate): If we read a little further into that May-2017 staff report<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7Ca0122d7a2557496e27c708d607ae1b44%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704841711420385&sdata=yChIGdiE2vm%2FeCvNRhVRohl7RP3yvuxKJaEAuXFjrCg%3D&reserved=0>, you’ll see that 35 registrars used a process similar to the Whois Conflicts policy to obtain waivers to contract requirements about retaining registrant data – based on applicable privacy laws (see excerpt from staff report below). It’s unfortunate we diverted today’s discussion the Whois Conflicts Policy, since the wide use of ICANN’s Data Retention Waiver Process is sufficient to explain the point we made about TempSpec Appendix C “Data Processing Requirements”. That is, we should rely on ICANN policy and processes to grant a waiver if/when applicable law conflicts with registrant data requirements in Registry and registrar agreements. But look at the first line of TempSpec App C.1 “Principles for Processing”: “Each Controller will observe the following principles to govern its Processing of Personal Data contained in Registration Data, except as required by applicable laws or regulations”. (italics added) That TempSpec text could imply that each registrar and registry can decide on its own to ignore any principles for processing – without first obtaining a waiver of the contractual requirement from ICANN. Here’s that excerpt from that May-2017 staff report<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7Ca0122d7a2557496e27c708d607ae1b44%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704841711430393&sdata=5hs%2FwHZg%2BUv4wLon9tUAjb9ekG4GDPT4ivDOhnGmytg%3D&reserved=0>, showing that 35 registrars have obtained waivers to contract requirements about retaining registrant data – based on applicable privacy laws: The 2013 Registrar Accreditation Agreement (“RAA”) Data Retention Waiver Process Under this Requests process, a registrar may request a compliance waiver of the data retention requirements, by presenting ICANN with a written opinion from a nationally recognized law firm, or ruling or written guidance from a government body that states that collecting or retaining one or more data elements in the manner required by the specification violates applicable law. A general assertion that the data collection and Data Retention Specification requirements are unlawful is not sufficient. Rather, the waiver request must specify the applicable law, the specific allegedly offending data collection and/or retention requirement(s), and the manner in which the collection and/or retention violates the law. This specificity helps ICANN to determine the appropriate limitations on the scope and duration of data collection and retention requirements when granting the waiver. This also helps ICANN balance the interests of the registrar, governments, and the broader Internet community when considering granting such waivers. In addition, if ICANN has previously waived compliance with the requirements for a registrar located in the same jurisdiction and the applying registrar is subject to the same applicable law, the registrar may request the same waiver. The 2013 RAA calls for ICANN and the registrar to discuss data retention waiver requests in good faith in an effort to reach a mutually acceptable resolution. The Data Retention Specification contemplates potential future modifications to the Whois Procedure in section 2 of the RAA.4 Because each country may interpret its data privacy requirements differently, ICANN is working through each of the submitted requests country-by-country. The complexity and diversity of national privacy laws has resulted in considerable investments of time and resources by ICANN and registrars alike. In countries with data privacy laws applicable to registrars, ICANN has found that restrictions generally permit the retention of registration data, but only for legitimate purposes, and for a period no longer than is necessary for the purposes for which the data were collected or for which they are further processed. What constitutes a legitimate purpose and how long data can be retained are complicated questions, and the answers may vary from one country to the next, even within the EU. As of April 2017, a total of 35 Data Retention Waivers were granted to registrars. From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Ayden Férdeline Sent: Tuesday, August 21, 2018 12:56 To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] ICANN Procedure for Handling WHOIS Conflicts with Privacy Law This statement seems to support Milton’s claim on today’s call that the WHOIS Conflicts with Privacy Law procedure has never been invoked: On 21 Aug 2018, at 20:55, Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> wrote: Given that to date no registrar or registry operator has formally invoked the Whois Procedure Kind regards, Ayden Férdeline On 21 Aug 2018, at 20:55, Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> wrote: Dear All, Per the action item from today’s meeting, please find attached the staff assessment and next steps report on the Revised ICANN Procedure for Handling WHOIS Conflicts with Privacy Law which was published in May 2017. As there were specific questions in relation to the origin of the procedure, I’ve excerpted the background section from this document below. As noted, the GNSO Council has already agreed to form an Implementation Advisory Group to review the procedure and adopted a charter for this effort in February of this year (see https://gnso.icann.org/en/council/resolutions#201802<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgnso.icann.org%2Fen%2Fcouncil%2Fresolutions%23201802&data=02%7C01%7Cmarksv%40microsoft.com%7Ca0122d7a2557496e27c708d607ae1b44%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704841711430393&sdata=nXeTZtsYUM2RS8vioBXzsP%2BKOfYXeUmpmq5uikIZJPs%3D&reserved=0>). However, due to workload issues and the pending EPDP, the Council delayed the call for volunteers and agreed during its most recent meeting to decide when the call for volunteers should be launched following the publication of the Initial Report on the Temporary Specification by the EPDP Team. Best regards, Caitlin, Berry and Marika ============================ Background (from https://www.icann.org/en/system/files/files/whois-privacy-conflicts-procedure-03may17-en.pdf<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7Ca0122d7a2557496e27c708d607ae1b44%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704841711440402&sdata=fKzqbaaEFDk9Ib32sUJZnZJyfOH5SZgJoATi6WCN0gE%3D&reserved=0>). In November 2005, the GNSO concluded a policy development process<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgnso.icann.org%2Fen%2Fissues%2Fwhois-privacy%2Fcouncil-rpt-18jan06.htm&data=02%7C01%7Cmarksv%40microsoft.com%7Ca0122d7a2557496e27c708d607ae1b44%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704841711450410&sdata=Gr1qzWhIN8La5YkThZieAEgvWZt2mFZV0YIcpz7%2BZms%3D&reserved=0> (PDP) on Whois conflicts with privacy law which recommended that “In order to facilitate reconciliation of any conflicts between local/national mandatory privacy laws or regulations and applicable provisions of the ICANN contract regarding the collection, display and distribution of personal data via the gTLD Whois service, ICANN should: 1. Develop and publicly document a Procedure for dealing with the situation in which a registrar or registry can credibly demonstrate that it is legally prevented by local/national privacy laws or regulations from fully complying with applicable provisions of its ICANN contract regarding the collection, display and distribution of personal data via Whois. 2. Create goals for the procedure which include: * Ensuring that ICANN staff is informed of a conflict at the earliest appropriate juncture; * Resolving the conflict, if possible, in a manner conducive to ICANN's Mission, applicable Core Values, and the stability and uniformity of the Whois system; * Providing a mechanism for the recognition, if appropriate, in circumstances where the conflict cannot be otherwise resolved, of an exception to contractual obligations to those registries/registrars to which the specific conflict applies with regard to collection, display and distribution of personally identifiable data via Whois; and * Preserving sufficient flexibility for ICANN staff to respond to particular factual situations as they arise”. The ICANN Board of Directors adopted the recommendations in May 2006 and directed staff to develop such a Procedure. A draft Procedure was posted for public comment, and input was specifically solicited from the Governmental Advisory Committee (GAC). The GAC recommended adding a provision, which was included as section 1.4 in the procedure, urging a registrar or registry to work with relevant national governments to ensure adherence to domestic and international law, as well as applicable international conventions. If the Whois requirements require changes that ICANN determines prevent compliance with contractual Whois obligations, ICANN may refrain, on a provisional basis, from taking enforcement action for non-compliance, while ICANN prepares a public report and recommendation and submits it to the ICANN Board for a decision. Given that to date no registrar or registry operator has formally invoked the Whois Procedure, and yet numerous concerns have arisen from contracted parties and the wider community, ICANN launched a review in 2014, as provided in the Whois Procedure’s final clause. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flearn.icann.org%2Fcourses%2Fgnso&data=02%7C01%7Cmarksv%40microsoft.com%7Ca0122d7a2557496e27c708d607ae1b44%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704841711450410&sdata=USA31sSrsvyeA%2Bfb7np1cQGUrl8SfRjwG9tJX57Qd%2BE%3D&reserved=0> and visiting the GNSO Newcomer pages<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fgnso.icann.org%2Fsites%2Fgnso.icann.org%2Ffiles%2Fgnso%2Fpresentations%2Fpolicy-efforts.htm%23newcomers&data=02%7C01%7Cmarksv%40microsoft.com%7Ca0122d7a2557496e27c708d607ae1b44%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704841711460419&sdata=EtxEONwvQ%2BfYVZqo%2FuMdJql%2FDN7Rdep7fm4sHEDoBPY%3D&reserved=0>. <whois-privacy-conflicts-procedure-03may17-en.pdf>
Hi Milton, To be clear the point of my comment on the call this morning wasn't that the WHOIS conflicts procedure was somehow relevant to our ePDP, but that we need to rework the text currently in Temp Spec Appendix C.1 so what ends up in our final report so it doesn't create uncertainty or a mechanism to sidestep/avoid existing policy. "IPC agrees with the bulk of this section but strongly disagrees with the lead in language to this section, which makes the obligations subject to applicable laws. All obligations are subject to applicable laws, but for the sake of certainty, it is important that the obligations be clear and certain, and not subject to any one party’s view of what applicable laws require. There is an existing consensus policy and Process to govern conflicts between WHOIS obligations and National Data Protection Laws, and that will govern dealing with any conflict between those laws and such obligations. The language above appears to allow circumvention of that policy and process, and creates uncertainty. Therefore, in Section 1 the phrase “except as required by applicable laws and regulations” should be deleted, as it is unnecessary." Alex On Tue, Aug 21, 2018 at 2:36 PM Mueller, Milton L <milton@gatech.edu> wrote:
Actually Mark, Ayden is correct and yours is a misreading. You are confusing the RAA’s Data Retention Waiver Process with the Handling Whois Conflicts with Law procedure. They are, as your colleague says, “similar” in intent, but they are not the same. One is in the RAA, the other is not. So Ayden and I are correct, the Whois process has never been used; and your colleague is correct, the other procedure has been used 35 times.
Having established some facts, it might be useful to back up and ask what this discussion is about and why it is relevant. In my opinion, this discussion is only relevant because some people seem to be suggesting that the Whois Conflicts with Law procedure can somehow rescue ICANN from the need to implement or revise the temp spec. If that is not your argument, and I have misinterpreted the significance of this discussion, then we can all save a lot of effort if you can explain why you think either the Whois Conflict w Law Procedure or the Data Retention Waiver Process are relevant to our ePDP.
--MM
*From:* Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] *On Behalf Of *Mark Svancarek (CELA) via Gnso-epdp-team *Sent:* Tuesday, August 21, 2018 5:16 PM *To:* Ayden Férdeline <icann@ferdeline.com>; gnso-epdp-team@icann.org *Subject:* Re: [Gnso-epdp-team] ICANN Procedure for Handling WHOIS Conflicts with Privacy Law
I think that’s a misreading, sorry. It seems that35 waivers have been granted in 5 years.
Here’s a clarification from Steve (posting on his behalf since he’s an alternate):
If we read a little further into that May-2017 staff report <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7Cc160deec3036483229ce08d607aa6194%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C636704825701106839&sdata=8Zfl0MG%2F6e3J%2F1ewA7EcBULz%2BB%2B0ITF8v3zzM90JT5k%3D&reserved=0>, you’ll see that 35 registrars used a process similar to the Whois Conflicts policy to obtain waivers to contract requirements about retaining registrant data – based on applicable privacy laws (see excerpt from staff report below).
It’s unfortunate we diverted today’s discussion the Whois Conflicts Policy, since the wide use of ICANN’s Data Retention Waiver Process is sufficient to explain the point we made about TempSpec Appendix C “Data Processing Requirements”.
That is, we should rely on ICANN policy and processes to grant a waiver if/when applicable law conflicts with registrant data requirements in Registry and registrar agreements. But look at the first line of TempSpec App C.1 “Principles for Processing”:
“Each Controller will observe the following principles to govern its Processing of Personal Data contained in Registration Data, *except as required by applicable laws or regulations*”. (italics added)
That TempSpec *text* could imply that each registrar and registry can decide on its own to ignore any principles for processing – without first obtaining a waiver of the contractual requirement from ICANN.
Here’s that excerpt from that May-2017 staff report <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7Cc160deec3036483229ce08d607aa6194%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C636704825701106839&sdata=8Zfl0MG%2F6e3J%2F1ewA7EcBULz%2BB%2B0ITF8v3zzM90JT5k%3D&reserved=0>, showing that 35 registrars have obtained waivers to contract requirements about retaining registrant data – based on applicable privacy laws:
*The 2013 Registrar Accreditation Agreement (“RAA”) Data Retention Waiver Process *
Under this Requests process, a registrar may request a compliance waiver of the data retention requirements, by presenting ICANN with a written opinion from a nationally recognized law firm, or ruling or written guidance from a government body that states that collecting or retaining one or more data elements in the manner required by the specification violates applicable law. A general assertion that the data collection and Data Retention Specification requirements are unlawful is not sufficient. Rather, the waiver request must specify the applicable law, the specific allegedly offending data collection and/or retention requirement(s), and the manner in which the collection and/or retention violates the law.
This specificity helps ICANN to determine the appropriate limitations on the scope and duration of data collection and retention requirements when granting the waiver. This also helps ICANN balance the interests of the registrar, governments, and the broader Internet community when considering granting such waivers. In addition, if ICANN has previously waived compliance with the requirements for a registrar located in the same jurisdiction and the applying registrar is subject to the same applicable law, the registrar may request the same waiver.
The 2013 RAA calls for ICANN and the registrar to discuss data retention waiver requests in good faith in an effort to reach a mutually acceptable resolution. The Data Retention Specification contemplates potential future modifications to the Whois Procedure in section 2 of the RAA.4 Because each country may interpret its data privacy requirements differently, ICANN is working through each of the submitted requests country-by-country.
The complexity and diversity of national privacy laws has resulted in considerable investments of time and resources by ICANN and registrars alike. In countries with data privacy laws applicable to registrars, ICANN has found that restrictions generally permit the retention of registration data, but only for legitimate purposes, and for a period no longer than is necessary for the purposes for which the data were collected or for which they are further processed. What constitutes a legitimate purpose and how long data can be retained are complicated questions, and the answers may vary from one country to the next, even within the EU.
As of April 2017, a total of 35 Data Retention Waivers were granted to registrars.
*From:* Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> *On Behalf Of *Ayden Férdeline *Sent:* Tuesday, August 21, 2018 12:56 *To:* gnso-epdp-team@icann.org *Subject:* Re: [Gnso-epdp-team] ICANN Procedure for Handling WHOIS Conflicts with Privacy Law
This statement seems to support Milton’s claim on today’s call that the WHOIS Conflicts with Privacy Law procedure has never been invoked:
On 21 Aug 2018, at 20:55, Marika Konings <marika.konings@icann.org> wrote:
Given that to date no registrar or registry operator has formally invoked the Whois Procedure
Kind regards,
Ayden Férdeline
On 21 Aug 2018, at 20:55, Marika Konings <marika.konings@icann.org> wrote:
Dear All,
Per the action item from today’s meeting, please find attached the staff assessment and next steps report on the Revised ICANN Procedure for Handling WHOIS Conflicts with Privacy Law which was published in May 2017. As there were specific questions in relation to the origin of the procedure, I’ve excerpted the background section from this document below. As noted, the GNSO Council has already agreed to form an Implementation Advisory Group to review the procedure and adopted a charter for this effort in February of this year (see https://gnso.icann.org/en/council/resolutions#201802 <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgnso.icann.org%2Fen%2Fcouncil%2Fresolutions%23201802&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952399814&sdata=WJqXY9ZS9EFT1m1avYwLzQHbT3o6l2AAon%2BU%2FoeY7j0%3D&reserved=0>). However, due to workload issues and the pending EPDP, the Council delayed the call for volunteers and agreed during its most recent meeting to decide when the call for volunteers should be launched following the publication of the Initial Report on the Temporary Specification by the EPDP Team.
Best regards,
Caitlin, Berry and Marika
============================
*Background* (from https://www.icann.org/en/system/files/files/whois-privacy-conflicts-procedur... <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952399814&sdata=Gk6O8uK6dnajSzeV8xv%2F3rUx6fm5RXETNHjWMVjm%2FCg%3D&reserved=0> ).
In November 2005, the GNSO concluded a policy development process <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgnso.icann.org%2Fen%2Fissues%2Fwhois-privacy%2Fcouncil-rpt-18jan06.htm&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952409822&sdata=Vc7EwlUp9RjKtSOSRtAvcXfXuQhAzpduNwCo9bRHZA4%3D&reserved=0> (PDP) on Whois conflicts with privacy law which recommended that “In order to facilitate reconciliation of any conflicts between local/national mandatory privacy laws or regulations and applicable provisions of the ICANN contract regarding the collection, display and distribution of personal data via the gTLD Whois service, ICANN should:
1. Develop and publicly document a Procedure for dealing with the situation in which a registrar or registry can credibly demonstrate that it is legally prevented by local/national privacy laws or regulations from fully complying with applicable provisions of its ICANN contract regarding the collection, display and distribution of personal data via Whois. 2. Create goals for the procedure which include:
1. Ensuring that ICANN staff is informed of a conflict at the earliest appropriate juncture; 2. Resolving the conflict, if possible, in a manner conducive to ICANN's Mission, applicable Core Values, and the stability and uniformity of the Whois system; 3. Providing a mechanism for the recognition, if appropriate, in circumstances where the conflict cannot be otherwise resolved, of an exception to contractual obligations to those registries/registrars to which the specific conflict applies with regard to collection, display and distribution of personally identifiable data via Whois; and 4. Preserving sufficient flexibility for ICANN staff to respond to particular factual situations as they arise”.
The ICANN Board of Directors adopted the recommendations in May 2006 and directed staff to develop such a Procedure. A draft Procedure was posted for public comment, and input was specifically solicited from the Governmental Advisory Committee (GAC). The GAC recommended adding a provision, which was included as section 1.4 in the procedure, urging a registrar or registry to work with relevant national governments to ensure adherence to domestic and international law, as well as applicable international conventions.
If the Whois requirements require changes that ICANN determines prevent compliance with contractual Whois obligations, ICANN may refrain, on a provisional basis, from taking enforcement action for non-compliance, while ICANN prepares a public report and recommendation and submits it to the ICANN Board for a decision. Given that to date no registrar or registry operator has formally invoked the Whois Procedure, and yet numerous concerns have arisen from contracted parties and the wider community, ICANN launched a review in 2014, as provided in the Whois Procedure’s final clause.
*Marika Konings*
*Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) *
*Email: **marika.konings@icann.org* <marika.konings@icann.org>
*Follow the GNSO via Twitter @ICANN_GNSO*
*Find out more about the GNSO by taking our **interactive courses* <https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flearn.icann.org%2Fcourses%2Fgnso&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952409822&sdata=IwV%2FoVI35K1EpCsySXi%2ByVQChRcCkxVZFMjmgqyureM%3D&reserved=0>* and visiting the **GNSO Newcomer pages* <https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fgnso.icann.org%2Fsites%2Fgnso.icann.org%2Ffiles%2Fgnso%2Fpresentations%2Fpolicy-efforts.htm%23newcomers&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952419826&sdata=oJHiPRaRApE8LTrNGVIfVKoEUFwgo1xunGCxfTFi4q8%3D&reserved=0> *. *
<whois-privacy-conflicts-procedure-03may17-en.pdf>
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
-- ___________ *Alex Deacon* Cole Valley Consulting alex@colevalleyconsulting.com +1.415.488.6009
Thanks for the clarification, Alex. I understand better now how the Whois conflicts with law procedure got dragged into the discussion. That being said, I don’t think I can agree with your position. You state that “all obligations are subject to applicable law” but you are afraid that explicitly stating that language somehow empowers “one party” to decide for themselves what applicable laws require? I think that logically, that’s a non sequitur, and practically, the fear is completely unfounded. ICANN compliance can go after anyone who doesn’t comply with their contracts. A registrar or registry who thought ICANN obligations forced them to break the law would have to go through some kind of a process to demonstrate how applicable law prevented them from doing so. That process would not necessarily have to be the old, and defunct Whois conflicts with law procedure. I don’t see how including that language allows anyone to circumvent anything. --MM From: Alex Deacon [mailto:alex@colevalleyconsulting.com] Sent: Tuesday, August 21, 2018 6:23 PM To: Mueller, Milton L <milton@gatech.edu> Cc: Mark Svancarek (CELA) <marksv@microsoft.com>; icann@ferdeline.com; gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] ICANN Procedure for Handling WHOIS Conflicts with Privacy Law Hi Milton, To be clear the point of my comment on the call this morning wasn't that the WHOIS conflicts procedure was somehow relevant to our ePDP, but that we need to rework the text currently in Temp Spec Appendix C.1 so what ends up in our final report so it doesn't create uncertainty or a mechanism to sidestep/avoid existing policy. "IPC agrees with the bulk of this section but strongly disagrees with the lead in language to this section, which makes the obligations subject to applicable laws. All obligations are subject to applicable laws, but for the sake of certainty, it is important that the obligations be clear and certain, and not subject to any one party’s view of what applicable laws require. There is an existing consensus policy and Process to govern conflicts between WHOIS obligations and National Data Protection Laws, and that will govern dealing with any conflict between those laws and such obligations. The language above appears to allow circumvention of that policy and process, and creates uncertainty. Therefore, in Section 1 the phrase “except as required by applicable laws and regulations” should be deleted, as it is unnecessary." Alex On Tue, Aug 21, 2018 at 2:36 PM Mueller, Milton L <milton@gatech.edu<mailto:milton@gatech.edu>> wrote: Actually Mark, Ayden is correct and yours is a misreading. You are confusing the RAA’s Data Retention Waiver Process with the Handling Whois Conflicts with Law procedure. They are, as your colleague says, “similar” in intent, but they are not the same. One is in the RAA, the other is not. So Ayden and I are correct, the Whois process has never been used; and your colleague is correct, the other procedure has been used 35 times. Having established some facts, it might be useful to back up and ask what this discussion is about and why it is relevant. In my opinion, this discussion is only relevant because some people seem to be suggesting that the Whois Conflicts with Law procedure can somehow rescue ICANN from the need to implement or revise the temp spec. If that is not your argument, and I have misinterpreted the significance of this discussion, then we can all save a lot of effort if you can explain why you think either the Whois Conflict w Law Procedure or the Data Retention Waiver Process are relevant to our ePDP. --MM From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>] On Behalf Of Mark Svancarek (CELA) via Gnso-epdp-team Sent: Tuesday, August 21, 2018 5:16 PM To: Ayden Férdeline <icann@ferdeline.com<mailto:icann@ferdeline.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] ICANN Procedure for Handling WHOIS Conflicts with Privacy Law I think that’s a misreading, sorry. It seems that35 waivers have been granted in 5 years. Here’s a clarification from Steve (posting on his behalf since he’s an alternate): If we read a little further into that May-2017 staff report<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7Cc160deec3036483229ce08d607aa6194%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C636704825701106839&sdata=8Zfl0MG%2F6e3J%2F1ewA7EcBULz%2BB%2B0ITF8v3zzM90JT5k%3D&reserved=0>, you’ll see that 35 registrars used a process similar to the Whois Conflicts policy to obtain waivers to contract requirements about retaining registrant data – based on applicable privacy laws (see excerpt from staff report below). It’s unfortunate we diverted today’s discussion the Whois Conflicts Policy, since the wide use of ICANN’s Data Retention Waiver Process is sufficient to explain the point we made about TempSpec Appendix C “Data Processing Requirements”. That is, we should rely on ICANN policy and processes to grant a waiver if/when applicable law conflicts with registrant data requirements in Registry and registrar agreements. But look at the first line of TempSpec App C.1 “Principles for Processing”: “Each Controller will observe the following principles to govern its Processing of Personal Data contained in Registration Data, except as required by applicable laws or regulations”. (italics added) That TempSpec text could imply that each registrar and registry can decide on its own to ignore any principles for processing – without first obtaining a waiver of the contractual requirement from ICANN. Here’s that excerpt from that May-2017 staff report<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7Cc160deec3036483229ce08d607aa6194%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C636704825701106839&sdata=8Zfl0MG%2F6e3J%2F1ewA7EcBULz%2BB%2B0ITF8v3zzM90JT5k%3D&reserved=0>, showing that 35 registrars have obtained waivers to contract requirements about retaining registrant data – based on applicable privacy laws: The 2013 Registrar Accreditation Agreement (“RAA”) Data Retention Waiver Process Under this Requests process, a registrar may request a compliance waiver of the data retention requirements, by presenting ICANN with a written opinion from a nationally recognized law firm, or ruling or written guidance from a government body that states that collecting or retaining one or more data elements in the manner required by the specification violates applicable law. A general assertion that the data collection and Data Retention Specification requirements are unlawful is not sufficient. Rather, the waiver request must specify the applicable law, the specific allegedly offending data collection and/or retention requirement(s), and the manner in which the collection and/or retention violates the law. This specificity helps ICANN to determine the appropriate limitations on the scope and duration of data collection and retention requirements when granting the waiver. This also helps ICANN balance the interests of the registrar, governments, and the broader Internet community when considering granting such waivers. In addition, if ICANN has previously waived compliance with the requirements for a registrar located in the same jurisdiction and the applying registrar is subject to the same applicable law, the registrar may request the same waiver. The 2013 RAA calls for ICANN and the registrar to discuss data retention waiver requests in good faith in an effort to reach a mutually acceptable resolution. The Data Retention Specification contemplates potential future modifications to the Whois Procedure in section 2 of the RAA.4 Because each country may interpret its data privacy requirements differently, ICANN is working through each of the submitted requests country-by-country. The complexity and diversity of national privacy laws has resulted in considerable investments of time and resources by ICANN and registrars alike. In countries with data privacy laws applicable to registrars, ICANN has found that restrictions generally permit the retention of registration data, but only for legitimate purposes, and for a period no longer than is necessary for the purposes for which the data were collected or for which they are further processed. What constitutes a legitimate purpose and how long data can be retained are complicated questions, and the answers may vary from one country to the next, even within the EU. As of April 2017, a total of 35 Data Retention Waivers were granted to registrars. From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Ayden Férdeline Sent: Tuesday, August 21, 2018 12:56 To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] ICANN Procedure for Handling WHOIS Conflicts with Privacy Law This statement seems to support Milton’s claim on today’s call that the WHOIS Conflicts with Privacy Law procedure has never been invoked: On 21 Aug 2018, at 20:55, Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> wrote: Given that to date no registrar or registry operator has formally invoked the Whois Procedure Kind regards, Ayden Férdeline On 21 Aug 2018, at 20:55, Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> wrote: Dear All, Per the action item from today’s meeting, please find attached the staff assessment and next steps report on the Revised ICANN Procedure for Handling WHOIS Conflicts with Privacy Law which was published in May 2017. As there were specific questions in relation to the origin of the procedure, I’ve excerpted the background section from this document below. As noted, the GNSO Council has already agreed to form an Implementation Advisory Group to review the procedure and adopted a charter for this effort in February of this year (see https://gnso.icann.org/en/council/resolutions#201802<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgnso.icann.org%2Fen%2Fcouncil%2Fresolutions%23201802&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952399814&sdata=WJqXY9ZS9EFT1m1avYwLzQHbT3o6l2AAon%2BU%2FoeY7j0%3D&reserved=0>). However, due to workload issues and the pending EPDP, the Council delayed the call for volunteers and agreed during its most recent meeting to decide when the call for volunteers should be launched following the publication of the Initial Report on the Temporary Specification by the EPDP Team. Best regards, Caitlin, Berry and Marika ============================ Background (from https://www.icann.org/en/system/files/files/whois-privacy-conflicts-procedure-03may17-en.pdf<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952399814&sdata=Gk6O8uK6dnajSzeV8xv%2F3rUx6fm5RXETNHjWMVjm%2FCg%3D&reserved=0>). In November 2005, the GNSO concluded a policy development process<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgnso.icann.org%2Fen%2Fissues%2Fwhois-privacy%2Fcouncil-rpt-18jan06.htm&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952409822&sdata=Vc7EwlUp9RjKtSOSRtAvcXfXuQhAzpduNwCo9bRHZA4%3D&reserved=0> (PDP) on Whois conflicts with privacy law which recommended that “In order to facilitate reconciliation of any conflicts between local/national mandatory privacy laws or regulations and applicable provisions of the ICANN contract regarding the collection, display and distribution of personal data via the gTLD Whois service, ICANN should: 1. Develop and publicly document a Procedure for dealing with the situation in which a registrar or registry can credibly demonstrate that it is legally prevented by local/national privacy laws or regulations from fully complying with applicable provisions of its ICANN contract regarding the collection, display and distribution of personal data via Whois. 2. Create goals for the procedure which include: * Ensuring that ICANN staff is informed of a conflict at the earliest appropriate juncture; * Resolving the conflict, if possible, in a manner conducive to ICANN's Mission, applicable Core Values, and the stability and uniformity of the Whois system; * Providing a mechanism for the recognition, if appropriate, in circumstances where the conflict cannot be otherwise resolved, of an exception to contractual obligations to those registries/registrars to which the specific conflict applies with regard to collection, display and distribution of personally identifiable data via Whois; and * Preserving sufficient flexibility for ICANN staff to respond to particular factual situations as they arise”. The ICANN Board of Directors adopted the recommendations in May 2006 and directed staff to develop such a Procedure. A draft Procedure was posted for public comment, and input was specifically solicited from the Governmental Advisory Committee (GAC). The GAC recommended adding a provision, which was included as section 1.4 in the procedure, urging a registrar or registry to work with relevant national governments to ensure adherence to domestic and international law, as well as applicable international conventions. If the Whois requirements require changes that ICANN determines prevent compliance with contractual Whois obligations, ICANN may refrain, on a provisional basis, from taking enforcement action for non-compliance, while ICANN prepares a public report and recommendation and submits it to the ICANN Board for a decision. Given that to date no registrar or registry operator has formally invoked the Whois Procedure, and yet numerous concerns have arisen from contracted parties and the wider community, ICANN launched a review in 2014, as provided in the Whois Procedure’s final clause. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flearn.icann.org%2Fcourses%2Fgnso&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952409822&sdata=IwV%2FoVI35K1EpCsySXi%2ByVQChRcCkxVZFMjmgqyureM%3D&reserved=0> and visiting the GNSO Newcomer pages<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fgnso.icann.org%2Fsites%2Fgnso.icann.org%2Ffiles%2Fgnso%2Fpresentations%2Fpolicy-efforts.htm%23newcomers&data=02%7C01%7Cmarksv%40microsoft.com%7C2158f84e56f24e1e26a108d607a03173%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636704781952419826&sdata=oJHiPRaRApE8LTrNGVIfVKoEUFwgo1xunGCxfTFi4q8%3D&reserved=0>. <whois-privacy-conflicts-procedure-03may17-en.pdf> _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team -- ___________ Alex Deacon Cole Valley Consulting alex@colevalleyconsulting.com<mailto:alex@colevalleyconsulting.com> +1.415.488.6009
I think we can agree on this: “A registrar or registry who thought ICANN obligations forced them to break the law would have to go through some kind of a process to demonstrate how applicable law prevented them from doing so.” So let’s set aside the references to the existing policy (Whois Conflicts of Law, Data Retention Waiver, or other) for now. Do we agree that this policy panel is empowered to define the updated processes whereby a registrar or registry who thought ICANN obligations forced them to break the law would demonstrate how applicable law prevented them from doing so? If so, do we agree that developing such policy/process is a good use of our time? From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of Mueller, Milton L Sent: Wednesday, August 22, 2018 09:39 To: Alex Deacon <alex@colevalleyconsulting.com> Cc: gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] ICANN Procedure for Handling WHOIS Conflicts with Privacy Law Thanks for the clarification, Alex. I understand better now how the Whois conflicts with law procedure got dragged into the discussion. That being said, I don’t think I can agree with your position. You state that “all obligations are subject to applicable law” but you are afraid that explicitly stating that language somehow empowers “one party” to decide for themselves what applicable laws require? I think that logically, that’s a non sequitur, and practically, the fear is completely unfounded. ICANN compliance can go after anyone who doesn’t comply with their contracts. A registrar or registry who thought ICANN obligations forced them to break the law would have to go through some kind of a process to demonstrate how applicable law prevented them from doing so. That process would not necessarily have to be the old, and defunct Whois conflicts with law procedure. I don’t see how including that language allows anyone to circumvent anything. --MM From: Alex Deacon [mailto:alex@colevalleyconsulting.com] Sent: Tuesday, August 21, 2018 6:23 PM To: Mueller, Milton L <milton@gatech.edu<mailto:milton@gatech.edu>> Cc: Mark Svancarek (CELA) <marksv@microsoft.com<mailto:marksv@microsoft.com>>; icann@ferdeline.com<mailto:icann@ferdeline.com>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] ICANN Procedure for Handling WHOIS Conflicts with Privacy Law Hi Milton, To be clear the point of my comment on the call this morning wasn't that the WHOIS conflicts procedure was somehow relevant to our ePDP, but that we need to rework the text currently in Temp Spec Appendix C.1 so what ends up in our final report so it doesn't create uncertainty or a mechanism to sidestep/avoid existing policy. "IPC agrees with the bulk of this section but strongly disagrees with the lead in language to this section, which makes the obligations subject to applicable laws. All obligations are subject to applicable laws, but for the sake of certainty, it is important that the obligations be clear and certain, and not subject to any one party’s view of what applicable laws require. There is an existing consensus policy and Process to govern conflicts between WHOIS obligations and National Data Protection Laws, and that will govern dealing with any conflict between those laws and such obligations. The language above appears to allow circumvention of that policy and process, and creates uncertainty. Therefore, in Section 1 the phrase “except as required by applicable laws and regulations” should be deleted, as it is unnecessary." Alex On Tue, Aug 21, 2018 at 2:36 PM Mueller, Milton L <milton@gatech.edu<mailto:milton@gatech.edu>> wrote: Actually Mark, Ayden is correct and yours is a misreading. You are confusing the RAA’s Data Retention Waiver Process with the Handling Whois Conflicts with Law procedure. They are, as your colleague says, “similar” in intent, but they are not the same. One is in the RAA, the other is not. So Ayden and I are correct, the Whois process has never been used; and your colleague is correct, the other procedure has been used 35 times. Having established some facts, it might be useful to back up and ask what this discussion is about and why it is relevant. In my opinion, this discussion is only relevant because some people seem to be suggesting that the Whois Conflicts with Law procedure can somehow rescue ICANN from the need to implement or revise the temp spec. If that is not your argument, and I have misinterpreted the significance of this discussion, then we can all save a lot of effort if you can explain why you think either the Whois Conflict w Law Procedure or the Data Retention Waiver Process are relevant to our ePDP. --MM From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>] On Behalf Of Mark Svancarek (CELA) via Gnso-epdp-team Sent: Tuesday, August 21, 2018 5:16 PM To: Ayden Férdeline <icann@ferdeline.com<mailto:icann@ferdeline.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] ICANN Procedure for Handling WHOIS Conflicts with Privacy Law I think that’s a misreading, sorry. It seems that35 waivers have been granted in 5 years. Here’s a clarification from Steve (posting on his behalf since he’s an alternate): If we read a little further into that May-2017 staff report<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7C66ee761feca0471b01a108d6084dd042%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636705527646576706&sdata=nDUyIKLdlMfDvOGXl0fK86USmabBS%2FbYtRHgIhPli2k%3D&reserved=0>, you’ll see that 35 registrars used a process similar to the Whois Conflicts policy to obtain waivers to contract requirements about retaining registrant data – based on applicable privacy laws (see excerpt from staff report below). It’s unfortunate we diverted today’s discussion the Whois Conflicts Policy, since the wide use of ICANN’s Data Retention Waiver Process is sufficient to explain the point we made about TempSpec Appendix C “Data Processing Requirements”. That is, we should rely on ICANN policy and processes to grant a waiver if/when applicable law conflicts with registrant data requirements in Registry and registrar agreements. But look at the first line of TempSpec App C.1 “Principles for Processing”: “Each Controller will observe the following principles to govern its Processing of Personal Data contained in Registration Data, except as required by applicable laws or regulations”. (italics added) That TempSpec text could imply that each registrar and registry can decide on its own to ignore any principles for processing – without first obtaining a waiver of the contractual requirement from ICANN. Here’s that excerpt from that May-2017 staff report<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7C66ee761feca0471b01a108d6084dd042%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636705527646586714&sdata=6TFiFpLQI9odcZnAN06kICggLlQUUba6OpzLvxExvyA%3D&reserved=0>, showing that 35 registrars have obtained waivers to contract requirements about retaining registrant data – based on applicable privacy laws: The 2013 Registrar Accreditation Agreement (“RAA”) Data Retention Waiver Process Under this Requests process, a registrar may request a compliance waiver of the data retention requirements, by presenting ICANN with a written opinion from a nationally recognized law firm, or ruling or written guidance from a government body that states that collecting or retaining one or more data elements in the manner required by the specification violates applicable law. A general assertion that the data collection and Data Retention Specification requirements are unlawful is not sufficient. Rather, the waiver request must specify the applicable law, the specific allegedly offending data collection and/or retention requirement(s), and the manner in which the collection and/or retention violates the law. This specificity helps ICANN to determine the appropriate limitations on the scope and duration of data collection and retention requirements when granting the waiver. This also helps ICANN balance the interests of the registrar, governments, and the broader Internet community when considering granting such waivers. In addition, if ICANN has previously waived compliance with the requirements for a registrar located in the same jurisdiction and the applying registrar is subject to the same applicable law, the registrar may request the same waiver. The 2013 RAA calls for ICANN and the registrar to discuss data retention waiver requests in good faith in an effort to reach a mutually acceptable resolution. The Data Retention Specification contemplates potential future modifications to the Whois Procedure in section 2 of the RAA.4 Because each country may interpret its data privacy requirements differently, ICANN is working through each of the submitted requests country-by-country. The complexity and diversity of national privacy laws has resulted in considerable investments of time and resources by ICANN and registrars alike. In countries with data privacy laws applicable to registrars, ICANN has found that restrictions generally permit the retention of registration data, but only for legitimate purposes, and for a period no longer than is necessary for the purposes for which the data were collected or for which they are further processed. What constitutes a legitimate purpose and how long data can be retained are complicated questions, and the answers may vary from one country to the next, even within the EU. As of April 2017, a total of 35 Data Retention Waivers were granted to registrars. From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Ayden Férdeline Sent: Tuesday, August 21, 2018 12:56 To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] ICANN Procedure for Handling WHOIS Conflicts with Privacy Law This statement seems to support Milton’s claim on today’s call that the WHOIS Conflicts with Privacy Law procedure has never been invoked: On 21 Aug 2018, at 20:55, Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> wrote: Given that to date no registrar or registry operator has formally invoked the Whois Procedure Kind regards, Ayden Férdeline On 21 Aug 2018, at 20:55, Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> wrote: Dear All, Per the action item from today’s meeting, please find attached the staff assessment and next steps report on the Revised ICANN Procedure for Handling WHOIS Conflicts with Privacy Law which was published in May 2017. As there were specific questions in relation to the origin of the procedure, I’ve excerpted the background section from this document below. As noted, the GNSO Council has already agreed to form an Implementation Advisory Group to review the procedure and adopted a charter for this effort in February of this year (see https://gnso.icann.org/en/council/resolutions#201802<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgnso.icann.org%2Fen%2Fcouncil%2Fresolutions%23201802&data=02%7C01%7Cmarksv%40microsoft.com%7C66ee761feca0471b01a108d6084dd042%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636705527646596723&sdata=fBV05tR7DA7Kwg8APf2BTVregUt01cEHNeGZ4J3IQhU%3D&reserved=0>). However, due to workload issues and the pending EPDP, the Council delayed the call for volunteers and agreed during its most recent meeting to decide when the call for volunteers should be launched following the publication of the Initial Report on the Temporary Specification by the EPDP Team. Best regards, Caitlin, Berry and Marika ============================ Background (from https://www.icann.org/en/system/files/files/whois-privacy-conflicts-procedure-03may17-en.pdf<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.icann.org%2Fen%2Fsystem%2Ffiles%2Ffiles%2Fwhois-privacy-conflicts-procedure-03may17-en.pdf&data=02%7C01%7Cmarksv%40microsoft.com%7C66ee761feca0471b01a108d6084dd042%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636705527646596723&sdata=AK6yixEcAQNW3wLy4Mw522BfNOT0rlhuOqxlxhMhS%2BI%3D&reserved=0>). In November 2005, the GNSO concluded a policy development process<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgnso.icann.org%2Fen%2Fissues%2Fwhois-privacy%2Fcouncil-rpt-18jan06.htm&data=02%7C01%7Cmarksv%40microsoft.com%7C66ee761feca0471b01a108d6084dd042%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636705527646606731&sdata=dyyT3z15moaEzXGdAFFkjbmqMHuw2M63I0sC5GYqhv0%3D&reserved=0> (PDP) on Whois conflicts with privacy law which recommended that “In order to facilitate reconciliation of any conflicts between local/national mandatory privacy laws or regulations and applicable provisions of the ICANN contract regarding the collection, display and distribution of personal data via the gTLD Whois service, ICANN should: 1. Develop and publicly document a Procedure for dealing with the situation in which a registrar or registry can credibly demonstrate that it is legally prevented by local/national privacy laws or regulations from fully complying with applicable provisions of its ICANN contract regarding the collection, display and distribution of personal data via Whois. 2. Create goals for the procedure which include: * Ensuring that ICANN staff is informed of a conflict at the earliest appropriate juncture; * Resolving the conflict, if possible, in a manner conducive to ICANN's Mission, applicable Core Values, and the stability and uniformity of the Whois system; * Providing a mechanism for the recognition, if appropriate, in circumstances where the conflict cannot be otherwise resolved, of an exception to contractual obligations to those registries/registrars to which the specific conflict applies with regard to collection, display and distribution of personally identifiable data via Whois; and * Preserving sufficient flexibility for ICANN staff to respond to particular factual situations as they arise”. The ICANN Board of Directors adopted the recommendations in May 2006 and directed staff to develop such a Procedure. A draft Procedure was posted for public comment, and input was specifically solicited from the Governmental Advisory Committee (GAC). The GAC recommended adding a provision, which was included as section 1.4 in the procedure, urging a registrar or registry to work with relevant national governments to ensure adherence to domestic and international law, as well as applicable international conventions. If the Whois requirements require changes that ICANN determines prevent compliance with contractual Whois obligations, ICANN may refrain, on a provisional basis, from taking enforcement action for non-compliance, while ICANN prepares a public report and recommendation and submits it to the ICANN Board for a decision. Given that to date no registrar or registry operator has formally invoked the Whois Procedure, and yet numerous concerns have arisen from contracted parties and the wider community, ICANN launched a review in 2014, as provided in the Whois Procedure’s final clause. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flearn.icann.org%2Fcourses%2Fgnso&data=02%7C01%7Cmarksv%40microsoft.com%7C66ee761feca0471b01a108d6084dd042%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636705527646616739&sdata=DE6ez6%2FeAdbwE1nMQWjH9CQsPkmrlvKyGBXFC9vxQwg%3D&reserved=0> and visiting the GNSO Newcomer pages<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fgnso.icann.org%2Fsites%2Fgnso.icann.org%2Ffiles%2Fgnso%2Fpresentations%2Fpolicy-efforts.htm%23newcomers&data=02%7C01%7Cmarksv%40microsoft.com%7C66ee761feca0471b01a108d6084dd042%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636705527646616739&sdata=%2BgxC841cQKxY%2B0dtQmBz6KeEAgBPwEyjlE6eM9kyNRk%3D&reserved=0>. <whois-privacy-conflicts-procedure-03may17-en.pdf> _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmm.icann.org%2Fmailman%2Flistinfo%2Fgnso-epdp-team&data=02%7C01%7Cmarksv%40microsoft.com%7C66ee761feca0471b01a108d6084dd042%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636705527646626744&sdata=4bYLyKaELFIokrPmd6bzdDJczz6vBz2Rr2J9ZqannSQ%3D&reserved=0> -- ___________ Alex Deacon Cole Valley Consulting alex@colevalleyconsulting.com<mailto:alex@colevalleyconsulting.com> +1.415.488.6009
participants (5)
-
Alex Deacon -
Ayden Férdeline -
Marika Konings -
Mark Svancarek (CELA) -
Mueller, Milton L