Thanks, Thomas. Please note that in other to facilitate that conversation, staff put together the following document: https://docs.google.com/document/d/1-rdfchOwpANFVKOtnM_9bPp-zT4JAvTN8dJqebdi... which basically pulled out this information from the different data elements workbooks. Input was in principle due last Friday, but in order to help inform the discussion, it would be really helpful if you could mark specifically which responsibilities may need updating / streamlining and why so this can help focus further discussions. With regards to the Initial Report, note that as work on the data elements workbooks and other outstanding items (as flagged in blue in the Initial Report) is completed, this will get copied / pasted into the relevant sections and as such should not prevent review of the other parts of the Initial Report. We understand that the timeline is putting a lot of pressure on everyone to review the information in a timely manner, but unfortunately there is very little flexibility in the timeline with the original publication data already being pushed out by two weeks from the original timeline (any additional time here, will mean less time for the remaining phases of work). Best regards, Caitlin, Berry and Marika From: Thomas Rickert <epdp@gdpr.ninja> Date: Monday, November 5, 2018 at 10:24 AM To: Marika Konings <marika.konings@icann.org> Cc: Thomas Rickert <epdp@gdpr.ninja>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: [Ext] Re: [Gnso-epdp-team] Proposed Agenda and items for input - EPDP Team Meeting #23 Hi Marika, May I ask for an additional point to be added to the agenda? It is relating to the responsibilities of the parties. Looking at all the work sheets, there are a few processing activities, for which the parties are not joint controllers, but where we have controller-processor relationships. I am not sure this is the best possible outcome and I would like to have a discussion about streamlining this. In my view, it is possible to make more points part of the joint controller situation and take care of the responsibilities in the joint controller agreement by allocating responsibilities to specific parties and add indemnification clauses to get to the intended results. Also, it is difficult to work on the draft report and provide input while work books and other input is not yet stable. Can we please get more time to review a stable version of the draft initial report? Best, Thomas Am 05.11.2018 um 17:05 schrieb Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>: Dear All, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 5 November at 14.00 UTC. In relation to agenda item 4, please review the following and provide your feedback on the mailing list to help inform the discussion. * Technical contact consent In relation to the data elements that are optional to provide for the Registered Name Holder (RNH), the following language was added to the preliminary recommendation to reflect that the registrar may not have a direct contractual relationship with the data subject whose information is provided by the RNH: If the Registered Name Holder elects to provide contact information for a technical contact who does not have a direct contractual relationship with the registrar, the registrar is required to redact or obtain all necessary consent from the technical contact prior to publication. However, noting that it is currently not proposed that technical contact information would be published, we would suggest making the following update: If the Registered Name Holder elects to provide contact information for a technical contact who does not have a direct contractual relationship with the registrar, the registrar is required to redact or obtain all necessary consent from the technical contact prior to publication any disclosure. Question for the EPDP Team: are you comfortable with the inclusion of this revised language as part of preliminary recommendation #10? If not, please provide your rationale and proposed changes / edits prior to the meeting. * Data retention This recommendation is derived from Data Elements Workbook A. Are there any concerns about this recommendation? The EPDP Team recommends that Registrars are required to retain the herein-specified data elements for a period of one year following the life of the registration. This retention period conforms to the specific statute of limitations within the Transfer Dispute Resolution Policy (“TDRP”). Other relevant parties, including Registries, escrow providers and ICANN Compliance, have separate retention periods less than or equal to one year accordingly and in line with the GDPR requirements. Question for the EPDP Team: are you comfortable with the inclusion of this preliminary recommendation? If not, please provide your rationale and proposed changes / edits prior to the meeting. Note that in relation to small team #1 and #2 discussions, the leadership team will be putting forward a proposed path forward shortly. Best regards, Caitlin, Berry and Marika EPDP Meeting #23 Agenda Tuesday, 5 November 2018 1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Proposed approach for reviewing and finalizing the Initial Report * Update on F2F planning * Proposed next steps in relation to small team #1 and #2 language for inclusion in the Initial Report * Review of outstanding action items * Other updates, if applicable 1. Review of outstanding items for Initial Report and proposed approach Objective of discussion: 1. Confirm list of outstanding items to be considered in relation to Initial Report and approach for addressing these * Review outstanding issues punch list (to be circulated) * Confirm approach for addressing these * Confirm next steps, if any 1. Commence addressing outstanding items * Technical contact redaction – any concerns in relation to proposed language for inclusion in the Initial Report? * Data retention – any concerns in relation to proposed language for inclusion in the Initial Report? * Confirm next steps, if any 1. Wrap and confirm next meeting to be scheduled for Thursday 8 November at 14.00 UTC. * Confirm action items * Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_...> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...>. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team

Thanks, Matt. It probably would be helpful for the EPDP Team to see them as they are ready so if you could add them to the google doc (https://docs.google.com/document/d/1SoNTnvvadNQ8nX_-OxN4mtsd-gfLNxT54GXSXyGQ...) as you progress, that would be really helpful. Thanks, Marika From: Matt Serlin <matt@brandsight.com> Date: Monday, November 5, 2018 at 11:00 AM To: Marika Konings <marika.konings@icann.org>, Thomas Rickert <epdp@gdpr.ninja> Cc: "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] [Ext] Re: Proposed Agenda and items for input - EPDP Team Meeting #23 Hi Marika, On behalf of the RrSG, I am writing to let you know our comments on the initial report will not be completed today. We are not in a position to commit to a specific day to get them submitted at this point, but we are working to get them done as quickly as possible while taking time to ensure we review the entire document and all of the recommendations. Additionally, curious if it would be useful for you all to receive comments as we have them completed by line number or if you’d prefer to wait and receive everything in totality? Best regards, Matt From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of Marika Konings <marika.konings@icann.org> Date: Monday, November 5, 2018 at 9:55 AM To: Thomas Rickert <epdp@gdpr.ninja> Cc: "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] [Ext] Re: Proposed Agenda and items for input - EPDP Team Meeting #23 Thanks, Thomas. Please note that in other to facilitate that conversation, staff put together the following document: https://docs.google.com/document/d/1-rdfchOwpANFVKOtnM_9bPp-zT4JAvTN8dJqebdi... [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_documen...> which basically pulled out this information from the different data elements workbooks. Input was in principle due last Friday, but in order to help inform the discussion, it would be really helpful if you could mark specifically which responsibilities may need updating / streamlining and why so this can help focus further discussions. With regards to the Initial Report, note that as work on the data elements workbooks and other outstanding items (as flagged in blue in the Initial Report) is completed, this will get copied / pasted into the relevant sections and as such should not prevent review of the other parts of the Initial Report. We understand that the timeline is putting a lot of pressure on everyone to review the information in a timely manner, but unfortunately there is very little flexibility in the timeline with the original publication data already being pushed out by two weeks from the original timeline (any additional time here, will mean less time for the remaining phases of work). Best regards, Caitlin, Berry and Marika From: Thomas Rickert <epdp@gdpr.ninja> Date: Monday, November 5, 2018 at 10:24 AM To: Marika Konings <marika.konings@icann.org> Cc: Thomas Rickert <epdp@gdpr.ninja>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: [Ext] Re: [Gnso-epdp-team] Proposed Agenda and items for input - EPDP Team Meeting #23 Hi Marika, May I ask for an additional point to be added to the agenda? It is relating to the responsibilities of the parties. Looking at all the work sheets, there are a few processing activities, for which the parties are not joint controllers, but where we have controller-processor relationships. I am not sure this is the best possible outcome and I would like to have a discussion about streamlining this. In my view, it is possible to make more points part of the joint controller situation and take care of the responsibilities in the joint controller agreement by allocating responsibilities to specific parties and add indemnification clauses to get to the intended results. Also, it is difficult to work on the draft report and provide input while work books and other input is not yet stable. Can we please get more time to review a stable version of the draft initial report? Best, Thomas Am 05.11.2018 um 17:05 schrieb Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>: Dear All, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 5 November at 14.00 UTC. In relation to agenda item 4, please review the following and provide your feedback on the mailing list to help inform the discussion. * Technical contact consent In relation to the data elements that are optional to provide for the Registered Name Holder (RNH), the following language was added to the preliminary recommendation to reflect that the registrar may not have a direct contractual relationship with the data subject whose information is provided by the RNH: If the Registered Name Holder elects to provide contact information for a technical contact who does not have a direct contractual relationship with the registrar, the registrar is required to redact or obtain all necessary consent from the technical contact prior to publication. However, noting that it is currently not proposed that technical contact information would be published, we would suggest making the following update: If the Registered Name Holder elects to provide contact information for a technical contact who does not have a direct contractual relationship with the registrar, the registrar is required to redact or obtain all necessary consent from the technical contact prior to publication any disclosure. Question for the EPDP Team: are you comfortable with the inclusion of this revised language as part of preliminary recommendation #10? If not, please provide your rationale and proposed changes / edits prior to the meeting. * Data retention This recommendation is derived from Data Elements Workbook A. Are there any concerns about this recommendation? The EPDP Team recommends that Registrars are required to retain the herein-specified data elements for a period of one year following the life of the registration. This retention period conforms to the specific statute of limitations within the Transfer Dispute Resolution Policy (“TDRP”). Other relevant parties, including Registries, escrow providers and ICANN Compliance, have separate retention periods less than or equal to one year accordingly and in line with the GDPR requirements. Question for the EPDP Team: are you comfortable with the inclusion of this preliminary recommendation? If not, please provide your rationale and proposed changes / edits prior to the meeting. Note that in relation to small team #1 and #2 discussions, the leadership team will be putting forward a proposed path forward shortly. Best regards, Caitlin, Berry and Marika EPDP Meeting #23 Agenda Tuesday, 5 November 2018 1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Proposed approach for reviewing and finalizing the Initial Report * Update on F2F planning * Proposed next steps in relation to small team #1 and #2 language for inclusion in the Initial Report * Review of outstanding action items * Other updates, if applicable 1. Review of outstanding items for Initial Report and proposed approach Objective of discussion: 1. Confirm list of outstanding items to be considered in relation to Initial Report and approach for addressing these * Review outstanding issues punch list (to be circulated) * Confirm approach for addressing these * Confirm next steps, if any 1. Commence addressing outstanding items * Technical contact redaction – any concerns in relation to proposed language for inclusion in the Initial Report? * Data retention – any concerns in relation to proposed language for inclusion in the Initial Report? * Confirm next steps, if any 1. Wrap and confirm next meeting to be scheduled for Thursday 8 November at 14.00 UTC. * Confirm action items * Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_...> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...>. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team

Hi Alan: Thanks for your email and the thought that went into this document. I have some questions, not to contradict but to understand. My first question is about my understanding of roles and responsibilities. Is my assessment below correct? I understand that there are additional data streams to those described in the draft initial report, However, I think we have identified the ones that spring from contracted parties’ agreement with ICANN, ICANN's mission, and the requirements therein. Data streams outside of this need not be considered for this ICANN-policy-making exercise. Therefore, the data maps in each of the workbooks contain only these ICANN-specific data streams. In a similar vein, data processing activities that do not have an ICANN purpose need not be included here. Registries and registrars carry on the rest of their data processing activities without being under consensus policy. Therefore, all the processing activities we include in this policy must at least have an ICANN purpose (and the majority of purposes listed also have a contracted parties purpose). The EDPB input identifies both ICANN and contracted parties as controllers in many scenarios. That means that there can be (and often is, in our case) two or more controllers for these processes. Whether these require joint-controller agreements is something we have discussed (but not to conclusion) in our meetings. If my description above is correct, what data streams have we missed that should be included? If my description is incorrect, help me get clear on that so we can create a proper document. To move forward on this in the meeting tomorrow, I’d like to have Thomas introduce the points made in his email and corresponding recommendations. Then, as part of that discussion, Alan, you can come in and make recommendations commensurate with the points you have raised in your document. If additional study / work is required, we can assign a few team members to that. Let me know what your thinking is on my thoughts above and plan for proceeding. Best regards, Kurt

Begin forwarded message:

From: Alan Woods <alan@donuts.email> Subject: Re: [Gnso-epdp-team] Proposed Agenda and items for input - EPDP Team Meeting #23 Date: November 5, 2018 at 8:55:21 AM PST To: Thomas Rickert <epdp@gdpr.ninja> Cc: GNSO EPDP <gnso-epdp-team@icann.org>

Dear Marika and team,

After much deliberation by the teams noting Thomas' comment relating to Roles and Responsibilities, I am blatantly using this as a segue: we do have a specific comment to make on the "Processing Activities & Responsible Parties document".

The CPH have jointly outlined some concerns outlined in these comments. Apologies for the delay, but all these issues demand careful though and there are many such demands on us all at this moment (I fully appreciate on you guys too .. so again very sorry!)

Kind regards,

Alan Woods

<http://donuts.domains/> Alan Woods Senior Compliance & Policy Manager, Donuts Inc. The Victorians, 15-18 Earlsfort Terrace Dublin 2, County Dublin Ireland

<https://www.facebook.com/donutstlds> <https://twitter.com/DonutsInc> <https://www.linkedin.com/company/donuts-inc> Please NOTE: This electronic message, including any attachments, may include privileged, confidential and/or inside information owned by Donuts Inc. . Any distribution or use of this communication by anyone other than the intended recipient(s) is strictly prohibited and may be unlawful. If you are not the intended recipient, please notify the sender by replying to this message and then delete it from your system. Thank you.

On Mon, Nov 5, 2018 at 4:24 PM Thomas Rickert <epdp@gdpr.ninja> wrote: Hi Marika, May I ask for an additional point to be added to the agenda?

It is relating to the responsibilities of the parties. Looking at all the work sheets, there are a few processing activities, for which the parties are not joint controllers, but where we have controller-processor relationships. I am not sure this is the best possible outcome and I would like to have a discussion about streamlining this. In my view, it is possible to make more points part of the joint controller situation and take care of the responsibilities in the joint controller agreement by allocating responsibilities to specific parties and add indemnification clauses to get to the intended results.

Also, it is difficult to work on the draft report and provide input while work books and other input is not yet stable. Can we please get more time to review a stable version of the draft initial report?

Best, Thomas

...

Am 05.11.2018 um 17:05 schrieb Marika Konings <marika.konings@icann.org <mailto:marika.konings@icann.org>>:

Dear All,

Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 5 November at 14.00 UTC. In relation to agenda item 4, please review the following and provide your feedback on the mailing list to help inform the discussion.

Technical contact consent In relation to the data elements that are optional to provide for the Registered Name Holder (RNH), the following language was added to the preliminary recommendation to reflect that the registrar may not have a direct contractual relationship with the data subject whose information is provided by the RNH: If the Registered Name Holder elects to provide contact information for a technical contact who does not have a direct contractual relationship with the registrar, the registrar is required to redact or obtain all necessary consent from the technical contact prior to publication. However, noting that it is currently not proposed that technical contact information would be published, we would suggest making the following update: If the Registered Name Holder elects to provide contact information for a technical contact who does not have a direct contractual relationship with the registrar, the registrar is required to redact or obtain all necessary consent from the technical contact prior to publication any disclosure.

Question for the EPDP Team: are you comfortable with the inclusion of this revised language as part of preliminary recommendation #10? If not, please provide your rationale and proposed changes / edits prior to the meeting.

Data retention This recommendation is derived from Data Elements Workbook A. Are there any concerns about this recommendation? The EPDP Team recommends that Registrars are required to retain the herein-specified data elements for a period of one year following the life of the registration. This retention period conforms to the specific statute of limitations within the Transfer Dispute Resolution Policy (“TDRP”). Other relevant parties, including Registries, escrow providers and ICANN Compliance, have separate retention periods less than or equal to one year accordingly and in line with the GDPR requirements.

Question for the EPDP Team: are you comfortable with the inclusion of this preliminary recommendation? If not, please provide your rationale and proposed changes / edits prior to the meeting.

Note that in relation to small team #1 and #2 discussions, the leadership team will be putting forward a proposed path forward shortly.

Best regards,

Caitlin, Berry and Marika

<>EPDP Meeting #23 Agenda <> Tuesday, 5 November 2018

Roll Call & SOI Updates (5 minutes) Welcome and Updates from EPDP Team Chair (5 minutes) Proposed approach for reviewing and finalizing the Initial Report Update on F2F planning Proposed next steps in relation to small team #1 and #2 language for inclusion in the Initial Report Review of outstanding action items Other updates, if applicable

Review of outstanding items for Initial Report and proposed approach

Objective of discussion: Confirm list of outstanding items to be considered in relation to Initial Report and approach for addressing these

Review outstanding issues punch list (to be circulated) Confirm approach for addressing these Confirm next steps, if any

Commence addressing outstanding items

Technical contact redaction – any concerns in relation to proposed language for inclusion in the Initial Report? Data retention – any concerns in relation to proposed language for inclusion in the Initial Report? Confirm next steps, if any

Wrap and confirm next meeting to be scheduled for Thursday 8 November at 14.00 UTC. Confirm action items Confirm questions for ICANN Org, if any

Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org <mailto:marika.konings@icann.org>

Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses <https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_...> and visiting the GNSO Newcomer pages <https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gns...>.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team>

---

Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team>_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team