Marc, thank you for the RySG input. Please find below in blue some responses / feedback in relation to your comments. Best regards, Caitlin, Berry and Marika From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of "Anderson, Marc via Gnso-epdp-team" <gnso-epdp-team@icann.org> Reply-To: "Anderson, Marc" <mcanderson@verisign.com> Date: Monday, November 5, 2018 at 4:12 PM To: "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] General RySG comments on the first draft of the ePDP initial report General RySG comments on the first draft of the ePDP initial report The RySG ePDP team is submitting the following general comments on the draft initial report dated 1 November 2018. We are simultaneously working on more detailed and substantive feedback to the specific points of the Report, but felt it was important to go on the record with this high-level feedback as soon as possible, given the short time remaining until the 19 November target to publish that report. To provide context for this feedback, we would like to remind the ePDP Leadership and Working Group of the RySG’s goal statement for participating in the ePDP: The Registries Stakeholder Group’s goal is to participate actively and in good faith towards a consensus policy that addresses the questions set forth in the EPDP Charter. The RySG believes that any consensus policy developed by the EPDP must provide a clear path for compliance with the GDPR, be commercially reasonable and implementable, takes into account our differing business models, and does not inhibit innovation. Months into our work, this statement still reflects our goals for this working group and the lens through which we view the preliminary draft of the Initial Report. Scope of the Initial Report The RySG ePDP team wishes to emphasize that the focus of the Initial Report for this first phase of the ePDP should be on affirming or altering the requirements of the Temporary Specification to ensure that ICANN’s contracted parties are able to comply with the GDPR in fulfilling the services they are required to provide. As currently drafted, the Initial Report does not make clear whether the scope of the ePDP includes only RDDS or all data processing activities undertaken by ICANN’s contracted parties; we recommend that such a distinction be made clearly at the outset of the Report. We also recommend that the Report provide answers to all the Charter questions that pertain to this first phase of the ePDP’s work. Any items that fall outside of the scope as stated above should be reserved for a later phase of the ePDP and, by extension, a subsequent report. Thanks for your feedback. We look forward to receiving suggestions for how to clarify the scope further beyond the language that is quoted from the charter. Highlighted in red are the charter questions for which no draft response is currently provided, but the hope is that some willing volunteers will be able to suggest proposed language for inclusion. Please note that no issues or questions related to the second phase of the EPDP’s work have been included. The report and the policy recommendations contained therein should be straightforward and easy to understand The report as currently drafted is difficult to read and understand, in particular for those readers who have not been actively participating in or consistently observing the work of the ePDP. We recommend that ICANN staff take particular care in explaining the terminology used in the report and providing sufficient context around the discussions that led up to the conclusions reached, where necessary. Furthermore, as the ePDP charter calls for this Initial Report to be sent to the EDPB for feedback on the applicability of the law in relation to the proposed recommendations, it is particularly important that the Report and attendant policy recommendations be written in a clear and straightforward manner that can facilitate such a review. Staff will review the draft Initial Report and aim to clarify terminology where possible. One option would be to include a glossary that explains in further detail some of the terminology that is used in the Initial Report? In relation to the EDPB, the idea would be to focus the questions for the EDPB in a separate letter as feedback has indicated that it is unlikely that the EDPB would review the Initial Report in its entirety. Of course, the Initial Report would be included as well, but the EPDP Team may want to focus on which questions and/or recommendations it may want to call specific attention to and call those out separately. Of course, any recommendations for making the policy recommendations clearer are welcome! Use of the purpose workbooks We believe that one of the reasons the current draft of the Initial Report is so difficult to follow is because it relies so heavily on the purpose worksheets that the Working Group developed. The RySG understood these worksheets to be a tool to aid the deliberations of the Working Group. The text contained in the worksheets has little meaning outside of the context of the discussion and deliberations of the Working Group and as such the workbooks are not suitable for wholesale inclusion in the Initial Report. We are also concerned that the completed worksheets have not been fully vetted by the ePDP Working Group. The Group’s deliberations have focused primarily on the purpose statement itself and the Group has not discussed the later sections of the worksheets in depth if at all, particularly since new versions of the worksheets were published following ICANN 63. Despite this fact, the Initial Report relies heavily on these later sections of the worksheets. Given the lack of discussion and, by extension, the absence of agreement on these portions, we find this approach to be problematic. The idea is to include the data elements workbooks as an annex so those interested can refer to it, but distill the most relevant parts into the body of the Initial Report which has already been done for a number of the Charter Questions that pertain to parts of the data elements workbooks. The EPDP Team was requested to review all data element workbooks by Friday 2 November to flag any issues that needed further discussion / consideration. So far, only input has been received in relation to purpose M and the responsibilities assigned to the different parties which have been added to the list of items to be further considered. If there are other areas that need further consideration, please call these out as soon as possible. Source of the (26) policy recommendations While the Initial Report devotes substantial text to the worksheets, it is not clear to the RySG ePDP team how the 26 preliminary policy recommendations were developed. There seems to be no clear connection between the discussions of the Working Group thus far and the specific recommendations contained in the Initial Report. We note the disclaimer on page 9 that “all content, and especially the draft recommendations will need to be cross-checked with the final language agreed to by the ePDP team before publication”. To aid in that cross-checking, it would be helpful if staff could cite the provenance of each recommendation, whether it be discussions during a particular meeting(s),one of the purpose worksheets, or an email thread. In light of the lack of clarity around the source of the 26 policy recommendations, the RySG ePDP team is particularly concerned about their presentation in the Initial Report. The phrasing of the recommendations implies that the Working Group reached consensus on these recommendations, and it is our understanding that no such consensus has yet been achieved. The initial report should not present recommendations on items where the group did not reach consensus. The majority of the policy recommendations are direct results of the work on the data elements workbooks and aim to reflect those (Preliminary Recommendations #1, #4, #5, #6, #7, #8, #9, #10, #11, #15, #17). Others are: * The result of policy recommendations that were agreed to in the context of the discussion on the data elements workbooks (Preliminary recommendation #2, #3), * Small team efforts (Preliminary Recommendations #12, #13, #14, #16), * Suggested during the LA F2F meeting in the context of a small group discussion (#18), * Derived from the discussions on the triage report and input provided in response to the triage survey (Preliminary Recommendations #19, #20, #21, #22, #23, #24, #25), * Aiming to capture recent discussions (Preliminary Recommendation #26). Do note that all items in blue in the Initial Report are still under discussion / review. The EPDP Team was asked to flag any other preliminary recommendations that require further discussion by Monday 5 November so that these can be added to the list of outstanding items. Ability to implement policy recommendations In addition to our concerns about the presentation of the policy recommendations in the Initial Report, it is also not immediately clear what the implementation impacts of those recommendations will be. As one of the parties who will have to implement the policy recommendations contained in the Final Report, it is important to us that such implications are duly considered when developing the recommendations. Please suggest language for inclusion in the report to capture this aspect. The Initial Report is expected to capture “A statement on the WG discussion concerning impact of the proposed recommendations, which could consider areas such as economic, competition, operations, privacy and other rights, scalability and feasibility” so this contribution will be very helpful in that regard. Similarly, this is usually also a question that is called out for public comment. Questions for community The draft of the Initial Report lists 10 questions for the community. The RySG ePDP team feels there are additional questions on which we should be asking the community to supply feedback, and will be providing suggestions along with our detailed comments. Great, thank you. Closing thoughts The RySG ePDP team wants to thank Staff and the Leadership team for all their hard work assembling this draft and their support getting us this far. We realize this is a first draft and work in progress. As stated we are working on specific and substantive comments for more detailed review but hope these general comments will be helpful as we move from first draft to a final version of the Initial Report. Marc Anderson mcanderson@verisign.com<mailto:mcanderson@verisign.com> Cell: 571.521.9943 Office: 703.948.3404 12061 Bluemont Way, Reston, VA 20190 Verisign.com [verisign.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.verisign.com_&d=DwMF...> [Description: Description: Description: Verisign™]