Re: [Gnso-epdp-team] [Ext] RE: For your review - feasibility of requiring unique contacts terminology, problem statement and examples
Thanks, Melina. Copying in the correct email address for the GNSO EPDP Team (please see message below). We’ll get your access to the google drive sorted shortly. Best regards, Caitlin, Berry and Marika From: STROUNGI Melina <Melina.STROUNGI@ec.europa.eu> Date: Tuesday, 19 January 2021 at 12:45 To: "gnso-epdp-team-bounces@icann.org" <gnso-epdp-team-bounces@icann.org>, Marika Konings <marika.konings@icann.org> Cc: NEMIGUENTCHEVA - GRAU Velimira <Velimira.GRAU@ec.europa.eu>, "LEWIS-EVANS, Christopher" <Christopher.Lewis-Evans@nca.gov.uk>, "Kapin, Laureen" <LKAPIN@ftc.gov> Subject: [Ext] RE: For your review - feasibility of requiring unique contacts terminology, problem statement and examples Dear Caitlin, Berry and Marika, Just to let you know that I do not appear to have access to the google docs below. I had requested access since yesterday but it doesn’t seem to have been authorized. In order to meet today’s deadline, please find some initial questions/comments from my side (copying also my GAC colleagues). If someone could insert them in the doc, where appropriate, it would be great. 1. On the B&B definition of pseudonymisation, currently defined as: “The same unique string is used for multiple registrations by a unique data subject.”--> By ‘multiple registrations’ we mean various registrations within the same registrar or within multiple registrars/registries? (Melina/GAC) Why do we need a different definition of pseudonymisation as compared to the one in GDPR? What is the added value of such definition? (Velimira/GAC) 1. According to the description of the specific exercise of Phase 2a, our goal/task is : “Addressing the feasibility of requiring unique contacts to have a uniform anonymized email address across domain name registrations at a given Registrar” Moreover, according to EPDP Team Recommendation #13: “The EPDP Team recommends that the Registrar MUST provide an email address or a web form to facilitate email communication with the relevant contact, but MUST NOT identify the contact email address or the contact itself”. -->Doesn’t this mean that the purpose of Phase 2a has been already defined and is limited to contactibility of the registrant? Or can we still consider including feasibility of correlation or registrations across multiple registrars? (Melina/GAC) 1. ENISA’s report on pseudonymisation techniques states that: ‘however, it is often not the choice of pseudonymisation technique utilised for one or two specific identifiers that causes the most problems; it is the implicit linkability among a set of pseudonyms and other data values that are joined into a more complex data structure’. The issue of linkability is precisely the point that we need to understand and this is precisely why an example of how pseudonymisation would work in the context of registries/registrars would be useful. We need to understand how this ‘unique string’ would be shared (if shared) across registries/registrars, if and to what extent they already exchange internally personal data and if such linkability would be possible from the side of third parties (if yes, how? By hacking/leaking the mapping table for example or also in any other way?). It is crucial for the purpose and success of the whole Phase 2a exercise to have a solid understanding on specific technical implementation details. To that end, specific case examples provided by the contracted parties would be very useful. Best, Melina From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Marika Konings Sent: Friday, January 15, 2021 8:56 PM To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] For your review - feasibility of requiring unique contacts terminology, problem statement and examples Dear EPDP Team, Per the action items from Thursday’s meeting, the staff support team has tried to pull together terminology, problem statements and examples for your review and input here: https://docs.google.com/document/d/1weQemSQ0-884ILbhmR3OLzUWouyGXMKH/edit<https://urldefense.com/v3/__https:/docs.google.com/document/d/1weQemSQ0-884ILbhmR3OLzUWouyGXMKH/edit__;!!DOxrgLBm!XBz7CoN8j7vSaR2hY5PgYVq3RC9NHMZZjjfKklby1k2ywidvwUtJiG8mYMitT8lVxZRm6_k$>. Please provide your group’s input by Tuesday 19 January COB. Also take note of the other documents that have been posted for review as part of the action items coming out of Thursday’s meeting (see https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8AdVdrRIdrw/edit#gid=0<https://urldefense.com/v3/__https:/docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8AdVdrRIdrw/edit*gid=0__;Iw!!DOxrgLBm!XBz7CoN8j7vSaR2hY5PgYVq3RC9NHMZZjjfKklby1k2ywidvwUtJiG8mYMitT8lVP5DQ140$>). Best regards, Caitlin, Berry and Marika
Many thanks Marika. Just a small note that the input is not yet 100% final; we may come back later to you in the course of today with further adjustments/additions. Best, Melina From: Marika Konings <marika.konings@icann.org> Sent: Tuesday, January 19, 2021 1:02 PM To: STROUNGI Melina (CNECT) <Melina.STROUNGI@ec.europa.eu>; gnso-epdp-team@icann.org Cc: NEMIGUENTCHEVA - GRAU Velimira (CNECT) <Velimira.GRAU@ec.europa.eu>; LEWIS-EVANS, Christopher <Christopher.Lewis-Evans@nca.gov.uk>; Kapin, Laureen <LKAPIN@ftc.gov> Subject: Re: [Ext] RE: For your review - feasibility of requiring unique contacts terminology, problem statement and examples Thanks, Melina. Copying in the correct email address for the GNSO EPDP Team (please see message below). We’ll get your access to the google drive sorted shortly. Best regards, Caitlin, Berry and Marika From: STROUNGI Melina <Melina.STROUNGI@ec.europa.eu<mailto:Melina.STROUNGI@ec.europa.eu>> Date: Tuesday, 19 January 2021 at 12:45 To: "gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>" <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>>, Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>> Cc: NEMIGUENTCHEVA - GRAU Velimira <Velimira.GRAU@ec.europa.eu<mailto:Velimira.GRAU@ec.europa.eu>>, "LEWIS-EVANS, Christopher" <Christopher.Lewis-Evans@nca.gov.uk<mailto:Christopher.Lewis-Evans@nca.gov.uk>>, "Kapin, Laureen" <LKAPIN@ftc.gov<mailto:LKAPIN@ftc.gov>> Subject: [Ext] RE: For your review - feasibility of requiring unique contacts terminology, problem statement and examples Dear Caitlin, Berry and Marika, Just to let you know that I do not appear to have access to the google docs below. I had requested access since yesterday but it doesn’t seem to have been authorized. In order to meet today’s deadline, please find some initial questions/comments from my side (copying also my GAC colleagues). If someone could insert them in the doc, where appropriate, it would be great. 1. On the B&B definition of pseudonymisation, currently defined as: “The same unique string is used for multiple registrations by a unique data subject.”--> By ‘multiple registrations’ we mean various registrations within the same registrar or within multiple registrars/registries? (Melina/GAC) Why do we need a different definition of pseudonymisation as compared to the one in GDPR? What is the added value of such definition? (Velimira/GAC) 1. According to the description of the specific exercise of Phase 2a, our goal/task is : “Addressing the feasibility of requiring unique contacts to have a uniform anonymized email address across domain name registrations at a given Registrar” Moreover, according to EPDP Team Recommendation #13: “The EPDP Team recommends that the Registrar MUST provide an email address or a web form to facilitate email communication with the relevant contact, but MUST NOT identify the contact email address or the contact itself”. -->Doesn’t this mean that the purpose of Phase 2a has been already defined and is limited to contactibility of the registrant? Or can we still consider including feasibility of correlation or registrations across multiple registrars? (Melina/GAC) 1. ENISA’s report on pseudonymisation techniques states that: ‘however, it is often not the choice of pseudonymisation technique utilised for one or two specific identifiers that causes the most problems; it is the implicit linkability among a set of pseudonyms and other data values that are joined into a more complex data structure’. The issue of linkability is precisely the point that we need to understand and this is precisely why an example of how pseudonymisation would work in the context of registries/registrars would be useful. We need to understand how this ‘unique string’ would be shared (if shared) across registries/registrars, if and to what extent they already exchange internally personal data and if such linkability would be possible from the side of third parties (if yes, how? By hacking/leaking the mapping table for example or also in any other way?). It is crucial for the purpose and success of the whole Phase 2a exercise to have a solid understanding on specific technical implementation details. To that end, specific case examples provided by the contracted parties would be very useful. Best, Melina From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Marika Konings Sent: Friday, January 15, 2021 8:56 PM To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] For your review - feasibility of requiring unique contacts terminology, problem statement and examples Dear EPDP Team, Per the action items from Thursday’s meeting, the staff support team has tried to pull together terminology, problem statements and examples for your review and input here: https://docs.google.com/document/d/1weQemSQ0-884ILbhmR3OLzUWouyGXMKH/edit<https://urldefense.com/v3/__https:/docs.google.com/document/d/1weQemSQ0-884ILbhmR3OLzUWouyGXMKH/edit__;!!DOxrgLBm!XBz7CoN8j7vSaR2hY5PgYVq3RC9NHMZZjjfKklby1k2ywidvwUtJiG8mYMitT8lVxZRm6_k$>. Please provide your group’s input by Tuesday 19 January COB. Also take note of the other documents that have been posted for review as part of the action items coming out of Thursday’s meeting (see https://docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8AdVdrRIdrw/edit#gid=0<https://urldefense.com/v3/__https:/docs.google.com/spreadsheets/d/17qLMYb3HC7qGYPQveXbUq5ZSzvedrQ3t8AdVdrRIdrw/edit*gid=0__;Iw!!DOxrgLBm!XBz7CoN8j7vSaR2hY5PgYVq3RC9NHMZZjjfKklby1k2ywidvwUtJiG8mYMitT8lVP5DQ140$>). Best regards, Caitlin, Berry and Marika
participants (2)
-
Marika Konings -
STROUNGI Melina