Milton, Thank you for sharing your concerns. I clearly see your point and in some circumstances would be very sympathetic to them. Especially if our task would be to develop use cases for students to learn. But this is not a case. We are using cases to identify commonalities that would allow us, the Team, to develop policy recommendations how to best implement provisions of GDPR. Use cases are just a method that allows us to focus our attention to all necessary aspects of future policy recommendations. Therefore, cases need not be ideally drafted but rather represent/outline real life situations and help us understand concerns of different groups. And we should not try to agree on every word in the case, but rather to seek common understanding/ touch-points. I would propose that we look at your proposal of use cases merger by e-mail exchange and in the meantime, take most supported cases and discuss them thru as suggested - thoroughly but quickly. I invite other Team members to join the conversation on Milton's proposal. Thank you JK On Wed, Jul 17, 2019 at 10:16 AM Mueller, Milton L <milton@gatech.edu> wrote:

Marika

Several participants in the EPDP have not taken the survey yet and you have closed the survey so we can’t add our responses. Please re-open. It is not a proper survey of rankings if it does not include all representative entities on the EPDP. I am sorry NCSG did not fill it out on time but we are distributed over multiple continents, and have to read 21 cases each with 5 or 6 pages, and then coordinate a response.

In general, I don’t think you should maintain the fiction that staff or chair can set an arbitrary deadline and then cut off all discussion when that deadline is not met. It is a violation of proper process.

I expect to see the survey reopened so that NCSG, GAC, ALAC can provide their input.

It also became clear to us that the rankings depend heavily on how we consolidate cases. In our view, there is a huge amount of overlap and duplication amongst the proposed cases. We should not be ranking and considering them until we know how they are going to be consolidated or grouped. And they will be consolidated, have not doubt about it; and if we discuss these cases before consolidating them we will be wasting massive amounts of time.

I suspect you think you are saving time by pushing these arbitrary cutoffs upon us but in fact you are not. By truncating discussions you are preventing us from coming to an agreement. This will just lead to additional contention.

Dr. Milton L Mueller

Georgia Institute of Technology

School of Public Policy

*From:* Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> *On Behalf Of *Marika Konings *Sent:* Tuesday, July 16, 2019 12:39 PM *To:* gnso-epdp-team@icann.org *Subject:* [Gnso-epdp-team] Materials for agenda item #4

Dear EPDP Team,

In preparation for agenda item #4, please find attached the proposed order based on the responses received to the survey. Do note that this schedule is not carved in stone, but based on the speed of review, it will be adjusted as needed. As a reminder and discussed during the last meeting, the following approach will be followed:

· First reading of use case on one call (typically 30 min), followed by second/final reading on next call (typically 60 min);

· EPDP Team members to identify during the first reading which sections they have an issue and briefly describe its nature. After the call, member should submit edit/view/proposal in writing by Friday (COB). Staff support team to produce updated version based on inputs provided during first reading for the second reading and will disseminate the updated text by Tuesday;

· Aim of readings is to reach a broad understanding of all members on different aspects of the case rather than agreement on each word in the presented case.

Please take specific note of the following: “After the call, member should submit edit/view/proposal in writing by Friday (COB)” which will apply for the use case that will have its first reading during Thursday’s meeting.

Best regards,

Caitlin, Berry and Marika

*From: *Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of Marika Konings <marika.konings@icann.org> *Date: *Monday, July 15, 2019 at 08:32 *To: *"gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> *Subject: *[Gnso-epdp-team] Proposed agenda - EPDP Team meeting #9 on 18 July 2019

Dear EPDP Team,

Please find hereby the proposed agenda for the next EPDP Team meeting which is scheduled for Thursday 18 July at 14.00 UTC. As a reminder:

EPDP Team to review the updated LEA use case and provide feedback by Tuesday, 16 July.

*16 July 2019*

EPDP Team to respond to survey ranking use cases ( https://www.surveymonkey.com/r/YS597PR)

*15 July 2019*

Best regards,

Caitlin, Berry and Marika

=================

*EPDP Phase 2 - Meeting #9 *

*Proposed Agenda*

Thursday, 18 July 2019 at 14.00 UTC

1. Roll Call & SOI Updates (5 minutes)

2. Confirmation of agenda (Chair)

3. Welcome and housekeeping issues (Chair) (10 minutes)

· Update from Legal Committee

4. Use Cases Ranking Exercise (10 minutes)

· Overview of use cases submitted: https://community.icann.org/x/-KCjBg

· Confirm results of ranking exercise

· Confirm leadership proposed order and next steps

5. Use case – second reading: Investigation of criminal activity against a victim in the jurisdiction of the investigating EU LEA requesting data from a non-local data controller <https://community.icann.org/download/attachments/111386876/Use%20Case%20-%20GAC%20LEA1%20-%207%20July%202019.docx?version=1&modificationDate=1562565249000&api=v2> (30 minutes)

· Consider concerns / issues expressed on the mailing list prior to the meeting

· Preliminary agreement on use case

· Confirm next steps, if any

6. Use case – first reading: Investigation of criminal activity where domain names are used. Typical specific example: phishing attack <https://community.icann.org/download/attachments/111386876/SSAC%20Crime-Abuse%20Investigation%20Use%20Case%20-%2011%20July%202019.docx?version=1&modificationDate=1562865007000&api=v2> (60 minutes)

· Introduction of use case (SSAC)

· Input from EPDP Team – questions, concerns, proposed modifications

· Confirm next steps

7. Any other business (5 minutes)

· Priority 2 small team meetings update

a) Accuracy and WHOIS ARS (see https://docs.google.com/document/d/1pS9Pibanj-Hp6LztZpeERtxdoLsnp4y_-do0vU5V...)

b) Input received on other priority 2 items from RrSG (see https://mm.icann.org/pipermail/gnso-epdp-team/2019-June/002174.html)

c) Leadership to recommend next steps via mailing list

· Council request for input on org letter requesting clarification on Data Accuracy and Phase-2 (see https://gnso.icann.org/sites/default/files/file/field-file-attach/marby-to-d...). EPDP Team to provide input on the mailing list. Confirm deadline for input.

8. Wrap and confirm next EPDP Team meeting on Thursday 25 July at 14.00 UTC (5 minutes)

· Confirm action items

· Confirm questions for ICANN Org, if any

*Marika Konings*

*Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) *

*Email: marika.konings@icann.org <marika.konings@icann.org> *

*Follow the GNSO via Twitter @ICANN_GNSO*

*Find out more about the GNSO by taking our interactive courses <https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_gnso&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=7_PQAir-9nJQ2uB2cWiTDDDo5Hfy5HL9rSTe65iXLVM&m=5DXgId95wrCsHi--pxTiJD7bMB9r-T5ytCn7od3CF2Q&s=Cg5uQf0yAfw-qlFZ0WNBfsLmmtBNUiH0SuI6Vg-gXBQ&e=> and visiting the GNSO Newcomer pages <https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gnso.icann.org_files_gnso_presentations_policy-2Defforts.htm-23newcomers&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=7_PQAir-9nJQ2uB2cWiTDDDo5Hfy5HL9rSTe65iXLVM&m=5DXgId95wrCsHi--pxTiJD7bMB9r-T5ytCn7od3CF2Q&s=tT-E2RoAucUb3pfL9zmlbRdq1sytaEf765KOEkBVCjk&e=>. *

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

As I mentioned on Thursday's call, criminal acts on the Internet are not dealt with exclusively by law enforcement. The vast majority of cases are dealt with by private entities, such as in-house investigators at networks, security companies dealing with phishing, private investigators, etc. etc. See also Recital 49. So, a fruitful approach to finding commonalities is to begin with the WHAT: WHAT is being investigated and WHAT the goals of the exercise are. In many cases, both a private party and an LE agent may use similar methods, and may be trying to accomplish similar goals. For example see the attached use case from SSAC – both LE and private entities go through these kinds of steps, with similar goals. Then perhaps comes the issue WHO is looking into it, and what differences that entails. The differences: Law Enforcement has a special status under the law, and may have a special GDPR basis when requesting data. And LE has some powers that private entities cannot deploy – such as arresting people and obtaining search warrants. So, I hope the team can consider these ideas at it proceeds. All best, --greg From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of Mueller, Milton L Sent: Wednesday, July 17, 2019 5:40 PM To: Janis Karklins <karklinsj@gmail.com> Cc: gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] Materials for agenda item #4 Janis:

We are using cases to identify commonalities that would allow us, the Team,

to develop policy recommendations how to best implement provisions of GDPR.

I know that. That is exactly why I have proposed to consolidate them in the way I have. It seems to me that the commonalities in the cases I proposed to merge are fairly obvious. If it is a criminal case, for example, it really doesn’t matter a lot whether it is a copyright crime or a trademark crime or a phishing crime, the point is that you will have a government LEA requesting information needed to attribute and capture the criminal, which might be obtained through RDS or through subpoenas or other means. If someone can explain how the use case differs substantially in ways that affect the application of GDPR, let them do so. Use cases are just a method that allows us to focus our attention to all necessary aspects of future policy recommendations. Therefore, cases need not be ideally drafted but rather represent/outline real life situations and help us understand concerns of different groups. This comment is completely off the mark. Nothing in my document takes issue with any case because it is not “perfectly drafted.” It does not address the drafting at all. It talks about commonalities in their substance. You said: “we should not try to agree on every word in the case, but rather to seek common understanding/ touch-points.” Which is exactly why I proposed to consolidate cases on more general terms.

I would propose that we look at your proposal of use cases merger by e-mail

exchange and in the meantime, take most supported cases and discuss them

thru as suggested - thoroughly but quickly.

This is not an acceptable proposal. In effect you are saying that you will ignore my proposed consolidation, and that we will waste time going case by case through all the cases anyway, based on an illegitimate survey that excluded half of the team. And when you say “thoroughly but quickly” you are living in a fantasy world. That will not happen. Think of how much time we spent on a single TM case. If the use cases have any value we need carefully consider the problems they pose. That will happen more efficiently if the cases are more general. That is why we need to consolidate the cases. We will raise this issue on the call tomorrow.

I invite other Team members to join the conversation on Milton's proposal.

We will have that conversation tomorrow on the call. Dr. Milton L Mueller Georgia Institute of Technology School of Public Policy