Quote from your message: "It is a black-and-white breach of consumer expectations." Ayden, I am delighted that as opposed to some of your colleagues, you now believe that consumer protection is fully within ICANN's remit. And that we need to build "ethics" into all of our contracts. I fear you may have some difficulty in getting agreement on who's ethics to select. Lastly, please consider that although other jurisdictions have and will continue to enact privacy regulations, they will not all have a baseline of those rules in the GDPR. I am afraid that in the long term, we will have no choice to to adhere to a varying set of regulations and contracted parties that wish to straddle jurisdictions will have to adapt. Regarding cost, it may be unfortunate that some of our new rules will impose costs on contracted parties and thus registrants. Just as the costs of GDPR itself, which are not trivial, are being borne by them. Alan At 04/11/2018 06:35 AM, Ayden Férdeline wrote: I agree with Farzaneh; all domain name registrants should be shown a baseline of respect, regardless of whether or not they live in a jurisdiction with strong and enforced privacy protections. This is as much an ethical consideration as it is a legal one. While in some other sectors there are fuzzy questions around what information is private and sensitive, and what is innocuous and does not need to be protected, in our situation the case is very simple. There is demonstrable harm that can result from the disclosure of registration data. And look on Twitter at the messages that registrars receive from consumers upset that their registration data has been made public (or “sold” is the perception many consumers have). It is a black-and-white breach of consumer expectations. No one is registering a domain name with the implicit understanding that their contact information will be obtained by a third party. I note this appreciating that some third parties, like law enforcement, will have a need to access registration data, but relying on consumers to themselves take steps to protect their personal information is not going to fly. You can’t ask someone to check a box noting whether or not they are a legal or natural person, because most registrants won’t know the answer or why the distinction matters. What if a natural person becomes confused and indicates they are a legal person? I don’t believe the BC and IPC's proposed language that, “Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws,” would shield the contracted party in any meaningful way. Under European Union law at least, standard contract terms must be fair. A registrant cannot sign away a right. A contract is not allowed to create an imbalance between your rights and obligations as a consumer and the rights and obligations of sellers and suppliers. What differentiates the GDPR from its weaker, 1995 predecessor is that it tries to correct the power imbalance that exists between a data controller and a data subject. There were natural information asymmetries that had not self-corrected. The right to know what information has been collected about you in the GDPR, and the right to ask that it be corrected or deleted (also in the GDPR) all support the thesis that there is a power imbalance at play here. The onus in the GDPR is on those with more power - whoever is collecting and processing personal information - to behave in a reasonable way towards consumers and to put the interests of the individual above their own. I know that I have only referenced the GDPR above but that I am asking that GDPR-equivalent protections be applied much more broadly to all registrants. I say this for three reasons. Primarily, because I think it is not unthinkable that increased data protection regulations will be coming to other markets in the near future, including the United States. However there is also the question of cost and whether it is fair to impose upon the contracted parties (and, ultimately, domain name registrants) the cost of achieving compliance with the GDPR by building a separate, parallel process/system for the EU market and a separate, parallel process/system for other markets, or whether it is more economical to simply convert all of one's business processes to conform to the more stringent regulation. And finally, ethics: just because someone lives in a jurisdiction that does not guarantee a right today does not mean there is not an ethical duty of care to deliver it. Kind regards, Ayden Férdeline ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Sunday, 4 November 2018 07:37, farzaneh badii <farzaneh.badii@gmail.com> wrote: Dear Diane, How can registrars determine the applicable law even if the geographical information is accurate? I don't think registrars can actually determine which law outside of their own jurisdiction applies to their registrants even if they know the geographical location. For example, as far as I know EU citizens anywhere in the world are protected by GDPR. So their geographical location does not determine what law applies. Registrars have to abide by their local laws, the court of law determines the applicable law and some registries have the choice of law clauses in their agreements with registrars which cannot be in conflict with the local laws of the registrars. All in all determining the "jurisdiction" of data subject is not dependent only on the geographical location of the registrant in this case. Also I think every domain name registrant regardless of where they are located deserve minimum data protection. They are consumers by the way! I am getting increasingly puzzled by IPC/BC interpretation of "accuracy" of personal information of data subjects under GDPR. In my opinion the concept of accuracy in GDPR is actually supposed to protect data subjects and not to be used against them. Accurate information is not about keeping the data accurate so that it can be displayed and accessed and mined by many around the world! The accuracy of data is a right given to data subjects so that inaccurate data cannot be used against them in court and other forums, or be denied a service or end in violating their rights. I believe they have the right for their information to be accurate and not the responsibility (under GDPR) to maintain it accurately. The registrars under GDPR have to maintain the data of domain name registrants "uptodate" to reduce privacy risks. They don't have to keep the database accurate so that they can distinguish between legal and natural persons. I believe by ICO you mean Information Commissioners Office. Specifically this page: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-re... The natural v legal distinction is not only burdensome for the CPs or opens them to liability. It is dangerous for noncommercial/not for porfit/ advocacy organizations that have registered domain names and are vulnerable to attacks of all sorts. I assume IPC/BC wants this distinction so that the org personal sensitive data won't be redacted. I would like to know why. I would like to know why while some groups are fiercely working to have access to personal and sensitive data of domain name registrants for their legitimate interest, also work towards exposing domain name registrants sensitive data to the world. Farzaneh On Fri, Nov 2, 2018 at 10:13 PM Alan Greenberg <alan.greenberg@mcgill.ca<mailto:alan.greenberg@mcgill.ca> > wrote: This all sounds right to me. Alan At 02/11/2018 09:28 PM, Plaut, Diane wrote: Dear EPDP Team- In our efforts to overcome a significant hurdle through our EPDP work � that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrantâ��s because if it is no not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws. The Accuracy of information provided by data subjects Article 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that: Personal data shall be�accurate and, where necessary, keept up tto date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (â��accuracyâ��). According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data provided by the data subject, provided by a third party or created by the controller – the same obligation applies in each such caase. As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states that: â��In some cases it t is reasonable to rely on the individual to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details, but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this.â� Howeever, if the controller learns that information is no longer accurate/up to date (either from the data subject or from other information which comes to light), the controller should update its records accordingly. The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must: · accurately record the information provided; · accurately record the source of the information; · take â��reasononable stepsâ� in the circumstances to ensure the accurracy of the information; and · carefully consider any challenges to the accuracy of the information. Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes. Moreover, in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties. Sincerely, Diane Diane Plaut General Counsel and Privacy Officer Direct +1 646-899-2806 â�¨ diane.plaut@corsearch.com<mailto:diane.plaut@corsearch..com> 220 West 42nd Street, 11th Floor, New York, NY 10036, United Statesâ�¨www.corsearch.com Join Corsearch on Twitter<https://twitter.com/corsearch> Linkedin<https://www.linkedin.com/company/2593860/> Trademarks + Brands<http://trademarksandbrands.corsearch.com/> Customer Service/Platform Support: 1 800 SEARCH1â�¢ (1 800 732 72441)â�¨ Corsearch.USCustomerService@corsearch.com<mailto:Corsearch.USCustomerService@corssearch.com> Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team