Bird and Bird is offering arguments for protection in the event of complaint.  While that protection is welcome and reassuring in terms of risk, I am not certain that we have adequately explained to 2Birds how registration actually takes place.  It would have been beneficial to walk them through a range of different ways to register a domain name.  As we have discussed in the calls, very often non-savvy non-commercial users or small business/home workers use resellers of various kinds to register their domains. Additional risk creeps in here, WRT whether or not a positive consent has been obtained from relevant employees.  Further risk creeps in when we look at automatic renewals, where the contact data may not be updated.  If updated, have the steps been taken to get consent from new employees?  To me this is key, non-savvy users, and I count myself among them, are not likely to check what an intermediary is doing with respect to the domain renewal or updating. Now, of course the argument is that they SHOULD be more diligent and they SHOULD pay attention to the accuracy requirements, but lets deal in facts here.....are they?  As the data controller who is pre-emptively disclosing personal data, allegedly with consent, to unknown (to the contracted party) third parties, the responsibility still rests with the controller.  As I have mentioned, a Facebook or a Google or a Microsoft can get away with treading roughshod over their consent arrangements....not too many folks are going to give up free or necessary services over quibbles in a consent form, even if it is 75 pages long.  However the registrars (and to a lesser extent, the registries) are operating in a highly competitive market.  Once losing my trust, perhaps over a trifling inattention to the accuracy of my data, and I am transferring my domains to another company. Policing a complex reseller market is also rather a difficult matter that we have not discussed at length in our debates on this issue.  I know that the data commissioners as a group do not understand how the accountability for the handling of personal information is transferred in that market, and it would not be surprising if 2Birds did not either.  Bottom line:  accredited registrars are shouldering the risk here, it is their risk, and they would know best whether they can trust the accuracy of the designation of legal personhood.  This is why I think that this designation, in my opinion, should always permit an override by the  contracted parties to treat the data as personal.  I have suggested many many times that commercial organizations should operate on an accreditation basis and be linked to their official registration numbers (business, corporation, municipal licence etc).  Noone ever responds to that idea....if it is totally ridiculous I would certainly like to know why, I am offering it in good faith and I think it would do something useful to stop fraudulent registrations in their names.  However, small business and non-commercial organizations, even if incorporated or in possession of a registration # of some kind have different needs and circumstances, and they are frequently treated differently under data protection law. One final point that I have raised a few times.....we tend to focus on enforcement fines and Court costs.  Even if noone ever complains to a DPA or takes a case to Court, where the advice of 2 Birds gives us some comfort that the risk is manageable, and the results would exonerate the contracted parties.....what about reputational damage in the meantime?  Court costs?  Who actually wants to have customers complaining about the practices?  Employee morale, if it is employees who are objecting to the practices? I support focusing on whether the data submitted is personal or not, with a fulsome definition and description of same, and full flexibility for contracted parties to err on the side of caution and consider the possibility of  some data being personal after all.  After all, much data is still being disclosed, and noone has adduced strong evidence that the delay in requesting the data (as opposed to getting it from the published data) will have huge repercussions.  What is actually at play here is who is doing the extra work....the requesting party, or the data controller. Stephanie Perrin On 2021-04-15 10:42 p.m., Mueller, Milton L via Gnso-epdp-team wrote:

*EXTERNAL EMAIL:*

Further legal support from TwoBirds

14.2If personal data is erroneously included in published Registration Data, it would in this scenario occur despite substantial (VSC) steps taken by the Contracted Parties, and would be primarily attributable to the actions/omissions of the Registrant.  This is likely to be taken into account by data subjects, data protection supervisory authorities, and courts.

14.3The data in question is likely to be low sensitivity.  The scenario being envisaged here (mistaken inclusion of personal data in published Registration Data) seems to be most likely to occur when a legal entity (e.g. a company or non-profit organisation) is registering / maintaining its own domains.  In those scenarios, we assume the personal data that could be disclosed would ordinarily relate to an employee’s work details (e.g. a company email address), not an individual’s private life.  Although the GDPR confers protection even in the workplace, the data in question here may arguably be less capable of causing harm to an individual than data relating to the data subject’s private life.[1] <#_ftn1>

14.4In more sensitive cases (e.g. disclosing that a person works for a company in a sensitive or “embarrassing” sector), a Registrant would be putting itself at serious risk of complaints from its own employees.  Registrants are therefore already incentivised to avoid errors that could have serious consequences for their own staff.

*From:*Mueller, Milton L *Sent:* Thursday, April 15, 2021 10:34 PM *To:* gnso-epdp-team@icann.org *Subject:* RE: [Gnso-epdp-team] On the proposed guidance

Some legal support for my argument below from Bird & Bird:

There may even be an argument, based on EU Court of Justice (“CJEU”) caselaw, that this is a situation where Contracted Parties should generally only be liable should they fail to properly address a complaint about the data – i.e. only once they are put on notice about the alleged illegality and thereby have an opportunity to “verify” the merits of the complaint.[1] <#_ftn2>  This bears some parallels to other EU liability regimes for operators of services online that process – unwittingly – content that violates EU law.[2] <#_ftn3>  As discussed at footnote 6 below, this is arguably recognised in (at least some) decisions of GDPR supervisory authorities.

In other words, if personal data finds its way into a published registration record that should not be there, an objection can be lodged with the registrar and they can verify the merits and remove the data.

Dr. Milton L Mueller

Georgia Institute of Technology

School of Public Policy

Internet Governance Project <https://internetgovernance.org/>

*From:*Mueller, Milton L *Sent:* Thursday, April 15, 2021 9:14 PM *To:* gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org> *Subject:* FW: [Gnso-epdp-team] On the proposed guidance

...

" Everyone who is named in a role in a registration must have already been informed

...

and consented to all of the conditions involved in the role. " This is the ideal. Sadly, this ideal

...

is very often not the case.

Whoa.

Of course, Volker, it is possible that a person making a registration for a legal person won’t do it properly. But it is absurd to expect a registrar to be legally responsible for that. How can the registrar be liable for privacy breaches made by the registrant? Indeed, I can’t understand why gaining the consent of the administrative assistant of the xyz department to have their name listed in the whois is a matter for DNS/ICANN policy at all. ICANN policy simply needs to inform registrants that under certain conditions the data will be published.

Let’s take an extreme case – suppose a nasty IT manager in a major corporation puts the name, email address and (what the heck) a revenge porn photo of her ex-husband in her company’s registration record. Are you telling me the registrar would be considered responsible for that breach of privacy? Not the nasty IT manager?

Show me a legal case in which that kind of liability has been assigned. I doubt you can, but I await the data from CP lawyers who have been involved in these cases. I do know of several cases in which agents for a corporation wrongly listed themselves as the technical and administrative contact, making it possible for them to hijack the name. The registrar was NEVER held liable for that.

Reminder: We had to reform Whois/RDS policy because ICANN, *as a matter of contractual obligation, required registrars to publish sensitive PII of any and every Registrant*. Once we have removed that obligation, and once we have given registrants knowledge of the conditions under which the data in the record should be published, I don’t see why registrars need to worry about some corporation listing the personal email address of someone in their IT department.

So if this alleged risk is being cited to scare us away from allowing registrants to self-designate as legal or natural, it is a pretty weak case, imho.

--MM

*From:*Gnso-epdp-team <gnso-epdp-team-bounces@icann.org <mailto:gnso-epdp-team-bounces@icann.org>> *On Behalf Of *Volker Greimann via Gnso-epdp-team *Sent:* Thursday, April 15, 2021 10:10 AM *To:* Steve Crocker <steve@shinkuro.com <mailto:steve@shinkuro.com>> *Cc:* gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org> *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

Employees are named by other employees without their knowledge, or remain named long after they leave. From the experience as a registrar dealing with registrants every day, this ideal is an assumption that does not survive contact with reality.

-- Volker A. Greimann General Counsel and Policy Manager *KEY-SYSTEMS GMBH*

T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net <http://www.key-systems.net/>

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

On Thu, Apr 15, 2021 at 3:36 PM Steve Crocker via Gnso-epdp-team <gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>> wrote:

Laureen,

Thanks for your note.  With respect to the details under legal person, we believe the issue of consent should be moot.  Everyone who is named in a role in a registration must have already been informed and consented to all of the conditions involved in the role.  This is a prerequisite for having a working system and is not specific to meeting a privacy regulation.  The fact that this requirement is not specified in the existing contractual documentation is an error and needs to be rectified.

Steve

On Thu, Apr 15, 2021 at 6:28 AM Kapin, Laureen via Gnso-epdp-team <gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>> wrote:

I think we share common ground on many key issues and I would like to build on the many helpful inputs received as to what would be advisable.

*Goal*: publish non-personal, non-protected data to the greatest extent permissible under the GDPR and within low legal risks to data controllers and processors.  Note, the description below does /not /fully detail the advised safeguards which B&B has documented and which we’ve adopted in our prior input because my impression is that we generally agree that the safeguards are prudent.  This description merely seeks to identify the key steps that must be taken to ensure that personal data is identified and protected and non-personal data is published.  I also highlight the addition of a potential additional safeguard – Confirmation.  I think this process incorporates what we’ve discussed and inputs received and could form a useful framework for discussion.

*Note:*

**

n*New Registrations: *This process applies to new registrations (Steve C. has some useful thoughts on how to deal with existing Registrations)

n*Publish: *When I use the word “publish,” I mean made public directly; not via the SSAD.

n*Flexibility: *Based on input from our Registrar colleagues, we should permit flexibility for how these steps are implemented to account for the varied business models in place.

n*Timing: *All identifications need to take place at the time of registration or shortly thereafter (w/in the 13-day accuracy verification window) and no registration data should be published until the identification, consent, and confirmation process concludes

*Process:*

1.A threshold identification of the registrant as a natural or legal person;

a.If natural, registration info redacted

b.If legal, further inquiries and advisories (safeguards):

i.if the legal person identifies that it has a protected status under the GDPR

1.registration info redacted

ii.If the legal person registration contains personal data, advise of consequences (publication)

1.Obtain necessary consents

2./Possible additional safeguard/: /Ask Registrant to Confirm any identification that will result in publication of contact data /(akin to confirming a flight reservation or stock trade)

a.Publish

3.If no consent

a.Redact

2.Provide quick and easy opportunity to correct any mistakes

I hope this is useful.

Kind regards,

Laureen Kapin

Counsel for International Consumer Protection

Federal Trade Commission

(202) 326-3237

*From:*Gnso-epdp-team <gnso-epdp-team-bounces@icann.org <mailto:gnso-epdp-team-bounces@icann.org>> *On Behalf Of *Volker Greimann via Gnso-epdp-team *Sent:* Thursday, April 15, 2021 8:35 AM *To:* Hadia Abdelsalam Mokhtar EL miniawi <Hadia@tra.gov.eg <mailto:Hadia@tra.gov.eg>> *Cc:* gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org> *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

I think we need to be cognisant of the current status quo and use that as the basis for our thoughts on the matter:

1) There is no differentiation between legal or natural contacts.

2) The redaction of all contacts is permitted and has become the de-facto standard.

3) We allow consent-based disclosure.

4) NIS 2 may at some point in the future require publication of non-personal information.

This leads to two very simple follow-on questions:

a) How do we identify such non-personal information? What is really necessary for this end?

b) What would publication entail?

For a) we and Twobirds identified voluntary self-declaration of the data submitted. As all data is redacted by default, the differentiation of the data subject category is irrelevant as it ultimately only boils down to the declaration of the data subject thatthe data contains no personal information.

For b), the term "publish" is undefined. For all we know, it could mean publication in a physical print edition (it doesn't mean that though). But publication within SSAD can very well be sufficient for that definition. There is no reason whatsoever to assume differently.

-- Volker A. Greimann General Counsel and Policy Manager *KEY-SYSTEMS GMBH*

T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net <http://www.key-systems.net/>

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaig...>

Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaig...>

On Thu, Apr 15, 2021 at 1:52 PM Hadia Abdelsalam Mokhtar EL miniawi via Gnso-epdp-team <gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org>> wrote:

Dear Milton,

Thank you for your constructive thoughts. I believe we have a lot to build on. In relation to principle one, I think we all agree that some legal data subjects would want to publish their data in the RDDS, but without your first principle they can only do this through consent. The legal memo received lately from Bird & Bird explains that if CPs publish the data of legal persons based on consent they are at a higher risk than if they publish the data of legal persons based on self-designation. In the latter case CPs might only be liable if they fail to address a complaint. So the question always was: what is the benefit of labeling the data as belonging to a natural or legal person? Of course we all know that GDPR protects the data of natural persons and not legal persons, but the important answer now is that the distinction significantly reduces the liability of CPs. In addition, the distinction is helpful in performing the balancing test in case the data is not published and I am sure if we look into individual use cases we can find much more benefits. Moreover, it could prove to be useful regarding possible upcoming regulations. I would also add that the level of protection assigned to the data elements suggested by Steve provides additional safe guards and flexibility in the implementation.

Finally, I join you in being optimistic about our ability to finish this.

Kind regards

Hadia

*From:*Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org <mailto:gnso-epdp-team-bounces@icann.org>] *On Behalf Of *Mueller, Milton L via Gnso-epdp-team *Sent:* Wednesday, April 14, 2021 10:12 PM *To:* gnso-epdp-team@icann.org <mailto:gnso-epdp-team@icann.org> *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

Colleagues:

I have only gotten time to review the latest Guidance document and the surrounding debate today. Apologies, but there is a lot going on in my day job.

I am disappointed to see that we seem to be going backwards. I see divergence rather than convergence on the way we are approaching the problem.

I see no point in adding more noise to the current document via the Comments function. What I would like to try to do is articulate some broad principles about how to deal with the legal/natural distinction. If we can agree on those principles, it will be relatively easy to complete the document. If we cannot/do not agree on those principles, additional wordsmithing and debates over terms will not get us anywhere.

So here are the broad principles that I would offer up for debate:

1.The legal/natural distinction is relevant and we need to find a way make it in RDDS without compromising privacy rights.

2.Registrants should be able to self-designate as legal or natural, with no burden of authentication placed on registrars or registries

3.To protect small home offices or NGOs who are technically Legal persons but whose registration data may include Personal data, we need an additional check in the process.

4.As long as they conform with the above 3 principles, registrars/ries (CPs) should be given maximum flexibility to choose the way to differentiate.

Principle 1 discussion:

If we cannot agree on this (or agree to abandon this principle), _/nothing else will fall into place/_. Ever. So let’s settle that. Steve and Volker I suspect will disagree with this principle. Steve has argued that the L/N distinction is “not a central concern” and all that matters is whether the registrant’s data is to be made available to anyone. If he is right, we can discard the guidance altogether, because we already have a recommendation to allow the RNH to consent to the publication of their data. Volker has also suggested that it is personal data we need to differentiate, not L/N . I disagree with Steve and Volker on this and so do most of the rest of the group. L/N distinction is a central concern to certain stakeholder groups in the EPDP, because a) GDPR and other data protection laws do not protect it and this process is all about bringing RDS into compliance with privacy law; b) Legal person data could be published and it would provide easier access to their registration data. As a NCSG member I can find no basis for objecting to the publication of WalMart’s, Kroger’s or the local hardware store’s registration data. Any concerns about PII are addressed by principles 2 and 3. Steve is approaching this as an engineer, but this is a policy process, and we will not obtain agreement on a solution unless certain stakeholders are satisfied. If they think it is a central concern, it’s a central concern, that’s how policy/politics work.

Principle 2 discussion

This is the key principle that keeps NCSG and CPH satisfied. Registrants are in control of how they are designated. Yes, this means that some people will lie. That is just something we will have to accept. One cannot erase that possibility without creating a system that is too burdensome and costly as to outweigh any benefits.

Principle 3 discussion

This is something everyone seems to agree on already. But it is good to make it explicit, then we can work out how specific our guidance can get, so as to conform to …

Principle 4

Avoid being overly prescriptive, but ensure that the other 3 principles are honored. So yes, Volker, we give you maximum flexibility to implement in accordance with different business models, but you can NOT make a designation for a RNH, because it violates principle 2.

I truly believe that if we can come to agreement on these 4 principles and use them as the basis for drafting guidance, we can actually finish this.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://www.icann.org/privacy/policy>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://www.icann.org/privacy/tos>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaig...>

Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaig...>

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://www.icann.org/privacy/policy>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://www.icann.org/privacy/tos>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://www.icann.org/privacy/policy>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://www.icann.org/privacy/tos>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

------------------------------------------------------------------------

------------------------------------------------------------------------

[1] <#_ftnref1> As explained above, we have understood this question to be asking about scenarios where Registrants are legal persons, as per the EDPB quote at paragraph 1.  In respect of individual (natural person) Registrants, the issues will be largely similar: if a natural person incorrectly states that their data is not personal data, then (i) the verification measures should prevent the data from being published, since they will give the data subject an opportunity to correct their mistake; (ii) the mitigating factors and legal arguments described at paragraphs 11.7 and 11.8 and paragraphs 14.1 - 14.6 here, should confer reasonable legal protection for Contracted Parties.

[1] <#_ftnref2>In its judgement in Case C‑136/17 /GC and Others/, the CJEU explained that GDPR obligations relating to an erasure (“Right to Be Forgotten”) request apply “/to the operator of a search engine in the context of his responsibilities, powers and capabilities as the controller of the processing carried out in connection with the activity of the search engine, on the occasion of a verification performed by that operator, under the supervision of the competent national authorities, following a request by the data subject”/.  As the Advocate General explained in that case, “/such an operator can act only within the framework of its responsibilities, powers and capabilities. In other words, such an operator may be incapable of ensuring the full effect of the provisions of [EU data protection law], precisely because of its limited responsibilities, powers and capabilities. . . An ex ante control of internet pages which are referenced as the result of a search does not fall within the responsibilities or the capabilities of a search engine/.”  It could not know, from the moment it indexed a webpage, that the content of that page was (for example) out of date (as in the original /Google Spain / Costeja/ ruling), or (in the /GC and Others/ case/) / “special category” or “criminal offence” data for which it required consent.

[2] <#_ftnref3>See, for example, Article 14 <https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32000L0031> of the e-Commerce Directive 2000/31/EC and its transposition into the national laws of EU/EEA Member States and the UK.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

I think you both make good points. Our starting point is the current status quo, which I expect will continue on into the far future: All registration data provided as a registrant must be viewed as potential personal information, in a Schroedingers Cat kind-of situation. Until you look at it, you do not know what it is, even though you can make certain assumptions with varying likelihoods. The 2B memo tells us nothing new in that regard. What it does tell us is that the various methods of determination without looking have risk of various degrees attached. Miltons proposed registrant-declaration is one of the lower risk ones methods. Stephanie is also right that in a highly competitive market with razor-thin margins, corners will be cut at some point of the channel, especially once you enter the realm of resellers. So Stephanie is absolutely correct in her point that the determination of whether contracted parties can rely on the accuracy of any declaration must be that of the contracted party itself. The declaration of legal status of the registrant ultimately does not help us make that determination. The declaration of content of the data goes a whole lot further in that regard. Controlling the process where the declaration is made helps even more (hence the requirement to allow post-registration declarations). As for publication vs. disclosure, after having given this some thought, I still tend to come out on the side of disclosure, but with the following features: - self-declared data sets would be set to automated disclosure. - public RDAP could contain a marker/flag/label/something that shows that this data set is available for automated disclosure in SSAD - Disclosure fees for such data sets in SSAD could be priced lower than non-automated data sets, say half-price - Access levels for access to such data sets could be lower for users of SSAD. For example, if you just want to access automated-disclosure sets, accreditation could be voluntary, and a mere ID-check application process and a statement of legitimate interest for each request could be possible. Advantages: - Increased utility of SSAD - SSAD User Fees would decrease (higher query volumes overall, lower fees for some queries) - CP Risk would be limited - CP handling times for requests would be reduced in case they implement that flag. I still need to hear what the benefits of the differentiation of data sets and better availability of non-personal information really are, though. In my experience it is not like cyber criminals are setting up legal entities such as STEALATRADEMARK, Inc or VIOLATEACOPYRIGHT, Ltd. left and right to register their domain names. Those kinds of domains are usually registered with perfectly accurate personal data sets. If someone could really make the case of what the perceived benefit to all parties concerned is on this (something I have been asking for from days 1), I'd be happy to hear them. The common argument of security, stability and resilience of the DNS went out of the window the day the Temp Spec first came into effect after all, as neither of the three has been affected by the current vegetative state of the WHOIS (In the sense that it is not quite dead yet, but almost. Machines still keep it alive). This also would solve the issue of thick vs thin RDAP: If RDAP only returns the basic data set anyway and never any personal information, there is no longer any need to require registrars to provide RDAP services as there no longer is any concern in supplying said data to the registries for centralised publication. Thick RDAP would be saved. -- Volker A. Greimann General Counsel and Policy Manager *KEY-SYSTEMS GMBH* T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358. This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached. On Sat, Apr 17, 2021 at 12:19 AM Stephanie E Perrin via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:

Bird and Bird is offering arguments for protection in the event of complaint. While that protection is welcome and reassuring in terms of risk, I am not certain that we have adequately explained to 2Birds how registration actually takes place. It would have been beneficial to walk them through a range of different ways to register a domain name. As we have discussed in the calls, very often non-savvy non-commercial users or small business/home workers use resellers of various kinds to register their domains. Additional risk creeps in here, WRT whether or not a positive consent has been obtained from relevant employees. Further risk creeps in when we look at automatic renewals, where the contact data may not be updated. If updated, have the steps been taken to get consent from new employees? To me this is key, non-savvy users, and I count myself among them, are not likely to check what an intermediary is doing with respect to the domain renewal or updating.

Now, of course the argument is that they SHOULD be more diligent and they SHOULD pay attention to the accuracy requirements, but lets deal in facts here.....are they? As the data controller who is pre-emptively disclosing personal data, allegedly with consent, to unknown (to the contracted party) third parties, the responsibility still rests with the controller. As I have mentioned, a Facebook or a Google or a Microsoft can get away with treading roughshod over their consent arrangements....not too many folks are going to give up free or necessary services over quibbles in a consent form, even if it is 75 pages long. However the registrars (and to a lesser extent, the registries) are operating in a highly competitive market. Once losing my trust, perhaps over a trifling inattention to the accuracy of my data, and I am transferring my domains to another company. Policing a complex reseller market is also rather a difficult matter that we have not discussed at length in our debates on this issue. I know that the data commissioners as a group do not understand how the accountability for the handling of personal information is transferred in that market, and it would not be surprising if 2Birds did not either. Bottom line: accredited registrars are shouldering the risk here, it is their risk, and they would know best whether they can trust the accuracy of the designation of legal personhood. This is why I think that this designation, in my opinion, should always permit an override by the contracted parties to treat the data as personal. I have suggested many many times that commercial organizations should operate on an accreditation basis and be linked to their official registration numbers (business, corporation, municipal licence etc). Noone ever responds to that idea....if it is totally ridiculous I would certainly like to know why, I am offering it in good faith and I think it would do something useful to stop fraudulent registrations in their names. However, small business and non-commercial organizations, even if incorporated or in possession of a registration # of some kind have different needs and circumstances, and they are frequently treated differently under data protection law.

One final point that I have raised a few times.....we tend to focus on enforcement fines and Court costs. Even if noone ever complains to a DPA or takes a case to Court, where the advice of 2 Birds gives us some comfort that the risk is manageable, and the results would exonerate the contracted parties.....what about reputational damage in the meantime? Court costs? Who actually wants to have customers complaining about the practices? Employee morale, if it is employees who are objecting to the practices?

I support focusing on whether the data submitted is personal or not, with a fulsome definition and description of same, and full flexibility for contracted parties to err on the side of caution and consider the possibility of some data being personal after all. After all, much data is still being disclosed, and noone has adduced strong evidence that the delay in requesting the data (as opposed to getting it from the published data) will have huge repercussions. What is actually at play here is who is doing the extra work....the requesting party, or the data controller.

Stephanie Perrin

On 2021-04-15 10:42 p.m., Mueller, Milton L via Gnso-epdp-team wrote:

*EXTERNAL EMAIL:*

Further legal support from TwoBirds

14.2 If personal data is erroneously included in published Registration Data, it would in this scenario occur despite substantial (VSC) steps taken by the Contracted Parties, and would be primarily attributable to the actions/omissions of the Registrant. This is likely to be taken into account by data subjects, data protection supervisory authorities, and courts.

14.3 The data in question is likely to be low sensitivity. The scenario being envisaged here (mistaken inclusion of personal data in published Registration Data) seems to be most likely to occur when a legal entity (e.g. a company or non-profit organisation) is registering / maintaining its own domains. In those scenarios, we assume the personal data that could be disclosed would ordinarily relate to an employee’s work details (e.g. a company email address), not an individual’s private life. Although the GDPR confers protection even in the workplace, the data in question here may arguably be less capable of causing harm to an individual than data relating to the data subject’s private life.[1] <#m_2854865445665285661__ftn1>

14.4 In more sensitive cases (e.g. disclosing that a person works for a company in a sensitive or “embarrassing” sector), a Registrant would be putting itself at serious risk of complaints from its own employees. Registrants are therefore already incentivised to avoid errors that could have serious consequences for their own staff.

*From:* Mueller, Milton L *Sent:* Thursday, April 15, 2021 10:34 PM *To:* gnso-epdp-team@icann.org *Subject:* RE: [Gnso-epdp-team] On the proposed guidance

Some legal support for my argument below from Bird & Bird:

There may even be an argument, based on EU Court of Justice (“CJEU”) caselaw, that this is a situation where Contracted Parties should generally only be liable should they fail to properly address a complaint about the data – i.e. only once they are put on notice about the alleged illegality and thereby have an opportunity to “verify” the merits of the complaint. [1] <#m_2854865445665285661__ftn2> This bears some parallels to other EU liability regimes for operators of services online that process – unwittingly – content that violates EU law.[2] <#m_2854865445665285661__ftn3> As discussed at footnote 6 below, this is arguably recognised in (at least some) decisions of GDPR supervisory authorities.

In other words, if personal data finds its way into a published registration record that should not be there, an objection can be lodged with the registrar and they can verify the merits and remove the data.

Dr. Milton L Mueller

Georgia Institute of Technology

School of Public Policy

Internet Governance Project <https://internetgovernance.org/>

*From:* Mueller, Milton L *Sent:* Thursday, April 15, 2021 9:14 PM *To:* gnso-epdp-team@icann.org *Subject:* FW: [Gnso-epdp-team] On the proposed guidance

...

" Everyone who is named in a role in a registration must have already been informed

...

and consented to all of the conditions involved in the role. " This is the ideal. Sadly, this ideal

...

is very often not the case.

Whoa.

Of course, Volker, it is possible that a person making a registration for a legal person won’t do it properly. But it is absurd to expect a registrar to be legally responsible for that. How can the registrar be liable for privacy breaches made by the registrant? Indeed, I can’t understand why gaining the consent of the administrative assistant of the xyz department to have their name listed in the whois is a matter for DNS/ICANN policy at all. ICANN policy simply needs to inform registrants that under certain conditions the data will be published.

Let’s take an extreme case – suppose a nasty IT manager in a major corporation puts the name, email address and (what the heck) a revenge porn photo of her ex-husband in her company’s registration record. Are you telling me the registrar would be considered responsible for that breach of privacy? Not the nasty IT manager?

Show me a legal case in which that kind of liability has been assigned. I doubt you can, but I await the data from CP lawyers who have been involved in these cases. I do know of several cases in which agents for a corporation wrongly listed themselves as the technical and administrative contact, making it possible for them to hijack the name. The registrar was NEVER held liable for that.

Reminder: We had to reform Whois/RDS policy because ICANN, *as a matter of contractual obligation, required registrars to publish sensitive PII of any and every Registrant*. Once we have removed that obligation, and once we have given registrants knowledge of the conditions under which the data in the record should be published, I don’t see why registrars need to worry about some corporation listing the personal email address of someone in their IT department.

So if this alleged risk is being cited to scare us away from allowing registrants to self-designate as legal or natural, it is a pretty weak case, imho.

--MM

*From:* Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> *On Behalf Of *Volker Greimann via Gnso-epdp-team *Sent:* Thursday, April 15, 2021 10:10 AM *To:* Steve Crocker <steve@shinkuro.com> *Cc:* gnso-epdp-team@icann.org *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

Employees are named by other employees without their knowledge, or remain named long after they leave. From the experience as a registrar dealing with registrants every day, this ideal is an assumption that does not survive contact with reality.

-- Volker A. Greimann General Counsel and Policy Manager *KEY-SYSTEMS GMBH*

T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

On Thu, Apr 15, 2021 at 3:36 PM Steve Crocker via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:

Laureen,

Thanks for your note. With respect to the details under legal person, we believe the issue of consent should be moot. Everyone who is named in a role in a registration must have already been informed and consented to all of the conditions involved in the role. This is a prerequisite for having a working system and is not specific to meeting a privacy regulation. The fact that this requirement is not specified in the existing contractual documentation is an error and needs to be rectified.

Steve

On Thu, Apr 15, 2021 at 6:28 AM Kapin, Laureen via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:

I think we share common ground on many key issues and I would like to build on the many helpful inputs received as to what would be advisable.

*Goal*: publish non-personal, non-protected data to the greatest extent permissible under the GDPR and within low legal risks to data controllers and processors. Note, the description below does *not *fully detail the advised safeguards which B&B has documented and which we’ve adopted in our prior input because my impression is that we generally agree that the safeguards are prudent. This description merely seeks to identify the key steps that must be taken to ensure that personal data is identified and protected and non-personal data is published. I also highlight the addition of a potential additional safeguard – Confirmation. I think this process incorporates what we’ve discussed and inputs received and could form a useful framework for discussion.

*Note:*

n *New Registrations: *This process applies to new registrations (Steve C. has some useful thoughts on how to deal with existing Registrations)

n *Publish: *When I use the word “publish,” I mean made public directly; not via the SSAD.

n *Flexibility: *Based on input from our Registrar colleagues, we should permit flexibility for how these steps are implemented to account for the varied business models in place.

n *Timing: *All identifications need to take place at the time of registration or shortly thereafter (w/in the 13-day accuracy verification window) and no registration data should be published until the identification, consent, and confirmation process concludes

*Process:*

1. A threshold identification of the registrant as a natural or legal person;

a. If natural, registration info redacted

b. If legal, further inquiries and advisories (safeguards):

i. if the legal person identifies that it has a protected status under the GDPR

1. registration info redacted

ii. If the legal person registration contains personal data, advise of consequences (publication)

1. Obtain necessary consents

2. *Possible additional safeguard*: *Ask Registrant to Confirm any identification that will result in publication of contact data *(akin to confirming a flight reservation or stock trade)

a. Publish

3. If no consent

a. Redact

2. Provide quick and easy opportunity to correct any mistakes

I hope this is useful.

Kind regards,

Laureen Kapin

Counsel for International Consumer Protection

Federal Trade Commission

(202) 326-3237

*From:* Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> *On Behalf Of *Volker Greimann via Gnso-epdp-team *Sent:* Thursday, April 15, 2021 8:35 AM *To:* Hadia Abdelsalam Mokhtar EL miniawi <Hadia@tra.gov.eg> *Cc:* gnso-epdp-team@icann.org *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

I think we need to be cognisant of the current status quo and use that as the basis for our thoughts on the matter:

1) There is no differentiation between legal or natural contacts.

2) The redaction of all contacts is permitted and has become the de-facto standard.

3) We allow consent-based disclosure.

4) NIS 2 may at some point in the future require publication of non-personal information.

This leads to two very simple follow-on questions:

a) How do we identify such non-personal information? What is really necessary for this end?

b) What would publication entail?

For a) we and Twobirds identified voluntary self-declaration of the data submitted. As all data is redacted by default, the differentiation of the data subject category is irrelevant as it ultimately only boils down to the declaration of the data subject thatthe data contains no personal information.

For b), the term "publish" is undefined. For all we know, it could mean publication in a physical print edition (it doesn't mean that though). But publication within SSAD can very well be sufficient for that definition. There is no reason whatsoever to assume differently.

-- Volker A. Greimann General Counsel and Policy Manager *KEY-SYSTEMS GMBH*

T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaig...>

Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaig...>

On Thu, Apr 15, 2021 at 1:52 PM Hadia Abdelsalam Mokhtar EL miniawi via Gnso-epdp-team <gnso-epdp-team@icann.org> wrote:

Dear Milton,

Thank you for your constructive thoughts. I believe we have a lot to build on. In relation to principle one, I think we all agree that some legal data subjects would want to publish their data in the RDDS, but without your first principle they can only do this through consent. The legal memo received lately from Bird & Bird explains that if CPs publish the data of legal persons based on consent they are at a higher risk than if they publish the data of legal persons based on self-designation. In the latter case CPs might only be liable if they fail to address a complaint. So the question always was: what is the benefit of labeling the data as belonging to a natural or legal person? Of course we all know that GDPR protects the data of natural persons and not legal persons, but the important answer now is that the distinction significantly reduces the liability of CPs. In addition, the distinction is helpful in performing the balancing test in case the data is not published and I am sure if we look into individual use cases we can find much more benefits. Moreover, it could prove to be useful regarding possible upcoming regulations. I would also add that the level of protection assigned to the data elements suggested by Steve provides additional safe guards and flexibility in the implementation.

Finally, I join you in being optimistic about our ability to finish this.

Kind regards

Hadia

*From:* Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] *On Behalf Of *Mueller, Milton L via Gnso-epdp-team *Sent:* Wednesday, April 14, 2021 10:12 PM *To:* gnso-epdp-team@icann.org *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

Colleagues:

I have only gotten time to review the latest Guidance document and the surrounding debate today. Apologies, but there is a lot going on in my day job.

I am disappointed to see that we seem to be going backwards. I see divergence rather than convergence on the way we are approaching the problem.

I see no point in adding more noise to the current document via the Comments function. What I would like to try to do is articulate some broad principles about how to deal with the legal/natural distinction. If we can agree on those principles, it will be relatively easy to complete the document. If we cannot/do not agree on those principles, additional wordsmithing and debates over terms will not get us anywhere.

So here are the broad principles that I would offer up for debate:

1. The legal/natural distinction is relevant and we need to find a way make it in RDDS without compromising privacy rights.

2. Registrants should be able to self-designate as legal or natural, with no burden of authentication placed on registrars or registries

3. To protect small home offices or NGOs who are technically Legal persons but whose registration data may include Personal data, we need an additional check in the process.

4. As long as they conform with the above 3 principles, registrars/ries (CPs) should be given maximum flexibility to choose the way to differentiate.

Principle 1 discussion:

If we cannot agree on this (or agree to abandon this principle), _*nothing else will fall into place*_. Ever. So let’s settle that. Steve and Volker I suspect will disagree with this principle. Steve has argued that the L/N distinction is “not a central concern” and all that matters is whether the registrant’s data is to be made available to anyone. If he is right, we can discard the guidance altogether, because we already have a recommendation to allow the RNH to consent to the publication of their data. Volker has also suggested that it is personal data we need to differentiate, not L/N . I disagree with Steve and Volker on this and so do most of the rest of the group. L/N distinction is a central concern to certain stakeholder groups in the EPDP, because a) GDPR and other data protection laws do not protect it and this process is all about bringing RDS into compliance with privacy law; b) Legal person data could be published and it would provide easier access to their registration data. As a NCSG member I can find no basis for objecting to the publication of WalMart’s, Kroger’s or the local hardware store’s registration data. Any concerns about PII are addressed by principles 2 and 3. Steve is approaching this as an engineer, but this is a policy process, and we will not obtain agreement on a solution unless certain stakeholders are satisfied. If they think it is a central concern, it’s a central concern, that’s how policy/politics work.

Principle 2 discussion

This is the key principle that keeps NCSG and CPH satisfied. Registrants are in control of how they are designated. Yes, this means that some people will lie. That is just something we will have to accept. One cannot erase that possibility without creating a system that is too burdensome and costly as to outweigh any benefits.

Principle 3 discussion

This is something everyone seems to agree on already. But it is good to make it explicit, then we can work out how specific our guidance can get, so as to conform to …

Principle 4

Avoid being overly prescriptive, but ensure that the other 3 principles are honored. So yes, Volker, we give you maximum flexibility to implement in accordance with different business models, but you can NOT make a designation for a RNH, because it violates principle 2.

I truly believe that if we can come to agreement on these 4 principles and use them as the basis for drafting guidance, we can actually finish this.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaig...>

Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaig...>

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

------------------------------

------------------------------

[1] <#m_2854865445665285661__ftnref1> As explained above, we have understood this question to be asking about scenarios where Registrants are legal persons, as per the EDPB quote at paragraph 1. In respect of individual (natural person) Registrants, the issues will be largely similar: if a natural person incorrectly states that their data is not personal data, then (i) the verification measures should prevent the data from being published, since they will give the data subject an opportunity to correct their mistake; (ii) the mitigating factors and legal arguments described at paragraphs 11.7 and 11.8 and paragraphs 14.1 - 14.6 here, should confer reasonable legal protection for Contracted Parties.

[1] <#m_2854865445665285661__ftnref2> In its judgement in Case C‑136/17 *GC and Others*, the CJEU explained that GDPR obligations relating to an erasure (“Right to Be Forgotten”) request apply “*to the operator of a search engine in the context of his responsibilities, powers and capabilities as the controller of the processing carried out in connection with the activity of the search engine, on the occasion of a verification performed by that operator, under the supervision of the competent national authorities, following a request by the data subject”*. As the Advocate General explained in that case, “*such an operator can act only within the framework of its responsibilities, powers and capabilities. In other words, such an operator may be incapable of ensuring the full effect of the provisions of [EU data protection law], precisely because of its limited responsibilities, powers and capabilities. . . An ex ante control of internet pages which are referenced as the result of a search does not fall within the responsibilities or the capabilities of a search engine*.” It could not know, from the moment it indexed a webpage, that the content of that page was (for example) out of date (as in the original *Google Spain / Costeja* ruling), or (in the *GC and Others* case*) * “special category” or “criminal offence” data for which it required consent.

[2] <#m_2854865445665285661__ftnref3> See, for example, Article 14 <https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32000L0031> of the e-Commerce Directive 2000/31/EC and its transposition into the national laws of EU/EEA Member States and the UK.

_______________________________________________ Gnso-epdp-team mailing listGnso-epdp-team@icann.orghttps://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

Dear Melina, thanks for your explanation. I contend that the data contained in SSAD is publicly available, just as the data contained in the German trade register is publicly available, even though there may be a paywall. Hence publication can mean anything that provides for public access: A physical book, SSAD or RDAP. Anyone with a legitimate interest can apply for an SSAD account just like anyone can apply for an account with the online version of the German trade register. Data in SSAD is publicly available. If NIS 2 comes down on a different interpretation in Germany (although I do not see why it would if even the public trade register is behind a paywall), I would welcome that as well, as it provides me with a legal basis for publication. An obligation based in law to disclose data means there is no longer any risk attached to such disclosures, if done correctly. So when that law comes into effect in my jurisdiction, I will implement it. Before that time, the legal basis is missing and CPs bear the risk of wrongful disclosure. So lets meet again once the implementation data of NIS 2 draws near. Basing policy on non-existent law is premature. "T*o come back to your other point, (i.e., that you are not convinced that the availability of non-personal WHOIS data would contribute to the **security, stability and resilience of the DNS), I trust you are not implying that so many people from all over the world are intensively working on a problem which would be non-existent. * *Currently the vast majority of registration data are not available and the majority of requests from different organisations to access such data remain unanswered.*" This is an issue that SSAD was designed to solve. But the last three years have shown that it is less of a problem than people make it out to be. "*According to a study published in January 2021 by InterIsle Consulting Group, at present, (...)*" This is a statement of alleged fact, but it does not show why this necessarily is an issue. "*Even European government agency and law enforcement requests for redacted WHOIS data have been denied.* (...)" I would imagine that this would only be the case if they were acting outside their legal remit, e.g. outside their jurisdiction. As Theoden said to Gandalf "You have no power here!". All requests with a proper legal basis, e.g. acting inside their own jurisdiction should be answered, and if not, compliance be called. "*(...) where WHOIS data would have been critical to help combat online sexual child abuse cases. According to the complainants, the availability of more WHOIS data in public could help to find perpetrators on the internet.*" And those perpetrators register domain names with existing legal entities as registrants? Because unless this is the case, the argument is irrelevant to the question at hand. "*According to a study published in 2021 by InterIsle Consulting Group, the data suggests that only around 11.5% of domains may belong to natural persons who are protected by GDPR. This 11.5% may be the percentage of domains that is necessary to protect under GDPR. In contrast, registrars and registry operators have redacted contact data from 57.3% of all domains, or five times the amount that may be necessary.*" This statistic misses the point we are debating though as it does not in any way differentiate between legal entities whose data contains personal information, and those where it does not. If it is necessary to redact 100% of registration data or to put it inside the SSAD where access is controlled to protect even 1% of registrants, it is worth doing. Protection of the innocent always takes precedent. "*It would be beneficial if you could explain why non-personal data of legal persons have been redacted and why you object to the effort of having greater transparency while fully respecting privacy of registrants.*" Because blanket redaction of all data is the only way to safely and securely ensure that the personal data of data subjects is protected. There is a reason why even government controlled databases such as the car registration register are redacted. I have not seen a car register where the registration details of legal entities are published. Having that data publicly available might be beneficial for any number of causes. And those are registers that are being kept with a legal basis. "*In light of all the conversations, and B&B advice received, it is clear that the argument of potential liability risk due to inadvertent disclosure of personal data does no longer hold value.*" I wonder which part of the advice we received allowed you to draw this conclusion as the advice always pointed out that risk remains. Please, come again once the demands you are raising are also implemented this way for all public registers in the various countries where you wish to see contracted parties to implement them. Trade registers, car registers, gun ownership registers, sex offender registers, land registers, etc. None of them universally have the level of access you want for mere domain name registrations. That said, if someone demonstrates a legitimate interest with regard to any data, personal or non-personal, they will receive prompt disclosure from us (after the balancing test). If there is significant danger of harm to third parties, we will even grant access even though the requestor may be acting outside their jurisdiction, regardless of whether the registrant is legal or natural. Because granting such access is our moral obligation if a case for disclosure is made. But please do not ask us to provide access levels that even our own governments do not provide for much, much, much more critical data. Best, -- Volker A. Greimann General Counsel and Policy Manager *KEY-SYSTEMS GMBH* T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358. This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached. On Tue, Apr 20, 2021 at 11:47 AM STROUNGI Melina < Melina.STROUNGI@ec.europa.eu> wrote:

Dear Volker,

Thank you for your comments.

Let me come back to your previous email of 15 April (attached) and your email below, in order to hopefully address some of your concerns.

Regarding your argument that ‘the interpretation of the book is only valid if the text actually supports that interpretation’, this is precisely the case with NIS 2 text. The legislator’s intention behind ‘publication’ is explained in recital 62 of NIS 2 Proposal <https://digital-strategy.ec.europa.eu/en/library/proposal-directive-measures...>, which explicitly clarifies that “*TLD registries and the entities providing domain name registration services for them should make publically available domain name registration data that fall outside the scope of Union data protection rules, such as data that concern legal persons*.”

Given the above context, the word ‘publication’ is doubtful to have any other interpretation than the obvious one: ‘publication’ means ‘*making publically available’*. Publically = to the public.

I understand your wish to do otherwise, but just to bear in mind that such wish is not enough to override the actual wording of the text.

We are doing our best to address everyone’s individual concerns (including yours and lots of your comments and suggestions have already been taken into account), but at the same time we need to ensure that contracted parties who wish to differentiate between legal and natural entities and wish to align their practices with the NIS2 proposal are able to do so. We hope that, even if you do not completely find the provisions to your liking, you are willing to facilitate this group’s hard efforts to make some progress before the May deadline.

To come back to your other point, (i.e., that you are not convinced that the availability of non-personal WHOIS data would contribute to the security, stability and resilience of the DNS), I trust you are not implying that so many people from all over the world are intensively working on a problem which would be non-existent.

This is what the current situation looks like:

Currently the vast majority of registration data are not available and the majority of requests from different organisations to access such data remain unanswered.

According to a study published in January 2021 by InterIsle Consulting Group, at present, only 13.5% of domains have an actual registrant identified in WHOIS. Registrars and registry operators have used ICANN’s post-GDPR policy to redact contact data from 57.3% of all domains. Adding proxy-protected domains, this means that 86.5% of registrants cannot be identified via WHOIS. According to statistics from Appdetex, during the period January 1, 2020, through September 1, 2020, only 24.6% of 2,933 requests submitted to 158 ICANN-accredited registrars resulted in responses that included registrant data. These statistics are also consistent with the estimate of the PSWG within ICANN that roughly 70% of requests are being denied or ignored.

Even European government agency and law enforcement requests for redacted WHOIS data have been denied. As described in a May 2020 letter from the ICANN President to the European Data Protection Board, requests that have been made by European Data Protection Authorities for access to redacted, nonpublic WHOIS data to assist in their investigations of potential privacy violations have been denied by domain name registrars and registries.

I will not list all complaints and problems reported, but just as an illustration, complaints from law enforcement authorities have been brought to our attention, where WHOIS data would have been critical to help combat online sexual child abuse cases. According to the complainants, the availability of more WHOIS data in public could help to find perpetrators on the internet.

The publication of domain name registration data concerning legal entities is expected to substantially increase the wealth of information available to the public.

According to a study published in 2021 by InterIsle Consulting Group, the data suggests that only around 11.5% of domains may belong to natural persons who are protected by GDPR. This 11.5% may be the percentage of domains that is necessary to protect under GDPR. In contrast, registrars and registry operators have redacted contact data from 57.3% of all domains, or five times the amount that may be necessary.

I trust that the above give a flavour of the actual situation and problems.

It would be beneficial if you could explain why non-personal data of legal persons have been redacted and why you object to the effort of having greater transparency while fully respecting privacy of registrants.

In light of all the conversations, and B&B advice received, it is clear that the argument of potential liability risk due to inadvertent disclosure of personal data does no longer hold value. If you want to diminish this risk, it is clear that you first have to distinguish between natural and legal entities and then further ensure that legal entities do not provide any personal data (or, if they do provide personal data, that they consent to publishing of such personal data). Then in case of a mistake it will be up to the registrant; not the contracted parties. So in our view the liability argument cannot be used as a justification for not taking action – especially given the many problems that such inaction causes and will continue to cause.

Best regards,

Melina

*From:* Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> *On Behalf Of *Volker Greimann via Gnso-epdp-team *Sent:* Sunday, April 18, 2021 3:04 AM *To:* Stephanie E Perrin <stephanie.perrin@mail.utoronto.ca> *Cc:* GNSO EPDP <gnso-epdp-team@icann.org> *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

I think you both make good points. Our starting point is the current status quo, which I expect will continue on into the far future: All registration data provided as a registrant must be viewed as potential personal information, in a Schroedingers Cat kind-of situation. Until you look at it, you do not know what it is, even though you can make certain assumptions with varying likelihoods. The 2B memo tells us nothing new in that regard.

What it does tell us is that the various methods of determination without looking have risk of various degrees attached.

Miltons proposed registrant-declaration is one of the lower risk ones methods. Stephanie is also right that in a highly competitive market with razor-thin margins, corners will be cut at some point of the channel, especially once you enter the realm of resellers. So Stephanie is absolutely correct in her point that the determination of whether contracted parties can rely on the accuracy of any declaration must be that of the contracted party itself. The declaration of legal status of the registrant ultimately does not help us make that determination. The declaration of content of the data goes a whole lot further in that regard. Controlling the process where the declaration is made helps even more (hence the requirement to allow post-registration declarations).

As for publication vs. disclosure, after having given this some thought, I still tend to come out on the side of disclosure, but with the following features:

- self-declared data sets would be set to automated disclosure.

- public RDAP could contain a marker/flag/label/something that shows that this data set is available for automated disclosure in SSAD

- Disclosure fees for such data sets in SSAD could be priced lower than non-automated data sets, say half-price

- Access levels for access to such data sets could be lower for users of SSAD. For example, if you just want to access automated-disclosure sets, accreditation could be voluntary, and a mere ID-check application process and a statement of legitimate interest for each request could be possible.

Advantages:

- Increased utility of SSAD

- SSAD User Fees would decrease (higher query volumes overall, lower fees for some queries)

- CP Risk would be limited

- CP handling times for requests would be reduced in case they implement that flag.

I still need to hear what the benefits of the differentiation of data sets and better availability of non-personal information really are, though. In my experience it is not like cyber criminals are setting up legal entities such as STEALATRADEMARK, Inc or VIOLATEACOPYRIGHT, Ltd. left and right to register their domain names. Those kinds of domains are usually registered with perfectly accurate personal data sets. If someone could really make the case of what the perceived benefit to all parties concerned is on this (something I have been asking for from days 1), I'd be happy to hear them. The common argument of security, stability and resilience of the DNS went out of the window the day the Temp Spec first came into effect after all, as neither of the three has been affected by the current vegetative state of the WHOIS (In the sense that it is not quite dead yet, but almost. Machines still keep it alive).

This also would solve the issue of thick vs thin RDAP:

If RDAP only returns the basic data set anyway and never any personal information, there is no longer any need to require registrars to provide RDAP services as there no longer is any concern in supplying said data to the registries for centralised publication. Thick RDAP would be saved.

-- Volker A. Greimann General Counsel and Policy Manager *KEY-SYSTEMS GMBH*

T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net <https://urldefense.com/v3/__http:/www.key-systems.net/__;!!DOxrgLBm!XSywrkEo...>

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

On Sat, Apr 17, 2021 at 12:19 AM Stephanie E Perrin via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:

Bird and Bird is offering arguments for protection in the event of complaint. While that protection is welcome and reassuring in terms of risk, I am not certain that we have adequately explained to 2Birds how registration actually takes place. It would have been beneficial to walk them through a range of different ways to register a domain name. As we have discussed in the calls, very often non-savvy non-commercial users or small business/home workers use resellers of various kinds to register their domains. Additional risk creeps in here, WRT whether or not a positive consent has been obtained from relevant employees. Further risk creeps in when we look at automatic renewals, where the contact data may not be updated. If updated, have the steps been taken to get consent from new employees? To me this is key, non-savvy users, and I count myself among them, are not likely to check what an intermediary is doing with respect to the domain renewal or updating.

Now, of course the argument is that they SHOULD be more diligent and they SHOULD pay attention to the accuracy requirements, but lets deal in facts here.....are they? As the data controller who is pre-emptively disclosing personal data, allegedly with consent, to unknown (to the contracted party) third parties, the responsibility still rests with the controller. As I have mentioned, a Facebook or a Google or a Microsoft can get away with treading roughshod over their consent arrangements....not too many folks are going to give up free or necessary services over quibbles in a consent form, even if it is 75 pages long. However the registrars (and to a lesser extent, the registries) are operating in a highly competitive market. Once losing my trust, perhaps over a trifling inattention to the accuracy of my data, and I am transferring my domains to another company. Policing a complex reseller market is also rather a difficult matter that we have not discussed at length in our debates on this issue. I know that the data commissioners as a group do not understand how the accountability for the handling of personal information is transferred in that market, and it would not be surprising if 2Birds did not either. Bottom line: accredited registrars are shouldering the risk here, it is their risk, and they would know best whether they can trust the accuracy of the designation of legal personhood. This is why I think that this designation, in my opinion, should always permit an override by the contracted parties to treat the data as personal. I have suggested many many times that commercial organizations should operate on an accreditation basis and be linked to their official registration numbers (business, corporation, municipal licence etc). Noone ever responds to that idea....if it is totally ridiculous I would certainly like to know why, I am offering it in good faith and I think it would do something useful to stop fraudulent registrations in their names. However, small business and non-commercial organizations, even if incorporated or in possession of a registration # of some kind have different needs and circumstances, and they are frequently treated differently under data protection law.

One final point that I have raised a few times.....we tend to focus on enforcement fines and Court costs. Even if noone ever complains to a DPA or takes a case to Court, where the advice of 2 Birds gives us some comfort that the risk is manageable, and the results would exonerate the contracted parties.....what about reputational damage in the meantime? Court costs? Who actually wants to have customers complaining about the practices? Employee morale, if it is employees who are objecting to the practices?

I support focusing on whether the data submitted is personal or not, with a fulsome definition and description of same, and full flexibility for contracted parties to err on the side of caution and consider the possibility of some data being personal after all. After all, much data is still being disclosed, and noone has adduced strong evidence that the delay in requesting the data (as opposed to getting it from the published data) will have huge repercussions. What is actually at play here is who is doing the extra work....the requesting party, or the data controller.

Stephanie Perrin

On 2021-04-15 10:42 p.m., Mueller, Milton L via Gnso-epdp-team wrote:

*EXTERNAL EMAIL:*

Further legal support from TwoBirds

14.2 If personal data is erroneously included in published Registration Data, it would in this scenario occur despite substantial (VSC) steps taken by the Contracted Parties, and would be primarily attributable to the actions/omissions of the Registrant. This is likely to be taken into account by data subjects, data protection supervisory authorities, and courts.

14.3 The data in question is likely to be low sensitivity. The scenario being envisaged here (mistaken inclusion of personal data in published Registration Data) seems to be most likely to occur when a legal entity (e.g. a company or non-profit organisation) is registering / maintaining its own domains. In those scenarios, we assume the personal data that could be disclosed would ordinarily relate to an employee’s work details (e.g. a company email address), not an individual’s private life. Although the GDPR confers protection even in the workplace, the data in question here may arguably be less capable of causing harm to an individual than data relating to the data subject’s private life.[1] <#m_5832361527529862212_m_2854865445665285661__ftn1>

14.4 In more sensitive cases (e.g. disclosing that a person works for a company in a sensitive or “embarrassing” sector), a Registrant would be putting itself at serious risk of complaints from its own employees. Registrants are therefore already incentivised to avoid errors that could have serious consequences for their own staff.

*From:* Mueller, Milton L *Sent:* Thursday, April 15, 2021 10:34 PM *To:* gnso-epdp-team@icann.org *Subject:* RE: [Gnso-epdp-team] On the proposed guidance

Some legal support for my argument below from Bird & Bird:

There may even be an argument, based on EU Court of Justice (“CJEU”) caselaw, that this is a situation where Contracted Parties should generally only be liable should they fail to properly address a complaint about the data – i.e. only once they are put on notice about the alleged illegality and thereby have an opportunity to “verify” the merits of the complaint. [1] <#m_5832361527529862212_m_2854865445665285661__ftn2> This bears some parallels to other EU liability regimes for operators of services online that process – unwittingly – content that violates EU law.[2] <#m_5832361527529862212_m_2854865445665285661__ftn3> As discussed at footnote 6 below, this is arguably recognised in (at least some) decisions of GDPR supervisory authorities.

In other words, if personal data finds its way into a published registration record that should not be there, an objection can be lodged with the registrar and they can verify the merits and remove the data.

Dr. Milton L Mueller

Georgia Institute of Technology

School of Public Policy

Internet Governance Project <https://urldefense.com/v3/__https:/internetgovernance.org/__;!!DOxrgLBm!XSyw...>

*From:* Mueller, Milton L *Sent:* Thursday, April 15, 2021 9:14 PM *To:* gnso-epdp-team@icann.org *Subject:* FW: [Gnso-epdp-team] On the proposed guidance

...

" Everyone who is named in a role in a registration must have already been informed

...

and consented to all of the conditions involved in the role. " This is the ideal. Sadly, this ideal

...

is very often not the case.

Whoa.

Of course, Volker, it is possible that a person making a registration for a legal person won’t do it properly. But it is absurd to expect a registrar to be legally responsible for that. How can the registrar be liable for privacy breaches made by the registrant? Indeed, I can’t understand why gaining the consent of the administrative assistant of the xyz department to have their name listed in the whois is a matter for DNS/ICANN policy at all. ICANN policy simply needs to inform registrants that under certain conditions the data will be published.

Let’s take an extreme case – suppose a nasty IT manager in a major corporation puts the name, email address and (what the heck) a revenge porn photo of her ex-husband in her company’s registration record. Are you telling me the registrar would be considered responsible for that breach of privacy? Not the nasty IT manager?

Show me a legal case in which that kind of liability has been assigned. I doubt you can, but I await the data from CP lawyers who have been involved in these cases. I do know of several cases in which agents for a corporation wrongly listed themselves as the technical and administrative contact, making it possible for them to hijack the name. The registrar was NEVER held liable for that.

Reminder: We had to reform Whois/RDS policy because ICANN, *as a matter of contractual obligation, required registrars to publish sensitive PII of any and every Registrant*. Once we have removed that obligation, and once we have given registrants knowledge of the conditions under which the data in the record should be published, I don’t see why registrars need to worry about some corporation listing the personal email address of someone in their IT department.

So if this alleged risk is being cited to scare us away from allowing registrants to self-designate as legal or natural, it is a pretty weak case, imho.

--MM

*From:* Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> *On Behalf Of *Volker Greimann via Gnso-epdp-team *Sent:* Thursday, April 15, 2021 10:10 AM *To:* Steve Crocker <steve@shinkuro.com> *Cc:* gnso-epdp-team@icann.org *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

Employees are named by other employees without their knowledge, or remain named long after they leave. From the experience as a registrar dealing with registrants every day, this ideal is an assumption that does not survive contact with reality.

-- Volker A. Greimann General Counsel and Policy Manager *KEY-SYSTEMS GMBH*

T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net <https://urldefense.com/v3/__http:/www.key-systems.net/__;!!DOxrgLBm!XSywrkEo...>

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

On Thu, Apr 15, 2021 at 3:36 PM Steve Crocker via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:

Laureen,

Thanks for your note. With respect to the details under legal person, we believe the issue of consent should be moot. Everyone who is named in a role in a registration must have already been informed and consented to all of the conditions involved in the role. This is a prerequisite for having a working system and is not specific to meeting a privacy regulation. The fact that this requirement is not specified in the existing contractual documentation is an error and needs to be rectified.

Steve

On Thu, Apr 15, 2021 at 6:28 AM Kapin, Laureen via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:

I think we share common ground on many key issues and I would like to build on the many helpful inputs received as to what would be advisable.

*Goal*: publish non-personal, non-protected data to the greatest extent permissible under the GDPR and within low legal risks to data controllers and processors. Note, the description below does *not *fully detail the advised safeguards which B&B has documented and which we’ve adopted in our prior input because my impression is that we generally agree that the safeguards are prudent. This description merely seeks to identify the key steps that must be taken to ensure that personal data is identified and protected and non-personal data is published. I also highlight the addition of a potential additional safeguard – Confirmation. I think this process incorporates what we’ve discussed and inputs received and could form a useful framework for discussion.

*Note:*

n *New Registrations: *This process applies to new registrations (Steve C. has some useful thoughts on how to deal with existing Registrations)

n *Publish: *When I use the word “publish,” I mean made public directly; not via the SSAD.

n *Flexibility: *Based on input from our Registrar colleagues, we should permit flexibility for how these steps are implemented to account for the varied business models in place.

n *Timing: *All identifications need to take place at the time of registration or shortly thereafter (w/in the 13-day accuracy verification window) and no registration data should be published until the identification, consent, and confirmation process concludes

*Process:*

1. A threshold identification of the registrant as a natural or legal person;

a. If natural, registration info redacted

b. If legal, further inquiries and advisories (safeguards):

i. if the legal person identifies that it has a protected status under the GDPR

1. registration info redacted

ii. If the legal person registration contains personal data, advise of consequences (publication)

1. Obtain necessary consents

2. *Possible additional safeguard*: *Ask Registrant to Confirm any identification that will result in publication of contact data *(akin to confirming a flight reservation or stock trade)

a. Publish

3. If no consent

a. Redact

2. Provide quick and easy opportunity to correct any mistakes

I hope this is useful.

Kind regards,

Laureen Kapin

Counsel for International Consumer Protection

Federal Trade Commission

(202) 326-3237

*From:* Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> *On Behalf Of *Volker Greimann via Gnso-epdp-team *Sent:* Thursday, April 15, 2021 8:35 AM *To:* Hadia Abdelsalam Mokhtar EL miniawi <Hadia@tra.gov.eg> *Cc:* gnso-epdp-team@icann.org *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

I think we need to be cognisant of the current status quo and use that as the basis for our thoughts on the matter:

1) There is no differentiation between legal or natural contacts.

2) The redaction of all contacts is permitted and has become the de-facto standard.

3) We allow consent-based disclosure.

4) NIS 2 may at some point in the future require publication of non-personal information.

This leads to two very simple follow-on questions:

a) How do we identify such non-personal information? What is really necessary for this end?

b) What would publication entail?

For a) we and Twobirds identified voluntary self-declaration of the data submitted. As all data is redacted by default, the differentiation of the data subject category is irrelevant as it ultimately only boils down to the declaration of the data subject thatthe data contains no personal information.

For b), the term "publish" is undefined. For all we know, it could mean publication in a physical print edition (it doesn't mean that though). But publication within SSAD can very well be sufficient for that definition. There is no reason whatsoever to assume differently.

-- Volker A. Greimann General Counsel and Policy Manager *KEY-SYSTEMS GMBH*

T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net <https://urldefense.com/v3/__http:/www.key-systems.net/__;!!DOxrgLBm!XSywrkEo...>

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

<https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&...>

Virus-free. www.avast.com <https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&...>

On Thu, Apr 15, 2021 at 1:52 PM Hadia Abdelsalam Mokhtar EL miniawi via Gnso-epdp-team <gnso-epdp-team@icann.org> wrote:

Dear Milton,

Thank you for your constructive thoughts. I believe we have a lot to build on. In relation to principle one, I think we all agree that some legal data subjects would want to publish their data in the RDDS, but without your first principle they can only do this through consent. The legal memo received lately from Bird & Bird explains that if CPs publish the data of legal persons based on consent they are at a higher risk than if they publish the data of legal persons based on self-designation. In the latter case CPs might only be liable if they fail to address a complaint. So the question always was: what is the benefit of labeling the data as belonging to a natural or legal person? Of course we all know that GDPR protects the data of natural persons and not legal persons, but the important answer now is that the distinction significantly reduces the liability of CPs. In addition, the distinction is helpful in performing the balancing test in case the data is not published and I am sure if we look into individual use cases we can find much more benefits. Moreover, it could prove to be useful regarding possible upcoming regulations. I would also add that the level of protection assigned to the data elements suggested by Steve provides additional safe guards and flexibility in the implementation.

Finally, I join you in being optimistic about our ability to finish this.

Kind regards

Hadia

*From:* Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] *On Behalf Of *Mueller, Milton L via Gnso-epdp-team *Sent:* Wednesday, April 14, 2021 10:12 PM *To:* gnso-epdp-team@icann.org *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

Colleagues:

I have only gotten time to review the latest Guidance document and the surrounding debate today. Apologies, but there is a lot going on in my day job.

I am disappointed to see that we seem to be going backwards. I see divergence rather than convergence on the way we are approaching the problem.

I see no point in adding more noise to the current document via the Comments function. What I would like to try to do is articulate some broad principles about how to deal with the legal/natural distinction. If we can agree on those principles, it will be relatively easy to complete the document. If we cannot/do not agree on those principles, additional wordsmithing and debates over terms will not get us anywhere.

So here are the broad principles that I would offer up for debate:

1. The legal/natural distinction is relevant and we need to find a way make it in RDDS without compromising privacy rights.

2. Registrants should be able to self-designate as legal or natural, with no burden of authentication placed on registrars or registries

3. To protect small home offices or NGOs who are technically Legal persons but whose registration data may include Personal data, we need an additional check in the process.

4. As long as they conform with the above 3 principles, registrars/ries (CPs) should be given maximum flexibility to choose the way to differentiate.

Principle 1 discussion:

If we cannot agree on this (or agree to abandon this principle), _*nothing else will fall into place*_. Ever. So let’s settle that. Steve and Volker I suspect will disagree with this principle. Steve has argued that the L/N distinction is “not a central concern” and all that matters is whether the registrant’s data is to be made available to anyone. If he is right, we can discard the guidance altogether, because we already have a recommendation to allow the RNH to consent to the publication of their data. Volker has also suggested that it is personal data we need to differentiate, not L/N . I disagree with Steve and Volker on this and so do most of the rest of the group. L/N distinction is a central concern to certain stakeholder groups in the EPDP, because a) GDPR and other data protection laws do not protect it and this process is all about bringing RDS into compliance with privacy law; b) Legal person data could be published and it would provide easier access to their registration data. As a NCSG member I can find no basis for objecting to the publication of WalMart’s, Kroger’s or the local hardware store’s registration data. Any concerns about PII are addressed by principles 2 and 3. Steve is approaching this as an engineer, but this is a policy process, and we will not obtain agreement on a solution unless certain stakeholders are satisfied. If they think it is a central concern, it’s a central concern, that’s how policy/politics work.

Principle 2 discussion

This is the key principle that keeps NCSG and CPH satisfied. Registrants are in control of how they are designated. Yes, this means that some people will lie. That is just something we will have to accept. One cannot erase that possibility without creating a system that is too burdensome and costly as to outweigh any benefits.

Principle 3 discussion

This is something everyone seems to agree on already. But it is good to make it explicit, then we can work out how specific our guidance can get, so as to conform to …

Principle 4

Avoid being overly prescriptive, but ensure that the other 3 principles are honored. So yes, Volker, we give you maximum flexibility to implement in accordance with different business models, but you can NOT make a designation for a RNH, because it violates principle 2.

I truly believe that if we can come to agreement on these 4 principles and use them as the basis for drafting guidance, we can actually finish this.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-t...> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm...>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XS...>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

<https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&...>

Virus-free. www.avast.com <https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&...>

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-t...> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm...>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XS...>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-t...> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm...>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XS...>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

------------------------------

------------------------------

[1] <#m_5832361527529862212_m_2854865445665285661__ftnref1> As explained above, we have understood this question to be asking about scenarios where Registrants are legal persons, as per the EDPB quote at paragraph 1. In respect of individual (natural person) Registrants, the issues will be largely similar: if a natural person incorrectly states that their data is not personal data, then (i) the verification measures should prevent the data from being published, since they will give the data subject an opportunity to correct their mistake; (ii) the mitigating factors and legal arguments described at paragraphs 11.7 and 11.8 and paragraphs 14.1 - 14.6 here, should confer reasonable legal protection for Contracted Parties.

[1] <#m_5832361527529862212_m_2854865445665285661__ftnref2> In its judgement in Case C‑136/17 *GC and Others*, the CJEU explained that GDPR obligations relating to an erasure (“Right to Be Forgotten”) request apply “*to the operator of a search engine in the context of his responsibilities, powers and capabilities as the controller of the processing carried out in connection with the activity of the search engine, on the occasion of a verification performed by that operator, under the supervision of the competent national authorities, following a request by the data subject”*. As the Advocate General explained in that case, “*such an operator can act only within the framework of its responsibilities, powers and capabilities. In other words, such an operator may be incapable of ensuring the full effect of the provisions of [EU data protection law], precisely because of its limited responsibilities, powers and capabilities. . . An ex ante control of internet pages which are referenced as the result of a search does not fall within the responsibilities or the capabilities of a search engine*.” It could not know, from the moment it indexed a webpage, that the content of that page was (for example) out of date (as in the original *Google Spain / Costeja* ruling), or (in the *GC and Others* case*) * “special category” or “criminal offence” data for which it required consent.

[2] <#m_5832361527529862212_m_2854865445665285661__ftnref3> See, for example, Article 14 <https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32000L0031> of the e-Commerce Directive 2000/31/EC and its transposition into the national laws of EU/EEA Member States and the UK.

_______________________________________________

Gnso-epdp-team mailing list

Gnso-epdp-team@icann.org

https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-t...>

_______________________________________________

By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm...>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XS...>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-t...> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm...>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XS...>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

Volker, To me, the term "publicly available" means available to anyone without qualification as to the purpose and without any controls on the use. You seem to be using the term differently. The discussion within this working group of what data is to be made available publicly is just one part of the larger discussion regarding who should have access to which data and for which purposes. The idea of SSAD or any other differentiated access system is to implement those yet to be determined rules. What is your understanding of what the rules regarding access to non-public data should be? Thanks, Steve On Tue, Apr 20, 2021 at 3:31 AM Volker Greimann via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:

Dear Melina,

thanks for your explanation.

I contend that the data contained in SSAD is publicly available, just as the data contained in the German trade register is publicly available, even though there may be a paywall. Hence publication can mean anything that provides for public access: A physical book, SSAD or RDAP. Anyone with a legitimate interest can apply for an SSAD account just like anyone can apply for an account with the online version of the German trade register. Data in SSAD is publicly available.

If NIS 2 comes down on a different interpretation in Germany (although I do not see why it would if even the public trade register is behind a paywall), I would welcome that as well, as it provides me with a legal basis for publication. An obligation based in law to disclose data means there is no longer any risk attached to such disclosures, if done correctly. So when that law comes into effect in my jurisdiction, I will implement it. Before that time, the legal basis is missing and CPs bear the risk of wrongful disclosure. So lets meet again once the implementation data of NIS 2 draws near. Basing policy on non-existent law is premature.

"T*o come back to your other point, (i.e., that you are not convinced that the availability of non-personal WHOIS data would contribute to the **security, stability and resilience of the DNS), I trust you are not implying that so many people from all over the world are intensively working on a problem which would be non-existent. *

*Currently the vast majority of registration data are not available and the majority of requests from different organisations to access such data remain unanswered.*"

This is an issue that SSAD was designed to solve. But the last three years have shown that it is less of a problem than people make it out to be.

"*According to a study published in January 2021 by InterIsle Consulting Group, at present, (...)*"

This is a statement of alleged fact, but it does not show why this necessarily is an issue.

"*Even European government agency and law enforcement requests for redacted WHOIS data have been denied.* (...)"

I would imagine that this would only be the case if they were acting outside their legal remit, e.g. outside their jurisdiction. As Theoden said to Gandalf "You have no power here!". All requests with a proper legal basis, e.g. acting inside their own jurisdiction should be answered, and if not, compliance be called.

"*(...) where WHOIS data would have been critical to help combat online sexual child abuse cases. According to the complainants, the availability of more WHOIS data in public could help to find perpetrators on the internet.*"

And those perpetrators register domain names with existing legal entities as registrants? Because unless this is the case, the argument is irrelevant to the question at hand.

"*According to a study published in 2021 by InterIsle Consulting Group, the data suggests that only around 11.5% of domains may belong to natural persons who are protected by GDPR. This 11.5% may be the percentage of domains that is necessary to protect under GDPR. In contrast, registrars and registry operators have redacted contact data from 57.3% of all domains, or five times the amount that may be necessary.*"

This statistic misses the point we are debating though as it does not in any way differentiate between legal entities whose data contains personal information, and those where it does not. If it is necessary to redact 100% of registration data or to put it inside the SSAD where access is controlled to protect even 1% of registrants, it is worth doing. Protection of the innocent always takes precedent.

"*It would be beneficial if you could explain why non-personal data of legal persons have been redacted and why you object to the effort of having greater transparency while fully respecting privacy of registrants.*"

Because blanket redaction of all data is the only way to safely and securely ensure that the personal data of data subjects is protected. There is a reason why even government controlled databases such as the car registration register are redacted. I have not seen a car register where the registration details of legal entities are published. Having that data publicly available might be beneficial for any number of causes. And those are registers that are being kept with a legal basis.

"*In light of all the conversations, and B&B advice received, it is clear that the argument of potential liability risk due to inadvertent disclosure of personal data does no longer hold value.*"

I wonder which part of the advice we received allowed you to draw this conclusion as the advice always pointed out that risk remains.

Please, come again once the demands you are raising are also implemented this way for all public registers in the various countries where you wish to see contracted parties to implement them. Trade registers, car registers, gun ownership registers, sex offender registers, land registers, etc. None of them universally have the level of access you want for mere domain name registrations.

That said, if someone demonstrates a legitimate interest with regard to any data, personal or non-personal, they will receive prompt disclosure from us (after the balancing test). If there is significant danger of harm to third parties, we will even grant access even though the requestor may be acting outside their jurisdiction, regardless of whether the registrant is legal or natural. Because granting such access is our moral obligation if a case for disclosure is made.

But please do not ask us to provide access levels that even our own governments do not provide for much, much, much more critical data.

Best,

-- Volker A. Greimann General Counsel and Policy Manager *KEY-SYSTEMS GMBH*

T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

On Tue, Apr 20, 2021 at 11:47 AM STROUNGI Melina < Melina.STROUNGI@ec.europa.eu> wrote:

...

Dear Volker,

Thank you for your comments.

Let me come back to your previous email of 15 April (attached) and your email below, in order to hopefully address some of your concerns.

Regarding your argument that ‘the interpretation of the book is only valid if the text actually supports that interpretation’, this is precisely the case with NIS 2 text. The legislator’s intention behind ‘publication’ is explained in recital 62 of NIS 2 Proposal <https://digital-strategy.ec.europa.eu/en/library/proposal-directive-measures...>, which explicitly clarifies that “*TLD registries and the entities providing domain name registration services for them should make publically available domain name registration data that fall outside the scope of Union data protection rules, such as data that concern legal persons*.”

Given the above context, the word ‘publication’ is doubtful to have any other interpretation than the obvious one: ‘publication’ means ‘*making publically available’*. Publically = to the public.

I understand your wish to do otherwise, but just to bear in mind that such wish is not enough to override the actual wording of the text.

We are doing our best to address everyone’s individual concerns (including yours and lots of your comments and suggestions have already been taken into account), but at the same time we need to ensure that contracted parties who wish to differentiate between legal and natural entities and wish to align their practices with the NIS2 proposal are able to do so. We hope that, even if you do not completely find the provisions to your liking, you are willing to facilitate this group’s hard efforts to make some progress before the May deadline.

To come back to your other point, (i.e., that you are not convinced that the availability of non-personal WHOIS data would contribute to the security, stability and resilience of the DNS), I trust you are not implying that so many people from all over the world are intensively working on a problem which would be non-existent.

This is what the current situation looks like:

Currently the vast majority of registration data are not available and the majority of requests from different organisations to access such data remain unanswered.

According to a study published in January 2021 by InterIsle Consulting Group, at present, only 13.5% of domains have an actual registrant identified in WHOIS. Registrars and registry operators have used ICANN’s post-GDPR policy to redact contact data from 57.3% of all domains. Adding proxy-protected domains, this means that 86.5% of registrants cannot be identified via WHOIS. According to statistics from Appdetex, during the period January 1, 2020, through September 1, 2020, only 24.6% of 2,933 requests submitted to 158 ICANN-accredited registrars resulted in responses that included registrant data. These statistics are also consistent with the estimate of the PSWG within ICANN that roughly 70% of requests are being denied or ignored.

Even European government agency and law enforcement requests for redacted WHOIS data have been denied. As described in a May 2020 letter from the ICANN President to the European Data Protection Board, requests that have been made by European Data Protection Authorities for access to redacted, nonpublic WHOIS data to assist in their investigations of potential privacy violations have been denied by domain name registrars and registries.

I will not list all complaints and problems reported, but just as an illustration, complaints from law enforcement authorities have been brought to our attention, where WHOIS data would have been critical to help combat online sexual child abuse cases. According to the complainants, the availability of more WHOIS data in public could help to find perpetrators on the internet.

The publication of domain name registration data concerning legal entities is expected to substantially increase the wealth of information available to the public.

According to a study published in 2021 by InterIsle Consulting Group, the data suggests that only around 11.5% of domains may belong to natural persons who are protected by GDPR. This 11.5% may be the percentage of domains that is necessary to protect under GDPR. In contrast, registrars and registry operators have redacted contact data from 57.3% of all domains, or five times the amount that may be necessary.

I trust that the above give a flavour of the actual situation and problems.

It would be beneficial if you could explain why non-personal data of legal persons have been redacted and why you object to the effort of having greater transparency while fully respecting privacy of registrants.

In light of all the conversations, and B&B advice received, it is clear that the argument of potential liability risk due to inadvertent disclosure of personal data does no longer hold value. If you want to diminish this risk, it is clear that you first have to distinguish between natural and legal entities and then further ensure that legal entities do not provide any personal data (or, if they do provide personal data, that they consent to publishing of such personal data). Then in case of a mistake it will be up to the registrant; not the contracted parties. So in our view the liability argument cannot be used as a justification for not taking action – especially given the many problems that such inaction causes and will continue to cause.

Best regards,

Melina

*From:* Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> *On Behalf Of *Volker Greimann via Gnso-epdp-team *Sent:* Sunday, April 18, 2021 3:04 AM *To:* Stephanie E Perrin <stephanie.perrin@mail.utoronto.ca> *Cc:* GNSO EPDP <gnso-epdp-team@icann.org> *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

I think you both make good points. Our starting point is the current status quo, which I expect will continue on into the far future: All registration data provided as a registrant must be viewed as potential personal information, in a Schroedingers Cat kind-of situation. Until you look at it, you do not know what it is, even though you can make certain assumptions with varying likelihoods. The 2B memo tells us nothing new in that regard.

What it does tell us is that the various methods of determination without looking have risk of various degrees attached.

Miltons proposed registrant-declaration is one of the lower risk ones methods. Stephanie is also right that in a highly competitive market with razor-thin margins, corners will be cut at some point of the channel, especially once you enter the realm of resellers. So Stephanie is absolutely correct in her point that the determination of whether contracted parties can rely on the accuracy of any declaration must be that of the contracted party itself. The declaration of legal status of the registrant ultimately does not help us make that determination. The declaration of content of the data goes a whole lot further in that regard. Controlling the process where the declaration is made helps even more (hence the requirement to allow post-registration declarations).

As for publication vs. disclosure, after having given this some thought, I still tend to come out on the side of disclosure, but with the following features:

- self-declared data sets would be set to automated disclosure.

- public RDAP could contain a marker/flag/label/something that shows that this data set is available for automated disclosure in SSAD

- Disclosure fees for such data sets in SSAD could be priced lower than non-automated data sets, say half-price

- Access levels for access to such data sets could be lower for users of SSAD. For example, if you just want to access automated-disclosure sets, accreditation could be voluntary, and a mere ID-check application process and a statement of legitimate interest for each request could be possible.

Advantages:

- Increased utility of SSAD

- SSAD User Fees would decrease (higher query volumes overall, lower fees for some queries)

- CP Risk would be limited

- CP handling times for requests would be reduced in case they implement that flag.

I still need to hear what the benefits of the differentiation of data sets and better availability of non-personal information really are, though. In my experience it is not like cyber criminals are setting up legal entities such as STEALATRADEMARK, Inc or VIOLATEACOPYRIGHT, Ltd. left and right to register their domain names. Those kinds of domains are usually registered with perfectly accurate personal data sets. If someone could really make the case of what the perceived benefit to all parties concerned is on this (something I have been asking for from days 1), I'd be happy to hear them. The common argument of security, stability and resilience of the DNS went out of the window the day the Temp Spec first came into effect after all, as neither of the three has been affected by the current vegetative state of the WHOIS (In the sense that it is not quite dead yet, but almost. Machines still keep it alive).

This also would solve the issue of thick vs thin RDAP:

If RDAP only returns the basic data set anyway and never any personal information, there is no longer any need to require registrars to provide RDAP services as there no longer is any concern in supplying said data to the registries for centralised publication. Thick RDAP would be saved.

-- Volker A. Greimann General Counsel and Policy Manager *KEY-SYSTEMS GMBH*

T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net <https://urldefense.com/v3/__http:/www.key-systems.net/__;!!DOxrgLBm!XSywrkEo...>

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

On Sat, Apr 17, 2021 at 12:19 AM Stephanie E Perrin via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:

Bird and Bird is offering arguments for protection in the event of complaint. While that protection is welcome and reassuring in terms of risk, I am not certain that we have adequately explained to 2Birds how registration actually takes place. It would have been beneficial to walk them through a range of different ways to register a domain name. As we have discussed in the calls, very often non-savvy non-commercial users or small business/home workers use resellers of various kinds to register their domains. Additional risk creeps in here, WRT whether or not a positive consent has been obtained from relevant employees. Further risk creeps in when we look at automatic renewals, where the contact data may not be updated. If updated, have the steps been taken to get consent from new employees? To me this is key, non-savvy users, and I count myself among them, are not likely to check what an intermediary is doing with respect to the domain renewal or updating.

Now, of course the argument is that they SHOULD be more diligent and they SHOULD pay attention to the accuracy requirements, but lets deal in facts here.....are they? As the data controller who is pre-emptively disclosing personal data, allegedly with consent, to unknown (to the contracted party) third parties, the responsibility still rests with the controller. As I have mentioned, a Facebook or a Google or a Microsoft can get away with treading roughshod over their consent arrangements....not too many folks are going to give up free or necessary services over quibbles in a consent form, even if it is 75 pages long. However the registrars (and to a lesser extent, the registries) are operating in a highly competitive market. Once losing my trust, perhaps over a trifling inattention to the accuracy of my data, and I am transferring my domains to another company. Policing a complex reseller market is also rather a difficult matter that we have not discussed at length in our debates on this issue. I know that the data commissioners as a group do not understand how the accountability for the handling of personal information is transferred in that market, and it would not be surprising if 2Birds did not either. Bottom line: accredited registrars are shouldering the risk here, it is their risk, and they would know best whether they can trust the accuracy of the designation of legal personhood. This is why I think that this designation, in my opinion, should always permit an override by the contracted parties to treat the data as personal. I have suggested many many times that commercial organizations should operate on an accreditation basis and be linked to their official registration numbers (business, corporation, municipal licence etc). Noone ever responds to that idea....if it is totally ridiculous I would certainly like to know why, I am offering it in good faith and I think it would do something useful to stop fraudulent registrations in their names. However, small business and non-commercial organizations, even if incorporated or in possession of a registration # of some kind have different needs and circumstances, and they are frequently treated differently under data protection law.

One final point that I have raised a few times.....we tend to focus on enforcement fines and Court costs. Even if noone ever complains to a DPA or takes a case to Court, where the advice of 2 Birds gives us some comfort that the risk is manageable, and the results would exonerate the contracted parties.....what about reputational damage in the meantime? Court costs? Who actually wants to have customers complaining about the practices? Employee morale, if it is employees who are objecting to the practices?

I support focusing on whether the data submitted is personal or not, with a fulsome definition and description of same, and full flexibility for contracted parties to err on the side of caution and consider the possibility of some data being personal after all. After all, much data is still being disclosed, and noone has adduced strong evidence that the delay in requesting the data (as opposed to getting it from the published data) will have huge repercussions. What is actually at play here is who is doing the extra work....the requesting party, or the data controller.

Stephanie Perrin

On 2021-04-15 10:42 p.m., Mueller, Milton L via Gnso-epdp-team wrote:

*EXTERNAL EMAIL:*

Further legal support from TwoBirds

14.2 If personal data is erroneously included in published Registration Data, it would in this scenario occur despite substantial (VSC) steps taken by the Contracted Parties, and would be primarily attributable to the actions/omissions of the Registrant. This is likely to be taken into account by data subjects, data protection supervisory authorities, and courts.

14.3 The data in question is likely to be low sensitivity. The scenario being envisaged here (mistaken inclusion of personal data in published Registration Data) seems to be most likely to occur when a legal entity (e.g. a company or non-profit organisation) is registering / maintaining its own domains. In those scenarios, we assume the personal data that could be disclosed would ordinarily relate to an employee’s work details (e.g. a company email address), not an individual’s private life. Although the GDPR confers protection even in the workplace, the data in question here may arguably be less capable of causing harm to an individual than data relating to the data subject’s private life.[1] <#m_4115156499825390581_m_8997009847875421100_m_5832361527529862212_m_2854865445665285661__ftn1>

14.4 In more sensitive cases (e.g. disclosing that a person works for a company in a sensitive or “embarrassing” sector), a Registrant would be putting itself at serious risk of complaints from its own employees. Registrants are therefore already incentivised to avoid errors that could have serious consequences for their own staff.

*From:* Mueller, Milton L *Sent:* Thursday, April 15, 2021 10:34 PM *To:* gnso-epdp-team@icann.org *Subject:* RE: [Gnso-epdp-team] On the proposed guidance

Some legal support for my argument below from Bird & Bird:

There may even be an argument, based on EU Court of Justice (“CJEU”) caselaw, that this is a situation where Contracted Parties should generally only be liable should they fail to properly address a complaint about the data – i.e. only once they are put on notice about the alleged illegality and thereby have an opportunity to “verify” the merits of the complaint. [1] <#m_4115156499825390581_m_8997009847875421100_m_5832361527529862212_m_2854865445665285661__ftn2> This bears some parallels to other EU liability regimes for operators of services online that process – unwittingly – content that violates EU law. [2] <#m_4115156499825390581_m_8997009847875421100_m_5832361527529862212_m_2854865445665285661__ftn3> As discussed at footnote 6 below, this is arguably recognised in (at least some) decisions of GDPR supervisory authorities.

In other words, if personal data finds its way into a published registration record that should not be there, an objection can be lodged with the registrar and they can verify the merits and remove the data.

Dr. Milton L Mueller

Georgia Institute of Technology

School of Public Policy

Internet Governance Project <https://urldefense.com/v3/__https:/internetgovernance.org/__;!!DOxrgLBm!XSyw...>

*From:* Mueller, Milton L *Sent:* Thursday, April 15, 2021 9:14 PM *To:* gnso-epdp-team@icann.org *Subject:* FW: [Gnso-epdp-team] On the proposed guidance

...

" Everyone who is named in a role in a registration must have already been informed

...

and consented to all of the conditions involved in the role. " This is the ideal. Sadly, this ideal

...

is very often not the case.

Whoa.

Of course, Volker, it is possible that a person making a registration for a legal person won’t do it properly. But it is absurd to expect a registrar to be legally responsible for that. How can the registrar be liable for privacy breaches made by the registrant? Indeed, I can’t understand why gaining the consent of the administrative assistant of the xyz department to have their name listed in the whois is a matter for DNS/ICANN policy at all. ICANN policy simply needs to inform registrants that under certain conditions the data will be published.

Let’s take an extreme case – suppose a nasty IT manager in a major corporation puts the name, email address and (what the heck) a revenge porn photo of her ex-husband in her company’s registration record. Are you telling me the registrar would be considered responsible for that breach of privacy? Not the nasty IT manager?

Show me a legal case in which that kind of liability has been assigned. I doubt you can, but I await the data from CP lawyers who have been involved in these cases. I do know of several cases in which agents for a corporation wrongly listed themselves as the technical and administrative contact, making it possible for them to hijack the name. The registrar was NEVER held liable for that.

Reminder: We had to reform Whois/RDS policy because ICANN, *as a matter of contractual obligation, required registrars to publish sensitive PII of any and every Registrant*. Once we have removed that obligation, and once we have given registrants knowledge of the conditions under which the data in the record should be published, I don’t see why registrars need to worry about some corporation listing the personal email address of someone in their IT department.

So if this alleged risk is being cited to scare us away from allowing registrants to self-designate as legal or natural, it is a pretty weak case, imho.

--MM

*From:* Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> *On Behalf Of *Volker Greimann via Gnso-epdp-team *Sent:* Thursday, April 15, 2021 10:10 AM *To:* Steve Crocker <steve@shinkuro.com> *Cc:* gnso-epdp-team@icann.org *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

Employees are named by other employees without their knowledge, or remain named long after they leave. From the experience as a registrar dealing with registrants every day, this ideal is an assumption that does not survive contact with reality.

-- Volker A. Greimann General Counsel and Policy Manager *KEY-SYSTEMS GMBH*

T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net <https://urldefense.com/v3/__http:/www.key-systems.net/__;!!DOxrgLBm!XSywrkEo...>

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

On Thu, Apr 15, 2021 at 3:36 PM Steve Crocker via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:

Laureen,

Thanks for your note. With respect to the details under legal person, we believe the issue of consent should be moot. Everyone who is named in a role in a registration must have already been informed and consented to all of the conditions involved in the role. This is a prerequisite for having a working system and is not specific to meeting a privacy regulation. The fact that this requirement is not specified in the existing contractual documentation is an error and needs to be rectified.

Steve

On Thu, Apr 15, 2021 at 6:28 AM Kapin, Laureen via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:

I think we share common ground on many key issues and I would like to build on the many helpful inputs received as to what would be advisable.

*Goal*: publish non-personal, non-protected data to the greatest extent permissible under the GDPR and within low legal risks to data controllers and processors. Note, the description below does *not *fully detail the advised safeguards which B&B has documented and which we’ve adopted in our prior input because my impression is that we generally agree that the safeguards are prudent. This description merely seeks to identify the key steps that must be taken to ensure that personal data is identified and protected and non-personal data is published. I also highlight the addition of a potential additional safeguard – Confirmation. I think this process incorporates what we’ve discussed and inputs received and could form a useful framework for discussion.

*Note:*

n *New Registrations: *This process applies to new registrations (Steve C. has some useful thoughts on how to deal with existing Registrations)

n *Publish: *When I use the word “publish,” I mean made public directly; not via the SSAD.

n *Flexibility: *Based on input from our Registrar colleagues, we should permit flexibility for how these steps are implemented to account for the varied business models in place.

n *Timing: *All identifications need to take place at the time of registration or shortly thereafter (w/in the 13-day accuracy verification window) and no registration data should be published until the identification, consent, and confirmation process concludes

*Process:*

1. A threshold identification of the registrant as a natural or legal person;

a. If natural, registration info redacted

b. If legal, further inquiries and advisories (safeguards):

i. if the legal person identifies that it has a protected status under the GDPR

1. registration info redacted

ii. If the legal person registration contains personal data, advise of consequences (publication)

1. Obtain necessary consents

2. *Possible additional safeguard*: *Ask Registrant to Confirm any identification that will result in publication of contact data *(akin to confirming a flight reservation or stock trade)

a. Publish

3. If no consent

a. Redact

2. Provide quick and easy opportunity to correct any mistakes

I hope this is useful.

Kind regards,

Laureen Kapin

Counsel for International Consumer Protection

Federal Trade Commission

(202) 326-3237

*From:* Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> *On Behalf Of *Volker Greimann via Gnso-epdp-team *Sent:* Thursday, April 15, 2021 8:35 AM *To:* Hadia Abdelsalam Mokhtar EL miniawi <Hadia@tra.gov.eg> *Cc:* gnso-epdp-team@icann.org *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

I think we need to be cognisant of the current status quo and use that as the basis for our thoughts on the matter:

1) There is no differentiation between legal or natural contacts.

2) The redaction of all contacts is permitted and has become the de-facto standard.

3) We allow consent-based disclosure.

4) NIS 2 may at some point in the future require publication of non-personal information.

This leads to two very simple follow-on questions:

a) How do we identify such non-personal information? What is really necessary for this end?

b) What would publication entail?

For a) we and Twobirds identified voluntary self-declaration of the data submitted. As all data is redacted by default, the differentiation of the data subject category is irrelevant as it ultimately only boils down to the declaration of the data subject thatthe data contains no personal information.

For b), the term "publish" is undefined. For all we know, it could mean publication in a physical print edition (it doesn't mean that though). But publication within SSAD can very well be sufficient for that definition. There is no reason whatsoever to assume differently.

-- Volker A. Greimann General Counsel and Policy Manager *KEY-SYSTEMS GMBH*

T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net <https://urldefense.com/v3/__http:/www.key-systems.net/__;!!DOxrgLBm!XSywrkEo...>

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

<https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&...>

Virus-free. www.avast.com <https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&...>

On Thu, Apr 15, 2021 at 1:52 PM Hadia Abdelsalam Mokhtar EL miniawi via Gnso-epdp-team <gnso-epdp-team@icann.org> wrote:

Dear Milton,

Thank you for your constructive thoughts. I believe we have a lot to build on. In relation to principle one, I think we all agree that some legal data subjects would want to publish their data in the RDDS, but without your first principle they can only do this through consent. The legal memo received lately from Bird & Bird explains that if CPs publish the data of legal persons based on consent they are at a higher risk than if they publish the data of legal persons based on self-designation. In the latter case CPs might only be liable if they fail to address a complaint. So the question always was: what is the benefit of labeling the data as belonging to a natural or legal person? Of course we all know that GDPR protects the data of natural persons and not legal persons, but the important answer now is that the distinction significantly reduces the liability of CPs. In addition, the distinction is helpful in performing the balancing test in case the data is not published and I am sure if we look into individual use cases we can find much more benefits. Moreover, it could prove to be useful regarding possible upcoming regulations. I would also add that the level of protection assigned to the data elements suggested by Steve provides additional safe guards and flexibility in the implementation.

Finally, I join you in being optimistic about our ability to finish this.

Kind regards

Hadia

*From:* Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] *On Behalf Of *Mueller, Milton L via Gnso-epdp-team *Sent:* Wednesday, April 14, 2021 10:12 PM *To:* gnso-epdp-team@icann.org *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

Colleagues:

I have only gotten time to review the latest Guidance document and the surrounding debate today. Apologies, but there is a lot going on in my day job.

I am disappointed to see that we seem to be going backwards. I see divergence rather than convergence on the way we are approaching the problem.

I see no point in adding more noise to the current document via the Comments function. What I would like to try to do is articulate some broad principles about how to deal with the legal/natural distinction. If we can agree on those principles, it will be relatively easy to complete the document. If we cannot/do not agree on those principles, additional wordsmithing and debates over terms will not get us anywhere.

So here are the broad principles that I would offer up for debate:

1. The legal/natural distinction is relevant and we need to find a way make it in RDDS without compromising privacy rights.

2. Registrants should be able to self-designate as legal or natural, with no burden of authentication placed on registrars or registries

3. To protect small home offices or NGOs who are technically Legal persons but whose registration data may include Personal data, we need an additional check in the process.

4. As long as they conform with the above 3 principles, registrars/ries (CPs) should be given maximum flexibility to choose the way to differentiate.

Principle 1 discussion:

If we cannot agree on this (or agree to abandon this principle), _*nothing else will fall into place*_. Ever. So let’s settle that. Steve and Volker I suspect will disagree with this principle. Steve has argued that the L/N distinction is “not a central concern” and all that matters is whether the registrant’s data is to be made available to anyone. If he is right, we can discard the guidance altogether, because we already have a recommendation to allow the RNH to consent to the publication of their data. Volker has also suggested that it is personal data we need to differentiate, not L/N . I disagree with Steve and Volker on this and so do most of the rest of the group. L/N distinction is a central concern to certain stakeholder groups in the EPDP, because a) GDPR and other data protection laws do not protect it and this process is all about bringing RDS into compliance with privacy law; b) Legal person data could be published and it would provide easier access to their registration data. As a NCSG member I can find no basis for objecting to the publication of WalMart’s, Kroger’s or the local hardware store’s registration data. Any concerns about PII are addressed by principles 2 and 3. Steve is approaching this as an engineer, but this is a policy process, and we will not obtain agreement on a solution unless certain stakeholders are satisfied. If they think it is a central concern, it’s a central concern, that’s how policy/politics work.

Principle 2 discussion

This is the key principle that keeps NCSG and CPH satisfied. Registrants are in control of how they are designated. Yes, this means that some people will lie. That is just something we will have to accept. One cannot erase that possibility without creating a system that is too burdensome and costly as to outweigh any benefits.

Principle 3 discussion

This is something everyone seems to agree on already. But it is good to make it explicit, then we can work out how specific our guidance can get, so as to conform to …

Principle 4

Avoid being overly prescriptive, but ensure that the other 3 principles are honored. So yes, Volker, we give you maximum flexibility to implement in accordance with different business models, but you can NOT make a designation for a RNH, because it violates principle 2.

I truly believe that if we can come to agreement on these 4 principles and use them as the basis for drafting guidance, we can actually finish this.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-t...> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm...>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XS...>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

<https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&...>

Virus-free. www.avast.com <https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&...>

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-t...> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm...>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XS...>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-t...> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm...>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XS...>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

------------------------------

------------------------------

[1] <#m_4115156499825390581_m_8997009847875421100_m_5832361527529862212_m_2854865445665285661__ftnref1> As explained above, we have understood this question to be asking about scenarios where Registrants are legal persons, as per the EDPB quote at paragraph 1. In respect of individual (natural person) Registrants, the issues will be largely similar: if a natural person incorrectly states that their data is not personal data, then (i) the verification measures should prevent the data from being published, since they will give the data subject an opportunity to correct their mistake; (ii) the mitigating factors and legal arguments described at paragraphs 11.7 and 11.8 and paragraphs 14.1 - 14.6 here, should confer reasonable legal protection for Contracted Parties.

[1] <#m_4115156499825390581_m_8997009847875421100_m_5832361527529862212_m_2854865445665285661__ftnref2> In its judgement in Case C‑136/17 *GC and Others*, the CJEU explained that GDPR obligations relating to an erasure (“Right to Be Forgotten”) request apply “*to the operator of a search engine in the context of his responsibilities, powers and capabilities as the controller of the processing carried out in connection with the activity of the search engine, on the occasion of a verification performed by that operator, under the supervision of the competent national authorities, following a request by the data subject”*. As the Advocate General explained in that case, “*such an operator can act only within the framework of its responsibilities, powers and capabilities. In other words, such an operator may be incapable of ensuring the full effect of the provisions of [EU data protection law], precisely because of its limited responsibilities, powers and capabilities. . . An ex ante control of internet pages which are referenced as the result of a search does not fall within the responsibilities or the capabilities of a search engine*.” It could not know, from the moment it indexed a webpage, that the content of that page was (for example) out of date (as in the original *Google Spain / Costeja* ruling), or (in the *GC and Others* case*) * “special category” or “criminal offence” data for which it required consent.

[2] <#m_4115156499825390581_m_8997009847875421100_m_5832361527529862212_m_2854865445665285661__ftnref3> See, for example, Article 14 <https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32000L0031> of the e-Commerce Directive 2000/31/EC and its transposition into the national laws of EU/EEA Member States and the UK.

_______________________________________________

Gnso-epdp-team mailing list

Gnso-epdp-team@icann.org

https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-t...>

_______________________________________________

By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm...>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XS...>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-t...> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm...>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XS...>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team

---

By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

Point of information - In the case of registration data, "publicly available" cannot mean "without any controls on the use." Use of whois data for email and other marketing, etc., has been prohibited since day 1, and those limitations have been specifically challenged and upheld in court. Question - I think I agree with Steve that "publicly available" means available to anyone, subject to reasonable measures to enforce the use prohibitions/limitations. I'm not really clear, however, why making that data available through automated SSAD disclosures is different from making it available through RDAP. Is it the cost? The need to be identified? On Tue, Apr 20, 2021 at 10:40 AM Steve Crocker via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:

Volker,

To me, the term "publicly available" means available to anyone without qualification as to the purpose and without any controls on the use. You seem to be using the term differently.

The discussion within this working group of what data is to be made available publicly is just one part of the larger discussion regarding who should have access to which data and for which purposes. The idea of SSAD or any other differentiated access system is to implement those yet to be determined rules.

What is your understanding of what the rules regarding access to non-public data should be?

Thanks,

Steve

On Tue, Apr 20, 2021 at 3:31 AM Volker Greimann via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:

...

Dear Melina,

thanks for your explanation.

I contend that the data contained in SSAD is publicly available, just as the data contained in the German trade register is publicly available, even though there may be a paywall. Hence publication can mean anything that provides for public access: A physical book, SSAD or RDAP. Anyone with a legitimate interest can apply for an SSAD account just like anyone can apply for an account with the online version of the German trade register. Data in SSAD is publicly available.

If NIS 2 comes down on a different interpretation in Germany (although I do not see why it would if even the public trade register is behind a paywall), I would welcome that as well, as it provides me with a legal basis for publication. An obligation based in law to disclose data means there is no longer any risk attached to such disclosures, if done correctly. So when that law comes into effect in my jurisdiction, I will implement it. Before that time, the legal basis is missing and CPs bear the risk of wrongful disclosure. So lets meet again once the implementation data of NIS 2 draws near. Basing policy on non-existent law is premature.

"T*o come back to your other point, (i.e., that you are not convinced that the availability of non-personal WHOIS data would contribute to the **security, stability and resilience of the DNS), I trust you are not implying that so many people from all over the world are intensively working on a problem which would be non-existent. *

*Currently the vast majority of registration data are not available and the majority of requests from different organisations to access such data remain unanswered.*"

This is an issue that SSAD was designed to solve. But the last three years have shown that it is less of a problem than people make it out to be.

"*According to a study published in January 2021 by InterIsle Consulting Group, at present, (...)*"

This is a statement of alleged fact, but it does not show why this necessarily is an issue.

"*Even European government agency and law enforcement requests for redacted WHOIS data have been denied.* (...)"

I would imagine that this would only be the case if they were acting outside their legal remit, e.g. outside their jurisdiction. As Theoden said to Gandalf "You have no power here!". All requests with a proper legal basis, e.g. acting inside their own jurisdiction should be answered, and if not, compliance be called.

"*(...) where WHOIS data would have been critical to help combat online sexual child abuse cases. According to the complainants, the availability of more WHOIS data in public could help to find perpetrators on the internet.*"

And those perpetrators register domain names with existing legal entities as registrants? Because unless this is the case, the argument is irrelevant to the question at hand.

"*According to a study published in 2021 by InterIsle Consulting Group, the data suggests that only around 11.5% of domains may belong to natural persons who are protected by GDPR. This 11.5% may be the percentage of domains that is necessary to protect under GDPR. In contrast, registrars and registry operators have redacted contact data from 57.3% of all domains, or five times the amount that may be necessary.*"

This statistic misses the point we are debating though as it does not in any way differentiate between legal entities whose data contains personal information, and those where it does not. If it is necessary to redact 100% of registration data or to put it inside the SSAD where access is controlled to protect even 1% of registrants, it is worth doing. Protection of the innocent always takes precedent.

"*It would be beneficial if you could explain why non-personal data of legal persons have been redacted and why you object to the effort of having greater transparency while fully respecting privacy of registrants.*"

Because blanket redaction of all data is the only way to safely and securely ensure that the personal data of data subjects is protected. There is a reason why even government controlled databases such as the car registration register are redacted. I have not seen a car register where the registration details of legal entities are published. Having that data publicly available might be beneficial for any number of causes. And those are registers that are being kept with a legal basis.

"*In light of all the conversations, and B&B advice received, it is clear that the argument of potential liability risk due to inadvertent disclosure of personal data does no longer hold value.*"

I wonder which part of the advice we received allowed you to draw this conclusion as the advice always pointed out that risk remains.

Please, come again once the demands you are raising are also implemented this way for all public registers in the various countries where you wish to see contracted parties to implement them. Trade registers, car registers, gun ownership registers, sex offender registers, land registers, etc. None of them universally have the level of access you want for mere domain name registrations.

That said, if someone demonstrates a legitimate interest with regard to any data, personal or non-personal, they will receive prompt disclosure from us (after the balancing test). If there is significant danger of harm to third parties, we will even grant access even though the requestor may be acting outside their jurisdiction, regardless of whether the registrant is legal or natural. Because granting such access is our moral obligation if a case for disclosure is made.

But please do not ask us to provide access levels that even our own governments do not provide for much, much, much more critical data.

Best,

-- Volker A. Greimann General Counsel and Policy Manager *KEY-SYSTEMS GMBH*

T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

On Tue, Apr 20, 2021 at 11:47 AM STROUNGI Melina < Melina.STROUNGI@ec.europa.eu> wrote:

...

Dear Volker,

Thank you for your comments.

Let me come back to your previous email of 15 April (attached) and your email below, in order to hopefully address some of your concerns.

Regarding your argument that ‘the interpretation of the book is only valid if the text actually supports that interpretation’, this is precisely the case with NIS 2 text. The legislator’s intention behind ‘publication’ is explained in recital 62 of NIS 2 Proposal <https://digital-strategy.ec.europa.eu/en/library/proposal-directive-measures...>, which explicitly clarifies that “*TLD registries and the entities providing domain name registration services for them should make publically available domain name registration data that fall outside the scope of Union data protection rules, such as data that concern legal persons*.”

Given the above context, the word ‘publication’ is doubtful to have any other interpretation than the obvious one: ‘publication’ means ‘*making publically available’*. Publically = to the public.

I understand your wish to do otherwise, but just to bear in mind that such wish is not enough to override the actual wording of the text.

We are doing our best to address everyone’s individual concerns (including yours and lots of your comments and suggestions have already been taken into account), but at the same time we need to ensure that contracted parties who wish to differentiate between legal and natural entities and wish to align their practices with the NIS2 proposal are able to do so. We hope that, even if you do not completely find the provisions to your liking, you are willing to facilitate this group’s hard efforts to make some progress before the May deadline.

To come back to your other point, (i.e., that you are not convinced that the availability of non-personal WHOIS data would contribute to the security, stability and resilience of the DNS), I trust you are not implying that so many people from all over the world are intensively working on a problem which would be non-existent.

This is what the current situation looks like:

Currently the vast majority of registration data are not available and the majority of requests from different organisations to access such data remain unanswered.

According to a study published in January 2021 by InterIsle Consulting Group, at present, only 13.5% of domains have an actual registrant identified in WHOIS. Registrars and registry operators have used ICANN’s post-GDPR policy to redact contact data from 57.3% of all domains. Adding proxy-protected domains, this means that 86.5% of registrants cannot be identified via WHOIS. According to statistics from Appdetex, during the period January 1, 2020, through September 1, 2020, only 24.6% of 2,933 requests submitted to 158 ICANN-accredited registrars resulted in responses that included registrant data. These statistics are also consistent with the estimate of the PSWG within ICANN that roughly 70% of requests are being denied or ignored.

Even European government agency and law enforcement requests for redacted WHOIS data have been denied. As described in a May 2020 letter from the ICANN President to the European Data Protection Board, requests that have been made by European Data Protection Authorities for access to redacted, nonpublic WHOIS data to assist in their investigations of potential privacy violations have been denied by domain name registrars and registries.

I will not list all complaints and problems reported, but just as an illustration, complaints from law enforcement authorities have been brought to our attention, where WHOIS data would have been critical to help combat online sexual child abuse cases. According to the complainants, the availability of more WHOIS data in public could help to find perpetrators on the internet.

The publication of domain name registration data concerning legal entities is expected to substantially increase the wealth of information available to the public.

According to a study published in 2021 by InterIsle Consulting Group, the data suggests that only around 11.5% of domains may belong to natural persons who are protected by GDPR. This 11.5% may be the percentage of domains that is necessary to protect under GDPR. In contrast, registrars and registry operators have redacted contact data from 57.3% of all domains, or five times the amount that may be necessary.

I trust that the above give a flavour of the actual situation and problems.

It would be beneficial if you could explain why non-personal data of legal persons have been redacted and why you object to the effort of having greater transparency while fully respecting privacy of registrants.

In light of all the conversations, and B&B advice received, it is clear that the argument of potential liability risk due to inadvertent disclosure of personal data does no longer hold value. If you want to diminish this risk, it is clear that you first have to distinguish between natural and legal entities and then further ensure that legal entities do not provide any personal data (or, if they do provide personal data, that they consent to publishing of such personal data). Then in case of a mistake it will be up to the registrant; not the contracted parties. So in our view the liability argument cannot be used as a justification for not taking action – especially given the many problems that such inaction causes and will continue to cause.

Best regards,

Melina

*From:* Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> *On Behalf Of *Volker Greimann via Gnso-epdp-team *Sent:* Sunday, April 18, 2021 3:04 AM *To:* Stephanie E Perrin <stephanie.perrin@mail.utoronto.ca> *Cc:* GNSO EPDP <gnso-epdp-team@icann.org> *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

I think you both make good points. Our starting point is the current status quo, which I expect will continue on into the far future: All registration data provided as a registrant must be viewed as potential personal information, in a Schroedingers Cat kind-of situation. Until you look at it, you do not know what it is, even though you can make certain assumptions with varying likelihoods. The 2B memo tells us nothing new in that regard.

What it does tell us is that the various methods of determination without looking have risk of various degrees attached.

Miltons proposed registrant-declaration is one of the lower risk ones methods. Stephanie is also right that in a highly competitive market with razor-thin margins, corners will be cut at some point of the channel, especially once you enter the realm of resellers. So Stephanie is absolutely correct in her point that the determination of whether contracted parties can rely on the accuracy of any declaration must be that of the contracted party itself. The declaration of legal status of the registrant ultimately does not help us make that determination. The declaration of content of the data goes a whole lot further in that regard. Controlling the process where the declaration is made helps even more (hence the requirement to allow post-registration declarations).

As for publication vs. disclosure, after having given this some thought, I still tend to come out on the side of disclosure, but with the following features:

- self-declared data sets would be set to automated disclosure.

- public RDAP could contain a marker/flag/label/something that shows that this data set is available for automated disclosure in SSAD

- Disclosure fees for such data sets in SSAD could be priced lower than non-automated data sets, say half-price

- Access levels for access to such data sets could be lower for users of SSAD. For example, if you just want to access automated-disclosure sets, accreditation could be voluntary, and a mere ID-check application process and a statement of legitimate interest for each request could be possible.

Advantages:

- Increased utility of SSAD

- SSAD User Fees would decrease (higher query volumes overall, lower fees for some queries)

- CP Risk would be limited

- CP handling times for requests would be reduced in case they implement that flag.

I still need to hear what the benefits of the differentiation of data sets and better availability of non-personal information really are, though. In my experience it is not like cyber criminals are setting up legal entities such as STEALATRADEMARK, Inc or VIOLATEACOPYRIGHT, Ltd. left and right to register their domain names. Those kinds of domains are usually registered with perfectly accurate personal data sets. If someone could really make the case of what the perceived benefit to all parties concerned is on this (something I have been asking for from days 1), I'd be happy to hear them. The common argument of security, stability and resilience of the DNS went out of the window the day the Temp Spec first came into effect after all, as neither of the three has been affected by the current vegetative state of the WHOIS (In the sense that it is not quite dead yet, but almost. Machines still keep it alive).

This also would solve the issue of thick vs thin RDAP:

If RDAP only returns the basic data set anyway and never any personal information, there is no longer any need to require registrars to provide RDAP services as there no longer is any concern in supplying said data to the registries for centralised publication. Thick RDAP would be saved.

-- Volker A. Greimann General Counsel and Policy Manager *KEY-SYSTEMS GMBH*

T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net <https://urldefense.com/v3/__http:/www.key-systems.net/__;!!DOxrgLBm!XSywrkEo...>

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

On Sat, Apr 17, 2021 at 12:19 AM Stephanie E Perrin via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:

Bird and Bird is offering arguments for protection in the event of complaint. While that protection is welcome and reassuring in terms of risk, I am not certain that we have adequately explained to 2Birds how registration actually takes place. It would have been beneficial to walk them through a range of different ways to register a domain name. As we have discussed in the calls, very often non-savvy non-commercial users or small business/home workers use resellers of various kinds to register their domains. Additional risk creeps in here, WRT whether or not a positive consent has been obtained from relevant employees. Further risk creeps in when we look at automatic renewals, where the contact data may not be updated. If updated, have the steps been taken to get consent from new employees? To me this is key, non-savvy users, and I count myself among them, are not likely to check what an intermediary is doing with respect to the domain renewal or updating.

Now, of course the argument is that they SHOULD be more diligent and they SHOULD pay attention to the accuracy requirements, but lets deal in facts here.....are they? As the data controller who is pre-emptively disclosing personal data, allegedly with consent, to unknown (to the contracted party) third parties, the responsibility still rests with the controller. As I have mentioned, a Facebook or a Google or a Microsoft can get away with treading roughshod over their consent arrangements....not too many folks are going to give up free or necessary services over quibbles in a consent form, even if it is 75 pages long. However the registrars (and to a lesser extent, the registries) are operating in a highly competitive market. Once losing my trust, perhaps over a trifling inattention to the accuracy of my data, and I am transferring my domains to another company. Policing a complex reseller market is also rather a difficult matter that we have not discussed at length in our debates on this issue. I know that the data commissioners as a group do not understand how the accountability for the handling of personal information is transferred in that market, and it would not be surprising if 2Birds did not either. Bottom line: accredited registrars are shouldering the risk here, it is their risk, and they would know best whether they can trust the accuracy of the designation of legal personhood. This is why I think that this designation, in my opinion, should always permit an override by the contracted parties to treat the data as personal. I have suggested many many times that commercial organizations should operate on an accreditation basis and be linked to their official registration numbers (business, corporation, municipal licence etc). Noone ever responds to that idea....if it is totally ridiculous I would certainly like to know why, I am offering it in good faith and I think it would do something useful to stop fraudulent registrations in their names. However, small business and non-commercial organizations, even if incorporated or in possession of a registration # of some kind have different needs and circumstances, and they are frequently treated differently under data protection law.

One final point that I have raised a few times.....we tend to focus on enforcement fines and Court costs. Even if noone ever complains to a DPA or takes a case to Court, where the advice of 2 Birds gives us some comfort that the risk is manageable, and the results would exonerate the contracted parties.....what about reputational damage in the meantime? Court costs? Who actually wants to have customers complaining about the practices? Employee morale, if it is employees who are objecting to the practices?

I support focusing on whether the data submitted is personal or not, with a fulsome definition and description of same, and full flexibility for contracted parties to err on the side of caution and consider the possibility of some data being personal after all. After all, much data is still being disclosed, and noone has adduced strong evidence that the delay in requesting the data (as opposed to getting it from the published data) will have huge repercussions. What is actually at play here is who is doing the extra work....the requesting party, or the data controller.

Stephanie Perrin

On 2021-04-15 10:42 p.m., Mueller, Milton L via Gnso-epdp-team wrote:

*EXTERNAL EMAIL:*

Further legal support from TwoBirds

14.2 If personal data is erroneously included in published Registration Data, it would in this scenario occur despite substantial (VSC) steps taken by the Contracted Parties, and would be primarily attributable to the actions/omissions of the Registrant. This is likely to be taken into account by data subjects, data protection supervisory authorities, and courts.

14.3 The data in question is likely to be low sensitivity. The scenario being envisaged here (mistaken inclusion of personal data in published Registration Data) seems to be most likely to occur when a legal entity (e.g. a company or non-profit organisation) is registering / maintaining its own domains. In those scenarios, we assume the personal data that could be disclosed would ordinarily relate to an employee’s work details (e.g. a company email address), not an individual’s private life. Although the GDPR confers protection even in the workplace, the data in question here may arguably be less capable of causing harm to an individual than data relating to the data subject’s private life.[1] <#m_2928171497802302509_m_4115156499825390581_m_8997009847875421100_m_5832361527529862212_m_2854865445665285661__ftn1>

14.4 In more sensitive cases (e.g. disclosing that a person works for a company in a sensitive or “embarrassing” sector), a Registrant would be putting itself at serious risk of complaints from its own employees. Registrants are therefore already incentivised to avoid errors that could have serious consequences for their own staff.

*From:* Mueller, Milton L *Sent:* Thursday, April 15, 2021 10:34 PM *To:* gnso-epdp-team@icann.org *Subject:* RE: [Gnso-epdp-team] On the proposed guidance

Some legal support for my argument below from Bird & Bird:

There may even be an argument, based on EU Court of Justice (“CJEU”) caselaw, that this is a situation where Contracted Parties should generally only be liable should they fail to properly address a complaint about the data – i.e. only once they are put on notice about the alleged illegality and thereby have an opportunity to “verify” the merits of the complaint. [1] <#m_2928171497802302509_m_4115156499825390581_m_8997009847875421100_m_5832361527529862212_m_2854865445665285661__ftn2> This bears some parallels to other EU liability regimes for operators of services online that process – unwittingly – content that violates EU law. [2] <#m_2928171497802302509_m_4115156499825390581_m_8997009847875421100_m_5832361527529862212_m_2854865445665285661__ftn3> As discussed at footnote 6 below, this is arguably recognised in (at least some) decisions of GDPR supervisory authorities.

In other words, if personal data finds its way into a published registration record that should not be there, an objection can be lodged with the registrar and they can verify the merits and remove the data.

Dr. Milton L Mueller

Georgia Institute of Technology

School of Public Policy

Internet Governance Project <https://urldefense.com/v3/__https:/internetgovernance.org/__;!!DOxrgLBm!XSyw...>

*From:* Mueller, Milton L *Sent:* Thursday, April 15, 2021 9:14 PM *To:* gnso-epdp-team@icann.org *Subject:* FW: [Gnso-epdp-team] On the proposed guidance

...

" Everyone who is named in a role in a registration must have already been informed

...

and consented to all of the conditions involved in the role. " This is the ideal. Sadly, this ideal

...

is very often not the case.

Whoa.

Of course, Volker, it is possible that a person making a registration for a legal person won’t do it properly. But it is absurd to expect a registrar to be legally responsible for that. How can the registrar be liable for privacy breaches made by the registrant? Indeed, I can’t understand why gaining the consent of the administrative assistant of the xyz department to have their name listed in the whois is a matter for DNS/ICANN policy at all. ICANN policy simply needs to inform registrants that under certain conditions the data will be published.

Let’s take an extreme case – suppose a nasty IT manager in a major corporation puts the name, email address and (what the heck) a revenge porn photo of her ex-husband in her company’s registration record. Are you telling me the registrar would be considered responsible for that breach of privacy? Not the nasty IT manager?

Show me a legal case in which that kind of liability has been assigned. I doubt you can, but I await the data from CP lawyers who have been involved in these cases. I do know of several cases in which agents for a corporation wrongly listed themselves as the technical and administrative contact, making it possible for them to hijack the name. The registrar was NEVER held liable for that.

Reminder: We had to reform Whois/RDS policy because ICANN, *as a matter of contractual obligation, required registrars to publish sensitive PII of any and every Registrant*. Once we have removed that obligation, and once we have given registrants knowledge of the conditions under which the data in the record should be published, I don’t see why registrars need to worry about some corporation listing the personal email address of someone in their IT department.

So if this alleged risk is being cited to scare us away from allowing registrants to self-designate as legal or natural, it is a pretty weak case, imho.

--MM

*From:* Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> *On Behalf Of *Volker Greimann via Gnso-epdp-team *Sent:* Thursday, April 15, 2021 10:10 AM *To:* Steve Crocker <steve@shinkuro.com> *Cc:* gnso-epdp-team@icann.org *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

Employees are named by other employees without their knowledge, or remain named long after they leave. From the experience as a registrar dealing with registrants every day, this ideal is an assumption that does not survive contact with reality.

-- Volker A. Greimann General Counsel and Policy Manager *KEY-SYSTEMS GMBH*

T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net <https://urldefense.com/v3/__http:/www.key-systems.net/__;!!DOxrgLBm!XSywrkEo...>

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

On Thu, Apr 15, 2021 at 3:36 PM Steve Crocker via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:

Laureen,

Thanks for your note. With respect to the details under legal person, we believe the issue of consent should be moot. Everyone who is named in a role in a registration must have already been informed and consented to all of the conditions involved in the role. This is a prerequisite for having a working system and is not specific to meeting a privacy regulation. The fact that this requirement is not specified in the existing contractual documentation is an error and needs to be rectified.

Steve

On Thu, Apr 15, 2021 at 6:28 AM Kapin, Laureen via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:

I think we share common ground on many key issues and I would like to build on the many helpful inputs received as to what would be advisable.

*Goal*: publish non-personal, non-protected data to the greatest extent permissible under the GDPR and within low legal risks to data controllers and processors. Note, the description below does *not *fully detail the advised safeguards which B&B has documented and which we’ve adopted in our prior input because my impression is that we generally agree that the safeguards are prudent. This description merely seeks to identify the key steps that must be taken to ensure that personal data is identified and protected and non-personal data is published. I also highlight the addition of a potential additional safeguard – Confirmation. I think this process incorporates what we’ve discussed and inputs received and could form a useful framework for discussion.

*Note:*

n *New Registrations: *This process applies to new registrations (Steve C. has some useful thoughts on how to deal with existing Registrations)

n *Publish: *When I use the word “publish,” I mean made public directly; not via the SSAD.

n *Flexibility: *Based on input from our Registrar colleagues, we should permit flexibility for how these steps are implemented to account for the varied business models in place.

n *Timing: *All identifications need to take place at the time of registration or shortly thereafter (w/in the 13-day accuracy verification window) and no registration data should be published until the identification, consent, and confirmation process concludes

*Process:*

1. A threshold identification of the registrant as a natural or legal person;

a. If natural, registration info redacted

b. If legal, further inquiries and advisories (safeguards):

i. if the legal person identifies that it has a protected status under the GDPR

1. registration info redacted

ii. If the legal person registration contains personal data, advise of consequences (publication)

1. Obtain necessary consents

2. *Possible additional safeguard*: *Ask Registrant to Confirm any identification that will result in publication of contact data *(akin to confirming a flight reservation or stock trade)

a. Publish

3. If no consent

a. Redact

2. Provide quick and easy opportunity to correct any mistakes

I hope this is useful.

Kind regards,

Laureen Kapin

Counsel for International Consumer Protection

Federal Trade Commission

(202) 326-3237

*From:* Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> *On Behalf Of *Volker Greimann via Gnso-epdp-team *Sent:* Thursday, April 15, 2021 8:35 AM *To:* Hadia Abdelsalam Mokhtar EL miniawi <Hadia@tra.gov.eg> *Cc:* gnso-epdp-team@icann.org *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

I think we need to be cognisant of the current status quo and use that as the basis for our thoughts on the matter:

1) There is no differentiation between legal or natural contacts.

2) The redaction of all contacts is permitted and has become the de-facto standard.

3) We allow consent-based disclosure.

4) NIS 2 may at some point in the future require publication of non-personal information.

This leads to two very simple follow-on questions:

a) How do we identify such non-personal information? What is really necessary for this end?

b) What would publication entail?

For a) we and Twobirds identified voluntary self-declaration of the data submitted. As all data is redacted by default, the differentiation of the data subject category is irrelevant as it ultimately only boils down to the declaration of the data subject thatthe data contains no personal information.

For b), the term "publish" is undefined. For all we know, it could mean publication in a physical print edition (it doesn't mean that though). But publication within SSAD can very well be sufficient for that definition. There is no reason whatsoever to assume differently.

-- Volker A. Greimann General Counsel and Policy Manager *KEY-SYSTEMS GMBH*

T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net <https://urldefense.com/v3/__http:/www.key-systems.net/__;!!DOxrgLBm!XSywrkEo...>

Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached.

<https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&...>

Virus-free. www.avast.com <https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&...>

On Thu, Apr 15, 2021 at 1:52 PM Hadia Abdelsalam Mokhtar EL miniawi via Gnso-epdp-team <gnso-epdp-team@icann.org> wrote:

Dear Milton,

Thank you for your constructive thoughts. I believe we have a lot to build on. In relation to principle one, I think we all agree that some legal data subjects would want to publish their data in the RDDS, but without your first principle they can only do this through consent. The legal memo received lately from Bird & Bird explains that if CPs publish the data of legal persons based on consent they are at a higher risk than if they publish the data of legal persons based on self-designation. In the latter case CPs might only be liable if they fail to address a complaint. So the question always was: what is the benefit of labeling the data as belonging to a natural or legal person? Of course we all know that GDPR protects the data of natural persons and not legal persons, but the important answer now is that the distinction significantly reduces the liability of CPs. In addition, the distinction is helpful in performing the balancing test in case the data is not published and I am sure if we look into individual use cases we can find much more benefits. Moreover, it could prove to be useful regarding possible upcoming regulations. I would also add that the level of protection assigned to the data elements suggested by Steve provides additional safe guards and flexibility in the implementation.

Finally, I join you in being optimistic about our ability to finish this.

Kind regards

Hadia

*From:* Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] *On Behalf Of *Mueller, Milton L via Gnso-epdp-team *Sent:* Wednesday, April 14, 2021 10:12 PM *To:* gnso-epdp-team@icann.org *Subject:* Re: [Gnso-epdp-team] On the proposed guidance

Colleagues:

I have only gotten time to review the latest Guidance document and the surrounding debate today. Apologies, but there is a lot going on in my day job.

I am disappointed to see that we seem to be going backwards. I see divergence rather than convergence on the way we are approaching the problem.

I see no point in adding more noise to the current document via the Comments function. What I would like to try to do is articulate some broad principles about how to deal with the legal/natural distinction. If we can agree on those principles, it will be relatively easy to complete the document. If we cannot/do not agree on those principles, additional wordsmithing and debates over terms will not get us anywhere.

So here are the broad principles that I would offer up for debate:

1. The legal/natural distinction is relevant and we need to find a way make it in RDDS without compromising privacy rights.

2. Registrants should be able to self-designate as legal or natural, with no burden of authentication placed on registrars or registries

3. To protect small home offices or NGOs who are technically Legal persons but whose registration data may include Personal data, we need an additional check in the process.

4. As long as they conform with the above 3 principles, registrars/ries (CPs) should be given maximum flexibility to choose the way to differentiate.

Principle 1 discussion:

If we cannot agree on this (or agree to abandon this principle), _*nothing else will fall into place*_. Ever. So let’s settle that. Steve and Volker I suspect will disagree with this principle. Steve has argued that the L/N distinction is “not a central concern” and all that matters is whether the registrant’s data is to be made available to anyone. If he is right, we can discard the guidance altogether, because we already have a recommendation to allow the RNH to consent to the publication of their data. Volker has also suggested that it is personal data we need to differentiate, not L/N . I disagree with Steve and Volker on this and so do most of the rest of the group. L/N distinction is a central concern to certain stakeholder groups in the EPDP, because a) GDPR and other data protection laws do not protect it and this process is all about bringing RDS into compliance with privacy law; b) Legal person data could be published and it would provide easier access to their registration data. As a NCSG member I can find no basis for objecting to the publication of WalMart’s, Kroger’s or the local hardware store’s registration data. Any concerns about PII are addressed by principles 2 and 3. Steve is approaching this as an engineer, but this is a policy process, and we will not obtain agreement on a solution unless certain stakeholders are satisfied. If they think it is a central concern, it’s a central concern, that’s how policy/politics work.

Principle 2 discussion

This is the key principle that keeps NCSG and CPH satisfied. Registrants are in control of how they are designated. Yes, this means that some people will lie. That is just something we will have to accept. One cannot erase that possibility without creating a system that is too burdensome and costly as to outweigh any benefits.

Principle 3 discussion

This is something everyone seems to agree on already. But it is good to make it explicit, then we can work out how specific our guidance can get, so as to conform to …

Principle 4

Avoid being overly prescriptive, but ensure that the other 3 principles are honored. So yes, Volker, we give you maximum flexibility to implement in accordance with different business models, but you can NOT make a designation for a RNH, because it violates principle 2.

I truly believe that if we can come to agreement on these 4 principles and use them as the basis for drafting guidance, we can actually finish this.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-t...> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm...>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XS...>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

<https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&...>

Virus-free. www.avast.com <https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&...>

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-t...> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm...>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XS...>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-t...> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm...>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XS...>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

------------------------------

------------------------------

[1] <#m_2928171497802302509_m_4115156499825390581_m_8997009847875421100_m_5832361527529862212_m_2854865445665285661__ftnref1> As explained above, we have understood this question to be asking about scenarios where Registrants are legal persons, as per the EDPB quote at paragraph 1. In respect of individual (natural person) Registrants, the issues will be largely similar: if a natural person incorrectly states that their data is not personal data, then (i) the verification measures should prevent the data from being published, since they will give the data subject an opportunity to correct their mistake; (ii) the mitigating factors and legal arguments described at paragraphs 11.7 and 11.8 and paragraphs 14.1 - 14.6 here, should confer reasonable legal protection for Contracted Parties.

[1] <#m_2928171497802302509_m_4115156499825390581_m_8997009847875421100_m_5832361527529862212_m_2854865445665285661__ftnref2> In its judgement in Case C‑136/17 *GC and Others*, the CJEU explained that GDPR obligations relating to an erasure (“Right to Be Forgotten”) request apply “*to the operator of a search engine in the context of his responsibilities, powers and capabilities as the controller of the processing carried out in connection with the activity of the search engine, on the occasion of a verification performed by that operator, under the supervision of the competent national authorities, following a request by the data subject”*. As the Advocate General explained in that case, “*such an operator can act only within the framework of its responsibilities, powers and capabilities. In other words, such an operator may be incapable of ensuring the full effect of the provisions of [EU data protection law], precisely because of its limited responsibilities, powers and capabilities. . . An ex ante control of internet pages which are referenced as the result of a search does not fall within the responsibilities or the capabilities of a search engine*.” It could not know, from the moment it indexed a webpage, that the content of that page was (for example) out of date (as in the original *Google Spain / Costeja* ruling), or (in the *GC and Others* case*) * “special category” or “criminal offence” data for which it required consent.

[2] <#m_2928171497802302509_m_4115156499825390581_m_8997009847875421100_m_5832361527529862212_m_2854865445665285661__ftnref3> See, for example, Article 14 <https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32000L0031> of the e-Commerce Directive 2000/31/EC and its transposition into the national laws of EU/EEA Member States and the UK.

_______________________________________________

Gnso-epdp-team mailing list

Gnso-epdp-team@icann.org

https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-t...>

_______________________________________________

By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm...>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XS...>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-t...> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm...>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XS...>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team

---

By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

Obviously I can’t speak for Volker, but I want to try and respond with why I find Volker’s proposal intriguing. The registration data in whois / RDAP is available to everyone, including bad actors. We know that bad actors are harvesting registration data via whois / RDAP. It is used in a variety of ways, subjecting (legal and natural) registrants to phishing attempts, spam, fake renewal / transfer requests, domain hijack attempts and monetization of their data for example. There are very limited tools that we can employ to prevent that. We can block IP addresses, but bad actors can easily change IP addresses. We can add rate limiting, but again bad actors can use multiple IP addresses and rate limiting impacts legitimate requests as well. Making that data available via automated SSAD disclosures means that the requestor has gone through some amount of pre-validation to determine that they are who they claim to be. With the SSAD where a requestor is abusing or misusing the data being provided there can be actual ramifications, suspending or revoking their SSAD access. It provides the possibility of preventing bad actors from being able to abuse (legal and natural) registrant data while still getting that data into the hands of good actors who are not abusing the data and have a legitimate purpose. -Marc From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of Becky Burr via Gnso-epdp-team Sent: Tuesday, April 20, 2021 12:21 PM To: Steve Crocker <steve@shinkuro.com> Cc: gnso-epdp-team@icann.org Subject: [EXTERNAL] Re: [Gnso-epdp-team] On the proposed guidance Caution: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Point of information - In the case of registration data, "publicly available" cannot mean "without any controls on the use." Use of whois data for email and other marketing, etc., has been prohibited since day 1, and those limitations have been specifically challenged and upheld in court. Question - I think I agree with Steve that "publicly available" means available to anyone, subject to reasonable measures to enforce the use prohibitions/limitations. I'm not really clear, however, why making that data available through automated SSAD disclosures is different from making it available through RDAP. Is it the cost? The need to be identified? On Tue, Apr 20, 2021 at 10:40 AM Steve Crocker via Gnso-epdp-team <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> wrote: Volker, To me, the term "publicly available" means available to anyone without qualification as to the purpose and without any controls on the use. You seem to be using the term differently. The discussion within this working group of what data is to be made available publicly is just one part of the larger discussion regarding who should have access to which data and for which purposes. The idea of SSAD or any other differentiated access system is to implement those yet to be determined rules. What is your understanding of what the rules regarding access to non-public data should be? Thanks, Steve On Tue, Apr 20, 2021 at 3:31 AM Volker Greimann via Gnso-epdp-team <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> wrote: Dear Melina, thanks for your explanation. I contend that the data contained in SSAD is publicly available, just as the data contained in the German trade register is publicly available, even though there may be a paywall. Hence publication can mean anything that provides for public access: A physical book, SSAD or RDAP. Anyone with a legitimate interest can apply for an SSAD account just like anyone can apply for an account with the online version of the German trade register. Data in SSAD is publicly available. If NIS 2 comes down on a different interpretation in Germany (although I do not see why it would if even the public trade register is behind a paywall), I would welcome that as well, as it provides me with a legal basis for publication. An obligation based in law to disclose data means there is no longer any risk attached to such disclosures, if done correctly. So when that law comes into effect in my jurisdiction, I will implement it. Before that time, the legal basis is missing and CPs bear the risk of wrongful disclosure. So lets meet again once the implementation data of NIS 2 draws near. Basing policy on non-existent law is premature. "To come back to your other point, (i.e., that you are not convinced that the availability of non-personal WHOIS data would contribute to the security, stability and resilience of the DNS), I trust you are not implying that so many people from all over the world are intensively working on a problem which would be non-existent. Currently the vast majority of registration data are not available and the majority of requests from different organisations to access such data remain unanswered." This is an issue that SSAD was designed to solve. But the last three years have shown that it is less of a problem than people make it out to be. "According to a study published in January 2021 by InterIsle Consulting Group, at present, (...)" This is a statement of alleged fact, but it does not show why this necessarily is an issue. "Even European government agency and law enforcement requests for redacted WHOIS data have been denied. (...)" I would imagine that this would only be the case if they were acting outside their legal remit, e.g. outside their jurisdiction. As Theoden said to Gandalf "You have no power here!". All requests with a proper legal basis, e.g. acting inside their own jurisdiction should be answered, and if not, compliance be called. "(...) where WHOIS data would have been critical to help combat online sexual child abuse cases. According to the complainants, the availability of more WHOIS data in public could help to find perpetrators on the internet." And those perpetrators register domain names with existing legal entities as registrants? Because unless this is the case, the argument is irrelevant to the question at hand. "According to a study published in 2021 by InterIsle Consulting Group, the data suggests that only around 11.5% of domains may belong to natural persons who are protected by GDPR. This 11.5% may be the percentage of domains that is necessary to protect under GDPR. In contrast, registrars and registry operators have redacted contact data from 57.3% of all domains, or five times the amount that may be necessary." This statistic misses the point we are debating though as it does not in any way differentiate between legal entities whose data contains personal information, and those where it does not. If it is necessary to redact 100% of registration data or to put it inside the SSAD where access is controlled to protect even 1% of registrants, it is worth doing. Protection of the innocent always takes precedent. "It would be beneficial if you could explain why non-personal data of legal persons have been redacted and why you object to the effort of having greater transparency while fully respecting privacy of registrants." Because blanket redaction of all data is the only way to safely and securely ensure that the personal data of data subjects is protected. There is a reason why even government controlled databases such as the car registration register are redacted. I have not seen a car register where the registration details of legal entities are published. Having that data publicly available might be beneficial for any number of causes. And those are registers that are being kept with a legal basis. "In light of all the conversations, and B&B advice received, it is clear that the argument of potential liability risk due to inadvertent disclosure of personal data does no longer hold value." I wonder which part of the advice we received allowed you to draw this conclusion as the advice always pointed out that risk remains. Please, come again once the demands you are raising are also implemented this way for all public registers in the various countries where you wish to see contracted parties to implement them. Trade registers, car registers, gun ownership registers, sex offender registers, land registers, etc. None of them universally have the level of access you want for mere domain name registrations. That said, if someone demonstrates a legitimate interest with regard to any data, personal or non-personal, they will receive prompt disclosure from us (after the balancing test). If there is significant danger of harm to third parties, we will even grant access even though the requestor may be acting outside their jurisdiction, regardless of whether the registrant is legal or natural. Because granting such access is our moral obligation if a case for disclosure is made. But please do not ask us to provide access levels that even our own governments do not provide for much, much, much more critical data. Best, -- Volker A. Greimann General Counsel and Policy Manager KEY-SYSTEMS GMBH T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net<http://secure-web.cisco.com/1Z3CkNGDtaX4XG9vBNapXiAQ1QfliIbyTnLo2IMVkQGCP57R...> Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358. This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached. On Tue, Apr 20, 2021 at 11:47 AM STROUNGI Melina <Melina.STROUNGI@ec.europa.eu<mailto:Melina.STROUNGI@ec.europa.eu>> wrote: Dear Volker, Thank you for your comments. Let me come back to your previous email of 15 April (attached) and your email below, in order to hopefully address some of your concerns. Regarding your argument that ‘the interpretation of the book is only valid if the text actually supports that interpretation’, this is precisely the case with NIS 2 text. The legislator’s intention behind ‘publication’ is explained in recital 62 of NIS 2 Proposal<https://secure-web.cisco.com/13dWk7h9VpU03U5HSO6SLOym6r7vc_Dki3_DON-EVBKP-ma...>, which explicitly clarifies that “TLD registries and the entities providing domain name registration services for them should make publically available domain name registration data that fall outside the scope of Union data protection rules, such as data that concern legal persons.” Given the above context, the word ‘publication’ is doubtful to have any other interpretation than the obvious one: ‘publication’ means ‘making publically available’. Publically = to the public. I understand your wish to do otherwise, but just to bear in mind that such wish is not enough to override the actual wording of the text. We are doing our best to address everyone’s individual concerns (including yours and lots of your comments and suggestions have already been taken into account), but at the same time we need to ensure that contracted parties who wish to differentiate between legal and natural entities and wish to align their practices with the NIS2 proposal are able to do so. We hope that, even if you do not completely find the provisions to your liking, you are willing to facilitate this group’s hard efforts to make some progress before the May deadline. To come back to your other point, (i.e., that you are not convinced that the availability of non-personal WHOIS data would contribute to the security, stability and resilience of the DNS), I trust you are not implying that so many people from all over the world are intensively working on a problem which would be non-existent. This is what the current situation looks like: Currently the vast majority of registration data are not available and the majority of requests from different organisations to access such data remain unanswered. According to a study published in January 2021 by InterIsle Consulting Group, at present, only 13.5% of domains have an actual registrant identified in WHOIS. Registrars and registry operators have used ICANN’s post-GDPR policy to redact contact data from 57.3% of all domains. Adding proxy-protected domains, this means that 86.5% of registrants cannot be identified via WHOIS. According to statistics from Appdetex, during the period January 1, 2020, through September 1, 2020, only 24.6% of 2,933 requests submitted to 158 ICANN-accredited registrars resulted in responses that included registrant data. These statistics are also consistent with the estimate of the PSWG within ICANN that roughly 70% of requests are being denied or ignored. Even European government agency and law enforcement requests for redacted WHOIS data have been denied. As described in a May 2020 letter from the ICANN President to the European Data Protection Board, requests that have been made by European Data Protection Authorities for access to redacted, nonpublic WHOIS data to assist in their investigations of potential privacy violations have been denied by domain name registrars and registries. I will not list all complaints and problems reported, but just as an illustration, complaints from law enforcement authorities have been brought to our attention, where WHOIS data would have been critical to help combat online sexual child abuse cases. According to the complainants, the availability of more WHOIS data in public could help to find perpetrators on the internet. The publication of domain name registration data concerning legal entities is expected to substantially increase the wealth of information available to the public. According to a study published in 2021 by InterIsle Consulting Group, the data suggests that only around 11.5% of domains may belong to natural persons who are protected by GDPR. This 11.5% may be the percentage of domains that is necessary to protect under GDPR. In contrast, registrars and registry operators have redacted contact data from 57.3% of all domains, or five times the amount that may be necessary. I trust that the above give a flavour of the actual situation and problems. It would be beneficial if you could explain why non-personal data of legal persons have been redacted and why you object to the effort of having greater transparency while fully respecting privacy of registrants. In light of all the conversations, and B&B advice received, it is clear that the argument of potential liability risk due to inadvertent disclosure of personal data does no longer hold value. If you want to diminish this risk, it is clear that you first have to distinguish between natural and legal entities and then further ensure that legal entities do not provide any personal data (or, if they do provide personal data, that they consent to publishing of such personal data). Then in case of a mistake it will be up to the registrant; not the contracted parties. So in our view the liability argument cannot be used as a justification for not taking action – especially given the many problems that such inaction causes and will continue to cause. Best regards, Melina From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Volker Greimann via Gnso-epdp-team Sent: Sunday, April 18, 2021 3:04 AM To: Stephanie E Perrin <stephanie.perrin@mail.utoronto.ca<mailto:stephanie.perrin@mail.utoronto.ca>> Cc: GNSO EPDP <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] On the proposed guidance I think you both make good points. Our starting point is the current status quo, which I expect will continue on into the far future: All registration data provided as a registrant must be viewed as potential personal information, in a Schroedingers Cat kind-of situation. Until you look at it, you do not know what it is, even though you can make certain assumptions with varying likelihoods. The 2B memo tells us nothing new in that regard. What it does tell us is that the various methods of determination without looking have risk of various degrees attached. Miltons proposed registrant-declaration is one of the lower risk ones methods. Stephanie is also right that in a highly competitive market with razor-thin margins, corners will be cut at some point of the channel, especially once you enter the realm of resellers. So Stephanie is absolutely correct in her point that the determination of whether contracted parties can rely on the accuracy of any declaration must be that of the contracted party itself. The declaration of legal status of the registrant ultimately does not help us make that determination. The declaration of content of the data goes a whole lot further in that regard. Controlling the process where the declaration is made helps even more (hence the requirement to allow post-registration declarations). As for publication vs. disclosure, after having given this some thought, I still tend to come out on the side of disclosure, but with the following features: - self-declared data sets would be set to automated disclosure. - public RDAP could contain a marker/flag/label/something that shows that this data set is available for automated disclosure in SSAD - Disclosure fees for such data sets in SSAD could be priced lower than non-automated data sets, say half-price - Access levels for access to such data sets could be lower for users of SSAD. For example, if you just want to access automated-disclosure sets, accreditation could be voluntary, and a mere ID-check application process and a statement of legitimate interest for each request could be possible. Advantages: - Increased utility of SSAD - SSAD User Fees would decrease (higher query volumes overall, lower fees for some queries) - CP Risk would be limited - CP handling times for requests would be reduced in case they implement that flag. I still need to hear what the benefits of the differentiation of data sets and better availability of non-personal information really are, though. In my experience it is not like cyber criminals are setting up legal entities such as STEALATRADEMARK, Inc or VIOLATEACOPYRIGHT, Ltd. left and right to register their domain names. Those kinds of domains are usually registered with perfectly accurate personal data sets. If someone could really make the case of what the perceived benefit to all parties concerned is on this (something I have been asking for from days 1), I'd be happy to hear them. The common argument of security, stability and resilience of the DNS went out of the window the day the Temp Spec first came into effect after all, as neither of the three has been affected by the current vegetative state of the WHOIS (In the sense that it is not quite dead yet, but almost. Machines still keep it alive). This also would solve the issue of thick vs thin RDAP: If RDAP only returns the basic data set anyway and never any personal information, there is no longer any need to require registrars to provide RDAP services as there no longer is any concern in supplying said data to the registries for centralised publication. Thick RDAP would be saved. -- Volker A. Greimann General Counsel and Policy Manager KEY-SYSTEMS GMBH T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net<https://urldefense.com/v3/__http:/www.key-systems.net/__;!!DOxrgLBm!XSywrkEo...> Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358. This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached. On Sat, Apr 17, 2021 at 12:19 AM Stephanie E Perrin via Gnso-epdp-team <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> wrote: Bird and Bird is offering arguments for protection in the event of complaint. While that protection is welcome and reassuring in terms of risk, I am not certain that we have adequately explained to 2Birds how registration actually takes place. It would have been beneficial to walk them through a range of different ways to register a domain name. As we have discussed in the calls, very often non-savvy non-commercial users or small business/home workers use resellers of various kinds to register their domains. Additional risk creeps in here, WRT whether or not a positive consent has been obtained from relevant employees. Further risk creeps in when we look at automatic renewals, where the contact data may not be updated. If updated, have the steps been taken to get consent from new employees? To me this is key, non-savvy users, and I count myself among them, are not likely to check what an intermediary is doing with respect to the domain renewal or updating. Now, of course the argument is that they SHOULD be more diligent and they SHOULD pay attention to the accuracy requirements, but lets deal in facts here.....are they? As the data controller who is pre-emptively disclosing personal data, allegedly with consent, to unknown (to the contracted party) third parties, the responsibility still rests with the controller. As I have mentioned, a Facebook or a Google or a Microsoft can get away with treading roughshod over their consent arrangements....not too many folks are going to give up free or necessary services over quibbles in a consent form, even if it is 75 pages long. However the registrars (and to a lesser extent, the registries) are operating in a highly competitive market. Once losing my trust, perhaps over a trifling inattention to the accuracy of my data, and I am transferring my domains to another company. Policing a complex reseller market is also rather a difficult matter that we have not discussed at length in our debates on this issue. I know that the data commissioners as a group do not understand how the accountability for the handling of personal information is transferred in that market, and it would not be surprising if 2Birds did not either. Bottom line: accredited registrars are shouldering the risk here, it is their risk, and they would know best whether they can trust the accuracy of the designation of legal personhood. This is why I think that this designation, in my opinion, should always permit an override by the contracted parties to treat the data as personal. I have suggested many many times that commercial organizations should operate on an accreditation basis and be linked to their official registration numbers (business, corporation, municipal licence etc). Noone ever responds to that idea....if it is totally ridiculous I would certainly like to know why, I am offering it in good faith and I think it would do something useful to stop fraudulent registrations in their names. However, small business and non-commercial organizations, even if incorporated or in possession of a registration # of some kind have different needs and circumstances, and they are frequently treated differently under data protection law. One final point that I have raised a few times.....we tend to focus on enforcement fines and Court costs. Even if noone ever complains to a DPA or takes a case to Court, where the advice of 2 Birds gives us some comfort that the risk is manageable, and the results would exonerate the contracted parties.....what about reputational damage in the meantime? Court costs? Who actually wants to have customers complaining about the practices? Employee morale, if it is employees who are objecting to the practices? I support focusing on whether the data submitted is personal or not, with a fulsome definition and description of same, and full flexibility for contracted parties to err on the side of caution and consider the possibility of some data being personal after all. After all, much data is still being disclosed, and noone has adduced strong evidence that the delay in requesting the data (as opposed to getting it from the published data) will have huge repercussions. What is actually at play here is who is doing the extra work....the requesting party, or the data controller. Stephanie Perrin On 2021-04-15 10:42 p.m., Mueller, Milton L via Gnso-epdp-team wrote: EXTERNAL EMAIL: Further legal support from TwoBirds 14.2 If personal data is erroneously included in published Registration Data, it would in this scenario occur despite substantial (VSC) steps taken by the Contracted Parties, and would be primarily attributable to the actions/omissions of the Registrant. This is likely to be taken into account by data subjects, data protection supervisory authorities, and courts. 14.3 The data in question is likely to be low sensitivity. The scenario being envisaged here (mistaken inclusion of personal data in published Registration Data) seems to be most likely to occur when a legal entity (e.g. a company or non-profit organisation) is registering / maintaining its own domains. In those scenarios, we assume the personal data that could be disclosed would ordinarily relate to an employee’s work details (e.g. a company email address), not an individual’s private life. Although the GDPR confers protection even in the workplace, the data in question here may arguably be less capable of causing harm to an individual than data relating to the data subject’s private life.[1] 14.4 In more sensitive cases (e.g. disclosing that a person works for a company in a sensitive or “embarrassing” sector), a Registrant would be putting itself at serious risk of complaints from its own employees. Registrants are therefore already incentivised to avoid errors that could have serious consequences for their own staff. From: Mueller, Milton L Sent: Thursday, April 15, 2021 10:34 PM To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: RE: [Gnso-epdp-team] On the proposed guidance Some legal support for my argument below from Bird & Bird: There may even be an argument, based on EU Court of Justice (“CJEU”) caselaw, that this is a situation where Contracted Parties should generally only be liable should they fail to properly address a complaint about the data – i.e. only once they are put on notice about the alleged illegality and thereby have an opportunity to “verify” the merits of the complaint.[1] This bears some parallels to other EU liability regimes for operators of services online that process – unwittingly – content that violates EU law.[2] As discussed at footnote 6 below, this is arguably recognised in (at least some) decisions of GDPR supervisory authorities. In other words, if personal data finds its way into a published registration record that should not be there, an objection can be lodged with the registrar and they can verify the merits and remove the data. Dr. Milton L Mueller Georgia Institute of Technology School of Public Policy Internet Governance Project<https://urldefense.com/v3/__https:/internetgovernance.org/__;!!DOxrgLBm!XSyw...> From: Mueller, Milton L Sent: Thursday, April 15, 2021 9:14 PM To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: FW: [Gnso-epdp-team] On the proposed guidance >" Everyone who is named in a role in a registration must have already been informed > and consented to all of the conditions involved in the role. " This is the ideal. Sadly, this ideal > is very often not the case. Whoa. Of course, Volker, it is possible that a person making a registration for a legal person won’t do it properly. But it is absurd to expect a registrar to be legally responsible for that. How can the registrar be liable for privacy breaches made by the registrant? Indeed, I can’t understand why gaining the consent of the administrative assistant of the xyz department to have their name listed in the whois is a matter for DNS/ICANN policy at all. ICANN policy simply needs to inform registrants that under certain conditions the data will be published. Let’s take an extreme case – suppose a nasty IT manager in a major corporation puts the name, email address and (what the heck) a revenge porn photo of her ex-husband in her company’s registration record. Are you telling me the registrar would be considered responsible for that breach of privacy? Not the nasty IT manager? Show me a legal case in which that kind of liability has been assigned. I doubt you can, but I await the data from CP lawyers who have been involved in these cases. I do know of several cases in which agents for a corporation wrongly listed themselves as the technical and administrative contact, making it possible for them to hijack the name. The registrar was NEVER held liable for that. Reminder: We had to reform Whois/RDS policy because ICANN, as a matter of contractual obligation, required registrars to publish sensitive PII of any and every Registrant. Once we have removed that obligation, and once we have given registrants knowledge of the conditions under which the data in the record should be published, I don’t see why registrars need to worry about some corporation listing the personal email address of someone in their IT department. So if this alleged risk is being cited to scare us away from allowing registrants to self-designate as legal or natural, it is a pretty weak case, imho. --MM From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Volker Greimann via Gnso-epdp-team Sent: Thursday, April 15, 2021 10:10 AM To: Steve Crocker <steve@shinkuro.com<mailto:steve@shinkuro.com>> Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] On the proposed guidance Employees are named by other employees without their knowledge, or remain named long after they leave. From the experience as a registrar dealing with registrants every day, this ideal is an assumption that does not survive contact with reality. -- Volker A. Greimann General Counsel and Policy Manager KEY-SYSTEMS GMBH T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net<https://urldefense.com/v3/__http:/www.key-systems.net/__;!!DOxrgLBm!XSywrkEo...> Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358. This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached. On Thu, Apr 15, 2021 at 3:36 PM Steve Crocker via Gnso-epdp-team <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> wrote: Laureen, Thanks for your note. With respect to the details under legal person, we believe the issue of consent should be moot. Everyone who is named in a role in a registration must have already been informed and consented to all of the conditions involved in the role. This is a prerequisite for having a working system and is not specific to meeting a privacy regulation. The fact that this requirement is not specified in the existing contractual documentation is an error and needs to be rectified. Steve On Thu, Apr 15, 2021 at 6:28 AM Kapin, Laureen via Gnso-epdp-team <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> wrote: I think we share common ground on many key issues and I would like to build on the many helpful inputs received as to what would be advisable. Goal: publish non-personal, non-protected data to the greatest extent permissible under the GDPR and within low legal risks to data controllers and processors. Note, the description below does not fully detail the advised safeguards which B&B has documented and which we’ve adopted in our prior input because my impression is that we generally agree that the safeguards are prudent. This description merely seeks to identify the key steps that must be taken to ensure that personal data is identified and protected and non-personal data is published. I also highlight the addition of a potential additional safeguard – Confirmation. I think this process incorporates what we’ve discussed and inputs received and could form a useful framework for discussion. Note: • New Registrations: This process applies to new registrations (Steve C. has some useful thoughts on how to deal with existing Registrations) • Publish: When I use the word “publish,” I mean made public directly; not via the SSAD. • Flexibility: Based on input from our Registrar colleagues, we should permit flexibility for how these steps are implemented to account for the varied business models in place. • Timing: All identifications need to take place at the time of registration or shortly thereafter (w/in the 13-day accuracy verification window) and no registration data should be published until the identification, consent, and confirmation process concludes Process: 1. A threshold identification of the registrant as a natural or legal person; a. If natural, registration info redacted b. If legal, further inquiries and advisories (safeguards): i. if the legal person identifies that it has a protected status under the GDPR 1. registration info redacted ii. If the legal person registration contains personal data, advise of consequences (publication) 1. Obtain necessary consents 2. Possible additional safeguard: Ask Registrant to Confirm any identification that will result in publication of contact data (akin to confirming a flight reservation or stock trade) a. Publish 3. If no consent a. Redact 2. Provide quick and easy opportunity to correct any mistakes I hope this is useful. Kind regards, Laureen Kapin Counsel for International Consumer Protection Federal Trade Commission (202) 326-3237 From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Volker Greimann via Gnso-epdp-team Sent: Thursday, April 15, 2021 8:35 AM To: Hadia Abdelsalam Mokhtar EL miniawi <Hadia@tra.gov.eg<mailto:Hadia@tra.gov.eg>> Cc: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] On the proposed guidance I think we need to be cognisant of the current status quo and use that as the basis for our thoughts on the matter: 1) There is no differentiation between legal or natural contacts. 2) The redaction of all contacts is permitted and has become the de-facto standard. 3) We allow consent-based disclosure. 4) NIS 2 may at some point in the future require publication of non-personal information. This leads to two very simple follow-on questions: a) How do we identify such non-personal information? What is really necessary for this end? b) What would publication entail? For a) we and Twobirds identified voluntary self-declaration of the data submitted. As all data is redacted by default, the differentiation of the data subject category is irrelevant as it ultimately only boils down to the declaration of the data subject thatthe data contains no personal information. For b), the term "publish" is undefined. For all we know, it could mean publication in a physical print edition (it doesn't mean that though). But publication within SSAD can very well be sufficient for that definition. There is no reason whatsoever to assume differently. -- Volker A. Greimann General Counsel and Policy Manager KEY-SYSTEMS GMBH T: +49 6894 9396901 M: +49 6894 9396851 F: +49 6894 9396851 W: www.key-systems.net<https://urldefense.com/v3/__http:/www.key-systems.net/__;!!DOxrgLBm!XSywrkEo...> Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835 CEO: Oliver Fries and Robert Birkner Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358. This email and any files transmitted are confidential and intended only for the person(s) directly addressed. If you are not the intended recipient, any use, copying, transmission, distribution, or other forms of dissemination is strictly prohibited. If you have received this email in error, please notify the sender immediately and permanently delete this email with any files that may be attached. <https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&...> Virus-free. www.avast.com<https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&...> On Thu, Apr 15, 2021 at 1:52 PM Hadia Abdelsalam Mokhtar EL miniawi via Gnso-epdp-team <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> wrote: Dear Milton, Thank you for your constructive thoughts. I believe we have a lot to build on. In relation to principle one, I think we all agree that some legal data subjects would want to publish their data in the RDDS, but without your first principle they can only do this through consent. The legal memo received lately from Bird & Bird explains that if CPs publish the data of legal persons based on consent they are at a higher risk than if they publish the data of legal persons based on self-designation. In the latter case CPs might only be liable if they fail to address a complaint. So the question always was: what is the benefit of labeling the data as belonging to a natural or legal person? Of course we all know that GDPR protects the data of natural persons and not legal persons, but the important answer now is that the distinction significantly reduces the liability of CPs. In addition, the distinction is helpful in performing the balancing test in case the data is not published and I am sure if we look into individual use cases we can find much more benefits. Moreover, it could prove to be useful regarding possible upcoming regulations. I would also add that the level of protection assigned to the data elements suggested by Steve provides additional safe guards and flexibility in the implementation. Finally, I join you in being optimistic about our ability to finish this. Kind regards Hadia From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>] On Behalf Of Mueller, Milton L via Gnso-epdp-team Sent: Wednesday, April 14, 2021 10:12 PM To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] On the proposed guidance Colleagues: I have only gotten time to review the latest Guidance document and the surrounding debate today. Apologies, but there is a lot going on in my day job. I am disappointed to see that we seem to be going backwards. I see divergence rather than convergence on the way we are approaching the problem. I see no point in adding more noise to the current document via the Comments function. What I would like to try to do is articulate some broad principles about how to deal with the legal/natural distinction. If we can agree on those principles, it will be relatively easy to complete the document. If we cannot/do not agree on those principles, additional wordsmithing and debates over terms will not get us anywhere. So here are the broad principles that I would offer up for debate: 1. The legal/natural distinction is relevant and we need to find a way make it in RDDS without compromising privacy rights. 2. Registrants should be able to self-designate as legal or natural, with no burden of authentication placed on registrars or registries 3. To protect small home offices or NGOs who are technically Legal persons but whose registration data may include Personal data, we need an additional check in the process. 4. As long as they conform with the above 3 principles, registrars/ries (CPs) should be given maximum flexibility to choose the way to differentiate. Principle 1 discussion: If we cannot agree on this (or agree to abandon this principle), _nothing else will fall into place_. Ever. So let’s settle that. Steve and Volker I suspect will disagree with this principle. Steve has argued that the L/N distinction is “not a central concern” and all that matters is whether the registrant’s data is to be made available to anyone. If he is right, we can discard the guidance altogether, because we already have a recommendation to allow the RNH to consent to the publication of their data. Volker has also suggested that it is personal data we need to differentiate, not L/N . I disagree with Steve and Volker on this and so do most of the rest of the group. L/N distinction is a central concern to certain stakeholder groups in the EPDP, because a) GDPR and other data protection laws do not protect it and this process is all about bringing RDS into compliance with privacy law; b) Legal person data could be published and it would provide easier access to their registration data. As a NCSG member I can find no basis for objecting to the publication of WalMart’s, Kroger’s or the local hardware store’s registration data. Any concerns about PII are addressed by principles 2 and 3. Steve is approaching this as an engineer, but this is a policy process, and we will not obtain agreement on a solution unless certain stakeholders are satisfied. If they think it is a central concern, it’s a central concern, that’s how policy/politics work. Principle 2 discussion This is the key principle that keeps NCSG and CPH satisfied. Registrants are in control of how they are designated. Yes, this means that some people will lie. That is just something we will have to accept. One cannot erase that possibility without creating a system that is too burdensome and costly as to outweigh any benefits. Principle 3 discussion This is something everyone seems to agree on already. But it is good to make it explicit, then we can work out how specific our guidance can get, so as to conform to … Principle 4 Avoid being overly prescriptive, but ensure that the other 3 principles are honored. So yes, Volker, we give you maximum flexibility to implement in accordance with different business models, but you can NOT make a designation for a RNH, because it violates principle 2. I truly believe that if we can come to agreement on these 4 principles and use them as the basis for drafting guidance, we can actually finish this. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-team__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxghxMAOY$> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxl5BDJwa$>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxn6b_CGX$>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. <https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&...> Virus-free. www.avast.com<https://urldefense.com/v3/__https:/www.avast.com/sig-email?utm_medium=email&...> _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-team__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxghxMAOY$> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxl5BDJwa$>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxn6b_CGX$>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-team__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxghxMAOY$> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxl5BDJwa$>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxn6b_CGX$>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. _____ _____ [1] As explained above, we have understood this question to be asking about scenarios where Registrants are legal persons, as per the EDPB quote at paragraph 1. In respect of individual (natural person) Registrants, the issues will be largely similar: if a natural person incorrectly states that their data is not personal data, then (i) the verification measures should prevent the data from being published, since they will give the data subject an opportunity to correct their mistake; (ii) the mitigating factors and legal arguments described at paragraphs 11.7 and 11.8 and paragraphs 14.1 - 14.6 here, should confer reasonable legal protection for Contracted Parties. [1] In its judgement in Case C‑136/17 GC and Others, the CJEU explained that GDPR obligations relating to an erasure (“Right to Be Forgotten”) request apply “to the operator of a search engine in the context of his responsibilities, powers and capabilities as the controller of the processing carried out in connection with the activity of the search engine, on the occasion of a verification performed by that operator, under the supervision of the competent national authorities, following a request by the data subject”. As the Advocate General explained in that case, “such an operator can act only within the framework of its responsibilities, powers and capabilities. In other words, such an operator may be incapable of ensuring the full effect of the provisions of [EU data protection law], precisely because of its limited responsibilities, powers and capabilities. . . An ex ante control of internet pages which are referenced as the result of a search does not fall within the responsibilities or the capabilities of a search engine.” It could not know, from the moment it indexed a webpage, that the content of that page was (for example) out of date (as in the original Google Spain / Costeja ruling), or (in the GC and Others case) “special category” or “criminal offence” data for which it required consent. [2] See, for example, Article 14<https://secure-web.cisco.com/1PPn2p2s6dzer8OKRUBFJPCEk7-mmKJw2XWOI9X3Sbr6FIL...> of the e-Commerce Directive 2000/31/EC and its transposition into the national laws of EU/EEA Member States and the UK. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-team__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxghxMAOY$> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxl5BDJwa$>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxn6b_CGX$>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-epdp-team__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxghxMAOY$> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxl5BDJwa$>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!XSywrkEovOjOF-WmOAPUMVqsao1Zv9b2rUkkdL1O1jXYaDTpt6eZXsc9LSp2ncroxn6b_CGX$>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://secure-web.cisco.com/16wEaGw0GyAb6ahlevuupWt1K0Yq8ZN5qkZy1oyRBBFvmSczMqC92I7X6btwvYM2tz4qQH6IGGDiyQS9x7A0y4UBOP3Y6yqg3XfDA5aKIHuEKeoSR2vgowFOhSVWJWsX062ok1wSaGKbEyw_XUL7RhApoVx3wlgGdwtnzavE5D_2f_BkUtPoMk7wjnC8U9wwNgj4NieVR29qIM852MKnOin1-RKWysdBi7ifeczk3unh1FHutD73cvJfOqrN0bMrD/https%3A%2F%2Fmm.icann.org%2Fmailman%2Flistinfo%2Fgnso-epdp-team> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://secure-web.cisco.com/1t1d6Ou5QM2EGQlXYqUVvA2hM8sz6vavevGfYN9xoDkpEMocGZOZBYVHmzrq0ybI1mWActLqXmn9HhuIwkxbgYAFv0KbBDINqphWngQnSm_LSvWy_B8eLCWKKcBPlAO9JhHSMxDxGQnsOlWc43e6Ac3zO6TaIzLa35BJ9lTk5vrUW6tHgqfEpUmzqXmtDsVsk3tV14ZgKywdSrYzXKE_uoXGtKcJ1SDdK4V0W0-QkfZbHRQMBx2jzdnATgWUdGbJM/https%3A%2F%2Fwww.icann.org%2Fprivacy%2Fpolicy>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://secure-web.cisco.com/1tBPn-cMMnfqbEJTLK-9Hrn9NcJ9t-pyZO_DD7D3ZSjknVSj2-X91RtwJpk8ZzAfz_5rgskButFvPy-udhNzGSwOSjW2M1lZjgFE_92yUjNJq7W6yHwmhyd-e-Er_chZxzT_Z2Vz7-QZRJn9a4ciHEIUX71a58g5wVbzakL4hKJ93g8DaIyqwcq1QryPs_lEYIjPHuijuZkfHypr5nY13S_0N6RZnrq2S0VPEUgXZ-BXEgtJvjeIS1z3zOwTW4LGw/https%3A%2F%2Fwww.icann.org%2Fprivacy%2Ftos>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://secure-web.cisco.com/16wEaGw0GyAb6ahlevuupWt1K0Yq8ZN5qkZy1oyRBBFvmSczMqC92I7X6btwvYM2tz4qQH6IGGDiyQS9x7A0y4UBOP3Y6yqg3XfDA5aKIHuEKeoSR2vgowFOhSVWJWsX062ok1wSaGKbEyw_XUL7RhApoVx3wlgGdwtnzavE5D_2f_BkUtPoMk7wjnC8U9wwNgj4NieVR29qIM852MKnOin1-RKWysdBi7ifeczk3unh1FHutD73cvJfOqrN0bMrD/https%3A%2F%2Fmm.icann.org%2Fmailman%2Flistinfo%2Fgnso-epdp-team> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://secure-web.cisco.com/1t1d6Ou5QM2EGQlXYqUVvA2hM8sz6vavevGfYN9xoDkpEMocGZOZBYVHmzrq0ybI1mWActLqXmn9HhuIwkxbgYAFv0KbBDINqphWngQnSm_LSvWy_B8eLCWKKcBPlAO9JhHSMxDxGQnsOlWc43e6Ac3zO6TaIzLa35BJ9lTk5vrUW6tHgqfEpUmzqXmtDsVsk3tV14ZgKywdSrYzXKE_uoXGtKcJ1SDdK4V0W0-QkfZbHRQMBx2jzdnATgWUdGbJM/https%3A%2F%2Fwww.icann.org%2Fprivacy%2Fpolicy>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://secure-web.cisco.com/1tBPn-cMMnfqbEJTLK-9Hrn9NcJ9t-pyZO_DD7D3ZSjknVSj2-X91RtwJpk8ZzAfz_5rgskButFvPy-udhNzGSwOSjW2M1lZjgFE_92yUjNJq7W6yHwmhyd-e-Er_chZxzT_Z2Vz7-QZRJn9a4ciHEIUX71a58g5wVbzakL4hKJ93g8DaIyqwcq1QryPs_lEYIjPHuijuZkfHypr5nY13S_0N6RZnrq2S0VPEUgXZ-BXEgtJvjeIS1z3zOwTW4LGw/https%3A%2F%2Fwww.icann.org%2Fprivacy%2Ftos>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.