I really do not understand why we are talking about to what extent Consumer Protection is within ICANN's mandate. We are talking about 3rd part use cases, not ICANN Purposes. No one thinks that phishing or law protection is in ICANN's mandate, but we are talking about use cases for people/organizations who ARE in the business to potentially access redacted data. If a domain is clearly that of a legal person, and the contact information is not that of natural persons, there is no balancing to be done. Having a use case does not imply that any information will be released. It means there MAY be a case for releasing the information, and that is all we are presuming. Information may be released if there is natural person information involved and the balancing ctest is met, or if there is no natural person information. Unless we change during phase 2, we are allowing a registrar to not distinguish between natural persons and legal persons in deciding what to redact (or not) from the public RDS. It does not imply that they could not make the distinction on a case-by-case basis. Alan At 12/08/2019 12:53 PM, Mueller, Milton L wrote: I wish our positions were compatible. But I don’t think they are. Hadia (and Greg if I am not mistaken) are saying that the ALAC use case is justified because consumer protection is “in the global public interest.” My view, and apparently that of James Bladel and Alan Woods, is that the ALAC case seems to extend ICANN authority to general consumer protection which is outside the scope of ICANN’s mission. Actually there is an even stronger reason to discard this use case. In effect, advocates of this use case are saying that a consumer’s curiosity about who is behind a domain is sufficient cause to disclose protected data. I think this fails the 6.1.f balancing test prima facie. Curiosity does not outweigh a fundamental right, ever. Note well: the advocates of this use case are NOT saying that this is a remedy for fraud or some other form of actual consumer abuse. They say they need to expose this data BEFORE a transaction takes place, before fraud is even possible, because a consumer may be curious or feel uncertain about who is behind it. This is a very, very, very weak rationale, and I see no way that it passes a balancing test. Indeed, if that is a valid justification for disclosure, then we are back in the realm of the pre-GDPR Whois, because it means that anyone for any reason can be curious about who is behind a domain and might benefit from knowing the private data of the registrant. If we accept the ALAC 2 as a valid use case, we are back to pre-temp spec Whois. We all know that is not legal or acceptable. Dr. Milton L Mueller Georgia Institute of Technology School of Public Policy From: Mark Svancarek (CELA) <marksv@microsoft.com> Sent: Monday, August 12, 2019 12:40 PM To: Mueller, Milton L <milton@gatech.edu>; Greg Aaron <greg@illumintel.com>; gnso-epdp-team@icann.org Subject: RE: [Gnso-epdp-team] On the subject of ICANN's Bylaws... Milton, aren’t you and Greg (in this narrow topic) saying compatible things? - MiMu: Public interest is to be determined within MSM - GrAa: Let’s discuss this topic within EPDP From: Gnso-epdp-team < gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Mueller, Milton L Sent: Monday, August 12, 2019 9:33 AM To: Greg Aaron <greg@illumintel.com<mailto:greg@illumintel.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] On the subject of ICANN's Bylaws... All: Let me provide some background about Greg’s favorite section of the bylaws. He is fixated on the presence of three words he likes (global public interest) and not the actual meaning of the section. That core value emerged from a debate about the extent to which “the global public interest” was a meaningful guide to policy making. Those of us with extensive experience with regulatory systems around the world know that “public interest” is a blanket term that can be used to justify almost anything, from completely shutting down the internet to martial law to rate regulation. We knew as we were debating this that anyone can, and everyone does, claim that whatever policy they want is “in the public interest.” We did not want the Board to have the discretion to “divine” the public interest and use that divination to make policy unilaterally. There was, therefore a desire to carefully limit and bound public interest claims. Now look at what 1.2(b)iii actually says. It does NOT say that ICANN’s authority over Internet activity pertains to anything and everything that might be in the global public interest. It says that insofar as an ICANN policy is determined to be in the public interest, it must be so determined by a _bottom up, multistakeholder policy process_ and that such process must be _accountable and transparent_. In other words, this section of the bylaws only tells us _how_ the public interest in any given policy domain is to be ascertained. It does not expand ICANN’s mandate to include anything anyone thinks might be in the public interest. --MM From: Gnso-epdp-team < gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of Greg Aaron Sent: Monday, August 12, 2019 10:41 AM To: 'James M. Bladel' <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] On the subject of ICANN's Bylaws... Dear James: Thank you for your note. I can only speak to the comments I made in Thursday’s call. I did not reference ICANN’s Bylaws about “Competition and Consumer Trust” at all. Your references to Bylaws 4.6 are not relevant to my comments. Some members had stated that the ALAC use case should not even be discussed, because its premise is out of ICANN scope. I stated that it’s our obligation to talk about such issues. I referenced Bylaws 1.2(b)iii -- in the Core Values section � whicch says that the point of ICANN “policy development and decision-making [is] to ensure that the bottom-up, multistakeholder policy development process is used to ascertain the global public interest and that those processes are accountable and transparent”. My point was that as policy-makers, we are all obliged to apply that principle, especially since this working group is making decisions that will affect millions (if not billions) of people. It is a reminder for us to keep the big picture in mind, and that we’re here to ascertain what’s good for the Internet and discern what options exist within the law to serve that greater purpose. The SSAC has previously encouraged the ePDP to consider the impacts on how registrants and users interact for contactability, problem-solving, the avoidance of fraud, etc. In any case, the CCT Reviews you reference in Bylaws Section 4.6(d) are not the place to shunt all items that involve public impacts. According to the Bylaws, the CCT Reviews exist to examine only a limited set of things � basically CCT issues coming oout of the new gTLD program. Instead, any PDP can consider impacts on registrants and users as those issues come up within a WG’s charter. AFAIK our charter does not prohibit such. Your points below about alternate means are a contribution to the substantive debate, and thanks for them. But again, we can only have that debate if we all remember our main decision-making principles, and if issues are on the table in the first place, rather than kept off the table for some reason. All best, --Greg From: Gnso-epdp-team < gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Friday, August 9, 2019 11:47 AM To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] On the subject of ICANN's Bylaws... Good morning, Colleagues- During yesterday’s call, a few folks mentioned that ICANN’s Bylaws contain commitments to uphold “Competition” and “Consumer Choice/Consumer Trust”. These references to the Bylaws were offered in support of the proposed Use Case that RDS data should be a primary resource for consumers who are seeking to verify the operator of a website, or check the reputation of business, or to dispute a commercial transaction. For clarity, it’s worth noting that the predominant context for “competition” in ICANN’s Bylaws is specific to the domain name industry, esp. Registries and Registrars. And this makes sense, given that the industry prior to ICANN had no concept of “competition” or “consumer choice”; all domain transactions were handled by a single provider. Additionally, mentions of “consumer protection”, “consumer choice”, and “consumer trust” within the Bylaws are contained within Section 4.6(d), which outlines the “Periodic Reviews”, and are an element of the 2012 New gTLD program. These sections were ported to the Bylaws from the Affirmation of Commitments, and were drafted when many feared that new gTLDs would confuse consumers and undermine trust/confidence in the DNS. Taken together, it’s not correct to conclude that WHOIS/RDS data is intended to replace or preempt more widely recognized alternative tools for online consumers, like: * SSL certificates, verified by Certificate Authorities (CA) and supported by all modern browsers * Trust certificates (issued by organizations like the Better Business Bureau, Trustwave, McAffee, SiteLock, and card processors like Visa/Mastercard) * Reputation/review services like Google ratings, Yelp, and Facebook or Amazon reviews, and * The “About Us” or “Contact Us” or “Customer Support” links on merchant websites, which are omnipresent for legitimate businesses and required by law in many areas. But if this is still a point of divergence among the EPDP members, then perhaps we could consult ICANN Legal about the extent of their “Competition” and “Consumer Trust” mandate, and whether they believe ICANN is on the hook for the integrity & consumer satisfaction for all commercial activity taking place anywhere on the Internet. J. ------------- James Bladel GoDaddy _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy ( https://www.icann.org/privacy/policy) and the website Terms of Service ( https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.