Further Input from the IPC/BC on Small Team #1 and #2 issues
Dear EPDP Team- In our efforts to overcome a significant hurdle through our EPDP work – that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws. The Accuracy of information provided by data subjects Article 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that: Personal data shall be…accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’). According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data provided by the data subject, provided by a third party or created by the controller – the same obligation applies in each such case. As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states that: “In some cases it is reasonable to rely on the individual to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details, but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this.” However, if the controller learns that information is no longer accurate/up to date (either from the data subject or from other information which comes to light), the controller should update its records accordingly. The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must: · accurately record the information provided; · accurately record the source of the information; · take “reasonable steps” in the circumstances to ensure the accuracy of the information; and · carefully consider any challenges to the accuracy of the information. Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes. Moreover, in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties. Sincerely, Diane Diane Plaut General Counsel and Privacy Officer [cid:image001.png@01D3CA70.18FC1D40] Direct +1 646-899-2806 diane.plaut@corsearch.com<mailto:diane.plaut@corsearch.com> 220 West 42nd Street, 11th Floor, New York, NY 10036, United States www.corsearch.com<http://www.corsearch.com/> Join Corsearch on Twitter<https://twitter.com/corsearch> Linkedin<https://www.linkedin.com/company/2593860/> Trademarks + Brands<http://trademarksandbrands.corsearch.com/> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241) Corsearch.USCustomerService@corsearch.com<mailto:Corsearch.USCustomerService@corsearch.com> Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession.
This all sounds right to me. Alan At 02/11/2018 09:28 PM, Plaut, Diane wrote: Dear EPDP Team- In our efforts to overcome a significant hurdle through our EPDP work � that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws. The Accuracy of information provided by data subjects Article 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that: Personal data shall be�accurate and, where necessary, keept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’). According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data provided by the data subject, provided by a third party or created by the controller � the same obligation applies in each such caase. As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states that: “In some cases it is reasonable to rely on the individual to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details, but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this.” However, if the controller learns that information is no longer accurate/up to date (either from the data subject or from other information which comes to light), the controller should update its records accordingly. The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must: · accurately record the information provided; · accurately record the source of the information; · take “reasonable steps” in the circumstances to ensure the accuracy of the information; and · carefully consider any challenges to the accuracy of the information. Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes. Moreover, in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties. Sincerely, Diane Diane Plaut General Counsel and Privacy Officer [cid:image001.png@01D3CA70.18FC1D40] Direct +1 646-899-2806 diane.plaut@corsearch.com<mailto:diane.plaut@corsearch.com> 220 West 42nd Street, 11th Floor, New York, NY 10036, United States www.corsearch.com<http://www.corsearch.com/> Join Corsearch on Twitter<https://twitter.com/corsearch> Linkedin<https://www.linkedin.com/company/2593860/> Trademarks + Brands<http://trademarksandbrands.corsearch.com/> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241) Corsearch.USCustomerService@corsearch.com<mailto:Corsearch.USCustomerService@corsearch.com> Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Dear Diane, How can registrars determine the applicable law even if the geographical information is accurate? I don't think registrars can actually determine which law outside of their own jurisdiction applies to their registrants even if they know the geographical location. For example, as far as I know EU citizens anywhere in the world are protected by GDPR. So their geographical location does not determine what law applies. Registrars have to abide by their local laws, the court of law determines the applicable law and some registries have the choice of law clauses in their agreements with registrars which cannot be in conflict with the local laws of the registrars. All in all determining the "jurisdiction" of data subject is not dependent only on the geographical location of the registrant in this case. Also I think every domain name registrant regardless of where they are located deserve minimum data protection. They are consumers by the way! I am getting increasingly puzzled by IPC/BC interpretation of "accuracy" of personal information of data subjects under GDPR. In my opinion the concept of accuracy in GDPR is actually supposed to protect data subjects and not to be used against them. Accurate information is not about keeping the data accurate so that it can be displayed and accessed and mined by many around the world! The accuracy of data is a right given to data subjects so that inaccurate data cannot be used against them in court and other forums, or be denied a service or end in violating their rights. I believe they have the right for their information to be accurate and not the responsibility (under GDPR) to maintain it accurately. The registrars under GDPR have to maintain the data of domain name registrants "uptodate" to reduce privacy risks. They don't have to keep the database accurate so that they can distinguish between legal and natural persons. I believe by ICO you mean Information Commissioners Office. Specifically this page: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-re... The natural v legal distinction is not only burdensome for the CPs or opens them to liability. It is dangerous for noncommercial/not for porfit/ advocacy organizations that have registered domain names and are vulnerable to attacks of all sorts. I assume IPC/BC wants this distinction so that the org personal sensitive data won't be redacted. I would like to know why. I would like to know why while some groups are fiercely working to have access to personal and sensitive data of domain name registrants for their legitimate interest, also work towards exposing domain name registrants sensitive data to the world. Farzaneh On Fri, Nov 2, 2018 at 10:13 PM Alan Greenberg <alan.greenberg@mcgill.ca> wrote:
This all sounds right to me. Alan
At 02/11/2018 09:28 PM, Plaut, Diane wrote:
Dear EPDP Team-
In our efforts to overcome a significant hurdle through our EPDP work – that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws.
*The Accuracy of information provided by data subjects *Article 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that:
*Personal data shall be…accurate and, where necessary, keept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’). *According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data provided by the data subject, provided by a third party or created by the controller – the same obligation applies in each such caase. *As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states* that: “In some cases it is reasonable to rely on the individual to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details, *but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this*.†However, if the controller learns that information is no longer accurate/up to date (either from the data subject or from other information which comes to light), the controller should update its records accordingly.
*The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must: · accurately record the information provided; · accurately record the source of the information; · take “reasonable steps†in the circumstances to ensure the accuracy of the information; and · carefully consider any challenges to the accuracy of the information.*
*Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes. Moreover, in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties. * Sincerely,
Diane
*Diane Plaut *General Counsel and Privacy Officer [image: cid:image001.png@01D3CA70.18FC1D40] Direct +1 646-899-2806 
 diane.plaut@corsearch.com 220 West 42nd Street, 11th Floor, New York, NY 10036, United States
 www.corsearch.com Join Corsearch on Twitter <https://twitter.com/corsearch> Linkedin <https://www.linkedin.com/company/2593860/> Trademarks + Brands <http://trademarksandbrands.corsearch.com/> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241)
 Corsearch.USCustomerService@corsearch.com
*Confidentiality Notice:* This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession.
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
I agree with Farzaneh; all domain name registrants should be shown a baseline of respect, regardless of whether or not they live in a jurisdiction with strong and enforced privacy protections. This is as much an ethical consideration as it is a legal one. While in some other sectors there are fuzzy questions around what information is private and sensitive, and what is innocuous and does not need to be protected, in our situation the case is very simple. There is demonstrable harm that can result from the disclosure of registration data. And look on Twitter at the messages that registrars receive from consumers upset that their registration data has been made public (or “sold” is the perception many consumers have). It is a black-and-white breach of consumer expectations. No one is registering a domain name with the implicit understanding that their contact information will be obtained by a third party. I note this appreciating that some third parties, like law enforcement, will have a need to access registration data, but relying on consumers to themselves take steps to protect their personal information is not going to fly. You can’t ask someone to check a box noting whether or not they are a legal or natural person, because most registrants won’t know the answer or why the distinction matters. What if a natural person becomes confused and indicates they are a legal person? I don’t believe the BC and IPC's proposed language that, “Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws,” would shield the contracted party in any meaningful way. Under European Union law at least, standard contract terms must be fair. A registrant cannot sign away a right. A contract is not allowed to create an imbalance between your rights and obligations as a consumer and the rights and obligations of sellers and suppliers. What differentiates the GDPR from its weaker, 1995 predecessor is that it tries to correct the power imbalance that exists between a data controller and a data subject. There were natural information asymmetries that had not self-corrected. The right to know what information has been collected about you in the GDPR, and the right to ask that it be corrected or deleted (also in the GDPR) all support the thesis that there is a power imbalance at play here. The onus in the GDPR is on those with more power - whoever is collecting and processing personal information - to behave in a reasonable way towards consumers and to put the interests of the individual above their own. I know that I have only referenced the GDPR above but that I am asking that GDPR-equivalent protections be applied much more broadly to all registrants. I say this for three reasons. Primarily, because I think it is not unthinkable that increased data protection regulations will be coming to other markets in the near future, including the United States. However there is also the question of cost and whether it is fair to impose upon the contracted parties (and, ultimately, domain name registrants) the cost of achieving compliance with the GDPR by building a separate, parallel process/system for the EU market and a separate, parallel process/system for other markets, or whether it is more economical to simply convert all of one's business processes to conform to the more stringent regulation. And finally, ethics: just because someone lives in a jurisdiction that does not guarantee a right today does not mean there is not an ethical duty of care to deliver it. Kind regards, Ayden Férdeline ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Sunday, 4 November 2018 07:37, farzaneh badii <farzaneh.badii@gmail.com> wrote:
Dear Diane,
How can registrars determine the applicable law even if the geographical information is accurate? I don't think registrars can actually determine which law outside of their own jurisdiction applies to their registrants even if they know the geographical location. For example, as far as I know EU citizens anywhere in the world are protected by GDPR. So their geographical location does not determine what law applies. Registrars have to abide by their local laws, the court of law determines the applicable law and some registries have the choice of law clauses in their agreements with registrars which cannot be in conflict with the local laws of the registrars. All in all determining the "jurisdiction" of data subject is not dependent only on the geographical location of the registrant in this case.
Also I think every domain name registrant regardless of where they are located deserve minimum data protection. They are consumers by the way!
I am getting increasingly puzzled by IPC/BC interpretation of "accuracy" of personal information of data subjects under GDPR. In my opinion the concept of accuracy in GDPR is actually supposed to protect data subjects and not to be used against them. Accurate information is not about keeping the data accurate so that it can be displayed and accessed and mined by many around the world! The accuracy of data is a right given to data subjects so that inaccurate data cannot be used against them in court and other forums, or be denied a service or end in violating their rights. I believe they have the right for their information to be accurate and not the responsibility (under GDPR) to maintain it accurately. The registrars under GDPR have to maintain the data of domain name registrants "uptodate" to reduce privacy risks. They don't have to keep the database accurate so that they can distinguish between legal and natural persons. I believe by ICO you mean Information Commissioners Office. Specifically this page: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-re...
The natural v legal distinction is not only burdensome for the CPs or opens them to liability. It is dangerous for noncommercial/not for porfit/ advocacy organizations that have registered domain names and are vulnerable to attacks of all sorts.
I assume IPC/BC wants this distinction so that the org personal sensitive data won't be redacted. I would like to know why. I would like to know why while some groups are fiercely working to have access to personal and sensitive data of domain name registrants for their legitimate interest, also work towards exposing domain name registrants sensitive data to the world.
Farzaneh
On Fri, Nov 2, 2018 at 10:13 PM Alan Greenberg <alan.greenberg@mcgill.ca> wrote:
This all sounds right to me. Alan
At 02/11/2018 09:28 PM, Plaut, Diane wrote:
[]Dear EPDP Team-
In our efforts to overcome a significant hurdle through our EPDP work – that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws. The Accuracy of information provided by data subjectsArticle 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that: Personal data shall be…accurate and, where necessary, keept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’).According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data provided by the data subject, provided by a third party or created by the controller – the same obligation applies in each such caase. As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states that: “In some cases it is reasonable to rely on the individual to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details, but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this.†However, if the controller learns that information is no longer accurate/up to date (either from the data subject or from other information which comes to light), the controller should update its records accordingly. The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must: · accurately record the information provided; · accurately record the source of the information; · take “reasonable steps†in the circumstances to ensure the accuracy of the information; and · carefully consider any challenges to the accuracy of the information. Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes.
Moreover, in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties. Sincerely,
Diane
Diane PlautGeneral Counsel and Privacy Officer [cid:image001.png@01D3CA70.18FC1D40] Direct +1 646-899-2806 
diane.plaut@corsearch.com 220 West 42nd Street, 11th Floor, New York, NY 10036, United States
[www.corsearch.com](http://www.corsearch.com/) Join Corsearch on [Twitter](https://twitter.com/corsearch) [Linkedin](https://www.linkedin.com/company/2593860/) [Trademarks + Brands](http://trademarksandbrands.corsearch.com/) Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241)
Corsearch.USCustomerService@corsearch.com
Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession.
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Hi, I also agree with Farzi on this, particularly on the issue of accuracy. Mentions of accuracy of data for data subjects in GDPR, to me, appear to all be directed towards ensuring the data subject’s right to rectifying personal data (Article 16), associated with data subjects' right to restriction of processing (Article 18). Accuracy obligations in GDPR are, to the extent possible, placed on the Controller, not the data subject. From what I can tell, the ICO analysis runs along those same lines, and does not (again, to me) seem to be worded in a way that is meant to place an accuracy of data burden on data subjects in order to facilitate the pursuit of 3rd-party interests. Thanks. Amr
On Nov 4, 2018, at 1:35 PM, Ayden Férdeline <icann@ferdeline.com> wrote:
I agree with Farzaneh; all domain name registrants should be shown a baseline of respect, regardless of whether or not they live in a jurisdiction with strong and enforced privacy protections. This is as much an ethical consideration as it is a legal one.
While in some other sectors there are fuzzy questions around what information is private and sensitive, and what is innocuous and does not need to be protected, in our situation the case is very simple. There is demonstrable harm that can result from the disclosure of registration data. And look on Twitter at the messages that registrars receive from consumers upset that their registration data has been made public (or “sold” is the perception many consumers have). It is a black-and-white breach of consumer expectations. No one is registering a domain name with the implicit understanding that their contact information will be obtained by a third party. I note this appreciating that some third parties, like law enforcement, will have a need to access registration data, but relying on consumers to themselves take steps to protect their personal information is not going to fly. You can’t ask someone to check a box noting whether or not they are a legal or natural person, because most registrants won’t know the answer or why the distinction matters.
What if a natural person becomes confused and indicates they are a legal person? I don’t believe the BC and IPC's proposed language that, “Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws,” would shield the contracted party in any meaningful way. Under European Union law at least, standard contract terms must be fair. A registrant cannot sign away a right. A contract is not allowed to create an imbalance between your rights and obligations as a consumer and the rights and obligations of sellers and suppliers.
What differentiates the GDPR from its weaker, 1995 predecessor is that it tries to correct the power imbalance that exists between a data controller and a data subject. There were natural information asymmetries that had not self-corrected. The right to know what information has been collected about you in the GDPR, and the right to ask that it be corrected or deleted (also in the GDPR) all support the thesis that there is a power imbalance at play here. The onus in the GDPR is on those with more power - whoever is collecting and processing personal information - to behave in a reasonable way towards consumers and to put the interests of the individual above their own.
I know that I have only referenced the GDPR above but that I am asking that GDPR-equivalent protections be applied much more broadly to all registrants. I say this for three reasons. Primarily, because I think it is not unthinkable that increased data protection regulations will be coming to other markets in the near future, including the United States. However there is also the question of cost and whether it is fair to impose upon the contracted parties (and, ultimately, domain name registrants) the cost of achieving compliance with the GDPR by building a separate, parallel process/system for the EU market and a separate, parallel process/system for other markets, or whether it is more economical to simply convert all of one's business processes to conform to the more stringent regulation. And finally, ethics: just because someone lives in a jurisdiction that does not guarantee a right today does not mean there is not an ethical duty of care to deliver it.
Kind regards,
Ayden Férdeline
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Sunday, 4 November 2018 07:37, farzaneh badii <farzaneh.badii@gmail.com> wrote:
Dear Diane,
How can registrars determine the applicable law even if the geographical information is accurate? I don't think registrars can actually determine which law outside of their own jurisdiction applies to their registrants even if they know the geographical location. For example, as far as I know EU citizens anywhere in the world are protected by GDPR. So their geographical location does not determine what law applies. Registrars have to abide by their local laws, the court of law determines the applicable law and some registries have the choice of law clauses in their agreements with registrars which cannot be in conflict with the local laws of the registrars. All in all determining the "jurisdiction" of data subject is not dependent only on the geographical location of the registrant in this case.
Also I think every domain name registrant regardless of where they are located deserve minimum data protection. They are consumers by the way!
I am getting increasingly puzzled by IPC/BC interpretation of "accuracy" of personal information of data subjects under GDPR. In my opinion the concept of accuracy in GDPR is actually supposed to protect data subjects and not to be used against them. Accurate information is not about keeping the data accurate so that it can be displayed and accessed and mined by many around the world! The accuracy of data is a right given to data subjects so that inaccurate data cannot be used against them in court and other forums, or be denied a service or end in violating their rights. I believe they have the right for their information to be accurate and not the responsibility (under GDPR) to maintain it accurately. The registrars under GDPR have to maintain the data of domain name registrants "uptodate" to reduce privacy risks. They don't have to keep the database accurate so that they can distinguish between legal and natural persons. I believe by ICO you mean Information Commissioners Office. Specifically this page: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-re...
The natural v legal distinction is not only burdensome for the CPs or opens them to liability. It is dangerous for noncommercial/not for porfit/ advocacy organizations that have registered domain names and are vulnerable to attacks of all sorts.
I assume IPC/BC wants this distinction so that the org personal sensitive data won't be redacted. I would like to know why. I would like to know why while some groups are fiercely working to have access to personal and sensitive data of domain name registrants for their legitimate interest, also work towards exposing domain name registrants sensitive data to the world.
Farzaneh
On Fri, Nov 2, 2018 at 10:13 PM Alan Greenberg <alan.greenberg@mcgill.ca> wrote:
This all sounds right to me. Alan
At 02/11/2018 09:28 PM, Plaut, Diane wrote:
[]Dear EPDP Team-
In our efforts to overcome a significant hurdle through our EPDP work – that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws. The Accuracy of information provided by data subjectsArticle 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that: Personal data shall be…accurate and, where necessary, keept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’).According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data provided by the data subject, provided by a third party or created by the controller – the same obligation applies in each such caase. As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states that: “In some cases it is reasonable to rely on the individual to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details, but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this.†However, if the controller learns that information is no longer accurate/up to date (either from the data subject or from other information which comes to light), the controller should update its records accordingly. The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must: · accurately record the information provided; · accurately record the source of the information; · take “reasonable steps†in the circumstances to ensure the accuracy of the information; and · carefully consider any challenges to the accuracy of the information. Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes.
Moreover, in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties. Sincerely,
Diane
Diane PlautGeneral Counsel and Privacy Officer [cid:image001.png@01D3CA70.18FC1D40]
Direct +1 646-899-2806 
diane.plaut@corsearch.com
220 West 42nd Street, 11th Floor, New York, NY 10036, United States
[www.corsearch.com](http://www.corsearch.com/)
Join Corsearch on [Twitter](https://twitter.com/corsearch) [Linkedin](https://www.linkedin.com/company/2593860/) [Trademarks + Brands](http://trademarksandbrands.corsearch.com/)
Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241)
Corsearch.USCustomerService@corsearch.com
Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession.
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org
Hi again, And in case I wasn’t clear in my previous email, I strongly oppose this being included in the initial report:
On Nov 3, 2018, at 3:28 AM, Plaut, Diane <Diane.Plaut@corsearch.com> wrote:
[SNIP]
Moreover, in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties.
I was under the impression that during our deliberations on purposes, that we had agreed that there would be no change to accuracy requirements as per existing Consensus Policies. I don’t believe that changing this now is helpful in getting us towards the finish line on the EPDP Team’s initial report. Additionally, I don’t believe that inclusion of this text as a contractual provision would achieve the purpose it is seeking to achieve. It does not, IMO, meet the required standards for the principle of transparency, clearly explaining to the RNH/data subject that the extent to which the data in question is accurate will determine what processing activities will be allowed, and that personal data might be disclosed to 3rd-parties. Getting a RNH to sign this will not relieve the applicable Registrar from its accuracy obligations under GDPR. Thanks again. Amr
On Nov 4, 2018, at 2:00 PM, Amr Elsadr <aelsadr@icannpolicy.ninja> wrote:
Hi,
I also agree with Farzi on this, particularly on the issue of accuracy. Mentions of accuracy of data for data subjects in GDPR, to me, appear to all be directed towards ensuring the data subject’s right to rectifying personal data (Article 16), associated with data subjects' right to restriction of processing (Article 18). Accuracy obligations in GDPR are, to the extent possible, placed on the Controller, not the data subject.
From what I can tell, the ICO analysis runs along those same lines, and does not (again, to me) seem to be worded in a way that is meant to place an accuracy of data burden on data subjects in order to facilitate the pursuit of 3rd-party interests.
Thanks.
Amr
On Nov 4, 2018, at 1:35 PM, Ayden Férdeline <icann@ferdeline.com> wrote:
I agree with Farzaneh; all domain name registrants should be shown a baseline of respect, regardless of whether or not they live in a jurisdiction with strong and enforced privacy protections. This is as much an ethical consideration as it is a legal one.
While in some other sectors there are fuzzy questions around what information is private and sensitive, and what is innocuous and does not need to be protected, in our situation the case is very simple. There is demonstrable harm that can result from the disclosure of registration data. And look on Twitter at the messages that registrars receive from consumers upset that their registration data has been made public (or “sold” is the perception many consumers have). It is a black-and-white breach of consumer expectations. No one is registering a domain name with the implicit understanding that their contact information will be obtained by a third party. I note this appreciating that some third parties, like law enforcement, will have a need to access registration data, but relying on consumers to themselves take steps to protect their personal information is not going to fly. You can’t ask someone to check a box noting whether or not they are a legal or natural person, because most registrants won’t know the answer or why the distinction matters.
What if a natural person becomes confused and indicates they are a legal person? I don’t believe the BC and IPC's proposed language that, “Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws,” would shield the contracted party in any meaningful way. Under European Union law at least, standard contract terms must be fair. A registrant cannot sign away a right. A contract is not allowed to create an imbalance between your rights and obligations as a consumer and the rights and obligations of sellers and suppliers.
What differentiates the GDPR from its weaker, 1995 predecessor is that it tries to correct the power imbalance that exists between a data controller and a data subject. There were natural information asymmetries that had not self-corrected. The right to know what information has been collected about you in the GDPR, and the right to ask that it be corrected or deleted (also in the GDPR) all support the thesis that there is a power imbalance at play here. The onus in the GDPR is on those with more power - whoever is collecting and processing personal information - to behave in a reasonable way towards consumers and to put the interests of the individual above their own.
I know that I have only referenced the GDPR above but that I am asking that GDPR-equivalent protections be applied much more broadly to all registrants. I say this for three reasons. Primarily, because I think it is not unthinkable that increased data protection regulations will be coming to other markets in the near future, including the United States. However there is also the question of cost and whether it is fair to impose upon the contracted parties (and, ultimately, domain name registrants) the cost of achieving compliance with the GDPR by building a separate, parallel process/system for the EU market and a separate, parallel process/system for other markets, or whether it is more economical to simply convert all of one's business processes to conform to the more stringent regulation. And finally, ethics: just because someone lives in a jurisdiction that does not guarantee a right today does not mean there is not an ethical duty of care to deliver it.
Kind regards,
Ayden Férdeline
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Sunday, 4 November 2018 07:37, farzaneh badii <farzaneh.badii@gmail.com> wrote:
Dear Diane,
How can registrars determine the applicable law even if the geographical information is accurate? I don't think registrars can actually determine which law outside of their own jurisdiction applies to their registrants even if they know the geographical location. For example, as far as I know EU citizens anywhere in the world are protected by GDPR. So their geographical location does not determine what law applies. Registrars have to abide by their local laws, the court of law determines the applicable law and some registries have the choice of law clauses in their agreements with registrars which cannot be in conflict with the local laws of the registrars. All in all determining the "jurisdiction" of data subject is not dependent only on the geographical location of the registrant in this case.
Also I think every domain name registrant regardless of where they are located deserve minimum data protection. They are consumers by the way!
I am getting increasingly puzzled by IPC/BC interpretation of "accuracy" of personal information of data subjects under GDPR. In my opinion the concept of accuracy in GDPR is actually supposed to protect data subjects and not to be used against them. Accurate information is not about keeping the data accurate so that it can be displayed and accessed and mined by many around the world! The accuracy of data is a right given to data subjects so that inaccurate data cannot be used against them in court and other forums, or be denied a service or end in violating their rights. I believe they have the right for their information to be accurate and not the responsibility (under GDPR) to maintain it accurately. The registrars under GDPR have to maintain the data of domain name registrants "uptodate" to reduce privacy risks. They don't have to keep the database accurate so that they can distinguish between legal and natural persons. I believe by ICO you mean Information Commissioners Office. Specifically this page: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-re...
The natural v legal distinction is not only burdensome for the CPs or opens them to liability. It is dangerous for noncommercial/not for porfit/ advocacy organizations that have registered domain names and are vulnerable to attacks of all sorts.
I assume IPC/BC wants this distinction so that the org personal sensitive data won't be redacted. I would like to know why. I would like to know why while some groups are fiercely working to have access to personal and sensitive data of domain name registrants for their legitimate interest, also work towards exposing domain name registrants sensitive data to the world.
Farzaneh
On Fri, Nov 2, 2018 at 10:13 PM Alan Greenberg <alan.greenberg@mcgill.ca> wrote:
This all sounds right to me. Alan
At 02/11/2018 09:28 PM, Plaut, Diane wrote:
[]Dear EPDP Team-
In our efforts to overcome a significant hurdle through our EPDP work – that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws. The Accuracy of information provided by data subjectsArticle 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that: Personal data shall be…accurate and, where necessary, keept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’).According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data provided by the data subject, provided by a third party or created by the controller – the same obligation applies in each such caase. As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states that: “In some cases it is reasonable to rely on the individual to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details, but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this.†However, if the controller learns that information is no longer accurate/up to date (either from the data subject or from other information which comes to light), the controller should update its records accordingly. The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must: · accurately record the information provided; · accurately record the source of the information; · take “reasonable steps†in the circumstances to ensure the accuracy of the information; and · carefully consider any challenges to the accuracy of the information. Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes.
Moreover, in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties. Sincerely,
Diane
Diane PlautGeneral Counsel and Privacy Officer [cid:image001.png@01D3CA70.18FC1D40]
Direct +1 646-899-2806 
diane.plaut@corsearch.com
220 West 42nd Street, 11th Floor, New York, NY 10036, United States
[www.corsearch.com](http://www.corsearch.com/)
Join Corsearch on [Twitter](https://twitter.com/corsearch) [Linkedin](https://www.linkedin.com/company/2593860/) [Trademarks + Brands](http://trademarksandbrands.corsearch.com/)
Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241)
Corsearch.USCustomerService@corsearch.com
Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession.
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org
Hi Farzi, Just a quick clarification GDPR does not apply to EU citizens not residing in the EU. The GDPR is not concerned with the citizenship it is concerned with where the person is located. If you leave an EU country and travel to a non EU country you are no longer protected by the GDPR. The data rights of the EU citizens located outside of the EU is protected by the laws of the territory that they are at. The data rights of the registrants is determined by their location (not their citizenship) in addition to the location of the controller and processor. And with regard to protecting registrants we should also not forget the necessity of protecting the registrants against domains hijacking and thefts which could be devastating to the domain name holder not only financially but in terms of accessibility to the site in case it is a not for profit web page or domain and the rights of the registrants to be able to pursue their rights in this regard. Finally and on another note which legal entities or businesses would like to be kept hidden?? Best Hadia From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of farzaneh badii Sent: Sunday, November 04, 2018 9:38 AM To: Alan Greenberg Cc: gnso-epdp-team-bounces@icann.org; alex@the-online.net; GNSO EPDP Subject: Re: [Gnso-epdp-team] Further Input from the IPC/BC on Small Team #1 and #2 issues Dear Diane, How can registrars determine the applicable law even if the geographical information is accurate? I don't think registrars can actually determine which law outside of their own jurisdiction applies to their registrants even if they know the geographical location. For example, as far as I know EU citizens anywhere in the world are protected by GDPR. So their geographical location does not determine what law applies. Registrars have to abide by their local laws, the court of law determines the applicable law and some registries have the choice of law clauses in their agreements with registrars which cannot be in conflict with the local laws of the registrars. All in all determining the "jurisdiction" of data subject is not dependent only on the geographical location of the registrant in this case. Also I think every domain name registrant regardless of where they are located deserve minimum data protection. They are consumers by the way! I am getting increasingly puzzled by IPC/BC interpretation of "accuracy" of personal information of data subjects under GDPR. In my opinion the concept of accuracy in GDPR is actually supposed to protect data subjects and not to be used against them. Accurate information is not about keeping the data accurate so that it can be displayed and accessed and mined by many around the world! The accuracy of data is a right given to data subjects so that inaccurate data cannot be used against them in court and other forums, or be denied a service or end in violating their rights. I believe they have the right for their information to be accurate and not the responsibility (under GDPR) to maintain it accurately. The registrars under GDPR have to maintain the data of domain name registrants "uptodate" to reduce privacy risks. They don't have to keep the database accurate so that they can distinguish between legal and natural persons. I believe by ICO you mean Information Commissioners Office. Specifically this page: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-re... The natural v legal distinction is not only burdensome for the CPs or opens them to liability. It is dangerous for noncommercial/not for porfit/ advocacy organizations that have registered domain names and are vulnerable to attacks of all sorts. I assume IPC/BC wants this distinction so that the org personal sensitive data won't be redacted. I would like to know why. I would like to know why while some groups are fiercely working to have access to personal and sensitive data of domain name registrants for their legitimate interest, also work towards exposing domain name registrants sensitive data to the world. Farzaneh On Fri, Nov 2, 2018 at 10:13 PM Alan Greenberg <alan.greenberg@mcgill.ca<mailto:alan.greenberg@mcgill.ca>> wrote: This all sounds right to me. Alan At 02/11/2018 09:28 PM, Plaut, Diane wrote: Dear EPDP Team- In our efforts to overcome a significant hurdle through our EPDP work – that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws. The Accuracy of information provided by data subjects Article 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that: Personal data shall be…accurate and, where necessary, keept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’). According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data provided by the data subject, provided by a third party or created by the controller – the same obligation applies in each such caase. As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states that: “In some cases it is reasonable to rely on the individual to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details, but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this.†However, if the controller learns that information is no longer accurate/up to date (either from the data subject or from other information which comes to light), the controller should update its records accordingly. The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must: · accurately record the information provided; · accurately record the source of the information; · take “reasonable steps†in the circumstances to ensure the accuracy of the information; and · carefully consider any challenges to the accuracy of the information. Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes. Moreover, in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties. Sincerely, Diane Diane Plaut General Counsel and Privacy Officer Error! Filename not specified. Direct +1 646-899-2806 
 diane.plaut@corsearch.com<mailto:diane.plaut@corsearch.com> 220 West 42nd Street, 11th Floor, New York, NY 10036, United States
www.corsearch.com<http://www.corsearch.com/> Join Corsearch on Twitter<https://twitter.com/corsearch> Linkedin<https://www.linkedin.com/company/2593860/> Trademarks + Brands<http://trademarksandbrands.corsearch.com/> Customer Service/Platform Support: 1 800 SEARCH1â„¢ (1 800 732 7241)
 Corsearch.USCustomerService@corsearch.com<mailto:Corsearch.USCustomerService@corsearch.com> Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Dear All There are avalanche of contradicting messages Everyone pushes for its own views Pls ce the validity of all statement Haida Pls clarify what you said about GDPR against a clause of articles to validate what you stated . Others are talking of accuracy They are requested to explore what accuracy they are looking by giving examples Fritz is kindly requested to reconcile all these contradictory statements Regards Kavouss Sent from my iPhone
On 4 Nov 2018, at 15:02, Hadia Abdelsalam Mokhtar EL miniawi <Hadia@tra.gov.eg> wrote:
Hi Farzi,
Just a quick clarification GDPR does not apply to EU citizens not residing in the EU. The GDPR is not concerned with the citizenship it is concerned with where the person is located. If you leave an EU country and travel to a non EU country you are no longer protected by the GDPR. The data rights of the EU citizens located outside of the EU is protected by the laws of the territory that they are at. The data rights of the registrants is determined by their location (not their citizenship) in addition to the location of the controller and processor. And with regard to protecting registrants we should also not forget the necessity of protecting the registrants against domains hijacking and thefts which could be devastating to the domain name holder not only financially but in terms of accessibility to the site in case it is a not for profit web page or domain and the rights of the registrants to be able to pursue their rights in this regard. Finally and on another note which legal entities or businesses would like to be kept hidden??
Best Hadia
From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of farzaneh badii Sent: Sunday, November 04, 2018 9:38 AM To: Alan Greenberg Cc: gnso-epdp-team-bounces@icann.org; alex@the-online.net; GNSO EPDP Subject: Re: [Gnso-epdp-team] Further Input from the IPC/BC on Small Team #1 and #2 issues
Dear Diane,
How can registrars determine the applicable law even if the geographical information is accurate? I don't think registrars can actually determine which law outside of their own jurisdiction applies to their registrants even if they know the geographical location. For example, as far as I know EU citizens anywhere in the world are protected by GDPR. So their geographical location does not determine what law applies. Registrars have to abide by their local laws, the court of law determines the applicable law and some registries have the choice of law clauses in their agreements with registrars which cannot be in conflict with the local laws of the registrars. All in all determining the "jurisdiction" of data subject is not dependent only on the geographical location of the registrant in this case.
Also I think every domain name registrant regardless of where they are located deserve minimum data protection. They are consumers by the way!
I am getting increasingly puzzled by IPC/BC interpretation of "accuracy" of personal information of data subjects under GDPR. In my opinion the concept of accuracy in GDPR is actually supposed to protect data subjects and not to be used against them. Accurate information is not about keeping the data accurate so that it can be displayed and accessed and mined by many around the world! The accuracy of data is a right given to data subjects so that inaccurate data cannot be used against them in court and other forums, or be denied a service or end in violating their rights. I believe they have the right for their information to be accurate and not the responsibility (under GDPR) to maintain it accurately. The registrars under GDPR have to maintain the data of domain name registrants "uptodate" to reduce privacy risks. They don't have to keep the database accurate so that they can distinguish between legal and natural persons. I believe by ICO you mean Information Commissioners Office. Specifically this page: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-re...
The natural v legal distinction is not only burdensome for the CPs or opens them to liability. It is dangerous for noncommercial/not for porfit/ advocacy organizations that have registered domain names and are vulnerable to attacks of all sorts.
I assume IPC/BC wants this distinction so that the org personal sensitive data won't be redacted. I would like to know why. I would like to know why while some groups are fiercely working to have access to personal and sensitive data of domain name registrants for their legitimate interest, also work towards exposing domain name registrants sensitive data to the world.
Farzaneh
On Fri, Nov 2, 2018 at 10:13 PM Alan Greenberg <alan.greenberg@mcgill.ca> wrote: This all sounds right to me. Alan
At 02/11/2018 09:28 PM, Plaut, Diane wrote:
Dear EPDP Team-
In our efforts to overcome a significant hurdle through our EPDP work – that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws. The Accuracy of information provided by data subjects Article 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that: Personal data shall be…accurate and, where necessary, keept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’). According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data provided by the data subject, provided by a third party or created by the controller – the same obligation applies in each such caase. As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states that: “In some cases it is reasonable to rely on the individual to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details, but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this.†However, if the controller learns that information is no longer accurate/up to date (either from the data subject or from other information which comes to light), the controller should update its records accordingly. The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must: · accurately record the information provided; · accurately record the source of the information; · take “reasonable steps†in the circumstances to ensure the accuracy of the information; and · carefully consider any challenges to the accuracy of the information. Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes.
Moreover, in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties.
Sincerely,
Diane
Diane Plaut General Counsel and Privacy Officer Error! Filename not specified. Direct +1 646-899-2806 
 diane.plaut@corsearch.com 220 West 42nd Street, 11th Floor, New York, NY 10036, United States
www.corsearch.com Join Corsearch on Twitter Linkedin Trademarks + Brands Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241)
 Corsearch.USCustomerService@corsearch.com
Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession.
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
The question was whether accurate Geo location can help CPs identify applicable laws. Yes GDPR applies to data subjects who are "in" the EU. And a lot of sources on Google say that EU citizens are not protected by GDPR when outside of the EU and it applies to those who are "in" the EU when data being processed. So non resident EU citizens (A French national living in China) is not a GDPR data subject. There are still arguments over that as well. The only thing that might be clear is that those physically in the EU at the time of registration (regardless of their nationality) are data subject just to make sure gdpr coverage goes beyond citizenship. But it is not clear what would happen to EU citizens on vacation or long stays in other countries. Does being "in" the EU refer to the "location" of data subject at the time of registration or does it for EU citizens refer to the main place of residence? A French citizen who registers a domain name on vacation in the Caribbean is not physically present in the EU at the time of registration. Is that person not subject to GDPR because they were not in the EU ? Or if they register a domain in Port of Spain indicating their location as Paris then what would happen ?Is there a EDPB avice on this? All in all, yes GDPR applies to those who are "in" the EU regardless of their nationality. But in the case of domain name registration, geographical location does not clarify the applicable law in my opinion. Many other factors have to be taken into account. What is being in the EU? does that mean where they have their main residency? where they pay taxes? where their cruise is taking them? If we don't have clarity on this we cannot simply say if they make their geographical location clear we have established the applicable law correctly. Hadia I am glad you are asking which organizations would want to hide their physical address from the public. I hope this can provide some explanation as to why I get irritated when we are lumping all organizations together and ask for their sensitive data to be exposed to the public: Organizations that are critical of their governments and even if established abroad can be under threat Organizations that work for minority rights and women rights Organizations that are trying to hold various actors accountable Organizations that analyze and criticize religious extremists Human rights law firms/HR lawyers in certain parts of this world are in prison ... I can continue some say we are not here to protect and advance human rights. We are not here to violate HR and put people in danger either. We are not here to protect all consumers globally from whatever fraud regardless of whether it relates to DNS. We are not here to facilitate all kinds of law enforcement action that do not relate to security stability resiliency of DNS, we are not here to protect trademark and IP at any cost and at a global scale and beyond ICANN mission. Does distinguishing between legal and natural person help with advancing ICANN purpose and mission or third party interest? Please tell me how. I wish someone could answer my question. For the past three months, this group was dominated by access to WHOIS sensitive personal data discussion. We compromised. Access is now an ICANN purpose. Is it not enough? Is it not enough to pursue your purpose? Why is there a need for distinguishing between legal vs natural persons? If you have legitimate interest you can access anyway. Please let me know why it's not enough to give access to legitimate interest parties and redact orgs sensitive data too. On Sun, Nov 4, 2018 at 10:08 AM Arasteh <kavouss.arasteh@gmail.com> wrote:
Dear All There are avalanche of contradicting messages Everyone pushes for its own views Pls ce the validity of all statement Haida Pls clarify what you said about GDPR against a clause of articles to validate what you stated . Others are talking of accuracy They are requested to explore what accuracy they are looking by giving examples Fritz is kindly requested to reconcile all these contradictory statements Regards Kavouss
Sent from my iPhone
On 4 Nov 2018, at 15:02, Hadia Abdelsalam Mokhtar EL miniawi < Hadia@tra.gov.eg> wrote:
Hi Farzi,
Just a quick clarification GDPR does not apply to EU citizens not residing in the EU. The GDPR is not concerned with the citizenship it is concerned with where the person is located. If you leave an EU country and travel to a non EU country you are no longer protected by the GDPR. The data rights of the EU citizens located outside of the EU is protected by the laws of the territory that they are at. The data rights of the registrants is determined by their location (not their citizenship) in addition to the location of the controller and processor. And with regard to protecting registrants we should also not forget the necessity of protecting the registrants against domains hijacking and thefts which could be devastating to the domain name holder not only financially but in terms of accessibility to the site in case it is a not for profit web page or domain and the rights of the registrants to be able to pursue their rights in this regard.
Finally and on another note which legal entities or businesses would like to be kept hidden??
Best
Hadia
*From:* Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org <gnso-epdp-team-bounces@icann.org>] *On Behalf Of *farzaneh badii *Sent:* Sunday, November 04, 2018 9:38 AM *To:* Alan Greenberg *Cc:* gnso-epdp-team-bounces@icann.org; alex@the-online.net; GNSO EPDP *Subject:* Re: [Gnso-epdp-team] Further Input from the IPC/BC on Small Team #1 and #2 issues
Dear Diane,
How can registrars determine the applicable law even if the geographical information is accurate? I don't think registrars can actually determine which law outside of their own jurisdiction applies to their registrants even if they know the geographical location. For example, as far as I know EU citizens anywhere in the world are protected by GDPR. So their geographical location does not determine what law applies. Registrars have to abide by their local laws, the court of law determines the applicable law and some registries have the choice of law clauses in their agreements with registrars which cannot be in conflict with the local laws of the registrars. All in all determining the "jurisdiction" of data subject is not dependent only on the geographical location of the registrant in this case.
Also I think every domain name registrant regardless of where they are located deserve minimum data protection. They are consumers by the way!
I am getting increasingly puzzled by IPC/BC interpretation of "accuracy" of personal information of data subjects under GDPR. In my opinion the concept of accuracy in GDPR is actually supposed to protect data subjects and not to be used against them. Accurate information is not about keeping the data accurate so that it can be displayed and accessed and mined by many around the world! The accuracy of data is a right given to data subjects so that inaccurate data cannot be used against them in court and other forums, or be denied a service or end in violating their rights. I believe they have the right for their information to be accurate and not the responsibility (under GDPR) to maintain it accurately. The registrars under GDPR have to maintain the data of domain name registrants "uptodate" to reduce privacy risks. They don't have to keep the database accurate so that they can distinguish between legal and natural persons.
I believe by ICO you mean Information Commissioners Office. Specifically this page: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-re...
The natural v legal distinction is not only burdensome for the CPs or opens them to liability. It is dangerous for noncommercial/not for porfit/ advocacy organizations that have registered domain names and are vulnerable to attacks of all sorts.
I assume IPC/BC wants this distinction so that the org personal sensitive data won't be redacted. I would like to know why. I would like to know why while some groups are fiercely working to have access to personal and sensitive data of domain name registrants for their legitimate interest, also work towards exposing domain name registrants sensitive data to the world.
Farzaneh
On Fri, Nov 2, 2018 at 10:13 PM Alan Greenberg <alan.greenberg@mcgill.ca> wrote:
This all sounds right to me. Alan
At 02/11/2018 09:28 PM, Plaut, Diane wrote:
Dear EPDP Team-
In our efforts to overcome a significant hurdle through our EPDP work – that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws.
*The Accuracy of information provided by data subjects *Article 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that:
*Personal data shall be…accurate and, where necessary, keept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’). *According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data provided by the data subject, provided by a third party or created by the controller – the same obligation applies in each such caase. *As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states* that: “In some cases it is reasonable to rely on the individual to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details, *but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this*.†However, if the controller learns that information is no longer accurate/up to date (either from the data subject or from other information which comes to light), the controller should update its records accordingly.
*The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must: · accurately record the information provided; · accurately record the source of the information; · take “reasonable steps†in the circumstances to ensure the accuracy of the information; and · carefully consider any challenges to the accuracy of the information.*
*Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes. Moreover, in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties. * Sincerely,
Diane
*Diane Plaut *General Counsel and Privacy Officer *Error! Filename not specified.* Direct +1 646-899-2806 
 diane.plaut@corsearch.com 220 West 42 <https://maps.google.com/?q=220+West+42&entry=gmail&source=g> nd Street, 11th Floor, New York, NY 10036, United States
 www.corsearch.com Join Corsearch on Twitter <https://twitter.com/corsearch> Linkedin <https://www.linkedin.com/company/2593860/> Trademarks + Brands <http://trademarksandbrands.corsearch.com/> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241)
 Corsearch.USCustomerService@corsearch.com
*Confidentiality Notice:* This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession.
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Just wish to jump in on Hadia’s point alone (I have many thoughts on the submissions but let’s see how the leadership team present the divergence, and we can respond accordingly) But that being said, I am moved to this email, to clarify a point of law, as Hadia, you are somewhat mistaken and clarification is needed to avoid further confusion. To your point Hadia, you are only looking at half the picture. If mere residency of the data subject were the sole determinative factor, then yes I could accept the validity of that argument; however, the GDPR applies to all European data not just the data of European resident persons. E.g. If I am an EU citizen, residing in Mongolia, but I use a European registrar, then the GDPR will apply to my registration data; If I am a US citizen residing in Europe and chose an American registrar , the GDPR applies; If I am a US citizen, residing in Mongolia, and I use a South African registrar, but via a EU reseller, then the GDPR applies... and so on... We must be clear that this task of properly identifying the GDPR’s applicability is not as simple or straightforward a task as it is being lauded by some. Kind regards, Alan On Sun 4 Nov 2018 at 17:45, farzaneh badii <farzaneh.badii@gmail.com> wrote:
The question was whether accurate Geo location can help CPs identify applicable laws.
Yes GDPR applies to data subjects who are "in" the EU. And a lot of sources on Google say that EU citizens are not protected by GDPR when outside of the EU and it applies to those who are "in" the EU when data being processed. So non resident EU citizens (A French national living in China) is not a GDPR data subject. There are still arguments over that as well. The only thing that might be clear is that those physically in the EU at the time of registration (regardless of their nationality) are data subject just to make sure gdpr coverage goes beyond citizenship. But it is not clear what would happen to EU citizens on vacation or long stays in other countries.
Does being "in" the EU refer to the "location" of data subject at the time of registration or does it for EU citizens refer to the main place of residence? A French citizen who registers a domain name on vacation in the Caribbean is not physically present in the EU at the time of registration. Is that person not subject to GDPR because they were not in the EU ? Or if they register a domain in Port of Spain indicating their location as Paris then what would happen ?Is there a EDPB avice on this?
All in all, yes GDPR applies to those who are "in" the EU regardless of their nationality. But in the case of domain name registration, geographical location does not clarify the applicable law in my opinion. Many other factors have to be taken into account. What is being in the EU? does that mean where they have their main residency? where they pay taxes? where their cruise is taking them? If we don't have clarity on this we cannot simply say if they make their geographical location clear we have established the applicable law correctly.
Hadia I am glad you are asking which organizations would want to hide their physical address from the public. I hope this can provide some explanation as to why I get irritated when we are lumping all organizations together and ask for their sensitive data to be exposed to the public:
Organizations that are critical of their governments and even if established abroad can be under threat Organizations that work for minority rights and women rights Organizations that are trying to hold various actors accountable Organizations that analyze and criticize religious extremists Human rights law firms/HR lawyers in certain parts of this world are in prison ... I can continue
some say we are not here to protect and advance human rights. We are not here to violate HR and put people in danger either. We are not here to protect all consumers globally from whatever fraud regardless of whether it relates to DNS. We are not here to facilitate all kinds of law enforcement action that do not relate to security stability resiliency of DNS, we are not here to protect trademark and IP at any cost and at a global scale and beyond ICANN mission.
Does distinguishing between legal and natural person help with advancing ICANN purpose and mission or third party interest? Please tell me how.
I wish someone could answer my question. For the past three months, this group was dominated by access to WHOIS sensitive personal data discussion. We compromised. Access is now an ICANN purpose. Is it not enough? Is it not enough to pursue your purpose? Why is there a need for distinguishing between legal vs natural persons? If you have legitimate interest you can access anyway. Please let me know why it's not enough to give access to legitimate interest parties and redact orgs sensitive data too.
On Sun, Nov 4, 2018 at 10:08 AM Arasteh <kavouss.arasteh@gmail.com> wrote:
Dear All There are avalanche of contradicting messages Everyone pushes for its own views Pls ce the validity of all statement Haida Pls clarify what you said about GDPR against a clause of articles to validate what you stated . Others are talking of accuracy They are requested to explore what accuracy they are looking by giving examples Fritz is kindly requested to reconcile all these contradictory statements Regards Kavouss
Sent from my iPhone
On 4 Nov 2018, at 15:02, Hadia Abdelsalam Mokhtar EL miniawi < Hadia@tra.gov.eg> wrote:
Hi Farzi,
Just a quick clarification GDPR does not apply to EU citizens not residing in the EU. The GDPR is not concerned with the citizenship it is concerned with where the person is located. If you leave an EU country and travel to a non EU country you are no longer protected by the GDPR. The data rights of the EU citizens located outside of the EU is protected by the laws of the territory that they are at. The data rights of the registrants is determined by their location (not their citizenship) in addition to the location of the controller and processor. And with regard to protecting registrants we should also not forget the necessity of protecting the registrants against domains hijacking and thefts which could be devastating to the domain name holder not only financially but in terms of accessibility to the site in case it is a not for profit web page or domain and the rights of the registrants to be able to pursue their rights in this regard.
Finally and on another note which legal entities or businesses would like to be kept hidden??
Best
Hadia
*From:* Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org <gnso-epdp-team-bounces@icann.org>] *On Behalf Of *farzaneh badii *Sent:* Sunday, November 04, 2018 9:38 AM *To:* Alan Greenberg *Cc:* gnso-epdp-team-bounces@icann.org; alex@the-online.net; GNSO EPDP *Subject:* Re: [Gnso-epdp-team] Further Input from the IPC/BC on Small Team #1 and #2 issues
Dear Diane,
How can registrars determine the applicable law even if the geographical information is accurate? I don't think registrars can actually determine which law outside of their own jurisdiction applies to their registrants even if they know the geographical location. For example, as far as I know EU citizens anywhere in the world are protected by GDPR. So their geographical location does not determine what law applies. Registrars have to abide by their local laws, the court of law determines the applicable law and some registries have the choice of law clauses in their agreements with registrars which cannot be in conflict with the local laws of the registrars. All in all determining the "jurisdiction" of data subject is not dependent only on the geographical location of the registrant in this case.
Also I think every domain name registrant regardless of where they are located deserve minimum data protection. They are consumers by the way!
I am getting increasingly puzzled by IPC/BC interpretation of "accuracy" of personal information of data subjects under GDPR. In my opinion the concept of accuracy in GDPR is actually supposed to protect data subjects and not to be used against them. Accurate information is not about keeping the data accurate so that it can be displayed and accessed and mined by many around the world! The accuracy of data is a right given to data subjects so that inaccurate data cannot be used against them in court and other forums, or be denied a service or end in violating their rights. I believe they have the right for their information to be accurate and not the responsibility (under GDPR) to maintain it accurately. The registrars under GDPR have to maintain the data of domain name registrants "uptodate" to reduce privacy risks. They don't have to keep the database accurate so that they can distinguish between legal and natural persons.
I believe by ICO you mean Information Commissioners Office. Specifically this page: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-re...
The natural v legal distinction is not only burdensome for the CPs or opens them to liability. It is dangerous for noncommercial/not for porfit/ advocacy organizations that have registered domain names and are vulnerable to attacks of all sorts.
I assume IPC/BC wants this distinction so that the org personal sensitive data won't be redacted. I would like to know why. I would like to know why while some groups are fiercely working to have access to personal and sensitive data of domain name registrants for their legitimate interest, also work towards exposing domain name registrants sensitive data to the world.
Farzaneh
On Fri, Nov 2, 2018 at 10:13 PM Alan Greenberg <alan.greenberg@mcgill.ca> wrote:
This all sounds right to me. Alan
At 02/11/2018 09:28 PM, Plaut, Diane wrote:
Dear EPDP Team-
In our efforts to overcome a significant hurdle through our EPDP work – that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws.
*The Accuracy of information provided by data subjects *Article 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that:
*Personal data shall be…accurate and, where necessary, keept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’). *According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data provided by the data subject, provided by a third party or created by the controller – the same obligation applies in each such caase. *As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states* that: “In some cases it is reasonable to rely on the individual to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details, *but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this*.†However, if the controller learns that information is no longer accurate/up to date (either from the data subject or from other information which comes to light), the controller should update its records accordingly.
*The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must: · accurately record the information provided; · accurately record the source of the information; · take “reasonable steps†in the circumstances to ensure the accuracy of the information; and · carefully consider any challenges to the accuracy of the information.*
*Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes. Moreover, in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties. * Sincerely,
Diane
*Diane Plaut *General Counsel and Privacy Officer *Error! Filename not specified.* Direct +1 646-899-2806 
 diane.plaut@corsearch.com 220 West 42 <https://maps.google.com/?q=220+West+42&entry=gmail&source=g> nd Street, 11th Floor, New York, NY 10036, United States
 www.corsearch.com Join Corsearch on Twitter <https://twitter.com/corsearch> Linkedin <https://www.linkedin.com/company/2593860/> Trademarks + Brands <http://trademarksandbrands.corsearch.com/> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241)
 Corsearch.USCustomerService@corsearch.com
*Confidentiality Notice:* This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession.
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
-- [image: Donuts Inc.] <http://donuts.domains> Alan Woods Senior Compliance & Policy Manager, Donuts Inc. ------------------------------ The Victorians, 15-18 Earlsfort Terrace Dublin 2, County Dublin Ireland <https://www.facebook.com/donutstlds> <https://twitter.com/DonutsInc> <https://www.linkedin.com/company/donuts-inc> Please NOTE: This electronic message, including any attachments, may include privileged, confidential and/or inside information owned by Donuts Inc. . Any distribution or use of this communication by anyone other than the intended recipient(s) is strictly prohibited and may be unlawful. If you are not the intended recipient, please notify the sender by replying to this message and then delete it from your system. Thank you.
Hi All so to Kavous point I did not say something new. Article 3 of the GDPR, which is about the territorial scope, says that the GDPR applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless whether the processing takes place in the union or not. This means if the processor or the controller (could be a registry, registrar or re-seller) is established in the EU any data it processes no matter where it is or to whom it belongs must be processed in compliance with the GDPR. Article 3 also says that the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union must also be processed in a manner, which is GDPR compliant. Which means that the processing of the personal data of anyone residing in the EU should be done in a manner that is GDPR compliant. Please note that there is no reference to the citizenship. The GDPR does not refer to citizens or residents it refers to data subjects. Accordingly if an EU citizen is outside of the EU and his data is being processed by a processor or controller not established in the EU, then he is not the GDPR data subject and his data is not protected by the GDPR. To Alan's point I never said that "mere residency of the data subject were the sole determinative factor" I said in the email below " The data rights of the registrants is determined by their location (not their citizenship) in addition to the location of the controller and processor" In an effort to be clear GDPR will apply if the personal data processed belongs to 1. A Person located in the EU (not necessarily citizen or resident) and his data is processed by a controller or processor established in the EU 2. A Person located in the EU (not necessarily citizen or resident) and his data is processed by a controller or processor not established in the EU 3. A person located outside of the EU (Not necessarily an EU citizen or resident) and his data is being processed by a controller or processor established in the EU The GDPR will not apply to personal data of 1. An EU citizen or resident residing outside of the EU and whose data is being processed by a controller or processor established outside of the EU. In this case he is not the data subject of the GDPR and his data rights are protected by the laws of the territory where he resides 2. A non EU resident or citizen residing outside of the EU and whose data is being processed by a controller or processor established outside of the EU. In this case he is not the data subject of the GDPR and his data rights are protected by the data protection laws of the territory where he resides The above are all the combinations that I could think of. Regards Hadia ________________________________ From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of Alan Woods <alan@donuts.email> Sent: 04 November 2018 20:44 To: farzaneh badii Cc: gnso-epdp-team-bounces@icann.org; Alex Deacon; GNSO EPDP Subject: Re: [Gnso-epdp-team] Further Input from the IPC/BC on Small Team #1 and #2 issues Just wish to jump in on Hadia’s point alone (I have many thoughts on the submissions but let’s see how the leadership team present the divergence, and we can respond accordingly) But that being said, I am moved to this email, to clarify a point of law, as Hadia, you are somewhat mistaken and clarification is needed to avoid further confusion. To your point Hadia, you are only looking at half the picture. If mere residency of the data subject were the sole determinative factor, then yes I could accept the validity of that argument; however, the GDPR applies to all European data not just the data of European resident persons. E.g. If I am an EU citizen, residing in Mongolia, but I use a European registrar, then the GDPR will apply to my registration data; If I am a US citizen residing in Europe and chose an American registrar , the GDPR applies; If I am a US citizen, residing in Mongolia, and I use a South African registrar, but via a EU reseller, then the GDPR applies... and so on... We must be clear that this task of properly identifying the GDPR’s applicability is not as simple or straightforward a task as it is being lauded by some. Kind regards, Alan On Sun 4 Nov 2018 at 17:45, farzaneh badii <farzaneh.badii@gmail.com<mailto:farzaneh.badii@gmail.com>> wrote: The question was whether accurate Geo location can help CPs identify applicable laws. Yes GDPR applies to data subjects who are "in" the EU. And a lot of sources on Google say that EU citizens are not protected by GDPR when outside of the EU and it applies to those who are "in" the EU when data being processed. So non resident EU citizens (A French national living in China) is not a GDPR data subject. There are still arguments over that as well. The only thing that might be clear is that those physically in the EU at the time of registration (regardless of their nationality) are data subject just to make sure gdpr coverage goes beyond citizenship. But it is not clear what would happen to EU citizens on vacation or long stays in other countries. Does being "in" the EU refer to the "location" of data subject at the time of registration or does it for EU citizens refer to the main place of residence? A French citizen who registers a domain name on vacation in the Caribbean is not physically present in the EU at the time of registration. Is that person not subject to GDPR because they were not in the EU ? Or if they register a domain in Port of Spain indicating their location as Paris then what would happen ?Is there a EDPB avice on this? All in all, yes GDPR applies to those who are "in" the EU regardless of their nationality. But in the case of domain name registration, geographical location does not clarify the applicable law in my opinion. Many other factors have to be taken into account. What is being in the EU? does that mean where they have their main residency? where they pay taxes? where their cruise is taking them? If we don't have clarity on this we cannot simply say if they make their geographical location clear we have established the applicable law correctly. Hadia I am glad you are asking which organizations would want to hide their physical address from the public. I hope this can provide some explanation as to why I get irritated when we are lumping all organizations together and ask for their sensitive data to be exposed to the public: Organizations that are critical of their governments and even if established abroad can be under threat Organizations that work for minority rights and women rights Organizations that are trying to hold various actors accountable Organizations that analyze and criticize religious extremists Human rights law firms/HR lawyers in certain parts of this world are in prison ... I can continue some say we are not here to protect and advance human rights. We are not here to violate HR and put people in danger either. We are not here to protect all consumers globally from whatever fraud regardless of whether it relates to DNS. We are not here to facilitate all kinds of law enforcement action that do not relate to security stability resiliency of DNS, we are not here to protect trademark and IP at any cost and at a global scale and beyond ICANN mission. Does distinguishing between legal and natural person help with advancing ICANN purpose and mission or third party interest? Please tell me how. I wish someone could answer my question. For the past three months, this group was dominated by access to WHOIS sensitive personal data discussion. We compromised. Access is now an ICANN purpose. Is it not enough? Is it not enough to pursue your purpose? Why is there a need for distinguishing between legal vs natural persons? If you have legitimate interest you can access anyway. Please let me know why it's not enough to give access to legitimate interest parties and redact orgs sensitive data too. On Sun, Nov 4, 2018 at 10:08 AM Arasteh <kavouss.arasteh@gmail.com<mailto:kavouss.arasteh@gmail.com>> wrote: Dear All There are avalanche of contradicting messages Everyone pushes for its own views Pls ce the validity of all statement Haida Pls clarify what you said about GDPR against a clause of articles to validate what you stated . Others are talking of accuracy They are requested to explore what accuracy they are looking by giving examples Fritz is kindly requested to reconcile all these contradictory statements Regards Kavouss Sent from my iPhone On 4 Nov 2018, at 15:02, Hadia Abdelsalam Mokhtar EL miniawi <Hadia@tra.gov.eg<mailto:Hadia@tra.gov.eg>> wrote: Hi Farzi, Just a quick clarification GDPR does not apply to EU citizens not residing in the EU. The GDPR is not concerned with the citizenship it is concerned with where the person is located. If you leave an EU country and travel to a non EU country you are no longer protected by the GDPR. The data rights of the EU citizens located outside of the EU is protected by the laws of the territory that they are at. The data rights of the registrants is determined by their location (not their citizenship) in addition to the location of the controller and processor. And with regard to protecting registrants we should also not forget the necessity of protecting the registrants against domains hijacking and thefts which could be devastating to the domain name holder not only financially but in terms of accessibility to the site in case it is a not for profit web page or domain and the rights of the registrants to be able to pursue their rights in this regard. Finally and on another note which legal entities or businesses would like to be kept hidden?? Best Hadia From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] On Behalf Of farzaneh badii Sent: Sunday, November 04, 2018 9:38 AM To: Alan Greenberg Cc: gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>; alex@the-online.net<mailto:alex@the-online.net>; GNSO EPDP Subject: Re: [Gnso-epdp-team] Further Input from the IPC/BC on Small Team #1 and #2 issues Dear Diane, How can registrars determine the applicable law even if the geographical information is accurate? I don't think registrars can actually determine which law outside of their own jurisdiction applies to their registrants even if they know the geographical location. For example, as far as I know EU citizens anywhere in the world are protected by GDPR. So their geographical location does not determine what law applies. Registrars have to abide by their local laws, the court of law determines the applicable law and some registries have the choice of law clauses in their agreements with registrars which cannot be in conflict with the local laws of the registrars. All in all determining the "jurisdiction" of data subject is not dependent only on the geographical location of the registrant in this case. Also I think every domain name registrant regardless of where they are located deserve minimum data protection. They are consumers by the way! I am getting increasingly puzzled by IPC/BC interpretation of "accuracy" of personal information of data subjects under GDPR. In my opinion the concept of accuracy in GDPR is actually supposed to protect data subjects and not to be used against them. Accurate information is not about keeping the data accurate so that it can be displayed and accessed and mined by many around the world! The accuracy of data is a right given to data subjects so that inaccurate data cannot be used against them in court and other forums, or be denied a service or end in violating their rights. I believe they have the right for their information to be accurate and not the responsibility (under GDPR) to maintain it accurately. The registrars under GDPR have to maintain the data of domain name registrants "uptodate" to reduce privacy risks. They don't have to keep the database accurate so that they can distinguish between legal and natural persons. I believe by ICO you mean Information Commissioners Office. Specifically this page: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-re... The natural v legal distinction is not only burdensome for the CPs or opens them to liability. It is dangerous for noncommercial/not for porfit/ advocacy organizations that have registered domain names and are vulnerable to attacks of all sorts. I assume IPC/BC wants this distinction so that the org personal sensitive data won't be redacted. I would like to know why. I would like to know why while some groups are fiercely working to have access to personal and sensitive data of domain name registrants for their legitimate interest, also work towards exposing domain name registrants sensitive data to the world. Farzaneh On Fri, Nov 2, 2018 at 10:13 PM Alan Greenberg <alan.greenberg@mcgill.ca<mailto:alan.greenberg@mcgill.ca>> wrote: This all sounds right to me. Alan At 02/11/2018 09:28 PM, Plaut, Diane wrote: Dear EPDP Team- In our efforts to overcome a significant hurdle through our EPDP work – that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws. The Accuracy of information provided by data subjects Article 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that: Personal data shall be…accurate and, where necessary, keept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’). According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data provided by the data subject, provided by a third party or created by the controller – the same obligation applies in each such caase. As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states that: “In some cases it is reasonable to rely on the individual to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details, but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this.†However, if the controller learns that information is no longer accurate/up to date (either from the data subject or from other information which comes to light), the controller should update its records accordingly. The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must: · accurately record the information provided; · accurately record the source of the information; · take “reasonable steps†in the circumstances to ensure the accuracy of the information; and · carefully consider any challenges to the accuracy of the information. Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes. Moreover, in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties. Sincerely, Diane Diane Plaut General Counsel and Privacy Officer Error! Filename not specified. Direct +1 646-899-2806 
 diane.plaut@corsearch.com<mailto:diane.plaut@corsearch.com> 220 West 42<https://maps.google.com/?q=220+West+42&entry=gmail&source=g>nd Street, 11th Floor, New York, NY 10036, United States
www.corsearch.com<http://www.corsearch.com/> Join Corsearch on Twitter<https://twitter.com/corsearch> Linkedin<https://www.linkedin.com/company/2593860/> Trademarks + Brands<http://trademarksandbrands.corsearch.com/> Customer Service/Platform Support: 1 800 SEARCH1â„¢ (1 800 732 7241)
 Corsearch.USCustomerService@corsearch.com<mailto:Corsearch.USCustomerService@corsearch.com> Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team -- [Donuts Inc.]<http://donuts.domains> Alan Woods Senior Compliance & Policy Manager, Donuts Inc. ________________________________ The Victorians, 15-18 Earlsfort Terrace Dublin 2, County Dublin Ireland [http://storage.googleapis.com/signaturesatori/icons/facebook.png]<https://www.facebook.com/donutstlds> [http://storage.googleapis.com/signaturesatori/icons/twitter.png] <https://twitter.com/DonutsInc> [http://storage.googleapis.com/signaturesatori/icons/linkedin.png] <https://www.linkedin.com/company/donuts-inc> Please NOTE: This electronic message, including any attachments, may include privileged, confidential and/or inside information owned by Donuts Inc. . Any distribution or use of this communication by anyone other than the intended recipient(s) is strictly prohibited and may be unlawful. If you are not the intended recipient, please notify the sender by replying to this message and then delete it from your system. Thank you.
Hi Diane, all, Thanks for doing research on this and sharing information from the ICO with the group. This has sparked off quiet some discussion, which is good. Reading all the e-mails I cannot help feeling that you are talking past each other, at least to a certain extent. We are trying to answer the question whether a distinction between natural and legal persons should be made. Some say that the distinction should not be made as there are risks when you make the distinction. If a legal person’s name is PII and if a contracted party then publishes that data, it will be in breach of the GDPR and potentially be at the risk of being fined. The ICO on the other hand, says that information from the data subject can be trusted. What that means is that the registrar does not have to do validation. Let’s say I mistype my name - that is nothing the registrar needs to investigate. But that is different from a sole trader who gives his name and tags it legal person. I do not think the ICO would go as far as saying that the data subject’s potentially inaccurate submission of information would include the legal consequences of being put into the bucket of legal entities. In fact, that could mean that the individual would get its data disclosed and not be able to exercise rights under GDPR. This is why I think we should try to get guidance from the DPAs or the EC. If they say the parties involved will not be sanctioned if they rely on the self-identification of a customer, that is fine. Absent such clarification, we need to continue the conversation…. I hope this helps. Best, Thomas
Am 03.11.2018 um 02:28 schrieb Plaut, Diane <Diane.Plaut@corsearch.com>:
Dear EPDP Team- <>
In our efforts to overcome a significant hurdle through our EPDP work – that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws. The Accuracy of information provided by data subjects Article 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that: Personal data shall be…accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’). According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data provided by the data subject, provided by a third party or created by the controller – the same obligation applies in each such case. As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states that: “In some cases it is reasonable to rely on the individual to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details, but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this.” However, if the controller learns that information is no longer accurate/up to date (either from the data subject or from other information which comes to light), the controller should update its records accordingly. The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must: · accurately record the information provided; · accurately record the source of the information; · take “reasonable steps” in the circumstances to ensure the accuracy of the information; and · carefully consider any challenges to the accuracy of the information. Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes.
Moreover, in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties.
Sincerely,
Diane
Diane Plaut General Counsel and Privacy Officer <image001.png> Direct +1 646-899-2806 <tel:+1%20646-899-2806> > diane.plaut@corsearch.com <mailto:diane.plaut@corsearch.com> 220 West 42nd Street, 11th Floor, New York, NY 10036, United States > www.corsearch.com <http://www.corsearch.com/> Join Corsearch on Twitter <https://twitter.com/corsearch> Linkedin <https://www.linkedin.com/company/2593860/> Trademarks + Brands <http://trademarksandbrands.corsearch.com/> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241 <tel:1%20800%20732%207241>) > Corsearch.USCustomerService@corsearch.com <mailto:Corsearch.USCustomerService@corsearch.com>
Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession.
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team>
Dear All I do not understand the origin of didtrust on the following *"that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws."* Regards Kavouss On Sun, Nov 4, 2018 at 8:59 PM Thomas Rickert <epdp@gdpr.ninja> wrote:
Hi Diane, all, Thanks for doing research on this and sharing information from the ICO with the group.
This has sparked off quiet some discussion, which is good.
Reading all the e-mails I cannot help feeling that you are talking past each other, at least to a certain extent.
We are trying to answer the question whether a distinction between natural and legal persons should be made.
Some say that the distinction should not be made as there are risks when you make the distinction. If a legal person’s name is PII and if a contracted party then publishes that data, it will be in breach of the GDPR and potentially be at the risk of being fined.
The ICO on the other hand, says that information from the data subject can be trusted. What that means is that the registrar does not have to do validation.
Let’s say I mistype my name - that is nothing the registrar needs to investigate.
But that is different from a sole trader who gives his name and tags it legal person. I do not think the ICO would go as far as saying that the data subject’s potentially inaccurate submission of information would include the legal consequences of being put into the bucket of legal entities. In fact, that could mean that the individual would get its data disclosed and not be able to exercise rights under GDPR.
This is why I think we should try to get guidance from the DPAs or the EC. If they say the parties involved will not be sanctioned if they rely on the self-identification of a customer, that is fine. Absent such clarification, we need to continue the conversation….
I hope this helps.
Best, Thomas
Am 03.11.2018 um 02:28 schrieb Plaut, Diane <Diane.Plaut@corsearch.com>:
Dear EPDP Team-
In our efforts to overcome a significant hurdle through our EPDP work – that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws. *The Accuracy of information provided by data subjects* Article 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that: *Personal data shall be…accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’).* According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data provided by the data subject, provided by a third party or created by the controller – the same obligation applies in each such case. *As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states* that: “In some cases it is reasonable to rely on the individual to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details, *but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this*.” However, if the controller learns that information is no longer accurate/up to date (either from the data subject or from other information which comes to light), the controller should update its records accordingly. *The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must: * *·* *accurately record the information provided;* *·* *accurately record the source of the information;* *·* *take “reasonable steps” in the circumstances to ensure the accuracy of the information; and* *·* *carefully consider any challenges to the accuracy of the information.* *Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes.*
*Moreover, **in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties.*
Sincerely,
Diane
*Diane Plaut* General Counsel and Privacy Officer <image001.png> Direct +1 646-899-2806 <+1%20646-899-2806> diane.plaut@corsearch.com 220 West 42nd Street, 11th Floor, New York, NY 10036, United States www.corsearch.com Join Corsearch on Twitter <https://twitter.com/corsearch> Linkedin <https://www.linkedin.com/company/2593860/> Trademarks + Brands <http://trademarksandbrands.corsearch.com/> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241) Corsearch.USCustomerService@corsearch.com
*Confidentiality Notice:* This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession.
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Dear Thomas- Thank you for thoughtful analysis, as usual. I agree that we have to get further input from other DPAs, and I have told you that I very much want to support and be part of that effort (the meeting you offered to set up). This was a starting point to push this effort forward, and I believe a good starting point because the ICO is recognized as a source of moderate guidance. Getting DPA guidance is an important and essential effort that we both know needs to happen to allow the EPDP to come up with practical solutions to the legal application of data protection laws, and specifically the GDPR, to answer the charter questions and advance a working DNS system. Please let me know if you were able to make progress on setting up the meeting in November, as discussed. Sincerely, Diane On Nov 4, 2018, at 2:59 PM, Thomas Rickert <epdp@gdpr.ninja<mailto:epdp@gdpr.ninja>> wrote: Hi Diane, all, Thanks for doing research on this and sharing information from the ICO with the group. This has sparked off quiet some discussion, which is good. Reading all the e-mails I cannot help feeling that you are talking past each other, at least to a certain extent. We are trying to answer the question whether a distinction between natural and legal persons should be made. Some say that the distinction should not be made as there are risks when you make the distinction. If a legal person’s name is PII and if a contracted party then publishes that data, it will be in breach of the GDPR and potentially be at the risk of being fined. The ICO on the other hand, says that information from the data subject can be trusted. What that means is that the registrar does not have to do validation. Let’s say I mistype my name - that is nothing the registrar needs to investigate. But that is different from a sole trader who gives his name and tags it legal person. I do not think the ICO would go as far as saying that the data subject’s potentially inaccurate submission of information would include the legal consequences of being put into the bucket of legal entities. In fact, that could mean that the individual would get its data disclosed and not be able to exercise rights under GDPR. This is why I think we should try to get guidance from the DPAs or the EC. If they say the parties involved will not be sanctioned if they rely on the self-identification of a customer, that is fine. Absent such clarification, we need to continue the conversation…. I hope this helps. Best, Thomas Am 03.11.2018 um 02:28 schrieb Plaut, Diane <Diane.Plaut@corsearch.com<mailto:Diane.Plaut@corsearch.com>>: Dear EPDP Team- In our efforts to overcome a significant hurdle through our EPDP work – that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws. The Accuracy of information provided by data subjects Article 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that: Personal data shall be…accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’). According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data provided by the data subject, provided by a third party or created by the controller – the same obligation applies in each such case. As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states that: “In some cases it is reasonable to rely on the individual to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details, but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this.” However, if the controller learns that information is no longer accurate/up to date (either from the data subject or from other information which comes to light), the controller should update its records accordingly. The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must: · accurately record the information provided; · accurately record the source of the information; · take “reasonable steps” in the circumstances to ensure the accuracy of the information; and · carefully consider any challenges to the accuracy of the information. Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes. Moreover, in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties. Sincerely, Diane Diane Plaut General Counsel and Privacy Officer <image001.png> Direct +1 646-899-2806<tel:+1%20646-899-2806> diane.plaut@corsearch.com<mailto:diane.plaut@corsearch.com> 220 West 42nd Street, 11th Floor, New York, NY 10036, United States www.corsearch.com<http://www.corsearch.com/> Join Corsearch on Twitter<https://twitter.com/corsearch> Linkedin<https://www.linkedin.com/company/2593860/> Trademarks + Brands<http://trademarksandbrands.corsearch.com/> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241<tel:1%20800%20732%207241>) Corsearch.USCustomerService@corsearch.com<mailto:Corsearch.USCustomerService@corsearch.com> Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession. _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://mm.icann.org/mailman/listinfo/gnso-epdp-team>
Dear Kurt I am not sure that everybody speaking on the same wave-length Some dealing with persons some other dealing with location Some other dealing with data Some other dealing with person and citizenship Some other dealing with data ,persons, reseller There is therefroe a need to clarify all these cobntradictory statement Regards Kavouss On Mon, Nov 5, 2018 at 2:03 AM Plaut, Diane <Diane.Plaut@corsearch.com> wrote:
Dear Thomas-
Thank you for thoughtful analysis, as usual. I agree that we have to get further input from other DPAs, and I have told you that I very much want to support and be part of that effort (the meeting you offered to set up). This was a starting point to push this effort forward, and I believe a good starting point because the ICO is recognized as a source of moderate guidance.
Getting DPA guidance is an important and essential effort that we both know needs to happen to allow the EPDP to come up with practical solutions to the legal application of data protection laws, and specifically the GDPR, to answer the charter questions and advance a working DNS system.
Please let me know if you were able to make progress on setting up the meeting in November, as discussed.
Sincerely,
Diane
On Nov 4, 2018, at 2:59 PM, Thomas Rickert <epdp@gdpr.ninja> wrote:
Hi Diane, all, Thanks for doing research on this and sharing information from the ICO with the group.
This has sparked off quiet some discussion, which is good.
Reading all the e-mails I cannot help feeling that you are talking past each other, at least to a certain extent.
We are trying to answer the question whether a distinction between natural and legal persons should be made.
Some say that the distinction should not be made as there are risks when you make the distinction. If a legal person’s name is PII and if a contracted party then publishes that data, it will be in breach of the GDPR and potentially be at the risk of being fined.
The ICO on the other hand, says that information from the data subject can be trusted. What that means is that the registrar does not have to do validation.
Let’s say I mistype my name - that is nothing the registrar needs to investigate.
But that is different from a sole trader who gives his name and tags it legal person. I do not think the ICO would go as far as saying that the data subject’s potentially inaccurate submission of information would include the legal consequences of being put into the bucket of legal entities. In fact, that could mean that the individual would get its data disclosed and not be able to exercise rights under GDPR.
This is why I think we should try to get guidance from the DPAs or the EC. If they say the parties involved will not be sanctioned if they rely on the self-identification of a customer, that is fine. Absent such clarification, we need to continue the conversation….
I hope this helps.
Best, Thomas
Am 03.11.2018 um 02:28 schrieb Plaut, Diane <Diane.Plaut@corsearch.com>:
Dear EPDP Team-
In our efforts to overcome a significant hurdle through our EPDP work – that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws. *The Accuracy of information provided by data subjects* Article 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that: *Personal data shall be…accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’).* According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data provided by the data subject, provided by a third party or created by the controller – the same obligation applies in each such case. *As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states* that: “In some cases it is reasonable to rely on the individual to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details, *but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this*.” However, if the controller learns that information is no longer accurate/up to date (either from the data subject or from other information which comes to light), the controller should update its records accordingly. *The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must: * *·* *accurately record the information provided;* *·* *accurately record the source of the information;* *·* *take “reasonable steps” in the circumstances to ensure the accuracy of the information; and* *·* *carefully consider any challenges to the accuracy of the information.* *Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes.*
*Moreover, **in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties.*
Sincerely,
Diane
*Diane Plaut* General Counsel and Privacy Officer <image001.png> Direct +1 646-899-2806 <+1%20646-899-2806> diane.plaut@corsearch.com 220 West 42nd Street, 11th Floor, New York, NY 10036, United States www.corsearch.com Join Corsearch on Twitter <https://twitter.com/corsearch> Linkedin <https://www.linkedin.com/company/2593860/> Trademarks + Brands <http://trademarksandbrands.corsearch.com/> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241) Corsearch.USCustomerService@corsearch.com
*Confidentiality Notice:* This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession.
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team
Hi Diane, I am still waiting for a response from the EC. Will let all of you know once there is news to report. All the best, Thomas
Am 05.11.2018 um 02:02 schrieb Plaut, Diane <Diane.Plaut@corsearch.com>:
Dear Thomas-
Thank you for thoughtful analysis, as usual. I agree that we have to get further input from other DPAs, and I have told you that I very much want to support and be part of that effort (the meeting you offered to set up). This was a starting point to push this effort forward, and I believe a good starting point because the ICO is recognized as a source of moderate guidance.
Getting DPA guidance is an important and essential effort that we both know needs to happen to allow the EPDP to come up with practical solutions to the legal application of data protection laws, and specifically the GDPR, to answer the charter questions and advance a working DNS system.
Please let me know if you were able to make progress on setting up the meeting in November, as discussed.
Sincerely,
Diane
On Nov 4, 2018, at 2:59 PM, Thomas Rickert <epdp@gdpr.ninja <mailto:epdp@gdpr.ninja>> wrote:
Hi Diane, all, Thanks for doing research on this and sharing information from the ICO with the group.
This has sparked off quiet some discussion, which is good.
Reading all the e-mails I cannot help feeling that you are talking past each other, at least to a certain extent.
We are trying to answer the question whether a distinction between natural and legal persons should be made.
Some say that the distinction should not be made as there are risks when you make the distinction. If a legal person’s name is PII and if a contracted party then publishes that data, it will be in breach of the GDPR and potentially be at the risk of being fined.
The ICO on the other hand, says that information from the data subject can be trusted. What that means is that the registrar does not have to do validation.
Let’s say I mistype my name - that is nothing the registrar needs to investigate.
But that is different from a sole trader who gives his name and tags it legal person. I do not think the ICO would go as far as saying that the data subject’s potentially inaccurate submission of information would include the legal consequences of being put into the bucket of legal entities. In fact, that could mean that the individual would get its data disclosed and not be able to exercise rights under GDPR.
This is why I think we should try to get guidance from the DPAs or the EC. If they say the parties involved will not be sanctioned if they rely on the self-identification of a customer, that is fine. Absent such clarification, we need to continue the conversation….
I hope this helps.
Best, Thomas
Am 03.11.2018 um 02:28 schrieb Plaut, Diane <Diane.Plaut@corsearch.com <mailto:Diane.Plaut@corsearch.com>>:
Dear EPDP Team- <>
In our efforts to overcome a significant hurdle through our EPDP work – that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile, I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions on the issues of supporting the distinction of legal and natural persons and applying relevant country laws. The Accuracy of information provided by data subjects Article 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that: Personal data shall be…accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’). According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data provided by the data subject, provided by a third party or created by the controller – the same obligation applies in each such case. As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states that: “In some cases it is reasonable to rely on the individual to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details, but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this.” However, if the controller learns that information is no longer accurate/up to date (either from the data subject or from other information which comes to light), the controller should update its records accordingly. The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must: · accurately record the information provided; · accurately record the source of the information; · take “reasonable steps” in the circumstances to ensure the accuracy of the information; and · carefully consider any challenges to the accuracy of the information. Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes.
Moreover, in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy standards are achieved, stating: The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate. It could even go one step further and expressly say that Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws. Nothing in the above, limits the application of the ICO guidance from supporting greater accuracy required by all parties.
Sincerely,
Diane
Diane Plaut General Counsel and Privacy Officer <image001.png> Direct +1 646-899-2806 <tel:+1%20646-899-2806> >>> diane.plaut@corsearch.com <mailto:diane.plaut@corsearch.com> 220 West 42nd Street, 11th Floor, New York, NY 10036, United States >>> www.corsearch.com <http://www.corsearch.com/> Join Corsearch on Twitter <https://twitter.com/corsearch> Linkedin <https://www.linkedin.com/company/2593860/> Trademarks + Brands <http://trademarksandbrands.corsearch.com/> Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241 <tel:1%20800%20732%207241>) >>> Corsearch.USCustomerService@corsearch.com <mailto:Corsearch.USCustomerService@corsearch.com>
Confidentiality Notice: This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession.
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org <mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team <https://mm.icann.org/mailman/listinfo/gnso-epdp-team>
participants (10)
-
Alan Greenberg -
Alan Woods -
Amr Elsadr -
Arasteh -
Ayden Férdeline -
farzaneh badii -
Hadia Abdelsalam Mokhtar EL miniawi -
Kavouss Arasteh
-
Plaut, Diane -
Thomas Rickert