Re: [Gnso-epdp-team] Coordination between ICANN org and EPDP
Hello Göran: Thanks very much for contacting me and your note I have repeated some your email below so that there is a clear connection between your questions and my responses. Today, ICANN org held a call to provide community leaders with updates regarding various GDPR activities. The slides and recording of the call are available at https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en <https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en>. On the call, a few community leaders reinforced the value of coordination between ICANN org and the EPDP Working Group, particularly around access model. To this end, please share with us any thoughts you might have regarding a process by which: 1) ICANN org can share guidance we receive from the DPAs and European Data Protection Board with the EPDP Working Group. Generally, our Team discussions are appropriately aimed at refining / altering ICANN processes so they are GDPR compliant. So guidance, case law or authoritative opinions received that provides compliance requirements will be extremely helpful. a. Through its many recent actions: engaging with the ICANN community, governments, the EDPB, and others, it is apparent that ICANN is the midst of executing a plan to obtain certainty around the various GDPR provisions. It would be instructive for the EPDP Team if ICANN were to share its plan (or elements of it) so that the team can anticipate the receipt (and timing) of new information. It would also indicate where there is likely no additional information, i.e., where the team would be left to draw conclusions based on the information that is already available. This information would likely cut down on the number of questions the ICANN Org receives from the team. We understand that the plan must have a degree of informality and be flexible, with each step based upon the information received in the step before it. However, where available, it would be instructive to know the planned-for objectives, expected learnings, a set of ultimate questions to be answered, planned inquiries, targets and so on. b. While ICANN has published each communication, the findings or results of those communications have not been organized in anyway of which we know. For example, observers of the back-and-forth between the ICANN Org and the EDPB have offered conclusions that can be drawn from these documents. However, no one has organized those conclusions in a way that might become a rule set or set of guidelines for those reviewing the Temporary Specification or creating an access model. Coincidentally, in today’s EPDP meeting such a request was made: for disclosure of all the communications with the EDPB and DPAs, the staff commentary to those communications, and some organization of same. c. We also wish to hear of developments related to GDPR in other industries, if available, such as: what data processing protocols have been adopted what data processing protocols have been tested in courts what other privacy regimes are in works in other jurisdictions what data is available regarding: the effects of GDPR on malfeasance detection, avoidance other positive or negative effects of GDPR d. Finally, it’d be helpful to be made aware of the details of ICANN’s GDPR implementation plan as ICANN org had to take on the advice of DPAs and the EDPB in fashioning that. (This is a request made from the EPDP team in yesterday’s meeting and so this request has been repeated to the ICANN liaisons working with the EPDP.) 2) How the EPDP Working Group will provide input regarding access to ICANN org to use in our interactions with DPAs and European Data Protection Board to obtain legal guidance that will help guide the Working Group in its work. As you know, we post all information we receive through our blogs and engage with stakeholders, also through communications we post whether through correspondence or comments via gdpr@icann.org <mailto:gdpr@icann.org>. a. A point of information: The EPDP team’s third set of deliverables is to provide an, “Initial Report and a Final Report regarding the EPDP Team’s recommendations … for a System for Accredited Access to Non-Public Registration Data.” Work on this could begin as early as the completion and publication of the Initial Report on the Temporary Specification. (The Team stays in close contact with the GNSO Council leadership in pursuit of the deliverables to ensure the spirit and letter of the EPDP Charter is followed.) b. While our current answer to this question is not yet finely honed, it is likely that, from time to time, the EPDP Team will have question regarding the constraints / opportunities imposed by the GDPR. These questions might take the form of a proposed access model (or elements of an access model). The EPDP Team will forward those to ICANN, which, in turn, can test them against its own knowledge base, with DPAs, with the EDPB, or elsewhere. c. As ICANN is a data controller involved in the collection, use and disclosure of the same data that is the subject matter of this Team’s work, it is expected that ICANN will work with the team on the successor to the Temporary Specification and an access model. I hope you find this response helpful. The team is keen to continue an active correspondence with ICANN in order to flesh out the framework provided by GDPR with detailed clarifications, implementation guidance and cases from other, similarly situated industries that have faced many of these same issues. We also plan to remain in close communication with ICANN leaders on this topic, through the ICANN-provided liaisons to the EPDP Team. Sincerely, Kurt
On Aug 14, 2018, at 8:17 AM, Goran Marby <goran.marby@icann.org> wrote:
Kurt,
Today, ICANN org held a call to provide community leaders with updates regarding various GDPR activities. The slides and recording of the call are available at https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en <https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en>.
On the call, a few community leaders reinforced the value of coordination between ICANN org and the EPDP Working Group, particularly around access model. To this end, please share with us any thoughts you might have regarding a process by which (1) ICANN org can share guidance we receive from the DPAs and European Data Protection Board with the EPDP Working Group; and (2) How the EPDP Working Group will provide input regarding access to ICANN org to use in our interactions with DPAs and European Data Protection Board to obtain legal guidance that will help guide the Working Group in its work. As you know, we post all information we receive through our blogs and engage with stakeholders, also through communications we post whether through correspondence or comments via gdpr@icann.org <mailto:gdpr@icann.org>. I look forward to hearing your thoughts on how we can continue to strengthen our work together toward the common goal of having an access model that is guided by the law and supported by the community.
Best regards,
Göran Marby President & CEO ICANN +1(310) 578 8690
Cássia Oliveira Sr. Manager, Office of the President & CEO cassia.oliveira@icann.org <mailto:cassia.oliveira@icann.org> +1(310) 578 8656
Kurt, Thanks for your thoughts on how the Expedited Policy Development Process (EPDP) Team envisions it will provide input to ICANN org to use in our interactions with the European Data Protection Board (EDPB) and Data Protection Authorities (DPAs). As I mentioned on the call<https://participate.icann.org/p65jm2z6cv7/?launcher=false&fcsContent=true&pb...> with community leaders on August 12th, it is very important that we get the community’s input, including the EPDP Team’s, during this process. We are trying to achieve legal certainty for any model that is developed, and to make sure any guidance or clarity we receive helps the community in its policy discussions. Just as we did with the Calzone proposed model for GDPR compliance, we want the community’s questions and comments on some of the open areas of interpretation to help guide our discussions with the EDPB and other relevant data protection authorities. This will help us take our discussions with the DPAs to the next level. The more “meat” we provide or the more specific questions we ask, the more meaningful guidance they can give us. With a better understanding of the law, we will all be well positioned to develop, implement and enforce a legally sound, consistent unified model for access to non-public registration data, and lower the risk for the contracted parties in order for them to be able to accept such model. This will also help all of you in your discussions, particularly on the Temp Spec. The DPAs and EDPB are open to engaging with us but the window of opportunity is finite. There are specific points in time where the topic can be addressed through their structures and processes. The Technology subgroup of the EDPB is the body responsible for looking at issues such as the WHOIS and providing input for the EDPB Plenary meetings. In order to have meaningful engagement with them we need to time our input with their respective meetings. Coordinating the right timing for DPAs to meaningfully engage with us while at the same time sharing with them concrete questions from our community-driven processes is an exercise that requires a great level of flexibility. It's also helpful to hear the EPDP Team’s thoughts on how ICANN org can share guidance we receive from DPAs and the EDPB with the EPDP Team. We have been very open and transparent with all of our engagement with the DPAs and the EDPB and will continue to be. All of the formal correspondence from the DPAs and EDPB are published on the ICANN correspondence page<https://www.icann.org/resources/pages/correspondence> and our informal verbal conversations for mutual education and information are summarized in blogs. We encourage the EPDP Team to continue to monitor these sources for the latest updates. To assist the EPDP Team in its work, ICANN org will provide the EPDP Team with a compiled list of correspondence received and blogs published thus far, including the topic of each correspondence/blog. We’d also like to offer the idea of a regular information sharing call between ICANN org and members of the EPDP Team if you think such a call would be helpful to the EPDP Team’s work. In addition to direct engagement with the EDPB, stakeholders, and the broader ICANN community, we are regularly updating our website with input received from communications and comments covering a range of topics relating to GDPR. Should the community have specific topics to raise, or information to share on areas and experiences in other sectors, please encourage them to submit it to gdpr@icann.org<mailto:gdpr@icann.org> and we will post it to make available to the community. Updates on our work related to data protection and privacy matters are published here<https://www.icann.org/dataprotectionprivacy>. I look forward to continued coordination between ICANN org and the EPDP Team. Best, Göran Marby President & CEO ICANN +1(310) 578 8690 Cássia Oliveira Sr. Manager, Office of the President & CEO cassia.oliveira@icann.org<mailto:cassia.oliveira@icann.org> +1(310) 578 8656 From: Kurt Pritz <kurt@kjpritz.com> Sent: Friday, August 17, 2018 10:19 AM To: Goran Marby <goran.marby@icann.org> Cc: rafik.dammak@gmail.com; David Olive <david.olive@icann.org>; Theresa Swinehart <theresa.swinehart@icann.org>; John Jeffrey <john.jeffrey@icann.org>; Akram Atallah <akram.atallah@icann.org>; Chris Disspain <chris.disspain@board.icann.org>; leon.sanchez@board.icann.org; Cassia Oliveira <cassia.oliveira@icann.org>; GNSO EPDP <gnso-epdp-team@icann.org> Subject: [Ext] Re: Coordination between ICANN org and EPDP Hello Göran: Thanks very much for contacting me and your note I have repeated some your email below so that there is a clear connection between your questions and my responses. Today, ICANN org held a call to provide community leaders with updates regarding various GDPR activities. The slides and recording of the call are available at https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en [icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resources...>. On the call, a few community leaders reinforced the value of coordination between ICANN org and the EPDP Working Group, particularly around access model. To this end, please share with us any thoughts you might have regarding a process by which: 1) ICANN org can share guidance we receive from the DPAs and European Data Protection Board with the EPDP Working Group. Generally, our Team discussions are appropriately aimed at refining / altering ICANN processes so they are GDPR compliant. So guidance, case law or authoritative opinions received that provides compliance requirements will be extremely helpful. a. Through its many recent actions: engaging with the ICANN community, governments, the EDPB, and others, it is apparent that ICANN is the midst of executing a plan to obtain certainty around the various GDPR provisions. It would be instructive for the EPDP Team if ICANN were to share its plan (or elements of it) so that the team can anticipate the receipt (and timing) of new information. It would also indicate where there is likely no additional information, i.e., where the team would be left to draw conclusions based on the information that is already available. This information would likely cut down on the number of questions the ICANN Org receives from the team. We understand that the plan must have a degree of informality and be flexible, with each step based upon the information received in the step before it. However, where available, it would be instructive to know the planned-for objectives, expected learnings, a set of ultimate questions to be answered, planned inquiries, targets and so on. b. While ICANN has published each communication, the findings or results of those communications have not been organized in anyway of which we know. For example, observers of the back-and-forth between the ICANN Org and the EDPB have offered conclusions that can be drawn from these documents. However, no one has organized those conclusions in a way that might become a rule set or set of guidelines for those reviewing the Temporary Specification or creating an access model. Coincidentally, in today’s EPDP meeting such a request was made: for disclosure of all the communications with the EDPB and DPAs, the staff commentary to those communications, and some organization of same. c. We also wish to hear of developments related to GDPR in other industries, if available, such as: 1. what data processing protocols have been adopted 2. what data processing protocols have been tested in courts 3. what other privacy regimes are in works in other jurisdictions 4. what data is available regarding: * the effects of GDPR on malfeasance detection, avoidance * other positive or negative effects of GDPR d. Finally, it’d be helpful to be made aware of the details of ICANN’s GDPR implementation plan as ICANN org had to take on the advice of DPAs and the EDPB in fashioning that. (This is a request made from the EPDP team in yesterday’s meeting and so this request has been repeated to the ICANN liaisons working with the EPDP.) 2) How the EPDP Working Group will provide input regarding access to ICANN org to use in our interactions with DPAs and European Data Protection Board to obtain legal guidance that will help guide the Working Group in its work. As you know, we post all information we receive through our blogs and engage with stakeholders, also through communications we post whether through correspondence or comments via gdpr@icann.org<mailto:gdpr@icann.org>. a. A point of information: The EPDP team’s third set of deliverables is to provide an, “Initial Report and a Final Report regarding the EPDP Team’s recommendations … for a System for Accredited Access to Non-Public Registration Data.” Work on this could begin as early as the completion and publication of the Initial Report on the Temporary Specification. (The Team stays in close contact with the GNSO Council leadership in pursuit of the deliverables to ensure the spirit and letter of the EPDP Charter is followed.) b. While our current answer to this question is not yet finely honed, it is likely that, from time to time, the EPDP Team will have question regarding the constraints / opportunities imposed by the GDPR. These questions might take the form of a proposed access model (or elements of an access model). The EPDP Team will forward those to ICANN, which, in turn, can test them against its own knowledge base, with DPAs, with the EDPB, or elsewhere. c. As ICANN is a data controller involved in the collection, use and disclosure of the same data that is the subject matter of this Team’s work, it is expected that ICANN will work with the team on the successor to the Temporary Specification and an access model. I hope you find this response helpful. The team is keen to continue an active correspondence with ICANN in order to flesh out the framework provided by GDPR with detailed clarifications, implementation guidance and cases from other, similarly situated industries that have faced many of these same issues. We also plan to remain in close communication with ICANN leaders on this topic, through the ICANN-provided liaisons to the EPDP Team. Sincerely, Kurt On Aug 14, 2018, at 8:17 AM, Goran Marby <goran.marby@icann.org<mailto:goran.marby@icann.org>> wrote: Kurt, Today, ICANN org held a call to provide community leaders with updates regarding various GDPR activities. The slides and recording of the call are available at https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en [icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resources...>. On the call, a few community leaders reinforced the value of coordination between ICANN org and the EPDP Working Group, particularly around access model. To this end, please share with us any thoughts you might have regarding a process by which (1) ICANN org can share guidance we receive from the DPAs and European Data Protection Board with the EPDP Working Group; and (2) How the EPDP Working Group will provide input regarding access to ICANN org to use in our interactions with DPAs and European Data Protection Board to obtain legal guidance that will help guide the Working Group in its work. As you know, we post all information we receive through our blogs and engage with stakeholders, also through communications we post whether through correspondence or comments via gdpr@icann.org<mailto:gdpr@icann.org>. I look forward to hearing your thoughts on how we can continue to strengthen our work together toward the common goal of having an access model that is guided by the law and supported by the community. Best regards, Göran Marby President & CEO ICANN +1(310) 578 8690 Cássia Oliveira Sr. Manager, Office of the President & CEO cassia.oliveira@icann.org<mailto:cassia.oliveira@icann.org> +1(310) 578 8656
participants (2)
-
Goran Marby -
Kurt Pritz