EPDP Team, Overall this new version is an improvement on the previous drafts. I added a couple notes for consideration. I also want to point out that the building block recommendations are very specific to the SSAD system and what the requirements are for the Retention and Destruction of any non-public registration data disclosed via that SSAD system. I think this is the right focus, but it doesn't address other retention/destruction requirements such as those related to user account information, and logs of requests for data. The TSG report (https://www.icann.org/en/system/files/files/technical-model-access-non-publi...) page 26 has some thoughts on this including what we might consider for an SSAD system requirement: "the system MUST NOT retain non-public gTLD domain name registration data in any persistent way or for any longer than needed to fulfill the query for which the data were acquired." Best, Marc From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of Caitlin Tubergen Sent: Thursday, October 10, 2019 8:51 AM To: gnso-epdp-team@icann.org Subject: [EXTERNAL] [Gnso-epdp-team] For final review - building block e) retention/destruction of data Dear EPDP Team, Building Block e (retention and destruction of data) is ready for your final review: https://docs.google.com/document/d/1WMhllLz5Zgm42C4Jfjiqinu32Jwiu_lhuBorzeuB... The edit log notes the proposed changes made as a result of Marc A's suggestions on the email list. Please flag any remaining issues that require further EPDP Team consideration (if any) by Friday 11 October at 22.00 UTC. Thank you. Best regards, Marika, Berry, and Caitlin