Dear All,

Please find below the notes & action items from today’s DT5 meeting. Please take particular note of the action items.

Best regards,

Marika

DT5 - Regulatory or Contractual Enforcement

Meeting on 18 October 2017

1.            Welcome & roll call

• Role of coordinator is to co-ordinate & facilitate, for DT members to do the actual work

2.            Brief recap of drafting team goals and due date

a.            Overall goal: To enable better understanding of the Regulatory or Contractual Enforcement purpose for Whois data, first in DT5 and then in the full RDS PDP WG.

• See also the template that has been circulated.
• Objective is NOT to determine whether or not this purpose is legitimate, but to ensure understanding of what this purpose entails
• Deadline to complete tasks by Thursday 26 October - will require everyone to contribute and participate

b.            Tasks

i.              List and briefly describe tasks commonly involved in carrying out this purpose.

ii. Describe the parties who often access gTLD registration data in pursuit of Regulatory or Contractual Enforcement purposes

iii. List gTLD registration data often involved in this purpose.

iv. Describe the purpose succinctly in one paragraph

• Who are the parties that request WHOIS data today for Regulatory or Contractual Enforcement purposes?
• What role does gTLD registration data play for Regulatory or Contractual Enforcement purposes?
• Why is access to Whois data needed to fulfill Regulatory or Contractual Enforcement purposes?

v. Prepare and submit the final deliverable to the full RDS PDP WG not later than Thursday, October 26.

vi. Provide an overview of the final deliverable in the Face-to-Face WG meeting on Saturday, October 28 in Abu Dhabi and interact with WG members in that meeting to answer their questions and help them understand the Regulatory or Contractual Enforcement purpose.

3. All team members to share their level of experience with the regulatory or contractual enforcement purpose

• Bastiaan Goslings - no experience in this area, hopes to gain a better understanding through asking questions
• Beth Bacon - middle of the road level of experience. Previous position was US government so some familiarity with how colleagues used RDS data for these purposes, now experience from a registry perspective.
• Farell Folly - more than 5 years of experience in regulatory (government) are especially in mobile telecommunications and Internet Service providers, but not especially with domain names.
• Krishna Seeburn - has been part of the regulatory body, also worked with policy and LE in certain situations. Not a practicing lawyer, but good insight into what is being discussed.
• Steve Metalitz - lawyer in private practice, has counseled clients involved in the scenarios outlined in the paper (contract compliance). Some direct experience and general experience in the regulatory environment.
• Theo Geurts - as a registrar a lot of experience dealing with LE, IP as well as government. Been doing this since 2009 and responsible for the abuse team.

4. Introduce EWG's definition of this purpose as a starting point for discussion (see both EWG Report excerpts on page 2 of template)

• See template for EWG definition and example use cases. DT may decide to use this as a starting point if deemed helpful, but no obligation to do so.
• Current description is very broad, more focused on use cases. Is objective to craft a purpose statement that could be used to share with DPAs in the context of data protection legislation? Important not to get hung up on the term 'definition' for now.
• Recent work on users may help inform this, namely dataflow matrix that was created as part of the small group working on GDPR issues: https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017-07-24-en
• Use case developed by RDS PDP WG may also assist in this regard (see https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries%20for%20compliance%20purposes.docx?version=1&modificationDate=1470109106000&api=v2). In addition, EWG report identified a number of use cases for this purpose.

5. Initial Discussion

a.            Q&A between members less familiar with this purpose and those who have direct experience with it

• Would be helpful to briefly describe tasks involved in this purpose? Who has been asked for what, in what context?

b.            Team members more familiar with this purpose to give real-world examples of this purpose drawn from their own experiences

• UDRP - pretty straightforward process: registrar gets inquiry from UDRP provider, who is registrant, when was last update, etc. Info sent back to UDRP provider, following which procedure starts. Sometimes info is masked as a result of P/P services - requires review of conditions to see if unmasking is allowed. If info is not unmasked, P/P provider will be named as defendant. Some registrars will provide information to UDRP provider but will not reveal the info in WHOIS (depends on terms and conditions of P/P). The UDRP provider will look at publicly available WHOIS to send the necessary materials to registrant - even though info may not always be actionable. UDRP provider uses WHOIS info to be able to start their proceedings. The UDRP rules require the UDRP provider to send a "verification request" to registrar. UDRP provider also uses Whois data directly to send notice of the complaint to the respondent.  
• Intellectual property owner who identifies a site potentially infringing IP. Needs to be able to assess whether the registrant has authorisation/license to use IP. Contract enforcement issue - need to find out whether the person using IP has the right to do so. If not, it would involve next steps, for example getting ICANN compliance involved to enforce legal obligations. Would first go to WHOIS info to find a possible answer, even if info is not actionable (for example, in case of P/P). Would also include a WHOIS lookup to try and identify hosting party.
• Contractual compliance - WHOIS accuracy - contractual obligation by registrars to correct info within a certain timeframe following receipt of WHOIS accuracy complaint. Received from all kinds of sources: registrants, ICANN compliance, third parties.
• Registration data escrow audits - registrars need to ensure that registrant data is escrowed to an escrow provider to make sure that should a registrar go out of business, ICANN can get hold of registrant data to be able to provide continuity of service. Compliance audits are in place to ensure that data is available, complete, accurate.
• Audits also in place to check how processes are applied that involve, amongst others, RDS info such as sending of FOA, transfers, etc.

Action item #1: DT members to dedicate time over the course of next week to this topic and encouraged to share perspectives on the mailing list.

c.             Identify & discuss issues where more understanding is needed

6.            Assign responsibilities for creating first drafts

a.            Task i:

b.            Task ii

c.             Task iii

• Consider having one person doing task i, ii and iii for the different use cases.
• Consider using google doc so that others can add / edit as appropriate.
• Steve Metalitz: Intellectual Property owners. (Steve to send to the mailing list, Beth to turn it into a google doc).

Action item #2: DT members to share first draft by end of day on Thursday 19 October.

7.            Next steps and action items

a.            List discussion on agenda item 5.c. (Chuck will initiate this after call.)

b.            Volunteers for agenda items 6.a, 6.b & 6.c will submit their first drafts to the list and initiate list discussion not later than Friday, October 20

8.            Next teleconference call(s)

a.            Suggestions:

i.              Next call on Monday October 23 or Tuesday October 24

ii.             Third call early on Thursday October 26 if needed to finalize deliverable

b.            Chuck will request a Doodle Poll for the following days:

i.              Monday October 23

ii.             Tuesday October 24

iii.            Thursday October 26

Action item #3: Staff to circulate doodle poll to schedule next meeting on Monday or Tuesday next week. Doodle poll would also include possible third meeting on Thursday 26 October - but if work is completed by that date, it would be cancelled.

Marika Konings

Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) 

Email: marika.konings@icann.org

Follow the GNSO via Twitter @ICANN_GNSO

Find out more about the GNSO by taking our interactive courses and visiting the GNSO Newcomer pages.