April 2016 - gnso-rds-pdp-data

Data Team Checklist - 18 April 13:00
by Lisa Phifer April 18, 2016

April 18, 2016

Dear team data, Today's updated data team checklist is attached and also posted to the wiki at: https://community.icann.org/x/p4xlAw Michele will be following up on next steps for this team to discuss questions listed here: https://community.icann.org/x/iTeAAw Best, Lisa

2 1

Mailing List Configuration Update
by Michele Neylon - Blacknight April 18, 2016

April 18, 2016

All ICANN has made some changes to how the mailing list is configured which should hopefully address the issue where people accidentally reply to the sender instead of the list. Details below: “Dear all, Please see below the final update from IT, you may wish to share it with your subgroups, we have cleared with IT that it is fine to circulate the explanation: "Today I went ahead and updated the settings on all the mailman mailing lists so that the sender and related headers are configured in the same manner. In most cases the reply and reply-all functionality will work as expected. However if the sender has very strict sender verification policies published then the reply-all functionality will not work on Outlook for PC. Fortunately these strict policies are not very prevalent at this time. Sender domain email authentication policies or signatures such as DMARC, SPF/DKIM are used to tell if the sending email server is authorized to send from a specific domain. Not all systems receiving emails check DMARC or SPF settings and not all domains have SPF or DMARC configured. Furthermore there are policies in place saying what to do when you receive an email from an unauthorized sender, the options are reject, quarantine or none (none is up to the recipient). Mailing list servers have historically resent emails from the sender. So if david.prangnell(a)gmail.com sent an email to an ICANN mailing list mailinglist(a)icann.org the ICANN mailing list server would resend the email out to all the recipients from david.prangnell(a)gmail.com. This is problematic because ICANN is not authorized to send emails from gmail.com. With this historical set up, reply and reply-all work as expected, however as explained above, if the sender has DMARC configured with a policy to reject or quarantine, and the recipient is doing sender verification, these emails will not be received. Today I configured our mailing list servers to change the from address to being the list only in the cases where the sender has the DMARC policy set to reject or quarantine. I have tested the reply and reply-all behavior on the following email clients: * Outlook PC * Outlook Mac * Gmail * Yahoo The mailing lists should behave as follows: * When a member of a list clicks on "Reply" the email should go to the sender only. * When a member of a list clicks on "Reply-all" the email should go to the sender and the list. The reply-all behavior works as expected unless the sender is from Yahoo, or any sender that has a DMARC policy set to reject or quarantine.’ Thank you all for your patience here, Kind regards Nathalie " -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845

1 0

Re: [gnso-rds-pdp-data] Further summaries
by Richard Padilla April 16, 2016

April 16, 2016

Looked at both didn't see anything that may be useful from Article 29 WP 5 Recommendation 2/97 <http://ec.europa.eu/justice/data-protection/article-29/documentation/opinio…> … There is one paragraph I may have missed from the article below ICANN's public consultation on 2013 RAA Data Retention Specification Data Elements and - Legitimate Purposes for Collection and Retention <https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/C…> (17 April 2014) … Summary: 1. Retention of personal data originally collected for commercial purposes, and subsequently retained for law enforcement purposes, has been the subject of a recent landmark ruling by the European Court of Justice, which held Directive 2006/24/EC to be invalid, as an unjustified interference with those rights. The Court recognised that the retention of personal data might be considered appropriate for the purposes of the detection, investigation and prosecution of serious crime, but judged that the Directive 'exceeded the limits imposed by compliance with the principle of proportionality'. It is reasonable to expect requirements for retaining personal data to be subject to increasing scrutiny and legal challenges in the EU. It specifies that EU law was under review and was possible changing after 3/2014 where by a new General Data Protection Regulation which is designed to replace Directive 95/46/EC and be directly applicable in each of the twenty-eight EU Member States. There is therefore now a more compelling need than ever before for ICANN to apply the waiver of the retention period under the 2013 RAA Data Retention Specification uniformly to all EU Member States as requested in the 'harmonised statement' of the Working Party issued by letter of 6 June 2013. Therefore my opinion will be that if the above had happen then there was an expectation that ICANN was going to have to abide by the new directive and ensure that these rules are abide by within the EU or EC now this doesn't not mention anything for other regions of the world like the Americas etc. but a possible argument of how the laws have changed and been implemented for organisations to follow is described above in the summary. Regards R. Padilla MSc. -- Richard Padilla MSc

5 8

RFC7485
by nathalie coupet April 15, 2016

April 15, 2016

RegionalInternet Registries (RIRs) and Domain Name Registries (DNRs) havehistorically maintained a lookup service to permit public access to someportion of the registry database. Most registries offer the servicevia the WHOIS protocol [RFC3912], with additionalservices beingoffered via World Wide Web pages, bulk downloads, and other services,such as Routing Policy Specification Language (RPSL) [RFC2622]. Thisdocument records an inventory of registry data objects tofacilitatediscussions of registration data objects. The RegistrationData Access Protocol (RDAP) ([RFC7480], [RFC7482], [RFC7483], and [RFC7484]) was developed using this inventoryas input.=> Some data elements were not supported by allRIRs, andsome were given different labels by different RIRs. Also, there wereidentical labels used for different data elements by different RIRs. o All ofthe 124 domain registries have the object names in their responses,although they are in various formats. o Of the118 WHOIS services contacted, 65 registries show their registrantcontact. About half of the registries (60 registries) supportadmin contact information. There are 47 registries, which is about one third of thetotal number, that have technical and billingcontact information. Only seven of the 124 registries give their abuse email ina "remarks" section. No explicit abuse contact information isprovided. o There are mainly twopresentation formats. One is key-value; the other is data block format. Most of thedomain-related WHOIS information is included in the top 10 data elements.Other information like name server and registrar name is also supportedby most registries. Nathalie Coupet

1 0

Data Team Checklist - 15 April 13:00
by Lisa Phifer April 15, 2016

April 15, 2016

Dear team data, Today's data team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw Three new docs and a couple of summaries have been added to the list. Please note that, for new docs, all that is needed from the data team at this juncture is to summarize aspects of the documents which may impact this PDP WG's deliberations on specific data elements. Everyone should now be reviewing the summaries already submitted, thinking about questions posed to each team in https://community.icann.org/x/iTeAAw . You are encouraged to share possible data team answers to these questions on this list. For easy review of email threads, see this list's archive: http://mm.icann.org/pipermail/gnso-rds-pdp-data/ Best, Lisa

1 0

Re: [gnso-rds-pdp-data] Further summary
by Richard Padilla April 15, 2016

April 15, 2016

Dear All, Being a little proactive Benny sent a link of the actual new rules that were pushed through yesterday at EEC here a quick summary: Agreed 14/4 - http://www.europarl.europa.eu/news/en/news-room/20160407IPR21776/Data-prote… 1. *New EU data protection rules which aim to give citizens back control of their personal data and create a high, uniform level of data protection across the EU fit for the digital era.* 2. "The regulation will also create clarity for businesses by establishing a single law across the EU. The new law creates confidence, legal certainty and fairer competition". 3. The new rules include provisions on: 1. a right to be forgotten, 2. "clear and affirmative consent" to the processing of private data by the person concerned, 3. a right to transfer your data to another service provider, 4. the right to know when your data has been hacked, 5. ensuring that privacy policies are explained in clear and understandable language, and 6. stronger enforcement and fines up to 4% of firms' total worldwide annual turnover, as a deterrent to breaking the rules. Therefore a need to re-evaluate how data is being protected regardless of a personal data due to EU MEPs passing this to law wonder how this will be seen in the rest of world. Regards R -- Richard Padilla MSc

2 1

Data Team Checklist - 14 April 14:00
by Lisa Phifer April 14, 2016

April 14, 2016

Dear team data, Today's data team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw Almost all of the summaries have now been submitted. Thanks all for your efforts to get this team ready for its next steps. Best, Lisa

1 0

Re: [gnso-rds-pdp-data] Summary of Article 29 - Data Protection Working Party
by Richard Padilla April 14, 2016

April 14, 2016

Dear all, As I hadn't properly defined the summary I produced here a revised copy of my summary. After reviewing the documents in the section above the following can be summarised as follows: There has been enough discussion on the if I can call it the maintenance of how data should be kept in according to the laws of various countries as all have different laws that more or less try to do the same thing in different words and explanation. For e.g. Opinion 5/2000 - The use of Public Directories for Reverse or Multi-criteria Searching Services 1. Directive 95/46/EC - the protection of individuals with regard to the processing of the personal data, in Article 6.1 b), which establishes that personal data must be "collected for specified, explicit and legitimate purpose and not further processed in a way incompatible with those purposes". 2. Note the purpose of conventional telephone directories is the disclosure of subscriber's telephone number starting from the knowledge of subscriber's name and that its use is limited to that specific purposes. 3. Must establish the balance of interests, the interests and risks to privacy at stake have to be identified and evaluated. Directive 97/66/EC gives helpful indications: as long as the minimum information necessary to identify a subscriber is at stake, thus this information can be included in conventional public directories unless the subscriber objects. It must be considered that the interest of the individual in being protected override the interests of controller or third parties. Therefore such processing is only legitimate if the individual has given his/her informed consent prior to any inclusion of his /her personal data in public directories for reverse or multi-criteria searches. 4. Specific and informed consent of the subscriber must be obtained prior to the inclusion of his personal data into all kinds of public directories which include all type of communication devices used for reverse or multi-criteria searches. There must be some given consent on how personal data can be used. 5. As most conclusions regard the directives of the EC previous WP on the Protection of Individuals with regards to protection of data takes the position that processing of said personal data in reverse directories or multi-criteria searching services without unambiguous and informed consent by subscriber is unfair and unlawful. Thus fully implementing and accepting the EC proposal for draft directive on processing personal data. t Opinion 4/2001 - On the Council of Europe's Draft Convention on Cyber-Crime 1. Article 15 of draft Convention could create the impression that the protection of human rights shall only be considered when it is "due" and shall on be "adequate". It can be seen as limiting the safeguards and procedures it would considerably low if not fully undermine the protection of fundamental rights. 2. Finally with several EU countries implementing Directive 95/46/EC shows that national laws requires personal data can be in principle only be sent to non-EU countries if this country does provide an adequate level of protection of individuals with regard to the processing of their personal data. The level of protection in these countries must be checked. Otherwise if no adequate protection on offer in third country then transfer f personal data may nevertheless be necessary to fight against crime. Adopted 30/2002 - Working document on determining the international application of EU data protection law to personal data processing on the Internet by non-EU based web site In all these cases, the application of EU data protection law means among other things the following: 1. With a view to making the collection of personal data fair and lawful, the controller has to clearly define the purpose of the processing. 2. The controller has also to ensure that the data are adequate, relevant and not excessive in relation to the purpose for which they are collected. 3. The collection must be based on a legitimate ground (unambiguous consent, performance of a contract, compliance with a legal obligation, in pursuance of legitimate interests of the controller etc.) and the individual has the right of access to and the rectification or erasure of his personal data. 4. The individual has at least to be informed about the identity of the controller and his representative if any, the purpose of the collection, the recipients and about his rights 32 . 5. Another important aspect is the security of the processing which may require the controller, right from the collection on, to apply specific technical and organisational measures in order to protect the data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the data are transmitted over a network. Such measures shall ensure a level of security appropriate to the risks presented and the nature of the data. 6. As regards sensitive data, specific provisions, dealing in particular with security requirements, regulate their collection. 7. The Article 29 Data Protection Working Party considers that the development of a programme for the promotion of European data protection rules in a pragmatic way would also help controllers in third countries to better understand, implement and demonstrate privacy compliance. A European system of labels/web seals, open also to non-EU web sites, could be the cornerstone of such action. 17 April 2014 - ICANN's public consultation on 2013 RAA Data Retention Specification Data Elements and Legitimate Purposes for Collection and Retention 1. The Draft Specification should only require collection of personal data, which is genuinely necessary for the performance of the contract between the Registrar and the Registrant (e.g. billing) or for other compatible purposes such as fighting fraud related to domain name registration. This data should be retained for no longer than is necessary for these purposes. It would not be acceptable for the data to be retained for longer periods or for other, incompatible purposes, such as law enforcement purposes or to enforce copyright. 2. Retention of personal data originally collected for commercial purposes, and subsequently retained for law enforcement purposes, has been the subject of a recent landmark ruling by the European Court of Justice, which held Directive 2006/24/EC to be invalid, as an unjustified interference with those rights. The Court recognised that the retention of personal data might be considered appropriate for the purposes of the detection, investigation and prosecution of serious crime, but judged that the Directive 'exceeded the limits imposed by compliance with the principle of proportionality'. It is reasonable to expect requirements for retaining personal data to be subject to increasing scrutiny and legal challenges in the EU. And limit processing of this data to compatible purposes, such as proportionate measures to fight fraud related to domain name registration. Opinion 6/2014 - Opinion of the European Data Protection Supervisor on the Commission Communication on Internet Policy and Governance - Europe`s role in shaping the future of Internet Governance 1. Base the future development of Internet Governance on the respect of fundamental rights. We welcome this principle, but we stress the need to translate it into practical policy initiatives, which is not always sufficiently the case. 2. We emphasise that, in order to "sustain and develop the Internet as an essential part of life" and to create a "single, open, free, unfragmented network of networks" with a "safe, secure, sound and resilient architecture", Internet Governance should be built starting from commonly shared international rights and values. Consequently, privacy and data protection principles need to gain more weight within Internet Governance fora and mechanisms. 3. We note some positive developments at international level in recognising privacy and data protection as essential values for the internet. At the Net Mundial, a general consensus was reached on the need to protect privacy on the Internet, by pointing out that "The right to privacy must be protected. This includes not being subject to arbitrary or unlawful surveillance, collection, treatment and use of personal data. The right to the protection of the law against such interference should be ensured". 4. The Communication emphasizes that the Internet has become a key infrastructure with global dimensions and that, as a consequence, greater international balance within the existing structures would increase the probability of issuing legitimate outcomes. Finally the other documents seem to repeat or rewrite similar points that will not make this summary any easier to further what can be used as a defined process of how data can be collated for use and kept in the way that provides the privacy required. This shows that the EU or EC directive on the protection of personal data has been the benchmark and implemented to used to protect personal data and privacy. No specific mention of length of time to hold such data although I think 6 weeks has been mentioned in one document I think. Also the last couple of summarised documents are definitely more on the privacy relation of personal data but think there may show some relevance towards the items we collect that can reference how data can be seen. Hope I defined it better this time Regards R. Padilla MSc. -- Richard Padilla MSc

1 0

Re: [gnso-rds-pdp-data] Review of Additional articles 29 WP documents that may be of interest to PDP WG
by Richard Padilla April 13, 2016

April 13, 2016

Dear all After reviewing the documents in the section above the following can be summarised as follows: There has been enough discussion on the if I can call it the maintenance of how data should be kept in according to the laws of various countries as all have different laws that more or less try to do the same thing in different words and explanation. For e.g. 1. Directive 95/46/EC - the protection of individuals with regard to the processing of the personal data, in Article 6.1 b), which establishes that personal data must be "collected for specified, explicit and legitimate purpose and not further processed in a way incompatible with those purposes" 2. Note the purpose of conventional telephone directories is the disclosure of subscriber's telephone number starting from the knowledge of subscriber's name and that its use is limited to that specific purposes. 3. Must establish the balance of interests, the interests and risks to privacy at stake have to be identified and evaluated. Directive 97/66/EC gives helpful indications: as long as the minimum information necessary to identify a subscriber is at stake, thus this information can be included in conventional public directories unless the subscriber objects. It must be considered that the interest of the individual in being protected override the interests of controller or third parties. Therefore such processing is only legitimate if the individual has given his/her informed consent prior to any inclusion of his /her personal data in public directories for reverse or multi-criteria searches. 4. Specific and informed consent of the subscriber must be obtained prior to the inclusion of his personal data into all kinds of public directories which include all type of communication devices used for reverse or multi-criteria searches. There must be some given consent on how personal data can be used. 5. As most conclusions regard the directives of the EC previous WP on the Protection of Individuals with regards to protection of data takes the position that processing of said personal data in reverse directories or multi-criteria searching services without unambiguous and informed consent by subscriber is unfair and unlawful. Thus fully implementing and accepting the EC proposal for draft directive on processing personal data. 6. Article 15 of draft Convention could create the impression that the protection of human rights shall only be considered when it is "due" and shall on be "adequate". It can be seen as limiting the safeguards and procedures it would considerably lower if not fully undermine the protection of fundamental rights. 7. Finally with several EU countries implementing Directive 95/46/EC shows that national laws requires personal data can be in principle only be sent to non-EU countries if this country does provide an adequate level of protection of individuals with regard to the processing of their personal data. the level of protection in these countries must be checked. Otherwise if no adequate protection on offer in third country then transfer f personal data may nevertheless be necessary to fight against crime. This shows that the EU or EC directive on the protection of personal data has been the benchmark used to protected personal data. No specfic mention of length of time to hold such data although I think 6 weeks has been mentioned in one document I think. Let me know if I need to do more Regards R. Padilla MSc. -- Richard Padilla MSc

1 0

Data Team Checklist - 13 April 13:00
by Lisa Phifer April 13, 2016

April 13, 2016

Dear team data, Today's data team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw Thanks to all who have been posting summaries, which you will find hyperlinked in the attached checklist. There are still a couple of summaries outstanding, but everyone should now be reviewing the summaries already submitted, thinking about the questions posed to the team in yesterday's WG call. See https://community.icann.org/x/iTeAAw for the question list. Best, Lisa

2 1