April 2016 - gnso-rds-pdp-data

@EXT summaries - word version
by Mounier, Grégory April 13, 2016

April 13, 2016

Dear all, Same summaries - Word .doc versions. Greg ________________________________ From: Greg Mounier Sent: 12 April 2016 10:42:14 To: Mounier, Grégory Subject: summaries - word version ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

2 1

Summary: Common Position on Privacy and Data Protection Aspects of the Publication of Personal Data Contained in publicly available documents on the Internet
by Sana Ali April 12, 2016

April 12, 2016

Dear All, The International Working Group on Data Protection in Telecommunications' Common Position on Privacy and Data Protection Aspects of the Publication of Personal Data contained in publicly available Documents on the Internet adopted at the 27th meeting of the Working Group on 4/5 May 2000 in Rethymnon / Crete Data Elements: What data should be collected, stored, and disclosed? The Working Group notes that the "Working Party on the protection of individuals with regard to the processing of personal data" of Data Protection Commissioners in the European Union ("Article 29 Group") has addressed these issues extensively in their “Opinion 3/99 on Public Sector information and the Protection of Personal Data” and fully supports their findings. As the document referenced is not included in any of the subgroups’ lists, I recommend introducing Opinion No 3/99 of the Article 29 Working Party as its own document in all 3 subgroups. Please see below my summary of the relevant sections to this subgroup (Data Elements). They all address the question of how ‘personal data’ should be treated (and the conditions under which it can be collected/stored/disclosed). I shall reiterate my recommendation to include this document summary in the other subgroups as well, since it is an important and interesting opinion which speaks to both privacy frames and purpose requirements in addition to data elements. Relevant Sections Contained Within Referenced “Opinion No 3/99 on Public sector information and the protection of personal data” by the Working Party on the protection of individuals with regard to the processing of personal data One of the key aspects of this opinion is the availability of public sector information. At issue is a specific category of information held by public sector bodies known as "public" information, which would be made public subject to certain rules or for a particular purpose and based, implicitly or explicitly, on the State's desire for transparency with regard to its citizens. The objective of this Opinion is to provide input for the discussion on the protection of personal data, a dimension which must be taken into consideration when undertaking to grant greater access to public sector data, where such data relates to individuals. ~ THE RULES ON DATA PROTECTION APPLY TO PERSONAL DATA WHICH HAVE BEEN MADE PUBLIC Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data covers the principle of the right of public access to administrative documents and other factors which are relevant to the discussion The principle of purpose requires that personal data are collected for specific, explicit and legitimate purposes and are not subsequently processed in a manner which is incompatible with these purposes. Personal data to be made public do not constitute a homogeneous category which can be dealt with uniformly from a data protection point of view. Instead, a step-by-step analysis is needed of the rights of the data subject and the right of the public to access the data respectively. While there may be public access to data, such access may be subject to certain conditions (such as proof of legitimate interest). Alternatively, the purposes for which the data may be used, for example for commercial purposes or by the media, may be restricted. At this point it is worth mentioning that regardless of whether or not personal data are published, data subjects always has the right to access their data and, where necessary, to require that they be rectified or erased if they have not been processed in accordance with the Directive, and in particular if they are incomplete or inaccurate. THE NEW TECHNOLOGIES CAN HELP STRIKE A BALANCE BETWEEN THE PROTECTION OF PERSONAL DATA AND THE PUBLICATION OF SUCH DATA In addition to promoting access to public data, in particular by providing on-line access, the new technologies and some of the accompanying administrative measures can also help to ensure compliance with the main principles of data protection, such as end purpose, the principle of information, the right to object and the principle of security. However, these technologies do not provide an absolute guarantee against abuses of the principles of personal data protection described above. Directive 95/46/EC recognises the right of data subjects to be informed about the processing of data concerning them and stipulates that at the very least they have the right to object to legitimate processing. Data subjects must therefore be informed about the commercial usage of data concerning them and must be able to object to such usage by simple and effective means. Another possibility mentioned in the opinion was to obtain the data subject's consent for commercial usage. Data subjects must have given their consent unambiguously and in full knowledge of the facts, taking into account the fact that anyone applying for planning permission is required to submit a file which meets certain stipulations. CONCLUSION: Public access to data does not mean unfettered access: all Member States base their legislation on this philosophy. When personal data are made public, either by virtue of a regulation or because the data subject himself authorises it, the data subject is not deprived of protection, ipso facto and forever. He is guaranteed such protection by law in accordance with the fundamental principles of the right to privacy. In order to strike a balance between the right to privacy and the protection of personal data on the one hand, and the right of the general public to access public sector data on the other, conclusions must take account of the following factors and issues: - a case-by-case assessment of whether personal data can be published/should be accessible or not, and if so, under what conditions and on which media (computerised or not, Internet dissemination or not, etc.); - the principles of purpose and legitimacy; - the obligation to inform the data subject; - the data subject's right to object; - the use of the new technologies to help protect the right to privacy. These factors should be taken into account not just in situations where publication or access is already regulated, but also in situations where regulation does not appear necessary, with a view to satisfying the general public's demand for access to public sector information, including personal data. Warm wishes, Sana Ali sana.ali2030(a)gmail.com <mailto:sana.ali2030@gmail.com> https://ca.linkedin.com/in/sanaali2030 <https://ca.linkedin.com/in/sanaali2030>

1 0

Data Team Checklist - 12 April 13:00
by Lisa Phifer April 12, 2016

April 12, 2016

Dear team data, Today's data team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw Thanks to all who have been posting summaries, which you will find hyperlinked in the attached checklist. Michele will be using this to discuss the team's progress during today's WG call. Best, Lisa

2 1

Re: [gnso-rds-pdp-data] @EXT summaries
by Lisa Phifer April 12, 2016

April 12, 2016

Thanks Greg! For ease of access by those who do not have Pages, attached are Word versions of the summaries just submitted to the list by Greg. >From: Greg Mounier >Sent: 12 April 2016 05:23:14 >To: Mounier, Grégory >Subject: summaries > >Dear all, > >Please find attached summaries of relevant >sections related to data registration elements >in the following fours documents: > >SAC055 and SAC058 (both partly reviewed by Holly), > > >Registrar Accreditation Agreement 2013 - >including RAA WHOIS requirements for registrants 2013, > > >and WHOIS Registrant Identification Study 2013. > > >Apologies for the delay. > >Best regards, > >Greg > > >******************* > >DISCLAIMER : This message is sent in confidence >and is only intended for the named recipient. If >you receive this message by mistake, you may not >use, copy, distribute or forward this message, >or any part of its contents or rely upon the information contained in it. >Please notify the sender immediately by e-mail >and delete the relevant e-mails from any >computer. This message does not constitute a >commitment by Europol unless otherwise indicated. > >*******************

1 0

@EXT summaries
by Mounier, Grégory April 12, 2016

April 12, 2016

________________________________ From: Greg Mounier Sent: 12 April 2016 05:23:14 To: Mounier, Grégory Subject: summaries Dear all, Please find attached summaries of relevant sections related to data registration elements in the following fours documents: SAC055 and SAC058 (both partly reviewed by Holly), Registrar Accreditation Agreement 2013 - including RAA WHOIS requirements for registrants 2013, and WHOIS Registrant Identification Study 2013. Apologies for the delay. Best regards, Greg ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

1 0

Data Team Checklist - 11 April 15:00
by Lisa Phifer April 11, 2016

April 11, 2016

1 0

Analysis....
by Deacon, Alex April 11, 2016

April 11, 2016

Hi, My analysis of the following 3 documents. Question: What data elements should be collected, stored and disclosed? Declaration of the Committee of Ministers on ICANN, human rights and the rule of law This document does not make any specific statements regarding the collection, storage and disclosure of user data elements. It does however make one very general statement in paragraph 3 that is germane to “disclosure” of information , e.g. "In certain criminal investigations, criminal justice authorities need to secure evidence on computer systems and to identify offenders, subject to the conditions and safeguards providing for the adequate protection of human rights pursuant to Article 15 of the Convention on Cybercrime (ETS No. 185)." In addition, this document references two additional documents that I did not review but may be relevant * Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108) * Article 15 of the Convention on Cybercrime (ETS No. 185) Dissenting Report from Stephanie Perrin (24 Jun 2014) The focus of this document is not on the specifics of individual data elements but on topics more relevant to the other sub groups. There are however two mentions of data elements on page one. Specifically * Legal Contact Email and Legal Contact Phone Number * Registrant Address, Registrant Phone Number It is important to note however that these mentions occur in a section where the author (Stephanie) states that she does not agree with the consensus of the EWG Final Report. Process Framework for a PDP on Next-Generation RDS This document does not make any specific statements regarding the collection, storage and disclosure of user data elements.

4 5

Summaries of Relevant Sections from International Working Group on Data Protection in Telecommunications and Media Documents - Data
by Sana Ali April 11, 2016

April 11, 2016

• Data Elements: What data should be collected, stored, and disclosed? Common Position on data protection aspects in the Draft Convention on cyber-crime of the Council of Europe In this respect the Working Group fully supports the findings of the European Data Protection Commissioners Conference that such retention of traffic data by Internet service providers would be an improper invasion of the fundamental rights guaranteed to individuals by the European Convention on Human Rights.This goes also for storing data revealing the use of the Internet by individuals. Existing powers for tracing crimes should not be extended in a way that invades privacy until the need for such measures has been clearly demonstrated. The Working Group has in the past stated that any Interception of Private Communications should be subject to appropriate safeguards Ten Commandments to protect Privacy in the Internet World Common Position on Incorporation of telecommunications-specific principles in multilateral privacy agreements Data Austerity: Telecommunications infrastructure has to be designed in a way that as few personal data are used to run the networks and services as technically possible. Virtual Right to be Alone: Nobody must be forced to let his or her personal data be published in directories or other indices. Every user has to be given the right to object to his or her data being collected by a search engine or other agents. Every user has to be given the right and the technical means to prevent the intrusion of external software into his own devices. Common Position on Privacy and Data Protection aspects of the Registration of Domain Names on the Internet • The amount of data collected and made publicly available in the course of the registration of a domain name should be restricted to what is essential to fulfil the purpose specified. In this respect the Working Group has reservations against a mandatory publication of any data exceeding name (which might also be the name of a company and not of a natural person), address and e-mailaddress in cases where the domain name holder is not himself responsible for the technical maintenance of the domain but has this done through a service provider (as is the case with many private persons who have registered domain names). • Any technical mechanism to be introduced to access the data collected from the registrants must furthermore have safeguards to meet the principle of purpose limitation and avoidance of the possibility to unauthorised secondary use of the registrant's data. Common Position relating to Reverse Directories • It is in any case necessary to endow the persons with the right to be informed by their provider of telephone or e-mail service, at the time of the collection of data concerning them, or if they have already subscribed, by a specific means of information, of the existence of services of reverse search and - if express consent is not required - of their right to object, free of charge, to such a search. Comments on the data protection impact of the revision of the ICANN RAA concerning accuracy and data retention of WHOIS data • The Working Party recalls its previous contributions to the process of collecting and disclosing WHOIS data, as included in the Opinion 2/2003 on the application of the data protection principles to WHOIS directories4 as well as its letters of 22 June 2006 to the Board of Directors of ICANN5 and of 12 March 2007 to the Chairman of the Board of Directors of ICANN6 in which the relevant data protection principles have been outlined • In assessing these proposals, ICANN should be aware that the purpose of collecting and publishing contact details in the WHOIS database is to facilitate contact about technical issues. The original purpose definition reads: “The purpose of the gTLD Whois service is to provide information sufficient to contact a responsible party for a particular gTLD domain name who can resolve, or reliably pass on data to a party who can resolve, issues related to the configuration of the records associated with the domain name within a DNS name server." • The Working Party strongly objects to the introduction of data retention by means of a contract issued by a private corporation in order to facilitate (public) law enforcement. If there is a pressing social need for specific collections of personal data to be available for law enforcement, and the proposed data retention is proportionate to the legitimate aim pursued, it is up to national governments to introduce legislation that meets the demands of article 8 of The European data retention directive 2006/24/EC imposes data retention obligations on providers of public electronic communication networks and services. Registrars are not such providers and are therefore not subjected to this European data retention obligation. the European Convention on Human Rights and article 17 of the International Covenant on Civil and Political rights. Sana Ali sana.ali2030(a)gmail.com <mailto:sana.ali2030@gmail.com> https://ca.linkedin.com/in/sanaali2030 <https://ca.linkedin.com/in/sanaali2030>

2 1

Data Team Checklist - 7 April
by Lisa Phifer April 8, 2016

April 8, 2016

Hello all, Another updated data team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw Just follow the link above if you're looking for the latest daily update of any team's checklist. The data team is down to just three documents left without volunteers: * Council of Europe Declaration Declaration of the Committee of Ministers on ICANN, human rights and the rule of law (3 June 2015) * Statements/Blogs by Perrin * Process Framework for a PDP on Next-Generation RDS, Page 9, Row 4 (hint: see questions/subquestions mind map) If you'd like to review and summarize any of these remaining docs, please reply to this message. Best, Lisa

3 4

Re: [gnso-rds-pdp-data] Data Input Documents Checklist
by Lisa Phifer April 6, 2016

April 6, 2016

2 1