- gnso-rds-pdp-data - lists.icann.org

REMINDER FW: Notes and for your review - sub-team draft responses to questions
by Marika Konings April 29, 2016

April 29, 2016

From: <gnso-rds-pdp-data-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Tuesday 26 April 2016 at 11:40 To: "gnso-rds-pdp-data(a)icann.org" <gnso-rds-pdp-data(a)icann.org> Subject: [gnso-rds-pdp-data] Notes and for your review - sub-team draft responses to questions Dear All, Please find below the notes from today¹s data sub-team meeting as well as the latest draft responses to the questions attached. As a reminder, you are encouraged to provide input by the end of this week (Friday 29 April) in view of finalising the sub-teams input to the full WG by the next WG meeting. Best regards, Marika Notes * For the latest versions of the check lists and summaries, please see https://community.icann.org/x/p4xlAw . * Membership of the sub-teams: https://community.icann.org/x/DDCAAw Data Sub-Team: * Roll call will be taken from Adobe Connect room * Reminder, please complete / update SOIs * Objective to complete the template to provide input to the full WG * Questions to be answered circulated to the list earlier today in the form of a template * None of the sub-teams exists in isolation * Possible area for discussion: work plan and order of questions - especially with regards to question 1 (users & purposes), question 4 (what data should be collected, stored and disclosed) and question 5 (what steps are needed to protect data and privacy). Does the data team have an opinion on the order of how these should be covered and/or synced up. * What data, what users, what privacy - could be order of approach. Others suggest that purpose should be dealt with first. * This is really a venn diagram - a large set of possible data, a subset of data for each user/purpose, and a subset of that as permitted by laws in each applicable jurisdiction. (not a perfect description, but the point is that all are inter-related) * Submit comments / edits to draft responses by the end of this week in view of finalising input by next week's meeting.

1 0

Notes and for your review - sub-team draft responses to questions
by Marika Konings April 26, 2016

April 26, 2016

Dear All, Please find below the notes from today¹s data sub-team meeting as well as the latest draft responses to the questions attached. As a reminder, you are encouraged to provide input by the end of this week (Friday 29 April) in view of finalising the sub-teams input to the full WG by the next WG meeting. Best regards, Marika Notes * For the latest versions of the check lists and summaries, please see https://community.icann.org/x/p4xlAw . * Membership of the sub-teams: https://community.icann.org/x/DDCAAw Data Sub-Team: * Roll call will be taken from Adobe Connect room * Reminder, please complete / update SOIs * Objective to complete the template to provide input to the full WG * Questions to be answered circulated to the list earlier today in the form of a template * None of the sub-teams exists in isolation * Possible area for discussion: work plan and order of questions - especially with regards to question 1 (users & purposes), question 4 (what data should be collected, stored and disclosed) and question 5 (what steps are needed to protect data and privacy). Does the data team have an opinion on the order of how these should be covered and/or synced up. * What data, what users, what privacy - could be order of approach. Others suggest that purpose should be dealt with first. * This is really a venn diagram - a large set of possible data, a subset of data for each user/purpose, and a subset of that as permitted by laws in each applicable jurisdiction. (not a perfect description, but the point is that all are inter-related) * Submit comments / edits to draft responses by the end of this week in view of finalising input by next week's meeting.

1 0

Data Sub Team question templates for discussion
by Michele Neylon - Blacknight April 26, 2016

April 26, 2016

All Apologies for sending this so close to the call. On the call later today we probably should be looking at these questions to help move things along - the other groups will be doing something similar. (i) Did this input inventory produce any insights to inform the WG’s work plan? Draft response: (ii) Which inputs are likely to be the most relevant during WG deliberations and why? Draft response (based on input received during 20/4 meeting): • Whois Task Force Final Report, because [to be completed] • SAC 054, because [to be completed] • EWG Recommendations, including tutorials and FAQs, because [to be completed] • RA Spec 4, because [to be completed] (iii) Which inputs, if any, generated the most discussion within the small team? Draft response: (iv) Which inputs may be obsolete or super-ceded by subsequent work? Draft response: (v) What input gaps, if any, may need to be addressed later? Draft response: (vi) Other key takeaways from this input inventory the team wishes to share with the WG Draft response: Bear in mind that, as previously noted, any and all inputs that are relevant are to be considered at some point. Nobody is suggesting that any document or input be discarded at this juncture (unless it’s been completely superseded as per the above). The idea behind this exercise (and related ones) is to help navigate the huge amount of information that is “out there” and to help the group focus on the ones that have potentially a higher importance. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845

2 1

Data Team Consolidated Summary - no updates for 21 April
by Lisa Phifer April 22, 2016

April 22, 2016

Dear data team, Just so that you don't think I forgot to send you a daily update message... There have been no updates to the Data Team Consolidated Summary PDF since it was posted at: https://community.icann.org/x/p4xlAw Going forward, staff will maintain the master consolidated summary. The Word version of the consolidated summary is also available on the above wiki page. - All team members are asked to review consolidated summaries (especially those within your own area of expertise) to ensure that key passages of each doc have at least been identified. - Those of you who drafted summaries are also asked to consider team feedback on your summary. Especially for docs which the team finds to be the most relevant to the charter question on data elements, please draft a few concise bullet points summarizing the doc's relevance. - All team members are encouraged to discuss on-list which of the identified docs are most relevant to the question of data elements and why, along with other questions listed here: https://community.icann.org/download/attachments/58734473/RDS-InputTeams-Pl… Please send all feedback on data team summaries and document relevance to this team's email list, gnso-rds-pdp-data(a)icann.org. Thanks all for your efforts, Lisa

1 0

Data Team Checklist - 20 April
by Lisa Phifer April 20, 2016

April 20, 2016

1 0

Data Team Summaries - Single PDF - 19 April
by Lisa Phifer April 20, 2016

April 20, 2016

Dear team data, Attached please find a single PDF containing all of the summaries drafted by members of the data team thus far. Hopefully I have faithfully copied in all of your summaries, listed in the same order as they appear in the data team checklist. For each summary, the "Title" or "Correspondence" is hyperlinked to the orginal document being summarized, while "Summarized by" is hyperlinked to the data team email message from which the summary was copied. Best, Lisa

1 0

Moving Things Along .. Next Steps
by Michele Neylon - Blacknight April 20, 2016

April 20, 2016

All Thanks for all your hard work over the last few weeks. You’ve all been fantastic and it is appreciated. So what now? On tomorrow’s call we’re going to start moving towards bringing back the input from the subgroups to the main group, so if you could consider the following it would be helpful: During the 20th April RDS PDP WG call, each team will be asked to report on its progress and share preliminary thoughts about the questions posed during last week’s WG call. To kick-start this discussion, I ask that each of you try to answer this question: Which “top 5" inputs summarised by this team are likely to be the most helpful to this PDP and why? For example, does the input define potential requirements that this WG should take into consideration during phase 1 of this PDP? Does the input identify dependencies that will shape our work plan? Our team will have an opportunity to share initial answers during the WG call. Please reply to this list today with your own initial thoughts so that we can prepare to contribute to discussion during the WG call. We will not be expected to have a team-agreed answer this week, but we need to at least begin this discussion. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845

4 3

Re: [gnso-rds-pdp-data] Data Team Checklist - 19 April 13:00
by Lisa Phifer April 19, 2016

April 19, 2016

1 0

Data Team Checklist - 19 April 13:00
by Lisa Phifer April 19, 2016

April 19, 2016

2 1

@EXT Summary of 2013 RAA data retention specification data elements
by Mounier, Grégory April 19, 2016

April 19, 2016

Hi everyone, Please find attached the summary of a document suggested by Lisa. This document lists an describes all data elements that can be collected by the registrars in accordance with the 2013 RAA and it provides reasons and legitimate purposes for that collection and retention. Greg ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

1 0

Data Team Checklist - 18 April 13:00
by Lisa Phifer April 18, 2016

April 18, 2016

Dear team data, Today's updated data team checklist is attached and also posted to the wiki at: https://community.icann.org/x/p4xlAw Michele will be following up on next steps for this team to discuss questions listed here: https://community.icann.org/x/iTeAAw Best, Lisa

2 1

Mailing List Configuration Update
by Michele Neylon - Blacknight April 18, 2016

April 18, 2016

All ICANN has made some changes to how the mailing list is configured which should hopefully address the issue where people accidentally reply to the sender instead of the list. Details below: “Dear all, Please see below the final update from IT, you may wish to share it with your subgroups, we have cleared with IT that it is fine to circulate the explanation: "Today I went ahead and updated the settings on all the mailman mailing lists so that the sender and related headers are configured in the same manner. In most cases the reply and reply-all functionality will work as expected. However if the sender has very strict sender verification policies published then the reply-all functionality will not work on Outlook for PC. Fortunately these strict policies are not very prevalent at this time. Sender domain email authentication policies or signatures such as DMARC, SPF/DKIM are used to tell if the sending email server is authorized to send from a specific domain. Not all systems receiving emails check DMARC or SPF settings and not all domains have SPF or DMARC configured. Furthermore there are policies in place saying what to do when you receive an email from an unauthorized sender, the options are reject, quarantine or none (none is up to the recipient). Mailing list servers have historically resent emails from the sender. So if david.prangnell(a)gmail.com sent an email to an ICANN mailing list mailinglist(a)icann.org the ICANN mailing list server would resend the email out to all the recipients from david.prangnell(a)gmail.com. This is problematic because ICANN is not authorized to send emails from gmail.com. With this historical set up, reply and reply-all work as expected, however as explained above, if the sender has DMARC configured with a policy to reject or quarantine, and the recipient is doing sender verification, these emails will not be received. Today I configured our mailing list servers to change the from address to being the list only in the cases where the sender has the DMARC policy set to reject or quarantine. I have tested the reply and reply-all behavior on the following email clients: * Outlook PC * Outlook Mac * Gmail * Yahoo The mailing lists should behave as follows: * When a member of a list clicks on "Reply" the email should go to the sender only. * When a member of a list clicks on "Reply-all" the email should go to the sender and the list. The reply-all behavior works as expected unless the sender is from Yahoo, or any sender that has a DMARC policy set to reject or quarantine.’ Thank you all for your patience here, Kind regards Nathalie " -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845

1 0

Re: [gnso-rds-pdp-data] Further summaries
by Richard Padilla April 16, 2016

April 16, 2016

Looked at both didn't see anything that may be useful from Article 29 WP 5 Recommendation 2/97 <http://ec.europa.eu/justice/data-protection/article-29/documentation/opinio…> … There is one paragraph I may have missed from the article below ICANN's public consultation on 2013 RAA Data Retention Specification Data Elements and - Legitimate Purposes for Collection and Retention <https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/C…> (17 April 2014) … Summary: 1. Retention of personal data originally collected for commercial purposes, and subsequently retained for law enforcement purposes, has been the subject of a recent landmark ruling by the European Court of Justice, which held Directive 2006/24/EC to be invalid, as an unjustified interference with those rights. The Court recognised that the retention of personal data might be considered appropriate for the purposes of the detection, investigation and prosecution of serious crime, but judged that the Directive 'exceeded the limits imposed by compliance with the principle of proportionality'. It is reasonable to expect requirements for retaining personal data to be subject to increasing scrutiny and legal challenges in the EU. It specifies that EU law was under review and was possible changing after 3/2014 where by a new General Data Protection Regulation which is designed to replace Directive 95/46/EC and be directly applicable in each of the twenty-eight EU Member States. There is therefore now a more compelling need than ever before for ICANN to apply the waiver of the retention period under the 2013 RAA Data Retention Specification uniformly to all EU Member States as requested in the 'harmonised statement' of the Working Party issued by letter of 6 June 2013. Therefore my opinion will be that if the above had happen then there was an expectation that ICANN was going to have to abide by the new directive and ensure that these rules are abide by within the EU or EC now this doesn't not mention anything for other regions of the world like the Americas etc. but a possible argument of how the laws have changed and been implemented for organisations to follow is described above in the summary. Regards R. Padilla MSc. -- Richard Padilla MSc

5 8

RFC7485
by nathalie coupet April 15, 2016

April 15, 2016

RegionalInternet Registries (RIRs) and Domain Name Registries (DNRs) havehistorically maintained a lookup service to permit public access to someportion of the registry database. Most registries offer the servicevia the WHOIS protocol [RFC3912], with additionalservices beingoffered via World Wide Web pages, bulk downloads, and other services,such as Routing Policy Specification Language (RPSL) [RFC2622]. Thisdocument records an inventory of registry data objects tofacilitatediscussions of registration data objects. The RegistrationData Access Protocol (RDAP) ([RFC7480], [RFC7482], [RFC7483], and [RFC7484]) was developed using this inventoryas input.=> Some data elements were not supported by allRIRs, andsome were given different labels by different RIRs. Also, there wereidentical labels used for different data elements by different RIRs. o All ofthe 124 domain registries have the object names in their responses,although they are in various formats. o Of the118 WHOIS services contacted, 65 registries show their registrantcontact. About half of the registries (60 registries) supportadmin contact information. There are 47 registries, which is about one third of thetotal number, that have technical and billingcontact information. Only seven of the 124 registries give their abuse email ina "remarks" section. No explicit abuse contact information isprovided. o There are mainly twopresentation formats. One is key-value; the other is data block format. Most of thedomain-related WHOIS information is included in the top 10 data elements.Other information like name server and registrar name is also supportedby most registries. Nathalie Coupet

1 0

Data Team Checklist - 15 April 13:00
by Lisa Phifer April 15, 2016

April 15, 2016

Dear team data, Today's data team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw Three new docs and a couple of summaries have been added to the list. Please note that, for new docs, all that is needed from the data team at this juncture is to summarize aspects of the documents which may impact this PDP WG's deliberations on specific data elements. Everyone should now be reviewing the summaries already submitted, thinking about questions posed to each team in https://community.icann.org/x/iTeAAw . You are encouraged to share possible data team answers to these questions on this list. For easy review of email threads, see this list's archive: http://mm.icann.org/pipermail/gnso-rds-pdp-data/ Best, Lisa

1 0

Re: [gnso-rds-pdp-data] Further summary
by Richard Padilla April 15, 2016

April 15, 2016

Dear All, Being a little proactive Benny sent a link of the actual new rules that were pushed through yesterday at EEC here a quick summary: Agreed 14/4 - http://www.europarl.europa.eu/news/en/news-room/20160407IPR21776/Data-prote… 1. *New EU data protection rules which aim to give citizens back control of their personal data and create a high, uniform level of data protection across the EU fit for the digital era.* 2. "The regulation will also create clarity for businesses by establishing a single law across the EU. The new law creates confidence, legal certainty and fairer competition". 3. The new rules include provisions on: 1. a right to be forgotten, 2. "clear and affirmative consent" to the processing of private data by the person concerned, 3. a right to transfer your data to another service provider, 4. the right to know when your data has been hacked, 5. ensuring that privacy policies are explained in clear and understandable language, and 6. stronger enforcement and fines up to 4% of firms' total worldwide annual turnover, as a deterrent to breaking the rules. Therefore a need to re-evaluate how data is being protected regardless of a personal data due to EU MEPs passing this to law wonder how this will be seen in the rest of world. Regards R -- Richard Padilla MSc

2 1

Data Team Checklist - 14 April 14:00
by Lisa Phifer April 14, 2016

April 14, 2016

Dear team data, Today's data team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw Almost all of the summaries have now been submitted. Thanks all for your efforts to get this team ready for its next steps. Best, Lisa

1 0

Re: [gnso-rds-pdp-data] Summary of Article 29 - Data Protection Working Party
by Richard Padilla April 14, 2016

April 14, 2016

Dear all, As I hadn't properly defined the summary I produced here a revised copy of my summary. After reviewing the documents in the section above the following can be summarised as follows: There has been enough discussion on the if I can call it the maintenance of how data should be kept in according to the laws of various countries as all have different laws that more or less try to do the same thing in different words and explanation. For e.g. Opinion 5/2000 - The use of Public Directories for Reverse or Multi-criteria Searching Services 1. Directive 95/46/EC - the protection of individuals with regard to the processing of the personal data, in Article 6.1 b), which establishes that personal data must be "collected for specified, explicit and legitimate purpose and not further processed in a way incompatible with those purposes". 2. Note the purpose of conventional telephone directories is the disclosure of subscriber's telephone number starting from the knowledge of subscriber's name and that its use is limited to that specific purposes. 3. Must establish the balance of interests, the interests and risks to privacy at stake have to be identified and evaluated. Directive 97/66/EC gives helpful indications: as long as the minimum information necessary to identify a subscriber is at stake, thus this information can be included in conventional public directories unless the subscriber objects. It must be considered that the interest of the individual in being protected override the interests of controller or third parties. Therefore such processing is only legitimate if the individual has given his/her informed consent prior to any inclusion of his /her personal data in public directories for reverse or multi-criteria searches. 4. Specific and informed consent of the subscriber must be obtained prior to the inclusion of his personal data into all kinds of public directories which include all type of communication devices used for reverse or multi-criteria searches. There must be some given consent on how personal data can be used. 5. As most conclusions regard the directives of the EC previous WP on the Protection of Individuals with regards to protection of data takes the position that processing of said personal data in reverse directories or multi-criteria searching services without unambiguous and informed consent by subscriber is unfair and unlawful. Thus fully implementing and accepting the EC proposal for draft directive on processing personal data. t Opinion 4/2001 - On the Council of Europe's Draft Convention on Cyber-Crime 1. Article 15 of draft Convention could create the impression that the protection of human rights shall only be considered when it is "due" and shall on be "adequate". It can be seen as limiting the safeguards and procedures it would considerably low if not fully undermine the protection of fundamental rights. 2. Finally with several EU countries implementing Directive 95/46/EC shows that national laws requires personal data can be in principle only be sent to non-EU countries if this country does provide an adequate level of protection of individuals with regard to the processing of their personal data. The level of protection in these countries must be checked. Otherwise if no adequate protection on offer in third country then transfer f personal data may nevertheless be necessary to fight against crime. Adopted 30/2002 - Working document on determining the international application of EU data protection law to personal data processing on the Internet by non-EU based web site In all these cases, the application of EU data protection law means among other things the following: 1. With a view to making the collection of personal data fair and lawful, the controller has to clearly define the purpose of the processing. 2. The controller has also to ensure that the data are adequate, relevant and not excessive in relation to the purpose for which they are collected. 3. The collection must be based on a legitimate ground (unambiguous consent, performance of a contract, compliance with a legal obligation, in pursuance of legitimate interests of the controller etc.) and the individual has the right of access to and the rectification or erasure of his personal data. 4. The individual has at least to be informed about the identity of the controller and his representative if any, the purpose of the collection, the recipients and about his rights 32 . 5. Another important aspect is the security of the processing which may require the controller, right from the collection on, to apply specific technical and organisational measures in order to protect the data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the data are transmitted over a network. Such measures shall ensure a level of security appropriate to the risks presented and the nature of the data. 6. As regards sensitive data, specific provisions, dealing in particular with security requirements, regulate their collection. 7. The Article 29 Data Protection Working Party considers that the development of a programme for the promotion of European data protection rules in a pragmatic way would also help controllers in third countries to better understand, implement and demonstrate privacy compliance. A European system of labels/web seals, open also to non-EU web sites, could be the cornerstone of such action. 17 April 2014 - ICANN's public consultation on 2013 RAA Data Retention Specification Data Elements and Legitimate Purposes for Collection and Retention 1. The Draft Specification should only require collection of personal data, which is genuinely necessary for the performance of the contract between the Registrar and the Registrant (e.g. billing) or for other compatible purposes such as fighting fraud related to domain name registration. This data should be retained for no longer than is necessary for these purposes. It would not be acceptable for the data to be retained for longer periods or for other, incompatible purposes, such as law enforcement purposes or to enforce copyright. 2. Retention of personal data originally collected for commercial purposes, and subsequently retained for law enforcement purposes, has been the subject of a recent landmark ruling by the European Court of Justice, which held Directive 2006/24/EC to be invalid, as an unjustified interference with those rights. The Court recognised that the retention of personal data might be considered appropriate for the purposes of the detection, investigation and prosecution of serious crime, but judged that the Directive 'exceeded the limits imposed by compliance with the principle of proportionality'. It is reasonable to expect requirements for retaining personal data to be subject to increasing scrutiny and legal challenges in the EU. And limit processing of this data to compatible purposes, such as proportionate measures to fight fraud related to domain name registration. Opinion 6/2014 - Opinion of the European Data Protection Supervisor on the Commission Communication on Internet Policy and Governance - Europe`s role in shaping the future of Internet Governance 1. Base the future development of Internet Governance on the respect of fundamental rights. We welcome this principle, but we stress the need to translate it into practical policy initiatives, which is not always sufficiently the case. 2. We emphasise that, in order to "sustain and develop the Internet as an essential part of life" and to create a "single, open, free, unfragmented network of networks" with a "safe, secure, sound and resilient architecture", Internet Governance should be built starting from commonly shared international rights and values. Consequently, privacy and data protection principles need to gain more weight within Internet Governance fora and mechanisms. 3. We note some positive developments at international level in recognising privacy and data protection as essential values for the internet. At the Net Mundial, a general consensus was reached on the need to protect privacy on the Internet, by pointing out that "The right to privacy must be protected. This includes not being subject to arbitrary or unlawful surveillance, collection, treatment and use of personal data. The right to the protection of the law against such interference should be ensured". 4. The Communication emphasizes that the Internet has become a key infrastructure with global dimensions and that, as a consequence, greater international balance within the existing structures would increase the probability of issuing legitimate outcomes. Finally the other documents seem to repeat or rewrite similar points that will not make this summary any easier to further what can be used as a defined process of how data can be collated for use and kept in the way that provides the privacy required. This shows that the EU or EC directive on the protection of personal data has been the benchmark and implemented to used to protect personal data and privacy. No specific mention of length of time to hold such data although I think 6 weeks has been mentioned in one document I think. Also the last couple of summarised documents are definitely more on the privacy relation of personal data but think there may show some relevance towards the items we collect that can reference how data can be seen. Hope I defined it better this time Regards R. Padilla MSc. -- Richard Padilla MSc

1 0

Re: [gnso-rds-pdp-data] Review of Additional articles 29 WP documents that may be of interest to PDP WG
by Richard Padilla April 13, 2016

April 13, 2016

Dear all After reviewing the documents in the section above the following can be summarised as follows: There has been enough discussion on the if I can call it the maintenance of how data should be kept in according to the laws of various countries as all have different laws that more or less try to do the same thing in different words and explanation. For e.g. 1. Directive 95/46/EC - the protection of individuals with regard to the processing of the personal data, in Article 6.1 b), which establishes that personal data must be "collected for specified, explicit and legitimate purpose and not further processed in a way incompatible with those purposes" 2. Note the purpose of conventional telephone directories is the disclosure of subscriber's telephone number starting from the knowledge of subscriber's name and that its use is limited to that specific purposes. 3. Must establish the balance of interests, the interests and risks to privacy at stake have to be identified and evaluated. Directive 97/66/EC gives helpful indications: as long as the minimum information necessary to identify a subscriber is at stake, thus this information can be included in conventional public directories unless the subscriber objects. It must be considered that the interest of the individual in being protected override the interests of controller or third parties. Therefore such processing is only legitimate if the individual has given his/her informed consent prior to any inclusion of his /her personal data in public directories for reverse or multi-criteria searches. 4. Specific and informed consent of the subscriber must be obtained prior to the inclusion of his personal data into all kinds of public directories which include all type of communication devices used for reverse or multi-criteria searches. There must be some given consent on how personal data can be used. 5. As most conclusions regard the directives of the EC previous WP on the Protection of Individuals with regards to protection of data takes the position that processing of said personal data in reverse directories or multi-criteria searching services without unambiguous and informed consent by subscriber is unfair and unlawful. Thus fully implementing and accepting the EC proposal for draft directive on processing personal data. 6. Article 15 of draft Convention could create the impression that the protection of human rights shall only be considered when it is "due" and shall on be "adequate". It can be seen as limiting the safeguards and procedures it would considerably lower if not fully undermine the protection of fundamental rights. 7. Finally with several EU countries implementing Directive 95/46/EC shows that national laws requires personal data can be in principle only be sent to non-EU countries if this country does provide an adequate level of protection of individuals with regard to the processing of their personal data. the level of protection in these countries must be checked. Otherwise if no adequate protection on offer in third country then transfer f personal data may nevertheless be necessary to fight against crime. This shows that the EU or EC directive on the protection of personal data has been the benchmark used to protected personal data. No specfic mention of length of time to hold such data although I think 6 weeks has been mentioned in one document I think. Let me know if I need to do more Regards R. Padilla MSc. -- Richard Padilla MSc

1 0

Data Team Checklist - 13 April 13:00
by Lisa Phifer April 13, 2016

April 13, 2016

Dear team data, Today's data team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw Thanks to all who have been posting summaries, which you will find hyperlinked in the attached checklist. There are still a couple of summaries outstanding, but everyone should now be reviewing the summaries already submitted, thinking about the questions posed to the team in yesterday's WG call. See https://community.icann.org/x/iTeAAw for the question list. Best, Lisa

2 1

@EXT summaries - word version
by Mounier, Grégory April 13, 2016

April 13, 2016

Dear all, Same summaries - Word .doc versions. Greg ________________________________ From: Greg Mounier Sent: 12 April 2016 10:42:14 To: Mounier, Grégory Subject: summaries - word version ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

2 1

Summary: Common Position on Privacy and Data Protection Aspects of the Publication of Personal Data Contained in publicly available documents on the Internet
by Sana Ali April 12, 2016

April 12, 2016

Dear All, The International Working Group on Data Protection in Telecommunications' Common Position on Privacy and Data Protection Aspects of the Publication of Personal Data contained in publicly available Documents on the Internet adopted at the 27th meeting of the Working Group on 4/5 May 2000 in Rethymnon / Crete Data Elements: What data should be collected, stored, and disclosed? The Working Group notes that the "Working Party on the protection of individuals with regard to the processing of personal data" of Data Protection Commissioners in the European Union ("Article 29 Group") has addressed these issues extensively in their “Opinion 3/99 on Public Sector information and the Protection of Personal Data” and fully supports their findings. As the document referenced is not included in any of the subgroups’ lists, I recommend introducing Opinion No 3/99 of the Article 29 Working Party as its own document in all 3 subgroups. Please see below my summary of the relevant sections to this subgroup (Data Elements). They all address the question of how ‘personal data’ should be treated (and the conditions under which it can be collected/stored/disclosed). I shall reiterate my recommendation to include this document summary in the other subgroups as well, since it is an important and interesting opinion which speaks to both privacy frames and purpose requirements in addition to data elements. Relevant Sections Contained Within Referenced “Opinion No 3/99 on Public sector information and the protection of personal data” by the Working Party on the protection of individuals with regard to the processing of personal data One of the key aspects of this opinion is the availability of public sector information. At issue is a specific category of information held by public sector bodies known as "public" information, which would be made public subject to certain rules or for a particular purpose and based, implicitly or explicitly, on the State's desire for transparency with regard to its citizens. The objective of this Opinion is to provide input for the discussion on the protection of personal data, a dimension which must be taken into consideration when undertaking to grant greater access to public sector data, where such data relates to individuals. ~ THE RULES ON DATA PROTECTION APPLY TO PERSONAL DATA WHICH HAVE BEEN MADE PUBLIC Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data covers the principle of the right of public access to administrative documents and other factors which are relevant to the discussion The principle of purpose requires that personal data are collected for specific, explicit and legitimate purposes and are not subsequently processed in a manner which is incompatible with these purposes. Personal data to be made public do not constitute a homogeneous category which can be dealt with uniformly from a data protection point of view. Instead, a step-by-step analysis is needed of the rights of the data subject and the right of the public to access the data respectively. While there may be public access to data, such access may be subject to certain conditions (such as proof of legitimate interest). Alternatively, the purposes for which the data may be used, for example for commercial purposes or by the media, may be restricted. At this point it is worth mentioning that regardless of whether or not personal data are published, data subjects always has the right to access their data and, where necessary, to require that they be rectified or erased if they have not been processed in accordance with the Directive, and in particular if they are incomplete or inaccurate. THE NEW TECHNOLOGIES CAN HELP STRIKE A BALANCE BETWEEN THE PROTECTION OF PERSONAL DATA AND THE PUBLICATION OF SUCH DATA In addition to promoting access to public data, in particular by providing on-line access, the new technologies and some of the accompanying administrative measures can also help to ensure compliance with the main principles of data protection, such as end purpose, the principle of information, the right to object and the principle of security. However, these technologies do not provide an absolute guarantee against abuses of the principles of personal data protection described above. Directive 95/46/EC recognises the right of data subjects to be informed about the processing of data concerning them and stipulates that at the very least they have the right to object to legitimate processing. Data subjects must therefore be informed about the commercial usage of data concerning them and must be able to object to such usage by simple and effective means. Another possibility mentioned in the opinion was to obtain the data subject's consent for commercial usage. Data subjects must have given their consent unambiguously and in full knowledge of the facts, taking into account the fact that anyone applying for planning permission is required to submit a file which meets certain stipulations. CONCLUSION: Public access to data does not mean unfettered access: all Member States base their legislation on this philosophy. When personal data are made public, either by virtue of a regulation or because the data subject himself authorises it, the data subject is not deprived of protection, ipso facto and forever. He is guaranteed such protection by law in accordance with the fundamental principles of the right to privacy. In order to strike a balance between the right to privacy and the protection of personal data on the one hand, and the right of the general public to access public sector data on the other, conclusions must take account of the following factors and issues: - a case-by-case assessment of whether personal data can be published/should be accessible or not, and if so, under what conditions and on which media (computerised or not, Internet dissemination or not, etc.); - the principles of purpose and legitimacy; - the obligation to inform the data subject; - the data subject's right to object; - the use of the new technologies to help protect the right to privacy. These factors should be taken into account not just in situations where publication or access is already regulated, but also in situations where regulation does not appear necessary, with a view to satisfying the general public's demand for access to public sector information, including personal data. Warm wishes, Sana Ali sana.ali2030(a)gmail.com <mailto:sana.ali2030@gmail.com> https://ca.linkedin.com/in/sanaali2030 <https://ca.linkedin.com/in/sanaali2030>

1 0

Data Team Checklist - 12 April 13:00
by Lisa Phifer April 12, 2016

April 12, 2016

Dear team data, Today's data team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw Thanks to all who have been posting summaries, which you will find hyperlinked in the attached checklist. Michele will be using this to discuss the team's progress during today's WG call. Best, Lisa

2 1

Re: [gnso-rds-pdp-data] @EXT summaries
by Lisa Phifer April 12, 2016

April 12, 2016

Thanks Greg! For ease of access by those who do not have Pages, attached are Word versions of the summaries just submitted to the list by Greg. >From: Greg Mounier >Sent: 12 April 2016 05:23:14 >To: Mounier, Grégory >Subject: summaries > >Dear all, > >Please find attached summaries of relevant >sections related to data registration elements >in the following fours documents: > >SAC055 and SAC058 (both partly reviewed by Holly), > > >Registrar Accreditation Agreement 2013 - >including RAA WHOIS requirements for registrants 2013, > > >and WHOIS Registrant Identification Study 2013. > > >Apologies for the delay. > >Best regards, > >Greg > > >******************* > >DISCLAIMER : This message is sent in confidence >and is only intended for the named recipient. If >you receive this message by mistake, you may not >use, copy, distribute or forward this message, >or any part of its contents or rely upon the information contained in it. >Please notify the sender immediately by e-mail >and delete the relevant e-mails from any >computer. This message does not constitute a >commitment by Europol unless otherwise indicated. > >*******************

1 0

@EXT summaries
by Mounier, Grégory April 12, 2016

April 12, 2016

________________________________ From: Greg Mounier Sent: 12 April 2016 05:23:14 To: Mounier, Grégory Subject: summaries Dear all, Please find attached summaries of relevant sections related to data registration elements in the following fours documents: SAC055 and SAC058 (both partly reviewed by Holly), Registrar Accreditation Agreement 2013 - including RAA WHOIS requirements for registrants 2013, and WHOIS Registrant Identification Study 2013. Apologies for the delay. Best regards, Greg ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

1 0