- gnso-rds-pdp-data - lists.icann.org

Data Team Checklist - 11 April 15:00
by Lisa Phifer April 11, 2016

April 11, 2016

1 0

Analysis....
by Deacon, Alex April 11, 2016

April 11, 2016

Hi, My analysis of the following 3 documents. Question: What data elements should be collected, stored and disclosed? Declaration of the Committee of Ministers on ICANN, human rights and the rule of law This document does not make any specific statements regarding the collection, storage and disclosure of user data elements. It does however make one very general statement in paragraph 3 that is germane to “disclosure” of information , e.g. "In certain criminal investigations, criminal justice authorities need to secure evidence on computer systems and to identify offenders, subject to the conditions and safeguards providing for the adequate protection of human rights pursuant to Article 15 of the Convention on Cybercrime (ETS No. 185)." In addition, this document references two additional documents that I did not review but may be relevant * Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108) * Article 15 of the Convention on Cybercrime (ETS No. 185) Dissenting Report from Stephanie Perrin (24 Jun 2014) The focus of this document is not on the specifics of individual data elements but on topics more relevant to the other sub groups. There are however two mentions of data elements on page one. Specifically * Legal Contact Email and Legal Contact Phone Number * Registrant Address, Registrant Phone Number It is important to note however that these mentions occur in a section where the author (Stephanie) states that she does not agree with the consensus of the EWG Final Report. Process Framework for a PDP on Next-Generation RDS This document does not make any specific statements regarding the collection, storage and disclosure of user data elements.

4 5

Summaries of Relevant Sections from International Working Group on Data Protection in Telecommunications and Media Documents - Data
by Sana Ali April 11, 2016

April 11, 2016

• Data Elements: What data should be collected, stored, and disclosed? Common Position on data protection aspects in the Draft Convention on cyber-crime of the Council of Europe In this respect the Working Group fully supports the findings of the European Data Protection Commissioners Conference that such retention of traffic data by Internet service providers would be an improper invasion of the fundamental rights guaranteed to individuals by the European Convention on Human Rights.This goes also for storing data revealing the use of the Internet by individuals. Existing powers for tracing crimes should not be extended in a way that invades privacy until the need for such measures has been clearly demonstrated. The Working Group has in the past stated that any Interception of Private Communications should be subject to appropriate safeguards Ten Commandments to protect Privacy in the Internet World Common Position on Incorporation of telecommunications-specific principles in multilateral privacy agreements Data Austerity: Telecommunications infrastructure has to be designed in a way that as few personal data are used to run the networks and services as technically possible. Virtual Right to be Alone: Nobody must be forced to let his or her personal data be published in directories or other indices. Every user has to be given the right to object to his or her data being collected by a search engine or other agents. Every user has to be given the right and the technical means to prevent the intrusion of external software into his own devices. Common Position on Privacy and Data Protection aspects of the Registration of Domain Names on the Internet • The amount of data collected and made publicly available in the course of the registration of a domain name should be restricted to what is essential to fulfil the purpose specified. In this respect the Working Group has reservations against a mandatory publication of any data exceeding name (which might also be the name of a company and not of a natural person), address and e-mailaddress in cases where the domain name holder is not himself responsible for the technical maintenance of the domain but has this done through a service provider (as is the case with many private persons who have registered domain names). • Any technical mechanism to be introduced to access the data collected from the registrants must furthermore have safeguards to meet the principle of purpose limitation and avoidance of the possibility to unauthorised secondary use of the registrant's data. Common Position relating to Reverse Directories • It is in any case necessary to endow the persons with the right to be informed by their provider of telephone or e-mail service, at the time of the collection of data concerning them, or if they have already subscribed, by a specific means of information, of the existence of services of reverse search and - if express consent is not required - of their right to object, free of charge, to such a search. Comments on the data protection impact of the revision of the ICANN RAA concerning accuracy and data retention of WHOIS data • The Working Party recalls its previous contributions to the process of collecting and disclosing WHOIS data, as included in the Opinion 2/2003 on the application of the data protection principles to WHOIS directories4 as well as its letters of 22 June 2006 to the Board of Directors of ICANN5 and of 12 March 2007 to the Chairman of the Board of Directors of ICANN6 in which the relevant data protection principles have been outlined • In assessing these proposals, ICANN should be aware that the purpose of collecting and publishing contact details in the WHOIS database is to facilitate contact about technical issues. The original purpose definition reads: “The purpose of the gTLD Whois service is to provide information sufficient to contact a responsible party for a particular gTLD domain name who can resolve, or reliably pass on data to a party who can resolve, issues related to the configuration of the records associated with the domain name within a DNS name server." • The Working Party strongly objects to the introduction of data retention by means of a contract issued by a private corporation in order to facilitate (public) law enforcement. If there is a pressing social need for specific collections of personal data to be available for law enforcement, and the proposed data retention is proportionate to the legitimate aim pursued, it is up to national governments to introduce legislation that meets the demands of article 8 of The European data retention directive 2006/24/EC imposes data retention obligations on providers of public electronic communication networks and services. Registrars are not such providers and are therefore not subjected to this European data retention obligation. the European Convention on Human Rights and article 17 of the International Covenant on Civil and Political rights. Sana Ali sana.ali2030(a)gmail.com <mailto:sana.ali2030@gmail.com> https://ca.linkedin.com/in/sanaali2030 <https://ca.linkedin.com/in/sanaali2030>

2 1

Data Team Checklist - 7 April
by Lisa Phifer April 8, 2016

April 8, 2016

Hello all, Another updated data team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw Just follow the link above if you're looking for the latest daily update of any team's checklist. The data team is down to just three documents left without volunteers: * Council of Europe Declaration Declaration of the Committee of Ministers on ICANN, human rights and the rule of law (3 June 2015) * Statements/Blogs by Perrin * Process Framework for a PDP on Next-Generation RDS, Page 9, Row 4 (hint: see questions/subquestions mind map) If you'd like to review and summarize any of these remaining docs, please reply to this message. Best, Lisa

3 4

Re: [gnso-rds-pdp-data] Data Input Documents Checklist
by Lisa Phifer April 6, 2016

April 6, 2016

2 1

Re: [gnso-rds-pdp-data] Data Input Documents Checklist
by Sara Bockey April 6, 2016

April 6, 2016

Hi Michele, I can review the statements/comments related to the following: -Article 29 WP statement on the data protection impact of the ICANN RAA (2013-2014) -Article 29 WP comments on the data protection impact of the revision of the ICANN RAA concerning accuracy and data retention of WHOIS (2012) -Article 29 WP on ICANNProcedure for Handling WHOIS Conflicts with Privacy Law (2007) -Article 29 WP on ICANN’s WHOIS Database Policy (2006) -Article 29 WP Opinion on the application of the data protection principles to WHOIS directories Sara On 4/4/16, 7:46 AM, "gnso-rds-pdp-data-bounces(a)icann.org<mailto:gnso-rds-pdp-data-bounces@icann.org> on behalf of Michele Neylon - Blacknight via gnso-rds-pdp-data" <gnso-rds-pdp-data-bounces(a)icann.org<mailto:gnso-rds-pdp-data-bounces@icann.org> on behalf of gnso-rds-pdp-data(a)icann.org<mailto:gnso-rds-pdp-data@icann.org>> wrote: All Please find attached a fairly comprehensive list of documents / inputs that have some bearing on “Data” within the context of our work. If someone were to volunteer to review those documents looking for any sections that address specific registration data elements (as opposed to trying to summarise overall inputs on data protection laws, which falls to the privacy team) it would be helpful. Any takers? :) Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845

5 5

Data Team Checklist - 6 April
by Lisa Phifer April 6, 2016

April 6, 2016

Hello all, Today's updated data team checklist (attached) was just posted to the wiki at: https://community.icann.org/x/p4xlAw Just follow the link above if you're looking for the latest daily update of any team's checklist. For ease of reference, the following docs already on the data team's list are not yet assigned: * Council of Europe Declaration <https://wcd.coe.int/ViewDoc.jsp?Ref=Decl%2803.06.2015%292>Declaration of the Committee of Ministers on ICANN, human rights and the rule of law (3 June 2015) * <http://ec.europa.eu/justice/data-protection/data-collection/obligations/ind…>European Commission Website: Obligations of Data Controllers * International Working Group on Data Protection in Telecommunications and Media Documents - <https://datenschutz-berlin.de/attachments/176/rever_en.pdf?1201099194>Common Position relating to Reverse Directories (Hong Kong, 15.04.1998) - <https://datenschutz-berlin.de/attachments/222/dns_en.pdf?1200656953>Common Position on Privacy and Data Protection aspects of the Registration of Domain Names on the Internet (Crete, 4./5.05.2000) - <https://datenschutz-berlin.de/attachments/220/pd_en.pdf?1201099774>Common Position on Privacy and Data Protection aspects of the Publication of Personal Data contained in publicly available documents on the Internet (Crete, 4./5.05.2000) - <https://datenschutz-berlin.de/attachments/216/tc_en.pdf?1200658742>Common Position on Incorporation of telecommunications-specific principles in multilateral privacy agreements: Ten Commandments to protect Privacy in the Internet World (Berlin, 13/14.09.2000) - <https://datenschutz-berlin.de/attachments/218/cy_en.pdf?1200656876>Common Position on data protection aspects in the Draft Convention on cyber-crime of the Council of Europe (Berlin, 13/14.09.2000) * <http://tools.ietf.org/html/rfc7485>RFC 7485 Inventory and Analysis of WHOIS Data (including earlier full WG list discussion about this doc) * <https://community.icann.org/display/gTLDRDS/Process+Framework>Process Framework for a PDP on Next-Generation RDS, especially Page 9, Row 4 (hint - start with not just framework, but Questions/Subquestions mind map) Remember, if you know of a document relevant to RDS data elements that isn't already on the attached checklist, you can volunteer to summarize it instead of/in addition to the above unassigned docs. Best, Lisa At 12:25 PM 4/5/2016, Michele Neylon - Blacknight via gnso-rds-pdp-data wrote: >All > >Thanks to all who were on the call today > >So in followup please find attached the proposed >plan regarding assignments for this group (data) > >Several of you have already volunteered to >handle some of the documents identified in the âinput checklistâ >For those of you who havenât done so yet >please see previous emails and choose a few >documents that arenât covered so far. > >As per the attached, ideally this should be done by tomorrow night April 6 > >Any âleftoversâ will be identified and >assigned to you if you havenât chosen something yourselves :) > >If you have any questions please let me or Staff know > >Regards > >Michele > >-- >Mr Michele Neylon >Blacknight Solutions >Hosting, Colocation & Domains >http://www.blacknight.host/ >http://blog.blacknight.com/ >http://ceo.hosting/ >Intl. +353 (0) 59 9183072 >Direct Dial: +353 (0)59 9183090 >------------------------------- >Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >Road,Graiguecullen,Carlow,Ireland Company No.: 370845 > > > >_______________________________________________ >gnso-rds-pdp-data mailing list >gnso-rds-pdp-data(a)icann.org >https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-data _______________________________________________ gnso-rds-pdp-data mailing list gnso-rds-pdp-data(a)icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-data

1 0

Proposed Plan ..
by Michele Neylon - Blacknight April 6, 2016

April 6, 2016

All Thanks to all who were on the call today So in followup please find attached the proposed plan regarding assignments for this group (data) Several of you have already volunteered to handle some of the documents identified in the “input checklist” For those of you who haven’t done so yet please see previous emails and choose a few documents that aren’t covered so far. As per the attached, ideally this should be done by tomorrow night April 6 Any “leftovers” will be identified and assigned to you if you haven’t chosen something yourselves :) If you have any questions please let me or Staff know Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845

5 8

Data Input Documents Checklist
by Michele Neylon - Blacknight April 4, 2016

April 4, 2016

All Please find attached a fairly comprehensive list of documents / inputs that have some bearing on “Data” within the context of our work. If someone were to volunteer to review those documents looking for any sections that address specific registration data elements (as opposed to trying to summarise overall inputs on data protection laws, which falls to the privacy team) it would be helpful. Any takers? :) Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845

2 1

FW: @EXT: RE: Data Input Documents Checklist
by Michele Neylon - Blacknight April 4, 2016

April 4, 2016

-- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 04/04/2016, 16:17, "Mounier, Grégory" <gregory.mounier(a)europol.europa.eu> wrote: >Michele and al, > >I am happy to review by Friday cob: > >Registrar Accreditation Agreement (2013), especially >RAA WHOIS requirements for Registrants (2013) >WHOIS Registrant Identification Study (2013) >SAC055, WHOIS: Blind Men and an Elephant >SAC058, Report on Domain Name Registration Data Validation > >Greg > >-----Original Message----- >From: gnso-rds-pdp-data-bounces(a)icann.org [mailto:gnso-rds-pdp-data-bounces@icann.org] On Behalf Of Michele Neylon - Blacknight via gnso-rds-pdp-data >Sent: 04 April 2016 16:46 >To: gnso-rds-pdp-data(a)icann.org >Subject: [gnso-rds-pdp-data] Data Input Documents Checklist > >All > >Please find attached a fairly comprehensive list of documents / inputs that have some bearing on “Data” within the context of our work. > >If someone were to volunteer to review those documents looking for any sections that address specific registration data elements (as opposed to trying to summarise overall inputs on data protection laws, which falls to the privacy team) it would be helpful. > >Any takers? :) > >Regards > >Michele > >-- >Mr Michele Neylon >Blacknight Solutions >Hosting, Colocation & Domains >http://www.blacknight.host/ >http://blog.blacknight.com/ >http://ceo.hosting/ >Intl. +353 (0) 59 9183072 >Direct Dial: +353 (0)59 9183090 >------------------------------- >Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > >******************* > >DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. >Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. > >*******************

1 0

RDS Data Background Materials and More
by Michele Neylon - Blacknight March 28, 2016

March 28, 2016

All As you know tomorrow’s call of the whole WG has been cancelled. This is partially in order to allow the sub groups to work on their various tasks.. Which in our case is in relation to “data” In order to help bring some focus to this work, as well as to help people get up to speed, staff have helped draft both a list of relevant documents as well as a baseline template to help us summarise our work in order to bring it back to the main group. It’s attached to this email I’d also note that there’s quite a large number of documents etc., referenced. All are relevant, though the list isn’t exhaustive. If you have any questions please let me know Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845

1 0

Fwd: Data Elements: What data should be collected, stored, and disclosed?
by Holly Raiche March 24, 2016

March 24, 2016

Folks - sorry I replied only to Michele- when I should have replied to the group Keep the discussion going please Holly Begin forwarded message: > From: Holly Raiche <h.raiche(a)internode.on.net> > Subject: Re: [gnso-rds-pdp-data] Data Elements: What data should be collected, stored, and disclosed? > Date: 25 March 2016 9:41:00 am AEDT > To: Michele Neylon - Blacknight <michele(a)blacknight.com> > > Yes - perfect - thanks > > (probably distinguish between what the RAA requires and what the registry requires as well) > > Holly > On 25 Mar 2016, at 9:34 am, Michele Neylon - Blacknight <michele(a)blacknight.com> wrote: > >> Holly >> >> So you mean group the data into 2 or 3 sets like the below? >> >> 1 - technically required or the domain simply won’t work >> 2 - required by contract (either by the registry or the RAA) >> 3 - other data currently not considered or that doesn’t fit into either bucket >> >> Regards >> >> Michele >> -- >> Mr Michele Neylon >> Blacknight Solutions >> Hosting, Colocation & Domains >> http://www.blacknight.host/ >> http://blog.blacknight.com/ >> http://ceo.hosting/ >> Intl. +353 (0) 59 9183072 >> Direct Dial: +353 (0)59 9183090 >> ------------------------------- >> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >> Road,Graiguecullen,Carlow,Ireland Company No.: 370845 >> >> >> >> >> >> >> >> On 24/03/2016, 22:27, "Holly Raiche" <h.raiche(a)internode.on.net> wrote: >> >>> Thanks Michele >>> >>> My suggestion is to start with SAC054 - it is a careful listing of what information is collected and for what purpose. Discussion on the list has also been really helpful. >>> >>> But may I make a suggestion as well: Could we try to differentiate between the information (maybe best call it registration data?) that is required by registrars and registries to function as registrars and registries, and what is not (even if it is required to be collected under the RAA) >>> >>> Cheers >>> >>> Holly >>> >>> >>> >>> >>> On 25 Mar 2016, at 2:10 am, Michele Neylon - Blacknight via gnso-rds-pdp-data <gnso-rds-pdp-data(a)icann.org> wrote: >>> >>>> All >>>> >>>> First off, thanks for agreeing to volunteer to work on this topic in a small group. >>>> >>>> Our task is centred around this key question: >>>> >>>> Data Elements: What data should be collected, stored, and disclosed? >>>> >>>> There has been some healthy discussion around this on the main WG list over the last week or two, so if you haven’t had a chance I’d recommend you review the previous emails there. >>>> >>>> >>>> The other groups are looking at “purpose” and “privacy” >>>> >>>> This approach is explained in the attached PDF, which was presented to the full PDP WG during this week’s meeting. >>>> >>>> So who is on this list / in this group? >>>> Michele Neylon (coordinator), Richard Padilla, Holly Raiche, Norm Ritchie, Sara Bockey, Amr Elsadr, Vlad Dinculescu, Benny Samuelsen, Ayden Ferdeline, Janelle McAlister, Jody Volker, Adrian Cheek, Sana Ali, Janay McWhorter, Lawrence Olawale-Roberts, David Cake, Chuck Gomes, Nathalie Coupet, Roger Carney, Gregory Mounier >>>> >>>> So let’s kick this off :) >>>> >>>> Regards >>>> >>>> Michele >>>> >>>> >>>> -- >>>> Mr Michele Neylon >>>> Blacknight Solutions >>>> Hosting, Colocation & Domains >>>> http://www.blacknight.host/ >>>> http://blog.blacknight.com/ >>>> http://ceo.hosting/ >>>> Intl. +353 (0) 59 9183072 >>>> Direct Dial: +353 (0)59 9183090 >>>> ------------------------------- >>>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >>>> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 >>>> >>>> >>>> <RDS-PDP-Proposed-Summary-Approach.pdf>_______________________________________________ >>>> gnso-rds-pdp-data mailing list >>>> gnso-rds-pdp-data(a)icann.org >>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-data >>> >

1 0

Data Elements: What data should be collected, stored, and disclosed?
by Michele Neylon - Blacknight March 24, 2016

March 24, 2016

All First off, thanks for agreeing to volunteer to work on this topic in a small group. Our task is centred around this key question: Data Elements: What data should be collected, stored, and disclosed? There has been some healthy discussion around this on the main WG list over the last week or two, so if you haven’t had a chance I’d recommend you review the previous emails there. The other groups are looking at “purpose” and “privacy” This approach is explained in the attached PDF, which was presented to the full PDP WG during this week’s meeting. So who is on this list / in this group? Michele Neylon (coordinator), Richard Padilla, Holly Raiche, Norm Ritchie, Sara Bockey, Amr Elsadr, Vlad Dinculescu, Benny Samuelsen, Ayden Ferdeline, Janelle McAlister, Jody Volker, Adrian Cheek, Sana Ali, Janay McWhorter, Lawrence Olawale-Roberts, David Cake, Chuck Gomes, Nathalie Coupet, Roger Carney, Gregory Mounier So let’s kick this off :) Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845

2 2