April 2016 - Gnso-rds-pdp-privacy

REMINDER: Re: Notes and for your review - sub-team draft responses to questions
by Marika Konings April 29, 2016

April 29, 2016

From: <gnso-rds-pdp-privacy-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Tuesday 26 April 2016 at 11:39 To: "gnso-rds-pdp-privacy(a)icann.org" <gnso-rds-pdp-privacy(a)icann.org> Subject: [Gnso-rds-pdp-privacy] Notes and for your review - sub-team draft responses to questions Dear All, Please find below the notes from today¹s privacy sub-team meeting as well as the latest draft responses to the questions attached. As a reminder, you are encouraged to provide input by the end of this week (Friday 29 April) in view of finalising the sub-teams input to the full WG by the next WG meeting. Best regards, Marika Notes * For the latest versions of the check lists and summaries, please see https://community.icann.org/x/p4xlAw . * Membership of the sub-teams: https://community.icann.org/x/DDCAAw Privacy Sub-Team * Which documents are most relevant - some documents may be important, but not necessary the most relevant to the WG deliberations * How to differentiate between personal and company data? Personal & sensitive data are considered together - sensitive data may also apply to a company. * Identifying documents that are most relevant, not ranking these in order of importance. * Encouraged to provide input by the end of the week in view of finalising template by next meeting.

1 0

Docs most relevant in our Privacy Subgroup summary
by Kathy Kleiman April 26, 2016

April 26, 2016

Hi All, I think we have been asked for our list of the most relevant documents for the Working Group from our Privacy subgroup. It is hard to choose from the excellent list and summaries prepared! My thoughts are that the documents below provide the best overview of pivotal legal principles of data protection, show the enormous spread of these principles around the world (particularly recently), and give us guidance for interpretation of these principles (including what it means to be a "data controller" and requires) are below. Best regards, Kathy In answer to subgroup question "(ii) Which inputs are likely to be the most important [relevant] during WG deliberations and why?", I share: 1) The EU Data Protection Directive 1995 (the best known of all data protection laws; the legal obligations of all countries in the EU) 2) The Council of Europe's Treaty 108 on Data Protection (created in 1981, and signed about 47 countries within and outside the EU, this is a key founding document of comprehensive data protection laws) 3) Professor Greenleaf's two articles (part of the same book) set out his studies showing that the adoption of data protection laws is growing rapidly -- and in 2015 the number of countries with comprehensive data protection laws surpassed those without data protections laws. More than a majority of the countries of the world have now adopted comprehensive data protection laws and legal frameworks. 4) Schrems v.Data Protection Commissioner (2015)/EU-US Privacy Shield (2016) - very recent cases and agreements which clearly show that rigorous enforcement of EU data protection laws is on the rise by high courts and their decisions are forcing new agreements to be negotiated which raise the legal requirements for transferring data from the EU countries to other parts of the world. The new EU-U.S. Privacy Shield is an important example of these higher legal requirements. The Article 29 Working Party Opinion on the Privacy Shield -- only about two weeks old -- is important for its discussion of these newest of major legal data protection frameworks. 5) Opinion 2/2003 on the Application of the Data Protection Principles to the Whois directories is the Article 29 Working Party's opinion expressly guiding ICANN on how to apply data protection laws and frameworks to the Whois issues. What could be more "on point" for our full Working Group's work? 6) McIntyre v. Ohio Elections Commission, a decision in 1995 by the US Supreme Court, affirming the importance of anonymous speech in creating an avenue for important, but unpopular and minority ideas to enter into a country's robust political, cultural and artistic discussions. In this decision, the US Supreme Court found that anonymity speech is a protected under the US First Amendment and a person cannot be forced to put her/his name and address on all of statements. Best regards, Kathy

6 8

Notes and for your review - sub-team draft responses to questions
by Marika Konings April 26, 2016

April 26, 2016

Dear All, Please find below the notes from today¹s privacy sub-team meeting as well as the latest draft responses to the questions attached. As a reminder, you are encouraged to provide input by the end of this week (Friday 29 April) in view of finalising the sub-teams input to the full WG by the next WG meeting. Best regards, Marika Notes * For the latest versions of the check lists and summaries, please see https://community.icann.org/x/p4xlAw . * Membership of the sub-teams: https://community.icann.org/x/DDCAAw Privacy Sub-Team * Which documents are most relevant - some documents may be important, but not necessary the most relevant to the WG deliberations * How to differentiate between personal and company data? Personal & sensitive data are considered together - sensitive data may also apply to a company. * Identifying documents that are most relevant, not ranking these in order of importance. * Encouraged to provide input by the end of the week in view of finalising template by next meeting.

1 0

Preparation for today's Privacy Team meeting
by Gomes, Chuck April 26, 2016

April 26, 2016

Hello Privacy Sub Team, I apologize for the late notice on this. I had hoped that David would have sent this earlier but for some unknown reason, probably beyond his control, he was unable to attend the Leadership Call yesterday and hasn't responded to email messages since then. On today's call you as a team will have 45 minutes to discuss the questions listed below. The team will be asked to formulate responses to each of the questions in the coming week and today's meeting will be used to get that process started. Please think about all the summaries of the documents that have been reviewed for "privacy" and be prepared to share your initial responses to the questions on today's call. Hopefully that will motivate list discussion in the coming week so that the team can present more complete responses in the WG call on May 3rd. Note that the Privacy Team is scheduled for the following time slot today: 16.15 - 17.00 UTC. If David is able to participate, I will let him lead the discussion if he is able to do so. If not, I will do it. If you have any questions, please let me know. Chuck Privacy Sub-Team - Draft 25 April 2016 Each team to consider their total output to address the following questions[1]: (i) Did this input inventory produce any insights to inform the WG's work plan? Draft response: (ii) Which inputs are likely to be the most relevant during WG deliberations and why[2]? Draft response (based on input received during 20/4 meeting): * SAC 054, because [to be completed] * EWG Recommendations, because [to be completed] (iii) Which inputs, if any, generated the most discussion within the small team? Draft response: (iv) Which inputs may be obsolete or super-ceded by subsequent work? Draft response: (v) What input gaps, if any, may need to be addressed later? Draft response: (vi) Other key takeaways from this input inventory the team wishes to share with the WG Draft response: ________________________________ [1] Please see 'Plan to consolidate summaries and complete & present team outputs<https://community.icann.org/download/attachments/58734473/RDS-InputTeams-Pl…>' for further details on the overall agreed approach for sub-teams. [2] Note, this does not mean that other inputs are not considered - this is just intended to facilitate the WG's prioritization of documents to consider first in relation to the finalization of the work plan and subsequent deliberations.

2 3

Re: [Gnso-rds-pdp-privacy] Preparation for today's Privacy Team meeting
by Gomes, Chuck April 26, 2016

April 26, 2016

I hope this doesn't create too much confusion, but here is a version of the questions with some input updated today. Chuck Privacy Sub-Team - Draft 25 April 2016 Each team to consider their total output to address the following questions[1]: (i) Did this input inventory produce any insights to inform the WG's work plan? Draft response: (ii) Which inputs are likely to be the most relevant during WG deliberations and why[2]? Draft response (based on input received during 20/4 meeting): * SAC 054, because [to be completed] * EWG Recommendations, because [to be completed] * The EU Data Protection Directive 1995 (the best known of all data protection laws; the legal obligations of all countries in the EU) * The Council of Europe's Treaty 108 on Data Protection (created in 1981, and signed about 47 countries within and outside the EU, this is a key founding document of comprehensive data protection laws) * Professor Greenleaf's two articles (part of the same book) set out his studies showing that the adoption of data protection laws is growing rapidly -- and in 2015 the number of countries with comprehensive data protection laws surpassed those without data protections laws. More than a majority of the countries of the world have now adopted comprehensive data protection laws and legal frameworks. * [Schrems v.Data Protection Commissioner (2015)/EU-US Privacy Shield (2016) - very recent cases and agreements which clearly show that rigorous enforcement of EU data protection laws is on the rise by high courts and their decisions are forcing new agreements to be negotiated which raise the legal requirements for transferring data from the EU countries to other parts of the world. The new EU-U.S. Privacy Shield is an important example of these higher legal requirements. The Article 29 Working Party Opinion on the Privacy Shield -- only about two weeks old -- is important for its discussion of these newest of major legal data protection frameworks. ] * Opinion 2/2003 on the Application of the Data Protection Principles to the Whois directories is the Article 29 Working Party's opinion expressly guiding ICANN on how to apply data protection laws and frameworks to the Whois issues. What could be more "on point" for our full Working Group's work? * McIntyre v. Ohio Elections Commission, a decision in 1995 by the US Supreme Court, affirming the importance of anonymous speech in creating an avenue for important, but unpopular and minority ideas to enter into a country's robust political, cultural and artistic discussions. In this decision, the US Supreme Court found that anonymity speech is a protected under the US First Amendment and a person cannot be forced to put her/his name and address on all of statements. * Thick Whois PDP report, and the legal review presented to the Implementation Review Team on Thick Whois (this is document #6 in the list from the consolidated PDF) is highly relevant, since it represents the most recent thinking from ICANN concerning the impact of privacy/data protection laws on one aspect of the current RDS (a/k/a Whois). (iii) Which inputs, if any, generated the most discussion within the small team? Draft response: (iv) Which inputs may be obsolete or super-ceded by subsequent work? Draft response: (v) What input gaps, if any, may need to be addressed later? Draft response: (vi) Other key takeaways from this input inventory the team wishes to share with the WG Draft response: From: Gomes, Chuck Sent: Tuesday, April 26, 2016 10:09 AM To: gnso-rds-pdp-privacy(a)icann.org Subject: Preparation for today's Privacy Team meeting Importance: High Hello Privacy Sub Team, I apologize for the late notice on this. I had hoped that David would have sent this earlier but for some unknown reason, probably beyond his control, he was unable to attend the Leadership Call yesterday and hasn't responded to email messages since then. On today's call you as a team will have 45 minutes to discuss the questions listed below. The team will be asked to formulate responses to each of the questions in the coming week and today's meeting will be used to get that process started. Please think about all the summaries of the documents that have been reviewed for "privacy" and be prepared to share your initial responses to the questions on today's call. Hopefully that will motivate list discussion in the coming week so that the team can present more complete responses in the WG call on May 3rd. Note that the Privacy Team is scheduled for the following time slot today: 16.15 - 17.00 UTC. If David is able to participate, I will let him lead the discussion if he is able to do so. If not, I will do it. If you have any questions, please let me know. Chuck Privacy Sub-Team - Draft 25 April 2016 Each team to consider their total output to address the following questions[1]: (i) Did this input inventory produce any insights to inform the WG's work plan? Draft response: (ii) Which inputs are likely to be the most relevant during WG deliberations and why[2]? Draft response (based on input received during 20/4 meeting): * SAC 054, because [to be completed] * EWG Recommendations, because [to be completed] (iii) Which inputs, if any, generated the most discussion within the small team? Draft response: (iv) Which inputs may be obsolete or super-ceded by subsequent work? Draft response: (v) What input gaps, if any, may need to be addressed later? Draft response: (vi) Other key takeaways from this input inventory the team wishes to share with the WG Draft response: ________________________________ ________________________________ [1] Please see 'Plan to consolidate summaries and complete & present team outputs<https://community.icann.org/download/attachments/58734473/RDS-InputTeams-Pl…>' for further details on the overall agreed approach for sub-teams. [2] Note, this does not mean that other inputs are not considered - this is just intended to facilitate the WG's prioritization of documents to consider first in relation to the finalization of the work plan and subsequent deliberations. [1] Please see 'Plan to consolidate summaries and complete & present team outputs<https://community.icann.org/download/attachments/58734473/RDS-InputTeams-Pl…>' for further details on the overall agreed approach for sub-teams. [2] Note, this does not mean that other inputs are not considered - this is just intended to facilitate the WG's prioritization of documents to consider first in relation to the finalization of the work plan and subsequent deliberations.

1 0

Privacy Team Consolidated Summary - 24 April
by Lisa Phifer April 24, 2016

April 24, 2016

Dear privacy team, The latest Privacy Team Consolidated Summary PDF (updated 24 April) is attached and posted to the wiki at: https://community.icann.org/x/p4xlAw In preparation for your team meeting on Tuesday, you are all encouraged to discuss on-list which of the identified docs are most relevant to privacy and why, along with other questions listed here: https://community.icann.org/download/attachments/58734473/RDS-InputTeams-Pla n-12April-updated.pdf Please send all feedback on privacy team summaries and questions to be considered by this team to this email list, gnso-rds-pdp-privacy(a)icann.org. Best, Lisa

1 0

McIntyre v.Ohio Elections Commission
by Kathy Kleiman April 22, 2016

April 22, 2016

Hi All, Posting my summary of the US Supreme Court case on the value of anonymous political speech and anonymous speech generally: McIntyre v. Ohio Elections Commission (1995). Apologies for the delay and I think that wraps up my contributions. Looking forward to reading everyone's summaries! Best, Kathy

1 0

Privacy Team Consolidated Summary - 21 April
by Lisa Phifer April 22, 2016

April 22, 2016

Dear privacy team, The latest Privacy Team Consolidated Summary PDF (updated 21 April) is attached and posted to the wiki at: https://community.icann.org/x/p4xlAw Going forward, staff will maintain the master consolidated summary. The Word version of the consolidated summary is also available on the above wiki page. - All team members are asked to review consolidated summaries (especially those within your own area of expertise) to ensure that key passages of each doc have at least been identified. - Those of you who drafted summaries are also asked to consider team feedback on your summary. Especially for docs which the team finds to be the most relevant to privacy including data protection, please draft a few concise bullet points summarizing the doc's relevance. - All team members are encouraged to discuss on-list which of the identified docs are most relevant to privacy and why, along with other questions listed here: https://community.icann.org/download/attachments/58734473/RDS-InputTeams-Pl… Please send all feedback on purpose team summaries and document relevance to this team's email list, gnso-rds-pdp-privacy(a)icann.org. Thanks all for your efforts, Lisa

1 0

European Commission Website: Obligations of Data Controllers
by Kathy Kleiman April 21, 2016

April 21, 2016

Hi All, A few last summaries coming into the subgroup. Sorry for the delay! Busy days... Best, Kathy (below and attached) Document Name: *European Commission Website: Obligations of Data Controllers* Document Link: http://ec.europa.eu/justice/data-protection/data-collection/obligations/ind… Summary: This is a key question about whether ICANN is a data controller under the laws of the European Data Protection Directive? Data Controllers “determine 'the purposes and the means of the processing of personal data'” and it is a term that applies to both public and private sectors. See /Who can collect and process personal data?, /http://ec.europa.eu/justice/data-protection/data-collection/index_en.htm (submitted as a separate document) The EU Data Protection Directive requires Data Controllers to abide by certain principles when they process personal data. According to the European Commission: “Each *data controller* must respect the following rules as set out in the Directive: Personal Data must be processed legally and fairly; It must be collected for explicit and legitimate purposes and used accordingly; It must be adequate, relevant and not excessive in relation to the purposes for which it is collected and/or further processed; It must be accurate, and updated where necessary; Data controllers must ensure that data subjects can rectify, remove or block incorrect data about themselves; Data that identifies individuals (personal data) must not be kept any longer than strictly necessary; Data controllers must protect personal data against accidental or unlawful destruction, loss, alteration and disclosure, particularly when processing involves data transmission over networks. They shall implement the appropriate security measures; These protection measures must ensure a level of protection appropriate to the data.” Additional information: It is hard to put it more succinctly, so I quoted directly from the European Commission webpage.

1 1

Privacy Team Checklist - 19 April 13:00
by Lisa Phifer April 20, 2016

April 20, 2016

3 3