April 2016 - Gnso-rds-pdp-privacy

Privacy Team Checklist - 15 April 01:00
by Lisa Phifer April 15, 2016

April 15, 2016

2 1

Fwd: Work so far
by Farell Folly April 15, 2016

April 15, 2016

Dear All, I apologize for not having included all in the destination address. Lisa, please can you send me again the link where I can find all the documents that are still pending for summary ? You did send a document I know but I think it might not be up to date, so I want to be sure about the summaries' progress. ---------- Forwarded message --------- From: Farell Folly <farellfolly(a)gmail.com> Date: mar. 12 avr. 2016 à 17:13 Subject: Re: [Gnso-rds-pdp-privacy] Work so far To: Lisa Phifer <lisa(a)corecom.com> Cc: David Cake <davecake(a)gmail.com> Dear all, To sum up, all four documents are letters written to ICANN in order to make some remarks on WHOIS database policy and to advise ICANN on how best it can manage the database. All four documents constantly point out the real purpose of the WHOIS and what information should be collected, what you should be available to the public and what mechanisms need to be put in place to prevent spamming and or bulk information access. Le mar. 12 avr. 2016 à 13:26, Lisa Phifer <lisa(a)corecom.com> a écrit : > Farell thank you, these privacy team docs have now been marked as assigned > to you: > > > *Article 29 WP on ICANN’s WHOIS Database Policy (2006) *- > https://www.icann.org/en/system/files/files/schaar-to-cerf-22jun06-en.pdf > - https://www.icann.org/en/correspondence/lawson-to-cerf-22jun06.pdf > - https://www.icann.org/en/correspondence/parisse-to-icann-22jun06.pdf > - > https://www.icann.org/en/system/files/files/fingleton-to-cerf-20jun06-en.pdf > > Best, Lisa > > > > At 02:42 AM 4/12/2016, Farell Folly wrote: > > I will take : article 29 WP on WHOIS database policies, all of them. > > LeÂ mardi 12 avril 2016, Lisa Phifer via Gnso-rds-pdp-privacy < > gnso-rds-pdp-privacy(a)icann.org> a Ã©critÂ : > > > All, > > Reply to Farell's question: The attached checklist highlights in yellow > the remaining unassigned documents for the privacy team. > > Best, Lisa > > > At 03:09 PM 4/11/2016, David Cake via Gnso-rds-pdp-privacy wrote: > Thank you so much to Steve, Ayden, Kathy and others who have finished > there summaries or are still working on them. I, and the whole leadership > team, really appreciates the great work being done. > > The privacy team is running a little behind schedule, because as you can > see from the checklist there are still some documents that have no one > assigned to create a summary. A few people have volunteered since, but if > you would like to volunteer to summarise one of the as yet unallocated > documents please contact Lisa and/or me. > > Some of the documents have been reviewed by other teams, but the summaries > prepared for other teams will not focus on the privacy aspects, so ideally > these should be reviewed by this team as well. Others have not been > summarised yet at all. There are quite a few. > > Do we have any further volunteers to summarise any of these remaining > documents? > > David > > _______________________________________________ > Gnso-rds-pdp-privacy mailing list > Gnso-rds-pdp-privacy(a)icann.org <http://??> > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-privacy > > > > -- > Meilleures salutations, > > --ff-- > > -- Best regards, @__f_f__ -- Best regards, @__f_f__

1 0

Kathy's summaries - round 2
by Kathy Kleiman April 14, 2016

April 14, 2016

Hi All, Apologies for the delay. Here is my second batch of summaries for our privacy sub-group. Committed summaries: 1. Global Tables of Data Privacy Laws & Bills (2015, Professor Greenleaf) 2. Global Data Privacy Laws 2015: 109 Countries, with European Laws Now a Minority (Greenleaf) 3. Constitution of California, Article 1, Section 1 A few additional summaries - directly relevant to our work: 4. Massachusetts Privacy Law (mentioned in our discussions at the same time as the California Constitutional privacy provisions), and 5. US Judicial Redress Act of 2015 (a newly enacted law in the US -- Feb 2016 - extending rights from the US Privacy Law 1974 to EU and other citizens per a process) Looking forward to reading everyone's summaries! Kathy

1 0

Privacy Team Checklist - 14 April 14:00
by Lisa Phifer April 14, 2016

April 14, 2016

1 0

Privacy Team Checklist - 13 April 13:00
by Lisa Phifer April 13, 2016

April 13, 2016

3 2

Summaries for AU, Ghana and South Africa National Legislation
by Grace Mutung'u (Bomu) April 13, 2016

April 13, 2016

Dear All, Please find attached. Regards, -- Grace L.N. Mutung'u Nairobi Kenya Skype: gracebomu Twitter: @Bomu <http://www.diplointernetgovernance.org/profile/GraceMutungu> PGP ID : 0x33A3450F

1 0

Privacy Team Checklist - 12 April 13:00 (resend)
by Lisa Phifer April 12, 2016

April 12, 2016

Argh! Resending same email but this time with the correct subject! Dear privacy team, Today's privacy team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw Thanks to all who have been posting summaries, which you will find hyperlinked in the attached checklist. David will be using this to discuss the team's progress during today's WG call. As you know, David is seeking privacy team volunteers to review unassigned docs, highlighted in yellow. This checklist will be updated again later today with those additional assignments still under discussion. Best, Lisa

2 1

Memo to EWG re gTLD Registration Data and International Data Privacy Considerations AND privacy-proxy-registration services-study 14sep10-en
by nathalie coupet April 12, 2016

April 12, 2016

Good afternoon, Here are two additional documents assigned to me. The Expert Working Group on gTLD Directory Services (EWG) wasformed by ICANN to help resolve the nearly decade-long deadlock within theICANN community on how to replace the current Whois system. EWG’s mandate is to reexamine and define thepurpose of collecting and maintaining gTLD directory services, to consider howto safeguard the data, and to propose a next generation solution that willbetter serve the needs of the global Internet community. 1) Purposes defined by the EWG EWG concluded the current Whoismodel—giving every user the same anonymous public access to gTLD registrationdata—should be abandoned. Instead, EWGrecommended a paradigm shift whereby gTLD registration data is collected,validated and disclosed for permissible purposes only, with some data elementsbeing accessible only to authenticated requestors that are then heldaccountable for appropriate use. EWGproposed that permissible purposes include domain name control, domain nameresearch, personal data protection, legal actions, technical issue resolution,regulatory/contract enforcement, domain name purchase/sale, individual Internetuse, abuse mitigation, and Internet services provision. 2) Centralized or Federated Model? The selection, implementation anduse of a specific Whois database structure (i.e., centralized or federated)should be informed by applicable legal principles of “personal data” protection,but no uniform definition of “personal data” exists and there are variousdisparities between existing regimes. Thesedifferences in data projection regulation raise significant jurisdictional concerns, as well aspotential regulatory obstacles on the global collection, processing, andtransfer of gTLD registration data that need to be considered when structuring,implementing, and administrating the Whois database replacement platform. · Notwithstanding the territorial nature of data privacy laws,many such laws have extraterritorial reach. · The administration of the Whois database may thus implicatethe laws of (i) the country where the Whois database platform is located, (ii)the country where the data owner/licensor/controller (controller) is located(i.e., where the registrar, registry, and possibly the Whois databaseadministrator are located to the extent such entities dictate the processing ofgTLD registration data), and (iii) the country where the data subjects (e.g.,registrants) are located · The controlling and most relevant law to consider is the lawwhere the data subject (i.e., registrant) resides, as the ultimate goal of dataprotection laws is the protection of individual personal data. Hence, the application of data protectionlaws will depend greatly on (i) where gTLD registration data will be located,(ii) whether ICANN (or the entity administering the database) will be viewed as a controller or processor ofsuch data, and hence have direct compliance obligations, (iii) the obligationsimposed on registrars/registries under their agreements with ICANN with respectto gTLD registration data, and (iv) the extent to which local data protectionlaws apply to registrants. · The distinction between data controller and dataprocessor is important, as controllers are required to comply with applicabledata protection laws, and must impose certain data protection obligations on dataprocessors. Processors are required toabide by the instructions of controllers. · This will influence the data location andtransfer considerations for the Whois replacement platform, whether as acentralized or federated model, and whether the Whois replacement databaseadministrator and/or registrars conduct themselves as controllers in connectionwith gTLD registration data. · The most comprehensive data protection andprivacy compliance legal framework remains to be the E.U. Data ProtectionDirective (E.U. Directive), Directive 95/46/EC of the European Parliament andof the Council of 24 October 1995 on the protection of individuals with regardto the processing of personal data and on the free movement of such data =>baseline for data protection compliance Datacontrollers must process personal data in accordance with the followingrelevant data privacy and protection principles: Purpose limitation: legitimatepurposes only. Data quality and proportionality:accurate and up to date. Transparency: notification of dataproviders Security and confidentiality:protection measures Rights of access, rectification,deletion and objection by data subjects Sensitive data: additionalsecurity measures Direct marketing: “opt-out” mustbe possible Data retention: limited time tosatisfy the purpose Accountability: for data collectors The transfer of personaldata from registrars to ICANN or the designated operator under a centralizedmodel, or the sharing of data between registrars under a federated model, willtherefore likely require data subject consent. Data transfers between ICANN or a designated operator and the registrarslikely also require that certain contractual obligations be imposed throughoutthe system. Choice of accountability and liability of the data controlleror the data processor for any data breach or violation of local laws depends onthe dependance (or independence) of the processor towards the controller inboth models. Sanctions: Regulatory fines, criminal sanctions, and injunctions on dataprocessing. International transfers ofpersonal data in violation of local data protection laws could also lead to aninjunction on data transfers, hampering the effectiveness of the Whoisdatabase replacement platform. The availability ofsuch penalties under local data protection regimes will potentially fuel localregistrar/registry opposition to a Whois database replacement platformunder either of the proposed models. Again, in some countries thetransfer of personal data from registrars to ICANN or the designated operatorunder a centralized model, or the sharing of data between registrars under afederated model, likely will require the consent of the data subjects. Data transfers between ICANN or thedesignated operator and the registrars likely also require that certaincontractual obligations be imposed throughout the system. Other issues: 1) various registrars provide an upgradedfee-paying subscription service that addresses personal data privacy and maywhich to continue with this source of revenues 2) considerable secure storage capacity. Cloud computing may introduce heightened datasecurity concerns and complicate proportionality in processing, internationaltransfer restrictions, and data storage. Conclusion: While technical, political and other considerationswill inform the implementation of the Whois database replacement platform, both models under consideration raisecritical data privacy issues that must be considered. privacy-proxy-registration services-study 14sep10-en Domain names can be registered using a Whois privacy orproxy service, which helps limit the amount of users’ personal information thatis made public via registrar and registry Whois services. The sample of domainnames registered under the top 5 gTLDs indicates that about 18% of them usedthis type of service. Among these, Whois proxy service registrations were themost common. Nathalie Coupet

1 0

Data Team Checklist - 12 April 13:00
by Lisa Phifer April 12, 2016

April 12, 2016

Dear privacy team, Today's privacy team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw Thanks to all who have been posting summaries, which you will find hyperlinked in the attached checklist. David will be using this to discuss the team's progress during today's WG call. As you know, David is seeking privacy team volunteers to review unassigned docs, highlighted in yellow. This checklist will be updated again later today with those additional assignments still under discussion. Best, Lisa

1 0

Work so far
by David Cake April 12, 2016

April 12, 2016

Thank you so much to Steve, Ayden, Kathy and others who have finished there summaries or are still working on them. I, and the whole leadership team, really appreciates the great work being done. The privacy team is running a little behind schedule, because as you can see from the checklist there are still some documents that have no one assigned to create a summary. A few people have volunteered since, but if you would like to volunteer to summarise one of the as yet unallocated documents please contact Lisa and/or me. Some of the documents have been reviewed by other teams, but the summaries prepared for other teams will not focus on the privacy aspects, so ideally these should be reviewed by this team as well. Others have not been summarised yet at all. There are quite a few. Do we have any further volunteers to summarise any of these remaining documents? David

4 4