April 2016 - Gnso-rds-pdp-privacy

Summaries of Relevant Section from International Working Group on Data Protection in Telecommunications and Media Documents - Privacy
by Sana Ali April 11, 2016

April 11, 2016

• Privacy: What steps are needed to protect data and privacy? Common Position on data protection aspects in the Draft Convention on cyber-crime of the Council of Europe Existing conditions and safeguards provided for under domestic law and the Convention on Mutual Assistance in Criminal Matters between the Member States of the European Union (Art. 23) must be respected. Such conditions and safeguards should at least include • prior judicial authorisation, • (subsequent) notification of individuals, • limits on use, • record-keeping requirements, • monitoring and auditing as well as • public reporting. In particular the cooperation of national authorities with operators of public and private networks should be based on solid, legal obligations rather than on voluntary agreement that are very difficult to control. Existing powers for tracing crimes should not be extended in a way that invades privacy until the need for such measures has been clearly demonstrated. The Working Group has in the past stated that any Interception of Private Communications should be subject to appropriate safeguards The introduction of new offences in the criminal law has to be handled extremely carefully, as a broad wording of such new offences as well as the penalisation of attempt and aiding and abetting such offences might lead to a considerable lowering of the privacy standard for all users of telecommunications networks by producing an enormous amount of personal identifiable data about Internet and telecommunications network usage, thus abolishing the right to anonymous use of such services. Ten Commandments to protect Privacy in the Internet World Common Position on Incorporation of telecommunications-specific principles in multilateral privacy agreements Virtual Right to be Alone: Nobody must be forced to let his or her personal data be published in directories or other indices. Every user has to be given the right to object to his or her data being collected by a search engine or other agents. Every user has to be given the right and the technical means to prevent the intrusion of external software into his own devices. Common Position on Privacy and Data Protection aspects of the Registration of Domain Names on the Internet The necessity to protect individuals has been recognised for more than twenty years in the existing national data protection regimes as well as in the international community (e.g. in the OECD guidelines on Privacy of 1980, the Council of Europe Convention No. 108, and, more recently, the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data). These regulations outline similar basic principles on the fair processing of personal information. Among these principles are the obligation to inform the data subjects about the processing of their personal data, the principle of limiting the collection and use of personal data to what is essential to the purpose specified and protection against unauthorised secondary uses. At the same time, any secondary use incompatible with the original purpose specified (e.g. marketing) should be based on the data subject´s informed consent. In this respect the level of privacy guaranteed by the present RAA (cf. point II.F.6.f) is not sufficient. The Working Group stresses that any registrar operating within the jurisdiction of existing data protection laws and any national domain name registration procedures are subject to the existing national data protection and privacy legislation and to the control by the existing national Data Protection and Privacy Commissioners. Common Position relating to Reverse Directories It is in any case necessary to endow the persons with the right to be informed by their provider of telephone or e-mail service, at the time of the collection of data concerning them, or if they have already subscribed, by a specific means of information, of the existence of services of reverse search and - if express consent is not required - of their right to object, free of charge, to such a search. Comments on the data protection impact of the revision of the ICANN RAA concerning accuracy and data retention of WHOIS data The Working Party finds the proposed new requirement to annually re-verify both the telephone number and the e-mail address and publish these contact details in the publicly accessible WHOIS database excessive and therefore unlawful. Because ICANN is not addressing the root of the problem, the proposed solution is a disproportionate infringement of the right to protection of personal data. Sana Ali sana.ali2030(a)gmail.com <mailto:sana.ali2030@gmail.com> https://ca.linkedin.com/in/sanaali2030 <https://ca.linkedin.com/in/sanaali2030>

3 2

Summary of the sections of the EWG Report pertinent to privacy
by Carlton Samuels April 11, 2016

April 11, 2016

I have been asked to summarize that portion of the EWG's Report pertaining privacy, inclusive of the FAQs. Much of what is said can be gleaned from Pages 11-12 and Section VI of the report, Here goes: ----------------------------------------------------------------------------- The EWG explicitly adopted that for the next generation RDS, registrants have a right to privacy and the reasonable expectation for the protection of their personal data, even when jurisdictions do not have data protection laws. We explicitly recommended adoption of a policy framework of 'privacy from the start' and implement mechanisms to introduce, harmonize and routinely reinforce this perspective; privacy by design. We recommended adoption of several overarching legal principles as framework: *" Personal data must be:* *· processed lawfully, fairly and in a transparent manner in relation to the data subject,* *· collected for specific, explicit and legitimate purposes and not further processed in a way incompatible with those purposes,* * · adequate, relevant, and limited to the minimum necessary in relation to the purposes for which they are processed, and* *· accurate and kept up-to-date as required for the specified purposes.* *Lawful processing, including transfer and disclosure can be – subject to the relevant jurisdiction – based on:* *• consent of the data subject,* *• the necessity for the performance of a contract to which the data subject is party, and* *• the necessity for compliance with a legal obligation to which the controller is subject.* *"* In addition, the Group adopted as principle the a right of the data subject to access the information and a right to rectify inaccuracy in the information kept on them. The report then outlined several ways privacy would be embraced and even enhanced in the next generation RDS: - ICANN adopt and disseminate a privacy policy - Add and use standard contract clauses that are harmonized with privacy and data protection laws and codified in policy - A “rules engine” to apply data protection laws by jurisdiction - a pre-validated Contact Directory which offers unique Contact IDs to deter personal data fraud - a centralized interface from whence to access all gTLD registration data - gated dataset beyond a small subset of RD for publication - RDAP or EPP to access gTLD data in the several registration data stores - purpose driven access to data inside the gate and only to users who disclose their identity, are authenticated, request gated data for a previously determined permissible purpose and are accountable. This includes law enforcement. - An accredited Privacy/Proxy Service for general use - An accredited Secure Protected Credentials Service for persons at risk and in instances where free speech rights may be denied or speakers persecuted. -------------------------------------------------------------------------------------------- -Carlton ============================== Carlton A Samuels Mobile: 876-818-1799 *Strategy, Planning, Governance, Assessment & Turnaround* =============================

1 0

Privacy Team Checklist - 11 April 1500
by Lisa Phifer April 11, 2016

April 11, 2016

Hello all, Today's privacy team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw Thanks to all who have been posting summaries, which you will find hyperlinked in the attached checklist. As you all know, this team is still looking for reviewers for unassigned documents. If you wish to summarize a still-unassigned doc, just reply to this message or email David <davecake(a)gmail.com> directly. Best, Lisa

2 1

SUMMARY: ICANN's Public Consultation on 2013 RAA Data Retention Specification Data Elements and Legitimate Purposes for Collection and Retention (17 April 2014)
by Ayden Fabien Férdeline April 11, 2016

April 11, 2016

ICANN's Public Consultation on 2013 RAA Data Retention Specification Data Elements and Legitimate Purposes for Collection and Retention (17 April 2014) Summary: * This document is a letter from the European Data Protection Supervisor to ICANN in response to its 2013 public consultation on the RAA Data Retention Specification Data Elements and Potentially Legitimate Purposes for Collection/Retention (' the draft Specification '). * The draft Specification “falls short of compliance with European data protection law.” * “The draft Specification should only require collection of personal data which is genuinely necessary for the performance of the contract between the Registrar and the Registrant (e.g. billing) or for other compatible purposes such as fighting fraud related to domain name registration. This data should be retained for no longer than is necessary for these purposes. It would not be acceptable for the data to be retained for longer periods or for other, incompatible purposes, such as law enforcement purposes or to enforce copyright.” * The “retention of personal data originally collected for commercial purposes, and subsequently retained for law enforcement purposes … [is] invalid.” * ICANN is encouraged “to take a lead in ensuring that privacy and data protection are embedded by default, when new tools and instruments or new Internet policies are designed, for the benefit of all – not just European – Internet users.” Ayden Férdeline Statement of Interest

1 0

SUMMARY | Opinion of the European Data Protection Supervisor: Europe's Role in Shaping the Future of Internet Governance (23 June 2014)
by Ayden Fabien Férdeline April 11, 2016

April 11, 2016

Opinion of the European Data Protection Supervisor: Europe's Role in Shaping the Future of Internet Governance (23 June 2014) Summary: * This document calls for all Internet policy discussions to take into consideration the internationally-recognised, fundamental rights of privacy and data protection. Such rights are: * 1) at the basis of users' online interactions, 2) should be protected online as well as offline, and 3) “are not negotiable”. * The current WHOIS system is named as “an example of a data protection issue which has to be addressed” because of its “authentication and data retention requirements.” It must be replaced “with a solution taking account, inter alia, of privacy concerns.” * Data protection authorities must be represented in multi-stakeholder Internet governance processes and must ensure that respect for fundamental rights are assured for all users regardless of their means and capabilities. They should also should work to ensure the harmonisation of data protection rules at a global level. * Data controllers have a responsibility to: * provide transparent and easily accessible and understandable information, should provide procedures and mechanisms for exercising a data subject's rights, must provide information on storage periods, must provide information on rights to lodge a complaint, and must provide information in relation to the international transfer of data and to the source from which the data is originating. * Users have the right to be forgotten and to erasure. In balancing the right to erasure against the freedom of information, the former overrides the general public's right to be informed, unless the data subject plays a role in public life that justifies interference with his/her right to privacy. * There is a close relationship between technological design and data protection. The principles of data protection-by-design and by-default could serve as significant enablers of trust on the Internet. Accordingly the inclusion of optimal data protection standards in the development of technology at the early design phase is encouraged. * Conflicts of law arise in connection with the Internet, jeopardising users' rights to privacy and data protection, and these need to be solved. “Given the global and cross-border nature of the Internet, personal data is often transferred to and processed in jurisdictions other than those in which users have submitted their data, exposing them to the risk of lower or no data protection. In addition, controllers processing personal data on the Internet may be faced with conflicting laws and obligations and must choose between violating foreign obligations or EU data protection safeguards … which in consequence undermines the data protection safeguards afforded to users under EU law.” * Google v AEPD might provide some guidance on answering this question – in this judgement the Court of Justice of the European Union ruled that the presence of an establishment on the territory of an EU Member State and the relationship between the activities of that establishment and the data processing at issue can be used to decide the applicability of EU data protection law to a processing carried out online. * “From a European perspective, we would encourage controllers processing the personal data of EU individuals on the Internet to increase the transparency and the amount of information they provide to users in relation to the law(s) they are subject to and the data protection rules they are bound to apply, including laws on access to data by government bodies, jurisdictions where data may be processed, and what safeguards have been implemented to protect users' data.” Ayden Férdeline Statement of Interest

1 0

Privacy Team Checklist - 8 April
by Lisa Phifer April 8, 2016

April 8, 2016

Hello all, This morning's privacy team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw David is working to get remaining docs assigned to privacy team volunteers. If you wish to summarize a still-unassigned doc, just reply to this message or email David <davecake(a)gmail.com> directly. Best, Lisa

2 1

Human Rights and Privacy Frameworks
by Kathy Kleiman April 7, 2016

April 7, 2016

Hi All, I know we need additional documents like a hole in the head, but "sensitive data" is going to be key to our WG evaluation. "Sensitive data" involves ethnicity and race, political opinions, religious beliefs, memberships, and more. "Sensitive data" in the EU and other countries has its own privacy protections for individuals and the institutions/organizations in which they exercise rights and fundamental freedoms. The documents below are largely on our list already, but if not, I would like to add them; if they are on the list, I would like to flag the sections below for special inclusion in our summary for the WG: 1. /United National Universal Declaration of Human Rights// /Protects "sensitive data" surrounding race, colour, sex, language, religious, political or other opinion, national or social origin, property, birth or other status." Particularly Article 2, /"Equality and Non-discrimination",/ http://ccnmtl.columbia.edu/projects/mmt/udhr/ 2. /European Convention 108, Article 1 and Article 6: A/ddresses issues regarding "rights and fundamental freedoms" and "special categories of data" specifically related to race, political review, health and sexual life, religion, etc, that /"may not be processed automatically unless domestic law provides appropriate safeguards." /Convention 108 is on our list already, but these sections may not have been flagged. /David and Lisa: //has anyone selected this doc to summarize? If not, I will. /3. /European Data Protective Directive /Article 8 addresses "sensitive data" issues pertaining to health or sex life, racial or ethnic original, political opinions, religious or philosophical beliefs, trade-union membership/. //Ditto - same question as above. / Best and tx, Kathy On 4/6/2016 5:57 AM, Kimpián Péter wrote: > > Sorry, one minor issue to be clear if we are in ICANN context in > example 3,4 (not in EU general data protection legislation) then the > same argumentation goes for me as in example 1,2. > > best regards, > > Peter > > *From:*Kimpián Péter [mailto:kimpian.peter@naih.hu] > *Sent:* Wednesday, April 6, 2016 11:44 AM > *To:* 'Kathy Kleiman' <kathy(a)kathykleiman.com>; > 'Monika.Zalnieriute(a)eui.eu' <Monika.Zalnieriute(a)eui.eu>; 'KWASNY > Sophie' <Sophie.KWASNY(a)coe.int>; 'Stephanie Perrin' > <stephanie.perrin(a)MAIL.UTORONTO.CA> > *Subject:* RE: Human Rights and Privacy > > Dear Kathy, dear Stephanie, Monika and Sophie, > > Thank you for the wonderful questions, these are very relevant one. > Some piece of legislation and my understanding of it: > > To always start with the highest level: > > ·*The Universal Declaration of Human Rights: *Article 2. : /Everyone > is entitled to all the rights and freedoms set forth in this > Declaration, without distinction of any kind, such as race, colour, > sex, language, religion, political or other opinion, national or > social origin, property, birth or other status. Furthermore, no > distinction shall be made on the basis of the political, > jurisdictional or international status of the country or territory to > which a person belongs, whether it be independent, trust, > non-self-governing or under any other limitation of sovereignty./ > > // > > ·From European point of view there are different human rights which > are at stake in the examples you gave: rights of association, freedom > of religion, freedom of opinion, principle of non-discrimination, > rights to privacy, right to data protection, freedom of speech. every > each of them has an extensive jurisprudence mainly from the European > Court of Human Rights to determine the ways of their implementation > and scope, limits. As for privacy and data protection: these rights > are guaranteed for individuals as you will see in CoE Convention 108 > and in Directive 95/46: // > > o*Convention 108: Article 1 – Object and purpose: */The purpose of > this Convention is to secure in the territory of each Party for every > individual, whatever his nationality or residence, respect for his > rights and fundamental freedoms, and in particular his right to > privacy, with regard to automatic processing of personal data relating > to him ("data protection")./ > > oYou will see the same concept in the *EU Directive 95/46 *: *Article > 1 Object of the Directive*: /1. In accordance with this Directive, > Member States shall protect the fundamental rights and freedoms of > natural persons, and in particular their right to privacy with respect > to the processing of personal data./ > > oIn the examples you mention the data controller have to deal with > individuals _“sensitive data” _(as we call it in Europe). Our higher > legislations call it “special categories of data” and they are > protected in a greater way. Usually only in cases falling under > exceptions that those data can be processed but in any case additional > safeguards have to be added wen processing those data:// > > // > > §*Convention 108: Article 6*//*– Special categories of > data:*/ Personal data revealing racial origin, political opinions or > religious or other beliefs, as well as personal data concerning health > or sexual life, may not be processed automatically unless domestic law > provides appropriate safeguards. The same shall apply to personal data > relating to criminal convictions./ > > §*Exceptions*: > > ·/ a, protecting State security, public safety, the monetary interests > of the State or the suppression of criminal offences;/ > > ·/ b, protecting the data subject or the rights and freedoms of others./ > > // > > §*Directive 95/46: Article 8, The processing of special categories of > data*: /1. Member States shall prohibit the processing of personal > data revealing racial or ethnic origin, political opinions, religious > or philosophical beliefs, trade-union membership, and the processing > of data concerning health or sex life./ > > §*Exceptions/:/*/2. Paragraph 1 shall not apply where: / > > // > > ·/(a) the data subject has given his explicit consent to the > processing of those data, except where the laws of the Member State > provide that the prohibition referred to in paragraph 1 may not be > lifted by the data subject's giving his consent; or/ > > ·/(b) processing is necessary for the purposes of carrying out the > obligations and specific rights of the controller in the field of > employment law in so far as it is authorized by national law providing > for adequate safeguards; or/ > > ·/(c) processing is necessary to protect the vital interests of the > data subject or of another person where the data subject is physically > or legally incapable of giving his consent; or/ > > ·/(d) processing is carried out in the course of its legitimate > activities with appropriate guarantees by a foundation, association or > any other non-profit-seeking body with a political, philosophical, > religious or trade-union aim and on condition that the processing > relates solely to the members of the body or to persons who have > regular contact with it in connection with its purposes and that the > data are not disclosed to a third party without the consent of the > data subjects; or/ > > ·/(e) the processing relates to data which are manifestly made public > by the data subject or is necessary for the establishment, exercise or > defence of legal claims./ > > ·/3. Paragraph 1 shall not apply where processing of the data is > required for the purposes of preventive medicine, medical diagnosis, > the provision of care or treatment or the management of health-care > services, and where those data are processed by a health professional > subject under national law or rules established by national competent > bodies to the obligation of professional secrecy or by another person > also subject to an equivalent obligation of secrecy./ > > ·/4. Subject to the provision of suitable safeguards, Member States > may, for reasons of substantial public interest, lay down exemptions > in addition to those laid down in paragraph 2 either by national law > or by decision of the supervisory authority./ > > ·/5. Processing of data relating to offences, criminal convictions or > security measures may be carried out only under the control of > official authority, or if suitable specific safeguards are provided > under national law, subject to derogations which may be granted by the > Member State under national provisions providing suitable specific > safeguards. However, a complete register of criminal convictions may > be kept only under the control of official authority./ > > ·/Member States may provide that data relating to administrative > sanctions or judgements in civil cases shall also be processed under > the control of official authority./ > > // > > o*For religious questions*it is a bit more complicated. All European > states have to guarantee the freedom of religion (which also means no > interference, no discrimination on religious grounds, etc.) but the > modality is at the states hand. For this there are three ways: > religious state, laic state and state in between. There are no > religious state in Europe which means in every country the gvt is > divided form the governance of a religious organisation. There are > several laic state in Europe where the most famous is France where > there is a strict separation of state and religion. There a good > number of in between state like mine where the government support > actively and financially some religious organisations. (and this a > never ending debate on which ground they chose them and how much they > like one or another // > > // > > _To sum up:_there is no legislation which protects associations, > groups, religious groups rights to privacy or data protection, but > every data related to them can be easily classified as sensitive one > where in the majority of states there is a clear prohibition with the > narrowly interpreted exceptions and as a minimum standard a better > protection must be attributed to them and additional safeguards must > be put in place. > > Coming back to ICANN context and your examples: > > 1.For example, when individuals gather together to speak/write about > minority religious, ethnic, political views and would prefer not to > publish their physical location publicly àI would say that there is > contract between ICANN/Registrars and registrants and if under this > contract the individual who wish not to give its consent for the > publication of its address ICANN/Registrars cannot overrule tis > non-consent by the RDS requirements (one is a human right the other > one is a public company policy). In my opinion only one contact detail > as per the choice of the data subject would be sufficient to go on > public in ICANN context which preferably would be the e-mail ID. It is > for the Registrars to check under their contract that the email ID is > adequate and serves the purpose (the domain name holder can be > contacted through it). Furthermore if there is about a data which is > sensitive or can be related to a sensitive data than even for > non-public processing ICANN/Registrars should put additional > safeguards in place > > 2.Some minority religious groups, such as mosques in the US South or > synagogues in certain regions àthe same argumentation as above and in > the top of it we speak here ab ovo about sensitive data (which can > only be public with the deliberate and informed consent of the data > subject and additional safeguards have to be put in place) > > 3.If I am a home-based business, is there any protection under EU data > protection law that would protect me from having to publish my home > address àthis is a more difficult one. I would say no in this case > because the data subject is doing business and it is a valid > expectation to get to know the business official address. Moreover it > will fall under the exceptions mention above and will be prescribed by > the law. So if I am teaching at home as a self-employed private > business I have to reveal my home address as the place of the > residence of the company. This is why all over Europe there are > business which are providing residence services for small and medium > size businesses which consist of providing their address as place of > residence for the self-employed company (same as the privacy proxy > services). > > 4.Would I be entitled to the privacy of my personal home even if I am > engaged in business activities under data protection laws? àWell, no > for the reasons specified above. You can hide most of the time your > home address if you are an individual but if you start operating a > business form your home there will be legislation which will foresee > the publication of the address of your residence of your company. It > is of your customers interest to know the legal address of the > company, business they are dealing with. Data protection is for > individuals (for now). > > Hope all this helps. If you have further question or you seek some > more claruty on one or several issue or you disagree just let me know > anytime. > > Best regards, > > Peter > > // > > // > > // > > *From:*Kathy Kleiman [mailto:kathy@kathykleiman.com] > *Sent:* Tuesday, April 5, 2016 7:58 PM > *To:* Monika.Zalnieriute(a)eui.eu <mailto:Monika.Zalnieriute@eui.eu>; > HUNGARY: Peter KIMPIAN (kimpian.peter(a)naih.hu > <mailto:kimpian.peter@naih.hu>) <kimpian.peter(a)naih.hu > <mailto:kimpian.peter@naih.hu>>; KWASNY Sophie <Sophie.KWASNY(a)coe.int > <mailto:Sophie.KWASNY@coe.int>>; Stephanie Perrin > <stephanie.perrin(a)MAIL.UTORONTO.CA > <mailto:stephanie.perrin@MAIL.UTORONTO.CA>> > *Subject:* Human Rights and Privacy > > Hi Monica and Peter (I know Sophie is out of town), > /Based on the discussions of the RDS WG today, Stephanie and I were > wondering if you could assist us in identifying human rights documents > that protect the privacy rights of groups and associations? /For > example, when individuals gather together to speak/write about > minority religious, ethnic, political views and would prefer not to > publish their physical location publicly. Some minority religious > groups, such as mosques in the US South or synagogues in certain > regions, might choose to remove themselves from local maps to avoid > easy targeting and would prefer not to list their physical address as > a condition of obtaining a domain name to share the time of their > services (with those who already know where to find them). /Is there > Human Rights legislation that you can point us to that might protect > the privacy of these groups and organizations? * > */ > Data Protection and small business question -- If I am a home-based > business, is there any protection under EU data protection law that > would protect me from having to publish my home address? In the US, > with such poor leave or flexibility for mothers, many women open their > own businesses when their children are young. They work parttime, from > home, often in a business-to-business context. /Is there any > protection in the EU for such an arrangement? Would I be entitled to > the privacy of my personal home even if I am engaged in business > activities under data protection laws? I think so, but wanted to > confirm... / > > Best and tx! > Kathy >

2 1

Checklist and summaries
by David Cake April 7, 2016

April 7, 2016

Staff has helpfully prepared a checklist of documents for the team so far, which is attached. I’ve very much appreciated the contribution of those who have suggested additional documents, and please feel free to suggest more, but with an eye to wrapping up this work fairly quickly, we should begin to focus more on summarisation of documents. You can see on this checklist there are quite a few still to be summarised. We will further be talking about this on todays call. Please volunteer to summarise documents if you can. Summaries should be short and to the point, and your summary should include which aspects of that document you feel are relevant to privacy considerations and why (some documents may also be relevant to other aspects of the WGs work). If you disagree with a summary presented by another, please don’t try to engage in prolonged discussion on the WG - if you think the summary is misleading or lacking please attempt your own summary and we can attempt some synthesis, if you have a more substantive issue then it is probably best addressed during deliberations of the entire WG. Regards David

6 7

Privacy Team Checklist - 7 April
by Lisa Phifer April 7, 2016

April 7, 2016

Hello all, Another updated privacy team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw Just follow the link above if you're looking for the latest daily update of any team's checklist. The privacy team's list includes many documents that have been identified but still need volunteers to summarize them: * 2013 RAA's <https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en#dat…>Data Retention Specification Waiver and <https://www.icann.org/en/system/files/files/draft-data-retention-spec-eleme…>Discussion Document (2014) * <https://community.icann.org/pages/viewpage.action?pageId=56986688>WHOIS Studies (2012-2014) , especially <http://www.icann.org/en/announcements/announcement-2-18may10-en.htm>WHOIS Privacy/Proxy Abuse Study and <http://gnso.icann.org/issues/whois/whois-pp-relay-reveal-feasibility-survey…>WHOIS Privacy/Proxy Relay and Reveal Survey * <https://www.icann.org/en/system/files/files/sac-055-en.pdf>SAC055, WHOIS: Blind Men and an Elephant (September 2012) * Article 29 WP statement on the data protection impact of the ICANN RAA (2013-2014) * Article 29 WP on ICANN's WHOIS Database Policy (2006) * Additional Article 29 WP documents that may be of interest to this PDP WG (4) * Council of Europe <https://wcd.coe.int/ViewDoc.jsp?Ref=Decl%2803.06.2015%292>Declaration of Committee of Ministers on ICANN, human rights and the rule of law (3 June 2015) * <http://www.coe.int/en/web/conventions/search-on-treaties/-/conventions/trea…>Council of Europe's Treaty 108 on Data Protection * <http://ec.europa.eu/justice/newsroom/data-protection/news/160229_en.htm>European Commission News Announcement: EU-US Privacy Shield * <http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=URISERV%3Al14012>European Data Protection Directive, 1995 * <https://www.icann.org/en/system/files/newsletters/privacy-proxy-registratio…>NORC Study of WHOIS Privacy/Proxy Prevalence (2010) * <https://www.icann.org/en/system/files/files/final-report-06jun14-en.pdf>EWG Recommendations for a Next-Generation RDS, especially Sections 6 & 7 * EWG Research:<https://community.icann.org/download/attachments/43982771/Memo%20to%20EWG%2…> Data Protection Considerations Applicable to Collection of gTLD Reg Data Memo * EWG Research: <https://community.icann.org/download/attachments/45744698/EWG%20PP%20PROVID…>WHOIS Privacy and Proxy Service Provider Practices Survey * <http://london50.icann.org/en/schedule/mon-ewg-final-overview/presentation-e…>EWG Tutorial Pages 28-30 and <https://community.icann.org/display/EWG/EWG+FAQs>EWG FAQs 31-38 * Statements/Blogs by <http://www.circleid.com/posts/20141105_how_to_improve_whois_data_accuracy/>Ajayi and <https://www.icann.org/en/system/files/files/perrin-statement-24jun14-en.pdf>Perrin * <https://community.icann.org/display/gTLDRDS/Process+Framework>Process Framework for a PDP on Next-Generation RDS, Page 9, Row 5 * <http://www.ohchr.org/Documents/Issues/Privacy/A-HRC-31-64.doc>Human Rights Council - Report by the UN Special Rapporteur on the right to privacy * EU Court of Justice Judgements that may apply to gTLDs (2 examples on checklist) * Relevant National Laws or Court Rulings that may apply to gTLDs (2 examples on checklist) * <https://mitpress.mit.edu/books/governance-privacy>Governance of Privacy: Policy Instruments in Global Perspective (MIT Press 2006) Although some, such as Article 29 correspondence and SAC055, are being reviewed by other teams to summarize aspects relating specifically to RDS data elements and purpose, it falls to the privacy team to summarize aspects of these documents that deal with data protection laws and privacy. If you'd like to review and summarize any of these remaining docs, please reply to this message. Best, Lisa

2 1

Re: [Gnso-rds-pdp-privacy] Privacy Team Checklist - 6 April
by Stephanie Perrin April 7, 2016

April 7, 2016

That is a great line, Ayden, I totally agree and I snort about electronic fees so often that I am now an old curmudgeon clinging stubbornly to paper. I won't tell you how long my hard copy of Graham's book has sat on my study couch, where I can get a pennysworth of enjoyment every day I look at it, at least. (I am not getting through it anytime soon, at 577 pages) Fav chapter for our purposes is, in my view, Chapter 3, Standards by which to assess a Country's Data Privacy Laws. Now that is not much help in predicting how a country will find with respect to the question of WHOIS, but it shows those unfamiliar with DP law what scholars look for in assessing a framework. I would note that much later on, he analyses the Bennett and Raab prediction re race to the top, race to the bottom, and finds in fact high standards in Asian law. One thing you could do, as the index is v unhelpful in looking for keywords like ICAnn and WHOIS and public registry, is do a scan when you get your hands on the electronic version. i would love to know if he has found any cases on WHOIS. thanks! Stephanie On 2016-04-06 19:06, Ayden Férdeline wrote: > Hi Stephanie, > > The LSE is kind enough to grant alumni access to e-books, so I have > access to the full text you mentioned (Asian Data Privacy Laws: Trade > & Human Rights Perspectives). I can summarise a few chapters, though I > wouldn't be able to do so until mid next week. If you have the > contents page handy, might you be able to suggest which chapter(s) I > should summarise? That being said, I think the point you alluded to, > though — that we, as a Working Group, should all have the same access > to review in full the texts we are summarising — is a very valid one. > I think the Guardian put it best when they said, “academic publishers > make Murdoch look like a socialist.” £74.75 for 24 hours access to > that text, which was probably funded through government research > grants and academic stipends? It hardly seems justifiable… > > Best wishes, > > Ayden > > On Wed, Apr 6, 2016 6:09 PM, Stephanie Perrin via Gnso-rds-pdp-privacy > gnso-rds-pdp-privacy(a)icann.org <mailto:gnso-rds-pdp-privacy@icann.org> > wrote: > > Yes it certainly clears up the redundancy that I thought I > saw....I figured one reference is enough as the links are all > there, but whatever you like.ï¿½ Not sure the article adds a whole > pile to our understanding but I am immersed in this stuff.ï¿½ And > yes, there is an ebook but the price point is (IMHO) a bit nutty > and I did not think you could just buy one chapter.ï¿½ I am old > fashioned, I like the book in my hand.... > I can of course siphon off one chapter through my uni library but > this is not cricket, so thought I would ask Graham how he felt > about sharing it. He may also, being prolific, have spun that work > off in an article we could find somewhere (not me, not now) > Thanks again Lisa! > cheers steph > On 2016-04-06 12:58, Lisa Phifer wrote: >> Thanks Stephanie. I had noticed that Kathy suggested the same >> Greenleaf book that you had, but thought it important to add the >> article about the tables also cited by Kathy. That's why the >> checklist contains both: >> >> * Global Tables (2015, abstract and PDF download here: >> http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2603502 >> <http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2603502>) and >> >> * Article about the Global Tables (2015, abstract and PDF >> download here: >> http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2603529 >> <http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2603529>) >> >> Please let me know if that doesn't clear up the apparent >> redundancy. No doubt it would be useful for the same person to >> review/summarize both together for the privacy team, since the >> article discusses recent updates to the table and the trends >> behind them. >> >> FYI, Greenleaf's 2014 book is available commercially as an e-book >> - see https://books.google.com/books?id=0eAuBQAAQBAJ >> <https://books.google.com/books?id=0eAuBQAAQBAJ> . Since we don't >> have public access to it, perhaps you could summarize the chapter >> you found useful? Doing that now would at least help the WG >> remember this resource exists when the time comes for detailed >> analysis of privacy laws. >> >> Best, Lisa >> >> >> At 09:23 AM 4/6/2016, Stephanie Perrin via Gnso-rds-pdp-privacy >> wrote: >>> Thanks Lisa, there is a redundancy, in that the global table I >>> sent you (SSRN article by Greenleaf) is the same as the one >>> Kathy resent which appears below it.ï¿½ >>> In his 2014 book on asian privacy laws, which I did not send as >>> it is hardcover only, there is an excellent chapter on how to >>> evaluate/compare privacy laws, which has always been a puzzle >>> for WHOIS discussions.ï¿½ I could summarize that but probably >>> not distribute a scanned copy, however graham is a great >>> advocate for access so if interested I could pester him and see >>> if he has an electronic version. >>> cheers stephanie >>> >>> On 2016-04-06 10:39, Lisa Phifer via Gnso-rds-pdp-privacy wrote: >>>> Hello all, >>>> >>>> Today's updated privacy team checklist (attached) was just >>>> posted to the wiki at: >>>> https://community.icann.org/x/p4xlAw >>>> <https://community.icann.org/x/p4xlAw> >>>> >>>> Just follow the link above if you're looking for the latest >>>> daily update of any team's checklist. >>>> >>>> In today's checklist update, to make it clearer which docs are >>>> not yet assigned, I have removed the ? names from the "Reviewed >>>> by" column. As you can see, there are still plenty of docs >>>> identified by this team over the past week or so that could >>>> still use volunteers to review them. For those not certain how >>>> much work is involved: summaries should be concise - for >>>> example, "executive summaries" that point the WG to the >>>> portions of the document most relevant to RDS privacy and why. >>>> >>>> Best, Lisa >>>> >>>> >>>> At 11:49 AM 4/5/2016, David Cake via Gnso-rds-pdp-privacy wrote: >>>> >>>> >>>>> Please find attached a summary of the proposed plan to finish >>>>> the sub-teams input summarising work as presented on todays >>>>> call. Weï¿½?Td like to get this document summarising work done >>>>> (of course, we know other relevant documents may be published >>>>> from here on, but we can handle those as the come) so we can >>>>> get back to full WG mode and start proceeding with the rest of >>>>> the work plan. >>>>> >>>>> So what we are asking of you now is: >>>>> >>>>> Please look at the input checklist provided, choose at least >>>>> one input (ideally one that has not been looked at yet) that >>>>> you are wiling to summarise, and email the whole group to let >>>>> them know that you are working on it. Aim to have these >>>>> summaries done by Monday. >>>>> Please try to do this by the end of Wednesday. >>>>> >>>>> This doesnï¿½?Tt mean that we are necessarily done with >>>>> identification of new inputs - if you have someone else >>>>> valuable to add, feel free to continue to do so. But the focus >>>>> should now be on summarising what we have. >>>>> >>>>> >>>>> David >>>>> >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> Gnso-rds-pdp-privacy mailing list >>>>> Gnso-rds-pdp-privacy(a)icann.org >>>>> <mailto:Gnso-rds-pdp-privacy@icann.org> >>>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-privacy >>>>> <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-privacy> >>>> >>>> >>>> >>>> _______________________________________________ >>>> Gnso-rds-pdp-privacy mailing list >>>> Gnso-rds-pdp-privacy(a)icann.org >>>> <mailto:Gnso-rds-pdp-privacy@icann.org> >>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-privacy >>> >>> _______________________________________________ >>> Gnso-rds-pdp-privacy mailing list >>> Gnso-rds-pdp-privacy(a)icann.org >>> <mailto:Gnso-rds-pdp-privacy@icann.org> >>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-privacy >>> <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-privacy> > > > Ayden Férdeline > +44.77.8018.7421 >

1 0