- Gnso-rds-pdp-privacy - lists.icann.org

Memo to EWG re gTLD Registration Data and International Data Privacy Considerations AND privacy-proxy-registration services-study 14sep10-en
by nathalie coupet April 12, 2016

April 12, 2016

Good afternoon, Here are two additional documents assigned to me. The Expert Working Group on gTLD Directory Services (EWG) wasformed by ICANN to help resolve the nearly decade-long deadlock within theICANN community on how to replace the current Whois system. EWG’s mandate is to reexamine and define thepurpose of collecting and maintaining gTLD directory services, to consider howto safeguard the data, and to propose a next generation solution that willbetter serve the needs of the global Internet community. 1) Purposes defined by the EWG EWG concluded the current Whoismodel—giving every user the same anonymous public access to gTLD registrationdata—should be abandoned. Instead, EWGrecommended a paradigm shift whereby gTLD registration data is collected,validated and disclosed for permissible purposes only, with some data elementsbeing accessible only to authenticated requestors that are then heldaccountable for appropriate use. EWGproposed that permissible purposes include domain name control, domain nameresearch, personal data protection, legal actions, technical issue resolution,regulatory/contract enforcement, domain name purchase/sale, individual Internetuse, abuse mitigation, and Internet services provision. 2) Centralized or Federated Model? The selection, implementation anduse of a specific Whois database structure (i.e., centralized or federated)should be informed by applicable legal principles of “personal data” protection,but no uniform definition of “personal data” exists and there are variousdisparities between existing regimes. Thesedifferences in data projection regulation raise significant jurisdictional concerns, as well aspotential regulatory obstacles on the global collection, processing, andtransfer of gTLD registration data that need to be considered when structuring,implementing, and administrating the Whois database replacement platform. · Notwithstanding the territorial nature of data privacy laws,many such laws have extraterritorial reach. · The administration of the Whois database may thus implicatethe laws of (i) the country where the Whois database platform is located, (ii)the country where the data owner/licensor/controller (controller) is located(i.e., where the registrar, registry, and possibly the Whois databaseadministrator are located to the extent such entities dictate the processing ofgTLD registration data), and (iii) the country where the data subjects (e.g.,registrants) are located · The controlling and most relevant law to consider is the lawwhere the data subject (i.e., registrant) resides, as the ultimate goal of dataprotection laws is the protection of individual personal data. Hence, the application of data protectionlaws will depend greatly on (i) where gTLD registration data will be located,(ii) whether ICANN (or the entity administering the database) will be viewed as a controller or processor ofsuch data, and hence have direct compliance obligations, (iii) the obligationsimposed on registrars/registries under their agreements with ICANN with respectto gTLD registration data, and (iv) the extent to which local data protectionlaws apply to registrants. · The distinction between data controller and dataprocessor is important, as controllers are required to comply with applicabledata protection laws, and must impose certain data protection obligations on dataprocessors. Processors are required toabide by the instructions of controllers. · This will influence the data location andtransfer considerations for the Whois replacement platform, whether as acentralized or federated model, and whether the Whois replacement databaseadministrator and/or registrars conduct themselves as controllers in connectionwith gTLD registration data. · The most comprehensive data protection andprivacy compliance legal framework remains to be the E.U. Data ProtectionDirective (E.U. Directive), Directive 95/46/EC of the European Parliament andof the Council of 24 October 1995 on the protection of individuals with regardto the processing of personal data and on the free movement of such data =>baseline for data protection compliance Datacontrollers must process personal data in accordance with the followingrelevant data privacy and protection principles: Purpose limitation: legitimatepurposes only. Data quality and proportionality:accurate and up to date. Transparency: notification of dataproviders Security and confidentiality:protection measures Rights of access, rectification,deletion and objection by data subjects Sensitive data: additionalsecurity measures Direct marketing: “opt-out” mustbe possible Data retention: limited time tosatisfy the purpose Accountability: for data collectors The transfer of personaldata from registrars to ICANN or the designated operator under a centralizedmodel, or the sharing of data between registrars under a federated model, willtherefore likely require data subject consent. Data transfers between ICANN or a designated operator and the registrarslikely also require that certain contractual obligations be imposed throughoutthe system. Choice of accountability and liability of the data controlleror the data processor for any data breach or violation of local laws depends onthe dependance (or independence) of the processor towards the controller inboth models. Sanctions: Regulatory fines, criminal sanctions, and injunctions on dataprocessing. International transfers ofpersonal data in violation of local data protection laws could also lead to aninjunction on data transfers, hampering the effectiveness of the Whoisdatabase replacement platform. The availability ofsuch penalties under local data protection regimes will potentially fuel localregistrar/registry opposition to a Whois database replacement platformunder either of the proposed models. Again, in some countries thetransfer of personal data from registrars to ICANN or the designated operatorunder a centralized model, or the sharing of data between registrars under afederated model, likely will require the consent of the data subjects. Data transfers between ICANN or thedesignated operator and the registrars likely also require that certaincontractual obligations be imposed throughout the system. Other issues: 1) various registrars provide an upgradedfee-paying subscription service that addresses personal data privacy and maywhich to continue with this source of revenues 2) considerable secure storage capacity. Cloud computing may introduce heightened datasecurity concerns and complicate proportionality in processing, internationaltransfer restrictions, and data storage. Conclusion: While technical, political and other considerationswill inform the implementation of the Whois database replacement platform, both models under consideration raisecritical data privacy issues that must be considered. privacy-proxy-registration services-study 14sep10-en Domain names can be registered using a Whois privacy orproxy service, which helps limit the amount of users’ personal information thatis made public via registrar and registry Whois services. The sample of domainnames registered under the top 5 gTLDs indicates that about 18% of them usedthis type of service. Among these, Whois proxy service registrations were themost common. Nathalie Coupet

1 0

Data Team Checklist - 12 April 13:00
by Lisa Phifer April 12, 2016

April 12, 2016

Dear privacy team, Today's privacy team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw Thanks to all who have been posting summaries, which you will find hyperlinked in the attached checklist. David will be using this to discuss the team's progress during today's WG call. As you know, David is seeking privacy team volunteers to review unassigned docs, highlighted in yellow. This checklist will be updated again later today with those additional assignments still under discussion. Best, Lisa

1 0

Work so far
by David Cake April 12, 2016

April 12, 2016

Thank you so much to Steve, Ayden, Kathy and others who have finished there summaries or are still working on them. I, and the whole leadership team, really appreciates the great work being done. The privacy team is running a little behind schedule, because as you can see from the checklist there are still some documents that have no one assigned to create a summary. A few people have volunteered since, but if you would like to volunteer to summarise one of the as yet unallocated documents please contact Lisa and/or me. Some of the documents have been reviewed by other teams, but the summaries prepared for other teams will not focus on the privacy aspects, so ideally these should be reviewed by this team as well. Others have not been summarised yet at all. There are quite a few. Do we have any further volunteers to summarise any of these remaining documents? David

4 4

Summaries of Relevant Section from International Working Group on Data Protection in Telecommunications and Media Documents - Privacy
by Sana Ali April 11, 2016

April 11, 2016

• Privacy: What steps are needed to protect data and privacy? Common Position on data protection aspects in the Draft Convention on cyber-crime of the Council of Europe Existing conditions and safeguards provided for under domestic law and the Convention on Mutual Assistance in Criminal Matters between the Member States of the European Union (Art. 23) must be respected. Such conditions and safeguards should at least include • prior judicial authorisation, • (subsequent) notification of individuals, • limits on use, • record-keeping requirements, • monitoring and auditing as well as • public reporting. In particular the cooperation of national authorities with operators of public and private networks should be based on solid, legal obligations rather than on voluntary agreement that are very difficult to control. Existing powers for tracing crimes should not be extended in a way that invades privacy until the need for such measures has been clearly demonstrated. The Working Group has in the past stated that any Interception of Private Communications should be subject to appropriate safeguards The introduction of new offences in the criminal law has to be handled extremely carefully, as a broad wording of such new offences as well as the penalisation of attempt and aiding and abetting such offences might lead to a considerable lowering of the privacy standard for all users of telecommunications networks by producing an enormous amount of personal identifiable data about Internet and telecommunications network usage, thus abolishing the right to anonymous use of such services. Ten Commandments to protect Privacy in the Internet World Common Position on Incorporation of telecommunications-specific principles in multilateral privacy agreements Virtual Right to be Alone: Nobody must be forced to let his or her personal data be published in directories or other indices. Every user has to be given the right to object to his or her data being collected by a search engine or other agents. Every user has to be given the right and the technical means to prevent the intrusion of external software into his own devices. Common Position on Privacy and Data Protection aspects of the Registration of Domain Names on the Internet The necessity to protect individuals has been recognised for more than twenty years in the existing national data protection regimes as well as in the international community (e.g. in the OECD guidelines on Privacy of 1980, the Council of Europe Convention No. 108, and, more recently, the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data). These regulations outline similar basic principles on the fair processing of personal information. Among these principles are the obligation to inform the data subjects about the processing of their personal data, the principle of limiting the collection and use of personal data to what is essential to the purpose specified and protection against unauthorised secondary uses. At the same time, any secondary use incompatible with the original purpose specified (e.g. marketing) should be based on the data subject´s informed consent. In this respect the level of privacy guaranteed by the present RAA (cf. point II.F.6.f) is not sufficient. The Working Group stresses that any registrar operating within the jurisdiction of existing data protection laws and any national domain name registration procedures are subject to the existing national data protection and privacy legislation and to the control by the existing national Data Protection and Privacy Commissioners. Common Position relating to Reverse Directories It is in any case necessary to endow the persons with the right to be informed by their provider of telephone or e-mail service, at the time of the collection of data concerning them, or if they have already subscribed, by a specific means of information, of the existence of services of reverse search and - if express consent is not required - of their right to object, free of charge, to such a search. Comments on the data protection impact of the revision of the ICANN RAA concerning accuracy and data retention of WHOIS data The Working Party finds the proposed new requirement to annually re-verify both the telephone number and the e-mail address and publish these contact details in the publicly accessible WHOIS database excessive and therefore unlawful. Because ICANN is not addressing the root of the problem, the proposed solution is a disproportionate infringement of the right to protection of personal data. Sana Ali sana.ali2030(a)gmail.com <mailto:sana.ali2030@gmail.com> https://ca.linkedin.com/in/sanaali2030 <https://ca.linkedin.com/in/sanaali2030>

3 2

Summary of the sections of the EWG Report pertinent to privacy
by Carlton Samuels April 11, 2016

April 11, 2016

I have been asked to summarize that portion of the EWG's Report pertaining privacy, inclusive of the FAQs. Much of what is said can be gleaned from Pages 11-12 and Section VI of the report, Here goes: ----------------------------------------------------------------------------- The EWG explicitly adopted that for the next generation RDS, registrants have a right to privacy and the reasonable expectation for the protection of their personal data, even when jurisdictions do not have data protection laws. We explicitly recommended adoption of a policy framework of 'privacy from the start' and implement mechanisms to introduce, harmonize and routinely reinforce this perspective; privacy by design. We recommended adoption of several overarching legal principles as framework: *" Personal data must be:* *· processed lawfully, fairly and in a transparent manner in relation to the data subject,* *· collected for specific, explicit and legitimate purposes and not further processed in a way incompatible with those purposes,* * · adequate, relevant, and limited to the minimum necessary in relation to the purposes for which they are processed, and* *· accurate and kept up-to-date as required for the specified purposes.* *Lawful processing, including transfer and disclosure can be – subject to the relevant jurisdiction – based on:* *• consent of the data subject,* *• the necessity for the performance of a contract to which the data subject is party, and* *• the necessity for compliance with a legal obligation to which the controller is subject.* *"* In addition, the Group adopted as principle the a right of the data subject to access the information and a right to rectify inaccuracy in the information kept on them. The report then outlined several ways privacy would be embraced and even enhanced in the next generation RDS: - ICANN adopt and disseminate a privacy policy - Add and use standard contract clauses that are harmonized with privacy and data protection laws and codified in policy - A “rules engine” to apply data protection laws by jurisdiction - a pre-validated Contact Directory which offers unique Contact IDs to deter personal data fraud - a centralized interface from whence to access all gTLD registration data - gated dataset beyond a small subset of RD for publication - RDAP or EPP to access gTLD data in the several registration data stores - purpose driven access to data inside the gate and only to users who disclose their identity, are authenticated, request gated data for a previously determined permissible purpose and are accountable. This includes law enforcement. - An accredited Privacy/Proxy Service for general use - An accredited Secure Protected Credentials Service for persons at risk and in instances where free speech rights may be denied or speakers persecuted. -------------------------------------------------------------------------------------------- -Carlton ============================== Carlton A Samuels Mobile: 876-818-1799 *Strategy, Planning, Governance, Assessment & Turnaround* =============================

1 0

Privacy Team Checklist - 11 April 1500
by Lisa Phifer April 11, 2016

April 11, 2016

Hello all, Today's privacy team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw Thanks to all who have been posting summaries, which you will find hyperlinked in the attached checklist. As you all know, this team is still looking for reviewers for unassigned documents. If you wish to summarize a still-unassigned doc, just reply to this message or email David <davecake(a)gmail.com> directly. Best, Lisa

2 1

SUMMARY: ICANN's Public Consultation on 2013 RAA Data Retention Specification Data Elements and Legitimate Purposes for Collection and Retention (17 April 2014)
by Ayden Fabien Férdeline April 11, 2016

April 11, 2016

ICANN's Public Consultation on 2013 RAA Data Retention Specification Data Elements and Legitimate Purposes for Collection and Retention (17 April 2014) Summary: * This document is a letter from the European Data Protection Supervisor to ICANN in response to its 2013 public consultation on the RAA Data Retention Specification Data Elements and Potentially Legitimate Purposes for Collection/Retention (' the draft Specification '). * The draft Specification “falls short of compliance with European data protection law.” * “The draft Specification should only require collection of personal data which is genuinely necessary for the performance of the contract between the Registrar and the Registrant (e.g. billing) or for other compatible purposes such as fighting fraud related to domain name registration. This data should be retained for no longer than is necessary for these purposes. It would not be acceptable for the data to be retained for longer periods or for other, incompatible purposes, such as law enforcement purposes or to enforce copyright.” * The “retention of personal data originally collected for commercial purposes, and subsequently retained for law enforcement purposes … [is] invalid.” * ICANN is encouraged “to take a lead in ensuring that privacy and data protection are embedded by default, when new tools and instruments or new Internet policies are designed, for the benefit of all – not just European – Internet users.” Ayden Férdeline Statement of Interest

1 0

SUMMARY | Opinion of the European Data Protection Supervisor: Europe's Role in Shaping the Future of Internet Governance (23 June 2014)
by Ayden Fabien Férdeline April 11, 2016

April 11, 2016

Opinion of the European Data Protection Supervisor: Europe's Role in Shaping the Future of Internet Governance (23 June 2014) Summary: * This document calls for all Internet policy discussions to take into consideration the internationally-recognised, fundamental rights of privacy and data protection. Such rights are: * 1) at the basis of users' online interactions, 2) should be protected online as well as offline, and 3) “are not negotiable”. * The current WHOIS system is named as “an example of a data protection issue which has to be addressed” because of its “authentication and data retention requirements.” It must be replaced “with a solution taking account, inter alia, of privacy concerns.” * Data protection authorities must be represented in multi-stakeholder Internet governance processes and must ensure that respect for fundamental rights are assured for all users regardless of their means and capabilities. They should also should work to ensure the harmonisation of data protection rules at a global level. * Data controllers have a responsibility to: * provide transparent and easily accessible and understandable information, should provide procedures and mechanisms for exercising a data subject's rights, must provide information on storage periods, must provide information on rights to lodge a complaint, and must provide information in relation to the international transfer of data and to the source from which the data is originating. * Users have the right to be forgotten and to erasure. In balancing the right to erasure against the freedom of information, the former overrides the general public's right to be informed, unless the data subject plays a role in public life that justifies interference with his/her right to privacy. * There is a close relationship between technological design and data protection. The principles of data protection-by-design and by-default could serve as significant enablers of trust on the Internet. Accordingly the inclusion of optimal data protection standards in the development of technology at the early design phase is encouraged. * Conflicts of law arise in connection with the Internet, jeopardising users' rights to privacy and data protection, and these need to be solved. “Given the global and cross-border nature of the Internet, personal data is often transferred to and processed in jurisdictions other than those in which users have submitted their data, exposing them to the risk of lower or no data protection. In addition, controllers processing personal data on the Internet may be faced with conflicting laws and obligations and must choose between violating foreign obligations or EU data protection safeguards … which in consequence undermines the data protection safeguards afforded to users under EU law.” * Google v AEPD might provide some guidance on answering this question – in this judgement the Court of Justice of the European Union ruled that the presence of an establishment on the territory of an EU Member State and the relationship between the activities of that establishment and the data processing at issue can be used to decide the applicability of EU data protection law to a processing carried out online. * “From a European perspective, we would encourage controllers processing the personal data of EU individuals on the Internet to increase the transparency and the amount of information they provide to users in relation to the law(s) they are subject to and the data protection rules they are bound to apply, including laws on access to data by government bodies, jurisdictions where data may be processed, and what safeguards have been implemented to protect users' data.” Ayden Férdeline Statement of Interest

1 0

Privacy Team Checklist - 8 April
by Lisa Phifer April 8, 2016

April 8, 2016

Hello all, This morning's privacy team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw David is working to get remaining docs assigned to privacy team volunteers. If you wish to summarize a still-unassigned doc, just reply to this message or email David <davecake(a)gmail.com> directly. Best, Lisa

2 1

Human Rights and Privacy Frameworks
by Kathy Kleiman April 7, 2016

April 7, 2016

Hi All, I know we need additional documents like a hole in the head, but "sensitive data" is going to be key to our WG evaluation. "Sensitive data" involves ethnicity and race, political opinions, religious beliefs, memberships, and more. "Sensitive data" in the EU and other countries has its own privacy protections for individuals and the institutions/organizations in which they exercise rights and fundamental freedoms. The documents below are largely on our list already, but if not, I would like to add them; if they are on the list, I would like to flag the sections below for special inclusion in our summary for the WG: 1. /United National Universal Declaration of Human Rights// /Protects "sensitive data" surrounding race, colour, sex, language, religious, political or other opinion, national or social origin, property, birth or other status." Particularly Article 2, /"Equality and Non-discrimination",/ http://ccnmtl.columbia.edu/projects/mmt/udhr/ 2. /European Convention 108, Article 1 and Article 6: A/ddresses issues regarding "rights and fundamental freedoms" and "special categories of data" specifically related to race, political review, health and sexual life, religion, etc, that /"may not be processed automatically unless domestic law provides appropriate safeguards." /Convention 108 is on our list already, but these sections may not have been flagged. /David and Lisa: //has anyone selected this doc to summarize? If not, I will. /3. /European Data Protective Directive /Article 8 addresses "sensitive data" issues pertaining to health or sex life, racial or ethnic original, political opinions, religious or philosophical beliefs, trade-union membership/. //Ditto - same question as above. / Best and tx, Kathy On 4/6/2016 5:57 AM, Kimpián Péter wrote: > > Sorry, one minor issue to be clear if we are in ICANN context in > example 3,4 (not in EU general data protection legislation) then the > same argumentation goes for me as in example 1,2. > > best regards, > > Peter > > *From:*Kimpián Péter [mailto:kimpian.peter@naih.hu] > *Sent:* Wednesday, April 6, 2016 11:44 AM > *To:* 'Kathy Kleiman' <kathy(a)kathykleiman.com>; > 'Monika.Zalnieriute(a)eui.eu' <Monika.Zalnieriute(a)eui.eu>; 'KWASNY > Sophie' <Sophie.KWASNY(a)coe.int>; 'Stephanie Perrin' > <stephanie.perrin(a)MAIL.UTORONTO.CA> > *Subject:* RE: Human Rights and Privacy > > Dear Kathy, dear Stephanie, Monika and Sophie, > > Thank you for the wonderful questions, these are very relevant one. > Some piece of legislation and my understanding of it: > > To always start with the highest level: > > ·*The Universal Declaration of Human Rights: *Article 2. : /Everyone > is entitled to all the rights and freedoms set forth in this > Declaration, without distinction of any kind, such as race, colour, > sex, language, religion, political or other opinion, national or > social origin, property, birth or other status. Furthermore, no > distinction shall be made on the basis of the political, > jurisdictional or international status of the country or territory to > which a person belongs, whether it be independent, trust, > non-self-governing or under any other limitation of sovereignty./ > > // > > ·From European point of view there are different human rights which > are at stake in the examples you gave: rights of association, freedom > of religion, freedom of opinion, principle of non-discrimination, > rights to privacy, right to data protection, freedom of speech. every > each of them has an extensive jurisprudence mainly from the European > Court of Human Rights to determine the ways of their implementation > and scope, limits. As for privacy and data protection: these rights > are guaranteed for individuals as you will see in CoE Convention 108 > and in Directive 95/46: // > > o*Convention 108: Article 1 – Object and purpose: */The purpose of > this Convention is to secure in the territory of each Party for every > individual, whatever his nationality or residence, respect for his > rights and fundamental freedoms, and in particular his right to > privacy, with regard to automatic processing of personal data relating > to him ("data protection")./ > > oYou will see the same concept in the *EU Directive 95/46 *: *Article > 1 Object of the Directive*: /1. In accordance with this Directive, > Member States shall protect the fundamental rights and freedoms of > natural persons, and in particular their right to privacy with respect > to the processing of personal data./ > > oIn the examples you mention the data controller have to deal with > individuals _“sensitive data” _(as we call it in Europe). Our higher > legislations call it “special categories of data” and they are > protected in a greater way. Usually only in cases falling under > exceptions that those data can be processed but in any case additional > safeguards have to be added wen processing those data:// > > // > > §*Convention 108: Article 6*//*– Special categories of > data:*/ Personal data revealing racial origin, political opinions or > religious or other beliefs, as well as personal data concerning health > or sexual life, may not be processed automatically unless domestic law > provides appropriate safeguards. The same shall apply to personal data > relating to criminal convictions./ > > §*Exceptions*: > > ·/ a, protecting State security, public safety, the monetary interests > of the State or the suppression of criminal offences;/ > > ·/ b, protecting the data subject or the rights and freedoms of others./ > > // > > §*Directive 95/46: Article 8, The processing of special categories of > data*: /1. Member States shall prohibit the processing of personal > data revealing racial or ethnic origin, political opinions, religious > or philosophical beliefs, trade-union membership, and the processing > of data concerning health or sex life./ > > §*Exceptions/:/*/2. Paragraph 1 shall not apply where: / > > // > > ·/(a) the data subject has given his explicit consent to the > processing of those data, except where the laws of the Member State > provide that the prohibition referred to in paragraph 1 may not be > lifted by the data subject's giving his consent; or/ > > ·/(b) processing is necessary for the purposes of carrying out the > obligations and specific rights of the controller in the field of > employment law in so far as it is authorized by national law providing > for adequate safeguards; or/ > > ·/(c) processing is necessary to protect the vital interests of the > data subject or of another person where the data subject is physically > or legally incapable of giving his consent; or/ > > ·/(d) processing is carried out in the course of its legitimate > activities with appropriate guarantees by a foundation, association or > any other non-profit-seeking body with a political, philosophical, > religious or trade-union aim and on condition that the processing > relates solely to the members of the body or to persons who have > regular contact with it in connection with its purposes and that the > data are not disclosed to a third party without the consent of the > data subjects; or/ > > ·/(e) the processing relates to data which are manifestly made public > by the data subject or is necessary for the establishment, exercise or > defence of legal claims./ > > ·/3. Paragraph 1 shall not apply where processing of the data is > required for the purposes of preventive medicine, medical diagnosis, > the provision of care or treatment or the management of health-care > services, and where those data are processed by a health professional > subject under national law or rules established by national competent > bodies to the obligation of professional secrecy or by another person > also subject to an equivalent obligation of secrecy./ > > ·/4. Subject to the provision of suitable safeguards, Member States > may, for reasons of substantial public interest, lay down exemptions > in addition to those laid down in paragraph 2 either by national law > or by decision of the supervisory authority./ > > ·/5. Processing of data relating to offences, criminal convictions or > security measures may be carried out only under the control of > official authority, or if suitable specific safeguards are provided > under national law, subject to derogations which may be granted by the > Member State under national provisions providing suitable specific > safeguards. However, a complete register of criminal convictions may > be kept only under the control of official authority./ > > ·/Member States may provide that data relating to administrative > sanctions or judgements in civil cases shall also be processed under > the control of official authority./ > > // > > o*For religious questions*it is a bit more complicated. All European > states have to guarantee the freedom of religion (which also means no > interference, no discrimination on religious grounds, etc.) but the > modality is at the states hand. For this there are three ways: > religious state, laic state and state in between. There are no > religious state in Europe which means in every country the gvt is > divided form the governance of a religious organisation. There are > several laic state in Europe where the most famous is France where > there is a strict separation of state and religion. There a good > number of in between state like mine where the government support > actively and financially some religious organisations. (and this a > never ending debate on which ground they chose them and how much they > like one or another // > > // > > _To sum up:_there is no legislation which protects associations, > groups, religious groups rights to privacy or data protection, but > every data related to them can be easily classified as sensitive one > where in the majority of states there is a clear prohibition with the > narrowly interpreted exceptions and as a minimum standard a better > protection must be attributed to them and additional safeguards must > be put in place. > > Coming back to ICANN context and your examples: > > 1.For example, when individuals gather together to speak/write about > minority religious, ethnic, political views and would prefer not to > publish their physical location publicly àI would say that there is > contract between ICANN/Registrars and registrants and if under this > contract the individual who wish not to give its consent for the > publication of its address ICANN/Registrars cannot overrule tis > non-consent by the RDS requirements (one is a human right the other > one is a public company policy). In my opinion only one contact detail > as per the choice of the data subject would be sufficient to go on > public in ICANN context which preferably would be the e-mail ID. It is > for the Registrars to check under their contract that the email ID is > adequate and serves the purpose (the domain name holder can be > contacted through it). Furthermore if there is about a data which is > sensitive or can be related to a sensitive data than even for > non-public processing ICANN/Registrars should put additional > safeguards in place > > 2.Some minority religious groups, such as mosques in the US South or > synagogues in certain regions àthe same argumentation as above and in > the top of it we speak here ab ovo about sensitive data (which can > only be public with the deliberate and informed consent of the data > subject and additional safeguards have to be put in place) > > 3.If I am a home-based business, is there any protection under EU data > protection law that would protect me from having to publish my home > address àthis is a more difficult one. I would say no in this case > because the data subject is doing business and it is a valid > expectation to get to know the business official address. Moreover it > will fall under the exceptions mention above and will be prescribed by > the law. So if I am teaching at home as a self-employed private > business I have to reveal my home address as the place of the > residence of the company. This is why all over Europe there are > business which are providing residence services for small and medium > size businesses which consist of providing their address as place of > residence for the self-employed company (same as the privacy proxy > services). > > 4.Would I be entitled to the privacy of my personal home even if I am > engaged in business activities under data protection laws? àWell, no > for the reasons specified above. You can hide most of the time your > home address if you are an individual but if you start operating a > business form your home there will be legislation which will foresee > the publication of the address of your residence of your company. It > is of your customers interest to know the legal address of the > company, business they are dealing with. Data protection is for > individuals (for now). > > Hope all this helps. If you have further question or you seek some > more claruty on one or several issue or you disagree just let me know > anytime. > > Best regards, > > Peter > > // > > // > > // > > *From:*Kathy Kleiman [mailto:kathy@kathykleiman.com] > *Sent:* Tuesday, April 5, 2016 7:58 PM > *To:* Monika.Zalnieriute(a)eui.eu <mailto:Monika.Zalnieriute@eui.eu>; > HUNGARY: Peter KIMPIAN (kimpian.peter(a)naih.hu > <mailto:kimpian.peter@naih.hu>) <kimpian.peter(a)naih.hu > <mailto:kimpian.peter@naih.hu>>; KWASNY Sophie <Sophie.KWASNY(a)coe.int > <mailto:Sophie.KWASNY@coe.int>>; Stephanie Perrin > <stephanie.perrin(a)MAIL.UTORONTO.CA > <mailto:stephanie.perrin@MAIL.UTORONTO.CA>> > *Subject:* Human Rights and Privacy > > Hi Monica and Peter (I know Sophie is out of town), > /Based on the discussions of the RDS WG today, Stephanie and I were > wondering if you could assist us in identifying human rights documents > that protect the privacy rights of groups and associations? /For > example, when individuals gather together to speak/write about > minority religious, ethnic, political views and would prefer not to > publish their physical location publicly. Some minority religious > groups, such as mosques in the US South or synagogues in certain > regions, might choose to remove themselves from local maps to avoid > easy targeting and would prefer not to list their physical address as > a condition of obtaining a domain name to share the time of their > services (with those who already know where to find them). /Is there > Human Rights legislation that you can point us to that might protect > the privacy of these groups and organizations? * > */ > Data Protection and small business question -- If I am a home-based > business, is there any protection under EU data protection law that > would protect me from having to publish my home address? In the US, > with such poor leave or flexibility for mothers, many women open their > own businesses when their children are young. They work parttime, from > home, often in a business-to-business context. /Is there any > protection in the EU for such an arrangement? Would I be entitled to > the privacy of my personal home even if I am engaged in business > activities under data protection laws? I think so, but wanted to > confirm... / > > Best and tx! > Kathy >

2 1