- Gnso-rds-pdp-privacy - lists.icann.org

Privacy Team Consolidated Summary - 21 April
by Lisa Phifer April 22, 2016

April 22, 2016

Dear privacy team, The latest Privacy Team Consolidated Summary PDF (updated 21 April) is attached and posted to the wiki at: https://community.icann.org/x/p4xlAw Going forward, staff will maintain the master consolidated summary. The Word version of the consolidated summary is also available on the above wiki page. - All team members are asked to review consolidated summaries (especially those within your own area of expertise) to ensure that key passages of each doc have at least been identified. - Those of you who drafted summaries are also asked to consider team feedback on your summary. Especially for docs which the team finds to be the most relevant to privacy including data protection, please draft a few concise bullet points summarizing the doc's relevance. - All team members are encouraged to discuss on-list which of the identified docs are most relevant to privacy and why, along with other questions listed here: https://community.icann.org/download/attachments/58734473/RDS-InputTeams-Pl… Please send all feedback on purpose team summaries and document relevance to this team's email list, gnso-rds-pdp-privacy(a)icann.org. Thanks all for your efforts, Lisa

1 0

European Commission Website: Obligations of Data Controllers
by Kathy Kleiman April 21, 2016

April 21, 2016

Hi All, A few last summaries coming into the subgroup. Sorry for the delay! Busy days... Best, Kathy (below and attached) Document Name: *European Commission Website: Obligations of Data Controllers* Document Link: http://ec.europa.eu/justice/data-protection/data-collection/obligations/ind… Summary: This is a key question about whether ICANN is a data controller under the laws of the European Data Protection Directive? Data Controllers “determine 'the purposes and the means of the processing of personal data'” and it is a term that applies to both public and private sectors. See /Who can collect and process personal data?, /http://ec.europa.eu/justice/data-protection/data-collection/index_en.htm (submitted as a separate document) The EU Data Protection Directive requires Data Controllers to abide by certain principles when they process personal data. According to the European Commission: “Each *data controller* must respect the following rules as set out in the Directive: Personal Data must be processed legally and fairly; It must be collected for explicit and legitimate purposes and used accordingly; It must be adequate, relevant and not excessive in relation to the purposes for which it is collected and/or further processed; It must be accurate, and updated where necessary; Data controllers must ensure that data subjects can rectify, remove or block incorrect data about themselves; Data that identifies individuals (personal data) must not be kept any longer than strictly necessary; Data controllers must protect personal data against accidental or unlawful destruction, loss, alteration and disclosure, particularly when processing involves data transmission over networks. They shall implement the appropriate security measures; These protection measures must ensure a level of protection appropriate to the data.” Additional information: It is hard to put it more succinctly, so I quoted directly from the European Commission webpage.

1 1

Privacy Team Checklist - 19 April 13:00
by Lisa Phifer April 20, 2016

April 20, 2016

3 3

Privacy Team Summaries - Single PDF - 20 April
by Lisa Phifer April 20, 2016

April 20, 2016

Dear privacy team, As promised... Attached please find a single PDF containing all of the summaries drafted by members of the privacy team thus far. Hopefully I have faithfully copied in all of your summaries, listed in the same order as they appear in the privacy team checklist. For each summary, the "Title" or "Correspondence" is hyperlinked to the orginal document being summarized, while "Summarized by" is hyperlinked to the privacy team email message from which the summary was copied. I will also post this to the wiki and update it to add missing summaries when they are submitted. Best, Lisa

1 0

Privacy Team Checklist - 20 April
by Lisa Phifer April 20, 2016

April 20, 2016

1 1

progress so far, next steps
by David Cake April 20, 2016

April 20, 2016

Thanks for the volunteering and hard work - the checklist has almost every item assigned and many submitted. I recognise that that is a heap of work, and thank everyone who volunteered. During the 20 April RDS PDP WG call, each team will be asked to report on its progress and share preliminary thoughts about the questions posed during last weeks WG call. To kick-start this discussion, I ask that each of you try to answer this question: Which top 5 inputs summarized by this team are likely to be the most helpful to this PDP and why? For example, does the input define potential requirements that this WG should take into consideration during phase 1 of this PDP? Does the input identify dependencies that will shape our work plan? Our team will have an opportunity to share initial answers during the WG call. Please reply to this list today with your own initial thoughts so that we can prepare to contribute to discussion during the WG call. We will not be expected to have a team-agreed answer this week, but we need to at least begin this discussion. The top 5 is just to get us started. We may not end up presenting our work in that format at all, but hopefully it will get us moving. For example I’d suggest that the Obligations of Data Controllers document would be a valuable one for all WG members to read. We also had a bit of a discussion on how to handle discussion of the ‘Privacy Shield’ issue - an issue that is very rapidly changing with knew documents appearing regularly. It demonstrates a problem with our work - some areas change so rapidly that we will need to keep updating the document list regularly, rather than hope to summarise relevant inputs during this document summary part of the process. David Sent from my iPad

3 2

Re: [Gnso-rds-pdp-privacy] progress so far, next steps
by Lisa Phifer April 19, 2016

April 19, 2016

1 0

FW: Privacy Team Docs in need of volunteers
by Victoria Sheckler April 19, 2016

April 19, 2016

Please see attached summary of the various article 29 working party related documents. -vicky

1 0

Updated EU Privacy and Data Protection Rules
by Carlton Samuels April 18, 2016

April 18, 2016

So the updated EU data protection and privacy regulations are now agreed. Some rules include: "....... - - a right to be forgotten, - - "clear and affirmative consent" to the processing of private data by the person concerned, - - a right to transfer your data to another service provider, - - the right to know when your data has been hacked, - - ensuring that privacy policies are explained in clear and understandable language, and - - stronger enforcement and fines up to 4% of firms' total worldwide annual turnover, as a deterrent to breaking the rules - ......." http://www.europarl.europa.eu/news/en/news-room/20160407IPR21776/Data-prote… -Carlton ============================== Carlton A Samuels Mobile: 876-818-1799 *Strategy, Planning, Governance, Assessment & Turnaround* ============================= On Mon, Apr 18, 2016 at 3:33 PM, nathalie coupet via Gnso-rds-pdp-privacy < gnso-rds-pdp-privacy(a)icann.org> wrote: > Hi Lisa, > > Here is the final summary. > > Best, > > Nathalie > > > On Monday, April 18, 2016 2:27 PM, nathalie coupet < > nathaliecoupet(a)yahoo.com> wrote: > > > Hi Lisa, > > Will do. > > Nathalie > > > On Monday, April 18, 2016 2:12 PM, Lisa Phifer <lisa(a)corecom.com> wrote: > > > Hi Nathalie, > > I suspect that you may have copied the text below from the PPSAI PDP > report (summarized by Steve Metalitz) instead of the survey you'd > volunteered to summarize: > > EWG Research: WHOIS Privacy and Proxy Service Provider Practices Survey > <https://community.icann.org/download/attachments/45744698/EWG%20PP%20PROVID…> > > https://community.icann.org/download/attachments/45744698/EWG%20PP%20PROVID… > > Please take another look at the above survey and summarize what it > attempted to examine. While it may not be reasonable to try to concisely > summarize survey findings, it would be very helpful to let the WG know what > this survey asked privacy and proxy providers about. > > Thanks > Lisa > > > At 08:30 AM 4/18/2016, you wrote: > > Here are my summaries. > > > *Privacy and Proxy Services *P/P services should remain available to > registrants irrespective of their status as commercial or non-commercial > organizations or as individuals. Further, P/P registrations should not be > limited to private individuals who use their domains for non-commercial > purposes.... > P/P customer data is to be validated and verified in a manner consistent > with the requirements outlined in the WHOIS Accuracy Program Specification > of the 2013 RAA > > > > > > > _______________________________________________ > Gnso-rds-pdp-privacy mailing list > Gnso-rds-pdp-privacy(a)icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-privacy >

3 2

Re: [Gnso-rds-pdp-privacy] Privacy/Proxy Service Provider Practices Survey
by nathalie coupet April 18, 2016

April 18, 2016

Hi Lisa, Here is the final summary. Best, Nathalie On Monday, April 18, 2016 2:27 PM, nathalie coupet <nathaliecoupet(a)yahoo.com> wrote: Hi Lisa, Will do. Nathalie On Monday, April 18, 2016 2:12 PM, Lisa Phifer <lisa(a)corecom.com> wrote: Hi Nathalie, I suspect that you may have copied the text below from the PPSAI PDPreport (summarized by Steve Metalitz) instead of the survey you'dvolunteered to summarize: EWG Research:WHOIS Privacy and Proxy Service Provider Practices Survey https://community.icann.org/download/attachments/45744698/EWG%20PP%20PROVID… Please take another look at the above survey and summarize what itattempted to examine. While it may not be reasonable to try to conciselysummarize survey findings, it would be very helpful to let the WG knowwhat this survey asked privacy and proxy providers about. Thanks Lisa At 08:30 AM 4/18/2016, you wrote: Here are my summaries. Privacy and Proxy Services P/P services should remain available to registrants irrespective oftheir status as commercial or non-commercial organizations or asindividuals. Further, P/P registrations should not be limited to privateindividuals who use their domains for non-commercial purposes.... P/P customer data is to be validated and verified in a manner consistentwith the requirements outlined in the WHOIS Accuracy ProgramSpecification of the 2013 RAA

1 0