- gnso-rds-pdp-purpose - lists.icann.org

Purpose Team Checklist - 7 April
by Lisa Phifer April 11, 2016

April 11, 2016

Hello all, Another updated purpose team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw Just follow the link above if you're looking for the latest daily update of any team's checklist. The purpose team still has several documents left without volunteers: * Article 29 WP statement on the data protection impact of the ICANN RAA (2013-2014) * Article 29 WP comments on the data protection impact of the revision of the ICANN RAA concerning accuracy and data retention of WHOIS (2012) * Article 29 WP on ICANN Procedure for Handling WHOIS Conflicts with Privacy Law (2007) * Article 29 WP on ICANN's WHOIS Database Policy (2006) * Article 29 WP Opinion on the application of the data protection principles to WHOIS directories * Additional Article 29 WP documents that may be of interest to this PDP WG * Council of Europe <https://wcd.coe.int/ViewDoc.jsp?Ref=Decl%2803.06.2015%292>Declaration of the Committee of Ministers on ICANN, human rights and the rule of law (3 June 2015) * <http://ec.europa.eu/justice/data-protection/data-collection/obligations/ind…>European Commission Website: Obligations of Data Controllers * <http://london50.icann.org/en/schedule/mon-ewg-final-overview/presentation-e…>EWG Tutorial Pages 17-20, 37-41 and <https://community.icann.org/display/EWG/EWG+FAQs>EWG FAQs 9-12, 67 and Video FAQ "<https://www.youtube.com/watch?v=YzPkxNNfDY4&list=UUl7rV9qJaQEx3GKhtSLx4QA>Is my purpose supported by the RDS?" * Statements/Blogs by <https://www.icann.org/en/system/files/files/perrin-statement-24jun14-en.pdf>Perrin and<http://www.circleid.com/posts/20141011_building_a_better_whois_for_the_indi…> Samuels * <https://community.icann.org/display/gTLDRDS/Process+Framework>Process Framework for a PDP on Next-Generation RDS, Page 9, Row 1 (hint: see questions/subquestions mind map) If you'd like to review and summarize any of these remaining docs, please reply to this message. Best, Lisa

3 2

RDS PDP Purpose - summary of GAC Communiques
by Tjabbe.BOS＠ec.europa.eu April 11, 2016

April 11, 2016

Dear group members, Attached you will find my summary of the document: - "GAC Communiqués regarding WHOIS (2007-2015), especially GAC Principles Regarding gTLD WHOIS Services (2007)". Best regards, Tjabbe Tjabbe Bos Policy Officer [cid:image001.gif@01CE2952.DC5024E0] European Commission DG Migration and Home Affairs Unit D2 – Fight against organised crime 1049 Brussels, Belgium Tel. +32 229 87113 What we do: http://ec.europa.eu/dgs/home-affairs/what-we-do/policies/organized-crime-an…

1 0

Re: [gnso-rds-pdp-purpose] Purpose Team Checklist - 6 April
by nathalie coupet April 10, 2016

April 10, 2016

Good morning, I've summarized in a few words the gist of both documents, and you will find the most important passages in the word files attached hereto. 2003 report ICANN | GNSO Whois Task Force Final Report on Accuracy and Bulk Access | 19 February 2003Purpose: Data collected must be accurate and reliable, or else registrant’s site should be deleted. Illegitimate purpose: Use of bulk access WHOIS data for marketing should not be permitted. WHOIS Task Force Report (2007): http://gnso.icann.org/en/issues/whois-privacy/whois-services-final-tf-repor… two issues not agreed, i.e., the purpose of WHOIS contacts, and the question whether there should be a change in data from that now published, are unlikely ever to be the subject even of rough consensus among the interested parties. The definition of purpose of WHOIS differs according to the stakeholder group. Best regards, Nathalie Coupet | | | | | | | | | | | ICANN | GNSO Whois Task Force Final Report on Accura...Table of Contents Introduction I. Consensus Policies II. Recommendations to ICANN and Registrars: Accuracy of WHOIS Data and Review. III. Discussion of th... | | | | View on archive.icann.org | Preview by Yahoo | | | | | Nathalie Coupet Translator & Interpreter English, French, Creole Cell: (786) 554-9638 On Wednesday, April 6, 2016 1:16 PM, nathalie coupet <nathaliecoupet(a)yahoo.com> wrote: Confirmed for both. Nathalie On Wednesday, April 6, 2016 1:14 PM, Lisa Phifer <lisa(a)corecom.com> wrote: Thanks Nathalie. I will put you down for the WHOIS Task Force Report (2007): http://gnso.icann.org/en/issues/whois-privacy/whois-services-final-tf-repor… You may also wish to review the 2003 report. It can be found at: https://archive.icann.org/en/gnso/whois-tf/report-19feb03.htm It looks like the purpose team's checklist incorrectly linked the 2007report title to the 2003 report web page. I will fix the checklist toinclude both documents with their correct hyperlinks. Thanks Lisa At 08:59 AM 4/6/2016, nathalie coupet wrote: Hi Lisa, I will take the Final Report of the GNSO Council's Whois Task Force Accuracy and Bulk Access. Nathalie Coupet On Wednesday, April 6, 2016 10:52AM, Lisa Phifer via gnso-rds-pdp-purpose<gnso-rds-pdp-purpose(a)icann.org> wrote: Hello all, Today's updated purpose team checklist (attached) was just posted to thewiki at: https://community.icann.org/x/p4xlAw Just follow the link above if you're looking for the latest dailyupdate of any team's checklist. In today's checklist update, to make it clearer which docs are not yetassigned, I have removed the ? names from the "Reviewed by"column. As you can see, there are still plenty of docs identified by thisteam over the past week or so that could still use volunteers to reviewthem. For those not certain how much work is involved: summaries shouldbe concise - for example, "executive summaries" that point theWG to the portions of the document most relevant to RDS purpose andwhy. Best, Lisa At 11:13 AM 4/5/2016, Lisa Phifer via gnso-rds-pdp-purpose wrote: As discussed during today's WGcall... Two weeks ago, many WG members volunteered to help identify and summarizeinput documents and relevant background to educate the full WG and informfinalization of the RDS PDP WG work plan. Thanks to all who have volunteered already. Nowlet's get going on completing this task! To help us keep track of identified inputs, assignments, and summaries,staff has created input checklists for all three teams. The latestversions are posted daily athttps://community.icann.org/x/p4xlAw Why? It's essential that this initial effort be completed without delayso that our PDP WG can continue in full group mode to complete tasksrequired at the start of every PDP: a work plan and early outreach toSO/ACs and SG/Cs. Once we reach that point, the full WG can begindeliberations. To achieve this and distribute workload, the leadership team has draftedthe following plan: 1) Between now and end-of-day Wednesday6 April, every volunteer is asked to review their small teamï¿½ inputchecklist and offer to review and summarize at least one input (can be aninput already identified or new). Email each summary to your own smallteam no later than Monday 11 April. 2) On Thursday 7 April, team leaderswill assign any documents identified but not yet taken to volunteersstill without assignments. If you find yourself assigned a document thatyou are unable to summarize, let your team lead know immediately so thatan alternative assignment can be made. 3) Summarization progress will be assessedduring the Tuesday 12 April WG call, where we will agree on a planto consolidate small team outputs into templates to be presented tothe full WG in April. 4) By the end of April, the full WGwill resume discussion of its work plan as well as approving a message toSO/ACs and SG/Cs to initiate early outreach, which may seek feedback onthe completeness of inputs identified in the Issue Report and by the WGthrough this small team effort. The most recent checklist is attached for your convenience. Please visithttps://community.icann.org/x/p4xlAw for the most current versioneach day. _______________________________________________ gnso-rds-pdp-purpose mailing list gnso-rds-pdp-purpose(a)icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-purpose _______________________________________________ gnso-rds-pdp-purpose mailing list gnso-rds-pdp-purpose(a)icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-purpose

1 0

Summary: Article 29 WP on ICANN Procedure for Handling WHOIS Conflicts with Privacy Law (2007)
by Maryan Rizinski April 8, 2016

April 8, 2016

Hi All, My second task was to review the Article 29 WP on ICANN Procedure for Handling WHOIS Conflicts with Privacy Law. This input is interesting as it provides thoughtful context for some debates that I believe will follow after we finish the work of our small teams. After reviewing the fundamental document <https://www.icann.org/en/system/files/files/schaar-to-cerf-12mar07-en.pdf> of this input, I extracted some relevant excerpts that are directly related to the users/purposes questions that we identified in the mind map from March 22, 2016. I highlighted some parts for improved readability and I also concisely summarized the relevant paragraphs with brief titles. The excerpts are given as follows: *Differentiating between legal and natural persons* *"In particular, the Article 29 WP emphasizes once more the need to differentiate between legal and natural persons registering domain names. In the first case, the publication of certain information about the company or organisation (such as their identification and their physical address) is often a requirement by law in the framework of the commercial or professional activities they perform. The Article 29 WP's primary concern relates to private domain holders that use domains solely in a non-commercial context. Nevertheless, a privacy issue is at stake also for instance in a workplace with people (employees) named in the context of commercial domains." (page 2)* *Limiting bulk access for direct marketing* *"The Working Party also reaffirms its support for earlier proposals concerning accuracy of the data (which is also one of the principles of the Data Protection Directive) published in WHOIS directories and limitation of bulk access for direct marketing issues. It recalls that bulk use of WHOIS data for direct marketing is by no means in line with the purpose for which the directories were set up and are being maintained." (page 2)* *Distinction between publicly accessible and publicly inaccessible data* *"Introducing a distinction between publicly accessible and publicly inaccessible data, e.g. for internal purposes of registrars for billing, etc., which is typical in many national legal systems might tackle many of the problems outlined above." (page 2)* *Definition of WHOIS purpose adopted by the GNSO Whois Task Force* *"The purpose of the gTLD Whois service is to provide information sufficient to contact a responsible party for a particular gTLD domain name who can resolve, or reliably pass on data to a party who can resolve, issues related to the configuration of the records associated with the domain name within a DNS nameserver." (page 2)* Note: This is a definition adopted in the GNSO Whois Task Force Preliminary Task Force Report on Whois Services of 22 November 2006. *The trade-off triangle: Technical operation of the Internet network v.s. legal responsibilities v.s. data protection and privacy rights* *"The Article 29 WP acknowledges the legitimacy of the purpose of the making available of some personal data through the WHOIS services, when this publication is necessary for the technical functioning of the Internet network as set out in the purpose definition. This publicity is necessary in order to put the person running a Website in a position to face the legal and technical responsibilities which are inherent to the running of such a site. However, in its current form the database does not take account of the data protection and privacy rights of those identifiable persons who are named as the contacts for domain names and organizations."* Personal note: This is not something that should be discussed now, but I have the impression that the centroid of this triangle is ensuring "trust" in the online environment. I hope this summary is helpful and I wish you have a great weekend! Best regards, Maryan

1 0

Additional summary re: collecting and publishing data for legal purposes: Privacy and Proxy PDP
by Greg Aaron April 8, 2016

April 8, 2016

Dear group: Below is a summary of a recently completed PDP. It is expected that the ICANN Board will approve it this year, making it a new Consensus Policy. It has to do with proxy and privacy services and the related collection and publication of contact information. It is therefore very relevant to our future discussions. Please add the below to our document summaries. All best, --Greg ********************** Privacy & Proxy Services Accreditation Issues Policy Development, and Consensus Policy On 21 January 2016 the GNSO Council voted unanimously to approve all the recommendations contained in the Final Report from the GNSO Working Group that had been chartered to conduct a Policy Development Process (PDP) on privacy and proxy services accreditation issues. This Recommendations Report has been sent to the ICANN Board for its review, which the GNSO Council recommended be adopted by the Board. When approved by the Board the recommendations will become ICANN Consensus Policy. The forthcoming policy covers various items including the collection of customer contact data and its publication in WHOIS, requirements for the rights and responsibilities of privacy and proxy service customers, and an accreditation program for privacy and proxy service providers. Among other things, the recommendations: * Affirm that privacy and proxy services should be available to all registrants, whether commercial or noncommercial, individual or corporate. * Domain contact data must be validated and verified in a manner consistent with the requirements of the 2013 RAA. * Privacy and proxy service providers must publish their policies and procedures for when they will publish or disclose their customers’ contact information (including in WHOIS), outside of the circumstances where it is required by applicable law; and * Establish that privacy and proxy service providers should not create impediments to transfers, renewals, or restorations of domain names and should prevent publication of customer contact information during these processes. References: * Final Report on the Privacy & Proxy Services Accreditation Issues Policy Development Process: http://gnso.icann.org/en/issues/raa/ppsai-final-07dec15-en.pdf * GNSO Council Recommendations Report to the Board regarding Adoption of the Final Recommendations from the Policy Development Process Working Group on Privacy and Proxy Services Accreditation Issues: http://gnso.icann.org/en/drafts/council-board-ppsai-recommendations-09feb16… BACKGROUND: The final recommendations include the following language: I. DEFINITIONS ... * "Privacy Service" means a service by which a Registered Name is registered to its beneficial user as the Registered Name Holder, but for which alternative, reliable contact information is provided by the privacy or proxy service provider for display of the Registered Name Holder's contact information in the Registration Data Service (WHOIS) or equivalent services. * "Proxy Service" is a service through which a Registered Name Holder licenses use of a Registered Name to the privacy or proxy customer in order to provide the privacy or proxy customer use of the domain name, and the Registered Name Holder's contact information is displayed in the Registration Data Service (WHOIS) or equivalent services rather than the customer's contact information.... * “Publication” means the reveal of a person’s (i.e. the licensee or beneficial owner of a registered domain name) identity/contact details in the WHOIS system. * “Disclosure” means the reveal of a person’s (i.e. the licensee or beneficial owner of a registered domain name) identity/contact details to a third party Requester without Publication in the WHOIS system. * The term “person” as used in these definitions is understood to include natural and legal persons, as well as organizations and entities. II. NO DISTINCTION IN TREATMENT; WHOIS LABELING REQUIREMENTS; VALIDATION & VERIFICATION OF CUSTOMER DATA: .... II.3: The status of a registrant as a commercial organization, non-commercial organization, or individual should not be the driving factor in whether P/P services are available to the registrant. Fundamentally, P/P services should remain available to registrants irrespective of their status as commercial or non-commercial organizations or as individuals. Further, P/P registrations should not be limited to private individuals who use their domains for non-commercial purposes.... 5. P/P customer data is to be validated and verified in a manner consistent with the requirements outlined in the WHOIS Accuracy Program Specification of the 2013 RAA (as may be updated from time to time).... MANDATORY PROVISIONS TO BE INCLUDED IN PROVIDER TERMS OF SERVICE & MINIMUM REQUIREMENTS TO BE COMMUNICATED TO CUSTOMERS: 6. All rights, responsibilities and obligations of registrants and P/P service customers as well as those of accredited P/P service providers need to be clearly communicated in the P/P service registration agreement, including a provider’s obligations in managing those rights and responsibilities and any specific requirements applying to transfers and renewals of a domain name. In particular, all accredited P/P service providers must disclose to their customers the conditions under which the service may be terminated in the event of a transfer of the domain name, and how requests for transfers of a domain name are handled. 7. All accredited P/P service providers must include on their websites, and in all Publication and Disclosure-related policies and documents, a link to either a request form containing a set of specific, minimum, mandatory criteria, or an equivalent list of such criteria, that the provider requires in order to determine whether or not to comply with third party requests, such as for the Disclosure or Publication of customer identity or contact details. 8. All accredited P/P service providers must publish their terms of service, including pricing (e.g. on their websites). In addition to other mandatory provisions recommended by the WG, the terms should at a minimum include the following elements in relation to Disclosure and Publication: * Clarification of when those terms refer to Publication requests (and their consequences) and when they refer to Disclosure requests (and their consequences). The WG further recommends that accredited providers expressly include a provision in their terms of service explaining the meaning and consequences of Publication. * The specific grounds upon which a customer’s details may be Disclosed or Published or service suspended or terminated, including Publication in the event of a customer’s initiation of a transfer of the underlying domain name In making this recommendation, the WG noted the changes to be introduced to the Inter Registrar Transfer Policy (“IRTP”) in 2016, where following a Change of Registrant17 a registrar is required to impose a 60-day inter-registrar transfer lock. * Clarification as to whether or not a customer: (1) will be notified when a provider receives a Publication or Disclosure request from a third party; and (2) may opt to cancel its domain registration prior to and in lieu of Publication or Disclosure. However, accredited P/P service providers that offer this option should nevertheless expressly prohibit cancellation of a domain name that is the subject of a UDRP proceeding.... DISCLOSURE OR PUBLICATION OF A CUSTOMER’S IDENTITY OR CONTACT DETAILS: 18. Regarding Disclosure and Publication, the WG agreed that none of its recommendations should be read as being intended to alter (or mandate the alteration of) the prevailing practice among P/P service providers to review requests manually or to facilitate direct resolution of an issue between a Requester and a P/P service customer. It also notes that disclosure of at least some contact details of the customer may in some cases be required in order to facilitate such direct resolution. In relation to Publication that is subsequently discovered to be unwarranted, the WG believes that contractual agreements between providers and their customers and relevant applicable laws will govern, and are likely to provide sufficient remedies in such instances. 19. The WG has developed an illustrative Disclosure Framework to apply to Disclosure requests made to P/P service providers by intellectual property (i.e. trademark and copyright) owners. The proposal includes requirements concerning the nature and type of information to be provided by a Requester, non-exhaustive grounds for refusal of a request, and the possibility of neutral dispute resolution/appeal in the event of a dispute. The WG recommends that a review of this Disclosure Framework be conducted at an appropriate time after the launch of the program and periodically thereafter, to determine if the implemented recommendations meet the policy objectives for which they were developed.

1 0

Purpose Team Checklist - All Docs Assigned
by Lisa Phifer April 7, 2016

April 7, 2016

1 0

Fwd: Re: Purpose Frameworks
by Kathy Kleiman April 7, 2016

April 7, 2016

Hi Susan and Lisa, If it is still open, I volunteer to summarize the Article 29 Data Protection Working Group's "Opinion 03/2013 on Purpose Limitation" adopted by April 2, 2013. In many ways, this is just the piece we have been looking for to understand what "purpose" means in the EU, and what the "purpose limitation" requires under the EU Data Protection Directive. It answers many questions we have been raising about the law and framework of "purpose," including: + /if under the EU Data Protection Directive, personal data must be "collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes," //then what is "a specified purpose," "how does a purpose become explicit," and what purposes are "legitimate?" /All discussed in detail! / /Further, it has sections addressing the natural follow-up question: what is "compatible use?" This decision discusses at length the legal limitation for "further processing" of personal data -- which must be not incompatible with the original purpose for which the data was collected in the first place. If someone has already summarized this opinion, how might I find that summary? Also, can we post the article by Hunton & Williams (global law firm) in its Privacy & Information Security Law Blog titled: "/Article 29 Working Party Clarifies Purpose Limitation Principles; Opines on Big and Open Data." /The writers provide a concise overview of the Article 29 Working Party's 70-page decision above is in clear language (hooray!). It provides a readable overview of this decision that "goes to the heart of data protection law and is relevant to virtually all data controllers processing personal data in the EU." I think it would help the full WG to provide access to it -- link: https://www.huntonprivacyblog.com/2013/04/09/article-29-working-party-clari… I'm happy to summarize it. Best and tx, Kathy

2 2

Approach to complete this team's task
by Lisa Phifer April 6, 2016

April 6, 2016

7 10

Purpose Team Checklist - 6 April
by Lisa Phifer April 6, 2016

April 6, 2016

1 0

Purpose Sub Team
by Susan Kawaguchi April 5, 2016

April 5, 2016

Hello All, Thank you to all who have agreed to review or have already submitted their review and the relevant sections of documents. ICANN staff has graciously created an input checklist to keep us organized which is attached. Please review the list of documents that no one has stepped forward to review yet. If you have time it would be great to get most of the documents reviewed by next Monday. Staff will review the incoming emails and add to our document of relevant information and the comments. Once we have all of these reviewed we can then all work on a summary of the document for the full WG. Best regards, Susan Kawaguchi Domain Name Manager Facebook Legal Dept.

2 1