- gnso-rds-pdp-purpose - lists.icann.org

Re: [gnso-rds-pdp-purpose] [gnso-rds-pdp-wg] a suggestion for "purpose in detail"
by Amr Elsadr March 23, 2017

March 23, 2017

Hi Nathalie, You can find information on ICANN’s Procedure for Handling WHOIS Conflicts with Privacy Law here: https://www.icann.org/resources/pages/whois-privacy-conflicts-procedure-200…. You will also find a section on the “Additional Key Inputs” page on this PDP WG’s wiki page (https://community.icann.org/display/gTLDRDS/Additional+Key+Inputs) linking to several pages and documents along the lifecycle of this procedure. Also of possible interest is the GNSO Council resolution from last month that confirmed the Council’s non-objection to the final report of an Implementation Advisory Group (IAG) that reviewed the implementation details of the WHOIS conflict with privacy policy: https://gnso.icann.org/en/council/resolutions#201702. We will make sure that the IAG’s final report is added to the relevant section on the “Additional Key Inputs” page of the WG wiki. I hope this helps. Thanks. Amr From: <gnso-rds-pdp-wg-bounces(a)icann.org> on behalf of nathalie coupet via gnso-rds-pdp-wg <gnso-rds-pdp-wg(a)icann.org> Reply-To: nathalie coupet <nathaliecoupet(a)yahoo.com> Date: Thursday, March 23, 2017 at 5:08 PM To: Lisa Phifer via Gnso-rds-pdp-purpose <gnso-rds-pdp-purpose(a)icann.org> Cc: "gnso-rds-pdp-wg(a)icann.org" <gnso-rds-pdp-wg(a)icann.org> Subject: Re: [gnso-rds-pdp-wg] a suggestion for "purpose in detail" Hi Lisa, Could you refer me to the documents providing for the Exception to the application of a law due to conflict, that was referred to at some point (by teh WG on transition from thin to thick Whois)? Thank you, Nathalie On Thursday, March 23, 2017 11:00 AM, John Bambenek via gnso-rds-pdp-wg <gnso-rds-pdp-wg(a)icann.org> wrote: Sent from my iPhone On Mar 23, 2017, at 09:44, Volker Greimann <vgreimann(a)key-systems.net<mailto:vgreimann@key-systems.net>> wrote: Whois is the rope with which bad actors hang themselves. Maybe dumb bad actors. Savvy bad actors just populate whois with data of unknowing third parties, thereby rendering any verification and validation instruments useless and inconveniencing the affected data subjects as well. I think maybe its best you let the people who do this work speak for the value of the information. We're using it in criminal investigations and prosecutions. You're just simply taking their money. Believe it or not, bad actors cost us money. We'd love to be able to "not to take their money" as it is a poisoned pill. And we see the whois data used by criminals all the time, when we look at the reports we are sent. Usually it is fake data ripped from some online database or the phone book. So its a baseless allegation that investigators might have expertise in how they use this data? Only domain registrars who have a financial relationship with the criminals know how to use this data? I referred to your last sentence which directly implied that registrars in general and the registrar I am employed with in particular profit from criminals using their service. This is a baseless allegation that could not be farther from the truth, as I have previously explained. That's a rather dramatic misreading. We investigate crimes so I would appreciate due deference to what data is valuable or not. Your role here is providing a service. You don't work with law enforcement to investigate crimes, do you? I have used the law to craft a possible solution but no DP authority has taken your position. Ultimately, that may be the road we have to take if no better solution to provide registrar services legally presents itself, but as I pointed out, that will ultimately serve no one. Registrars will have to raise their fees to incorporate the service, crime fighters and LEAs will have a much more difficult time getting ANY data across borders. Your "solution" would just make your own work a lot harder. I think perhaps deference to my opinion as to what would make MY work harder might be warranted. If you agree, I offer the same deference to you in matters in which your expertise is germane. Deal? You are simply taking the position that if your profits aren't maximized and your costs aren't minimized it is illegal. This position is untenable. Again, I resent you putting words into my mouth. Please do not make statements on my behalf or try to turn your assumptions into a claim of what I am saying. I am saying that anything we come up with will have to be in full compliance with legal requirements. And if there is a cost attached to that solution, that cost will be passed on somewhere, one way or another, not because I want it to but because I know that is the way it works. To which I agree. Let's craft a legal solution the represents the best of what we can offer for all ours (you, me, and everyone else's) interests. I think we can do balance. Will you join me in trying? > You have a contract with ICANN, that contract establishes requirements. Those requirements make it legal. If you believe that, you probably still believe in Trump and other things as well. The above statement is so supendiously wrong, it boggles the mind. You are basically saying that a contract to break the law somehow makes it ok to do so? So if we signed a contract tomorrow to rob the local bank, that absolves us from any guilt? No one care about your inane political opinions. So I was right? Also good attempt at dodging the argument, but the point I made still stands. No, I just don't think constantly injecting your political opinions is helpful. I won't inject comments about Merkel because they are irrelevant. Let's get out of our trenches and have more constructive dialogue. Will you join me? For clarity: The contract with ICANN can say that pigs may fly, but that does not change the laws of physics. If anything in the contract or ICANN policies violates applicable law, that part of the contract is null and void, does not apply, can be ignored, has no relevance, etc, etc. BTW: it even says so in the RAA. Maybe you can find the relevant passage yourself... If you have the law on your side, pound the law. If you have the facts on your side, pound the facts. Since you have neither, you pound the table. Just because you appear not to like the facts or the laws, they do not become less applicable. No one has all the facts here and no one is a master of the laws of every nation on this subject. Let's build bridges to build common understanding. Can I count on you? But we can find criminals faster with it! - No legal relevance. But we want to contact infringers! - No legal relevance. etc... ICANN sets the rules, you get to follow them. If ICANN sets illegal rules, we get to ignore them. So why set illegal rules in the first place? To trap the unwitting and careless registrars? You get a voice, we get a voice. Your voice can demand anything it likes, but if it is not in compliance with the law, it will be ignored. And rightly so. That's how contracts work. Nope! Contracts do not allow a contracted party to break the law. There is a reason assassination contracts are illegal. No one is suggesting you break the law. Calm down. Chuck, this is why we're in trench warfare. And it isn't going to change. Appears so. If one side continues to demand the illegal and the impossible for their own benefit, we will get nowhere. So why not educate yourself on the requirements of current and upcoming privacy regulations and afterwards, we can talk again... No one is demanding anything illegal. So fully standardizing this will probably force some registrars to collect and share far more data than they currently do, and it's unlikely to reduce the data collected by the ones who collect more. Nope, the opposite is true. Best, Volker On Tue, Mar 21, 2017 at 10:17 PM, John Bambenek via gnso-rds-pdp-wg <gnso-rds-pdp-wg(a)icann.org<mailto:gnso-rds-pdp-wg@icann.org>> wrote: Excellent suggestion. Perhaps a future action item could be a survey of who various classes of stakeholders use RDS/whois. Sent from my iPhone On Mar 21, 2017, at 21:07, nathalie coupet via gnso-rds-pdp-wg <gnso-rds-pdp-wg(a)icann.org<mailto:gnso-rds-pdp-wg@icann.org>> wrote: I have a hard time understanding what very stakeholder wants. If every group of stakeholder could write down how they see the new RDS functioning, just by doing a Venn diagram, we could better understand what we have in common and what we need to foncus on to reduce differences of opinion. But that would require more work from already busy people. I think though, it could give us a more tangible view of what we are up against. My .02 cents Nathalie On Tuesday, March 21, 2017 9:45 PM, Andrew Sullivan <ajs(a)anvilwalrusden.com<mailto:ajs@anvilwalrusden.com>> wrote: On Tue, Mar 21, 2017 at 03:01:50PM -0500, John Bambenek via gnso-rds-pdp-wg wrote: > Except that is not the only approach to the problem nor the ones exclusively used by DP authorities (i.e. Twitter). That is why I asked the question I did and why I will be lobbying them directly for whois privacy for free. > But I thought the point of what we were doing was to make some proposals for what to mask and how -- basically, that's what differential access does. And I also thought we were at the beginning of that effort (much as it frustrates me the rate at which we move). > The question of whether fields are optional or can be "masked" is inherently part of this discussion. > That's just conflating two different things. The first thing is to ask whether something should be collected _at all_. Then one can ask, if something is collected, who may obtain it and under what circumstances. This latter is the "masking" of which you speak. And it's all implemented as it currently is because whois is brain-dead. So let us not be restricted to the functionality we can get from a primitive protocol that had already been extended well beyond its design constraints more than 20 years ago. > To enable third-parties to communicate directly to resolve and troubleshoot problems. I suggest that's already there. > To enable third-parties to report abuse or security incidents so they may be resolved. This too. > To enable users and entities to have information to adjudicate an entity is who they say they are (for instance phishing, scams, fake news). > I find it impossible to imagine using the whois for this purpose, so I'd like a use description for this. Since it's not authenticated or authenticatable information anyway, as there are no signatures and so on, it seems a pretty poor way to do it. This is partly included in the purposes however when we discuss X.509 certificates. > ICANN isn't just a business to confer domain names. Its a quasi-regulatory body over a "commons" and a natural monopoly. The purposes must be viewed beyond the prism of the mere registrar-consumer relationship as many interests are relevant and just as important. > While I strongly agree that the purposes need to be rather wider than the domain name industry, I'm uncomfortable with both of the claims of quasi-regulatory authority, the notion of the Internet as a commons. The root zone is indeed a natural monopoly, though. Best regards, A -- Andrew Sullivan ajs(a)anvilwalrusden.com<mailto:ajs@anvilwalrusden.com> ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg(a)icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg<https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg(a)icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg<https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> ______________________________ _________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg(a)icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/ listinfo/gnso-rds-pdp-wg<https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg> -- _________________________________ Note to self: Pillage BEFORE burning. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg(a)icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann(a)key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net/> / www.RRPproxy.net<http://www.rrpproxy.net/> www.domaindiscount24.com<http://www.domaindiscount24.com/> / www.BrandShelter.com<http://www.brandshelter.com/> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu/> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann(a)key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net/> / www.RRPproxy.net<http://www.rrpproxy.net/> www.domaindiscount24.com<http://www.domaindiscount24.com/> / www.BrandShelter.com<http://www.brandshelter.com/> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu/> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg(a)icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg(a)icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann(a)key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net/> / www.RRPproxy.net<http://www.rrpproxy.net/> www.domaindiscount24.com<http://www.domaindiscount24.com/> / www.BrandShelter.com<http://www.brandshelter.com/> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu/> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann(a)key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net/> / www.RRPproxy.net<http://www.rrpproxy.net/> www.domaindiscount24.com<http://www.domaindiscount24.com/> / www.BrandShelter.com<http://www.brandshelter.com/> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu/> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg(a)icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann(a)key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net/> / www.RRPproxy.net<http://www.rrpproxy.net/> www.domaindiscount24.com<http://www.domaindiscount24.com/> / www.BrandShelter.com<http://www.brandshelter.com/> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu/> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann(a)key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net/> / www.RRPproxy.net<http://www.rrpproxy.net/> www.domaindiscount24.com<http://www.domaindiscount24.com/> / www.BrandShelter.com<http://www.brandshelter.com/> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems> www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu/> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone. _______________________________________________ gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg(a)icann.org<mailto:gnso-rds-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg

1 0

Re: [gnso-rds-pdp-purpose] Summaries
by Lisa Phifer April 29, 2016

April 29, 2016

1 0

REMINDER FW: Notes and for your review - sub-team draft responses to questions
by Marika Konings April 29, 2016

April 29, 2016

From: <gnso-rds-pdp-purpose-bounces(a)icann.org> on behalf of Lisa Phifer <lisa(a)corecom.com> Date: Tuesday 26 April 2016 at 13:07 To: "gnso-rds-pdp-purpose(a)icann.org" <gnso-rds-pdp-purpose(a)icann.org> Subject: [gnso-rds-pdp-purpose] Notes and for your review - sub-team draft responses to questions Dear All, Please find below the notes from today¹s purpose sub-team meeting as well as the latest draft responses to the questions attached. As a reminder, you are encouraged to provide input by the end of this week (Friday 29 April) in view of finalising the sub-teams input to the full WG by the next WG meeting. Best regards, Lisa Notes * For the latest versions of the check lists and summaries, please see https://community.icann.org/x/p4xlAw . * Membership of the sub-teams: https://community.icann.org/x/DDCAAw Purpose Sub-Team: * Roll call will be taken from Adobe Connect room * Reminder, please complete / update SOIs * Draft response displayed in Adobe Connect room includes documents identified as most relevant on the email list and why, as a starting point for discussion during this call. * Responses were updated to correct A29 references and to add A29 3/2013 and Green and White papers to the list. * If additional docs suggested by Kathy are not already on the purpose team's inputs list, add then and copy summaries from privacy team summaries. * It was noted that the team needs to ensure that the A29 docs listed as most important are those directly relevant to purpose. (It is believed they are.) * Additional input documents are welcome at any time during the PDP, but we do need to wrap up this input inventory this week to return to full WG mode and the PDP WG's work plan * Remaining assigned summaries to be added to consolidated summaries PDF. Note: A29 3/2013 summary was in fact already submitted and added to consolidated PDF last week. * Volunteers asked to take a look at the consolidated purpose team summaries (posted to mailing list and also on wiki at https://community.icann.org/x/p4xlAw as noted above) to identify any lengthy excerpts that need abbreviating or bullet points added to tie the excerpt to its relevance in answering the charter question addressed by this team * Team members may also wish to cross-check the list of input documents to ensure that the end user's expectations, fears, reactions, etc, are encompassed within inputs identified. (For example, the Individual Internet User purpose described in the EWG report and the blog post by Carlton Samuels.) If not, note this as an input gap. * Team will continue discussion on email list and come to conclusions about answers to questions by Friday of this week for discussion with full WG. * Submit comments / edits to draft responses by the end of this week in view of finalising input by next week's meeting.

1 0

Summaries
by Kiran Malancharuvil April 29, 2016

April 29, 2016

Hi all: Thanks for your patience. Here are the summaries I owe the group: Article 29 WP Statement on the data protection impact of the ICANN RAA (2013-2014) Article 29 WP Comments on the data protection impact of the revision of the ICANN RAA concerning accuracy and data retention of WHOIS (2012) Article 29 WP on ICANN's WHOIS Database Policy (2006) Best, Kiran Kiran Malancharuvil Policy Counselor MarkMonitor 415.222.8318 (t) 415.419.9138 (m) www.markmonitor.com<http://www.markmonitor.com/>

1 0

Re: [gnso-rds-pdp-purpose] Additional Information/question
by Carlton Samuels April 28, 2016

April 28, 2016

Actually Steph, we made extensive use of RAA 2013 in one of the EWG subteams I worked. Lack of user identification, authentication and access control was fingered as major disabilities of the existing WHOIS protocol. Scott [Hallenbeck], Lanre [Ajayi] and myself were members of the subteam (if memory serves it was G) that examined all the data elements described in the RAA 2013 WHOIS dataset from an access perspective, identify their source[s] and classified them for sensitivity to data protection rules. That outcome was the basis for recommending the RDAP - then in final preparatory stage by the WEIRDS WG of the IETF - as fit and proper vehicle for processing registration data. Another EWG subteam (could have been D with Michele on it) examined the RAA WHOIS dataset from a collection perspective + added some elements not described therein but which we know were generated in the course of the user/registrar transaction. Scott and myself then mapped the elements from collection perspective against those from the access perspective in an effort to harmonize elements, all under colour of data protection rules to decide the elements that would be gated for access. These were fairly detailed pieces of work and I kept the worksheets. So no, I cannot agree we never examined the RAA 2013. Best, -Carlton ============================== Carlton A Samuels Mobile: 876-818-1799 *Strategy, Planning, Governance, Assessment & Turnaround* ============================= On Mon, Apr 25, 2016 at 11:11 AM, Stephanie Perrin < stephanie.perrin(a)mail.utoronto.ca> wrote: > I would actually disagree. We discussed the use cases for data, accepting > those current uses as by and large legitimate. From a data protection > perspective, it has been clear from the very beginning that many of the new > purposes that registrant data were being put to, would not be permissible > by law under the original purpose of WHOIS. We never looked at the > collection instrument, (RAA) it was accepted as fait accompli. We did not > go over the extensive collection of documents that we had received from the > DPAs. So a thorough, tabula rasa discussion of the purpose of collection > of registrant data is in order, in my view. And SAC 055 agrees with that > view. > > Stephanie Perrin > > On 2016-04-25 17:34, Carlton Samuels wrote: > > ...and FWIW, the Review Team's final report was a very important substrate > upon which the EWG's work was advanced. > > The EWG spent an inordinate amount of time resolving the question as to > whether there was a purposeful need for registration data and if so, what > should be collected, the standards for collection, how it should be curated > and the safeguards, why and how it should be published and the mechanisms > for publication. > > I say again, it would be a sign of malignancy to embrace any attempt to > bounce the rubble here. If there is new and original insight of value to > the end game, let it be heard. > > Otherwise, enough good minds and treasure are exhausted answering those > questions. > > Lets get on with it. > > -Carlton > > > ============================== > Carlton A Samuels > Mobile: 876-818-1799 > *Strategy, Planning, Governance, Assessment & Turnaround* > ============================= > > On Mon, Apr 25, 2016 at 8:08 AM, Kathy Kleiman <kathy(a)kathykleiman.com> > wrote: > >> Hi Marika and All, >> I think my concerns run to (iii) and (v) below as the limitations of >> certain documents (especially ones people refer to often) have definitely >> been a part of the discussion of this subgroup. I would note that certain >> document in the summaries already contain some red highlighted notes, and I >> would like to request that similar notes be added *within our summary* of >> the Whois Review Team Final Report and within our subgroup report to the >> full WG. Here are the bullet points you requested (tx for asking!): >> >> - The Whois Review Team was *expressly barred **from looking at the >> purpose of the Whois system*. It was allowed to look only at ICANN's >> "existing policy relating to WHOIS" per the Affirmation of Commitments >> signed between US Department of Commerce and ICANN in 2009. >> >> - Even within that scope, the Whois Review Team Final Report expressly >> recommended protection of privacy for commercial companies, noncommercial >> organizations and individuals (finding that each shared with us legal and >> legitimate reasons for privacy including as-yet-unannounced mergers, new >> movie names, unpopular religious, ethnic and policy views, etc). >> >> - The Whois Review Team Final Report advised ICANN to work towards a >> standard of "contactability" *- reaching the registrant by **some **means >> rather than **all means *- which we wrote as: "ICANN should take >> appropriate measures to reduce the number of WHOIS registrations that fall >> into the accuracy groups Substantial Failure and Full Failure (as defined >> by the NORC Data Accuracy Study, 2009/10..." p. 87. >> >> We were tasked with conveying to the full WG our understanding of >> "purpose" as guided by these documents - and these notes add key insights >> and understandings to it (as we shared many times in presenting this Final >> Report to ICANN in 2012). >> >> Best, >> Kathy >> >> >> On 4/24/2016 8:35 PM, Marika Konings wrote: >> >> Kathy, all, as a reminder, each sub-team is expected to answer the >> following questions in relation to the work it has undertaken: >> >> (i) Did this input inventory produce any insights to inform the WG¹s work >> plan? >> (ii) Which inputs are likely to be the most important [relevant] during WG >> deliberations and why? >> (iii) Which inputs, if any, generated the most discussion within the small >> team? >> (iv) Which inputs may be obsolete or super-ceded by subsequent work? >> (v) What input gaps, if any, may need to be addressed later? >> (vi) Other key takeaways from this input inventory the team wishes to >> share with the WG >> >> >> Your concern appears to fall under item v? If you would like to summarise >> your concerns in a few bullets, the sub-team can maybe use these to start >> building out the responses to the questions? >> >> Best regards, >> >> Marika >> >> On 22/04/16 15:13, "gnso-rds-pdp-purpose-bounces(a)icann.org on behalf of >> Kathy Kleiman" <gnso-rds-pdp-purpose-bounces(a)icann.orgonbehalfofKathyKleiman> <gnso-rds-pdp-purpose-bounces(a)icann.org on behalf of >> kathy(a)kathykleiman.com> <gnso-rds-pdp-purpose-bounces@icann.orgonbehalfofkathy@kathykleiman.com> wrote: >> >> >> Hi Susan and Lisa, >> I have a question (which certainly does not have to be answered on a >> Friday afternoon), but some deep concerns have been raised on this list >> by people who helped created various documents and reports that we are >> now evaluating. For example, I raised the fact that it was completely >> out of scope for the Whois Review Team to evaluate the data collected in >> Whois and the primary purpose for which it was created. By the >> Affirmation of Commitments, we had to deal with the Whois system as it >> existed (and had been passed to ICANN from the National Science >> Foundation). >> >> We could not and did not address or deal with primary purpose. I think >> this limitation and fact is critical to the understanding and evaluation >> of the Whois Review Team report, especially as it applies to our >> question of "purpose." >> >> How can this point be added to Whois Review Team Final Report summary - >> perhaps in Additional Information? -- and to our discussion? >> >> Tx, >> Kathy >> _______________________________________________ >> gnso-rds-pdp-purpose mailing listgnso-rds-pdp-purpose@icann.orghttps://mm.icann.org/mailman/listinfo/gnso-rds-pdp-purpose >> >> >> >> _______________________________________________ >> gnso-rds-pdp-purpose mailing list >> gnso-rds-pdp-purpose(a)icann.org >> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-purpose >> > > > > _______________________________________________ > gnso-rds-pdp-purpose mailing listgnso-rds-pdp-purpose@icann.orghttps://mm.icann.org/mailman/listinfo/gnso-rds-pdp-purpose > > > > _______________________________________________ > gnso-rds-pdp-purpose mailing list > gnso-rds-pdp-purpose(a)icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-purpose >

3 4

Additional Information/question
by Kathy Kleiman April 27, 2016

April 27, 2016

Hi Susan and Lisa, I have a question (which certainly does not have to be answered on a Friday afternoon), but some deep concerns have been raised on this list by people who helped created various documents and reports that we are now evaluating. For example, I raised the fact that it was completely out of scope for the Whois Review Team to evaluate the data collected in Whois and the primary purpose for which it was created. By the Affirmation of Commitments, we had to deal with the Whois system as it existed (and had been passed to ICANN from the National Science Foundation). We could not and did not address or deal with primary purpose. I think this limitation and fact is critical to the understanding and evaluation of the Whois Review Team report, especially as it applies to our question of "purpose." How can this point be added to Whois Review Team Final Report summary - perhaps in Additional Information? -- and to our discussion? Tx, Kathy

6 7

Notes and for your review - sub-team draft responses to questions
by Lisa Phifer April 26, 2016

April 26, 2016

1 0

Purpose Sub Team question templates for discussion
by Susan Kawaguchi April 26, 2016

April 26, 2016

Hello Purpose Sub Team, On tomorrow’s call we will have 45 minutes to discuss the questions listed below. Staff has compiled our comments from emails and the last phone call discussion. We need to formulate responses to each of the questions below. Please review and think about all the summaries of the documents that have been reviewed for “purpose”. (i) Did this input inventory produce any insights to inform the WG’s work plan? Draft response: (ii) Which inputs are likely to be the most relevant during WG deliberations and why[2]? Draft response (based on input received during 20/4 meeting and sub-team mailing list): · EWG Recommendations (see relevant sections), because this comprehensive document has relevant sections that identify, analyze and define in a rigorous way the various categories of users and their purpose for accessing registration data. The analysis of the EWG is well structured and also carefully summarized in tables that are both detailed and, at the same time, precise and easy to read. In brief, the EWG recommendations provide a solid base for framing the questions that we are trying to address in our working group. The document is an excellent source of information that would help us facilitate our subsequent deliberations. · 2012 WHOIS Policy Review Team Report, because this report is another comprehensive document similar to the EWG recommendations. It contains a number relevant parts that give hints to answering the question of what is the over-arching purpose of collecting, maintaining, and providing access to gTLD registration data. The importance of this question makes the WHOIS report relevant to this PDP. · SAC055, because SAC055 provides further insight into the WHOIS Policy Review Team Final Report (2012). In particular, SAC055 emphasizes the need of a single consensus policy, explains why the attempts to reach consensus failed repeatedly and suggests recommendations to the ICANN Board of Directors to help overcome the challenges that occurred in the past. · 2007 GAC Communiqué regarding WHOIS, because the GAC principles regarding gTLD WHOIS services identify a number of important areas where WHOIS data is used such as supporting Internet's security and stability, determining availability of domain names, enforcing national and international laws, combating against abusive uses of ICTs, etc. All these recommendations are solid and also related to this PDP so they may help facilitate our work. · 2013 RAA - includes specific uses by registrars, because [to be completed] · Article 29 WP opinion (03/2003) on purpose limitation, because [to be completed] · Article 29 WP on ICANN Procedure for Handling WHOIS Conflicts with Privacy Law (2007), because this letter stresses the importance of defining the purpose of registration data so that its processing and use complies with EU data and protection legislation. Ensuring such legal compliance should be always kept in mind when defining the purpose in our PDP so that registrars operating under EU legislation do not face legal issues when trying to meet the registrar accreditation agreements. · Article 29 WP on legitimate interests of data controller (2014), because [to be completed] · SAC054, because this document is particularly relevant as it identifies not only the data elements collected, but the purpose for which they are collected, and identify whether the collection is optional or mandatory. (iii) Which inputs, if any, generated the most discussion within the small team? Draft response: (iv) Which inputs may be obsolete or super-ceded by subsequent work? Draft response: (v) What input gaps, if any, may need to be addressed later? Draft response: - The Whois Review Team was expressly barred from looking at the purpose of the Whois system. It was allowed to look only at ICANN's "existing policy relating to WHOIS" per the Affirmation of Commitments signed between US Department of Commerce and ICANN in 2009. - Even within that scope, the Whois Review Team Final Report expressly recommended protection of privacy for commercial companies, noncommercial organizations and individuals (finding that each shared with us legal and legitimate reasons for privacy including as-yet-unannounced mergers, new movie names, unpopular religious, ethnic and policy views, etc). - The Whois Review Team Final Report advised ICANN to work towards a standard of "contactability" - reaching the registrant by some means rather than all means - which we wrote as: "ICANN should take appropriate measures to reduce the number of WHOIS registrations that fall into the accuracy groups Substantial Failure and Full Failure (as defined by the NORC Data Accuracy Study, 2009/10..." p. 87. [MK1] (vi) Other key takeaways from this input inventory the team wishes to share with the WG Draft response: ________________________________ [1] Please see ‘Plan to consolidate summaries and complete & present team outputs<https://community.icann.org/download/attachments/58734473/RDS-InputTeams-Pl…>’ for further details on the overall agreed approach for sub-teams. [2] Note, this does not mean that other inputs are not considered – this is just intended to facilitate the WG’s prioritization of documents to consider first in relation to the finalization of the work plan and subsequent deliberations. ________________________________ [MK1]As suggested by Kathy. Looking forward to the discussion tomorrow. Susan Kawaguchi Domain Name Manager Facebook Legal Dept.

2 1

My "Big 5" documents
by Kathy Kleiman April 22, 2016

April 22, 2016

Hi All, What a tome we have created! Tx to all for the work, effort and insight. Tx Susan for asking about our top 5 picks from the Purpose List. The documents that I think are most important: 1) One not yet on our list (but so often referenced that it really must be): the EU Data Protection Directive (1995). This is the foundational document for the Article 29 Working Party opinions and so many other materials posted on our list. It is the EU law that creates the requirement of “purpose” in the collection, processing, retention, use and additional uses of data. It is the basis for this discussion (and Council of Europe Treaty 108 as well, signed by dozens of countries). Both were the first main documents to set out the requirement and definition of "purpose." I would request that both be added to our list - with the summaries already posted on the "Privacy checklist." Tx! 2) Opinion 03/2013 on Purpose Limitation by the Article 29 Working Party (issued April 2, 2013) is directly relevant to our work and providing clear input and insight to our understanding and interpretation of “purpose” as required under the EU Data Protection Directive (above). 3) the European Commission’s webpages on “Obligations of Data Controllers” and “Definition of Data Controllers” provides clear and accessible definitions and guidance as to who the "purpose" obligations apply to -- and helping us understand the obligations of those collecting data and those setting the policy for it. 4) I am still thinking about documents 4 and 5. :-) Best and have a good weekend, Kathy

1 0

Purpose Team Consolidated Summary - 21 April
by Lisa Phifer April 22, 2016

April 22, 2016

Dear purpose team, The latest Purpose Team Consolidated Summary PDF (updated 21 April) is attached and posted to the wiki at: https://community.icann.org/x/p4xlAw Going forward, staff will maintain the master consolidated summary. The Word version of the consolidated summary is also available on the above wiki page. - All team members are asked to review consolidated summaries (especially those within your own area of expertise) to ensure that key passages of each doc have at least been identified. - Those of you who drafted summaries are also asked to consider team feedback on your summary. Especially for docs which the team finds to be the most relevant to purpose, please draft a few concise bullet points summarizing the doc's relevance. - All team members are encouraged to discuss on-list which of the identified docs are most relevant to the question of purpose and why, along with other questions listed here: https://community.icann.org/download/attachments/58734473/RDS-InputTeams-Pl… Please send all feedback on purpose team summaries and document relevance to this team's email list, gnso-rds-pdp-purpose(a)icann.org. Thanks all for your efforts, Lisa

1 0