Tx for the invitation to join, Chuck, and following up on the discussion of Sam and Tapani, let me add that criteria for processing must be clearer than something broadly within ICANN's mission statement and something permissible somewhere. The requirements under law are express and concrete.

Specifically, GDPR Article 5(1)(b and c) states:

Personal data shall be:
2.    "collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes" (the "purpose limitation") AND
3.    "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed" (the "data minimisation" requirement).  [underline added]

Thus, our first criteria of "consistent with ICANN's mission," is only the first step and we need to go further than even the 3 criteria we are discussing..

Second, lawful and legal enter us into a debate over words and I have to agree with Sam and Tapani's analysis and let me add some of my own.

"Legal" is the term we use for actions expressly allowed under law. How we process personal data under the GDRP falls into this category -- of processing expressly allowed under law. Whereas the term lawful is used for a much broader category of actions which are generally permissible and allowable.

The term "legal" is much more consistent with our criteria statement because the processing of personal data by ICANN must clearly have a valid legal basis as expressly defined by data protection laws.

Best regards,
Kathy

On 2/7/2018 10:53 AM, Sam Lanfranco wrote:

Thanks Tapani,

I will extract from your longer message.
I deliberately kept my brief and less technical.
I think we are in agreement here and I support your position.

On 2/7/2018 1:07 AM, Tapani Tarvainen wrote:

The key distinction, as I understand it, is that "lawful" would be
 defined by the negative, everything that some law does not prohibit,
where as "legal basis" is defined by the positive, only things whose
justification can be explicitly derived from law.

  <......>

So I would prefer "legal basis" specifically in this sense: that any processing
 would have to be explicitly based on one of the criteria, or bases, as listed
in GDPR Article 6, or similar explicit justification in other data protection legislation. 




_______________________________________________
gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg