March 2022 - IRT.RegDataPolicy

IRT Task 202 Review Addendum II in OneDoc added for Rec 12 Supplenmental Recommendation 20220405
by Dennis Chang 25 Mar '22

25 Mar '22

Dear IRT, The supplemental recommendation provided clarity on requirements which this new addendum addresses. In terms of interpretation and requirement, this is the last change we’ve identified for Rec 12. 202 Review Addendum II in OneDoc added for Rec 12 Supplemental Recommendation<https://docs.google.com/document/d/1SVFkoI6RmrVVz--RrVLSOj1bmz1qLb7_JTuvt7A…> 20220405 I believe we’ll soon be able to go green on the Status Map for Rec 12. We’ll present the addendum at the IRT meeting next week for a brief discussion. -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org> One World – One Internet

1 0

IRT FYI: Letter from Board to GNSO: Supplemental Recommendation approval for Rec 12.
by Dennis Chang 24 Mar '22

24 Mar '22

Dear IRT, A letter from Maarten to Philippe (Board to GNSO) came out this week and it has been added to the IRT wiki for your reference. “I am pleased to inform you that the Board approved the supplemental recommendation at its meeting on 24 February 2022, and directed the org to include it in the implementation work on the Phase 1 recommendations.” 1. Board Confirmation letter to GNSO Council on Expedited Policy Development Process (EPDP) on the Temporary Specification for gTLD Registration Data Phase 1, Recommendation 12<https://www.icann.org/en/system/files/correspondence/botterman-to-fouquart-…> - 22 March 2022 I alerted you to the Board Resolution earlier and this is a nice follow-up letter to bring clarity in closure to a recommendation that had been an open implementation issue from the start of the EPDP Phase 1. We thank the Board and GNSO for their continued support of our implantation work and we can now confidently close Rec 12 on our side to prepare for Public Comment. -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org> One World – One Internet

1 0

IRT Task 201 Review Implementation Note F.c. Retention of Registration Data - revised 20220329
by Dennis Chang 22 Mar '22

22 Mar '22

Dear IRT, As promised, we are providing an alternate language for this note for Data Retention I converted this email discussion to an IRT task to ensure I get your attention. You’ll also note the due date being set to next week Tuesday, 29 March 2022, so that we can close this item at the next IRT meeting. The original note was not inaccurate nor misaligned with the policy requirement. However, we’ve reworded the language to remove reference to RAA per suggestions/. 201 Review Implementation Note F.c. Retention of Registration Data - revised<https://docs.google.com/document/d/1SVFkoI6RmrVVz--RrVLSOj1bmz1qLb7_JTuvt7A…> 20220329 With this item closed, we should be able to close out Phase 1 Rec 15 and Phase 2 Rec 21 both. I look forward to the Task Map color changes at our meeting next week. Thank for your continued support. Dennis Chang From: "IRT.RegDataPolicy" <irt.regdatapolicy-bounces(a)icann.org> on behalf of "Dennis Chang via IRT.RegDataPolicy" <irt.regdatapolicy(a)icann.org> Reply-To: Dennis Chang <dennis.chang(a)icann.org> Date: Thursday, March 3, 2022 at 12:37 To: Theo Geurts <gtheo(a)xs4all.nl>, "irt.regdatapolicy(a)icann.org" <irt.regdatapolicy(a)icann.org> Subject: Re: [IRT.RegDataPolicy] Data Retention requirements Thanks Theo and IRT, We discussed this yesterday and I think we made progress. We agreed to 1. will keep a note for clarity 2. not add data examples in that note I took the action to come back with alternative language. This one is especially challenging because we agreed on the policy language already (Section 13) Disagreement on the note, however, indicates that we see the requirement differently. While, it’s tempting to ignore this and leave for others in the future to deal with, I thank the IRT for the hard work it takes to untangle. Please do offer your insights and suggestions to move forward. Thanks Dennis Chang From: "IRT.RegDataPolicy" <irt.regdatapolicy-bounces(a)icann.org> on behalf of "Theo Geurts via IRT.RegDataPolicy" <irt.regdatapolicy(a)icann.org> Reply-To: Theo Geurts <gtheo(a)xs4all.nl> Date: Friday, February 18, 2022 at 13:02 To: "irt.regdatapolicy(a)icann.org" <irt.regdatapolicy(a)icann.org> Subject: Re: [IRT.RegDataPolicy] Data Retention requirements So I am trying to untangle this. The EPDP rec was on transfer data retention. A specific purpose, I cannot recall why we went there. I agree the clarification of the rec can trigger some questions on what is in the RAA. And we need to be clear as some registrars can do the wrong things based on just reading a policy. I would suggest to put the clarification as a foot note for registars for implementation, as in guidance. Best, Theo Op 17/02/2022 om 14:57 schreef Sarah Wyld via IRT.RegDataPolicy: Hello IRT team, Looking forward to finalizing this question related to data retention requirements. Specifically, I am looking at Implementation Note F(c) which I will copy here for reference: For purposes of clarity, unless specifically addressed and modified by this Policy, all other data retention requirements and obligations within Registrar’s Registrar Accreditation Agreement remain applicable and in force. For example, this Policy does not supersede or replace additional existing data retention requirements not applying to RDDS data elements that Registrars are subject to under the Registrar Accreditation Agreement. For clarity, this does not prevent Requestors, including ICANN Compliance, from requesting disclosure of these retained data elements for purposes other than TDRP. [P2P2R21] This implementation note will raise a question in the reader’s mind: “What other data retention requirements and obligations exist within the RAA?”. If the answer to this question is unclear, then the note will cause more confusion than clarity. The Recommendation we’re implementing says: The EPDP Team confirms its recommendation from phase 1 that registrars MUST retain only those data elements deemed necessary for the purposes of the TDRP, for a period of fifteen months following the life of the registration plus three months to implement the deletion, i.e., 18 months. This retention is grounded on the stated policy stipulation within the TDRP that claims under the policy may only be raised for a period of 12 months after the alleged breach (FN: see TDRP section 2.2) of the Transfer Policy (FN: see Section 1.15 of TDRP). For clarity, this does not prevent Requestors, including ICANN Compliance, from requesting disclosure of these retained data elements for purposes other than TDRP, but disclosure of those will be subject to relevant data protection laws, e.g., does a lawful basis for disclosure exist. For the avoidance of doubt, this retention period does not restrict the ability of registries and registrars to retain data elements for longer periods. So, the Recommendation says registrars “MUST retain only those data elements deemed necessary for the purposes of the TDRP” but the OneDoc says “ALSO the other data mentioned in the RAA”. Those are clearly not aligned. We could resolve this by simply removing the note F(c); our Policy requirement remains the same, and aligns with the Recommendation. Alternatively, we could go through the "Non-exhaustive list of examples of information/data/evidence that is not covered by the TDRP<https://docs.google.com/document/d/1x_DC_X3acfMuuwjiuCpxSihE_fR3Ok2KEZ3A2Dz…>” document that the Staff team put together of data they think should be retained outside this TDRP retention requirements. I have looked at every data element in that list and with the exception of the abuse reports (which have their own retention period clearly listed in 3.18.3) they all should be retained either only for the lifetime of the domain or are necessary for the TDRP. So, unless someone can point to data which should be retained differently than described in the Recommendation, I still find that the Implementation Note F(c) is confusing and does not help the implementer, because it makes them think there are retention requirements which there are not. If we must keep the note, we should update it to specifically indicate that only the Abuse Reports mentioned in RAA 3.18.3 are retained in this way. -- Sarah Wyld, CIPP/E Policy & Privacy Manager Pronouns: she/they swyld(a)tucows.com<mailto:swyld@tucows.com> [cid:image003.png@01D823DC.57DA4810] From: Dennis Chang (Google Docs)<mailto:comments-noreply@docs.google.com> Sent: February 16, 2022 7:09 PM To: swyld(a)tucowsinc.com<mailto:swyld@tucowsinc.com> Subject: IRT.OneDoc RegDat... - There was a comment on this which I n... Dennis Chang replied to a comment in the following document [Image removed by sender.]IRT.OneDoc RegDataPolicy20201005<https://docs.google.com/document/d/1SVFkoI6RmrVVz--RrVLSOj1bmz1qLb7_JTuvt7A…> For purposes of clarity, unless specifically addressed and modified by this Policy, all other data retention requirements and obligations within Registrar’s Registrar Accreditation Agreement remain applicable and in force. For example, this Policy does not supersede or replace additional existing data retention requirements not applying to RDDS data elements that Registrars are subject to under the Registrar Accreditation Agreement. For clarity, this does not prevent Requestors, including ICANN Compliance, from requesting disclosure of these retained data elements for purposes other than TDRP. [P2P2R21] [Image removed by sender.] Sarah Wyld There was a comment on this which I now cannot find in the comment history. This point c is confusing and should be removed, thank you. [Image removed by sender.] Dennis Chang New Hi Sarah, if you are referring to the comments that said that this policy replaces all retention requirements in RAA, that was closed since it is out-of-scope. This note is particularly important due to the Rec21 from Phase 2. Per the IRT call today, I'd like to close out the Recommendations related to retention. Would appreciate a reply here that it's ok to resolve this comment or point to specific language that is misaligned with the recommendation. thanks. Open<https://docs.google.com/document/d/1SVFkoI6RmrVVz--RrVLSOj1bmz1qLb7_JTuvt7A…> Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA You have received this email because you are a participant in this thread. Change what Google Docs sends you.<https://docs.google.com/document/u/103140320049987970298/docos/notify?ouid=…> You can reply to this email to reply to the discussion. [Image removed by sender.] _______________________________________________ IRT.RegDataPolicy mailing list IRT.RegDataPolicy(a)icann.org<mailto:IRT.RegDataPolicy@icann.org> https://mm.icann.org/mailman/listinfo/irt.regdatapolicy _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

1 0

IRT Task 200 Review Section 4: Policy Effective Date 20220405
by Dennis Chang 22 Mar '22

22 Mar '22

Dear IRT, As we are closing out the outstanding interpretations and requirement items, we will be working to clean up the OneDoc in preparation for the Public Comment. From here, I’ll be using the word “Lock Down” for each section to indicate that we will be freezing the policy language for that section until after public comment This of course is to ensure that we deliver our policy for public comment to the community per the timeline we’ve published. The Section 4 is unique in that the Public Comment version is different by design than the final version. Rather than a date, we use a time duration to inform the public the expected implementation timeline. IRT has already agreed on the 18 months, so the next step is for us is to receive public comments for consideration. Based on the comments received, we’ll have another discussion and finally select the exact date. Selecting the date will be a bit of fun as we’ll all remember this date for the rest of our lives, won’t we? 200 Review Section 4: Policy Effective Date <https://docs.google.com/document/d/1SVFkoI6RmrVVz--RrVLSOj1bmz1qLb7_JTuvt7A…> 20220405 -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org> One World – One Internet

1 0

IRT Task 199 Review Tech Contact move from section 9.2 to 9.3 and from 9.5 to 9.6 20220405
by Dennis Chang 22 Mar '22

22 Mar '22

Dear IRT, This was already discussed at the IRT meeting and this task is show you the exact changes that will be made. 199 Review Tech Contact move from section 9.2 to 9.3 and from 9.5 to 9.6<https://docs.google.com/document/d/1SVFkoI6RmrVVz--RrVLSOj1bmz1qLb7_JTuvt7A…> 20220405 As you’ll note that section 9.6 was necessary addition to accommodate the clarity in the implementation language to be aligned with the recommendation. -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org> One World – One Internet

1 0

IRT Task 198 Review Registrant Organization data element 9.1.5 to section 9.2 due 20220405
by Dennis Chang 22 Mar '22

22 Mar '22

Dear IRT, We’ve begun analysis for the Supplemental Recommendation for the Registrant Organization: Rec 12. To remind everyone, we had held off on discussing Registrant Organization data element till now to avoid any rework. As we review each encounter for “Registrant Organization,” we’ll be looking to see if the drafted language that is already there is acceptable. Where we need to make changes, I’ll issue IRT tasks to ask for your review. This change is one change that we had contemplated before. You’ll see the long chain of comments that leads up to the suggested change on the doc. 198 Review Registrant Organization data element 9.1.5 to section 9.2<https://docs.google.com/document/d/1SVFkoI6RmrVVz--RrVLSOj1bmz1qLb7_JTuvt7A…> 20220405 There are other changes and I’ll issue separate tasks for them. -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org> One World – One Internet

1 0

IRT FYI. GAC Communique Issue of Importance #4: RegData
by Dennis Chang 15 Mar '22

15 Mar '22

Dear IRT, RegData Policy came out as #4 in the Issue of Importance in the ICANN73 GAC Communique https://gac.icann.org/contentMigrated/icann73-gac-communique 4. EPDP Phase 1 Recommendations Implementation The GAC recalls its previous advice within the ICANN66 Montréal Communiqué and the follow-up on previous advice in the ICANN70, 71 and 72 Communiqués with regard to Phase 1 of the EPDP on gTLD Registration Data and the request for “a detailed work plan identifying an updated realistic schedule to complete its work.” The GAC welcomes the detailed work plan provided by ICANN org to the IRT prior to ICANN73 and notes that the expected Data Protection Agreements (DPAs) between ICANN org and Contracted Parties have been "undergoing time-consuming negotiations" and are part of discussions "which may lead to an impasse". Since finalized DPAs seem to be on the critical path to completing the implementation of EPDP Phase 1 policy recommendations, the GAC asks the ICANN Board to support the Org in getting this item completed to enable the timely conclusion of the Phase 1 IRT. Thanks for your review and support of the timeline. Now, let’s work together to deliver to the published schedule. -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org> One World – One Internet

1 0

IRT Task 197 Review Supplemental Recommendation for Rec12 IRT working doc. 20220323
by Dennis Chang 14 Mar '22

14 Mar '22

Dear IRT, Thank you for supporting our ICANN73 session last week. The ICANN sessions are good opportunities to share our work progress with the community And it was timely to receive the Board Direction for us to begin the implementation for the GNSO Supplemental Recommendation. This document was shared during that session and IRT members commented that it was helpful so here I share again. 197 Review Supplemental Recommendation for Rec12 IRT working doc.<https://docs.google.com/document/d/1Qu8EG_omjqu9NWHcGFLkgdq0a96_mE2T-yXEUwv…> 20220323 Let’s use this as our working document to review and analyze the supplemental recommendation. I think we’ve complied all pertinent information but please do add if find other material that could be helpful. Please comment directly on the document as well as we do our analysis. -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org> One World – One Internet

1 0

Reminder: ICANN73 Registration Data Policy Implementation-IRT Session | Wednesday, 09 March 2022 at 20:30 UTC
by Andrea Glandon 07 Mar '22

07 Mar '22

Dear all, The ICANN73 Registration Data Policy Implementation-IRT session will be held on Wednesday, 09 March 2022 at 20:30 UTC. YOU MUST REGISTER FOR ICANN73 INFORMATION * Sign into your ICANN Account, or create an account here [account.icann.org]<https://urldefense.com/v3/__https:/account.icann.org/login__;!!PtGJab4!r0Vr…>. * Register for ICANN73 by clicking in the ICANN SERVICES menu and selecting Meeting Registration and click on the ICANN73 Registration link. Click here [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/sites/default/files/polic…> for detailed instructions. Access the ICANN73 Schedule * ICANN73 schedule: https://73.schedule.icann.org/ [73.schedule.icann.org]<https://urldefense.com/v3/__https:/73.schedule.icann.org/__;!!PtGJab4!r0Vro…> For security purposes, participation links will be posted 24-hours prior to the session start times. IRT Agenda: https://community.icann.org/x/Jc0GCw Thank you. Andrea Glandon Policy Operations Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Skype ID: acglandon76

1 0

IRT Task 196 Review Questions from the RDAP WG 20220316
by Dennis Chang 07 Mar '22

07 Mar '22

Dear IRT, This is a document to facilitate the IRT discussion for the questions from the RDAP WG. Marc Anderson brought it up as an AOB item at our last meeting but we did not have enough discussion for a decision/direction. 196 Review Questions from the RDAP WG<https://docs.google.com/document/d/1AqwAoOmTk5Vs2fswNcwym80drt7BDUFzbfAjrzP…> 20220316 Marc, Please feel free to edit this document to make it useful for you and the IRT for our discussion this week. Thank you and the WG for updating the RDAP documents and we hope to see the RedDocs soon. -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org> One World – One Internet

1 0