March 2022 - IRT.RegDataPolicy

Re: [IRT.RegDataPolicy] Data Retention requirements
by Theo Geurts 03 Mar '22

03 Mar '22

So I am trying to untangle this. The EPDP rec was on transfer data retention. A specific purpose, I cannot recall why we went there. I agree the clarification of the rec can trigger some questions on what is in the RAA. And we need to be clear as some registrars can do the wrong things based on just reading a policy. I would suggest to put the clarification as a foot note for registars for implementation, as in guidance. Best, Theo Op 17/02/2022 om 14:57 schreef Sarah Wyld via IRT.RegDataPolicy: > > Hello IRT team, > > Looking forward to finalizing this question related to data retention > requirements. Specifically, I am looking at Implementation Note F(c) > which I will copy here for reference: > > For purposes of clarity, unless specifically addressed and modified by > this Policy, all other data retention requirements and obligations > within Registrar’s Registrar Accreditation Agreement remain applicable > and in force. For example, this Policy does not supersede or replace > additional existing data retention requirements not applying to RDDS > data elements that Registrars are subject to under the Registrar > Accreditation Agreement. For clarity, this does not prevent > Requestors, including ICANN Compliance, from requesting disclosure of > these retained data elements for purposes other than TDRP. [P2P2R21] > > This implementation note will raise a question in the reader’s mind: > “What other data retention requirements and obligations exist within > the RAA?”. If the answer to this question is unclear, then the note > will cause more confusion than clarity. > > The Recommendation we’re implementing says: > > The EPDP Team confirms its recommendation from phase 1 that registrars > MUST retain only those data elements deemed necessary for the purposes > of the TDRP, for a period of fifteen months following the life of the > registration plus three months to implement the deletion, i.e., 18 > months. This retention is grounded on the stated policy stipulation > within the TDRP that claims under the policy may only be raised for a > period of 12 months after the alleged breach (FN: see TDRP section > 2.2) of the Transfer Policy (FN: see Section 1.15 of TDRP). For > clarity, this does not prevent Requestors, including ICANN Compliance, > from requesting disclosure of these retained data elements for > purposes other than TDRP, but disclosure of those will be subject to > relevant data protection laws, e.g., does a lawful basis for > disclosure exist. For the avoidance of doubt, this retention period > does not restrict the ability of registries and registrars to retain > data elements for longer periods. > > So, the Recommendation says registrars “MUST retain only those data > elements deemed necessary for the purposes of the TDRP” but the OneDoc > says “ALSO the other data mentioned in the RAA”. Those are clearly not > aligned. > > *We could resolve this by simply removing the note F(c); our Policy > requirement remains the same, and aligns with the Recommendation.* > > ** > > Alternatively, we could go through the "Non-exhaustive list of > examples of information/data/evidence that is not covered by the TDRP > <https://docs.google.com/document/d/1x_DC_X3acfMuuwjiuCpxSihE_fR3Ok2KEZ3A2Dz…>” > document that the Staff team put together of data they think should be > retained outside this TDRP retention requirements. I have looked at > every data element in that list and with the exception of the abuse > reports (which have their own retention period clearly listed in > 3.18.3) they all should be retained either only for the lifetime of > the domain or are necessary for the TDRP. > > So, unless someone can point to data which should be retained > differently than described in the Recommendation, I still find that > the Implementation Note F(c) is confusing and does not help the > implementer, because it makes them think there are retention > requirements which there are not. > > If we must keep the note, we should update it to specifically indicate > that only the Abuse Reports mentioned in RAA 3.18.3 are retained in > this way. > > > -- > *Sarah Wyld*, CIPP/E > Policy & Privacy Manager > Pronouns: she/they > swyld(a)tucows.com <mailto:swyld@tucows.com> > > *From: *Dennis Chang (Google Docs) > <mailto:comments-noreply@docs.google.com> > *Sent: *February 16, 2022 7:09 PM > *To: *swyld(a)tucowsinc.com > *Subject: *IRT.OneDoc RegDat... - There was a comment on this which I n... > > > Dennis Chang replied to a comment in the following document > > IRT.OneDoc RegDataPolicy20201005 > <https://docs.google.com/document/d/1SVFkoI6RmrVVz--RrVLSOj1bmz1qLb7_JTuvt7A…> > > For purposes of clarity, unless specifically addressed and modified by > this Policy, all other data retention requirements and obligations > within Registrar’s Registrar Accreditation Agreement remain applicable > and in force. For example, this Policy does not supersede or replace > additional existing data retention requirements not applying to RDDS > data elements that Registrars are subject to under the Registrar > Accreditation Agreement. For clarity, this does not prevent > Requestors, including ICANN Compliance, from requesting disclosure of > these retained data elements for purposes other than TDRP. [P2P2R21] > > > > > Sarah Wyld > > There was a comment on this which I now cannot find in the comment > history. This point c is confusing and should be removed, thank you. > > > > > Dennis Chang > > > New > > Hi Sarah, if you are referring to the comments that said that this > policy replaces all retention requirements in RAA, that was closed > since it is out-of-scope. This note is particularly important due to > the Rec21 from Phase 2. Per the IRT call today, I'd like to close out > the Recommendations related to retention. Would appreciate a reply > here that it's ok to resolve this comment or point to specific > language that is misaligned with the recommendation. thanks. > > Open > <https://docs.google.com/document/d/1SVFkoI6RmrVVz--RrVLSOj1bmz1qLb7_JTuvt7A…> > > Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA > > You have received this email because you are a participant in this > thread. Change what Google Docs sends you. > <https://docs.google.com/document/u/103140320049987970298/docos/notify?ouid=…> > You can reply to this email to reply to the discussion. > > > > > _______________________________________________ > IRT.RegDataPolicy mailing list > IRT.RegDataPolicy(a)icann.org > https://mm.icann.org/mailman/listinfo/irt.regdatapolicy > > _______________________________________________ > By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos) You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

2 1

IRT Task 195 Review Registration Data Policy Timeline 20220309
by Dennis Chang 02 Mar '22

02 Mar '22

Dear IRT, Thank you for supporting the review of the RegData Timeline at the IRT meeting today. I’d would appreciate all IRT members to review before we present this at the ICANN73 session. 195 Review Registration Data Policy Timeline<https://community.icann.org/display/RDPIRT/RegDataPolicy+Implementation+Res…> 20220309 You’ll find it as #1 item under the Reference Material on IRT wiki where we will maintain the updates. With the publication of this timeline, the community will be expecting a public comment on our work in 3Q22. Publish the final policy in 2Q23 for it to be effective in 4Q24. I think this is a challenging but achievable timeline especially with the good news we just hear on Rec12 from our Board. Please advise if you see risks for not being able to deliver to this timeline so we can work as a team to mitigate them. Thank you again for staying in there till we finish. -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org> One World – One Internet

1 0

Re: [IRT.RegDataPolicy] IRT Task 192 Review Redlined CL&D Policy with additional examples 20220304 > 20220308
by Dennis Chang 02 Mar '22

02 Mar '22

Dear IRT, We reviewed this today but didn’t have enough time for discussion with other priority items that needed our attention. It’s our last Consensus Policy Reddoc so let’s see if we can complete it at our next meeting. Please do comment your agreement as well. 192 Review Redlined CL&D Policy<https://docs.google.com/document/d/1xQiOsTpCUNgodWx-UM4BMHSV4prHocPI/edit#h…> with additional examples 20220304 20220308 Thanks Dennis Chang From: "IRT.RegDataPolicy" <irt.regdatapolicy-bounces(a)icann.org> on behalf of "Dennis Chang via IRT.RegDataPolicy" <irt.regdatapolicy(a)icann.org> Reply-To: Dennis Chang <dennis.chang(a)icann.org> Date: Friday, February 18, 2022 at 16:30 To: "Dennis Chang via IRT.RegDataPolicy" <irt.regdatapolicy(a)icann.org> Subject: [IRT.RegDataPolicy] IRT Task 192 Review Redlined CL&D Policy with additional examples 20220304 Dear IRT, We reviewed the RedDoc for CL&D before and received IRT feedback that the examples could be improved for clarity. Here is an updated version for your review. 192 Review Redlined CL&D Policy<https://docs.google.com/document/d/1xQiOsTpCUNgodWx-UM4BMHSV4prHocPI/edit#h…> with additional examples 20220304 As I mentioned at the meeting, this is the last RedDoc. And after your review, it will be posted along with 17 other RedDocs we’ve done on the IRT wiki. All these will be used to support the Public Comment when we present the OneDoc. Scope of this public comment will significant and we’ll need to allow more time than typical. We’ll discuss this when we meet to review our schedule -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org> One World – One Internet

1 0

Re: [IRT.RegDataPolicy] 189 Review Implementation Note B.b, c, d - revised 20220222 > 20220228 > 20220316
by Dennis Chang 02 Mar '22

02 Mar '22

Dear IRT, At the IRT meeting today, we agreed to extend this task out one more time. As I said at the meeting, I don’t think this is a controversial or difficult item but understandably everyone has been busy and the wordily events occupying our minds in the recent days. 189 Review Implementation Note B.b, c, d - revised<https://docs.google.com/document/d/1SVFkoI6RmrVVz--RrVLSOj1bmz1qLb7_JTuvt7A…> 20220222 20220228 20220316 Thank you for your continued support. Dennis Chang From: "IRT.RegDataPolicy" <irt.regdatapolicy-bounces(a)icann.org> on behalf of "Dennis Chang via IRT.RegDataPolicy" <irt.regdatapolicy(a)icann.org> Reply-To: Dennis Chang <dennis.chang(a)icann.org> Date: Friday, February 18, 2022 at 15:05 To: "Dennis Chang via IRT.RegDataPolicy" <irt.regdatapolicy(a)icann.org> Subject: Re: [IRT.RegDataPolicy] 189 Review Implementation Note B.b, c, d - revised 20220222 > 20220228 Dear IRT, The due date for this task has been extended per y0ur request. 189 Review Implementation Note B.b, c, d - revised<https://docs.google.com/document/d/1SVFkoI6RmrVVz--RrVLSOj1bmz1qLb7_JTuvt7A…> 20220222 20220228 For those that missed the last IRT meeting, please check the recording where we had discussion that I think would be helpful. Thanks Dennis Chang From: "IRT.RegDataPolicy" <irt.regdatapolicy-bounces(a)icann.org> on behalf of "Dennis Chang via IRT.RegDataPolicy" <irt.regdatapolicy(a)icann.org> Reply-To: Dennis Chang <dennis.chang(a)icann.org> Date: Tuesday, February 8, 2022 at 17:18 To: "Dennis Chang via IRT.RegDataPolicy" <irt.regdatapolicy(a)icann.org> Subject: [IRT.RegDataPolicy] 189 Review Implementation Note B.b, c, d - revised 20220222 Dear IRT, Please review. 189 Review Implementation Note B.b, c, d - revised<https://docs.google.com/document/d/1SVFkoI6RmrVVz--RrVLSOj1bmz1qLb7_JTuvt7A…> 20220222 As you know, in light of the exchange between the Board and the Council regarding Recommendation 7, the policy language now includes the language that “…provided an appropriate legal basis exists and data processing agreement is in place…” in Section 8.4 and 8.5. With this requirement now in the policy, we needed to include the implementation note to make clear how ICANN org would go about enforcing this provision. For instance, ICANN org will not be able to determine whether legal basis exists, which must be determined between the parties to the transfer, i.e. Registry Operator and Registrar. Likewise, whether the parties choose to enter into a Data Protection Agreement (that covers the transfer of the specified data elements) is not mandatory and will not be the subject of compliance enforcement. In the event that a complainant or a party to the transfer establishes that these (non-mandatory) criteria are in place, ICANN Compliance may then be able to enforce the transfer requirements from Registrar to Registry Operator. I hope this explanation provides further clarity on the part of the ICANN org enforcement of this policy. We can discuss further at our next meeting. -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org> One World – One Internet

1 0

IRT Task 194 Review Board Resolution: Supplemental Recommendation for Recommendation 12 20220309
by Dennis Chang 01 Mar '22

01 Mar '22

Dear IRT, Great News! Board has resolved to adopt the Rec 12 Supplemental Recommendation and we’ve been directed to implement. Please review and we’ll discuss it the 9 March 2022 IRT session. 194 Review Board Resolution: Supplemental Recommendation for Recommendation 12<https://www.icann.org/resources/board-material/resolutions-2022-02-24-en> 20220309 Resolved (2022.02.24.05), the Board adopts the GNSO Council's Supplemental Recommendation<https://gnso.icann.org/en/council/resolutions/1999-2019#201912> on the Expedited Policy Development Process on the Temporary Specification for gTLD Registration Data (EPDP) Phase 1, Recommendation 12, concerning the deletion of data in the Organization field as it addresses the Board's overarching concern of loss of essential data, should there ever be the need to contact the registered name holder and is in the best interests of ICANN and the ICANN community. Resolved (2022.02.24.06), the Board directs the ICANN President and CEO, or his designee(s), to include the appropriate guidance as described in the GNSO 21 January 2022 correspondence as part of the implementation of the Registration Data Policy. -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org> One World – One Internet

1 0