Hello All, Thanks Marc for doing a thorough review and sending in comments, I appreciate your perspective. I support your input re moving the Scope to the Implementation Notes; the information seems best suited for the Scope section. I would also be interested especially in the answer to your question re the changes to 6.8. I agree that specifying “homepage” is not helpful and may instead cause confusion and lack of clarity. Thank you, -- Sarah Wyld, CIPP/E Policy & Privacy Manager Pronouns: she/they swyld@tucows.com From: Anderson, Marc via IRT.RegDataPolicy Sent: May 18, 2023 12:13 PM To: dennis.chang@icann.org; irt.regdatapolicy@icann.org Subject: Re: [IRT.RegDataPolicy] IRT Task 236 Review updated Policy Language- post Public Comment due 20230517 Dennis and IPT / IRT members, Here is my feedback for the task of reviewing the updated Policy Language document post public comment. Feedback: This language was in the scope section for public comment, but moved to implementation note A: Registry Operator’s and Registrar’s Processing of Personal Data contained in Registration Data for purposes other than the purposes identified in the Data Protection Agreement required by Section 5 is beyond the scope of this Policy. (See Implementation Note A.) This seems to be based on public comment feedback that “other purposes” in this section would benefit from clarity. Simply moving the language from the scope section to the implementation note doesn’t provide any clarity, it just moves it. The scope section seems the more appropriate place for this language. That registries and registrar can have other purposes for processing registration data beyond the baselines set in this policy is something agreed to in the working group and has been understood throughout the IRT. It seems important to capture that in the scope (section). I don’t support the change of moving that language from the scope section to Implementation note A. Note: Policy Effective Data – I’ll just note that section has its own specific task, so I’ll provide my feedback to that task (and not here). Question: Can you provide a little context for why section 6.8 was changed the way it was? I’m not sure if the changes are substantive, but they seem odd to me, and I’m not sure they are technically possible. In a registry system, you can’t delete contact data elements. You can add / modify / delete a contact, but you can’t delete contact data elements. I can’t track those changes back to a public comment and I’m not sure why the change, but the original language makes more sense to me. Question: Section 9 Publication (b) of the Responses to Public comments report indicates that there was feedback to section 9.2.4 consent to publish and that following review, the IPT included suggested clarification in the implementation notes of the draft policy. I can’t find what that is referring to. Could I get a clarification as to what that language is. I’ll note I’m not exactly sure what needs to be clarified as the language is 9.2.4 seems very clear and unambiguous (Registrar MUST provide the opportunity for the Registered Name Holder to provide its Consent to Publish the data element values.) Note: Section 10 Urgent requests have their owns specific task, so I’ll provide my feedback to that task (and not here). Feedback: In the implementation notes, section D (publication of registrant organization) subsection 2: the word “field’s” was replaced with “data element’s”. To be consistent with changes made throughout the rest of the document, that should probably be “data element value’s”. Feedback: I note that the RySG feedback on section 10 specifically the “link to a page where the mechanism and process for submitting disclosure requests is detailed” did not result in changes. The RySG pointed out that the policy recommendations deliberately do not use the word “homepage” while the policy language does and further notes that this is because the homepage is not always the best place for this link. For my company, being a registry is our primary business and the homepage makes sense as far as the location for publishing that link. I’ve heard from other registry and registrar colleagues frustration with the “homepage” requirement as for them, being a registry or registrar isn’t necessarily their primary business and for them the “homepage” isn’t the right place for that link, and may create confusion. I understand the IPT rejected the RySG feedback out of concern that some IRT members indicated it can be difficult finding information about disclosure requests. Perhaps there is some middle ground that can address both concerns, for example change the language in 10.1 to “… publish on their homepage or primary page for registry and/or registrar services a direct link….” Best, Marc From: IRT.RegDataPolicy <irt.regdatapolicy-bounces@icann.org> On Behalf Of Dennis Chang via IRT.RegDataPolicy Sent: Thursday, May 4, 2023 10:08 AM To: Anderson, Marc via IRT.RegDataPolicy <irt.regdatapolicy@icann.org> Subject: [EXTERNAL] [IRT.RegDataPolicy] IRT Task 236 Review updated Policy Language - post Public Comment due 20230517 Caution: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Dear IRT, We’ve completed review of all public comments and made the updates to the policy language. Prepared are the redline version and the clean version for your review. • The Registration Data Policy with redlined changes resulting from Public Comment: Registration Data Policy - Redline Version Post Public Comment • The clean version of the Registration Data Policy with changes resulting from Public Comment: Registration Data Policy - CLEAN Version Post Public Comment Also prepared is the Public Comment Report Addendum that documents the analysis and responses for the comments. • Public Comment Report - 20 January 2023 • Public Comment Report Addendum - Responses to Registration Data Public comment - 28 April 2023 You will find all these documents posted on the IRT wiki following our normal process. https://community.icann.org/display/RDPIRT/RegDataPolicy+Implementation+Reso... We’ll go over these in the IRT meeting on 10 May 2023. -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org One World – One Internet