October 2021 - ODP-SSAD - lists.icann.org

Request for verification/feedback on SSAD recommendations
by Yuko Yokoyama Oct. 21, 2021

Oct. 21, 2021

Dear Janis, As we continue to develop Org’s assessment for the SSAD ODP, we came to additional questions/assumptions that we would like GNSO Council’s confirmation and/or clarifications. Contractual Compliance In the SSAD, there are two areas that implicate ICANN Contractual Compliance intervention: 1. Alert mechanisms/complaints regarding Contracted Party behavior (Recs 5.3, 5.4) The recommendation states the “alert mechanism is not an appeal mechanism – to contest disclosure or non-disclosure affected parties are expected to use available dispute resolution mechanisms such as courts or Data Protection Authorities…” As a result, Compliance’s role is limited to investigating complaints related to procedural failures by the contracted party. 1. Contracted Party SLA requirements (Rec 10) Similar to existing processes, complaints or investigations related to contracted party requirements for SSAD may be received and processed through public-facing complaint forms that feed into the Naming Services portal (NSp) and result in individual cases. If needed, develop automation of complaints related to violations as those may be triggered from internal reporting. Question 1: Does the proposed approach regarding development of potential complaint forms or automated notifications (where possible) fulfill the intentions of the recommendations? Automation of Disclosure Request Processing Per recommendation 9.4, only the following categories are considered to meet the criteria for automated processing of data disclosure: * Requests from Law Enforcement in local or otherwise applicable jurisdictions with either 1) a confirmed GDPR 6(1)e lawful basis or 2) processing is to be carried out under a GDPR, Article 2 exemption; * The investigation of an infringement of the data protection legislation allegedly committed by ICANN/Contracted Parties affecting the registrant; * Request for city field only, to evaluate whether to pursue a claim or for statistical purposes; * No personal data on registration record that has been previously disclosed by the Contracted Party. Question 2: We note the first bullet specifically references the GDPR. Our understanding is the above categories were included in the legal guidance provided to the EPDP Team, and the legal guidance specifically referenced the GDPR. Our assumption is the EPDP Team considered this guidance in developing this recommendation but did not intend to exclude privacy laws outside the GDPR. In other words, though this first use case only references the specific scenario in which a law enforcement requestor has a legal basis for processing under GDPR 6(1)e (or whose processing is explicitly exempted from GDPR’s restrictions on data processing), other law enforcement authorities who are outside the EU might also qualify for automated disclosure if they have a comparable legitimate interest in processing such data under their own local law. Can you please confirm if this assumption is correct (or if, conversely, the intention was only for EU law enforcement requests to have the potential for automation under this use case)? We would very much appreciate your help in relaying these questions to the GNSO Council. If you have any questions, please do not hesitate to contact us. Regards, Yuko Yokoyama Program Director Strategic Initiatives, Global Domains & Strategy Internet Corporation for Assigned Names and Numbers (ICANN)

2 3

Re: [ODP-SSAD] Request for Extension of SSAD ODP GAC Survey
by Eleeza Agopian Oct. 15, 2021

Oct. 15, 2021

Dear GAC Support Team, We have received your request for an extension on the survey for Governmental Advisory Committee (GAC) members with regard to the System for Standardized Access/Disclosure (SSAD) Operational Design Phase (ODP). In order to accommodate greater participation, the survey deadline has been extended to 31 October 2021. The survey is available here: https://www.surveymonkey.com/r/ssadodpgac. While there are several questions in the survey, you are welcome to answer only those for which you are able to provide replies. In particular, we urge GAC members to focus on the following two questions: 1. How should each country/territory or government-designated Accreditation Authority (AA) be designated to ICANN org or its designee? 2. Who in your administration should be authorized to make such designations? This survey is critical in helping ICANN org fully assess the SSAD recommendations and answer the ICANN Board’s scoping questions. Any additional information or input the GAC deems relevant to the accreditation of governmental entities and requests for disclosure of nonpublic registration data by governmental entities, would also be appreciated. We thank you for your help in encouraging GAC participation. As always, feel free to contact us at ODP-SSAD(a)icann.org if there are any questions or concerns. Please note, the full text of your email, including your comment, name, and email address, will be published in the archive on ICANN org’s website here. Sincerely, Eleeza Agopian From: ODP-SSAD <odp-ssad-bounces(a)icann.org> on behalf of Fabien Betremieux <fabien.betremieux(a)icann.org> Date: Friday, October 15, 2021 at 11:34 AM To: "odp-ssad(a)icann.org" <odp-ssad(a)icann.org> Cc: "gac(a)icann.org" <gac(a)icann.org> Subject: [ODP-SSAD] Request for Extension of SSAD ODP GAC Survey Dear SSAD ODP Team, The GAC wishes to request an extension of the deadline for the SSAD ODP GAC Survey, to after ICANN72. The GAC notes and welcomes the recent clarification from ICANN org that part of the questions should be considered optional. That said, providing input in regard to designations of accreditation authorities may still prove challenging in some countries given that they may require substantial consultations and coordination at the national level. The extended response period would be used by GAC representatives to further communicate on the survey and ease coordination with competent national bodies. As you may be aware, this matter is also one of the topics the GAC is set to discuss during the upcoming ICANN72 meeting. The GAC would also like to take the opportunity of this request to kindly suggest that future surveys not be launched over summer holidays, or if this is the case, that the response period be longer. Thank you for your consideration On behalf of the GAC Chair, The GAC Support Team.

1 0

Request for Extension of SSAD ODP GAC Survey
by Fabien Betremieux Oct. 15, 2021

Oct. 15, 2021

Dear SSAD ODP Team, The GAC wishes to request an extension of the deadline for the SSAD ODP GAC Survey, to after ICANN72. The GAC notes and welcomes the recent clarification from ICANN org that part of the questions should be considered optional. That said, providing input in regard to designations of accreditation authorities may still prove challenging in some countries given that they may require substantial consultations and coordination at the national level. The extended response period would be used by GAC representatives to further communicate on the survey and ease coordination with competent national bodies. As you may be aware, this matter is also one of the topics the GAC is set to discuss during the upcoming ICANN72 meeting. The GAC would also like to take the opportunity of this request to kindly suggest that future surveys not be launched over summer holidays, or if this is the case, that the response period be longer. Thank you for your consideration On behalf of the GAC Chair, The GAC Support Team.

1 0

Re: [ODP-SSAD] [Ext] ODP Design
by Eleeza Agopian Oct. 13, 2021

Oct. 13, 2021

Dear Mr. Muthusamy, Thank you for your email. The Request for Information<https://www.icann.org/en/announcements/details/request-for-information-on-i…> on identity verification methods you referenced below closed in July. An overview of the responses we received was provided in a webinar conducted on 24 September 2021. A recording of that webinar is available here<https://icann.zoom.us/rec/share/FY0hnxQh8RkibZ1rsuXrujg6j4pFZkn3znzMjG8TCrT…>. We are also planning another community conversation on this project during ICANN72. You can find information on the 28 Octoberr 2021 session here<https://72.schedule.icann.org/meetings/bnxyRdTi3LXqJsNRd#/?limit=10&sortByF…>. If you have any feedback or input you’d like to share with the SSAD ODP team, you can submit it to odp-ssad(a)icann.org<mailto:odp-ssad@icann.org>. Please note that all emails sent to this address are publicly archived here<https://mm.icann.org/pipermail/odp-ssad/>. You can find more information on the SSAD ODP on this page<https://www.icann.org/ssadodp>. Thank you, Eleeza From: Sivasubramanian Muthusamy <shiva(a)nameshop.in> Date: Sunday, October 10, 2021 at 12:43 PM To: Eleeza Agopian <eleeza.agopian(a)icann.org>, "ssad(a)icann.org" <ssad(a)icann.org> Cc: Sivasubramanian Muthusamy <6.Internet(a)gmail.com> Subject: [Ext] ODP Design This concerns ICANN' call for information on identity verification methods as published at page https://www.icann.org/en/blogs/details/icann-to-open-request-for-informatio… I wish to present a broad, abstract design outline for SSAD, with a commercial component in design and implementation, somewhat expanded in scope considering recent DNS issues related to identity. Kindly advise us on the timeline for this project. -- Sivasubramanian M Nameshop India.

3 3

Sent again with recipient addresses corrected: ODP Design
by Sivasubramanian Muthusamy Oct. 10, 2021

Oct. 10, 2021

Dear Eleeza Agopian, This concerns ICANN' call for information on identity verification methods as published at page https://www.icann.org/en/blogs/details/icann-to-open-request-for-informatio… I wish to present a broad, abstract design outline for SSAD, with a commercial component in design and implementation, somewhat expanded in scope considering recent DNS issues related to identity. Kindly advise us on the timeline for this project. -- Sivasubramanian M Nameshop India.

1 0