August 2011 - Rt4-whois - lists.icann.org

Public wiki - Compliance - ICANN Staff material
by Alice Jansen Aug. 23, 2011

Aug. 23, 2011

Dear Review Team Members, This is to inform you that the slide presentation delivered by ICANN Compliance Staff on 21 July as well as Staff responses to the Review Team's questions on WHOIS compliance (circulated by Denise on 19 August) are now available on the public wiki at: https://community.icann.org/display/whoisreview/Information+Provided+by+ICA… Thanks, Kind regards Alice

2 1

Next call
by Alice Jansen Aug. 23, 2011

Aug. 23, 2011

Dear Review Team Members, As you all know, your next WHOIS conference call is scheduled for next week. With a view to ensuring a quorum, the Review Team Chair has decided to select a US/Australia-friendly timeslot for this call. 22:00 UTC appears to be the most convenient slot: 08:00 AUSTRALIA – 18:00 WASHINGTON – 15:00 LOS ANGELES – 23:00 LONDON – 00:00 BERLIN. Unfortunately I am unable to provide support on 31 August as I am on leave. As the call needs to be monitored, I asked Emily and Kathy whether it could please be postponed to 1 September, a proposal which was very kindly accepted. Your next session will thus be held on 1 September at 22:00 UTC. We hope this seems acceptable to you and apologize for any inconvenience this change may cause… Many thanks in advance for your understanding. Kindest regards Alice

2 1

Fwd: [ALAC-Announce] At-Large Representative to the WHOIS Review Team
by Omar Kaminski Aug. 22, 2011

Aug. 22, 2011

FYI ---------- Forwarded message ---------- From: ICANN At-Large Staff <staff(a)atlarge.icann.org> Date: 2011/8/22 Subject: [ALAC-Announce] At-Large Representative to the WHOIS Review Team To: ALAC Announce <alac-announce(a)atlarge-lists.icann.org> Cc: ICANN At-Large Staff <staff(a)atlarge.icann.org> Dear All, With 9 out of 14 ALAC Members having cast their vote for the At-Large Representative to the Whois Review Team, we can confirm that the vote is quorate. The candidate receiving the largest number of votes is Wilson Abigaba. ********* Question: Please place the candidates below in you order of preference, from highest to lowest, for the At-Large Representative to the WHOIS Review Team. With the possible answers being: * Wilson Abigaba: 26.66% * Seth Reiss: 21.48% * Eduardo Diaz: 18.52% * Cintra Sooknanan: 17.04% * Garth Bruen: 16.30% ********* You may verify the results independently under: https://www.bigpulse.com/pollresults?code=1910vNFdk4XIKLzsWImzBEiI As the vote was anonymous, we cannot confirm who participated in the balloting and who did not. You can find the results of all closed ALAC votes under: https://www.bigpulse.com/m7097 Thank you. Regards, Heidi Ullrich, Seth Greene, Matt Ashtiani, Gisella Gruber-White, Marilyn Vernon ICANN At-Large Staff _______________________________________________ ALAC-Announce mailing list ALAC-Announce(a)atlarge-lists.icann.org https://atlarge-lists.icann.org/mailman/listinfo/alac-announce At-Large Official Site: http://www.atlarge.icann.org

1 0

Re: [Rt4-whois] Draft User Insight contract
by lynn＠goodsecurityconsulting.com Aug. 19, 2011

Aug. 19, 2011

1 0

Answers from ICANN Staff to Whois Compliance Questions
by Denise Michel Aug. 19, 2011

Aug. 19, 2011

Dear Review Team members, Attached are the responses from ICANN Staff to the Review Team's questions regarding Whois compliance. This will be posted on the Team's wiki. Please let me know if you need anything further. Regards, Denise Denise Michel ICANN Advisor to the President & CEO denise.michel(a)icann.org +1.408.429.3072 mobile +1.310.578.8632 direct

1 0

Draft User Insight contract
by Olof Nordling Aug. 19, 2011

Aug. 19, 2011

Emily, Kathy, Lynn, all, Please find attached the draft contract for User Insight, Inc., in ICANN format. It was sent as draft today to the company for their review and approval, while highlighting that a contract should be agreed upon by Tuesday 23 August. Now, please note that we need your scrutiny and approval as well! In the draft contract, please note in particular: - they report to the Chair and Vice-Chair (in line with how it was done for ATRT's Berkman contract) - the start date is set to 23 August and the finish date as 30 September based on their 5 weeks plan, but I have highlighted that the finish date is a placeholder and that preferred delivery date is 19 September, urging them to carefully consider if that's doable. - as you have seen in their proposal already, they require appointment of an "executive sponsor" and a "project sponsor" from your side - probably worthwhile to consider right away. Looking forward to any questions, comments or edits from you on this. Very best regards Olof

2 1

Adobe Connect - Note Pod Content - Call 17 Aug
by Alice Jansen Aug. 17, 2011

Aug. 17, 2011

Dear Review Team Members, For your convenience, please find enclosed the note pod content of your call held on 17 August. Kindly note that these are draft notes and that Staff will create a preliminary report. Thanks, Kind regards Alice AGENDA 1. Preliminary report: 3 August for approval 2. Request for Proposals: Verify references of bidder 3. Assignments: Update on progress made to date 4. Marina del Rey Meeting: Structure of the meeting, agenda, preparations in anticipation of the meeting 5. Recommendations: Tease out recommendations from public comments, Singapore material etc 6. Dakar: schedule, desiderata 7. A.O.B PARTICIPANTS: Sarmad, Olof, Emily, Wilfried, James, Lynn, Kim, Michael, Omar, Kathy, Bill, Susan, Denise, Sharon APOLOGIES : Peter, Sharon NOTES 1) Agenda & Prel report adopted 2) RfP LG - Staff contacted references (please refer to email circulated to individual addresses). Enquiries about timeline and contract provisions. (ON) ICANN will try to expedite this as soon as decision made. (DN) is coordinating with legal department. (KK) consumer trust material - how much can put out to community now in MdR draft. (LG) need to make sure that reach out belong the ICANN community. Concerns about timelime. should set a deadline. Decision: contract by Tues 23 Aug - report delivered before MdR meeting if possible. Draft of consumer trust chapter to be circulated soon. (KVA) volunteers to help (LG) with consumer trust task 3) Chapters (ET) encouraged Members to dive into a detailed analysis of chapters (MY) consensus?- change wording - substantial wording Comments should be submitted by 31 August 4) MdR meeting Proposals on how should allocate time during MdR meeting - (KK) draft final report by time leave MdR - (KK) - (ET) - (AJ) to coordinate (dinner etc). All the sections should be ready by the MdR meeting 5) Dakar Leave the schedule as it is and refine in due date - constituency as a whole. 6) A.O.B - (ET) to update SoI - law firm - will provide full details. (SL) thanks Members for providing comments on definitions.

1 0

ICANN Procedure For Handling WHOIS Conflicts with Privacy Law
by Denise Michel Aug. 17, 2011

Aug. 17, 2011

Dear Team members: Only one registry thus far has used the current procedure, which is detailed at <http://www.icann.org/en/processes/icann-procedure-17jan08.htm>: Telnic. Board approval of Telnic's request can be found at: http://www.icann.org/en/minutes/prelim-report-18dec07.htm Additional information on Telnic's proposal can be found at: http://www.icann.org/en/registries/rsep/ As an aside -- Whois changes due to conflict with privacy laws were made by .NAME prior to the creation of the ICANN procedure. Additionally, there has been informal discussion about another registry preparing a request, and we'll let you know if/when this is filed. Regards. Denise Denise Michel ICANN Advisor to the President & CEO denise.michel(a)icann.org +1.408.429.3072 mobile +1.310.578.8632 direct

1 0

Applicable laws
by lynn＠goodsecurityconsulting.com Aug. 17, 2011

Aug. 17, 2011

3 2

FW: Applicable laws [SEC=UNOFFICIAL]
by Nettlefold, Peter Aug. 17, 2011

Aug. 17, 2011

Hi all, Thanks to Lynn and Kathy for continuing our discussions on these important issues. These were key issues I struggled with in drafting the accessibility/privacy part of the gaps chapter, which I circulated yesterday for comment. After reading the public submissions to our discussion paper, it seems clear that some people are worried about the privacy implications of WHOIS. It was raised by many respondents to our paper, and acknowledged as a valid concern by many others. However, I don't see a compelling case for us to catalogue all potential applicable privacy or data protection laws as a way to take this forward. In practice, I think this would be very difficult, and arguably of limited use. Even if every GAC member provided details of every potentially applicable law, this would not cover every country, and would only cover contributing countries at a set point in time. Further, what would we do with this data? How would we reconcile the inevitable differences? Arguably, any conflict with national law (whether it relates to 'sensitive' information, or other personal information) is intended to be addressed by ICANN's consensus procedure. The consensus procedure was developed by the ICANN community to deal with specific conflicts with national law. Whether and how it has been used may therefore provide us some guidance about any actual conflicts and how they've been handled. I see that Denise has undertaken to get back to us shortly with an answer to this - thanks Denise! The answer to this may provide useful insights into whether that particular procedure is effective or needs modification to deal with specific legal situations, and it could also clarify the potential extent of existing legal conflicts. For the procedure to be effective, there is no need to catalogue applicable laws in advance. Personally, I can't see any way to replace this (or a similar) case-by-case procedure with a more prescriptive universal mechanism based on a survey of applicable laws, nor any way to anticipate all potential legal conflicts in advance. There is then the additional question of whether we're only interested in situations where there is a conflict with a national law? If so, then we need to consider whether there needs to be any additional protections beyond the existing procedure. On balance, my position is that we should consider some way to acknowledge the privacy concerns of individuals, including those that may not be addressed by ICANN's existing consensus procedures and policies. The problem is how to do this without facilitating the unregulated and widely abused privacy/proxy situation that we now have. This is what I tried to address in the draft gaps chapter. The proposed recommendations at the end of that chapter are intended to provide a framework for a balanced, open and accountable privacy regime, while acknowledging that much of the detail (such as what data could be 'protected' or 'limited', and standardised processes for release of that data when needed) would rightly be developed through existing ICANN community (and cross community) processes. I look forward to further discussion on this as we move forward. Cheers, Peter From: rt4-whois-bounces(a)icann.org [mailto:rt4-whois-bounces@icann.org] On Behalf Of Kathy Kleiman Sent: Wednesday, 17 August 2011 2:30 PM To: rt4-whois(a)icann.org; lynn(a)goodsecurityconsulting.com Subject: Re: [Rt4-whois] Applicable laws Dear Lynn and All, I wanted to say how much I appreciate Lynn posting the key regional data protection frameworks to the group. I think they are very important, and she and I have discussed the need for us to look at them more closely in relation to the Whois data. I hope we can do this soon! Regarding sensitive vs private data, I wanted to add my views as an attorney who specializes in the area of data protection and privacy since starting my telecommunications practice in 1993. While sensitive data may focus on the areas of financial, birth, religion, health, and let's add political affiliation and sexual orientation, that's not where the story ends. Data protection and privacy laws certainly consider home address, home phone number, and now cell phone data as "private" or "personal data." Certainly telecommunications laws in the US, as one example, regularly protect the right of a person to "opt-out" of sharing their home address or home phone number in a public directory as a matter of personal privacy. In fact, opt-out in directories was chosen by a majority of Californians when last I researched it (and the state protects privacy as part of its state constitution) because home addresses and home phone numbers are considered very personal information, and worthy of protection. These are the very elements that have been such an issue of controversy within the ICANN arena. Over the last decade, as part of the history of Whois within ICANN, at least four Data Protection Commissioners and their senior staffs have warned ICANN about the problems of this data, and its data protection implications. They are very concerned with the elements now collected and published in the Whois. I will gather their letters to ICANN and share them, as well as notes of the speeches they have given. I would like to request that we ask ICANN Staff to work with us on this important matter as well. Ultimately, I do not think this is a matter for us to decide on (which may relieve everyone greatly). As many of you know, I have been thinking about this issue a great deal. I will be submitting a recommendation to our Team asking that GAC provide ICANN with clear information about relevant applicable laws, including data protection laws, and their guidance, based on these laws, as to the elements of the Whois now published. I'll distribute this before our meeting tomorrow. All the best, Kathy Since data privacy is an area of specialization for me, I would like to offer a couple of comments on the dialogue about privacy laws. Although WHOIS data contains personal data, it does not have any data elements that are considered to be "sensitive" in nature. The focus and priority of data protection authorities throughout the world is on protection of sensitive data such as financial account details, date of birth, religious affiliations, medical conditions, etc. For global, multi-national organizations who need to develop and maintain policies regarding the collection and use of personal data, there are multi-lateral privacy frameworks and principles that have been accepted and are well established including: 1) OECD Guidelines on the Protection of Privacy and Transborder Flows 2) UN Guidelines Concerning Computerized Personal Data Files 3) EU Directive 95/46/EC on the Protection of Individuals with Regard to the Processing of Personsal Data and on the Free Movement of Such Data 4) APEC Privacy Framework Since ICANN is headquartered in the State of California and the United States, I would note that California has an Office of Privacy Protection. At the national level, the U.S. Federal Trade Commission has been accepted as the equivalent of a Data Protection Authority. Hope these brief comments are helpful. Lynn _______________________________________________ Rt4-whois mailing list Rt4-whois(a)icann.org<mailto:Rt4-whois@icann.org> https://mm.icann.org/mailman/listinfo/rt4-whois -- ------------------------------------------------------------------------------- The information transmitted is for the use of the intended recipient only and may contain confidential and/or legally privileged material. Any review, re-transmission, disclosure, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited and may result in severe penalties. If you have received this e-mail in error please notify the Security Advisor of the Department of Broadband, Communications and the Digital Economy, 38 Sydney Ave, Forrest ACT 2603, telephone (02) 6271-1376 and delete all copies of this transmission together with any attachments. Please consider the environment before printing this email. -------------------------------------------------------------------------------

4 4