June 2015 - Whois-iag-volunteers

[New post] Spamming owners of newly registered domain names
by Christopher Wilkinson June 29, 2015

June 29, 2015

> > FYI. > > << … people mine whois databases to sell stuff. It’s incredibly cheap and easy to do these days: compare the zone files, get the new registrations, and then run whois lookups. > There are even people selling the entire .com whois database … >> > > Although the technical details as to 'how it is done' escape me, it would appear that this report is relevant to the question of Whois privacy. > > Regards > > CW > > > > Begin forwarded message: > >> From: Domain Name Wire | Domain Name News & Views <donotreply(a)wordpress.com> >> Subject: [New post] Spamming owners of newly registered domain names >> Date: 29 Jun 2015 20:50:33 GMT+02:00 >> To: mail(a)christopherwilkinson.eu >> >> New post on Domain Name Wire | Domain Name News & Views >> >> >> Spamming owners of newly registered domain names >> by Andrew Allemann >> Just one example of spam based on whois records. >> >> We all know that people mine whois databases to sell stuff. It's incredibly cheap and easy to do these days: compare the zone files, get the new registrations, and then run whois lookups. There are even people selling the entire .com whois database for a few hundred bucks. >> >> This makes it easy for people to spam new domain name registrants and sell them services they don't need, like search engine submission. >> >> Last week I registered a handful of .com domain names at Uniregistry. Shortly thereafter I received this email: Click here to continue reading... >> >> Andrew Allemann | June 29, 2015 at 1:45 pm | Tags: spam, whois | Categories: Policy & Law | URL: http://domainnamewire.com/?p=46535 >> Comment See all comments >> >> Unsubscribe to no longer receive posts from Domain Name Wire | Domain Name News & Views. >> Change your email settings at Manage Subscriptions. >> >> Trouble clicking? Copy and paste this URL into your browser: >> http://dnw.com/jnj8 >> >> >

1 0

Scheduling IAG-WHOIS Conflicts call, July 13th
by Maria Otanes June 25, 2015

June 25, 2015

Hello all, The next IAG-WHOIS Conflicts call will be held on Monday, July 13th instead of the first Wednesday of the month. Please complete the Doodle Poll below with your time preference and submit by July 2nd. Once the poll is closed, I will send a calendar invite. The available times are: 12:30 UTC 18:00 UTC 21:00 UTC http://doodle.com/ynyhitqsfnhwzn86 If you have any questions, please let me know. Best, Maria

1 0

Article 29 Response to the updated EU Data Protection Regulations
by Carlton Samuels June 19, 2015

June 19, 2015

The Commissioners sent a letter to the three parties contemplating the updated data protection regulations. Among other matters, there's this: "...... *The definition of personal data should therefore take into account the situation in which people can be “singled out” on the basis of identifiers or other information and could subsequently be treated differently. This definition should also take into account the recent CJEU rulings considering why and to what extent IP addresses and other online identifiers are as a general rule to be considered personal data." * The Letter can be found here <http://ec.europa.eu/justice/data-protection/article-29/documentation/other-…> as well as an attachment to this message. In an Appendix <http://ec.europa.eu/justice/data-protection/article-29/documentation/other-…> to the letter, they outlined and pronounced on what they see as the core issues; they endorsed the validity of Binding Corporate Rules as mechanisms to manage cross border transfer of personal data, declined to support risk factors as a measure to mitigate data controller's accountability, endorsed MLATs as the gold standard for access to personal data by public authorities as well as new powers for EDPBs to exact penalties. When all is said and done, countries are busy carving out bits and pieces that run counter to the ideals, all in furtherance of the 'national security interests' as they see them. -Carlton ============================== Carlton A Samuels Mobile: 876-818-1799 *Strategy, Planning, Governance, Assessment & Turnaround* =============================

1 0

Subject: EU Council reaches general approach on the new data protection rules
by Christopher Wilkinson June 17, 2015

June 17, 2015

> > Good morning: > > For your information, please find below the reports on the results of the EU Council's deliberations regarding the proposed data protection Regulation, communicated by the ISOC European Bureau. > > Regards > > CW > > > > >> >> >> · European Commission RAPID - Stronger data protection rules for Europe >> · Latvian Presidency of the Council of the EU - Data protection: Council agrees on a general approach >> · European Parliament Press - Data protection: Parliament’s negotiators welcome Council negotiating brief >> · Greens/EFA Group - Ministers' agreement paves way for negotiations with EP >> · BEUC - EU Justice Ministers decide on consumers’ privacy laws >> · DIGITALEUROPE - EU Data Protection Reform: DIGITALEUROPE welcomes Council General Approach >> >> >> European Commission RAPID - Stronger data protection rules for Europe >> >> Date published: June 15 2015 >> >> >> Stronger data protection rules for Europe >> >> More than 90% of Europeans are concerned about mobile apps collecting their data without their consent. Today, an important step was taken to finalise EU data protection rules to help restore that confidence. >> >> Ministers in the Council reached a General Approach on the new data protection rules, confirming the approach taken in the Commission's proposal back in 2012 (see IP/12/46). The proposed rules received the backing of the European Parliament in March 2014 (MEMO/14/186). >> >> How do EU data protection rules contribute to boosting the Digital Single Market? >> >> Completing the Digital Single Market is one of the top priorities of the European Commission. The internet and digital technologies are transforming our world. But existing barriers online mean citizens miss out on goods and services, internet companies and start-ups have their horizons limited, and businesses and governments cannot fully benefit from digital tools. >> With a fully functioning Digital Single Market, we can create up to €415 billion in additional growth, hundreds of thousands of new jobs, and a vibrant knowledge-based society (see IP/15/4919). >> >> But if citizens do not trust online services, they will not benefit from all the opportunities presented by technology. Confidence is paramount, but it is still far from a reality. >> >> Data protection reform will address this lack of trust. It will strengthen citizen’s rights such as the right to be forgotten, the right to data portability and the right to be informed of personal data breaches. The reform gives national regulators enforcement powers to ensure that these new rules are properly applied. They will be able to impose fines of up to 2% of a company’s annual worldwide turnover. >> >> What are the main benefits of the EU Data Protection Reform? >> >> The European Commission's proposals for a comprehensive reform of the EU's 1995 Data Protection Directive aim to strengthen privacy rights and boost Europe's digital economy. The Commission’s proposals update and modernise the principles enshrined in the 1995 Directive, bringing them into the digital age and building on the high level of data protection which has been in place in Europe since 1995. A clear definition of personal data will be established in the regulation to ensure harmonised implementation of the rules across the EU. The legislation is technologically neutral: this means that it will not go out of date, enabling innovation to continue to thrive under the new rules. >> >> What are the main benefits for citizens? >> >> The data protection reform will strengthen citizens' rights and thereby help restore trust. Nine out of ten Europeans say they are concerned about mobile apps collecting their data without their consent; seven out of ten are concerned about the potential use that companies may make of the information disclosed. >> >> The new rules will put citizens back in control of their data, notably through: >> A right to be forgotten: When you no longer want your data to be processed, and provided that there are no legitimate grounds for retaining it, the data will be deleted. This is about empowering individuals, not about erasing past events or restricting freedom of the press (see section on right to be forgotten for more details). >> Easier access to your own data: Individuals will have more information on how their data is processed and this information should be available in a clear and understandable way. Moreover, a right to data portability will make it easier for you to transfer your personal data between service providers. >> The right to know when your data has been hacked: For example, companies and organisations must notify the national supervisory authority of serious data breaches as soon as possible (if feasible within 24 hours) so that users can take appropriate measures. >> >> Data protection first, not an afterthought: ‘Data protection by design’ and ‘Data protection by default’ will also become essential principles in EU data protection rules – this means that data protection safeguards should be built into products and services from the earliest stage of development, and that privacy-friendly default settings should be the norm – for example on social networks or mobile apps. >> >> What are the benefits for businesses? >> >> Data is the currency of today's digital economy. Collected, analysed and moved across the globe, personal data has acquired enormous economic significance. According to some estimates, the value of European citizens' personal data has the potential to grow to nearly €1 trillion annually by 2020. Strengthening Europe’s high standards of data protection is a business opportunity. >> >> The European Commission's data protection reform will help the digital single market realise this potential, notably through four main innovations: >> One continent, one law: The Regulation will establish a single, pan-European law for data protection, replacing the current inconsistent patchwork of national laws. Companies will deal with one law, not 28. The benefits are estimated at €2.3 billion per year. >> One-stop-shop: The Regulation will establish a 'one-stop-shop' for businesses: companies will only have to deal with one single supervisory authority, not 28, making it simpler and cheaper for companies to do business in the EU; and easier, swifter and more efficient for citizens to get their personal data protected. >> The same rules for all companies – regardless of where they are established: Today European companies have to adhere to stricter standards than companies established outside the EU but also doing business on our Single Market. With the reform, companies based outside of Europe will have to apply the same rules. We are creating a level-playing field. Moreover rules for international transfers of data are streamlined, through simplified approval of binding corporate rules. This will foster international trade while ensuring continuity of protection for personal data. >> European regulators will be equipped with strong enforcement powers: data protection authorities will be able to fine companies who do not comply with EU rules up to 2% of their global annual turnover. The European Parliament has even proposed to raise the possible sanctions to 5%. >> >> What are the benefits for SMEs? >> >> The data protection reform is geared towards stimulating economic growth by cutting costs and red tape for European business, especially for small and medium enterprises (SMEs). First, by having one rule instead of 28, the EU's data protection reform will help SMEs break into new markets. Second, the Commission has proposed to exempt SMEs from several provisions of the Data Protection Regulation – whereas today's 1995 Data Protection Directive applies to all European companies, regardless of their size. Under the new rules, SMEs will benefit from four reductions in red tape: >> Data Protection Officers: SMEs are exempt from the obligation to appoint a data protection officer insofar as data processing is not their core business activity. >> No more notifications: Notifications to supervisory authorities are a formality and red tape that represents a cost for business of €130 million every year. The reform will scrap these entirely. >> Every penny counts: Where requests to access data are manifestly unfounded or excessive, SMEs will be able to charge a fee for providing access. >> Impact Assessments: SMEs will have no obligation to carry out an impact assessment unless there is a specific risk. >> >> The rules will also be flexible. The EU rules will adequately and correctly take into account risk. In a number of cases, the obligations of data controllers and processors are calibrated to the size of the business and to the nature of the data being processed. >> >> What is the "consistency mechanism" proposed in the EU data protection reform? >> >> Within a single market for data, identical rules on paper will not be enough. We have to ensure that the rules are interpreted and applied in the same way everywhere. That is why our reform introduces a consistency mechanism to streamline cooperation between the data protection authorities on issues with implications for all of Europe. >> >> What is the one-stop shop and how does it work? >> >> At present, a company processing data in the EU has to deal with 28 national laws and with even more national and local regulators. >> >> For businesses >> >> The regulation will create a regulatory “one-stop shop” for business: companies will only have to deal with one supervisory authority, not 28. >> >> The flaws of the present system were illustrated in the Google Street View case. The actions of a single company affected individuals in several Member States in the same way. Yet they prompted uncoordinated and divergent responses from national data protection authorities. >> >> The one-stop shop will ensure legal certainty for businesses operating throughout the EU and bring benefits for individuals and data protection authorities. >> >> Businesses will profit from faster decisions, from one single interlocutor (eliminating multiple contact points), and from less red tape. They will benefit from consistency of decisions where the same processing activity takes place in several Member States. >> >> For citizens >> >> With the new rules, individuals will always be able to go to their local data protection authority. The aim is to improve the current system in which individuals living in one Member State have to lodge a complaint with a data protection authority of another Member State, where the company is based. At the moment, when a business is established in one Member State, only the Data Protection Authority of that Member State is competent, even if the business is processing data across Europe. >> >> This makes it simpler for citizens – who will only have to deal with the data protection authority in their member state, in their own language. The proposal gives citizens the right to take a company processing their data to court in their home Member State. Everyone therefore have a right of administrative and judicial redress. >> >> How will the regulation work in practice? >> >> Example 1: a multinational company with several establishments in EU Member States has an online navigation and mapping system across Europe. This system collects images of all private and public buildings, and may also take pictures of individuals. >> >> With the current rules: >> The data protection safeguards upon data controllers vary substantially from one Member State to another. In one Member State, the deployment of this service led to a major public and political outcry, and some aspects of it were considered to be unlawful. The company then offered additional guarantees and safeguards to the individuals residing in that Member State after negotiation with the competent DPA, however the company refused to commit to offer the same additional guarantees to individuals in other Member States. >> Currently, data controllers operating across borders need to spend time and money (for legal advice, and to prepare the required forms or documents) to comply with different, and sometimes contradictory, obligations. >> >> With the new rules: >> The new rules will establish a single, pan-European law for data protection, replacing the current inconsistent patchwork of national laws. Any company - regardless of whether it is established in the EU or not - will have to apply EU data protection law should they wish to offer their services in the EU. >> >> Example 2: a small advertising company wants to expand its activities from France to Germany. >> >> With the current rules: >> Its data processing activities will be subject to a separate set of rules in Germany and the company will have to deal with a new regulator. The costs of obtaining legal advice and adjusting business models in order to enter this new market may be prohibitive. For example, some Member States charge notification fees for processing data. >> >> With the new rules: >> The new data protection rules will scrap all notification obligations and the costs associated with these. The aim of the data protection regulation is to remove obstacles to cross-border trade. >> >> How does the Council confirm the Commission's approach? >> >> The Council agrees upon many of the fundamental pillars of the Commission's proposal: >> >> One continent, one law >> >> The Council agrees that the new data protection law for the private and public sector should be a Regulation, and no longer a Directive. The Regulation will establish a single, pan-European law for data protection meaning that companies can simply deal with one law, not 28. The new rules will bring benefits of an estimated €2.3 billion per year. >> >> Non-European companies will have to respect European data protection law if they operate on the European market >> >> For a strong European digital industry to compete globally we need a level-playing field. Non-European companies, when offering services to European consumers, will have to apply the same rules and adhere to the same levels of protection of personal data. The reasoning is simple: if companies outside Europe want to take advantage of the European market and its more than 500 million potential customers, then they have to play by the European rules. >> >> The Council confirmed this important principle. >> >> Stronger rights for citizens, including the right to be forgotten >> >> The new rules will give citizens stronger rights, ensuring that citizens can be in control of their own personal data. The right to be forgotten builds on already existing rules to better cope with data protection risks online – in particular, the right to erasure. Citizens should be in a position to protect the privacy of their data by choosing whether or not to provide it. It is therefore important to empower EU individuals, particularly teenagers, to be in control of their own identity online. If an individual no longer wants his or her personal data to be processed or stored by a data controller, and if there is no legitimate reason for keeping it, the data should be removed from their system. >> >> The right to be forgotten is of course not an absolute right. There are cases where there is a legitimate reason to keep data in a database. The archives of a newspaper are a good example. It is clear that the right to be forgotten cannot amount to a right to re-write or erase history. Neither must the right to be forgotten take precedence over freedom of expression or freedom of the media. The legislation concerning the right to be forgotten includes an explicit provision that ensures it does not encroach on the freedom of expression and information. >> >> The Council endorses the right to be forgotten. >> >> A "One-stop shop" for businesses and citizens >> >> The "one-stop shop" is about simplification: >> - it makes it simpler for businesses established and operating in several Member States. They will only have to deal with a single national data protection authority, in the country where they have their main base: one interlocutor, not 28. >> - it also makes it simpler for citizens who will only have to deal with the data protection authority in their member state, in their own language. >> >> Effective sanctions >> >> The Council agrees that national data protection authorities need to be able to impose effective sanctions in case of breach of the law. It has maintained the Commission's proposal that fines going up to €1 million, or, in case of a company, 2% of the annual worldwide turnover of that company can be applied. >> >> For more information: >> IP/15/5176 >> >> >> Source: http://europa.eu/rapid/press-release_MEMO-15-5170_en.htm >> >> >> Latvian Presidency of the Council of the EU - Data protection: Council agrees on a general approach >> On 15 June 2015, the Council reached a general approach on the general data protection regulation that establishes rules adapted to the digital era. The twin aims of this regulation are to enhance the level of personal data protection for individuals and to increase business opportunities in the Digital Single Market. >> Latvia's minister for justice Dzintars Rasnačs said: "Today we have moved a great step closer to modernised and harmonised data protection framework for the European Union. I am very content that after more than 3 years of negotiations we have finally found a compromise on the text. The new data protection regulation, adapted to the needs of the digital age, will strengthen individual rights of our citizens and ensure a high standard of protection." >> A general approach means that the Council has a political agreement on the basis of which it can now begin negotiations with the European Parliament with a view to reaching overall agreement on new EU data protection rules. A first trilogue with the Parliament is planned for 24 June 2015. >> "I salute the readiness of the European Parliament to start the trilogue negotiations already next week. Hopefully we will come to the final agreement rapidly so that our citizens can enjoy the benefits of the reform as soon as possible", said Latvia's minister for justice Dzintars Rasnačs. >> The incoming Luxembourg Presidency indicated that, in parallel to the negotiations on the regulation, works on the data protection directive in the law enforcement area would be accelerated with the aim to find a general approach in October. >> Main elements of the agreement >> An enhanced level of data protection >> Personal data must be collected and processed lawfully under strict conditions and for a legitimate purpose. Data controllers (those responsible for the processing of data) must respect specific rules, such as the requirement for unambiguous consent by the data subject (the individual whose personal data is being processed), in order to be allowed to process personal data. >> Strengthened data protection rights give data subjects more control over their personal data: >> easier access to their data. >> more detailed information about what happens to their personal data once they decide to share it: data controllers must be more transparent about how personal data is handled, for example by informing individuals about their privacy policy in clear and plain language. >> a right to erasure of personal data and "to be forgotten", enabling anyone for example to require that a service provider remove, without delay, personal data collected when that individual was a child. >> a right to portability enabling easier transmission of personal data from one service provider, for instance a social network, to another. This will also increase competition among service providers. >> >> limits to the use of 'profiling', i.e. automated processing of personal data to assess personal aspects, such as performance at work, economic situation, health, personal preferences etc. >> To ensure improved legal redress, data subjects will be able to have any decision of their data protection authority reviewed by their national court, irrespective of the member state in which the data controller is established. >> Increased business opportunities in the Digital Single Market >> A single set of rules, valid across the EU and applicable both to European and non European companies offering their on-line services in the EU will prevent conflicting national data protection rules from disrupting cross-border exchanges of data. Moreover, increased cooperation between the supervisory authorities in the member states will ensure coherent application of those rules throughout the EU. This will create fair competition and encourage companies, especially small and medium-sized enterprises, to get the most out of the Digital Single Market. >> To reduce costs and provide legal certainty, in important transnational cases where several national supervisory authorities are involved, a single supervisory decision will be taken. This one-stop-shop mechanism will allow a company with subsidiaries in several member states to limit its contacts to the data protection authority in the member state where it is established. >> In order to reduce compliance costs, data controllers can, on the basis of an assessment of the risk involved in their processing of personal data, define risk levels and put in place measures in line with those levels. >> More and better tools to enforce compliance with the data protection rules >> Increasing responsibility and accountability of data controllers will improve compliance with the new data protection rules. Data controllers must implement appropriate security measures and provide, without undue delay, notification of personal data breaches to the supervisory authority as well as to those significantly affected by the breach. Controllers and processors may designate data protection officers in their organisation. Moreover, Union or national law can require them to do so. >> Data subjects, as well as, under certain conditions, data protection organisations can lodge a complaint with a supervisory authority or seek judicial remedy in cases where data protection rules are not respected. Furthermore, when such cases are confirmed, data controllers face fines of up to €1 million or 2% of their global annual turnover. >> Guarantees regarding transfers of personal data outside the EU >> The protection of transfers of personal data to third countries and international organisations is ensured through adequacy decisions. The Commission, with the involvement of member states and the European Parliament, is competent to decide whether the level of data protection offered by a third country or an international organization is adequate. In cases where no such decision has been taken, the transfer of personal data may only take place if the appropriate safeguards (standard data protection clauses, binding corporate rules, contractual clauses) are in place. >> Source: https://eu2015.lv/news/media-releases/2225-data-protection-council-agrees-o… >> >> >> European Parliament Press - Data protection: Parliament’s negotiators welcome Council negotiating brief >> >> Parliament looks forward to starting talks with ministers soon on reform to give the EU high common standards of data protection fit for the digital era, said its key negotiators on Monday, welcoming the Council's announcement that it had approved its negotiating mandate. The first meeting between the institutions is scheduled for 24 June and will be followed by a joint press conference. >> >> The European Parliament adopted its negotiating position in March 2014 and has since been waiting for Council to agree on its own mandate to open talks on the final text. >> >> Reacting to the news of the ministers’ agreement, Parliament's lead MEP on the data protection regulation, Jan Philipp Albrecht (Greens, DE) said: >> >> "After over a year of stalling, it is encouraging that we can finally push ahead with the EU data protection reform and that Parliament can begin negotiations with the Council. >> The challenge is now to reconcile the two sides, to ensure that the reform provides reliable and high common standards of data protection, and reach an agreement on this before the end of the year. >> There are clearly differences, notably on consumer rights and the duties of businesses. However, if we can negotiate constructively and pragmatically, it should be possible to deliver a compromise acceptable to both sides within the timeframe. This outcome would benefit everyone and show that the EU takes the concerns of its citizens in the digital age seriously." >> >> Civil Liberties Committee Chair Claude Moraes (S&D, UK), who will be chairing the talks with Council and Commission, added: >> >> "It has now been over one year since the Parliament has adopted its mandate for the negotiations on the Data Protection Regulation proving its commitment to improving the standards of data protection. Since then, we have continually called for the Council to adopt its own position ("General Approach") so that negotiations can begin to improve current legislation both for EU citizens and business. As it stands, EU legislation on data protection dates back to 1995, a time where internet access, smart phones or social media were not a part of daily life as they are today. >> Despite the difficult negotiations involved, the Parliament, led by the Rapporteur Jan Albrecht, will work towards finding a swift agreement on the Data Protection Regulation by the end of 2015 which will set out a robust, modern, consistent and higher level of protection for the years to come. As Chair of the Civil Liberties, Justice and Home Affairs Committee I would also urge the Council to ensure that they find agreement on the Data Protection Directive for law enforcement by October 2015 as the Parliament’s position has always been clear that we treat both proposals as a package" >> Read more about Parliament's priorities and negotiation mandate in this Q&A. >> Next steps >> The first three-way talks between Parliament, Council and Commission are to be held in the European Parliament on 24 June.. After the meeting, there will be a joint press conference by the three institutions at 14.00 (tbc). >> >> Background for editors >> >> The data protection regulation is part of a package which also includes a directive. The two legislative proposals were presented by the European Commission in January 2012. >> >> Parliament’s negotiating brief was approved by its Civil Liberties Committee in October 2013, and endorsed by Parliament as a whole in March 2014. >> >> Since then, Parliament has been waiting for member states to agree "general approach" among themselves in order to begin the final talks. >> >> MEPs have many times called on the Council to move forward on the package, stressing the need to update EU data protection rules without further delay, so as to give citizens the standards of data protection needed in the digital era. >> >> MEPs have also stressed the need to set a uniform standard of data protection in all EU legislation, but especially the European Police Office (EUROPOL) regulation, currently under negotiation, and an EU Passenger Name Record scheme. >> >> Member states also need to agree a general approach on the directive. >> >> >> Greens/EFA Group - Ministers' agreement paves way for negotiations with EP >> >> EU justice and home affairs ministers today adopted a common position on the draft EU legislation on data protection at their Council meeting. Following the decision, it was decided that legislative negotiations with the European Parliament will begin on 24 June (1). Commenting on the situation, Green MEP Jan Philipp Albrecht, the European Parliament's draftsman/rapporteur on the data protection regulation, said: >> >> "After over a year of stalling, it is encouraging that we can finally push ahead with the EU data protection reform and that the parliament can begin negotiations with the Council. The challenge is now to reconcile the two different sides to ensure the reform provides reliable and high common standards of data protection, and reach an agreement on this before the end of the year. There are clearly differences, notably as regards the rights afforded to consumers and duties to be fulfilled by businesses. However, if we can engage in constructive and pragmatic negotiations, it should be possible to reach a compromise acceptable to both sides in that timeframe. This would be a result for all sides and show that the EU is taking the concerns of its citizens in the digital age seriously." >> >> (1) The negotiations between the European Parliament, Council and Commission (trilogue) will begin on 24 June with a first meeting at 12.30 (for around 1 ½ hours). Directly afterwards, there will be a press conference with EP draftsperson Jan Philipp Albrecht, EU commissioner Vera Jourova and the current and coming EU presidencies on the roadmap for the negotiations. A separate invitation will be sent for this. >> >> Source: http://www.greens-efa.eu/eu-data-protection-rules-14167.html >> >> >> BEUC - EU Justice Ministers decide on consumers’ privacy laws >> >> >> Questions of how consumers’ personal data is gathered, used, monetised, if and how it is protected have become crucial in ‘big data’ driven economies. >> >> The EU is currently overhauling its 1995 legal framework with a General Data Protection Regulation which will apply to all companies (including online) targeting users in Europe. The Council of Justice Ministers agreed its general approach to this Regulation, Monday June 15. >> >> Key measures at stake include: >> >> · Closing loopholes – Businesses’ “legitimate grounds” for retaining information must not become the legal means to bypass fundamental data protection principles such as “purpose limitation” and “data minimisation” when processing consumers’ information. >> · Profiling – MEPs and consumers’ called for a right not to be subject to profiling i.e. when personal data is gathered, processed and cross-referenced to create a detailed image of an individual. Profiling of children must be expressly prohibited. >> · Ensuring access to redress – With large scale data protection law breaches, it must be made possible for victims to collectively claim redress and act on their rights. BEUC and the European Parliament agree this is a key remedy. >> · Scope of protection – The legal meaning of “personal data” must not be narrowed. It must include any information allowing identification of a subject e.g. location data or IP address. >> >> Monique Goyens, Director General of The European Consumer Organisation said: >> >> “The EU is, and should continue to be, a world leader of privacy and data protection standards. But the need to modernise is urgent. EU laws are now lagging behind the pace of technologies and business practices. Our personal data is collected, then used and transferred in ways which most consumers are oblivious to. An appropriate update must put control of personal data back in the hands of European consumers. >> >> “This new regulation is the opportunity to close gaps, ensure robust standards and stipulate that EU laws apply to all businesses operating here. It’s a source of concern that in some important instances the Council has deviated from the original aims of the reform and the principles which should be guiding it. We must ensure business opportunities presented by ‘big data’ do not result in an erosion of consumer rights. Getting it right is vital for Europe’s Digital Single Market. >> >> “70% of Europeans are concerned companies use their personal data for other purposes than for which it was collected, while 67% believe there is no alternative to disclosing personal information if they want to obtain products or services. >> >> Companies must stop seeing consumers as commodities, but instead as citizens with legal rights whose trust needs earning. In Europe, the concept of privacy is not a trend nor should companies view it as an inconvenience better off ignored. It is a longstanding fundamental right, one which must be made fully applicable to the digital world.” >> >> >> >> DIGITALEUROPE - EU Data Protection Reform: DIGITALEUROPE welcomes Council General Approach >> >> DIGITALEUROPE welcomes today’s adoption of a General Approach on the General Data Protection Regulation by Justice and Home Affairs Ministers during their meeting in Luxembourg. >> The text adopted by Ministers ends a protracted debate among Member States and opens the door for the start of the final trilogue negotiations with the European Parliament and European Commission. >> >> “We applaud the hard work of the Latvian Presidency and urge the incoming Luxembourg Presidency to continue the momentum as we move into a new challenging phase of negotiations with the Parliament,” said John Higgins, Director General of DIGITALEUROPE. >> >> Many important issues must be addressed during the upcoming trilogue discussions. DIGITALEUROPE continues to emphasise the need for the adoption of a coherent and consistent text that will create a set of single, harmonised and modern data protection rules for Europe’s data economy. >> >> Questions still remain on numerous topics including the implementation of a functioning one-stop-shop, the clear allocation of roles and responsibilities between data controllers and data processors, the introduction of a true ‘risk-based approach’, and a balanced view on profiling. >> >> “DIGITALEUROPE encourages all institutions to work together to adopt a regulation that is future proof, flexible and harmonised across the 28 member states of the EU,” he added. >> >> Europe needs a data protection regulation that allows it to embrace the data-driven innovations that are helping transform the economy, while at the same time granting enough protection to personal data to ensure that citizens trust the technologies. >> >> The trilogues will be of immense importance as this file can either act as an obstacle to the digital economy, if it fails to create legal certainty, or a catalyst for Europe’s data economy, if it does provide that legal certainty. >> >> “As we move closer to the trilogue discussion the regulation could go either way,” Mr Higgins said. >> >> Source: http://www.digitaleurope.org/DesktopModules/Bring2mind/DMX/Download.aspx?Co… >> >> >> >> >> >> >

1 0

FW: Dual Trigger Proposal Google Doc
by Maria Otanes June 15, 2015

June 15, 2015

From: Christopher Wilkinson <cw(a)christopherwilkinson.eu> Date: Tuesday, May 26, 2015 11:05 AM To: Maria Otanes <maria.otanes(a)icann.org> Cc: "jeffrey(a)icann.org" <jeffrey(a)icann.org> Subject: Re: [IAG-WHOIS conflicts] Dual Trigger Proposal Google Doc Dear Maria: Thankyou, but I regret that I do not understand this approach. I have explained in some detail why I cannot in any way endorse - even tacitly - this document, as is, or as amended. May I suggest that ICANN staff present a one page summary of the absolutely essential and feasible aspects that you would wish to see recommended by the IAG-WHOIS. Best regards Christopher > Begin forwarded message: > >> From: Christopher Wilkinson <cw(a)christopherwilkinson.eu> >> Subject: Re: [IAG-WHOIS conflicts] Dual Trigger Proposal >> Date: 7 May 2015 20:19:14 GMT+02:00 >> To: "whois-iag-volunteers(a)icann.org" <whois-iag-volunteers(a)icann.org> >> >> Good evening: >> >> I have reviewed the 'Dual Trigger' procedure as proposed by James Gannon, for >> which many thanks. >> >> However as I have explained to the recent conference calls, I see no merit in >> spending time on tweaking the procedure for handling eventual WHOIS conflicts >> with privacy and data protection laws when the underlying ICANN policy is >> fundamentally flawed. >> >> I have proposed to greatly simplify and expedite the matter either by ICANN >> adapting WHOIS to international best practice whereby all Registries and >> Registrars would implement a high level of personal data protection and >> privacy, world wide. Or alternatively, to Reverse the Burden of Proof, >> whereby Registries and Registrars would, as their primary default, implement >> applicable privacy and data protection laws in their respective >> jurisdictions. It would then be up to ICANN to initiate a procedure to >> examine whether, in any particular case, there was a threat to the stability >> and security of the Internet. >> >> The present draft document of some six detailed pages is really not workable >> and contains some serious misconceptions. >> >> -How many Registries and Registrars, world-wide, would be potentially >> affected by this procedure? What would be the consequences in cost and staff >> time for ICANN should they all actually apply for exemption? >> (Into how many languages would the procedure have to be translated before it >> could be realistically implemented by all present and future affected >> Registries and Registrars?) >> >> -ICANN's 'contractual WHOIS obligations' (Section 2.1) are not sacrosanct, >> particularly when they are inconsistent with applicable law. >> >> -the reference to ' anticipated impact on the operational stability ' >> (Section 4.1) is rather tendentious. I am aware of no reason to anticipate >> that privacy and data protection law would have any such impact. On the >> contrary, there are a large number of Registries (principally ccTLDs) which >> do respect applicable law. Did ICANN ever question whether they had any >> negative impact on stability, security or interoperability etc. of the >> Internet? >> >> -The reference in Section 5.2 to "ICANN's forbearance from enforcement of >> full compliance " is likely to be perceived as rather offensive. ICANN is >> not in a position to force Registrars or Registries to choose between ICANN's >> contractual conditions and applicable law. On the contrary, ICANN's Articles >> of Incorporation were drafted to ensure that the opposite would be the case. >> >> More generally, there is an underlying issue of fair competition between >> accredited Registrars in the ICANN gTLD system. Should one accept the >> procedure as proposed, one would be effectively placing certain Registrars at >> a competitive disadvantage (a) to undertake an exorbitant procedure to obtain >> a waiver or exemption from ICANN's contractual conditions and/or (b) to risk >> infringement of applicable law vis-à-vis their Registrants and public >> authorities. >> >> Again, such outcome is contrary to the underlying objectives of ICANN which >> was created in the first place to ensure conditions of fair competition among >> Registrars, world-wide. >> >> In the light of the above, I would recommend that the working group proceed >> no further with the so called 'trigger mechanisms' and start again from a >> more realistic and legally compliant position. >> >> With best regards to you all >> >> Christopher Wilkinson On 26 May 2015, at 16:04, Maria Otanes <maria.otanes(a)icann.org> wrote: > Hello all, > > We have created a Google docs workspace for the Dual Trigger WHOIS proceeding > proposal. Everyone on this email distribution has access to the document and > has the ability to suggest edits or provide comments. If you have any > questions or run into any problems with the Google doc, please let us know. > Thanks. > > https://docs.google.com/document/d/1iNKGTue_yt93gWzRdg7WkGNjIADZzzCveudYMT-… > c/edit?usp=sharing > > Kind regards, > Maria Otanes > _______________________________________________ > Whois-iag-volunteers mailing list > Whois-iag-volunteers(a)icann.org > https://mm.icann.org/mailman/listinfo/whois-iag-volunteers

4 3

Re: [IAG-WHOIS conflicts] Dual Trigger Proposal
by Michele Neylon - Blacknight June 10, 2015

June 10, 2015

Volker I like that option If ICANN disagree with the opinion or have issues with it they can challenge it. They’ve done this to a greater or lesser degree with the data retention waivers. And as Allen Grogan noted on the call a couple of weeks ago, it works pretty well. It might also be useful to see how much support there are for the two proposals. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://www.blacknight.press - get our latest news & media coverage http://www.technology.ie Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Random Stuff: http://www.michele.irish ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845 From: Volker Greimann Date: Wednesday 10 June 2015 17:11 To: Michele Neylon, Jamie Hedlund, "\"whois-iag-volunteers(a)icann.org<mailto:whois-iag-volunteers@icann.org>\"@mail-01.key-systems.net" Subject: Re: [IAG-WHOIS conflicts] Dual Trigger Proposal Hi Bradley, to be frank, this is getting ridiculous. The opinion of the law firm is everything we have at our disposal and as the law is not written to specific cases, there alsways will be room for interpretation, so "may" may be everything we can get. Law is always subject to interpretation and what has been the accepted interpretation of the law may change overnight, for example if there is a ruling by a higher court. I therefore propose a turn-around: If a contracted party has provided a legal opinion as required by the agreement and ICANN for whatever reason does not want to recognize the findings of this opinion, ICANN may, at its own cost, try to obtain a different legal opinion that states unequivocally that the implementation of XYZ absolutely and under any circumstance does not violate applicable law, and further may indemnify the contracted party in full for any damages, loss, etc the contracted party may suffer as a result of implementing XYZ when it is found to be in violation of applicable law after all. I do not think this is unreasonable at all, after all, ICANN should only be trying to enforce contractual obligations that are not in violation of applicable law. If ICANN makes a mistake in its evaluation, it should bear the legal and financial responsibility towards its contracted parties for forcing to do something they told them was a violation of national law. Steve is entitled to an opinion, but he has no role to play in the contractual relationship between ICANN and its contracted parties. If he believes a legal opinion does not reflect the actual law, he may advise ICANN of this fact and encourage ICANN to obtain its own legal opinion. So essentially, I am asking ICANN to put its money where its mouth is. Best, Volker From: <whois-iag-volunteers-bounces(a)icann.org<mailto:whois-iag-volunteers-bounces@icann.org>> on behalf of "Silver, Bradley" Date: Friday 22 May 2015 17:02 To: James Gannon, "whois-iag-volunteers(a)icann.org<mailto:whois-iag-volunteers@icann.org>" Subject: Re: [IAG-WHOIS conflicts] Dual Trigger Proposal James, all: Thanks for your edits, and thanks to Steve for the proposal introduced on the last call. My apologies for not being able to join the last discussion, but I have been able to review the transcript, and the various viewpoints expressed about the proposals on the table. I’ve also reviewed James’ draft and had the following comments: 1. My understanding of the “alternative” nature of Steve Metalitz’s proposal was that it would be an alternative to - not a replacement of –the existing proceeding as outlined in 1.1 of the Procedure. I see that Section 1.1. has been deleted in James’ draft. I support the inclusion of the proposal Steve submitted, as a means to provide flexibility to the trigger so that the affected registrar does not need to be in “receipt of notification of an investigation, litigation, regulatory proceeding or other government or civil action.” 2. Leading on from that, I don’t think it is useful to include as an alternative the possibility for an opinion from a law firm, even with the additional layers of consultation, for all the reasons which were expressed on the last call, and in prior discussions. Even the language proposed points to a lack of connection with the underlying policy, which requires a demonstration by the registrar that is actually legally prevented from complying, not that it might be. 3. A point that has been made a number of times in prior discussions is the need for a certain level of certainty and specificity as to the nature of the actual (not probable or theoretical) conflict, as part of the trigger mechanism – in keeping with the underlying policy. An opinion from a law firm does not meet that requirement, nor would an opinion or statement from a data authority without enforcement authority, or indeed any statement that comes from a body that is not specific to the registrar in question, and the specific contractual provisions and terms of service, as analyzed against national law of the relevant country. I would suggest further discussion about the proposal presented by Steve, and whether there are any ways to address some of the concerns expressed by others within that framework. Bradley Silver Chief Intellectual Property Counsel |Time Warner Inc. 1 Time Warner Center | New York, NY 10019-8016 P: 212 484 8869 | F: 212 658 9293 Am 10.06.2015 um 17:14 schrieb Michele Neylon - Blacknight: I’ve joined Adobe, but can’t even listen (forgot headphones in my room) Basically I think most of us support the proposal that James G put forward The IPC people don’t So why not put it to a vote? -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://www.blacknight.press - get our latest news & media coverage http://www.technology.ie Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social Random Stuff: http://www.michele.irish ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845 From: Jamie Hedlund Date: Wednesday 10 June 2015 16:03 To: Michele Neylon Subject: Re: [IAG-WHOIS conflicts] Dual Trigger Proposal Are you able to join call now? Jamie Hedlund VP, Strategic Programs Global Domains Division ICANN +1.202.374.3969 (m) +1.202.570.7125 (d) jamie.hedlund(a)icann.org<mailto:jamie.hedlund@icann.org> From: Michele Neylon - Blacknight <michele(a)blacknight.com<mailto:michele@blacknight.com>> Date: Friday, May 22, 2015 at 19:10 To: Bradley Silver <Bradley.Silver(a)timewarner.com<mailto:Bradley.Silver@timewarner.com>>, James Gannon <james(a)cyberinvasion.net<mailto:james@cyberinvasion.net>>, "whois-iag-volunteers(a)icann.org<mailto:whois-iag-volunteers@icann.org>" <whois-iag-volunteers(a)icann.org<mailto:whois-iag-volunteers@icann.org>> Subject: Re: [IAG-WHOIS conflicts] Dual Trigger Proposal Bradley With all due respect I would have to forcefully disagree with you. I and others have outlined why we are supportive of the proposal as outlined previously and our position on this isn’t going to change. Discussing it further is futile. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://www.blacknight.press - get our latest news & media coverage http://www.technology.ie Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845 From: <whois-iag-volunteers-bounces(a)icann.org<mailto:whois-iag-volunteers-bounces@icann.org>> on behalf of "Silver, Bradley" Date: Friday 22 May 2015 17:02 To: James Gannon, "whois-iag-volunteers(a)icann.org<mailto:whois-iag-volunteers@icann.org>" Subject: Re: [IAG-WHOIS conflicts] Dual Trigger Proposal James, all: Thanks for your edits, and thanks to Steve for the proposal introduced on the last call. My apologies for not being able to join the last discussion, but I have been able to review the transcript, and the various viewpoints expressed about the proposals on the table. I’ve also reviewed James’ draft and had the following comments: 1. My understanding of the “alternative” nature of Steve Metalitz’s proposal was that it would be an alternative to - not a replacement of –the existing proceeding as outlined in 1.1 of the Procedure. I see that Section 1.1. has been deleted in James’ draft. I support the inclusion of the proposal Steve submitted, as a means to provide flexibility to the trigger so that the affected registrar does not need to be in “receipt of notification of an investigation, litigation, regulatory proceeding or other government or civil action.” 2. Leading on from that, I don’t think it is useful to include as an alternative the possibility for an opinion from a law firm, even with the additional layers of consultation, for all the reasons which were expressed on the last call, and in prior discussions. Even the language proposed points to a lack of connection with the underlying policy, which requires a demonstration by the registrar that is actually legally prevented from complying, not that it might be. 3. A point that has been made a number of times in prior discussions is the need for a certain level of certainty and specificity as to the nature of the actual (not probable or theoretical) conflict, as part of the trigger mechanism – in keeping with the underlying policy. An opinion from a law firm does not meet that requirement, nor would an opinion or statement from a data authority without enforcement authority, or indeed any statement that comes from a body that is not specific to the registrar in question, and the specific contractual provisions and terms of service, as analyzed against national law of the relevant country. I would suggest further discussion about the proposal presented by Steve, and whether there are any ways to address some of the concerns expressed by others within that framework. Bradley Silver Chief Intellectual Property Counsel |Time Warner Inc. 1 Time Warner Center | New York, NY 10019-8016 P: 212 484 8869 | F: 212 658 9293 From:whois-iag-volunteers-bounces@icann.org<mailto:whois-iag-volunteers-bounces@icann.org> [mailto:whois-iag-volunteers-bounces@icann.org] On Behalf Of James Gannon Sent: Thursday, May 07, 2015 7:32 AM To: whois-iag-volunteers(a)icann.org<mailto:whois-iag-volunteers@icann.org> Subject: [IAG-WHOIS conflicts] Dual Trigger Proposal Hi All, In an effort to try and find a common ground, and after recognizing Steve’s input and comments on the call last night that his proposal needs not be the exclusive trigger I have tried to string together some draft language on what I am calling a Dual Trigger process. My changes have focused on step one being the trigger step, my changes to the remainder of the process have been minor, a change of ‘shall’ to ‘may’ in Section 2 to reflect the change in substance of the trigger mechanism. And the addition of Steve’s language to the Consultation period for a public comment period. Steve: I think I have faithfully reproduced your language here please let me know if I changed anything that changes the substance of your proposal. All: I would appreciate comments or input on the proposal. Please turn off tracking changes on formatting under the ‘Show Markup’ pane if you get spammed with changes related to formatting. As always my battle with Word and its method of dealing with formatting revisions continues! Please treat this as a Zero draft for discussion. James Gannon Director Cyber Invasion Ltd Dun Laoghaire, County Dublin, Ireland Office: +353 (1)663-8787 Cell: +353 (86)175-3581 Email:james@cyberinvasion.net<mailto:james@cyberinvasion.net?subject=Via:%20Email%20Signature> GPG: https://keybase.io/jayg ================================================================= This message is the property of Time Warner Inc. and is intended only for the use of the addressee(s) and may be legally privileged and/or confidential. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, he or she is hereby notified that any dissemination, distribution, printing, forwarding, or any method of copying of this information, and/or the taking of any action in reliance on the information herein is strictly prohibited except by the intended recipient or those to whom he or she intentionally distributes this message. If you have received this communication in error, please immediately notify the sender, and delete the original message and any copies from your computer or storage system. Thank you. ================================================================= -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann(a)key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net>www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems>www.twitter.com/key_systems<http://www.twitter.com/key_systems> Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann(a)key-systems.net<mailto:vgreimann@key-systems.net> Web: www.key-systems.net<http://www.key-systems.net> / www.RRPproxy.net<http://www.RRPproxy.net>www.domaindiscount24.com<http://www.domaindiscount24.com> / www.BrandShelter.com<http://www.BrandShelter.com> Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems<http://www.facebook.com/KeySystems>www.twitter.com/key_systems<http://www.twitter.com/key_systems> CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu<http://www.keydrive.lu> This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.

1 0

Fwd: [governance] Declaration of the Committee of Ministers on ICANN, human rights and the rule of law
by Stephanie Perrin June 4, 2015

June 4, 2015

In case anyone missed this, a declaration of Ministers from the Council of Europe. Speaks to some of our issues with the policy we are trying to implement. Stephanie Perrin -------- Forwarded Message -------- Subject: [governance] Declaration of the Committee of Ministers on ICANN, human rights and the rule of law Date: Thu, 4 Jun 2015 15:00:23 -0300 From: Reply-To: TBS *Declaration of the Committee of Ministers on ICANN, human rights and the rule of law* (Adopted by the Committee of Ministers on 3 June 201/at the 1229th meeting of the Ministers’ Deputies)/ https://wcd.coe.int/ViewDoc.jsp?Ref=Decl%2803.06.2015%292&Language=lanEngli…

1 0

Re: [IAG-WHOIS conflicts] Dual Trigger Proposal
by Silver, Bradley June 3, 2015

June 3, 2015

Perhaps ICANN staff could provide input on whether it would be feasible to conduct the waiver process within a time frame of 3 months, such as the Google example you refer to. -----Original Message----- From: Luc SEUFER [mailto:lseufer@dclgroup.eu] Sent: Wednesday, June 03, 2015 9:50 AM To: Silver, Bradley Cc: Steven J. Metalitz; James Gannon; whois-iag-volunteers(a)icann.org Subject: Re: [IAG-WHOIS conflicts] Dual Trigger Proposal I am afraid that would not work either. The moment a DPA has ruled one is breaching the law they will use their enforcement prerogatives, thus fining the party in breach. They sometime may give an ultimatum like in the famous French case with Google (http://www.reuters.com/article/2014/01/08/us-france-google-fine-idUSBREA071…) but I doubt the whole ICANN conflict resolution process can be conducted and the exemption granted within such timeframe. Therefore leaving no choice to the party between the ICANN rock and the DPA hard place. Best Wishes, Luc On 02 Jun 2015, at 21:56, Silver, Bradley <Bradley.Silver(a)timewarner.com<mailto:Bradley.Silver@timewarner.com>> wrote: Steve, James and all: I agree with Steve that the most authoritative sources of interpretation of national legal frameworks are agencies charged with their enforcement, particularly in the context of a policy which requires a credible demonstration that national laws prevent compliance with relevant obligations. I’ve taken a further look at Steve’s proposal, attached here for ease of reference, and I would like to suggest we focus on whether we a possible way to bridge the gap could be to consider the necessity and feasibility of the requirement that an agency attest to its intention or preparedness to enforce the relevant law against the contracted party unless contractual obligations are adjusted in a specified manner – currently set forth as Paragraph 4. Recognizing that agencies may be reluctant to take on what might be considered a positive obligation to enforce, I think that paragraphs 1 through 3 would provide a trigger mechanism which embodies the best source of national law interpretation, while stopping short of requiring any specific legal action to be commenced – consistent with the underlying policy. This is my own view, and obviously can’t speak for Steve or others who have supported his proposal. Bradley From: whois-iag-volunteers-bounces(a)icann.org<mailto:whois-iag-volunteers-bounces@icann.org> [mailto:whois-iag-volunteers-bounces@icann.org] On Behalf Of Metalitz, Steven Sent: Monday, June 01, 2015 2:10 PM To: 'James Gannon'; whois-iag-volunteers(a)icann.org<mailto:whois-iag-volunteers@icann.org> Subject: Re: [IAG-WHOIS conflicts] Dual Trigger Proposal Hello James and colleagues, While I appreciate that this is a constructive proposal and that it has been put forward in a good faith effort to find broader support, the problem remains whether it is consistent with the policy that it seeks to implement. That consensus policy states that the trigger to seeking a waiver of the contractual Whois obligations that the contracted party has undertaken is appropriate only when the contracted party “can credibly demonstrate that it is legally prevented by local/national privacy laws or regulations from fully complying” with those obligations. The issue is whether a written opinion prepared by a law firm at the behest of that contracted party can, by itself, amount to that credible demonstration. I believe that the answer is no, and thus a procedure that allows such an opinion, standing alone, to trigger such a waiver is inconsistent with the policy and should not be adopted. In his earlier response to Bradley, James stated “if a national law is in effect in the jurisdiction of the registrar and the registrar has competent legal opinion that the law is applicable to their business then we must accept that there is an actual prevention.” I don’t believe we must or should accept that, because a law firm retained by the contracted party does not have the capability to enforce that law and thus to carry out the “actual prevention” the policy requires as a trigger. While I agree with James that “we cannot go down the road of assuming that a registrar will not comply with a national law or that a national law will not be enforced,” the law firm legal opinion standing alone does not credibly demonstrate either non-compliance or the realistic threat of enforcement. As stated in the European Commission comments submitted last year, “the decision of granting of an exemption to the implementation of the contractual requirements concerning the collection, display and distribution of Whois data should remain exclusively based on the most authoritative sources of interpretation of national legal frameworks.” Simply put, law firms retained by contracted parties are not “the most authoritative sources of interpretation of national legal frameworks.” The agencies charged with enforcement of such laws are, which is why I proposed the alternative trigger based on a written statement from such a source. I would certainly welcome suggestions for ways to refine this alternative trigger, or to consider additional alternatives that also satisfy the policy’s requirement of a “credible demonstration of legal prevention.” Steve Metalitz From: whois-iag-volunteers-bounces(a)icann.org<mailto:whois-iag-volunteers-bounces@icann.org> [mailto:whois-iag-volunteers-bounces@icann.org] On Behalf Of James Gannon Sent: Monday, May 25, 2015 7:21 AM To: James Gannon; whois-iag-volunteers(a)icann.org<mailto:whois-iag-volunteers@icann.org> Subject: Re: [IAG-WHOIS conflicts] Dual Trigger Proposal Hi All, Please find attached Rev 1 on the dual trigger, incorporating some small changes to the trigger text that I received feedback on. If staff want to put this into a google doc for feedback please feel free. -James From: whois-iag-volunteers-bounces(a)icann.org<mailto:whois-iag-volunteers-bounces@icann.org> [mailto:whois-iag-volunteers-bounces@icann.org] On Behalf Of James Gannon Sent: Thursday, May 07, 2015 12:32 PM To: whois-iag-volunteers(a)icann.org<mailto:whois-iag-volunteers@icann.org> Subject: [IAG-WHOIS conflicts] Dual Trigger Proposal Hi All, In an effort to try and find a common ground, and after recognizing Steve’s input and comments on the call last night that his proposal needs not be the exclusive trigger I have tried to string together some draft language on what I am calling a Dual Trigger process. My changes have focused on step one being the trigger step, my changes to the remainder of the process have been minor, a change of ‘shall’ to ‘may’ in Section 2 to reflect the change in substance of the trigger mechanism. And the addition of Steve’s language to the Consultation period for a public comment period. Steve: I think I have faithfully reproduced your language here please let me know if I changed anything that changes the substance of your proposal. All: I would appreciate comments or input on the proposal. Please turn off tracking changes on formatting under the ‘Show Markup’ pane if you get spammed with changes related to formatting. As always my battle with Word and its method of dealing with formatting revisions continues! Please treat this as a Zero draft for discussion. James Gannon Director Cyber Invasion Ltd Dun Laoghaire, County Dublin, Ireland Office: +353 (1)663-8787 Cell: +353 (86)175-3581 Email:james@cyberinvasion.net<mailto:james@cyberinvasion.net?subject=Via:%20Email%20Signature> GPG: https://keybase.io/jayg ================================================================= This message is the property of Time Warner Inc. and is intended only for the use of the addressee(s) and may be legally privileged and/or confidential. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, he or she is hereby notified that any dissemination, distribution, printing, forwarding, or any method of copying of this information, and/or the taking of any action in reliance on the information herein is strictly prohibited except by the intended recipient or those to whom he or she intentionally distributes this message. If you have received this communication in error, please immediately notify the sender, and delete the original message and any copies from your computer or storage system. Thank you. ================================================================= <DRAFT alternative trigger for IAG-Whois (6822949-2).docx>_______________________________________________ Whois-iag-volunteers mailing list Whois-iag-volunteers(a)icann.org<mailto:Whois-iag-volunteers@icann.org> https://mm.icann.org/mailman/listinfo/whois-iag-volunteers ________________________________ -------------------------------------------------------- This e-mail and any attached files are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail by mistake, please notify the sender immediately and delete it from your system. You must not copy the message or disclose its contents to anyone. Think of the environment: don't print this e-mail unless you really need to. -------------------------------------------------------- ================================================================= This message is the property of Time Warner Inc. and is intended only for the use of the addressee(s) and may be legally privileged and/or confidential. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, he or she is hereby notified that any dissemination, distribution, printing, forwarding, or any method of copying of this information, and/or the taking of any action in reliance on the information herein is strictly prohibited except by the intended recipient or those to whom he or she intentionally distributes this message. If you have received this communication in error, please immediately notify the sender, and delete the original message and any copies from your computer or storage system. Thank you. =================================================================

1 0

Dual Trigger Proposal
by James Gannon June 2, 2015

June 2, 2015

Hi All, In an effort to try and find a common ground, and after recognizing Steve's input and comments on the call last night that his proposal needs not be the exclusive trigger I have tried to string together some draft language on what I am calling a Dual Trigger process. My changes have focused on step one being the trigger step, my changes to the remainder of the process have been minor, a change of 'shall' to 'may' in Section 2 to reflect the change in substance of the trigger mechanism. And the addition of Steve's language to the Consultation period for a public comment period. Steve: I think I have faithfully reproduced your language here please let me know if I changed anything that changes the substance of your proposal. All: I would appreciate comments or input on the proposal. Please turn off tracking changes on formatting under the 'Show Markup' pane if you get spammed with changes related to formatting. As always my battle with Word and its method of dealing with formatting revisions continues! Please treat this as a Zero draft for discussion. James Gannon Director Cyber Invasion Ltd Dun Laoghaire, County Dublin, Ireland Office: +353 (1)663-8787 Cell: +353 (86)175-3581 Email:james@cyberinvasion.net<mailto:james@cyberinvasion.net?subject=Via:%20Email%20Signature> GPG: https://keybase.io/jayg

8 17

IAG-WHOIS Conflicts call
by Maria Otanes June 2, 2015

June 2, 2015

15:00-16:30 UTC http://www.timeanddate.com/worldclock/fixedtime.html?msg=IAG-WHOIS+Conflict… ---------------------------------------------------------- Link to Adobe Connect: https://icann.adobeconnect.com/iag-whois/ ***Upon logging into Adobe Connect, a pop up window will provide you the option to dial out to your phone. Enter your phone number, + country, phone number*** If you are unable to log into Adobe Connect and can only join via phone or Skype: [Select *6 to mute and unmute on the call] International Dial In Numbers: https://www.myrcplus.com/cnums.asp?bwebid=8369444&ppc=3515982074&num=1-719-… Participant Passcode: 351 598 2074

1 0