<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Dear colleagues,<div class=""><br class=""></div><div class="">Forwarding the message below in case you hadn't seen it (emphasis mine). </div><div class=""><br class=""></div><div class="">This is a very exciting time for human rights in ICANN! The mandate for impact assessments becomes clearer every day in light of GDPR debates, and the (hopefully) imminent approval of the <a href="https://community.icann.org/display/WEIA/Documents?preview=/59641302/79437270/CCWG-Accountability-WS2-HumanRight-FinalReport-20171106%5B1%5D.pdf" class="">HR Bylaw Framework of Interpretation</a> will add institutional weight to the requirement for ICANN to respect internationally recognized human rights. </div><div class=""><br class=""></div><div class="">Looking forward to monitoring the EPDP process, supporting the NCSG delegates, and carrying out our first <a href="https://icannhumanrights.net/wp-content/uploads/2018/05/DRAFT-ICANN-HRIA-questionnaire-model.pdf" class="">multistakeholder HRIA</a> in parallel once the EPDP kicks off.</div><div class=""><br class=""></div><div class="">On the administrative side of things, we’re working to schedule a CCWP-HR call to discuss these and other developments in a few weeks time, most likely on 31 July. An agenda will be circulated in the coming days once we’ve secured the meeting time.</div><div class=""><br class=""></div><div class="">Kind regards,</div><div class="">Collin</div><div class=""><br class=""></div><div class=""><div class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><div class="">--</div>Collin Kurre<br class=""><div class="">ARTICLE 19</div></div><div class=""><br class=""></div></div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">Begin forwarded message:</div><br class="Apple-interchange-newline"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">From: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">jonathan m <<a href="mailto:jonathan.matkowsky@riskiq.net" class="">jonathan.matkowsky@riskiq.net</a>><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">Subject: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class=""><b class="">Re: [Accred-Model] Codes of conduct</b><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">Date: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">July 16, 2018 at 11:54:18 PM GMT+1<br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">To: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">"<a href="mailto:accred-model@icann.org" class="">accred-model@icann.org</a>" <<a href="mailto:accred-model@icann.org" class="">accred-model@icann.org</a>><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">Cc: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">"<a href="mailto:gdpr@icann.org" class="">gdpr@icann.org</a>" <<a href="mailto:gdpr@icann.org" class="">gdpr@icann.org</a>><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">Reply-To: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class=""><a href="mailto:jdm@riskiq.net" class="">jdm@riskiq.net</a><br class=""></span></div><br class=""><div class=""><div class=""><div dir="auto" class="">All,</div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">Any model that doesn’t take into account for transparency of processing that a data subject has the right to typically object and freeze the processing is not compliant with GDPR. I think the registrar as a controller must also have the right to object. That doesn’t mean that the processing won’t eventually continue if it is compelling and overrides the rights and freedoms of the individual but subject to Chapter 7 of the GDPR.</div></div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">When safety is a concern, then as long as the data subject knows which supervisory authority is overseeing the code of conduct under which the request is being made, it’s possible to protect the identity of the requestor. This should be relatively rare. </div><div dir="auto" class=""><br class=""></div><div dir="auto" class=""><font color="#ff2600" class=""><b class="">Not every legitimate interest outweighs the rights and freedoms of the data subject, and a privacy impact assessment is required. Not every legitimate interest is entitled to the same weight under GDPR, and the risks and severity of harm to the person must be considered especially when certain interests at stake aren’t the same as those of the controller. </b></font></div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">We need RDAP to accommodate these concerns. When law enforcement has legitimate interests, they can use the same RDAP tier of access, but when pursuing a criminal offense or investigation, a different model of access must be accommodated under the LED etc.</div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">Ignoring these issues won’t make them go away. I hope that truly consensus-building voices participate in the EPDP, because it’s time we stop trying to keep Whois to the greatest extent possible and instead <b class=""><font color="#ff2600" class="">design the next generation to be better—more accurate, with more accountability and integrity but also consistent with data protection laws and internationally recognized norms. It makes sense to generally treat all people — regardless of where they reside, with the same inherent rights and freedoms that European laws are attempting to protect.</font></b></div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">Jonathan Matkowsky</div><div dir="auto" class="">VP - Cybersecurity, Privacy & IP</div><div dir="auto" class="">JD, CIPT, CIPP/EU</div><div dir="auto" class="">RiskIQ, Inc.</div><div dir="auto" class=""><br class=""></div><div dir="auto" class=""><br class=""></div><div class=""><br class=""><div class="gmail_quote"><div dir="ltr" class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br class="">
</blockquote></div></div>
-- <br class=""><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature">Jonathan Matkowsky</div>
<br class="">
<span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;background-color:rgb(255,255,255)" class="">******************************</span><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;background-color:rgb(255,255,255)" class=""><wbr class="">******************************</span><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;background-color:rgb(255,255,255)" class=""><wbr class="">*******<br class=""></span><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;background-color:rgb(255,255,255)" class="">This message was sent from RiskIQ, and is intended only for the designated recipient(s). It may contain confidential or proprietary information and may be subject to confidentiality protections. If you are not a designated recipient, you may not review, copy or distribute this message. If you receive this in error, please notify the sender by reply e-mail and delete this message. Thank you.</span><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; background-color: rgb(255, 255, 255);" class=""><br class="webkit-block-placeholder"></div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;background-color:rgb(255,255,255)" class="">******************************</span><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;background-color:rgb(255,255,255)" class=""><wbr class="">******************************</span><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;background-color:rgb(255,255,255)" class=""><wbr class="">*******</span>_______________________________________________<br class="">Accred-Model mailing list<br class=""><a href="mailto:Accred-Model@icann.org" class="">Accred-Model@icann.org</a><br class="">https://mm.icann.org/mailman/listinfo/accred-model<br class=""></div></blockquote></div><br class=""></div></body></html>