<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Dear colleagues,<div class=""><br class=""></div><div class="">I’m resurrecting this thread to share some tangentially related news I stumbled across recently: </div><div class=""><br class=""></div><div class=""><div class="">First, the EU Parliament adopted a <a href="http://www.europarl.europa.eu/sides/getDoc.do?type=REPORT&mode=XML&reference=A8-2018-0194&language=EN" class="">resolution on the rights of indigenous peoples</a> this week calling for the EU to: "fulfill its extraterritorial duties related to human rights”, create legislation to prevent and sanction violations, and “devise clear rules of conduct and regulatory frameworks for extraterritorial action by companies and investors that fall within its jurisdiction” (see 48). While these provisions exclusively relate to the protection of indigenous peoples and local communities, the thrust behind them seems to support the trend toward application of laws based on non-territorial conditions that Raphaël observed in his recent <a href="https://icannhumanrights.net/icann-gdpr-human-rights/" class="">CCWP-HR post</a>. </div><div class=""><br class=""></div><div class="">Meanwhile, in the UK, a criminal and regulatory litigation firm published a <a href="https://www.corkerbinning.com/holding-companies-criminally-liable-for-human-rights-abuses/" class="">blog post</a> outlining ways that companies may be held criminally liable for human rights abuses, wherever they may occur. Again, this is only marginally related, but potentially of interest considering that the 2018 UK Data Protection Act introduced some criminal offenses for unlawfully obtaining personal data, among other things. The threat of fines + criminal liability will be a very effective motivator if, as the post implies, the “legislative appetite” continues in this direction.</div><div class=""><br class=""></div><div class="">Comments welcome on this Friday food for thought, especially from the lawyers (which I am not).</div><div class=""><br class=""></div><div class="">Have a nice weekend,</div><div class="">Collin</div><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><div class=""><br class="Apple-interchange-newline">--</div>Collin Kurre<br class=""><div class="">ARTICLE 19</div></div><div class=""><br class=""></div></div><br class="Apple-interchange-newline" style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br class="Apple-interchange-newline">
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">On Jul 5, 2018, at 8:43 PM, Raphaël BEAUREGARD-LACROIX <<a href="mailto:raphael.beauregardlacroix@sciencespo.fr" class="">raphael.beauregardlacroix@sciencespo.fr</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">Dear Collin, all,<div class=""><br class=""></div><div class="">This is indeed timely and I find the call to "holisticism" (if there is such a thing, or is it holism?) quite relevant. </div><div class=""><br class=""></div><div class="">That being said I also think it is important to remain as focus and concrete as possible, which I do not think is incompatible with being holistic. Certainly, the Californian CPA will provide, on a theoretical and practical level, an interesting comparative perspective, contrasting with the GDPR. </div><div class=""><br class=""></div><div class="">I suppose the most rational and straightforward path here is that ICANN (org and comm) should hold itself to the highest of standards, in case anyone else besides the EU and California would have the idea to follow up with further developments of data protection law...</div><div class=""><br class=""></div><div class="">Best, </div></div><div class="gmail_extra"><br class=""><div class="gmail_quote">On 5 July 2018 at 17:41, Collin Kurre <span dir="ltr" class=""><<a href="mailto:collin@article19.org" target="_blank" class="">collin@article19.org</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word" class=""><div class="">Dear colleagues,</div><div class=""><br class=""></div><div class="">You might be interested to hear that the California passed new data protection legislation last week, the 2018 Consumer Privacy Act. For those interested, the International Association of Privacy Professionals (IAPP) has produced a comprehensive overview of the new law: <a href="https://iapp.org/news/a/analysis-the-california-consumer-privacy-act-of-2018/" target="_blank" class="">https://iapp.org/news/a/<wbr class="">analysis-the-california-<wbr class="">consumer-privacy-act-of-2018/</a> </div><div class=""><span class="m_-5427024155238519717md"><p class="">I found the following excerpt from their analysis particularly relevant to ICANN:</p></span></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px" class=""><div class=""><span class="m_-5427024155238519717md"><p class="">"Some companies implemented many of their new privacy
protection measures worldwide in the hopes of being able to avoid
having to make further jurisdiction-specific updates for a while. The
passage of the California Consumer Privacy Act has now raised the
question as to whether these measures will be sufficient to the extent
they reach California residents with their GDPR-related compliance
measures. Unfortunately, the answer is largely, ‘No.’ </p><p class=""><i class="">Global companies can and should try to address the requirements of
the California Consumer Privacy Act, EU GDPR and other privacy regimes simultaneously and holistically in the interest of efficiency</i>.” </p></span></div></blockquote><div class=""><div class="">The <a href="https://www.icann.org/resources/pages/governance/bylaws-en" target="_blank" class="">Human Rights Bylaw</a> (which will come into effect when the WS2 recommendations are approved, likely in Q4 of this year) states that ICANN should be guided by the core value of “respecting internationally recognized human rights as required by applicable law.” </div><div class=""><br class=""></div><div class="">The <a href="https://community.icann.org/display/WEIA/Documents?preview=/59641302/79437270/CCWG-Accountability-WS2-HumanRight-FinalReport-20171106%5B1%5D.pdf" target="_blank" class="">HR FoI</a> recognizes that the notion of applicable law “is a dynamic concept inasmuch as laws, regulations, etcetera, change over time.” However, based on the GDPR experience, it seems like waiting for rights-related laws to become applicable may not be the best strategy in the long run. </div><div class=""><br class=""></div><div class="">Once the bylaw comes into effect, ICANN org and each SO and AC will be required to develop policies and frameworks to take human rights into account and avoid human rights violations in policy-development and decision-making processes. Some have perceived this as an additional administrative burden, though it’s hard to contest the bylaw's relevance given the amount of time the community has spent discussing access, accreditation, EPDPs, and other topics spawned by GDPR, a piece of privacy — and therefore human rights-related — legislation.</div><div class=""><br class=""></div><div class="">I therefore see <b class="">strategic potential in developing new compliance mechanisms for the human rights bylaw.</b> Just as corporate human rights impact assessments serve to identify gaps and mitigate risks, multistakeholder ICANN HRIAs should be devised and incorporated to promote more holistic, efficient, and proactive self-governance.</div><div class=""><br class=""></div><div class="">Thoughts and comments are certainly welcome! And as a reminder, you can find a few resources on related work on the ICANN Human Rights website, here: <a href="https://icannhumanrights.net/documents/" target="_blank" class="">https://<wbr class="">icannhumanrights.net/<wbr class="">documents/</a> </div><div class=""><br class=""></div><div class=""><br class="m_-5427024155238519717webkit-block-placeholder"></div><div class="">Warm regards,</div><div class="">Collin</div><div class="">
<div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; word-wrap: break-word;" class=""><div class=""><div class=""><br class="m_-5427024155238519717Apple-interchange-newline">--</div>Collin Kurre<br class=""><div class="">ARTICLE 19</div></div><div class=""><br class=""></div></div><br class="m_-5427024155238519717Apple-interchange-newline" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;"><br class="m_-5427024155238519717Apple-interchange-newline">
</div>
<br class=""></div></div><br class="">______________________________<wbr class="">_________________<br class="">
cc-humanrights mailing list<br class="">
<a href="mailto:cc-humanrights@icann.org" class="">cc-humanrights@icann.org</a><br class="">
<a href="https://mm.icann.org/mailman/listinfo/cc-humanrights" rel="noreferrer" target="_blank" class="">https://mm.icann.org/mailman/<wbr class="">listinfo/cc-humanrights</a><br class="">
<br class=""></blockquote></div><br class=""><br clear="all" class=""><div class=""><br class=""></div>-- <br class=""><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class="">Raphaël Beauregard-Lacroix<div class=""><a href="https://www.linkedin.com/in/rapha%C3%ABl-beauregard-lacroix-88733786/" style="font-size:12.8px" target="_blank" class="">LinkedIn</a><span style="font-size:12.8px" class=""> - </span><a href="https://twitter.com/rbl0112" style="font-size:12.8px" target="_blank" class="">@rbl0012</a></div></div></div></div></div></div></div></div></div>
</div>
</div></blockquote></div><br class=""></div></body></html>