<div dir="ltr">Hi Margie<div><br>Thanks for posting your proposed additional question for Bird & Bird. I was not able to be on the last call, so I may well have missed some context.</div><div><br></div><div>I am not able to support the proposed additional question for Counsel at this stage. </div><div><br></div><div>So much has changed (including the legal environment) since the consensus policy on Thick WHOIS, and this EPDP group is not tasked with reviewing that policy, I worry that the reference may just be confusing at best or unhelpful at worst. I"m not sure that we even need to bring in the concept of Thick WHOIS at this point. The key issue, as I understand it, is whether or not there is a legally justifiable transfer of gTLD registration data from registrar to registry.</div><div><br></div><div>A proposed edit would be - </div><div><br></div><div><p class="MsoNormal"><span style="font-size:11pt">Assuming that:<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p><ul type="disc" style="margin-bottom:0in;margin-top:0in"><li class="m_-4573777668572017776m_5094087853070500312gmail-m_6424736218809071686MsoListParagraph" style="margin:0in 0in 0.0001pt 2.75pt;font-size:12pt;font-family:Calibri,sans-serif"><span style="font-size:11pt">ICANN adopts all of the purposes identified in the current draft version of Recommendation 1, [ICANN TO SEND LIST OF PURPOSES] which addresses processing for the benefit of registries, registrars, ICANN, and third parties, as part of a future Consensus Policy that updates the WHOIS policy to address GDPR concerns<u></u><u></u></span></li><li class="m_-4573777668572017776m_5094087853070500312gmail-m_6424736218809071686MsoListParagraph" style="margin:0in 0in 0.0001pt 2.75pt;font-size:12pt;font-family:Calibri,sans-serif"><span style="font-size:11pt">These purposes become incorporated into the relevant registrar and registry agreements with ICANN<u></u><u></u></span></li><li class="m_-4573777668572017776m_5094087853070500312gmail-m_6424736218809071686MsoListParagraph" style="margin:0in 0in 0.0001pt 2.75pt;font-family:Calibri,sans-serif"><span style="font-size:14.6667px">Registrars continue to collect registration data, and there is a contractual requirement to transfer some or all of the data set from registrar to registry.</span></li></ul><div><font face="Calibri, sans-serif"><span style="font-size:14.6667px"><br></span></font></div></div><div><b>Can a controller or processor justify a transfer of data (for example from registrar to registry) solely on the basis that a 3rd party may require disclosure at some point in the future, for the the purposes of upholding the 'Security Stability and Resiliency' of the DNS, as defined in ICANN's bylaws? If not, what other justifications could be made to justify such a data transfer?</b></div><div><br></div><div>However, I'm not convinced that external legal counsel will be the best people to ask? I think that our EPDP plenary group is well placed to work through these issues as we continue our work in Phase II.</div><div><br></div><div>Best wishes</div><div><br>Emily</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Feb 6, 2019 at 7:33 PM Margie Milam <<a href="mailto:margiemilam@fb.com" target="_blank">margiemilam@fb.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-4573777668572017776gmail-m_5094087853070500312gmail-m_6424736218809071686WordSection1">
<p class="MsoNormal"><span style="font-size:11pt">Hi-<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Following up on today’s call, here is a draft legal question to pose to Ruth:<u></u><u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11pt"><u></u> <u></u></span></b></p>
<p class="MsoNormal"><span style="font-size:11pt">Assuming that:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<ul style="margin-top:0in" type="disc">
<li class="gmail-m_-4573777668572017776gmail-m_5094087853070500312gmail-m_6424736218809071686MsoListParagraph" style="margin-left:2.75pt"><span style="font-size:11pt">ICANN adopts all of the purposes identified in the current draft version of Recommendation 1, [ICANN TO SEND LIST OF PURPOSES] which addresses processing
for the benefit of registries, registrars, ICANN, and third parties, as part of a future Consensus Policy that updates the WHOIS policy to address GDPR concerns<u></u><u></u></span></li><li class="gmail-m_-4573777668572017776gmail-m_5094087853070500312gmail-m_6424736218809071686MsoListParagraph" style="margin-left:2.75pt"><span style="font-size:11pt">These purposes become incorporated into the relevant registrar and registry agreements with ICANN<u></u><u></u></span></li><li class="gmail-m_-4573777668572017776gmail-m_5094087853070500312gmail-m_6424736218809071686MsoListParagraph" style="margin-left:2.75pt"><span style="font-size:11pt">There is a prior consensus policy calling for THICK WHOIS that was adopted by the ICANN Board following the Bylaws, that requires the transfer of
the WHOIS contact data from the registrars to the registries for reasons that are identified in the
<a>
Final Report</a>, including “</span><i><span style="font-size:11pt">substantial benefits from mandating thick instead of thin Whois, including enhanced accessibility and enhanced stability.”</span></i><span style="font-size:11pt"><u></u><u></u></span></li><li class="gmail-m_-4573777668572017776gmail-m_5094087853070500312gmail-m_6424736218809071686MsoListParagraph" style="margin-left:2.75pt"><span style="font-size:11pt">The resulting policy from the EPDP would continue the requirement for Thick WHOIS</span><span style="font-size:11pt"><u></u><u></u></span></li></ul>
<p class="gmail-m_-4573777668572017776gmail-m_5094087853070500312gmail-m_6424736218809071686MsoListParagraph" style="margin-left:38.75pt"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11pt">Question:</span></b><span style="font-size:11pt"> is there a legal basis under GDPR to support the requirement of a transfer of data elements from registrars to registries to enable the processing called
for in these purposes even though the processing and transfer of data may be to enable processing for the benefit of 3<sup>rd</sup> parties (e.g. Purposes 2, 3, 5, 6) rather than for the registry’s purposes (Purpose 1)?
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Looking forward to your comments.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">All the best,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Margie<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
</div>
</div>
_______________________________________________<br>
Gnso-epdp-legal mailing list<br>
<a href="mailto:Gnso-epdp-legal@icann.org" target="_blank">Gnso-epdp-legal@icann.org</a><br>
<a href="https://mm.icann.org/mailman/listinfo/gnso-epdp-legal" rel="noreferrer" target="_blank">https://mm.icann.org/mailman/listinfo/gnso-epdp-legal</a></blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail-m_-4573777668572017776gmail-m_5094087853070500312gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><p style="margin:0px;font-weight:bold"><font face="arial, helvetica, sans-serif" color="#000000">Emily Taylor</font></p><p style="margin-bottom:1.5em;margin-top:0px"><font color="#000000"><font face="arial, helvetica, sans-serif">CEO, Oxford Information Labs<br></font><i><font face="arial, helvetica, sans-serif" style="font-size:12.8px">MA (Cantab), Solicitor (non-practising), MBA, </font></i></font></p><p style="margin-bottom:1.5em;margin-top:0px"><font color="#000000"><i><font face="arial, helvetica, sans-serif" style="font-size:12.8px">A</font></i><i style="font-size:12.8px"><font face="arial, helvetica, sans-serif" style="font-size:12.8px">ssociate Fellow, Chatham House; </font><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif">Editor, Journal of Cyber Policy</span></i></font></p><p style="font-size:12.8px;margin-bottom:60px"><font color="#000000"><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif">Lincoln House, Pony Road, Oxford OX4 2RD </span><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif">| T:</span><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif"> 01865 582885 <br></span><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif">E:</span><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif"> </span><a href="mailto:emily.taylor@oxil.co.uk" style="font-size:12.8px;font-family:arial,helvetica,sans-serif" target="_blank">emily.taylor@oxil.co.uk</a><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif"> </span><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif">| D:</span><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif"> 01865 582811 </span><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif">| M:</span><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif"> </span><a value="+447799766676" style="font-size:12.8px;font-family:arial,helvetica,sans-serif">+44 7540 049322</a></font></p><p style="margin-bottom:60px"></p><p style="margin-bottom:60px"><a href="http://explore.tandfonline.com/cfp/pgas/rcyb-cfp-2017" style="font-size:12.8px" target="_blank"><img src="https://drive.google.com/a/oxil.co.uk/uc?id=1-3eDLYPfLpkj30Jc34NcbkD1xt8NQpU8&export=download" width="200" height="81"></a><a href="http://explore.tandfonline.com/cfp/pgas/rcyb-cfp-2017" style="font-size:12.8px" target="_blank"><img src="https://docs.google.com/a/oxil.co.uk/uc?id=0B7sS_6djDxsHNm92d21jM21HMDQ&export=download" width="420" height="63" alt=""></a></p><p style="margin-bottom:60px"><font face="arial, helvetica, sans-serif"><a value="+447799766676"><br></a></font></p><p style="font-size:small;color:rgb(170,170,170);font-family:arial,helvetica,san-serif">Registered office: Lincoln House, 4 Pony Road, Oxford OX4 2RD. Registered in England and Wales No. 4520925. VAT No. 799526263<br><br>.<br><br><br><br><br></p></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>