<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Everyone: <div class=""><br class=""></div><div class="">I know you are all extremely busy and apologize for the lateness in coming back to these issues: </div><div class=""><br class=""></div><div class="">I</div><div class=""><br class=""></div><div class="">We have received two pieces of legal advice: on data accuracy and the possible redaction of ‘city name’ form Bird & Bird. </div><div class=""><br class=""></div><div class="">1) Should we forward these on the the full Team? </div><div class="">2) Should we ask Bird and Bird to carry on with the next part of their analysis of the city name issue?</div><div class=""><br class=""></div><div class="">I think the answer to both of these is ‘yes’; please let me know if you concur. Even though the analysis of the city name issue is likely to extend into Phase 2, I think a response received during Phase 2 would fit well with the existing recommendation. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">II</div><div class=""><br class=""></div><div class="">I believe the question of a legal basis for thick whois requires a detailed legal analysis and also believe we should start the process. My experience in working with Bird and Bird so far is that they read the questions carefully and extract the intent as well as the meaning of the written word so that the precise wording is not critical. I also believe that, because of the complexity, there will be some iteration between the legal team and B&B before a final memo is delivered. </div><div class=""><br class=""></div><div class="">Thinking about the materials that B&B will require, I think will want them to read the Thick Whois Final Report carefully and probably will also want to read a portion of the record to understand the rationale behind the policy recommendations. We can refer to ICANN’s Stability and Security Mission as Emily suggests but also should refer B&B to theThick Whois Policy team’s record to describe the possible legal basis for Thick Whois. I.e., I think it is better for B&B to look for justifications in the record rather than ask B&B for other possible justifications. </div><div class=""><br class=""></div><div class="">So, </div><div class=""><br class=""></div><div class="">Assuming that: </div><div class=""><ul class=""><li class="">ICANN adopts all of the purposes identified in the current draft version of Recommendation 1, [ICANN TO SEND LIST OF PURPOSES] which addresses processing for the benefit of registries, registrars, ICANN, and third parties, as part of a future Consensus Policy that updates the WHOIS policy to address GDPR concerns</li><li class="">These purposes become incorporated into the relevant registrar and registry agreements with ICANN</li><li class="">There is a prior consensus policy calling for THICK WHOIS that was adopted by the ICANN Board following the Bylaws, that requires the transfer of the WHOIS contact data from the registrars to the registries for reasons that are identified in the Final Report, including ICANN mission related, “substantial benefits from mandating thick instead of thin Whois, including enhanced accessibility and enhanced stability." </li></ul></div><div class=""><div class="">Question: Is there a legal basis under GDPR for a Controller or Processor to justify a transfer of data elements from registrars to registries to enable the processing called for in these purposes even though the processing and transfer of data may be to enable processing for the benefit of 3rd parties? I.e., should the resulting policy from the EPDP would continue the requirement for Thick WHOIS?</div></div><div class=""><br class=""></div><div class="">Let me know of your edits to this question. </div><div class=""><br class=""></div><div class="">Thanks for thinking about this at this time,</div><div class=""><br class=""></div><div class="">Kurt</div><div class=""><br class=""></div><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Feb 8, 2019, at 5:54 AM, Emily Taylor <<a href="mailto:emily.taylor@oxil.co.uk" class="">emily.taylor@oxil.co.uk</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">Hi Margie<div class=""><br class="">Thanks for posting your proposed additional question for Bird & Bird. I was not able to be on the last call, so I may well have missed some context.</div><div class=""><br class=""></div><div class="">I am not able to support the proposed additional question for Counsel at this stage. </div><div class=""><br class=""></div><div class="">So much has changed (including the legal environment) since the consensus policy on Thick WHOIS, and this EPDP group is not tasked with reviewing that policy, I worry that the reference may just be confusing at best or unhelpful at worst. I"m not sure that we even need to bring in the concept of Thick WHOIS at this point. The key issue, as I understand it, is whether or not there is a legally justifiable transfer of gTLD registration data from registrar to registry.</div><div class=""><br class=""></div><div class="">A proposed edit would be - </div><div class=""><br class=""></div><div class=""><p class="MsoNormal"><span style="font-size:11pt" class="">Assuming that:<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class=""><u class=""></u> <u class=""></u></span></p><ul type="disc" style="margin-bottom:0in;margin-top:0in" class=""><li class="m_-4573777668572017776m_5094087853070500312gmail-m_6424736218809071686MsoListParagraph" style="margin:0in 0in 0.0001pt 2.75pt;font-size:12pt;font-family:Calibri,sans-serif"><span style="font-size:11pt" class="">ICANN adopts all of the purposes identified in the current draft version of Recommendation 1, [ICANN TO SEND LIST OF PURPOSES] which addresses processing for the benefit of registries, registrars, ICANN, and third parties, as part of a future Consensus Policy that updates the WHOIS policy to address GDPR concerns<u class=""></u><u class=""></u></span></li><li class="m_-4573777668572017776m_5094087853070500312gmail-m_6424736218809071686MsoListParagraph" style="margin:0in 0in 0.0001pt 2.75pt;font-size:12pt;font-family:Calibri,sans-serif"><span style="font-size:11pt" class="">These purposes become incorporated into the relevant registrar and registry agreements with ICANN<u class=""></u><u class=""></u></span></li><li class="m_-4573777668572017776m_5094087853070500312gmail-m_6424736218809071686MsoListParagraph" style="margin:0in 0in 0.0001pt 2.75pt;font-family:Calibri,sans-serif"><span style="font-size:14.6667px" class="">Registrars continue to collect registration data, and there is a contractual requirement to transfer some or all of the data set from registrar to registry.</span></li></ul><div class=""><font face="Calibri, sans-serif" class=""><span style="font-size:14.6667px" class=""><br class=""></span></font></div></div><div class=""><b class="">Can a controller or processor justify a transfer of data (for example from registrar to registry) solely on the basis that a 3rd party may require disclosure at some point in the future, for the the purposes of upholding the 'Security Stability and Resiliency' of the DNS, as defined in ICANN's bylaws? If not, what other justifications could be made to justify such a data transfer?</b></div><div class=""><br class=""></div><div class="">However, I'm not convinced that external legal counsel will be the best people to ask? I think that our EPDP plenary group is well placed to work through these issues as we continue our work in Phase II.</div><div class=""><br class=""></div><div class="">Best wishes</div><div class=""><br class="">Emily</div><div class=""><br class=""></div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Feb 6, 2019 at 7:33 PM Margie Milam <<a href="mailto:margiemilam@fb.com" target="_blank" class="">margiemilam@fb.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US" class="">
<div class="gmail-m_-4573777668572017776gmail-m_5094087853070500312gmail-m_6424736218809071686WordSection1"><p class="MsoNormal"><span style="font-size:11pt" class="">Hi-<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class="">Following up on today’s call, here is a draft legal question to pose to Ruth:<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><b class=""><span style="font-size:11pt" class=""><u class=""></u> <u class=""></u></span></b></p><p class="MsoNormal"><span style="font-size:11pt" class="">Assuming that:<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class=""><u class=""></u> <u class=""></u></span></p>
<ul style="margin-top:0in" type="disc" class="">
<li class="gmail-m_-4573777668572017776gmail-m_5094087853070500312gmail-m_6424736218809071686MsoListParagraph" style="margin-left:2.75pt"><span style="font-size:11pt" class="">ICANN adopts all of the purposes identified in the current draft version of Recommendation 1, [ICANN TO SEND LIST OF PURPOSES] which addresses processing
for the benefit of registries, registrars, ICANN, and third parties, as part of a future Consensus Policy that updates the WHOIS policy to address GDPR concerns<u class=""></u><u class=""></u></span></li><li class="gmail-m_-4573777668572017776gmail-m_5094087853070500312gmail-m_6424736218809071686MsoListParagraph" style="margin-left:2.75pt"><span style="font-size:11pt" class="">These purposes become incorporated into the relevant registrar and registry agreements with ICANN<u class=""></u><u class=""></u></span></li><li class="gmail-m_-4573777668572017776gmail-m_5094087853070500312gmail-m_6424736218809071686MsoListParagraph" style="margin-left:2.75pt"><span style="font-size:11pt" class="">There is a prior consensus policy calling for THICK WHOIS that was adopted by the ICANN Board following the Bylaws, that requires the transfer of
the WHOIS contact data from the registrars to the registries for reasons that are identified in the
<a class="">
Final Report</a>, including “</span><i class=""><span style="font-size:11pt" class="">substantial benefits from mandating thick instead of thin Whois, including enhanced accessibility and enhanced stability.”</span></i><span style="font-size:11pt" class=""><u class=""></u><u class=""></u></span></li><li class="gmail-m_-4573777668572017776gmail-m_5094087853070500312gmail-m_6424736218809071686MsoListParagraph" style="margin-left:2.75pt"><span style="font-size:11pt" class="">The resulting policy from the EPDP would continue the requirement for Thick WHOIS</span><span style="font-size:11pt" class=""><u class=""></u><u class=""></u></span></li></ul><p class="gmail-m_-4573777668572017776gmail-m_5094087853070500312gmail-m_6424736218809071686MsoListParagraph" style="margin-left:38.75pt"><span style="font-size:11pt" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal"><b class=""><span style="font-size:11pt" class="">Question:</span></b><span style="font-size:11pt" class=""> is there a legal basis under GDPR to support the requirement of a transfer of data elements from registrars to registries to enable the processing called
for in these purposes even though the processing and transfer of data may be to enable processing for the benefit of 3<sup class="">rd</sup> parties (e.g. Purposes 2, 3, 5, 6) rather than for the registry’s purposes (Purpose 1)?
<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class="">Looking forward to your comments.<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class="">All the best,<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class="">Margie<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class=""> <u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11pt" class=""><u class=""></u> <u class=""></u></span></p>
</div>
</div>
_______________________________________________<br class="">
Gnso-epdp-legal mailing list<br class="">
<a href="mailto:Gnso-epdp-legal@icann.org" target="_blank" class="">Gnso-epdp-legal@icann.org</a><br class="">
<a href="https://mm.icann.org/mailman/listinfo/gnso-epdp-legal" rel="noreferrer" target="_blank" class="">https://mm.icann.org/mailman/listinfo/gnso-epdp-legal</a></blockquote></div><br clear="all" class=""><div class=""><br class=""></div>-- <br class=""><div dir="ltr" class="gmail-m_-4573777668572017776gmail-m_5094087853070500312gmail_signature"><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div style="margin: 0px; font-weight: bold;" class=""><font face="arial, helvetica, sans-serif" class="">Emily Taylor</font></div><p style="margin-bottom:1.5em;margin-top:0px" class=""><font class=""><font face="arial, helvetica, sans-serif" class="">CEO, Oxford Information Labs<br class=""></font><i class=""><font face="arial, helvetica, sans-serif" style="font-size:12.8px" class="">MA (Cantab), Solicitor (non-practising), MBA, </font></i></font></p><p style="margin-bottom:1.5em;margin-top:0px" class=""><font class=""><i class=""><font face="arial, helvetica, sans-serif" style="font-size:12.8px" class="">A</font></i><i style="font-size:12.8px" class=""><font face="arial, helvetica, sans-serif" style="font-size:12.8px" class="">ssociate Fellow, Chatham House; </font><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif" class="">Editor, Journal of Cyber Policy</span></i></font></p><p style="font-size:12.8px;margin-bottom:60px" class=""><font class=""><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif" class="">Lincoln House, Pony Road, Oxford OX4 2RD </span><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif" class="">| T:</span><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif" class=""> 01865 582885 <br class=""></span><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif" class="">E:</span><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif" class=""> </span><a href="mailto:emily.taylor@oxil.co.uk" style="font-size:12.8px;font-family:arial,helvetica,sans-serif" target="_blank" class="">emily.taylor@oxil.co.uk</a><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif" class=""> </span><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif" class="">| D:</span><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif" class=""> 01865 582811 </span><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif" class="">| M:</span><span style="font-size:12.8px;font-family:arial,helvetica,sans-serif" class=""> </span><a value="+447799766676" style="font-size:12.8px;font-family:arial,helvetica,sans-serif" class="">+44 7540 049322</a></font></p><div style="margin-bottom: 60px;" class=""><br class="webkit-block-placeholder"></div><p style="margin-bottom:60px" class=""><a href="http://explore.tandfonline.com/cfp/pgas/rcyb-cfp-2017" style="font-size:12.8px" target="_blank" class=""><img src="https://drive.google.com/a/oxil.co.uk/uc?id=1-3eDLYPfLpkj30Jc34NcbkD1xt8NQpU8&export=download" width="200" height="81" class=""></a><a href="http://explore.tandfonline.com/cfp/pgas/rcyb-cfp-2017" style="font-size:12.8px" target="_blank" class=""><img src="https://docs.google.com/a/oxil.co.uk/uc?id=0B7sS_6djDxsHNm92d21jM21HMDQ&export=download" width="420" height="63" alt="" class=""></a></p><p style="margin-bottom:60px" class=""><font face="arial, helvetica, sans-serif" class=""><a value="+447799766676" class=""><br class=""></a></font></p><p style="font-size:small;color:rgb(170,170,170);font-family:arial,helvetica,san-serif" class="">Registered office: Lincoln House, 4 Pony Road, Oxford OX4 2RD. Registered in England and Wales No. 4520925. VAT No. 799526263<br class=""><br class="">.<br class=""><br class=""><br class=""><br class=""><br class=""></p></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
_______________________________________________<br class="">Gnso-epdp-legal mailing list<br class=""><a href="mailto:Gnso-epdp-legal@icann.org" class="">Gnso-epdp-legal@icann.org</a><br class="">https://mm.icann.org/mailman/listinfo/gnso-epdp-legal</div></blockquote></div><br class=""></div></body></html>