<div dir="ltr">Hi Margie,<div>thanks for your reply. I guess then we will need to make a caveat that the case is just illustrative and is still being finalised by the group. I do find some issues with references to the legislation made in that case and the applicability of cited recitals, which possibly have to be changed or brought in conformity with applicable law/regulation. So if we submit the case fully and not just as a few lines illustrating "what's the case is about" -- there might be a problem. </div><div>Again, I guess we can discuss how to proceed during the next meeting of the legal team, but I want to flag this for now.</div><div>Cheers,</div><div>Tanya </div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, 9 Aug 2019 at 22:10, Margie Milam <<a href="mailto:margiemilam@fb.com">margiemilam@fb.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-7445691938696652461WordSection1">
<p class="MsoNormal">Hi Tatiana – <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The use case is meant to be illustrative, to facilitate Bird & Bird’s general understanding in order to provide its analysis. As a result I don’t believe that the use case needs to be finalized before it is presented.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">All the best,<u></u><u></u></p>
<p class="MsoNormal">Margie<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12pt;color:black">From: </span></b><span style="font-size:12pt;color:black">Tatiana Tropina <<a href="mailto:tatiana.tropina@gmail.com" target="_blank">tatiana.tropina@gmail.com</a>><br>
<b>Date: </b>Friday, August 9, 2019 at 10:20 AM<br>
<b>To: </b>Margie Milam <<a href="mailto:margiemilam@fb.com" target="_blank">margiemilam@fb.com</a>><br>
<b>Cc: </b>Caitlin Tubergen <<a href="mailto:caitlin.tubergen@icann.org" target="_blank">caitlin.tubergen@icann.org</a>>, "<a href="mailto:gnso-epdp-legal@icann.org" target="_blank">gnso-epdp-legal@icann.org</a>" <<a href="mailto:gnso-epdp-legal@icann.org" target="_blank">gnso-epdp-legal@icann.org</a>><br>
<b>Subject: </b>Re: [Gnso-epdp-legal] Notes and action items - EPDP Phase 2 Legal Committee Meeting #3<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Hi Margie, <u></u><u></u></p>
<div>
<p class="MsoNormal">a question - is this the case we discussed on the call yesterday? I just wonder if there is a need to reach a general agreement within the bigger EPDP team on this use case before we forward the question to legal -- there were some questions
about the use case yesterday and SSAC said they would reply. I think there is a need to wait until at least the issues with the case are resolved before sending the question to legal? - but would listen to what others say. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">But as we have 1,5 weeks before the next meeting, maybe this could be sorted. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Wish you and all others a great weekend,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Cheers,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Tanya <u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Fri, 9 Aug 2019 at 18:55, Margie Milam <<a href="mailto:margiemilam@fb.com" target="_blank">margiemilam@fb.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="margin-bottom:2pt"><span style="font-size:12pt;color:black">Hi-</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:2pt"><span style="font-size:12pt;color:black">Following up on the action items from Tuesday’s call - I added the use case we discussed on yesterday’s call to Question 11.</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:2pt"><b><span style="font-size:12pt;color:black"> </span></b><u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:2pt"><b><span style="font-size:12pt;color:black">Updated Question 11</span></b><span style="font-size:12pt;color:black">: Can legal counsel be consulted to determine whether GDPR prevents
fast automated, and non-rate limited responses (as described in SSAC 101) to nonpublic WHOIS data
<span style="background:yellow">with regards to the SSAC use case (</span></span><span style="color:black;background:yellow">Overarching Purpose: Crime and abuse investigation by non-law enforcement parties)</span><span style="color:black"> f</span><span style="font-size:12pt;color:black">or
properly credentialed security practitioners (as defined in SSAC 101), who have agreed on appropriate safeguards? If such access is not prohibited, can counsel provide examples of safeguards (such as pseudonymization) that should be considered? (BC)</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:255pt">
<span style="font-size:12pt;color:black"> </span><u></u><u></u></p>
<p class="MsoNormal">All the best,<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Margie<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12pt;color:black">From:
</span></b><span style="font-size:12pt;color:black">Gnso-epdp-legal <<a href="mailto:gnso-epdp-legal-bounces@icann.org" target="_blank">gnso-epdp-legal-bounces@icann.org</a>> on behalf of Caitlin Tubergen <<a href="mailto:caitlin.tubergen@icann.org" target="_blank">caitlin.tubergen@icann.org</a>><br>
<b>Date: </b>Tuesday, August 6, 2019 at 11:07 AM<br>
<b>To: </b>"<a href="mailto:gnso-epdp-legal@icann.org" target="_blank">gnso-epdp-legal@icann.org</a>" <<a href="mailto:gnso-epdp-legal@icann.org" target="_blank">gnso-epdp-legal@icann.org</a>><br>
<b>Subject: </b>[Gnso-epdp-legal] Notes and action items - EPDP Phase 2 Legal Committee Meeting #3</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-left:255pt;font-variant-caps:normal;text-align:start;word-spacing:0px">
<b><span style="font-size:12pt;color:black">Updated Question<span class="gmail-m_-7445691938696652461gmail-m-7161246621767108659apple-converted-space"> </span>11</span></b><span style="font-size:12pt;color:black">: Can legal counsel be consulted to determine whether GDPR prevents
fast automated, and non-rate limited responses (as described in SSAC 101) to nonpublic WHOIS data for properly credentialed security practitioners (as defined in SSAC 101), who have agreed on appropriate safeguards? If such access is not prohibited, can counsel
provide examples of safeguards (such as pseudonymization) that should be considered? (BC)</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:255pt;font-variant-caps:normal;text-align:start;word-spacing:0px">
<span style="font-size:12pt;color:black"> </span><u></u><u></u></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Gnso-epdp-legal mailing list<br>
<a href="mailto:Gnso-epdp-legal@icann.org" target="_blank">Gnso-epdp-legal@icann.org</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__mm.icann.org_mailman_listinfo_gnso-2Depdp-2Dlegal&d=DwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8&m=4Ct67L7B_OjiOzhFeRkGiZRNhJIU_MbBQeGI63cNa5I&s=euxVLQNefiEYd-TqfcuyjR1kybnG8vqVeVwoDX9xeRo&e=" target="_blank">https://mm.icann.org/mailman/listinfo/gnso-epdp-legal</a><br>
_______________________________________________<br>
By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_policy&d=DwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8&m=4Ct67L7B_OjiOzhFeRkGiZRNhJIU_MbBQeGI63cNa5I&s=R9nOdr9ruR6dzN9mAoEy3HqOqKeXAxluNM0CPWYOHQc&e=" target="_blank">https://www.icann.org/privacy/policy</a>)
and the website Terms of Service (<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_tos&d=DwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8&m=4Ct67L7B_OjiOzhFeRkGiZRNhJIU_MbBQeGI63cNa5I&s=FQVQkCt49mSrAD_a0inmlfD8HcQRjSFCSfnphDTMIy0&e=" target="_blank">https://www.icann.org/privacy/tos</a>).
You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.<u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
</blockquote></div>