<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in">
<span style="font-size:12.0pt;color:black">Hi-<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in">
<span style="font-size:12.0pt;color:black">Following up on the action items from Tuesday’s call - I added the use case we discussed on yesterday’s call to Question 11.<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in">
<b><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></b></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in">
<b><span style="font-size:12.0pt;color:black">Updated Question 11</span></b><span style="font-size:12.0pt;color:black">: Can legal counsel be consulted to determine whether GDPR prevents fast automated, and non-rate limited responses (as described in SSAC 101)
to nonpublic WHOIS data <span style="background:yellow;mso-highlight:yellow">with regards to the SSAC use case (</span></span><span style="color:black;background:yellow;mso-highlight:yellow">Overarching Purpose: Crime and abuse investigation by non-law enforcement
parties)</span><span style="color:black"> f</span><span style="font-size:12.0pt;color:black">or properly credentialed security practitioners (as defined in SSAC 101), who have agreed on appropriate safeguards? If such access is not prohibited, can counsel
provide examples of safeguards (such as pseudonymization) that should be considered? (BC)</span><b><span style="color:black"><o:p></o:p></span></b></p>
<p class="MsoNormal" style="margin-left:255.0pt"><span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
<p class="MsoNormal">All the best,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Margie<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Gnso-epdp-legal <gnso-epdp-legal-bounces@icann.org> on behalf of Caitlin Tubergen <caitlin.tubergen@icann.org><br>
<b>Date: </b>Tuesday, August 6, 2019 at 11:07 AM<br>
<b>To: </b>"gnso-epdp-legal@icann.org" <gnso-epdp-legal@icann.org><br>
<b>Subject: </b>[Gnso-epdp-legal] Notes and action items - EPDP Phase 2 Legal Committee Meeting #3<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal" style="margin-left:255.0pt;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<b><span style="font-size:12.0pt;color:black">Updated Question<span class="apple-converted-space"> </span>11</span></b><span style="font-size:12.0pt;color:black">: Can legal counsel be consulted to determine whether GDPR prevents fast automated, and non-rate
limited responses (as described in SSAC 101) to nonpublic WHOIS data for properly credentialed security practitioners (as defined in SSAC 101), who have agreed on appropriate safeguards? If such access is not prohibited, can counsel provide examples of safeguards
(such as pseudonymization) that should be considered? (BC)<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:255.0pt;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
</div>
</body>
</html>