<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
p.MsoFootnoteText, li.MsoFootnoteText, div.MsoFootnoteText
{mso-style-priority:99;
mso-style-link:"Footnote Text Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.FootnoteTextChar
{mso-style-name:"Footnote Text Char";
mso-style-priority:99;
mso-style-link:"Footnote Text";
font-family:"Calibri",sans-serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:10567286;
mso-list-template-ids:-941831928;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1
{mso-list-id:163862009;
mso-list-template-ids:-274068732;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2
{mso-list-id:355161539;
mso-list-template-ids:-1056531978;}
@list l2:level1
{mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level2
{mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level3
{mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level4
{mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level5
{mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level6
{mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level7
{mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level8
{mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level9
{mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l3
{mso-list-id:583146561;
mso-list-template-ids:988457020;}
@list l3:level1
{mso-level-start-at:2;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-weight:bold;
mso-bidi-font-weight:bold;}
@list l3:level2
{mso-level-number-format:alpha-lower;
mso-level-text:"%2\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:73.0pt;
text-indent:-19.0pt;}
@list l3:level3
{mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l3:level4
{mso-level-text:"\(%4\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l3:level5
{mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l3:level6
{mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l3:level7
{mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l3:level8
{mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l3:level9
{mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4
{mso-list-id:777717004;
mso-list-type:hybrid;
mso-list-template-ids:1240529164 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l4:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.0in;
text-indent:-.25in;
font-family:Symbol;}
@list l4:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.5in;
text-indent:-.25in;
font-family:"Courier New";}
@list l4:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.0in;
text-indent:-.25in;
font-family:Wingdings;}
@list l4:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.5in;
text-indent:-.25in;
font-family:Symbol;}
@list l4:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.0in;
text-indent:-.25in;
font-family:"Courier New";}
@list l4:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.5in;
text-indent:-.25in;
font-family:Wingdings;}
@list l4:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.0in;
text-indent:-.25in;
font-family:Symbol;}
@list l4:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.5in;
text-indent:-.25in;
font-family:"Courier New";}
@list l4:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:5.0in;
text-indent:-.25in;
font-family:Wingdings;}
@list l5
{mso-list-id:1396203690;
mso-list-template-ids:1167374274;}
@list l5:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6
{mso-list-id:1620255252;
mso-list-template-ids:602695500;}
@list l6:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt'>Dear Phase 2 Legal Committee,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Please find the proposed annotated agenda for the fourth meeting below. Please note the agenda will be updated as homework comes in.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Thank you.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Best regards,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Marika, Berry, and Caitlin<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:10.5pt;color:black'>--<o:p></o:p></span></b></p><p class=MsoNormal style='margin-bottom:12.0pt'><b>EPDP Phase 2 Legal Committee Meeting #4<o:p></o:p></b></p><p class=MsoNormal style='margin-bottom:12.0pt'><b>Proposed Agenda<o:p></o:p></b></p><p class=MsoNormal style='margin-bottom:12.0pt'><b>Tuesday, 20 August 14:00 UTC<o:p></o:p></b></p><ol style='margin-top:0in' start=1 type=1><li class=MsoNormal style='color:black;margin-bottom:12.0pt;mso-list:l2 level1 lfo1'><b>Roll Call & SOI Updates <o:p></o:p></b></li></ol><ol style='margin-top:0in' start=2 type=1><li class=MsoListParagraph style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l3 level1 lfo2'><b>Continued Substantive Review of Priority 1 (SSAD) Legal Questions Submitted to Date</b><o:p></o:p></li></ol><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoListParagraphCxSpFirst style='margin-left:73.0pt;mso-add-space:auto;text-indent:-19.0pt;mso-list:l3 level2 lfo2'><![if !supportLists]><span style='color:black'><span style='mso-list:Ignore'>a)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>Substantive review of SSAD questions (beginning where LC left off last week)<o:p></o:p></span></p><p class=MsoListParagraphCxSpMiddle style='margin-left:73.0pt;mso-add-space:auto'><span style='color:black'><o:p> </o:p></span></p><ul style='margin-top:0in' type=disc><li class=MsoListParagraphCxSpLast style='color:black;margin-bottom:12.0pt;mso-add-space:auto;mso-line-height-alt:11.65pt;mso-list:l4 level1 lfo3'><b>Updated Merged Questions 2 and 5</b>: LC to continue reviewing the updated text and suggest changes (if any) in advance of the next LC meeting on Tuesday, 20 August 2019. LC to be prepared to discuss the text and proposed updates during next LC call.<o:p></o:p></li></ul><p class=MsoNormal style='margin-left:1.0in'><b><i><span style='color:black'>Updated Merged Questions 2 and 5</span></i></b><i><span style='color:black'>: Consider a System for Standardized Access/Disclosure where contracted parties “CPs” are required to disclose personal data over RDAP to requestors either directly or through an intermediary request accreditation/authorization body. Assuming the following safeguards are in place, what risk, if any, would the CP face for the processing activity of disclosure in this context? If any risk exists, what improved or additional safeguards would eliminate<a name="_ftnref1"></a><a href="applewebdata://DC36EABD-CD08-4C99-90BB-7C993390CFCA#_ftn1"><span style='mso-bookmark:_ftnref1'><sup><span style='color:#954F72'>[1]</span></sup></span><span style='mso-bookmark:_ftnref1'></span></a><span style='mso-bookmark:_ftnref1'></span> this risk. In this scenario, would the CP be a controller or a processor<a name="_ftnref2"></a><a href="applewebdata://DC36EABD-CD08-4C99-90BB-7C993390CFCA#_ftn2"><span style='mso-bookmark:_ftnref2'><sup><span style='color:#954F72'>[2]</span></sup></span><span style='mso-bookmark:_ftnref2'></span></a><span style='mso-bookmark:_ftnref2'></span>, and to what extent, if at all, is the CP’s liability impacted by this controller/processor distinction? <o:p></o:p></span></i></p><p class=MsoNormal><i><span style='color:black'> <o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:91.0pt;text-indent:-.25in;mso-line-height-alt:11.65pt;mso-list:l5 level1 lfo4'><![if !supportLists]><span style='font-size:10.0pt;font-family:Symbol;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><i><span style='color:black'>Disclosure is required under CP’s contract with ICANN (resulting from Phase 2 EPDP policy).<o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:.5in;mso-line-height-alt:11.65pt'><i><span style='color:black'> <o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:91.0pt;text-indent:-.25in;mso-line-height-alt:11.65pt;mso-list:l1 level1 lfo5'><![if !supportLists]><span style='font-size:10.0pt;font-family:Symbol;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><i><span style='color:black'>CP’s contract with ICANN requires CP to notify the data subject of the purposes for which, and types of entities by which, personal data may be processed. CP is required to notify data subject of this with the opportunity to opt out before the data subject enters into the registration agreement with the CP, and again annually via the ICANN-required registration data accuracy reminder. CP has done so. <o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:.5in;mso-line-height-alt:11.65pt'><i><span style='color:black'> <o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:91.0pt;text-indent:-.25in;mso-line-height-alt:11.65pt;mso-list:l0 level1 lfo6'><![if !supportLists]><span style='font-size:10.0pt;font-family:Symbol;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><i><span style='color:black'>ICANN or its designee has validated the requestor’s identity, and required that the requestor: <o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:127.0pt;text-indent:-.25in;mso-line-height-alt:11.65pt;mso-list:l0 level2 lfo6'><![if !supportLists]><span style='font-size:10.0pt;font-family:"Courier New";color:black'><span style='mso-list:Ignore'>o<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><i><span style='color:black'>represents that it has a lawful basis for requesting and processing the data, <o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:127.0pt;text-indent:-.25in;mso-line-height-alt:11.65pt;mso-list:l0 level2 lfo6'><![if !supportLists]><span style='font-size:10.0pt;font-family:"Courier New";color:black'><span style='mso-list:Ignore'>o<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><i><span style='color:black'>provides its lawful basis,<o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:127.0pt;text-indent:-.25in;mso-line-height-alt:11.65pt;mso-list:l0 level2 lfo6'><![if !supportLists]><span style='font-size:10.0pt;font-family:"Courier New";color:black'><span style='mso-list:Ignore'>o<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><i><span style='color:black'>represents that it is requesting only the data necessary for its purpose, <o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:127.0pt;text-indent:-.25in;mso-line-height-alt:11.65pt;mso-list:l0 level2 lfo6'><![if !supportLists]><span style='font-size:10.0pt;font-family:"Courier New";color:black'><span style='mso-list:Ignore'>o<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><i><span style='color:black'>agrees to process the data in accordance with GDPR, and <o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:127.0pt;text-indent:-.25in;mso-line-height-alt:11.65pt;mso-list:l0 level2 lfo6'><![if !supportLists]><span style='font-size:10.0pt;font-family:"Courier New";color:black'><span style='mso-list:Ignore'>o<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><i><span style='color:black'>agrees to standard contractual clauses for the data transfer. <o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:.5in;mso-line-height-alt:11.65pt'><i><span style='color:black'> <o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:91.0pt;text-indent:-.25in;mso-list:l6 level1 lfo7'><![if !supportLists]><span style='font-size:10.0pt;font-family:Symbol;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><i>ICANN or its designee logs requests for non-public registration data, regularly audits these logs, takes compliance action against suspected abuse, and makes these logs available upon request by the data subject.<span style='color:black'><o:p></o:p></span></i></p><p class=MsoNormal style='margin-bottom:12.0pt;mso-line-height-alt:11.65pt'><span style='color:black'><o:p> </o:p></span></p><ul style='margin-top:0in' type=disc><li class=MsoListParagraph style='color:black;mso-line-height-alt:11.65pt;mso-list:l4 level1 lfo3'><b>Updated Question 4</b>: Brian and Volker to work together on redrafting question 4, specifically with respect to clarifying whose legal basis for processing the question refers to.<o:p></o:p></li></ul><p class=MsoNormal style='mso-line-height-alt:11.65pt'><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:91.0pt'><b><i><span style='color:black'>Updated Question 4</span></i></b><i><span style='color:black'>: European LEAs need to have a legal basis for requesting disclosure. Based on that, they approach the contracted party, which can then disclose based on Art. 6 I c GDPR to fulfil a legal obligation.<o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:91.0pt'><i><span style='color:black'>Where no legal basis for requesting data exists, no disclosure can take place.<o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:91.0pt'><i><span style='color:black'><o:p> </o:p></span></i></p><p class=MsoNormal style='margin-left:91.0pt'><i><span style='color:black'>Art. 6 I c GDPR is limited to European laws. As a consequence, non-EU LEA cannot use a European legal basis for requesting data and the contracted party can therefore not disclose based on 6 I c GDPR.<o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:91.0pt'><i><span style='color:black'><o:p> </o:p></span></i></p><p class=MsoNormal style='margin-left:91.0pt'><i><span style='color:black'>That would leave us with disclosure based on 6 I f GDPR and to the potentially problematic situation in which a domestic European LEA must be able to base its request on a national law while non-EU LEA “only” needs to have a legitimate interest. Remember that even public authorities must not base their processing on 6 I f GDPR in performing their core activities. I trust there is common understanding that investigating crime is the core activity of LEAs and thus it might be a contradiction to have domestic European LEAs blocked from basing their requests on 6 I f GDPR, while non-EU LEA can use that para as a legal basis and also to have the contracted party disclose based on 6 I f GDPR, while in domestic EU cases, only 6 I c GDPR would be applicable.<o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:91.0pt'><i><span style='color:black'><o:p> </o:p></span></i></p><p class=MsoNormal style='margin-left:91.0pt'><i><span style='color:black'>Remember that disclosing data to LEA is much more impactful for the data subject than in civil cases and that therefore, the law makers have included the aforementioned safeguards into the GDPR, which we might be bypassing by using 6 I f GDPR.<o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:91.0pt'><i><span style='color:black'>I am not saying this cannot be made work, but we should get confirmation that such disclosure is lawful.<o:p></o:p></span></i></p><p class=MsoNormal style='mso-line-height-alt:11.65pt'><span style='color:black'><o:p> </o:p></span></p><ul style='margin-top:0in' type=disc><li class=MsoListParagraph style='color:black;mso-line-height-alt:11.65pt;mso-list:l4 level1 lfo3'><b>Updated Question 9</b>: Hadia and Margie to work together to redraft the question to clarify ambiguities. (Note: in redrafting Q9, Hadia and Margie may want to consider the text of updated Q2/5.<o:p></o:p></li></ul><p class=MsoNormal style='margin-left:.5in;mso-line-height-alt:11.65pt'><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><b><i><span style='color:black'>Updated Question 9</span></i></b><i><span style='color:black'>: Assuming that there is a policy that allows accredited parties to access non-public WHOIS data through an SSAD (and requires the accredited party to commit to certain reasonable safeguards similar to a code of conduct), is it legally possible to have automated disclosures to third parties that have requested access under 6(1)(f)? If it is possible, please provide any guidance for how this can be accomplished. For example, is it legally permissible to define specific categories of requests (e.g. rapid response to a malware attack or contacting a non-responsive IP infringer) to identify types of user groups or processing activities that reduce the need for manual review? In addition, please describe the circumstances (if any) where a manual review is required under 6(1)(f), and any guidance for how to perform this balancing test.</span></i><i><o:p></o:p></i></p><p class=MsoNormal style='mso-line-height-alt:11.65pt'><span style='color:black'><o:p> </o:p></span></p><ul style='margin-top:0in' type=disc><li class=MsoListParagraphCxSpFirst style='color:black;margin-bottom:12.0pt;mso-add-space:auto;mso-line-height-alt:11.65pt;mso-list:l4 level1 lfo3'><b>Updated Question 11</b>: Question on hold for now. Margie to update the text of the question to include a specific use case. <o:p></o:p></li></ul><p class=MsoListParagraphCxSpLast style='margin-bottom:12.0pt;mso-add-space:auto;mso-line-height-alt:11.65pt'><b><span style='color:black'>Note: On the list, León proposed submitting the question with a summary of the situation that the use case tries to address. Would someone like to volunteer to do this? (The draft below includes Margie’s update + Volker’s proposed addition). <o:p></o:p></span></b></p><p class=MsoNormal style='margin-left:.75in'><b><i><span style='color:black'>Updated Question 11</span></i></b><i><span style='color:black'>: Can legal counsel be consulted to determine whether in [completely defined Scenario X] a fast automated, and non-rate limited responses (as described in SSAC 101) to nonpublic WHOIS data for properly credentialed security practitioners (as defined in SSAC 101), who have agreed on appropriate safeguards would be permissible under the GDRP and not cause any liability in data controllers/processors with regard to unrightful disclosures? Or would any automated disclosure carry a potential for liability of the disclosing party? Can counsel provide examples of safeguards (such as pseudonymization/anonymization) that should be considered?<o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:.75in'><o:p> </o:p></p><ul style='margin-top:0in' type=disc><li class=MsoListParagraphCxSpFirst style='color:black;margin-bottom:12.0pt;mso-add-space:auto;mso-line-height-alt:11.65pt;mso-list:l4 level1 lfo3'><b>Updated Question 12 and 13</b>: LC to review simplified question before sending to EPDP Team for sign off: In light of the<span class=apple-converted-space> </span><span style='color:windowtext'><a href="https://www.icann.org/en/system/files/correspondence/odonohue-to-marby-03may19-en.pdf" title="https://www.icann.org/en/system/files/correspondence/odonohue-to-marby-03may19-en.pdf"><span style='color:#954F72'>3 May 2019 correspondence from the European Commission</span></a></span>, are any updates on the<span class=apple-converted-space> </span><span style='color:windowtext'><a href="https://community.icann.org/download/attachments/102138857/6%281%29%28b%29%20Memo.docx?version=1&modificationDate=1548874809000&api=v2"><span style='color:#954F72'>previous memo on 6(1)(b)</span></a></span><span class=apple-converted-space> </span>necessary?<span class=apple-converted-space> </span><span class=apple-converted-space><o:p></o:p></span></li></ul><p class=MsoListParagraphCxSpMiddle style='margin-bottom:12.0pt;mso-add-space:auto;mso-line-height-alt:11.65pt'><b><span style='color:black'>Note: Is the Team OK with this question as worded above?</span></b><b><o:p></o:p></b></p><p class=MsoListParagraphCxSpMiddle style='margin-bottom:12.0pt;mso-add-space:auto;mso-line-height-alt:11.65pt'><b><o:p> </o:p></b></p><ul type=disc><li class=MsoListParagraphCxSpLast style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-add-space:auto;mso-list:l4 level1 lfo3'><b><i>Question 6: </i></b><i>Within the context of an SSAD, in addition to determining its own lawful basis for disclosing data, does the requestee (entity that houses the requested data) need to assess the lawful basis of the third-party requestor? (Question from ICANN65 from GAC/IPC)<b><o:p></o:p></b></i></li></ul><p class=MsoNormal style='margin-bottom:12.0pt;mso-line-height-alt:11.65pt'><b><span style='color:black'><o:p> </o:p></span></b></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoFootnoteText style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:310.0pt;margin-bottom:.0001pt'><a name="_ftn1"></a><a href="applewebdata://68B0E022-B472-4D73-B3D4-09BBCC4682C7#_ftnref1"><span style='mso-bookmark:_ftn1'><span class=MsoFootnoteReference><sup><span style='font-size:12.0pt;font-family:"Calibri",sans-serif;color:#954F72'>[1]</span></sup></span></span><span style='mso-bookmark:_ftn1'></span></a><span style='mso-bookmark:_ftn1'></span><span class=apple-converted-space><span style='font-size:12.0pt;color:black'> </span></span><span style='font-size:12.0pt;color:black'>“Here it is important to highlight the special role that safeguards may play in reducing the undue impact on the data subjects, and thereby changing the balance of rights and interests to the extent that the data controller’s legitimate interests will not be overridden.“ (</span><a href="https://iapp.org/media/pdf/resource_center/wp217_legitimate-interests_04-2014.pdf" title="https://iapp.org/media/pdf/resource_center/wp217_legitimate-interests_04-2014.pdf"><span style='font-size:12.0pt;color:#954F72'>https://iapp.org/media/pdf/resource_center/wp217_legitimate-interests_04-2014.pdf</span></a><span style='font-size:12.0pt;color:black'>)<o:p></o:p></span></p><p class=MsoFootnoteText style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:310.0pt;margin-bottom:.0001pt'><a name="_ftn2"></a><a href="applewebdata://68B0E022-B472-4D73-B3D4-09BBCC4682C7#_ftnref2"><span style='mso-bookmark:_ftn2'><span class=MsoFootnoteReference><sup><span style='font-size:12.0pt;font-family:"Calibri",sans-serif;color:#954F72'>[2]</span></sup></span></span><span style='mso-bookmark:_ftn2'></span></a><span style='mso-bookmark:_ftn2'></span><span class=apple-converted-space><span style='font-size:12.0pt;color:black'> </span></span><a href="https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/controller-processor/what-data-controller-or-data-processor_en" title="https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/controller-processor/what-data-controller-or-data-processor_en"><span style='font-size:12.0pt;color:#954F72'>https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/controller-processor/what-data-controller-or-data-processor_en</span></a><span style='font-size:12.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-left:1.0in'><o:p> </o:p></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoListParagraphCxSpFirst style='margin-left:73.0pt;mso-add-space:auto;text-indent:-19.0pt;mso-list:l3 level2 lfo2'><![if !supportLists]><span style='color:black'><span style='mso-list:Ignore'>b)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>Discussion on submission of questions – submit as complete batch or as available?<o:p></o:p></span></p><p class=MsoListParagraphCxSpLast style='margin-left:73.0pt;mso-add-space:auto;text-indent:-19.0pt;mso-list:l3 level2 lfo2'><![if !supportLists]><span style='color:black'><span style='mso-list:Ignore'>c)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>Agree on next steps<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><ol style='margin-top:0in' start=3 type=1><li class=MsoListParagraphCxSpFirst style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l3 level1 lfo2'><b>Wrap and confirm next meeting to be scheduled <o:p></o:p></b></li></ol><p class=MsoListParagraphCxSpMiddle style='margin-left:73.0pt;mso-add-space:auto;text-indent:-19.0pt;mso-list:l3 level2 lfo2'><![if !supportLists]><span style='color:black'><span style='mso-list:Ignore'>a)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>Confirm action items<o:p></o:p></span></p><p class=MsoListParagraphCxSpLast style='margin-left:73.0pt;mso-add-space:auto;text-indent:-19.0pt;mso-list:l3 level2 lfo2'><![if !supportLists]><span style='color:black'><span style='mso-list:Ignore'>b)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>The next LC Meeting will take place on Tuesday, 3 September at 14:00 UTC.<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Times New Roman",serif;color:black'><o:p> </o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>