<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Hi-<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Following up on Question 11 – here is a an updated question with a summary to replace the SSAC use case:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.75in"><b><i><span style="font-size:12.0pt;color:black">Updated Question 11</span></i></b><i><span style="font-size:12.0pt;color:black">:
<o:p></o:p></span></i></p>
<p class="MsoNormal" style="margin-left:1.0in"><i><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></i></p>
<p class="MsoNormal" style="margin-left:1.0in"><i><span style="font-size:12.0pt;color:black">Is it permissible under GDPR to provide fast, automated, and non-rate limited responses (as described in SSAC 101) to nonpublic WHOIS data for properly credentialed
security practitioners (as defined in SSAC 101) <span style="background:yellow;mso-highlight:yellow">who are responsible for defense against e-crimes (including network operators, providers of online services, commercial security services, cyber-crime investigators)
for use in investigations and mitigation activities to protect their network, information systems or services (as referenced in GDPR Recital 49)</span> and have agreed on appropriate safeguards? Or would any automated disclosure carry a potential for liability
of the disclosing party, or the controllers or processors of such data? Can counsel provide examples of safeguards (such as pseudonymization/anonymization) that should be considered?<o:p></o:p></span></i></p>
<p class="MsoNormal" style="margin-left:.75in"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.75in"><span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
<p class="MsoNormal">Talk to you tomorrow.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">All the best, <o:p></o:p></p>
<p class="MsoNormal">Margie<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Gnso-epdp-legal <gnso-epdp-legal-bounces@icann.org> on behalf of Caitlin Tubergen <caitlin.tubergen@icann.org><br>
<b>Date: </b>Friday, August 16, 2019 at 3:09 PM<br>
<b>To: </b>"gnso-epdp-legal@icann.org" <gnso-epdp-legal@icann.org><br>
<b>Subject: </b>[Gnso-epdp-legal] Proposed agenda - EPDP Phase 2 Legal Committee Meeting #4<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal" style="margin-left:.75in;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<b><i><span style="font-size:12.0pt;color:black">Updated Question 11</span></i></b><i><span style="font-size:12.0pt;color:black">: Can legal counsel be consulted to determine whether in [completely defined Scenario X] a fast automated, and non-rate limited
responses (as described in SSAC 101) to nonpublic WHOIS data for properly credentialed security practitioners (as defined in SSAC 101), who have agreed on appropriate safeguards would be permissible under the GDRP and not cause any liability in data controllers/processors
with regard to unrightful disclosures? Or would any automated disclosure carry a potential for liability of the disclosing party? Can counsel provide examples of safeguards (such as pseudonymization/anonymization) that should be considered?</span></i><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.75in;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:12.0pt;color:black"> <o:p></o:p></span></p>
</div>
</body>
</html>