<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
p.MsoFootnoteText, li.MsoFootnoteText, div.MsoFootnoteText
{mso-style-priority:99;
mso-style-link:"Footnote Text Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.FootnoteTextChar
{mso-style-name:"Footnote Text Char";
mso-style-priority:99;
mso-style-link:"Footnote Text";
font-family:"Calibri",sans-serif;}
p.paragraph, li.paragraph, div.paragraph
{mso-style-name:paragraph;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:10959408;
mso-list-type:hybrid;
mso-list-template-ids:-1525225306 -1646342254 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-start-at:3;
mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Calibri",sans-serif;
mso-fareast-font-family:Calibri;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l1
{mso-list-id:295643949;
mso-list-type:hybrid;
mso-list-template-ids:-425556840 67698689 1876443518 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:71.25pt;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level2
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:·;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:152.25pt;
text-indent:-63.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-font-family:"Times New Roman";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:143.25pt;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:179.25pt;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:215.25pt;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:251.25pt;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:287.25pt;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:323.25pt;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:359.25pt;
text-indent:-.25in;
font-family:Wingdings;}
@list l2
{mso-list-id:355161539;
mso-list-template-ids:447755236;}
@list l2:level1
{mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level2
{mso-level-number-format:alpha-lower;
mso-level-text:"%2\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level3
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level4
{mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level5
{mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level6
{mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level7
{mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level8
{mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level9
{mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l3
{mso-list-id:455222650;
mso-list-template-ids:88363088;}
@list l3:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4
{mso-list-id:583146561;
mso-list-template-ids:899343574;}
@list l4:level1
{mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-weight:bold;
mso-bidi-font-weight:bold;}
@list l4:level2
{mso-level-number-format:alpha-lower;
mso-level-text:"%2\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:73.0pt;
text-indent:-19.0pt;}
@list l4:level3
{mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4:level4
{mso-level-text:"\(%4\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4:level5
{mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4:level6
{mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4:level7
{mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4:level8
{mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4:level9
{mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l5
{mso-list-id:777717004;
mso-list-type:hybrid;
mso-list-template-ids:2029292598 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l5:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.0in;
text-indent:-.25in;
font-family:Symbol;}
@list l5:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.5in;
text-indent:-.25in;
font-family:"Courier New";}
@list l5:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.0in;
text-indent:-.25in;
font-family:Wingdings;}
@list l5:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.5in;
text-indent:-.25in;
font-family:Symbol;}
@list l5:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.0in;
text-indent:-.25in;
font-family:"Courier New";}
@list l5:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.5in;
text-indent:-.25in;
font-family:Wingdings;}
@list l5:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.0in;
text-indent:-.25in;
font-family:Symbol;}
@list l5:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.5in;
text-indent:-.25in;
font-family:"Courier New";}
@list l5:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:5.0in;
text-indent:-.25in;
font-family:Wingdings;}
@list l6
{mso-list-id:1122531452;
mso-list-type:hybrid;
mso-list-template-ids:425082584 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l6:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:.75in;
text-indent:-.25in;
font-family:Symbol;}
@list l6:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.25in;
text-indent:-.25in;
font-family:"Courier New";}
@list l6:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.75in;
text-indent:-.25in;
font-family:Wingdings;}
@list l6:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.25in;
text-indent:-.25in;
font-family:Symbol;}
@list l6:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.75in;
text-indent:-.25in;
font-family:"Courier New";}
@list l6:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.25in;
text-indent:-.25in;
font-family:Wingdings;}
@list l6:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.75in;
text-indent:-.25in;
font-family:Symbol;}
@list l6:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.25in;
text-indent:-.25in;
font-family:"Courier New";}
@list l6:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.75in;
text-indent:-.25in;
font-family:Wingdings;}
@list l7
{mso-list-id:1351030807;
mso-list-template-ids:1318377618;}
@list l7:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l7:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l7:level3
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l7:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l7:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l7:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l7:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l7:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l7:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l8
{mso-list-id:1420060449;
mso-list-type:hybrid;
mso-list-template-ids:1811826628 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l8:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l8:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l8:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l8:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l8:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l8:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l8:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l8:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l8:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l9
{mso-list-id:1841891889;
mso-list-type:hybrid;
mso-list-template-ids:950598906 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l9:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l9:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l9:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l9:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l9:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l9:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l9:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l9:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l9:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt'>Dear Phase 2 Legal Committee,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Below, please find the notes and action items from today’s EPDP Phase 2 Legal Committee meeting.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>As a reminder, the next EPDP Phase 2 Legal Committee Meeting will be <b>Tuesday, 3 September 2019 at 14:00 UTC</b>.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Thank you.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><br>Best regards,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Marika, Berry, and Caitlin<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:10.5pt;color:black'>--<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='font-size:10.5pt;color:black'><o:p> </o:p></span></b></p><p class=MsoNormal style='margin-bottom:12.0pt'><b>EPDP Phase 2 Legal Committee Meeting #5<o:p></o:p></b></p><p class=MsoNormal style='margin-bottom:12.0pt'><b>Tuesday, 27 August 14:00 UTC<o:p></o:p></b></p><p class=MsoNormal style='margin-bottom:12.0pt'><b><u>Action Items<o:p></o:p></u></b></p><p class=MsoListParagraphCxSpFirst style='margin-bottom:12.0pt;mso-add-space:auto;text-indent:-.25in;mso-list:l9 level1 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>1.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Support Staff to add the addition of Volker and Brian to the first question: what risk or liability, if any, would the CP face for the processing activity of disclosure in this context, including the risk of a third party abusing or circumventing the safeguards?<o:p></o:p></p><ol style='margin-top:0in' start=2 type=1><li class=MsoListParagraphCxSpMiddle style='margin-left:0in;mso-add-space:auto;mso-list:l9 level1 lfo1'>Volker and Brian to edit the Question 4 to clarify use of pronouns and whose legal basis is being referred to. (For the question to be included in Batch 1, the updates will need to be circulated by 15:00 UTC on Wednesday, 28 August.<o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='margin-left:0in;mso-add-space:auto;mso-list:l9 level1 lfo1'>Support Staff to reference safeguards within Question 11 (please see italicized text). <o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='margin-left:0in;mso-add-space:auto;mso-list:l9 level1 lfo1'>Thomas, Volker, Brian and Margie to work together on refining Question 11. Legal Committee to review updated text during the next call.<o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='margin-bottom:12.0pt;margin-left:0in;mso-add-space:auto;mso-line-height-alt:11.65pt;mso-list:l9 level1 lfo1'>Margie to review the 6(1)(b) memo and reword Question 12/13 to add more specificity (in response to feedback from the plenary team). <o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-add-space:auto;mso-list:l9 level1 lfo1'>Support Staff to create a Google Doc for additional legal questions that come up in discussions. <o:p></o:p></li><li class=MsoListParagraphCxSpLast style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-add-space:auto;mso-list:l9 level1 lfo1'>Hadia and Tara to provide draft language for a question regarding automated decision making. Following receipt of the advice for the first batch of questions, the Legal Committee will assess whether this question is necessary. <o:p></o:p></li></ol><div style='mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.5pt;padding:0in 0in 1.0pt 0in'><p class=MsoNormal style='margin-bottom:12.0pt;border:none;padding:0in'><o:p> </o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><ol style='margin-top:0in' start=1 type=1><li class=MsoListParagraphCxSpFirst style='color:black;margin-bottom:12.0pt;margin-left:0in;mso-add-space:auto;mso-list:l4 level1 lfo2'><b>Roll Call & SOI Updates <o:p></o:p></b></li><li class=MsoListParagraphCxSpLast style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l4 level1 lfo2'><b>Continued Substantive Review of Priority 1 (SSAD) Legal Questions Submitted to Date</b><o:p></o:p></li></ol><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoListParagraphCxSpFirst style='margin-left:73.0pt;mso-add-space:auto;text-indent:-19.0pt;mso-list:l4 level2 lfo2'><![if !supportLists]><span style='color:black'><span style='mso-list:Ignore'>a)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>Substantive review of SSAD questions (beginning where LC left off last week)<o:p></o:p></span></p><p class=MsoListParagraphCxSpLast style='margin-left:73.0pt;mso-add-space:auto'><span style='color:black'><o:p> </o:p></span></p><ul style='margin-top:0in' type=disc><li class=paragraph style='margin-top:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;mso-list:l6 level1 lfo3;vertical-align:baseline'><b><i><span style='font-family:"Calibri",sans-serif;color:black'>Updated Merged Questions 2 and 5</span></i></b><span style='font-family:"Calibri",sans-serif;color:black'> (proposed by Brian and Thomas)</span><span style='font-family:"Calibri",sans-serif'>:<o:p></o:p></span></li></ul><p class=paragraph style='margin:0in;margin-bottom:.0001pt;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif'><o:p> </o:p></span></p><p class=paragraph style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;text-indent:.5in;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif'>Consider a System for Standardized Access/Disclosure where: <span style='color:black'><o:p></o:p></span></span></p><ul style='margin-top:0in' type=disc><ul style='margin-top:0in' type=circle><li class=paragraph style='color:black;margin-bottom:0in;margin-bottom:.0001pt;mso-list:l8 level2 lfo4;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif;color:windowtext'>contracted parties “CPs” are contractually required by ICANN to disclose registration data including personal data, </span><span style='font-family:"Calibri",sans-serif'><o:p></o:p></span></li><li class=paragraph style='color:black;margin-bottom:0in;margin-bottom:.0001pt;mso-list:l8 level2 lfo4;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif;color:windowtext'>data must be disclosed over RDAP to requestors either directly or through an intermediary request accreditation/authorization body, </span><span style='font-family:"Calibri",sans-serif'><o:p></o:p></span></li><li class=paragraph style='color:black;margin-bottom:0in;margin-bottom:.0001pt;mso-list:l8 level2 lfo4;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif;color:windowtext'>the accreditation is carried out by third party commissioned by ICANN without CP involvement, </span><span style='font-family:"Calibri",sans-serif'><o:p></o:p></span></li><li class=paragraph style='color:black;margin-bottom:0in;margin-bottom:.0001pt;mso-list:l8 level2 lfo4;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif;color:windowtext'>disclosure takes place in an automated fashion without any manual intervention, </span><span style='font-family:"Calibri",sans-serif'><o:p></o:p></span></li><li class=paragraph style='color:black;margin-bottom:0in;margin-bottom:.0001pt;mso-list:l8 level2 lfo4;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif;color:windowtext'>data subjects are being duly informed according to ICANN’s contractual requirements of the purposes for which, and types of entities by which, personal data may be processed. CP’s contract with ICANN also requires CP to notify data subject about this potential disclosure and third-party processing before the data subject enters into the registration agreement with the CP, and again annually via the ICANN-required registration data accuracy reminder. CP has done so. </span><span style='font-family:"Calibri",sans-serif'><o:p></o:p></span></li></ul></ul><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:17.25pt;margin-bottom:.0001pt;text-indent:.5in;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><span style='font-family:"Calibri",sans-serif'>Further, assume the following safeguards are in place <span style='color:black'><o:p></o:p></span></span></p><ul style='margin-top:0in' type=disc><li class=paragraph style='color:black;margin-bottom:0in;margin-left:35.25pt;margin-bottom:.0001pt;mso-list:l1 level1 lfo5;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif;color:windowtext'>ICANN or its designee has validated/verified the requestor’s identity, and required in each instance that the requestor: </span><span style='font-family:"Calibri",sans-serif'><o:p></o:p></span></li></ul><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:152.25pt;margin-bottom:.0001pt;text-indent:-63.0pt;mso-list:l1 level2 lfo5;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-family:"Calibri",sans-serif'>represents that it has a lawful basis for requesting and processing the data, <span style='color:black'><o:p></o:p></span></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:152.25pt;margin-bottom:.0001pt;text-indent:-63.0pt;mso-list:l1 level2 lfo5;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-family:"Calibri",sans-serif'>provides its lawful basis, <span style='color:black'><o:p></o:p></span></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:152.25pt;margin-bottom:.0001pt;text-indent:-63.0pt;mso-list:l1 level2 lfo5;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-family:"Calibri",sans-serif'>represents that it is requesting only the data necessary for its purpose, <span style='color:black'><o:p></o:p></span></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:152.25pt;margin-bottom:.0001pt;text-indent:-63.0pt;mso-list:l1 level2 lfo5;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-family:"Calibri",sans-serif'>agrees to process the data in accordance with GDPR, and <span style='color:black'><o:p></o:p></span></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:152.25pt;margin-bottom:.0001pt;text-indent:-63.0pt;mso-list:l1 level2 lfo5;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-family:"Calibri",sans-serif'>agrees to EU standard contractual clauses for the data transfer. <span style='color:black'><o:p></o:p></span></span></p><p class=paragraph style='margin:0in;margin-bottom:.0001pt;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><span style='font-family:"Calibri",sans-serif'> <span style='color:black'><o:p></o:p></span></span></p><ul style='margin-top:0in' type=disc><li class=paragraph style='margin-bottom:0in;margin-left:35.25pt;margin-bottom:.0001pt;mso-list:l1 level1 lfo5;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif'>ICANN or its designee logs requests for non-public registration data, regularly audits these logs, takes compliance action against suspected abuse, and makes these logs available upon request by the data subject. <o:p></o:p></span></li></ul><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:53.25pt;margin-bottom:.0001pt;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif;color:black'>1. What risk, if any, would the CP face for the processing activity of disclosure in this context? <o:p></o:p></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:53.25pt;margin-bottom:.0001pt;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><span style='font-family:"Calibri",sans-serif;color:black'>2. Would you deem the criteria and safeguards outlined above sufficient to make disclosure of registration data compliant? If any risk exists, what improved or additional safeguards would eliminate<sup>1</sup> this risk? <o:p></o:p></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:53.25pt;margin-bottom:.0001pt;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-family:"Calibri",sans-serif;color:black'>3. In this scenario, would the CP be a controller or a processor<sup>2</sup>, and to what extent, if at all, is the CP’s liability impacted by this controller/processor distinction? <o:p></o:p></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:53.25pt;margin-bottom:.0001pt;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-family:"Calibri",sans-serif;color:black'>4. Only answer if a risk still exists for the CP: If a risk still exists for the CP, what additional safeguards might be required to eliminate CP liability depending on the nature of the disclosure request, i.e. depending on whether data is requested e.g. by private actors pursuing civil claims or law enforcement authorities depending on their jurisdiction or the nature of the crime (misdemeanor or felony) or the associated sanctions (fine, imprisonment or capital punishment)?<o:p></o:p></span></p><p class=MsoNormal style='margin-left:35.25pt;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'> <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>Footnote 1:<span class=apple-converted-space> </span>“</span><span style='color:#333333;background:#FCFCFC'>Here it is important to highlight the special role that safeguards may play in reducing the undue impact on the data subjects, and thereby changing the balance of rights and interests to the extent that the data controller’s legitimate interests will not be overridden.“ (</span><span style='color:black'><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__iapp.org_media_pdf_resource-5Fcenter_wp217-5Flegitimate-2Dinterests-5F04-2D2014.pdf&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=WmQKTNAW4Y5U-c0lyA5XiCXNYR3bBOIeUD3JHAistCY&s=sWyYss17bzERUGYmyRgrLIYOWeEFfEm8TK82oD0K4Yg&e="><span style='color:#0052CC;background:#FCFCFC'>https://iapp.org/media/pdf/resource_center/wp217_legitimate-interests_04-2014.pdf</span><span class=apple-converted-space><span style='color:#954F72'> </span></span><span style='color:#954F72'>[iapp.org]</span></a></span><span style='color:#333333;background:#FCFCFC'>)</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'> <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>Footnote 2:<span class=apple-converted-space> </span><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__ec.europa.eu_info_law_law-2Dtopic_data-2Dprotection_reform_rules-2Dbusiness-2Dand-2Dorganisations_obligations_controller-2Dprocessor_what-2Ddata-2Dcontroller-2Dor-2Ddata-2Dprocessor-5Fen&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=WmQKTNAW4Y5U-c0lyA5XiCXNYR3bBOIeUD3JHAistCY&s=VLfFI2qvdMLP-znynFRMTpavBVBxa6oxjPohOdyWao0&e=" title="https://urldefense.proofpoint.com/v2/url?u=https-3A__ec.europa.eu_info_law_law-2Dtopic_data-2Dprotection_reform_rules-2Dbusiness-2Dand-2Dorganisations_obligations_controller-2Dprocessor_what-2Ddata-2Dcontroller-2Dor-2Ddata-2Dprocessor-5Fen&d=DwMGaQ&c=FmY1"><span style='color:#954F72'>https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/controller-processor/what-data-controller-or-data-processor_en [ec.europa.eu]</span></a><o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p><p class=MsoNormal><b><span style='color:black'>Notes from Meeting:<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:black'><o:p> </o:p></span></b></p><ul style='margin-top:0in' type=disc><li class=MsoListParagraphCxSpFirst style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>Consider adding a few words about the abuse of a system. This could be directly addressed in question 2 of this question. For example, do CPs face compliance risk with regard to data protection policy if the safeguards are circumvented by the requesting party and data is subsequently disclosed?<b><o:p></o:p></b></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>Perhaps a separate question should be included. Frame this question more generally – to what extent in order to protect the CPs and ICANN from liability, the safeguards need to be audited and enforced? <b><o:p></o:p></b></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>Any system, no matter how strict the safeguards are, there is a potential these can be circumvented or do not prevent all conceivable abuse. If disclosure happens that would be considered a violation, would the safeguards being in place prevent liability or risk to the CPs? Expand the language of number 2 by adding one sentence here. <b><o:p></o:p></b></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>Proposed addition: Would CPs be liable in case abuse of this system by third parties? <b><o:p></o:p></b></li><li class=MsoListParagraphCxSpLast style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>Can sufficient safeguards being in place shield CPs from risk in case of unlawful disclosures?<o:p></o:p></li><li class=paragraph style='color:black;margin-bottom:0in;margin-bottom:.0001pt;mso-list:l0 level1 lfo6;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif'>General point: our goal shouldn’t be to eliminate any potential for abuse. Consider updating question 1 – what risk or liability, if any, would the CP face for the processing activity of disclosure in this context, including the risk of a third party abusing or circumventing the safeguards? <o:p></o:p></span></li><li class=paragraph style='color:black;margin-bottom:0in;margin-bottom:.0001pt;mso-list:l0 level1 lfo6;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif'>Action: Add the addition of Volker, Brian to the first question: what risk or liability, if any, would the CP face for the processing activity of disclosure in this context, including the risk of a third party abusing or circumventing the safeguards? <o:p></o:p></span></li></ul><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><ul style='margin-top:0in' type=disc><li class=MsoListParagraph style='color:black;mso-list:l5 level1 lfo7'><b><i>Updated Question 4 </i></b>(proposed by Brian and Volker, with addition from Thomas)<i>: </i>Under the GDPR, a data controller can disclose personal data to law enforcement of competent authority under Art 6 1 c GDPR provided the law enforcement authority has the legal authority to create a legal obligation under applicable law.<o:p></o:p></li></ul><p class=MsoNormal style='margin-left:91.0pt'><span style='color:black'><o:p> </o:p></span></p><ol style='margin-top:0in' start=1 type=1><ol style='margin-top:0in' start=1 type=a><ol style='margin-top:0in' start=1 type=a><li class=MsoListParagraphCxSpFirst style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l2 level3 lfo8'>Can law enforcement agencies of other jurisdictions than the data controller/processor therefore not rely on Art 6 1 c GDPR as a legal basis for the data controller to disclose protected data? Under what circumstances could Art 6 1 c GDPR apply to the disclosure of data in such a context?<o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l2 level3 lfo8'>Do other legal bases for disclosure exist, besides Art 6I f), that the data controller/processor can rely on for such "foreign" LEAs that lack power to legally compel the data controller/processor?<o:p></o:p></li><li class=MsoListParagraphCxSpLast style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l2 level3 lfo8'>Given that European public authorities cannot use Art. 6 I f GDPR as a legal basis for processing carried out in the performance of their tasks, these need to use e.g. Art. 6 I c GDPR and need to have a European legal basis. In the light of this, is it possible for non-EU-based law enforcement authorities to use Art. 6 I f GDPR as a legal basis, since Art. 6 I c GDPR does not seem to be available for them?<o:p></o:p></li></ol></ol></ol><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='color:black'>Notes from Meeting</span></b><span style='color:black'>: <o:p></o:p></span></p><ul style='margin-top:0in' type=disc><li class=MsoListParagraphCxSpFirst style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>There are some pronouns included, but it’s not clear whether the question is referring to the disclosing party or the law enforcement agency. <o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>The updated question is very difficult to understand.<o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>It may help to clarify the pronouns.<o:p></o:p></li><li class=MsoListParagraphCxSpLast style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>Action: Volker and Brian to edit the Question 4 to clarify use of pronouns and whose legal basis is being referred to. <o:p></o:p></li></ul><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><ul style='margin-top:0in' type=disc><li class=MsoListParagraph style='color:black;mso-list:l5 level1 lfo7'><b><i>Updated Question 11</i></b> (proposed by Margie)<i>: </i>Is it permissible under GDPR to provide fast, automated, and non-rate limited responses (as described in SSAC 101) to nonpublic WHOIS data for properly credentialed security practitioners<sup>1 </sup>(as defined in SSAC 101) who are responsible for defense against e-crimes (including network operators, providers of online services, commercial security services, cyber-crime investigators) for use in investigations and mitigation activities to protect their network, information systems or services (as referenced in GDPR Recital 49) and have agreed on appropriate safeguards? Or would any automated disclosure carry a potential for liability of the disclosing party, or the controllers or processors of such data? Can counsel provide examples of safeguards (such as pseudonymization/anonymization) that should be considered?<o:p></o:p></li></ul><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:71.25pt'><i><span style='color:black'>For purposes of this question, please assume the following safeguards are in place: <o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:71.25pt'><i><span style='color:black'><o:p> </o:p></span></i></p><p class=MsoNormal style='margin-left:71.25pt'><i><span style='color:black'>• Disclosure is required under CP’s contract with ICANN (resulting from Phase 2 EPDP policy).<o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:71.25pt'><i><span style='color:black'>• CP’s contract with ICANN requires CP to notify the data subject of the purposes for which, and types of entities by which, personal data may be processed. CP is required to notify data subject of this with the opportunity to opt out before the data subject enters into the registration agreement with the CP, and again annually via the ICANN-required registration data accuracy reminder. CP has done so.<o:p></o:p></span></i></p><ul style='margin-top:0in' type=disc><li class=paragraph style='color:black;margin-bottom:0in;margin-left:35.25pt;margin-bottom:.0001pt;mso-list:l1 level1 lfo5;vertical-align:baseline'><i><span style='font-family:"Calibri",sans-serif'>ICANN or its designee has validated/verified the requestor’s identity, and required in each instance that the requestor: <o:p></o:p></span></i></li></ul><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:152.25pt;margin-bottom:.0001pt;text-indent:-63.0pt;mso-list:l1 level2 lfo5;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><i><span style='font-family:"Calibri",sans-serif;color:black'>represents that it has a lawful basis for requesting and processing the data, <o:p></o:p></span></i></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:152.25pt;margin-bottom:.0001pt;text-indent:-63.0pt;mso-list:l1 level2 lfo5;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><i><span style='font-family:"Calibri",sans-serif;color:black'>provides its lawful basis, <o:p></o:p></span></i></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:152.25pt;margin-bottom:.0001pt;text-indent:-63.0pt;mso-list:l1 level2 lfo5;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><i><span style='font-family:"Calibri",sans-serif;color:black'>represents that it is requesting only the data necessary for its purpose, <o:p></o:p></span></i></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:152.25pt;margin-bottom:.0001pt;text-indent:-63.0pt;mso-list:l1 level2 lfo5;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><i><span style='font-family:"Calibri",sans-serif;color:black'>agrees to process the data in accordance with GDPR, and <o:p></o:p></span></i></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:152.25pt;margin-bottom:.0001pt;text-indent:-63.0pt;mso-list:l1 level2 lfo5;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><i><span style='font-family:"Calibri",sans-serif;color:black'>agrees to EU standard contractual clauses for the data transfer. <o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:1.0in;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='color:black'>Footnote 1: SSAC defines “security practitioners” in SSAC 101 as those who have a responsibility to perform specific types of functions (as specified in Section 3) related to the identification and mitigation of malicious activity, and the correction of problems that negatively affect services and users online.<o:p></o:p></span></p><p class=MsoNormal><b><span style='color:black'><o:p> </o:p></span></b></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='color:black'>Notes from Meeting<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:black'><o:p> </o:p></span></b></p><ul style='margin-top:0in' type=disc><li class=MsoListParagraphCxSpFirst style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>It may be helpful to refer back to the previous question? Add further bullet points to Question 11. <o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>The wording of security practitioners is too broad. In order for the question to be helpful, we will need to figure out who is in the circle of practitioners. <o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>Action: Support staff to reference safeguards within this question (please see italicized text). <o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>Security practitioners is too open – this definition needs to be tied down to make it an answerable question. The question should be more focused on the risk.<o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>This question is meant to address the situation with properly-credentialed security practitioners – the way to reduce the scope is through the accreditation of the security practitioners. <o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>This question is not ready for submission to outside counsel.<o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>Action: Thomas, Volker, Brian and Margie to work together on refining this question. Legal Committee to review in the next call.<o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>This question has two aspects: ask if only we install certain safeguards whether unlimited access to the data can be granted to security researchers. That is a good question for us to ask. The other aspect of this – if the first question is answered negatively, if it is not possible to allow accreditation-based access to queries <o:p></o:p></li><li class=MsoListParagraphCxSpLast style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>This is not intended to be a security researcher generally – for use in investigations and mitigation activities to protect their network, information systems or services<o:p></o:p></li></ul><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><ul style='margin-top:0in' type=disc><li class=MsoListParagraphCxSpFirst style='margin-bottom:12.0pt;mso-add-space:auto;mso-line-height-alt:11.65pt;mso-list:l5 level1 lfo7'><b><span style='color:black'>Updated Question 12 and 13</span></b><span style='color:black'>: LC to review simplified question before sending to EPDP Team for sign off: In light of the<span class=apple-converted-space> </span><a href="https://www.icann.org/en/system/files/correspondence/odonohue-to-marby-03may19-en.pdf" title="https://www.icann.org/en/system/files/correspondence/odonohue-to-marby-03may19-en.pdf"><span style='color:#954F72'>3 May 2019 correspondence from the European Commission</span></a>, are any updates on the<span class=apple-converted-space> </span><a href="https://community.icann.org/download/attachments/102138857/6%281%29%28b%29%20Memo.docx?version=1&modificationDate=1548874809000&api=v2"><span style='color:#954F72'>previous memo on 6(1)(b)</span></a><span class=apple-converted-space> </span>necessary?<span class=apple-converted-space> </span></span><span class=apple-converted-space><o:p></o:p></span></li><ul style='margin-top:0in' type=circle><li class=MsoListParagraphCxSpLast style='margin-bottom:12.0pt;mso-add-space:auto;mso-line-height-alt:11.65pt;mso-list:l5 level2 lfo7'><span style='color:black'>Based on the feedback during the plenary call (question is too broad), would the LC like to propose updated wording to this question?</span><o:p></o:p></li></ul></ul><p class=MsoNormal style='margin-bottom:12.0pt;mso-line-height-alt:11.65pt'><span class=apple-converted-space><b><span style='color:black'>Notes from Meeting:</span><o:p></o:p></b></span></p><ul style='margin-top:0in' type=disc><li class=MsoListParagraphCxSpFirst style='color:black;margin-bottom:12.0pt;margin-left:0in;mso-add-space:auto;mso-line-height-alt:11.65pt;mso-list:l0 level1 lfo6'><span class=apple-converted-space>EPDP Plenary noted during last week’s call that this language is too broad.<o:p></o:p></span></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-bottom:12.0pt;margin-left:0in;mso-add-space:auto;mso-line-height-alt:11.65pt;mso-list:l0 level1 lfo6'><span class=apple-converted-space>Margie to take a fresh look at the memo and make the question more specific. <o:p></o:p></span></li></ul><p class=MsoListParagraphCxSpMiddle style='margin-bottom:12.0pt;mso-add-space:auto;mso-line-height-alt:11.65pt'><b><o:p> </o:p></b></p><ul type=disc><li class=MsoListParagraphCxSpLast style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-add-space:auto;mso-list:l5 level1 lfo7'><b><i>Question 6: </i></b><i>Within the context of an SSAD, in addition to determining its own lawful basis for disclosing data, does the requestee (entity that houses the requested data) need to assess the lawful basis of the third-party requestor? (Question from ICANN65 from GAC/IPC)<b><o:p></o:p></b></i></li></ul><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.5in'><span style='color:black'>Note: awaiting updated text from Brian/Georgios<o:p></o:p></span></p><ul type=disc><li class=MsoListParagraphCxSpFirst style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>Brian and Georgios still trying to connect. Brian and Laureen will chat on the law enforcement question, so perhaps they can discuss this question for the next call. <o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>Support Staff to create a Google Doc for additional legal questions that come up in discussions. <o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>Does the group support a standalone question in reference to automation? The group needs more clarity on automation. <o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>It is OK to think about automation, but it seems difficult to ask this question. The answer, though, will likely be “it depends”. <o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>How is this question not already going to be answered by the response to merged question 2/5 and the response to 11. Perhaps add more into the questions about automation. <o:p></o:p></li><li class=MsoListParagraphCxSpLast style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-add-space:auto;mso-list:l0 level1 lfo6'>Hadia and Tara to provide draft language for a question regarding automated decision making. Following receipt of the advice for the first batch of questions, the team will assess whether this question <o:p></o:p></li></ul><p class=MsoNormal style='margin-bottom:12.0pt;mso-line-height-alt:11.65pt'><b><span style='color:black'><o:p> </o:p></span></b></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoFootnoteText style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:310.0pt;margin-bottom:.0001pt'><a name="_ftn1"></a><a href="applewebdata://68B0E022-B472-4D73-B3D4-09BBCC4682C7#_ftnref1"><span style='mso-bookmark:_ftn1'><span class=MsoFootnoteReference><sup><span style='font-size:12.0pt;font-family:"Calibri",sans-serif;color:#954F72'>[1]</span></sup></span></span><span style='mso-bookmark:_ftn1'></span></a><span style='mso-bookmark:_ftn1'></span><span class=apple-converted-space><span style='font-size:12.0pt;color:black'> </span></span><span style='font-size:12.0pt;color:black'>“Here it is important to highlight the special role that safeguards may play in reducing the undue impact on the data subjects, and thereby changing the balance of rights and interests to the extent that the data controller’s legitimate interests will not be overridden.“ (<a href="https://iapp.org/media/pdf/resource_center/wp217_legitimate-interests_04-2014.pdf" title="https://iapp.org/media/pdf/resource_center/wp217_legitimate-interests_04-2014.pdf"><span style='color:#954F72'>https://iapp.org/media/pdf/resource_center/wp217_legitimate-interests_04-2014.pdf</span></a>)<o:p></o:p></span></p><p class=MsoFootnoteText style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:310.0pt;margin-bottom:.0001pt'><a name="_ftn2"></a><a href="applewebdata://68B0E022-B472-4D73-B3D4-09BBCC4682C7#_ftnref2"><span style='mso-bookmark:_ftn2'><span class=MsoFootnoteReference><sup><span style='font-size:12.0pt;font-family:"Calibri",sans-serif;color:#954F72'>[2]</span></sup></span></span><span style='mso-bookmark:_ftn2'></span></a><span style='mso-bookmark:_ftn2'></span><span class=apple-converted-space><span style='font-size:12.0pt;color:black'> </span></span><span style='font-size:12.0pt;color:black'><a href="https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/controller-processor/what-data-controller-or-data-processor_en" title="https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/controller-processor/what-data-controller-or-data-processor_en"><span style='color:#954F72'>https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/controller-processor/what-data-controller-or-data-processor_en</span></a><o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoListParagraph style='margin-left:73.0pt;mso-add-space:auto;text-indent:-19.0pt;mso-list:l4 level2 lfo2'><![if !supportLists]><span style='color:black'><span style='mso-list:Ignore'>b)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>Agree on next steps<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><ol style='margin-top:0in' start=3 type=1><li class=MsoListParagraphCxSpFirst style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l4 level1 lfo2'><b>Wrap and confirm next meeting to be scheduled <o:p></o:p></b></li></ol><p class=MsoListParagraphCxSpMiddle style='margin-left:73.0pt;mso-add-space:auto;text-indent:-19.0pt;mso-list:l4 level2 lfo2'><![if !supportLists]><span style='color:black'><span style='mso-list:Ignore'>a)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>Confirm action items<o:p></o:p></span></p><p class=MsoListParagraphCxSpLast style='margin-left:73.0pt;mso-add-space:auto;text-indent:-19.0pt;mso-list:l4 level2 lfo2'><![if !supportLists]><span style='color:black'><span style='mso-list:Ignore'>b)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>The next LC Meeting will take place on Tuesday, 3 September at 14:00 UTC.<o:p></o:p></span></p><span style='font-size:12.0pt;font-family:"Calibri",sans-serif;color:black;mso-fareast-language:EN-US'><br clear=all style='page-break-before:always'></span><p class=MsoNormal><span style='color:black'>__________________<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><b><u><span style='color:black'>Batch 1<o:p></o:p></span></u></b></p><p class=MsoNormal><b><u><span style='color:black'><o:p><span style='text-decoration:none'> </span></o:p></span></u></b></p><p class=paragraph style='margin:0in;margin-bottom:.0001pt;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif;color:black'>1. (Formerly Q2/5) Consider a System for Standardized Access/Disclosure where: <o:p></o:p></span></p><ul style='margin-top:0in' type=disc><ul style='margin-top:0in' type=circle><li class=paragraph style='color:black;margin-bottom:0in;margin-bottom:.0001pt;mso-list:l8 level2 lfo4;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif'>contracted parties “CPs” are contractually required by ICANN to disclose registration data including personal data, <o:p></o:p></span></li><li class=paragraph style='color:black;margin-bottom:0in;margin-bottom:.0001pt;mso-list:l8 level2 lfo4;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif'>data must be disclosed over RDAP to requestors either directly or through an intermediary request accreditation/authorization body, <o:p></o:p></span></li><li class=paragraph style='color:black;margin-bottom:0in;margin-bottom:.0001pt;mso-list:l8 level2 lfo4;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif'>the accreditation is carried out by third party commissioned by ICANN without CP involvement, <o:p></o:p></span></li><li class=paragraph style='color:black;margin-bottom:0in;margin-bottom:.0001pt;mso-list:l8 level2 lfo4;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif'>disclosure takes place in an automated fashion without any manual intervention, <o:p></o:p></span></li><li class=paragraph style='color:black;margin-bottom:0in;margin-bottom:.0001pt;mso-list:l8 level2 lfo4;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif'>data subjects are being duly informed according to ICANN’s contractual requirements of the purposes for which, and types of entities by which, personal data may be processed. CP’s contract with ICANN also requires CP to notify data subject about this potential disclosure and third-party processing before the data subject enters into the registration agreement with the CP, and again annually via the ICANN-required registration data accuracy reminder. CP has done so. <o:p></o:p></span></li></ul></ul><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:17.25pt;margin-bottom:.0001pt;text-indent:.5in;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><span style='font-family:"Calibri",sans-serif;color:black'>Further, assume the following safeguards are in place <o:p></o:p></span></p><ul style='margin-top:0in' type=disc><li class=paragraph style='color:black;margin-bottom:0in;margin-left:35.25pt;margin-bottom:.0001pt;mso-list:l1 level1 lfo5;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif'>ICANN or its designee has validated/verified the requestor’s identity, and required in each instance that the requestor: <o:p></o:p></span></li></ul><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:152.25pt;margin-bottom:.0001pt;text-indent:-63.0pt;mso-list:l1 level2 lfo5;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-family:"Calibri",sans-serif;color:black'>represents that it has a lawful basis for requesting and processing the data, <o:p></o:p></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:152.25pt;margin-bottom:.0001pt;text-indent:-63.0pt;mso-list:l1 level2 lfo5;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-family:"Calibri",sans-serif;color:black'>provides its lawful basis, <o:p></o:p></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:152.25pt;margin-bottom:.0001pt;text-indent:-63.0pt;mso-list:l1 level2 lfo5;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-family:"Calibri",sans-serif;color:black'>represents that it is requesting only the data necessary for its purpose, <o:p></o:p></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:152.25pt;margin-bottom:.0001pt;text-indent:-63.0pt;mso-list:l1 level2 lfo5;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-family:"Calibri",sans-serif;color:black'>agrees to process the data in accordance with GDPR, and <o:p></o:p></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:152.25pt;margin-bottom:.0001pt;text-indent:-63.0pt;mso-list:l1 level2 lfo5;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-family:"Calibri",sans-serif;color:black'>agrees to EU standard contractual clauses for the data transfer. <o:p></o:p></span></p><p class=paragraph style='margin:0in;margin-bottom:.0001pt;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;-webkit-user-drag: none;overflow-wrap: break-word;word-spacing:0px'><span style='font-family:"Calibri",sans-serif;color:black'> <o:p></o:p></span></p><ul style='margin-top:0in' type=disc><li class=paragraph style='color:black;margin-bottom:0in;margin-left:35.25pt;margin-bottom:.0001pt;mso-list:l1 level1 lfo5;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif'>ICANN or its designee logs requests for non-public registration data, regularly audits these logs, takes compliance action against suspected abuse, and makes these logs available upon request by the data subject. <o:p></o:p></span></li></ul><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:53.25pt;margin-bottom:.0001pt;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif;color:black'>1. What risk or liability, if any, would the CP face for the processing activity of disclosure in this context, including the risk of a third party abusing or circumventing the safeguards? <o:p></o:p></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:53.25pt;margin-bottom:.0001pt;vertical-align:baseline'><span style='font-family:"Calibri",sans-serif;color:black'>2. Would you deem the criteria and safeguards outlined above sufficient to make disclosure of registration data compliant? If any risk exists, what improved or additional safeguards would eliminate<sup>1</sup> this risk? <o:p></o:p></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:53.25pt;margin-bottom:.0001pt;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-family:"Calibri",sans-serif;color:black'>3. In this scenario, would the CP be a controller or a processor<sup>2</sup>, and to what extent, if at all, is the CP’s liability impacted by this controller/processor distinction? <o:p></o:p></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:53.25pt;margin-bottom:.0001pt;vertical-align:baseline;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-family:"Calibri",sans-serif;color:black'>4. Only answer if a risk still exists for the CP: If a risk still exists for the CP, what additional safeguards might be required to eliminate CP liability depending on the nature of the disclosure request, i.e. depending on whether data is requested e.g. by private actors pursuing civil claims or law enforcement authorities depending on their jurisdiction or the nature of the crime (misdemeanor or felony) or the associated sanctions (fine, imprisonment or capital punishment)?<o:p></o:p></span></p><p class=MsoNormal style='margin-left:35.25pt;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'> <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>Footnote 1:<span class=apple-converted-space> </span>“</span><span style='color:#333333;background:#FCFCFC'>Here it is important to highlight the special role that safeguards may play in reducing the undue impact on the data subjects, and thereby changing the balance of rights and interests to the extent that the data controller’s legitimate interests will not be overridden.“ (</span><span style='color:black'><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__iapp.org_media_pdf_resource-5Fcenter_wp217-5Flegitimate-2Dinterests-5F04-2D2014.pdf&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=WmQKTNAW4Y5U-c0lyA5XiCXNYR3bBOIeUD3JHAistCY&s=sWyYss17bzERUGYmyRgrLIYOWeEFfEm8TK82oD0K4Yg&e="><span style='color:#0052CC;background:#FCFCFC'>https://iapp.org/media/pdf/resource_center/wp217_legitimate-interests_04-2014.pdf</span><span class=apple-converted-space><span style='color:#954F72'> </span></span><span style='color:#954F72'>[iapp.org]</span></a></span><span style='color:#333333;background:#FCFCFC'>)</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'> <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>Footnote 2:<span class=apple-converted-space> </span><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__ec.europa.eu_info_law_law-2Dtopic_data-2Dprotection_reform_rules-2Dbusiness-2Dand-2Dorganisations_obligations_controller-2Dprocessor_what-2Ddata-2Dcontroller-2Dor-2Ddata-2Dprocessor-5Fen&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=WmQKTNAW4Y5U-c0lyA5XiCXNYR3bBOIeUD3JHAistCY&s=VLfFI2qvdMLP-znynFRMTpavBVBxa6oxjPohOdyWao0&e=" title="https://urldefense.proofpoint.com/v2/url?u=https-3A__ec.europa.eu_info_law_law-2Dtopic_data-2Dprotection_reform_rules-2Dbusiness-2Dand-2Dorganisations_obligations_controller-2Dprocessor_what-2Ddata-2Dcontroller-2Dor-2Ddata-2Dprocessor-5Fen&d=DwMGaQ&c=FmY1"><span style='color:#954F72'>https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/controller-processor/what-data-controller-or-data-processor_en [ec.europa.eu]</span></a><o:p></o:p></span></p><p class=MsoListParagraph style='margin-left:1.5in;mso-add-space:auto'><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'> <o:p></o:p></span></p><ol style='margin-top:0in' start=2 type=1><li class=MsoListParagraphCxSpFirst style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l2 level1 lfo8'>(Formerly Q7)<span class=apple-converted-space> </span>To what extent, if any, are contracted parties liable when a third party that accesses non-public WHOIS data under an accreditation scheme where by the accessor is accredited for the stated purpose, commits to certain reasonable safeguards similar to a code of conduct regarding use of the data, but misrepresents their intended purposes for processing such data, and subsequently processes it in a manner inconsistent with the stated purpose. Under such circumstances, if there is possibility of liability to contracted parties, are there steps that can be taken to mitigate or reduce the risk of liability to the contracted parties?<o:p></o:p></li></ol><p class=MsoListParagraphCxSpMiddle style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'> <o:p></o:p></span></p><ol style='margin-top:0in' start=3 type=1><li class=MsoListParagraphCxSpLast style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l2 level1 lfo8'>(Formerly Q9) Assuming that there is a policy that allows accredited parties to access non-public WHOIS data through an SSAD (and requires the accredited party to commit to certain reasonable safeguards similar to a code of conduct), is it legally permissible under Article 6(1)(f) to:<o:p></o:p></li></ol><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'> <o:p></o:p></span></p><p class=MsoListParagraphCxSpFirst style='margin-left:.75in;mso-add-space:auto;text-indent:-.25in;mso-list:l3 level1 lfo9'><![if !supportLists]><span style='font-size:10.0pt;font-family:Symbol;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>define specific categories of requests from accredited parties (e.g. rapid response to a malware attack or contacting a non-responsive IP infringer), for which there can be automated submissions for non-public WHOIS data, without having to manually verify the qualifications of the accredited parties for each individual disclosure request, and/or<o:p></o:p></span></p><p class=MsoListParagraphCxSpLast style='margin-left:.75in;mso-add-space:auto;text-indent:-.25in;mso-list:l3 level1 lfo9'><![if !supportLists]><span style='font-size:10.0pt;font-family:Symbol;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>enable automated disclosures of such data, without requiring a manual review by the controller or processor of each individual disclosure request.<o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'>In addition, if it is not possible to automate any of these steps, please provide any guidance for how to perform the balancing test under Article 6(1)(f).<o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'> <o:p></o:p></span></p><p class=MsoNormal style='margin-left:.25in;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'>For reference, please refer to the following potential safeguards:<span class=apple-converted-space> </span><o:p></o:p></span></p><p class=MsoNormal style='margin-left:.25in;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'> <o:p></o:p></span></p><p class=MsoListParagraphCxSpFirst style='margin-left:.75in;mso-add-space:auto;text-indent:-.25in;mso-list:l7 level1 lfo10'><![if !supportLists]><span style='font-size:10.0pt;font-family:Symbol;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>Disclosure is required under CP’s contract with ICANN (resulting from Phase 2 EPDP policy).<o:p></o:p></span></p><p class=MsoListParagraphCxSpMiddle style='margin-left:.75in;mso-add-space:auto;text-indent:-.25in;mso-list:l7 level1 lfo10'><![if !supportLists]><span style='font-size:10.0pt;font-family:Symbol;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>CP’s contract with ICANN requires CP to notify the data subject of the purposes for which, and types of entities by which, personal data may be processed. CP is required to notify data subject of this with the opportunity to opt out before the data subject enters into the registration agreement with the CP, and again annually via the ICANN-required registration data accuracy reminder. CP has done so.<span class=apple-converted-space> </span><o:p></o:p></span></p><p class=MsoListParagraphCxSpMiddle style='margin-left:.75in;mso-add-space:auto;text-indent:-.25in;mso-list:l7 level1 lfo10'><![if !supportLists]><span style='font-size:10.0pt;font-family:Symbol;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>ICANN or its designee has validated the requestor’s identity, and required that the requestor:<span class=apple-converted-space> </span><o:p></o:p></span></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.25in;mso-add-space:auto;text-indent:-.25in;mso-list:l7 level2 lfo10'><![if !supportLists]><span style='font-size:10.0pt;font-family:"Courier New";color:black'><span style='mso-list:Ignore'>o<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>represents that it has a lawful basis for requesting and processing the data,<span class=apple-converted-space> </span><o:p></o:p></span></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.25in;mso-add-space:auto;text-indent:-.25in;mso-list:l7 level2 lfo10'><![if !supportLists]><span style='font-size:10.0pt;font-family:"Courier New";color:black'><span style='mso-list:Ignore'>o<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>provides its lawful basis,<o:p></o:p></span></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.25in;mso-add-space:auto;text-indent:-.25in;mso-list:l7 level2 lfo10'><![if !supportLists]><span style='font-size:10.0pt;font-family:"Courier New";color:black'><span style='mso-list:Ignore'>o<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>represents that it is requesting only the data necessary for its purpose,<span class=apple-converted-space> </span><o:p></o:p></span></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.25in;mso-add-space:auto;text-indent:-.25in;mso-list:l7 level2 lfo10'><![if !supportLists]><span style='font-size:10.0pt;font-family:"Courier New";color:black'><span style='mso-list:Ignore'>o<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>agrees to process the data in accordance with GDPR, and<span class=apple-converted-space> </span><o:p></o:p></span></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.25in;mso-add-space:auto;text-indent:-.25in;mso-list:l7 level2 lfo10'><![if !supportLists]><span style='font-size:10.0pt;font-family:"Courier New";color:black'><span style='mso-list:Ignore'>o<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>agrees to standard contractual clauses for the data transfer.<span class=apple-converted-space> </span><o:p></o:p></span></p><p class=MsoListParagraphCxSpMiddle style='margin-left:.75in;mso-add-space:auto;text-indent:-.25in;mso-list:l7 level1 lfo10'><![if !supportLists]><span style='font-size:10.0pt;font-family:Symbol;color:black'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>ICANN or its designee logs requests for non-public registration data, regularly audits these logs, takes compliance action against suspected abuse, and makes these logs available upon request by the data subject.<o:p></o:p></span></p><p class=MsoListParagraphCxSpLast style='margin-left:.75in;mso-add-space:auto;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'> <o:p></o:p></span></p><span style='font-size:12.0pt;font-family:"Calibri",sans-serif;color:black;mso-fareast-language:EN-US'><br clear=all style='page-break-before:always'></span><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Times New Roman",serif;color:black'><o:p> </o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>