<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
p.paragraph, li.paragraph, div.paragraph
{mso-style-name:paragraph;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:53630411;
mso-list-template-ids:1016745106;}
@list l0:level1
{mso-level-start-at:2;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-start-at:2;
mso-level-number-format:alpha-lower;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level4
{mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level7
{mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1
{mso-list-id:387651328;
mso-list-type:hybrid;
mso-list-template-ids:146720664 67698691 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.5in;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.0in;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.5in;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.0in;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.5in;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.0in;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.5in;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:5.0in;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:5.5in;
text-indent:-.25in;
font-family:Wingdings;}
@list l2
{mso-list-id:505556444;
mso-list-type:hybrid;
mso-list-template-ids:232442188 67698691 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l2:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l2:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l2:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l2:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l2:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l2:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l2:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l2:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l3
{mso-list-id:536352811;
mso-list-type:hybrid;
mso-list-template-ids:-174791112 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l3:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.25in;
text-indent:-.25in;
font-family:Symbol;}
@list l3:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.75in;
text-indent:-.25in;
font-family:"Courier New";}
@list l3:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.25in;
text-indent:-.25in;
font-family:Wingdings;}
@list l3:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.75in;
text-indent:-.25in;
font-family:Symbol;}
@list l3:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.25in;
text-indent:-.25in;
font-family:"Courier New";}
@list l3:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.75in;
text-indent:-.25in;
font-family:Wingdings;}
@list l3:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.25in;
text-indent:-.25in;
font-family:Symbol;}
@list l3:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.75in;
text-indent:-.25in;
font-family:"Courier New";}
@list l3:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:5.25in;
text-indent:-.25in;
font-family:Wingdings;}
@list l4
{mso-list-id:583146561;
mso-list-template-ids:1546040766;}
@list l4:level1
{mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Times New Roman",serif;
mso-ascii-font-family:Calibri;
mso-hansi-font-family:Calibri;
mso-bidi-font-family:Calibri;
mso-ansi-font-weight:bold;
mso-bidi-font-weight:bold;}
@list l4:level2
{mso-level-number-format:alpha-lower;
mso-level-text:"%2\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:73.0pt;
text-indent:-19.0pt;}
@list l4:level3
{mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4:level4
{mso-level-text:"\(%4\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4:level5
{mso-level-start-at:2;
mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Calibri",sans-serif;
mso-fareast-font-family:"Times New Roman";}
@list l4:level6
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:236.0pt;
text-indent:-38.0pt;}
@list l4:level7
{mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4:level8
{mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4:level9
{mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l5
{mso-list-id:743838231;
mso-list-template-ids:1324244240;}
@list l5:level1
{mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Times New Roman",serif;
mso-ascii-font-family:Calibri;
mso-hansi-font-family:Calibri;
mso-bidi-font-family:Calibri;
mso-ansi-font-weight:bold;
mso-bidi-font-weight:bold;}
@list l5:level2
{mso-level-number-format:alpha-lower;
mso-level-text:"%2\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:73.0pt;
text-indent:-19.0pt;}
@list l5:level3
{mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l5:level4
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l5:level5
{mso-level-start-at:2;
mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Calibri",sans-serif;
mso-fareast-font-family:"Times New Roman";}
@list l5:level6
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:236.0pt;
text-indent:-38.0pt;}
@list l5:level7
{mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l5:level8
{mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l5:level9
{mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l6
{mso-list-id:777717004;
mso-list-type:hybrid;
mso-list-template-ids:-2046496690 67698689 67698691 -1336368414 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l6:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.0in;
text-indent:-.25in;
font-family:Symbol;}
@list l6:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.5in;
text-indent:-.25in;
font-family:"Courier New";}
@list l6:level3
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:•;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:163.0pt;
text-indent:-37.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-font-family:"Times New Roman";}
@list l6:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.5in;
text-indent:-.25in;
font-family:Symbol;}
@list l6:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.0in;
text-indent:-.25in;
font-family:"Courier New";}
@list l6:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.5in;
text-indent:-.25in;
font-family:Wingdings;}
@list l6:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.0in;
text-indent:-.25in;
font-family:Symbol;}
@list l6:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.5in;
text-indent:-.25in;
font-family:"Courier New";}
@list l6:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:5.0in;
text-indent:-.25in;
font-family:Wingdings;}
@list l7
{mso-list-id:850296354;
mso-list-template-ids:1916438666;}
@list l7:level1
{mso-level-tab-stop:1.5in;
mso-level-number-position:left;
margin-left:1.5in;
text-indent:-.25in;}
@list l7:level2
{mso-level-tab-stop:2.0in;
mso-level-number-position:left;
margin-left:2.0in;
text-indent:-.25in;}
@list l7:level3
{mso-level-tab-stop:2.5in;
mso-level-number-position:left;
margin-left:2.5in;
text-indent:-.25in;}
@list l7:level4
{mso-level-tab-stop:3.0in;
mso-level-number-position:left;
margin-left:3.0in;
text-indent:-.25in;}
@list l7:level5
{mso-level-tab-stop:3.5in;
mso-level-number-position:left;
margin-left:3.5in;
text-indent:-.25in;}
@list l7:level6
{mso-level-tab-stop:4.0in;
mso-level-number-position:left;
margin-left:4.0in;
text-indent:-.25in;}
@list l7:level7
{mso-level-tab-stop:4.5in;
mso-level-number-position:left;
margin-left:4.5in;
text-indent:-.25in;}
@list l7:level8
{mso-level-tab-stop:5.0in;
mso-level-number-position:left;
margin-left:5.0in;
text-indent:-.25in;}
@list l7:level9
{mso-level-tab-stop:5.5in;
mso-level-number-position:left;
margin-left:5.5in;
text-indent:-.25in;}
@list l8
{mso-list-id:904796538;
mso-list-template-ids:725809524;}
@list l8:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l8:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l8:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l8:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l8:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l8:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l8:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l8:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l8:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l9
{mso-list-id:1284113958;
mso-list-type:hybrid;
mso-list-template-ids:997379400 67698713 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l9:level1
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.0in;
text-indent:-.25in;}
@list l9:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.5in;
text-indent:-.25in;}
@list l9:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
margin-left:3.0in;
text-indent:-9.0pt;}
@list l9:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.5in;
text-indent:-.25in;}
@list l9:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.0in;
text-indent:-.25in;}
@list l9:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
margin-left:4.5in;
text-indent:-9.0pt;}
@list l9:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:5.0in;
text-indent:-.25in;}
@list l9:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:5.5in;
text-indent:-.25in;}
@list l9:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
margin-left:6.0in;
text-indent:-9.0pt;}
@list l10
{mso-list-id:1610770818;
mso-list-template-ids:-414529932;}
@list l10:level1
{mso-level-start-at:2;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l10:level2
{mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l10:level3
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l10:level4
{mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l10:level5
{mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l10:level6
{mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l10:level7
{mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l10:level8
{mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l10:level9
{mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l11
{mso-list-id:2066105954;
mso-list-type:hybrid;
mso-list-template-ids:-467118468 67698691 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l11:level1
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l11:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l11:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l11:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l11:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l11:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l11:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l11:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l11:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt'>Dear EPDP Phase 2 Legal Committee:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Please find the notes and action items from the last Legal Committee meeting below.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>As a reminder, the next EPDP Phase 2 Legal Committee meeting will be <b>Tuesday, 15 October at 14:00 UTC</b>.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Best regards,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Marika, Berry, and Caitlin<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt'><b>EPDP Phase 2 Legal Committee Meeting #8<o:p></o:p></b></p><p class=MsoNormal style='margin-bottom:12.0pt'><b>Tuesday, 1 October at 14:00 UTC<o:p></o:p></b></p><p class=MsoNormal style='margin-bottom:12.0pt'><b>Proposed Annotated Agenda<o:p></o:p></b></p><p class=MsoNormal style='margin-bottom:12.0pt'><u>Action Items<o:p></o:p></u></p><p class=MsoNormal>1. Matthew, Brian, Margie, Stephanie and Hadia to provide high-level summaries of legal memos for the plenary to review by <b>Monday, 14 October</b>. <o:p></o:p></p><p class=MsoNormal>2. <span style='color:black'>LC to review Margie’s proposed updated text to Question 11 (re: security practitioners). LC to discuss the question (and any proposed updates) during the next call on Tuesday, 15 October.<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>3. Brian and Matthew to summarize the two positions re: questions 12 and 13 and propose whether Bird & Bird should opine on this. Legal Committee to discuss the positions during its next meeting. <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>4. Legal Committee to review the SSAC-proposed questions and consider which questions may be dependent on results of a legal vs. natural study and which questions are not dependent on the study.<o:p></o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><ol style='margin-top:0in' start=1 type=1><li class=MsoListParagraphCxSpFirst style='color:black;margin-bottom:12.0pt;margin-left:0in;mso-add-space:auto;mso-list:l4 level1 lfo1'><b>Roll Call & SOI Updates <o:p></o:p></b></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-bottom:12.0pt;margin-left:0in;mso-add-space:auto;mso-list:l4 level1 lfo1'><b>Housekeeping <o:p></o:p></b></li></ol><ul style='margin-top:0in' type=disc><li class=MsoListParagraphCxSpMiddle style='color:black;margin-bottom:12.0pt;margin-left:.75in;mso-add-space:auto;mso-list:l3 level1 lfo2'>Legal Committee to provide high-level summary of legal memos for the plenary to review – Volunteers needed<b><o:p></o:p></b></li><ul style='margin-top:0in' type=circle><li class=MsoListParagraphCxSpMiddle style='color:black;margin-bottom:12.0pt;margin-left:.75in;mso-add-space:auto;mso-list:l3 level2 lfo2'>Matt C., Brian, and Margie to volunteer to draft summaries of the legal memos<b><o:p></o:p></b></li></ul></ul><p class=MsoListParagraphCxSpMiddle style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:73.0pt;mso-add-space:auto'><b><span style='color:black'><o:p> </o:p></span></b></p><ol style='margin-top:0in' start=3 type=1><li class=MsoListParagraphCxSpLast style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l4 level1 lfo1'><b>Continued Substantive Review of Priority 1 (SSAD) Legal Questions Submitted to Date</b><o:p></o:p></li></ol><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoListParagraph style='margin-left:73.0pt;mso-add-space:auto;text-indent:-19.0pt;mso-list:l4 level2 lfo1'><![if !supportLists]><span style='color:black'><span style='mso-list:Ignore'>a)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>Substantive review of SSAD questions (beginning where LC left off during last LC meeting)<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><b><u><span style='color:black'>Updated Question 11<span style='border:solid windowtext 1.0pt;padding:0in'> </span></span></u></b><u><span style='color:black;border:solid windowtext 1.0pt;padding:0in'> <b> </b></span></u><u><o:p></o:p></u></p><p class=MsoListParagraph style='margin-left:1.0in;mso-add-space:auto'><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><i><span style='color:black'>Status: Thomas, Volker, Brian and Margie to work together on refining this question in advance of the next LC call on Tuesday, 1 October.<o:p></o:p></span></i></p><p class=MsoListParagraph style='margin-left:1.0in;mso-add-space:auto'><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>(Previous text proposed by Margie)<i>: </i>Is it permissible under GDPR to provide fast, automated, and non-rate limited responses (as described in SSAC 101) to nonpublic WHOIS data for properly credentialed security practitioners<sup>1 </sup>(as defined in SSAC 101) who are responsible for defense against e-crimes (including network operators, providers of online services, commercial security services, cyber-crime investigators) for use in investigations and mitigation activities to protect their network, information systems or services (as referenced in GDPR Recital 49) and have agreed on appropriate safeguards? Or would any automated disclosure carry a potential for liability of the disclosing party, or the controllers or processors of such data? Can counsel provide examples of safeguards (such as pseudonymization/anonymization) that should be considered?</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:black'>For purposes of this question, please assume the following safeguards are in place: <o:p></o:p></span></p><p class=MsoNormal style='margin-left:71.25pt'><span style='color:black'><o:p> </o:p></span></p><ul style='margin-top:0in' type=disc><ul style='margin-top:0in' type=circle><li class=MsoListParagraphCxSpFirst style='color:black;mso-list:l6 level2 lfo3'>Disclosure is required under CP’s contract with ICANN (resulting from Phase 2 EPDP policy).<o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;mso-list:l6 level2 lfo3'>CP’s contract with ICANN requires CP to notify the data subject of the purposes for which, and types of entities by which, personal data may be processed. CP is required to notify data subject of this with the opportunity to opt out before the data subject enters into the registration agreement with the CP, and again annually via the ICANN-required registration data accuracy reminder. CP has done so.<o:p></o:p></li><li class=MsoListParagraphCxSpLast style='color:black;mso-list:l6 level2 lfo3'><span style='color:windowtext'>ICANN or its designee has validated/verified the requestor’s identity, and required in each instance that the requestor: </span><o:p></o:p></li></ul></ul><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:163.0pt;margin-bottom:.0001pt;text-indent:-37.0pt;mso-list:l6 level3 lfo3;vertical-align:baseline'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>•<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-family:"Calibri",sans-serif'>represents that it has a lawful basis for requesting and processing the data, <span style='color:black'><o:p></o:p></span></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:163.0pt;margin-bottom:.0001pt;text-indent:-37.0pt;mso-list:l6 level3 lfo3;vertical-align:baseline'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>•<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-family:"Calibri",sans-serif'>provides its lawful basis, <span style='color:black'><o:p></o:p></span></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:163.0pt;margin-bottom:.0001pt;text-indent:-37.0pt;mso-list:l6 level3 lfo3;vertical-align:baseline'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>•<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-family:"Calibri",sans-serif'>represents that it is requesting only the data necessary for its purpose, <span style='color:black'><o:p></o:p></span></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:163.0pt;margin-bottom:.0001pt;text-indent:-37.0pt;mso-list:l6 level3 lfo3;vertical-align:baseline'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>•<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-family:"Calibri",sans-serif'>agrees to process the data in accordance with GDPR, and <span style='color:black'><o:p></o:p></span></span></p><p class=paragraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:163.0pt;margin-bottom:.0001pt;text-indent:-37.0pt;mso-list:l6 level3 lfo3;vertical-align:baseline'><![if !supportLists]><span style='font-family:"Calibri",sans-serif;color:black'><span style='mso-list:Ignore'>•<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-family:"Calibri",sans-serif'>agrees to EU standard contractual clauses for the data transfer. <span style='color:black'><o:p></o:p></span></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='color:black'>Footnote 1: SSAC defines “security practitioners” in SSAC 101 as those who have a responsibility to perform specific types of functions (as specified in Section 3) related to the identification and mitigation of malicious activity, and the correction of problems that negatively affect services and users online.<o:p></o:p></span></p><p class=MsoNormal><b><span style='color:black'><o:p> </o:p></span></b></p><p class=MsoNormal><span style='color:black'>Notes:<o:p></o:p></span></p><ul style='margin-top:0in' type=circle><li class=MsoListParagraphCxSpFirst style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l11 level1 lfo4'>Text was updated to address Thomas’ concern about the definition of security practitioners <o:p></o:p></li><li class=MsoListParagraphCxSpLast style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l11 level1 lfo4'>Proposal to postpone the review of this question during the next LC’s review<o:p></o:p></li></ul><p class=MsoNormal style='margin-left:.25in'><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><b><u><span style='color:black'>Updated Question 12 and 13<o:p></o:p></span></u></b></p><p class=MsoNormal><u><o:p><span style='text-decoration:none'> </span></o:p></u></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><i><span style='color:black'>Status: Brian and Matt to review and refine updated Q12/13 and provide the updated language to the EPDP Team in advance of the next call on Tuesday, 1 October. <o:p></o:p></span></i></p><p class=MsoNormal><span style='color:black'>(Previous text proposed by Margie) <o:p></o:p></span></p><p class=MsoNormal><b><span style='color:black'><o:p> </o:p></span></b></p><p class=MsoNormal><b><span style='color:black'>Background:<span class=apple-converted-space> </span></span></b><span style='color:black'>The<span class=apple-converted-space> </span></span><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_system_files_correspondence_odonohue-2Dto-2Dmarby-2D03may19-2Den.pdf&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=QByFqrfGsimsUqARjmh9tGVvwXBjAR0IbkSD0eVdiYg&s=EdXqx7ByC1uX-5j8DO06GVnRLxI1FCbAryQMnKVef7Q&e="><span style='color:#954F72'>recent EC Letter [icann.org]</span></a><span class=apple-converted-space><span style='color:black'> </span></span><span style='color:black'>provides clarification regarding the possible legal bases for disclosure of non-public registration data to in the section entitled “Legal Bases for Processing”, and noted:<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><i><span style='color:black'>“As explained in our comments, Art. 6(1)f GDPR (legitimate interest) is one of the six possible legal bases provided under Art. 6(1) GDPR. For instance, disclosure of nonpublic gTLD registration data could be necessary for compliance with a legal obligation to which the contracted parties are subject (see Art. 6(1)c GDPR).</span></i><span style='color:black'>”<o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><span style='color:black'> <o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><span style='color:black'>and<o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><span style='color:black'> <o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><i><span style='color:black'>“With regard to the formulation of purpose two, the European Commission acknowledges ICANN’s central role and responsibility for ensuring the security, stability and resilience of the Internet Domain Name System and that in doing so it acts in the public interest.”</span></i><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><span style='color:black'> <o:p></o:p></span></p><p class=MsoNormal><b><span style='color:black'>Questions:</span></b><span style='color:black'><o:p></o:p></span></p><ul type=disc><li class=MsoListParagraphCxSpFirst style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-add-space:auto;mso-list:l8 level1 lfo5'>In light of these statements from the EC, are there any updates to the prior memos submitted by B&B regarding the applicable bases for disclosure of non-public registration data to third parties for the purposes identified in EPDP Phase 1 Final Report Rec. 1 (Final Report), such as the memo on 6(1)(b)? <o:p></o:p></li><li class=MsoListParagraphCxSpLast style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-add-space:auto;mso-list:l8 level1 lfo5'>To what extent can disclosures of non-public registration data to third parties for the purposes identified in the Final Report Rec. 1 be justified under GDPR’ Article 6(1)e (public interest), in light of the EC’s recognition that: <i>“With regard to the formulation of purpose two, the European Commission acknowledges ICANN’s central role and responsibility for ensuring the security, stability and resilience of the Internet Domain Name System and that in doing so it acts in the public interest.”</i><o:p></o:p></li></ul><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:black'>Notes:<o:p></o:p></span></p><ul type=circle><li class=MsoListParagraphCxSpFirst style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-add-space:auto;mso-list:l2 level1 lfo6'>There are two questions drafted – the first question can be stricken. With respect to the second question, reviewed Recital 45 and the requirement to be done in public interest should be grounded in member state law. The EC letter did note how ICANN has acted in the public interest. <o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-add-space:auto;mso-list:l2 level1 lfo6'>Recital 45 seems fairly clear where something is carried out in the public interest, there has to be a legal basis in corresponding law. B/c the EC is not a data protection authority, the letter does not carry legal weight. <o:p></o:p></li><li class=MsoListParagraphCxSpLast style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-add-space:auto;mso-list:l2 level1 lfo6'>Discussion will be postponed until the next meeting on Tuesday, 15 October.<o:p></o:p></li></ul><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><u><span style='color:black'><o:p><span style='text-decoration:none'> </span></o:p></span></u></b></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><u><span style='color:black'>Question 6<o:p></o:p></span></u></b></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><i><span style='color:black'>Status: Awaiting updated text from Georgios (if any) <o:p></o:p></span></i></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:black'>(Updated proposal from Brian and Georgios): Q6) Within the context of an SSAD, in addition to determining its own lawful basis for disclosing data, may the disclosing party (which may not be the entity that houses the requested data) take full responsibility to assess the lawful basis of the third-party requestor (without the entity that houses the requested data being responsible for assessing the lawful basis of the requestor)?<o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:black'>*Note to legal subteam: do we want to expand this question to cover the other aspects of a disclosure request, beyond merely the lawful basis?<o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:black'>Previous legal advice rec’d from Bird & Bird: “The safeguards require attestation by the Requestor that it has a legal basis for its collection of personal data via the SSAD. Our conclusion above is that CPs will most likely be viewed as controllers for this processing. Accordingly, the main concern for CPs will be that <i>they </i>(rather than a Requestor) have a legal basis for the processing. Where multiple different controllers are involved, the challenge is greater.”<o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:black'>Notes: <o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:black'>Having heard no objection from Georgios, this question will be removed. <o:p></o:p></span></p><ol start=4 type=1><li class=MsoListParagraphCxSpFirst style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-add-space:auto;mso-list:l4 level1 lfo1'><b>Questions previously put on hold pending further legal advice and/or EPDP Team discussion<o:p></o:p></b></li></ol><p class=MsoListParagraphCxSpMiddle style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-add-space:auto'><b><span style='color:black'><o:p> </o:p></span></b></p><p class=MsoListParagraphCxSpLast style='margin-left:73.0pt;mso-add-space:auto;text-indent:-19.0pt;mso-list:l4 level2 lfo1'><![if !supportLists]><span style='color:black'><span style='mso-list:Ignore'>a)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><b><span style='color:black'>Additional topics noted in plenary sessions, where an EPDP Member requested the topic be considered by the Legal Committee</span></b><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><ul style='margin-top:0in' type=disc><ul style='margin-top:0in' type=circle><li class=MsoListParagraphCxSpFirst style='color:black;mso-list:l6 level2 lfo3'><b>Domain names based on identical contact information</b>:<b> </b>If a requestor obtains contact information for a domain name engaged in bad activity, is accessing contact information from other domain names with identical contact information permissible? (topic introduced by Brian K. during 6 September plenary meeting)<o:p></o:p></li></ul></ul><p class=MsoListParagraphCxSpMiddle style='margin-left:2.5in;mso-add-space:auto'><span style='color:black'><o:p> </o:p></span></p><ul style='margin-top:0in' type=disc><ul style='margin-top:0in' type=circle><li class=MsoListParagraphCxSpLast style='color:black;mso-list:l6 level2 lfo3'><b>ccTLD operators offering reverse WHOIS look-up services </b>(topic introduced by Margie during F2F – requested legal advice) <o:p></o:p></li></ul></ul><p class=MsoNormal style='margin-left:1.25in'><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><i><span style='color:black'>Status: Thomas, Volker, Brian and Margie to consider these items in their review of Q11. <o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:1.0in'><i><span style='color:black'><o:p> </o:p></span></i></p><p class=MsoNormal style='margin-left:1.0in'><span style='color:black'>Notes: <o:p></o:p></span></p><ul style='margin-top:0in' type=circle><li class=MsoListParagraphCxSpFirst style='color:black;margin-left:1.0in;mso-add-space:auto;mso-list:l1 level1 lfo7'>Controversial issues such as this should be taken out so that the team can focus on timely progress. Registries are currently able to offer these services voluntarily – not opposed to this, but the wider group should focus on the broader issues here.<o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:1.0in;mso-add-space:auto;mso-list:l1 level1 lfo7'>This is a two-part discussion – is this legally feasible, and if it is feasible to legally provide this service, would the Rrs and Rys agree to this?<o:p></o:p></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:1.0in;mso-add-space:auto;mso-list:l1 level1 lfo7'>Legal Committee to keep question open with respect to Question 11.<o:p></o:p></li></ul><p class=MsoListParagraphCxSpMiddle style='margin-left:1.25in;mso-add-space:auto'><span style='color:black'><o:p> </o:p></span></p><ul style='margin-top:0in' type=disc><ul style='margin-top:0in' type=circle><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:.75in;mso-add-space:auto;mso-list:l3 level2 lfo2'><b>SSAC-proposed topics: </b><o:p></o:p></li></ul><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:.75in;mso-add-space:auto;mso-list:l3 level1 lfo2'><b><span style='font-size:11.0pt'>BALANCING, AND RIGHT TO OBJECT</span></b><span style='font-size:11.0pt'>: The defense of networks, the prevention of fraud, resisting cybercrime, and indicating possible criminal acts or threats to public security to a competent authority are tasks performed by third parties who are not law enforcement or government agencies. Such parties have legitimate interests in making data requests under GDPR, notably under Article 6(1)f; see also Recitals 47, 49, and 50. We are considering balancing where the data subject may be infringing upon the rights of others, and the safety of third-party requestors who deal with cybercrime. The third-party purposes above also require timely responses to data requests.<o:p></o:p></span></li></ul><p class=MsoListParagraphCxSpMiddle style='margin-left:1.25in;mso-add-space:auto'><span style='font-size:11.0pt;color:black'>Assume that registrars notify their registrants up-front of the purposes of data collection, under what circumstances the data may be released, the right to object, etc. <o:p></o:p></span></p><ol style='margin-top:0in' start=1 type=1><ol style='margin-top:0in' start=1 type=a><ol style='margin-top:0in' start=1 type=1><ol style='margin-top:0in' start=1 type=a><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l5 level4 lfo8'><span style='font-size:11.0pt'>When a data controller receives a legitimate third-party data request, under what circumstances is the controller required under GDPR to explicitly notify the data subject that a request has occurred, and/or that it has provided data to a third party?<span class=apple-converted-space> </span><o:p></o:p></span></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l5 level4 lfo8'><span style='font-size:11.0pt'>Under what circumstances do data subjects have the right to object under GDPR to the release of their data to third parties? Per Bird & Bird's Question 3 memo, ICANN's use cases do not involve profiling or highly sensitive data categories (race, political affiliation, etc.), and "a decision to release information via the SSAD is would not in itself have legal effect on the data subject."<o:p></o:p></span></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l5 level4 lfo8'><span style='font-size:11.0pt'>Are data controllers ever required to notify the data subject of the<span class=apple-converted-space> </span><i>identity</i><span class=apple-converted-space> </span>of a third-party requestor?<o:p></o:p></span></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l5 level4 lfo8'><span style='font-size:11.0pt'>Please confirm: when a data subject objects to processing, the decision to release the data resides with the data controller?<o:p></o:p></span></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l5 level4 lfo8'><span style='font-size:11.0pt'>If a registrant must be notified of a request and then be given the opportunity to object, please explain how this process can be reconciled with or integrated into a SSAD that is designed to provide timely data exchange when possible and does not involve "a decision based solely on automated processing". (See Bird & Bird's Question 3 memo, paragraph 1.12.) <o:p></o:p></span></li></ol></ol></ol></ol><p class=MsoListParagraphCxSpMiddle style='margin-left:1.25in;mso-add-space:auto'><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><ul style='margin-top:0in' type=disc><li class=MsoListParagraphCxSpLast style='color:black;margin-left:.75in;mso-add-space:auto;mso-list:l3 level1 lfo2'><b><span style='font-size:11.0pt'>LEGAL VERSUS NATURAL PERSONS</span></b><span style='font-size:11.0pt'>: Registration data submitted by legal person registrants may contain the data of natural persons. For example the contact data they provide may include a natural person's name and email address. Legal person registrants also have the ability to publish non-personally identifiable contact data ("</span><span style='color:windowtext'><a href="mailto:admin@companyname.com"><span style='font-size:11.0pt;color:#954F72'>admin@companyname.com</span></a></span><span style='font-size:11.0pt'>") should they desire.<o:p></o:p></span></li></ul><p class=MsoNormal style='margin-left:.75in'><span style='font-size:11.0pt;color:black'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in;text-indent:.25in'><span style='font-size:11.0pt;color:black'>If registrants are required to self-identify as either a natural or legal person, then:<o:p></o:p></span></p><ol style='margin-top:0in' start=1 type=a><li class=MsoListParagraphCxSpFirst style='color:black;margin-left:1.5in;mso-add-space:auto;mso-list:l9 level1 lfo9'><span style='font-size:11.0pt'>Can registrars rely on that self-identification? <o:p></o:p></span></li><li class=MsoListParagraphCxSpLast style='color:black;margin-left:1.5in;mso-add-space:auto;mso-list:l9 level1 lfo9'><span style='font-size:11.0pt'>Can registrars make the contact data submitted by legal person registrants publicly available in RDS (WHOIS), by stating that it is the responsibility of a legal person registrant to obtain consent from any natural person whose data it submits? <span class=apple-converted-space> </span><o:p></o:p></span></li></ol><p class=MsoNormal style='margin-left:.75in'><span style='font-size:11.0pt;color:black'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.25in'><span style='font-size:11.0pt;color:black'>Please state any considerations, such as the ability of the registrant to correct its data. As part of the analysis, please examine the policies of the Internet protocol (IP address) registries RIPE NCC (the registry in Europe, based in the Netherlands) and ARIN (the registry in North America, which has customer contacts in Europe). These registries publish the data of natural persons who are subject to the GDPR, publicly via their WHOIS services, by placing the choice and responsibility on their registrants, who are legal persons. IP addresses and domain names are two sides of the same coin, and these IP address registries state mission justifications and collection purposes similar to those in ICANN's Temporary Specification. See:<o:p></o:p></span></p><p class=MsoNormal style='margin-left:.75in'><span style='font-size:11.0pt;color:black'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.25in'><span style='font-size:11.0pt;color:black'>1) “How We're Implementing the GDPR: Legal Grounds for Lawful Personal Data Processing and the RIPE Database”: </span><a href="https://labs.ripe.net/Members/Athina/gdpr-legal-grounds-for-lawful-personal-data-processing-and-the-ripe-database"><span style='font-size:11.0pt'>https://labs.ripe.net/Members/Athina/gdpr-legal-grounds-for-lawful-personal-data-processing-and-the-ripe-database</span></a><span style='font-size:11.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.25in'><span style='font-size:11.0pt;color:black'>2) “How We're Implementing the GDPR: The RIPE Database”:<span class=apple-converted-space> </span></span><a href="https://labs.ripe.net/Members/Athina/how-we-re-implementing-the-gdpr-the-ripe-database"><span style='font-size:11.0pt;color:#954F72'>https://labs.ripe.net/Members/Athina/how-we-re-implementing-the-gdpr-the-ripe-database</span></a><span style='font-size:11.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.25in'><span style='font-size:11.0pt;color:black'>3) "Personal Data Privacy Considerations At ARIN":<span class=apple-converted-space> </span></span><a href="https://teamarin.net/2018/03/20/personal-data-privacy-considerations-at-arin/"><span style='font-size:11.0pt;color:#954F72'>https://teamarin.net/2018/03/20/personal-data-privacy-considerations-at-arin/</span></a><span style='font-size:11.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.25in'><span style='font-size:11.0pt;color:black'>4) ARIN "Data Accuracy":<span class=apple-converted-space> </span></span><a href="https://www.arin.net/reference/materials/accuracy/"><span style='font-size:11.0pt;color:#954F72'>https://www.arin.net/reference/materials/accuracy/</span></a><span style='font-size:11.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.25in'><span style='font-size:11.0pt;color:black'>5) ARIN Registration Services Agreement, paragraph 3:<span class=apple-converted-space> </span></span><a href="https://www.arin.net/about/corporate/agreements/rsa.pdf"><span style='font-size:11.0pt;color:#954F72'>https://www.arin.net/about/corporate/agreements/rsa.pdf</span></a><span style='font-size:11.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.25in'><span style='font-size:11.0pt;color:black'>6) ARIN Privacy Policy:<span class=apple-converted-space> </span></span><a href="https://www.arin.net/about/privacy/"><span style='font-size:11.0pt;color:#954F72'>https://www.arin.net/about/privacy/</span></a><span style='font-size:11.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.25in'><span style='font-size:11.0pt;color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;color:black'>Notes:<o:p></o:p></span></p><ul style='margin-top:0in' type=disc><ul style='margin-top:0in' type=circle><li class=MsoListParagraphCxSpFirst style='color:black;margin-left:.75in;mso-add-space:auto;mso-list:l3 level2 lfo2'><span style='font-size:11.0pt'>This question relates to the practical implementation of legal vs. natural.<o:p></o:p></span></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:.75in;mso-add-space:auto;mso-list:l3 level2 lfo2'><span style='font-size:11.0pt'>One of the dependencies for further consideration in phase 2 is the study that is to be carried out by ICANN Org on this topic.</span><span style='font-size:11.0pt;font-family:"MS Gothic"'>
</span><span style='font-size:11.0pt'>It may be preferable to return to these questions on this topic once the study results are available as that may further help inform the EPDP Team’s consideration of this topic?</span><span style='font-size:11.0pt;font-family:"MS Gothic"'>
</span><span style='font-size:11.0pt'><o:p></o:p></span></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:.75in;mso-add-space:auto;mso-list:l3 level2 lfo2'><span style='font-size:11.0pt'>Some of the questions the group is asking are policy questions, not legal questions<o:p></o:p></span></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:.75in;mso-add-space:auto;mso-list:l3 level2 lfo2'><span style='font-size:11.0pt'>There may be a timing issue if the study is not completed soon. Is the study necessary for the EPDP Team to make decisions on this issue or not? The EPDP Team deferred this topic to Phase 2 on the condition that the study would be carried out to inform the Team’s work in Phase 2. Does this need to be escalated to the Chair’s attention?<o:p></o:p></span></li><li class=MsoListParagraphCxSpMiddle style='color:black;margin-left:.75in;mso-add-space:auto;mso-list:l3 level2 lfo2'><span style='font-size:11.0pt'>Homework: analyze SSAC questions and look at which questions may be dependent on results of a study and which questions may not be dependent on the study. <o:p></o:p></span></li></ul></ul><p class=MsoListParagraphCxSpMiddle style='margin-left:1.75in;mso-add-space:auto'><span style='font-size:11.0pt;color:black'><o:p> </o:p></span></p><ul style='margin-top:0in' type=disc><li class=MsoListParagraphCxSpLast style='color:black;margin-left:.75in;mso-add-space:auto;mso-list:l3 level1 lfo2'><b><span style='font-size:11.0pt'>Google Right to be Forgotten: </span></b><span style='font-size:11.0pt'>(Proposed by Margie) </span>In light of last week’s landmark Right to Be Forgotten Case regarding the reach of GDPR:<o:p></o:p></li></ul><p class=MsoNormal style='margin-left:1.25in'><span style='color:black'><a href="https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-09/cp190112en.pdf">https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-09/cp190112en.pdf</a><span class=apple-converted-space> </span>, where the Court clarified the applicability of GDPR outside of the EU, and stated:<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.25in'><i><span style='color:black'>“However, it states that numerous third States do not recognise the right to dereferencing or have a different approach to that right. The Court adds that the right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. In addition, the balance between the right to privacy and the protection of personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world.”</span></i><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p><p class=MsoNormal style='margin-left:.75in;text-indent:.5in'><span style='color:black'>Does this ruling affect:<o:p></o:p></span></p><ol start=1 type=1><li class=MsoListParagraphCxSpFirst style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in;mso-add-space:auto;mso-list:l7 level1 lfo10'>The advice given in<span class=apple-converted-space> </span><span style='color:windowtext'><a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__nam06.safelinks.protection.outlook.com_-3Furl-3Dhttps-253A-252F-252Fcommunity.icann.org-252Fdownload-252Fattachments-252F102138857-252FICANN-252520-2D-252520Memo-252520on-252520Territorial-252520Scope-252520.docx-253Fversion-253D1-2526modificationDate-253D1552176561000-2526api-253Dv2-26data-3D02-257C01-257CMarksv-2540microsoft.com-257C0fc10369b86b4fb54cdb08d745d81ad8-257C72f988bf86f141af91ab2d7cd011db47-257C1-257C1-257C637054666773951714-26sdata-3D85hB3n-252BgHO5zltdzTm5Pmd-252FUeu0T7OL-252F4bywkCcb7dg-253D-26reserved-3D0%26d%3DDwMGaQ%26c%3DOGmtg_3SI10Cogwk-ShFiw%26r%3DqQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA%26m%3DqgqaikAoSyJzElcg7C-u09feQBWajzhT1JT2LBv05jg%26s%3D8TCbK69KiXCKrPpNO-KL9rKcsRkCISjzvCof8uKQBRs%26e%3D&data=02%7C01%7CMarksv%40microsoft.com%7C2925832daae546b63e0408d745f74dba%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637054800792839937&sdata=exadgrNqqCKVQ%2FLTBKZXXJMnBkfDjA9SNSTaJuX%2FH4Q%3D&reserved=0" title="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__nam06.safelinks.protection.outlook.com_-3Furl-3Dhttps-253A-252F-252Fcommunity.icann.org-252Fdownload-252Fattachments-252F102138857-252FI"><span style='color:#954F72'>Phase 1 Regarding Territorial Scope</span></a></span>?<span style='font-size:11.0pt'><o:p></o:p></span></li><li class=MsoListParagraphCxSpLast style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in;mso-add-space:auto;mso-list:l7 level1 lfo10'>The advice given in Q1-2 with respect to liability (Section 4 of the memo)?<span style='font-size:11.0pt'><o:p></o:p></span></li></ol><p class=MsoNormal style='margin-left:1.25in'><span style='color:black'>In light of this ECJ decision, using the same assumptions identified for Q1 and Q2, would there be less risk under GDPR to contracted parties if:<o:p></o:p></span></p><ol start=2 type=1><ol start=1 type=1><ol start=1 type=a><li class=MsoListParagraphCxSpFirst style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-add-space:auto;mso-list:l10 level3 lfo11'>the SSAD allowed automated disclosure responses to requests submitted by accredited entities for redacted data of registrants and/or controllers located outside of the EU, for legitimate purposes (such as cybersecurity investigations and mitigation)<span class=apple-converted-space><b> </b></span>and/or other fundamental rights<span class=apple-converted-space> </span>such as<span class=apple-converted-space> </span>intellectual property<span class=apple-converted-space> </span>infringement investigations<span class=apple-converted-space> </span>(See Article 17, Section 2<span class=apple-converted-space> </span><span style='color:windowtext'><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__nam06.safelinks.protection.outlook.com_-3Furl-3Dhttps-253A-252F-252Feur-2Dlex.europa.eu-252Flegal-2Dcontent-252FEN-252FTXT-252F-253Furi-253DCELEX-253A12012P-252FTXT-26data-3D02-257C01-257CMarksv-2540microsoft.com-257C2925832daae546b63e0408d745f74dba-257C72f988bf86f141af91ab2d7cd011db47-257C1-257C1-257C637054800792819948-26sdata-3DRxgqL9eYdRavnaFqIDjzDOT4GPHJRSsmQ1-252Favz10vKw-253D-26reserved-3D0&d=DwMGaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8&m=VLG2NlF9SKlO5Br01dwddo_lA4oncgv7PkSSSsw8ZV4&s=fPD2dxvOeBSKNBXQT0rUNkNPmaova0kNQcFCii_4G6Y&e=" title="https://urldefense.proofpoint.com/v2/url?u=https-3A__nam06.safelinks.protection.outlook.com_-3Furl-3Dhttps-253A-252F-252Feur-2Dlex.europa.eu-252Flegal-2Dcontent-252FEN-252FTXT-252F-253Furi-253DCELEX-253A12012P-252FTXT-26data-3D02-257C01-257CMarksv-2540mic"><span style='color:#954F72'>https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:12012P/TXT</span></a></span>);<span class=apple-converted-space> </span><span style='font-size:11.0pt'>and/or <o:p></o:p></span></li></ol></ol></ol><ol start=2 type=1><ol start=1 type=1><ol start=2 type=a><li class=MsoListParagraphCxSpLast style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-add-space:auto;mso-list:l0 level3 lfo12'>ICANN served as the sole entity making disclosure decisions for the SSAD, and directly provided access to the redacted data from a processing center outside of the EU (such as from ICANN’s Los Angeles Headquarters)?<span style='font-size:11.0pt'><o:p></o:p></span></li></ol></ol></ol><p class=MsoNormal><b><span style='color:black'><o:p> </o:p></span></b></p><p class=MsoListParagraph style='margin-left:73.0pt;mso-add-space:auto;text-indent:-19.0pt;mso-list:l4 level2 lfo1'><![if !supportLists]><b><span style='color:black'><span style='mso-list:Ignore'>b)<span style='font:7.0pt "Times New Roman"'> </span></span></span></b><![endif]><b><span style='color:black'>Agree on next steps<o:p></o:p></span></b></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><ol style='margin-top:0in' start=5 type=1><li class=MsoListParagraphCxSpFirst style='color:black;margin-left:0in;mso-add-space:auto;mso-list:l4 level1 lfo1'><b>Wrap and confirm next meeting to be scheduled <o:p></o:p></b></li></ol><p class=MsoListParagraphCxSpMiddle style='margin-left:73.0pt;mso-add-space:auto;text-indent:-19.0pt;mso-list:l4 level2 lfo1'><![if !supportLists]><span style='color:black'><span style='mso-list:Ignore'>a)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>Confirm action items<o:p></o:p></span></p><p class=MsoListParagraphCxSpLast style='margin-left:73.0pt;mso-add-space:auto;text-indent:-19.0pt;mso-list:l4 level2 lfo1'><![if !supportLists]><span style='color:black'><span style='mso-list:Ignore'>b)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>The next LC Meeting will take place on Tuesday, 15 October at 14:00 UTC.<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Times New Roman",serif;color:black'><o:p> </o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>