<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hi Tara,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thank you for the updated question.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>EPDP Support Staff has updated the <a href="https://docs.google.com/document/d/1vEetjWuRlf2uvCCUREHf9G7ac5z2hk_sgGiOSJC3JO8/edit">Priority 2 – Legal vs. Natural worksheet</a> to include the updated question. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>We would propose reviewing this updated question in conjunction with the other proposed legal questions in relation to the legal vs. natural issue. The Legal Committee is scheduled to begin the review of Priority 2 questions once it has completed review of Priority 1 questions.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thank you.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Best regards,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Marika, Berry, and Caitlin<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:12.0pt;color:black'>From: </span></b><span style='font-size:12.0pt;color:black'>Gnso-epdp-legal <gnso-epdp-legal-bounces@icann.org> on behalf of Tara Whalen <tjwhalen@gmail.com><br><b>Date: </b>Monday, October 14, 2019 at 7:01 AM<br><b>To: </b>"gnso-epdp-legal@icann.org" <gnso-epdp-legal@icann.org><br><b>Subject: </b>[Gnso-epdp-legal] Updated text: consent and legal/natural persons<o:p></o:p></span></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Hello all,<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><o:p> </o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>As a follow-up to SSAC's previously-proposed question on legal/natural persons: we revised our original question in light of the recent memo from Bird & Bird, to ensure it focused on specific unaddressed issues involving consent. See full text below. We propose that our new version replace the old one entirely.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><o:p> </o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Thanks for your consideration,<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Tara Whalen<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>---<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[NEW VERSION]<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>LEGAL VERSUS NATURAL PERSONS:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Registration data submitted by legal person registrants may contain the data of natural persons. A Phase 1 memo stated that registrars can rely on a registrant's self-identification as legal or natural person, especially if risk is mitigated by taking further steps to ensure the accuracy of the registrant's designation. <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>As a follow-up to that memo: what are the consent issues and requirements related to such designations? Can registrars state that it is the responsibility of a legal person registrant to obtain consent from any natural person whose data it submits? <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>As part of the analysis, please examine the GDPR policies and practices of the Internet protocol (IP address) registries RIPE NCC (the registry in Europe, based in the Netherlands) and ARIN (the registry in North America, which has customer contacts in Europe). These registries publish the data of natural person contacts who are subject to the GDPR, publicly via their WHOIS services, by placing the choice and responsibility on their registrants, who are legal persons. These IP address registries state mission justifications and collection purposes similar to those in ICANN's Temporary Specification.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Please see:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>1) “How We're Implementing the GDPR: Legal Grounds for Lawful Personal Data Processing and the RIPE Database”:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__labs.ripe.net_Members_Athina_gdpr-2Dlegal-2Dgrounds-2Dfor-2Dlawful-2Dpersonal-2Ddata-2Dprocessing-2Dand-2Dthe-2Dripe-2Ddatabase&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=9Y9HB3OlTZfz1no1-rFIekmLoJGp-tuExNdcqd9C86s&s=LcOJEe4_D-4x9IhXzi5TPhiXK2UkcpYGG9KteZDVuPE&e=" target="_blank">https://labs.ripe.net/Members/Athina/gdpr-legal-grounds-for-lawful-personal-data-processing-and-the-ripe-database [labs.ripe.net]</a><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>2) “How We're Implementing the GDPR: The RIPE Database”: <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__labs.ripe.net_Members_Athina_how-2Dwe-2Dre-2Dimplementing-2Dthe-2Dgdpr-2Dthe-2Dripe-2Ddatabase&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=9Y9HB3OlTZfz1no1-rFIekmLoJGp-tuExNdcqd9C86s&s=MHkNDZD5npTHhFCww7h37jH0dZVXjP3J6gC_3_MlKMA&e=" target="_blank">https://labs.ripe.net/Members/Athina/how-we-re-implementing-the-gdpr-the-ripe-database [labs.ripe.net]</a><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>3) "Personal Data Privacy Considerations At ARIN": <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__teamarin.net_2018_03_20_personal-2Ddata-2Dprivacy-2Dconsiderations-2Dat-2Darin_&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=9Y9HB3OlTZfz1no1-rFIekmLoJGp-tuExNdcqd9C86s&s=pk0huv2aNSfvLj6S90UIZ4QJUIpAr9Ht-yJyf7pEC2g&e=" target="_blank">https://teamarin.net/2018/03/20/personal-data-privacy-considerations-at-arin/ [teamarin.net]</a><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>4) ARIN "Data Accuracy": <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.arin.net_reference_materials_accuracy_&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=9Y9HB3OlTZfz1no1-rFIekmLoJGp-tuExNdcqd9C86s&s=ckReulFNZOhT8xWNRFYx6OBfLxsYr0RaqxOEgr_Em6c&e=" target="_blank">https://www.arin.net/reference/materials/accuracy/ [arin.net]</a><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>5) ARIN Registration Services Agreement, paragraph 3: <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.arin.net_about_corporate_agreements_rsa.pdf&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=9Y9HB3OlTZfz1no1-rFIekmLoJGp-tuExNdcqd9C86s&s=A__4cvbv8CN_aWnGqBhNkF9hSAUmtHzIDL2uiGtMtLI&e=" target="_blank">https://www.arin.net/about/corporate/agreements/rsa.pdf [arin.net]</a><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>6) ARIN Privacy Policy: <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.arin.net_about_privacy_&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=9Y9HB3OlTZfz1no1-rFIekmLoJGp-tuExNdcqd9C86s&s=99xt1m5gH1mu0-Pt3ERCRTLchE2_nxsr0OLfK-0uyls&e=" target="_blank">https://www.arin.net/about/privacy/ [arin.net]</a><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div style='border:none;border-bottom:dotted windowtext 3.0pt;padding:0in 0in 1.0pt 0in'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[OLD VERSION]<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>LEGAL VERSUS NATURAL PERSONS:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Registration data submitted by legal person registrants may contain the data of natural persons. For example the contact data they provide may include a natural person's name and email address. Legal person registrants also have the ability to publish non-personally identifiable contact data ("<a href="mailto:admin@companyname.com" target="_blank">admin@companyname.com</a>") should they desire.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>If registrants are required to self-identify as either a natural or legal person, then:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>a. Can registrars rely on that self-identification? <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>b. Can registrars make the contact data submitted by legal person registrants publicly available in RDS (WHOIS), by stating that it is the responsibility of a legal person registrant to obtain consent from any natural person whose data it submits? <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Please state any considerations, such as the ability of the registrant to correct its data.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>As part of the analysis, please examine the policies of the Internet protocol (IP address) registries RIPE NCC (the registry in Europe, based in the Netherlands) and ARIN (the registry in North America, which has customer contacts in Europe). These registries publish the data of natural persons who are subject to the GDPR, publicly via their WHOIS services, by placing the choice and responsibility on their registrants, who are legal persons. IP addresses and domain names are two sides of the same coin, and these IP address registries state mission justifications and collection purposes similar to those in ICANN's Temporary Specification. See:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>1) “How We're Implementing the GDPR: Legal Grounds for Lawful Personal Data Processing and the RIPE Database”:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__labs.ripe.net_Members_Athina_gdpr-2Dlegal-2Dgrounds-2Dfor-2Dlawful-2Dpersonal-2Ddata-2Dprocessing-2Dand-2Dthe-2Dripe-2Ddatabase&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=9Y9HB3OlTZfz1no1-rFIekmLoJGp-tuExNdcqd9C86s&s=LcOJEe4_D-4x9IhXzi5TPhiXK2UkcpYGG9KteZDVuPE&e=" target="_blank">https://labs.ripe.net/Members/Athina/gdpr-legal-grounds-for-lawful-personal-data-processing-and-the-ripe-database [labs.ripe.net]</a><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>2) “How We're Implementing the GDPR: The RIPE Database”: <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__labs.ripe.net_Members_Athina_how-2Dwe-2Dre-2Dimplementing-2Dthe-2Dgdpr-2Dthe-2Dripe-2Ddatabase&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=9Y9HB3OlTZfz1no1-rFIekmLoJGp-tuExNdcqd9C86s&s=MHkNDZD5npTHhFCww7h37jH0dZVXjP3J6gC_3_MlKMA&e=" target="_blank">https://labs.ripe.net/Members/Athina/how-we-re-implementing-the-gdpr-the-ripe-database [labs.ripe.net]</a><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>3) "Personal Data Privacy Considerations At ARIN": <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__teamarin.net_2018_03_20_personal-2Ddata-2Dprivacy-2Dconsiderations-2Dat-2Darin_&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=9Y9HB3OlTZfz1no1-rFIekmLoJGp-tuExNdcqd9C86s&s=pk0huv2aNSfvLj6S90UIZ4QJUIpAr9Ht-yJyf7pEC2g&e=" target="_blank">https://teamarin.net/2018/03/20/personal-data-privacy-considerations-at-arin/ [teamarin.net]</a><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>4) ARIN "Data Accuracy": <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.arin.net_reference_materials_accuracy_&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=9Y9HB3OlTZfz1no1-rFIekmLoJGp-tuExNdcqd9C86s&s=ckReulFNZOhT8xWNRFYx6OBfLxsYr0RaqxOEgr_Em6c&e=" target="_blank">https://www.arin.net/reference/materials/accuracy/ [arin.net]</a><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>5) ARIN Registration Services Agreement, paragraph 3: <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.arin.net_about_corporate_agreements_rsa.pdf&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=9Y9HB3OlTZfz1no1-rFIekmLoJGp-tuExNdcqd9C86s&s=A__4cvbv8CN_aWnGqBhNkF9hSAUmtHzIDL2uiGtMtLI&e=" target="_blank">https://www.arin.net/about/corporate/agreements/rsa.pdf [arin.net]</a><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>6) ARIN Privacy Policy: <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.arin.net_about_privacy_&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=9Y9HB3OlTZfz1no1-rFIekmLoJGp-tuExNdcqd9C86s&s=99xt1m5gH1mu0-Pt3ERCRTLchE2_nxsr0OLfK-0uyls&e=" target="_blank">https://www.arin.net/about/privacy/ [arin.net]</a><o:p></o:p></p></div></div></body></html>