<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin-top:0cm;
margin-right:0cm;
margin-bottom:8.0pt;
margin-left:0cm;
line-height:106%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:8.0pt;
margin-left:36.0pt;
mso-add-space:auto;
line-height:106%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
mso-add-space:auto;
line-height:106%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
mso-add-space:auto;
line-height:106%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0cm;
margin-right:0cm;
margin-bottom:8.0pt;
margin-left:36.0pt;
mso-add-space:auto;
line-height:106%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:796337300;
mso-list-type:hybrid;
mso-list-template-ids:1009040736 67567631 67567641 67567643 67567631 67567641 67567643 67567631 67567641 67567643;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=DE link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span lang=EN-US>All,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>our small drafting team consisting of Margie, Brian, Volker and myself met briefly in Montreal and we now suggest the following language for q11. A few points need discussion by our group, but we will leave that to our call.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Best,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Thomas<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>In order to inform our group’s discussion on whether reverse lookups by any accredited party be allowed and be p<a name="_GoBack"></a>art of our policy recommendations, we would like to understand better whether reverse lookups can be compliant with GDPR in the following scenarios.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>In our current deliberations it was agreed that, disclosure requests relate to non-public registration data for a given domain name: a query is made for one domain name and – if disclosure is permissible – non-public registration data is returned for this very domain name.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Reverse lookups are different in that a query is made for any data element that is not publicly available in the registration data, but may be present as part of the non-public registration data. This may include e-mail addresses, a registered name holder name or a phone number. If reverse lookups were allowed, the SSAD could then potentially return numerous domain names associated with the given data element and resulting in the disclosure of non-public registration data for multiple domain names as well as other personal information contained in the domain names themselves or the use thereof. For example, a reverse query for a domain name holder may not only return his business domain names but also those used for private purposes. Further, a query for a more generic string sch as “John Smith” as registered name holder name may return results for multiple registered name holders. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Reverse lookups can be helpful to investigate patterns of abusive or criminal behavior. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Our group recognizes that reverse lookups can be more impactful for data subjects. Hence, we are seeking your advice on a staggered approach to limit disclosure to what is necessary for the requestor to conduct their work while limiting the impact on the data subjects involved.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Scenario 1:<o:p></o:p></span></p><ol style='margin-top:0cm' start=1 type=1><li class=MsoListParagraphCxSpFirst style='margin-left:0cm;mso-add-space:auto;mso-list:l0 level1 lfo1'><span lang=EN-US>The accredited requestor must:<o:p></o:p></span></li><ol style='margin-top:0cm' start=1 type=a><li class=MsoListParagraphCxSpMiddle style='margin-left:0cm;mso-add-space:auto;mso-list:l0 level2 lfo1'><span lang=EN-US> provide evidence that multiple (alternative suggestion: at least one) domain name(s) are involved in illegal / abusive conduct<o:p></o:p></span></li><li class=MsoListParagraphCxSpMiddle style='margin-left:0cm;mso-add-space:auto;mso-list:l0 level2 lfo1'><span lang=EN-US> identify at least one domain name for which it believes is involved in the illegal /abusive conduct and <o:p></o:p></span></li><li class=MsoListParagraphCxSpLast style='margin-left:0cm;mso-add-space:auto;mso-list:l0 level2 lfo1'><span lang=EN-US>cite an appropriate legal basis under GDPR to support its request, as well as all other information required for submitting “ordinary requests” to the SSAD.<o:p></o:p></span></li></ol></ol><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US>For example, victims of online fraud often share their experiences in online fora. Credible information published by multiple users in a trusted forum suggesting that a data element is linked to multiple domain names could suffice as a basis for triggering a reverse lookup. These requirements (a-c) are intended to prevent the reverse lookups from being misused as mere “fishing expeditions” or based on guesses. The SSAD will initially only produce the number of domain names associated with the given data elements by TLD and by registrar. No further information will be returned. This shall help the requestor to determine whether there is smoke or there is fire. <o:p></o:p></span></p><ol style='margin-top:0cm' start=2 type=1><li class=MsoListParagraphCxSpFirst style='margin-left:0cm;mso-add-space:auto;mso-list:l0 level1 lfo1'><span lang=EN-US>If the requestor wishes to proceed, a manual review / balancing of rights is required to determine whether investigating the alleged abusive behavior or criminal activity allows the disclosure of information on multiple domain names and whether proceeding to the next steps already unjustifiably impacts the rights of the data subjects involved. This may be the case where multiple domain names are used (for example) to publicize political speech and where the requestor might try to suppress such free speech or help convict those exercising free speech Or in other cases where the impact on the data subject outbalances the legitimate interests of the requestor.<o:p></o:p></span></li><li class=MsoListParagraphCxSpMiddle style='margin-left:0cm;mso-add-space:auto;mso-list:l0 level1 lfo1'><span lang=EN-US>If the manual review and balancing test is affirmative, only a list of domain names is returned, not the non-public registration data for all listed domain names. <o:p></o:p></span></li><li class=MsoListParagraphCxSpLast style='margin-left:0cm;mso-add-space:auto;mso-list:l0 level1 lfo1'><span lang=EN-US>The requestor may then proceed to file disclosure requests for individual domain names and these will be dealt with according to “ordinary” disclosure requests for individual domain names.<o:p></o:p></span></li></ol><p class=MsoNormal><span lang=EN-US>Scenario 2:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Dispute Resolution Providers appointed by ICANN, e.g. for UDRP cases, should be able to request disclosure of domain names registered by a given registered domain holder including non-public registration data for multiple domain names where the dispute resolution policy allows for multiple domain names to be included in one complaint, and where the multiple infringing domain names are to be submitted as evidence by the complainant to support a finding by the panelist of bad faith by the registrant.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Alternate proposal: Allow for DRPs to make requests to check whether the data of any given domain name matches an already obtained data set. No data would be disclosed, only the fact whether the data set matches that used in the query.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p></div></body></html>