<div dir="ltr">yes Matt, <div><br></div><div>you are correct - that is what we agreed on our Tuesday call. On Thursday morning, however, several members of the legal committee expressed a desire to retain the notion that under certain limited circumstances third parties would not have access to information needed to make the information identifiable, making the data "anonymous" in some sense to those third parties. Although this approach is arguably inconsistent with a straight reading of the GDPR definition of anonymous, I think we've discussed the fact that the ECJ has issued decisions that could be read to suggest that context is a meaningful distinction in determining whether or not data is personal data. (Here, with respect to context, Bird & Bird has already opined that no registration data should be considered "anonymous" under the GDPR because anyone with a legitimate and proportionate interest will have access to data (redacted registration data) that would link the pseudonymous email address to an identifiable person.) </div><div><br></div><div>Nonetheless, several members of the Legal Team noted that this concept of "anonymous in context" was discussed extensively in previous phases of the epdp and that it should be retained as a valuable indication of the group's thinking. These participants were uncomfortable with dropping the anonymity concept altogether given its history in the epdp context. This is somewhat complicated by the fact that Bird & Bird itself used the labels provided by the epdp, including the <div><br></div><div>Of course, whatever is "intended" in any particular situation, the question of whether or not data is anonymous (and therefore not personal data) is a question of fact to be determined, ultimately, by European courts. The substituted terms and associated definitions are, IMHO, a significant improvement over the previous "anonymous email" phrase and attempt at compromise in order to facilitate the plenary discussions.</div><div><br></div><div>b</div><div><br></div><div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Feb 19, 2021 at 12:59 AM Crossman, Matthew <<a href="mailto:mmcross@amazon.com">mmcross@amazon.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_4722403162395940434WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Hi everyone,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">I’m having trouble understanding the “</span><span style="font-size:11pt;font-family:Calibri,sans-serif;color:red">which is intended to be anonymous data
when processed by non-contracted parties</span><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,78,121)">” revision. I thought we agreed (based on the legal advice
already received from Bird & Bird) that because a link is maintained between the email address and the data subject, this does not meet the legal definition of anonymous data even from the perspective of a third party (“Looking at the "reasonably likely means"
test, as interpreted in <i>Breyer</i>, the data would still seem to be personal from the perspective of a third party. This is particularly the case since the third parties will use the masked e-mail address to contact the data subject, and/or (in option
(a)) to find other domain names associated with that data subject (see also <i>Nowak</i>'s reference to data being considered "related to" a particular data subject by reason of its "<i>purpose or effect</i>"). This seems like we are introducing a concept
that the legal advice has already opined is likely not possible, which I’m afraid may lead to further confusion in the plenary. I would be fine mirroring the language in the first revision (pseudonymous rather than anonymous) as I think that more accurately
captures the status of that data.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,78,121)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,78,121)">Let me know if I’m misunderstanding the purpose of that revision.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,78,121)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,78,121)">Thanks,<br>
Matt<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> Gnso-epdp-legal <<a href="mailto:gnso-epdp-legal-bounces@icann.org" target="_blank">gnso-epdp-legal-bounces@icann.org</a>>
<b>On Behalf Of </b>Becky Burr<br>
<b>Sent:</b> Thursday, February 18, 2021 9:11 AM<br>
<b>To:</b> <a href="mailto:gnso-epdp-legal@icann.org" target="_blank">gnso-epdp-legal@icann.org</a><br>
<b>Subject:</b> RE: [EXTERNAL] [Gnso-epdp-legal] definitions<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<table border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr style="height:15.25pt">
<td width="706" valign="top" style="width:842.35pt;border:1.5pt solid rgb(237,125,49);padding:0in 5.4pt;height:15.25pt">
<p><strong><span style="background:rgb(255,255,153)">CAUTION</span></strong><span style="background:rgb(255,255,153)">: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.</span><u></u><u></u></p>
</td>
</tr>
</tbody>
</table>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">As discussed, the following is being circulated to the Legal Team based on our discussion this morning. Absent objection (accompanied by an explanation of the objection), these definitions will be forwarded to the plenary at COB PST tomorrow
(Friday).<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<p style="margin:0in 0in 0.0001pt"><span style="font-family:Calibri,sans-serif;color:black">The Legal Team proposes replacement of the phrase "Pseudonymous email contact with the phrase "Registrant-based email contact", defined as: “`</span><span style="font-family:Calibri,sans-serif;color:red">an
</span><span style="font-family:Calibri,sans-serif;color:black">email for all domains registered by a unique registrant [sponsored by a given Registrar] OR [across Registrars]</span><span style="font-family:Calibri,sans-serif;color:red">, which is intended
to be pseudonymous data when processed by non-contracted parties</span><span style="font-family:Calibri,sans-serif;color:black">. </span><u></u><u></u></p>
</div>
</blockquote>
<div>
<p style="margin:0in 0in 0.0001pt"><u></u> <u></u></p>
<p class="MsoNormal"><br>
<br>
<u></u><u></u></p>
</div>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<p style="margin:0in 0in 0.0001pt"><span style="font-family:Calibri,sans-serif;color:black">The Legal Team proposes replacement of the phrase "Anonymous email contact" with the phrase "Registration-based email contact", defined as “A separate single
use email for each domain name registered by a unique registrant</span><span style="font-family:Calibri,sans-serif;color:red">, which is intended to be anonymous data when processed by non-contracted parties.</span><span style="font-family:Calibri,sans-serif;color:black">”</span><u></u><u></u></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<p style="margin:0in 0in 0.0001pt"><span style="font-family:Calibri,sans-serif;color:black">The Legal Team notes that the question of persistence over time (i.e., are the emails changed on a periodic basis) is a policy question for the plenary.</span><u></u><u></u></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<div>
<p class="MsoNormal">B<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Tue, Feb 16, 2021 at 10:34 AM Becky Burr <<a href="mailto:becky.burr@board.icann.org" target="_blank">becky.burr@board.icann.org</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">Team, <u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Thanks. for a productive call this morning. Please review the following definitions:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<p style="margin:0in 0in 0.0001pt"><span style="font-family:Calibri,sans-serif;color:black">The Legal Team proposes replacement of the phrase "Pseudonymous email contact with the phrase "Registrant-based email contact", defined as: “A pseudonymized
email for all domains registered by a unique registrant [sponsored by a given Registrar] OR [across Registrars]. </span><u></u><u></u></p>
</div>
</blockquote>
<div>
<p style="margin:0in 0in 0.0001pt"><u></u> <u></u></p>
<p class="MsoNormal"><br>
<br>
<u></u><u></u></p>
</div>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<p style="margin:0in 0in 0.0001pt"><span style="font-family:Calibri,sans-serif;color:black">The Legal Team proposes replacement of the phrase "Anonymous email contact" with the phrase "Registration-based email contact", defined as “A separate single
use pseudonymized email for each domain name registered by a unique registrant”</span><u></u><u></u></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<p style="margin:0in 0in 0.0001pt"><span style="font-family:Calibri,sans-serif;color:black">The Legal Team notes that the question of persistence over time (i.e., are the emails changed on a periodic basis) is a policy question for the plenary.</span><u></u><u></u></p>
</div>
</blockquote>
<div>
<p style="margin:0in 0in 0.0001pt"><span style="font-family:Calibri,sans-serif;color:black"><br>
<br>
</span><u></u><u></u></p>
<p style="margin:0in 0in 0.0001pt"><span style="font-family:Calibri,sans-serif;color:black">Please raise any objections over email in the next 24 hours.</span><u></u><u></u></p>
<p style="margin:0in 0in 0.0001pt"><span style="font-family:Calibri,sans-serif;color:black"><br>
<br>
</span><u></u><u></u></p>
<p style="margin:0in 0in 0.0001pt"><span style="font-family:Calibri,sans-serif;color:black">Best,</span><u></u><u></u></p>
<p style="margin:0in 0in 0.0001pt"><span style="font-family:Calibri,sans-serif;color:black">Becky</span><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote></div>