<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1546333375;
mso-list-template-ids:-1897106204;}
@list l1
{mso-list-id:1703747551;
mso-list-template-ids:-1103853622;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level2 lfo3
{mso-level-start-at:0;
mso-level-number-format:alpha-lower;
mso-level-numbering:continue;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:0in;
text-indent:0in;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Dear Legal Committee,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">As a reminder, we will discussing Melina’s questions during tomorrow’s meeting. The
<a href="https://docs.google.com/document/d/1CqczmN_ShkDFgx05q8AyUX5iDM2u5dul/edit">
questions</a> are pasted here for ease of reference (and highlighted in the Google doc in yellow):<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><i><span style="font-size:11.0pt">Would you change or add anything else on your analysis under points 1, 2 and 3 if an additional step is introduced after distinguishing between natural and legal persons, as described in the 2-step approach
below? In particular, could you please assess the level of risk (if any) of such approach:<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span style="font-size:11.0pt"><o:p> </o:p></span></i></p>
<p class="MsoNormal"><i><span style="font-size:11.0pt">a. Distinguishing at first level between natural and legal persons. If natural, then publish no data, if legal go to step 2.<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span style="font-size:11.0pt">b. Further distinguishing between data of legal persons which contain personal information and data which contain non-personal information. Publish only non-personal information.
<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span style="font-size:11.0pt"><o:p> </o:p></span></i></p>
<p class="MsoNormal"><i><span style="font-size:11.0pt">Additionally – and this could be optional – give the possibility to legal persons to publish personal information if they wish so. This aims at protecting, for instance, a case where there is a one person
company and their corporate address is the same as the home address. The registrant should have the option on whether they want their home address published.<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span style="font-size:11.0pt">Please advise on further steps to be taken on how to correctly implement such approach (if different than the steps described under points 2-3).<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span style="font-size:11.0pt">--</span></i><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Additionally, as there were no objections to Becky’s
<a href="https://docs.google.com/document/d/1UCP86uPZJBA_oh_4lfa6GwisfqnXUgbi5kdq-VOQCS0/edit">
updated Feasibility question</a>, the below question will be sent to Bird & Bird and the EPDP Team (as an FYI).<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:12.0pt;margin-right:0in;margin-bottom:12.0pt;margin-left:0in">
<b><u><span style="font-size:11.0pt;color:black">Questions Regarding Feasibility of Unique Contacts</span></u></b><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:12.0pt;margin-right:0in;margin-bottom:12.0pt;margin-left:0in">
<span style="font-size:11.0pt;color:black">B&B’s Memo data 4 February 2020 regarding email contact information discussed two options: (a) a “pseudonymous email contact” where the same unique string is used for multiple registrations by the data subject; and
(b) an “anonymous email contact” where a separate unique email string is used for each such registration. B&B opined that publication of either (a) or (b) would be treated as publication of personal data on the web because the purpose of making this masked
email address available is to allow 3<sup>rd</sup> parties to directly contact the data subject and because third parties with legitimate and proportionate interests would have access to the underlying data.</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:12.0pt;margin-right:0in;margin-bottom:12.0pt;margin-left:0in">
<span style="font-size:11.0pt;color:black">Upon review, the EPDP Legal Team has proposed to describe options (a) and (b) going forward as follows:</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<ul style="margin-top:0in" type="disc">
<li class="MsoNormal" style="color:black;margin-top:12.0pt;mso-list:l1 level1 lfo1;vertical-align:baseline">
<span style="font-size:11.0pt">The phrase "pseudonymous email contact” (option (a)) should be replaced with the phrase "<b>Registrant-based email contact</b>," defined as: “an email for all domains registered by a unique registrant,
<i>which is intended to be pseudonymous data when processed by third party users</i> (i.e., non-contracted parties). (The question of whether the email should be common across ICANN-accredited Registrars requires a policy determination TBD.)<o:p></o:p></span></li><li class="MsoNormal" style="color:black;margin-bottom:12.0pt;mso-list:l1 level1 lfo1;vertical-align:baseline">
<span style="font-size:11.0pt">The phrase "anonymous email contact" (option (b)) should be replaced with the phrase "<b>Registration-based email contact</b>," defined as “a separate single use email for each domain name registered by a unique registrant,
<i>which is intended to be virtually or “essentially” anonymous data when processed by third party users</i> (i.e., non-contracted parties).”<o:p></o:p></span></li></ul>
<p class="MsoNormal" style="mso-margin-top-alt:12.0pt;margin-right:0in;margin-bottom:12.0pt;margin-left:0in">
<span style="font-size:11.0pt;color:black">In answering the questions below, please assume, for discussion purposes, that third-party users of Registration-based email contact information cannot identify the data subject without disproportionate effort so that
the risk of identification appears in reality to be insignificant. </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<ol style="margin-top:0in" start="1" type="1">
<li class="MsoNormal" style="color:black;margin-top:12.0pt;mso-list:l0 level1 lfo2;vertical-align:baseline">
<span style="font-size:11.0pt">Based on your experience and applicable precedent, please compare the level of risk, likelihood of enforcement actions, fines, counseling, etc. associated with (a) publication on the web or (b) automated disclosure of (i) a Registrant-based
email contact on the one hand and (ii) a Registration-based email contact on the other? In responding to this question please consider:<o:p></o:p></span></li></ol>
<ol style="margin-top:0in" start="1" type="1">
<ol style="margin-top:0in" start="1" type="a">
<li class="MsoNormal" style="color:black;mso-list:l0 level2 lfo3;vertical-align:baseline">
<span style="font-size:11.0pt">Whether the assumed fact that the risk of data subject identification by a third party (i.e., non-contracted party) through a Registration-based email contact appears to be insignificant would render such emails effectively “anonymous”
with respect to such third parties under the <i>Breyer </i>standard?<o:p></o:p></span></li><li class="MsoNormal" style="color:black;margin-bottom:12.0pt;mso-list:l0 level2 lfo3;vertical-align:baseline">
<span style="font-size:11.0pt">If not, how would the choice of email contact (Registrant-based or Registration-based) affect the outcome of the legitimate interests balancing test under Article 6(1)(f)? To what extent would the use of a Registration-based email
contact reduce the impact of publication on the interests or fundamental rights and freedoms of the data subject?<o:p></o:p></span></li></ol>
</ol>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Does the answer to these questions change if the primary purpose for publishing a masked email is to support statistical research and analytics, and
<u>not</u> to communicate with the data subject?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Thank you.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><br>
Berry, Marika, and Caitlin</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
</body>
</html>