[Gnso-epdp-team] Notes and action items from EPDP Team Meeting #46

[Marika Konings]

Dear EPDP Team,

Please find below the notes and action items from today’s EPDP Team meeting.

Best regards,

Caitlin, Berry and Marika

==========


EPDP Team Meeting #46

Tuesday, 19 February 2019

Notes and Action Items


High level notes / actions:


Action item #1: EPDP Team Chair to review consensus designations in light of input received and see if any require modifications. Any updates to be shared with the EPDP Team as soon as possible. (Completed)


Action item #2: Staff support team to add following language ("Registrars and Registries must reasonably consider and accommodate requests for lawful disclosure") to recommendation #18. Also add "(A finalized time frame to be set during implementation. This discussion is to be prioritized during the implementation discussion.)” (Completed)


Action item #3: Staff support team to update recommendation #11 – City field as agreed during meeting and circulate to the team for confirmation that changes align with discussion. (Completed)


Action item #4: EPDP Team to confirm which groups cannot live with the inclusion of this recommendation #16 - Geographic basis in the report, recognizing that statements included in the report indicate groups positions on this topic.


Action item #5: Staff support team to ensure that accompanying text refers to possibility of study that was considered but no agreement was reached.


Questions for ICANN Org: None


Notes & Action items


These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/ZwPVBQ.


Proposed Agenda:

1.  Roll Call & SOI Updates

  *   Attendance will be taken from Adobe Connect
  *   Remember to mute your microphones when not speaking and state your name before speaking for transcription purposes.
  *   Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team.



2. Welcome and Updates from EPDP Team Chair (15 minutes)

   a. Recap of GNSO Council briefing on 14 Feb

  *   Update provided to the GNSO Council during its 14 Feb meeting
  *   Presented updated and detailed timeline for delivery of the Final Report
  *   Explained purpose of quiet period
  *   Question was flagged whether delivery date could be extended, but GNSO Chair noted that this is not possible factoring in the public comment period required by the ICANN Board as well as the GAC consideration of possible public policy concerns.
  *   Provided overview of the recommendations contained in the Final Report


   b. Quiet period recap of input received and proposed next steps

  *   Appreciate all the work that went into review and input provided as a result of quiet period.
  *   What is take away from statements, responses to consensus calls and comments on recommendations? Items selected for the agenda fell into two camps: 1) open issues where no closure has been achieved, 2) clarifications / accuracy changes. Not appropriate to reconsider items that were previously discussed and agreed - dissent can be noted in the report in relation to the different recommendations.
  *   Consensus designations - Chair to review consensus designations in light of input received and see if any require modifications. Conservative approach taken to date.


Action item #1: EPDP Team Chair to review consensus designations in light of input received and see if any require modifications. Any updates to be shared with the EPDP Team as soon as possible.


   c. Discussion of proposed way forward as described in email and document


Input on recommendation 15 -  see ALAC comment in relation to TDRP.


3. Discussion of items for amendment and final discussion:

   a. Recommendation 18 – Reasonable Access / Lawful Disclosure (30 minutes)


  *   Requests for access are reasonable if appropriate info is provided
  *   When such request is received, there is a certain timeframe in which a response is provided, but content (what data is shared) needs to be assessed for GDPR compliance and as such a one-size-fits-approach may not be feasible.
  *   Edits took away some of the nuance behind the section - original intent was that there would be some reasonableness from CPs side in relation what they do with a request. Some kind of baseline, basic understanding that when the request is reasonable, the expectation that CPs are reasonable in what they do. General understanding that CPs need to act lawfully, but there should be reasonable consideration. Could be as simple as adding a bullet at the top of the section dealing with responses that says something like: "Registrars must reasonably consider and accommodate lawful requests for disclosure". This language is aligned with BC/IPC edits for the first bullet.
  *   Adding timeline to the recommendation is unreasonable at this late stage of the process as there has been no time to consider this fully. Original language had already reference to 'X' days so objective was to add some specificity to that, while at the same time allowing for flexibility. CPs not comfortable with the aggressive timelines proposed - also, quiet period was not intended to put forward such substantive changes. Implementation phase is expected to further define what a reasonable response time is.
  *   Need to cooperate on achieving the mutual goal of reasonable response time to requests, including urgent ones.
  *   Some level of metric should be added so that measurement can be conducted.
  *   Reasonable is used for both the type of request and the timeline.
  *   Asking for specificity to ensure that the whole industry is reasonable - provide a benchmark, not a hard, fast timeline.
  *   Do not have all info needed to set a response time at the moment.
  *   Note that RAA requirements include provisions in relation to response times - is actively enforced without a specific SLA. Reasonable and prompt steps should be sufficient for contracted parties to make this evaluation.
  *   Consider settling on a timeframe of 30 days? Too long for certain groups. May not be sufficient for some and too restrictive for others?
  *   Proposal - go back to original language on the timeframe (to be determined during the implementation phase.
  *   Consider adding a clarification that this discussion is prioritized in the implementation phase. "(A finalized time frame to be set during implementation. This discussion is to be prioritized during the implementation discussion.')'


Action item #2: Staff support team to add following language ("Registrars and Registries must reasonably consider and accommodate requests for lawful disclosure") to recommendation #18. Also add "(A finalized time frame to be set during implementation. This discussion is to be prioritized during the implementation discussion.')'. Circulate to the team for confirmation that changes align with discussion.


   b. Recommendation 11 – City field (30 minutes)

    i.   consider legal guidance

    ii.    considered proposed consensus approach for Phase 2


  *   Legal advice requested (see memo provided by Bird & Bird - https://community.icann.org/x/6YMWBg). Indicated that further research may be needed.
  *   Proposed approach: redact city field for now and take anticipated legal advice into account in phase 2.
  *   City field to be redacted, EPDP team expects legal advice to be received and analysed in phase 2 during which a determination is to be made as to whether this recommendation should be modified. Remove footnote that indicated lack of support. Keep it as a separate recommendation to signal different approach.


Action item #3: Staff support team to update recommendation #11 – City field as agreed during meeting and circulate to the team for for confirmation that changes align with discussion.


   c. Recommendation 16 – Geographic considerations – consider proposed approach given anticipated legal advice during Phase 2 (30 minutes)


  *   See input provided and proposed approach
  *   Appears there is no general support for the proposed path forward.
  *   Consider removing the recommendation? Should this work be taken up by someone else? If the group is silent on it, does that have the same impact as what the recommendation currently recommends? Probably, yes. Some were looking for a commitment to look into this for more details. Legal advice will not make this clearer.
  *   How do CPs wade through different privacy regimes?
  *   NCSG would prefer that policy is uniform across parties, but would be willing to accept the existing recommendation pending legal advice.
  *   How to assist CPs to wade through the different privacy regimes? Each CPs will need to determine how to best deal with local law - ICANN Org does not indemnify CPs. CPs need flexibility to implement.
  *   Need a system that is as unified as possible, but with flexibility for CPs. General rule should be that all users should be able to benefit from the same rights.
  *   Other laws may impose different requirements from GDPR, how to deal with that?
  *   What is the negative impact if the recommendation stays as is?
  *   Possible language to be added to the recommendation: "Contingent upon the outcome of pending legal advice, ICANN org (with GNSO oversight) will undertake a measured study with respect to geographic distinctions. The first phase would include feasibility and cost assessments and, if found to be feasible, define, a tailored, economical study." Make not part of the recommendation, but make sure that it is referenced in the accompanying text.


Action item #4: EPDP Team to confirm which groups cannot live with the inclusion of this recommendation #16 - Geographic basis in the report, recognizing that statements included in the report indicate groups positions on this topic.


Action item #5: Staff support team to ensure that accompanying text refers to possibility of study that was considered but no agreement was reached.


   d. Recommendation 5 - Data collected by registrars (30 minutes), consider:

  i.     Tech contact issue

 ii.      legal guidance received regarding notice and consent requirements

 iii.      possible Phase 2 discussion


  *   See input provided and proposed actions
  *   See also legal guidance provided - why is consent needed if info is anonymized? Yes, but there is also the issue of processing by CPs of data of a data subject with which no contractual arrangement exists.
  *   No agreement on what optional means, which is reflected in the Final Report: "Noting some of the possible legal and technical challenges involved in collecting data from a third party, some (RySG, RrSG, NCSG) expressed the view that registrars should have the option, but should not be contractually required, to offer the RNH the ability to provide additional contact fields, e.g., technical function. Others (BC, IPC, ALAC, GAC and SSAC) expressed the view that registrars should be required to offer the RNH this ability, as making this optional could ultimately lead to risks to DNS stability, security and resiliency. The stakeholders supporting this view noted this functionality is considered important and desirable for some RNHs. The Team could not come to agreement on this issue and as such no recommendation is included in this Final Report in relation to whether optional also means, optional or required for the registrar to offer.
  *   See clarifying language that RySG provided - this may help further clarify this recommendation ("The EPDP Team recommends that the data elements, representing the Aggregate Minimum Data Set, listed below are required to be collected by registrars, noting that the collection of some data elements is optional.
  *   No further changes needed at this stage – leave Final Report language as is.


e. Recommendation 9 –  Contractual Compliance – consider clarification (30 minutes)

Deferred to Wednesday’s meeting


f. Recommendation 12 –  Organization field – consider clarification (30 minutes)

Deferred to Wednesday’s meeting


g. Recommendation 17 – Natural v Legal distinctions – consider clarification (30 minutes)

Deferred to Wednesday’s meeting


Action item #6: EPDP Team to review proposed actions for recommendations #9 (Contractual Compliance), #12 (Organization field) and #17 (Natural vs legal) in advance of the meeting and share any feedback with the mailing list.


4. Confirm next Steps (15 minutes)


5.  Wrap and confirm next meeting to be scheduled for Wednesday, 20 February 2019 at 14.00 UTC (5 minutes)

Marika Konings
Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN)
Email: marika.konings at icann.org<mailto:marika.konings at icann.org>

Follow the GNSO via Twitter @ICANN_GNSO
Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_gnso&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=7_PQAir-9nJQ2uB2cWiTDDDo5Hfy5HL9rSTe65iXLVM&m=5DXgId95wrCsHi--pxTiJD7bMB9r-T5ytCn7od3CF2Q&s=Cg5uQf0yAfw-qlFZ0WNBfsLmmtBNUiH0SuI6Vg-gXBQ&e=> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gnso.icann.org_files_gnso_presentations_policy-2Defforts.htm-23newcomers&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=7_PQAir-9nJQ2uB2cWiTDDDo5Hfy5HL9rSTe65iXLVM&m=5DXgId95wrCsHi--pxTiJD7bMB9r-T5ytCn7od3CF2Q&s=tT-E2RoAucUb3pfL9zmlbRdq1sytaEf765KOEkBVCjk&e=>.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/gnso-epdp-team/attachments/20190220/bb3b04e0/attachment-0001.html>