<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Source Sans Pro";
panose-1:2 11 5 3 3 4 3 2 2 4;}
@font-face
{font-family:-webkit-standard;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.apple-tab-span
{mso-style-name:apple-tab-span;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:445662632;
mso-list-template-ids:-469338122;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal" style="text-autospace:none">Kurt,<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"> <o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none">Thanks for your thoughts on how the Expedited Policy Development Process (EPDP) Team envisions it will provide input to ICANN org to use in our interactions with the European Data Protection Board (EDPB) and
Data Protection Authorities (DPAs). As I mentioned on the <a href="https://participate.icann.org/p65jm2z6cv7/?launcher=false&fcsContent=true&pbMode=normal"><span style="color:#6B006D">call</span></a> with community leaders on August 12<sup><span style="font-size:9.0pt">th</span></sup>,
it is very important that we get the community’s input, including the EPDP Team’s, during this process. We are trying to achieve legal certainty for any model that is developed, and to make sure any guidance or clarity we receive helps the community in its
policy discussions. Just as we did with the Calzone proposed model for GDPR compliance, we want the community’s questions and comments on some of the open areas of interpretation to help guide our discussions with the EDPB and other relevant data protection
authorities. This will help us take our discussions with the DPAs to the next level. The more “meat” we provide or the more specific questions we ask, the more meaningful guidance they can give us. With a better understanding of the law, we will all be well
positioned to develop, implement and enforce a legally sound, consistent unified model for access to non-public registration data, and lower the risk for the contracted parties in order for them to be able to accept such model. This will also help all of you
in your discussions, particularly on the Temp Spec.<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"> <o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none">The DPAs and EDPB are open to engaging with us but the window of opportunity is finite. There are specific points in time where the topic can be addressed through their structures and processes. The Technology
subgroup of the EDPB is the body responsible for looking at issues such as the WHOIS and providing input for the EDPB Plenary meetings. In order to have meaningful engagement with them we need to time our input with their respective meetings. Coordinating
the right timing for DPAs to meaningfully engage with us while at the same time sharing with them concrete questions from our community-driven processes is an exercise that requires a great level of flexibility. <o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"> <o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none">It's also helpful to hear the EPDP Team’s thoughts on how ICANN org can share guidance we receive from DPAs and the EDPB with the EPDP Team. We have been very open and transparent with all of our engagement with
the DPAs and the EDPB and will continue to be. All of the formal correspondence from the DPAs and EDPB are published on the ICANN correspondence
<a href="https://www.icann.org/resources/pages/correspondence">page</a> and our informal verbal conversations for mutual education and information are summarized in blogs. We encourage the EPDP Team to continue to monitor these sources for the latest updates.
To assist the EPDP Team in its work, ICANN org will provide the EPDP Team with a compiled list of correspondence received and blogs published thus far, including the topic of each correspondence/blog. We’d also like to offer the idea of a regular information
sharing call between ICANN org and members of the EPDP Team if you think such a call would be helpful to the EPDP Team’s work.<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"> <o:p></o:p></p>
<p class="MsoNormal">In addition to direct engagement with the EDPB, stakeholders, and the broader ICANN community, we are regularly updating our website with input received from communications and comments covering a range of topics relating to GDPR. Should
the community have specific topics to raise, or information to share on areas and experiences in other sectors, please encourage them to submit it to
<a href="mailto:gdpr@icann.org">gdpr@icann.org</a> and we will post it to make available to the community. Updates on our work related to data protection and privacy matters are published <a href="https://www.icann.org/dataprotectionprivacy"><span style="color:#6B006D">here</span></a>. I
look forward to continued coordination between ICANN org and the EPDP Team.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif;color:black">Best,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif;color:black">Göran Marby</span><span style="font-size:12.0pt;font-family:-webkit-standard;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif;color:black">President & CEO ICANN</span><span style="font-size:12.0pt;font-family:-webkit-standard;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif;color:black">+1(310) 578 8690</span><span style="font-size:12.0pt;font-family:-webkit-standard;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif;color:black"> </span><span style="font-size:12.0pt;font-family:-webkit-standard;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif;color:black"> </span><span style="font-size:12.0pt;font-family:-webkit-standard;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif;color:black">Cássia Oliveira</span><span style="font-size:12.0pt;font-family:-webkit-standard;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif;color:black">Sr. Manager, Office of the President & CEO </span><span style="font-size:12.0pt;font-family:-webkit-standard;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif;color:black"><a href="mailto:cassia.oliveira@icann.org">cassia.oliveira@icann.org</a></span><u><span style="color:blue"><o:p></o:p></span></u></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif;color:black">+1(310) 578 8656</span><o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Kurt Pritz <kurt@kjpritz.com> <br>
<b>Sent:</b> Friday, August 17, 2018 10:19 AM<br>
<b>To:</b> Goran Marby <goran.marby@icann.org><br>
<b>Cc:</b> rafik.dammak@gmail.com; David Olive <david.olive@icann.org>; Theresa Swinehart <theresa.swinehart@icann.org>; John Jeffrey <john.jeffrey@icann.org>; Akram Atallah <akram.atallah@icann.org>; Chris Disspain <chris.disspain@board.icann.org>; leon.sanchez@board.icann.org;
Cassia Oliveira <cassia.oliveira@icann.org>; GNSO EPDP <gnso-epdp-team@icann.org><br>
<b>Subject:</b> [Ext] Re: Coordination between ICANN org and EPDP<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hello Göran: <br>
<br>
Thanks very much for contacting me and your note<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I have repeated some your email below so that there is a clear connection between your questions and my responses. <br>
<br>
<span style="color:#0433FF">Today, ICANN org held a call to provide community leaders with updates regarding various GDPR activities. The slides and recording of the call are available at <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resources_pages_data-2Dprotection-2Dmeetings-2D2017-2D12-2D08-2Den&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=W-_OkQQwhKn898NIlgvGuUTNiO7-nEQecuC3xuoFiAY&m=jNTcC8mK05gyGk-nDws3RcdO6nKZgiqcuQYA4YRDjHg&s=BwKM9G3PoGIFKSgOrykuqfPrjktyikGLxPuB_WuRDi4&e=">https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en
[icann.org]</a>.<br>
<br>
On the call, a few community leaders reinforced the value of coordination between ICANN org and the EPDP Working Group, particularly around access model. To this end, please share with us any thoughts you might have regarding a process by which:<br>
<br>
1) ICANN org can share guidance we receive from the DPAs and European Data Protection Board with the EPDP Working Group.</span><br>
<br>
Generally, our Team discussions are appropriately aimed at refining / altering ICANN processes so they are GDPR compliant. So guidance, case law or authoritative opinions received that provides compliance requirements will be extremely helpful. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">a. Through its many recent actions: engaging with the ICANN community, governments, the EDPB, and others, it is apparent that ICANN is the midst of executing a plan to obtain certainty around the various GDPR provisions. It would be
instructive for the EPDP Team if ICANN were to share its plan (or elements of it) so that the team can anticipate the receipt (and timing) of new information. It would also indicate where there is likely no additional information, i.e., where the team would
be left to draw conclusions based on the information that is already available. This information would likely cut down on the number of questions the ICANN Org receives from the team. <br>
<br>
We understand that the plan must have a degree of informality and be flexible, with each step based upon the information received in the step before it. However, where available, it would be instructive to know the planned-for objectives, expected learnings, a
set of ultimate questions to be answered, planned inquiries, targets and so on.<br>
<br>
b. While ICANN has published each communication, the findings or results of those communications have not been organized in anyway of which we know. For example, observers of the back-and-forth between the ICANN Org and the EDPB have offered conclusions that
can be drawn from these documents. However, no one has organized those conclusions in a way that might become a rule set or set of guidelines for those reviewing the Temporary Specification or creating an access model.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
Coincidentally, in today’s EPDP meeting such a request was made: for disclosure of all the communications with the EDPB and DPAs, the staff commentary to those communications, and some organization of same.<br>
<br>
c. We also wish to hear of developments related to GDPR in other industries, if available, such as:<o:p></o:p></p>
<ol start="1" type="1">
<li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
what data processing protocols have been adopted<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
what data processing protocols have been tested in courts<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
what other privacy regimes are in works in other jurisdictions<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
what data is available regarding:<o:p></o:p></li></ol>
<ol start="4" type="1">
<ol start="1" type="1">
<li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level2 lfo1">
the effects of GDPR on malfeasance detection, avoidance<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level2 lfo1">
other positive or negative effects of GDPR<o:p></o:p></li></ol>
</ol>
<p class="MsoNormal">d. <span class="apple-tab-span"> </span>Finally, it’d be helpful to be made aware of the details of ICANN’s GDPR implementation plan as ICANN org had to take on the advice of DPAs and the EDPB in fashioning that. (This is a request
made from the EPDP team in yesterday’s meeting and so this request has been repeated to the ICANN liaisons working with the EPDP.)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
<span style="color:#0433FF">2) How the EPDP Working Group will provide input regarding access to ICANN org to use in our interactions with DPAs and European Data Protection Board to obtain legal guidance that will help guide the Working Group in its work.
As you know, we post all information we receive through our blogs and engage with stakeholders, also through communications we post whether through correspondence or comments via <a href="mailto:gdpr@icann.org">gdpr@icann.org</a>.</span><br>
<br>
a. A point of information: The EPDP team’s third set of deliverables is to provide an, “Initial Report and a Final Report regarding the EPDP Team’s recommendations … for a System for Accredited Access to Non-Public Registration Data.” Work on this could
begin as early as the completion and publication of the Initial Report on the Temporary Specification. (The Team stays in close contact with the GNSO Council leadership in pursuit of the deliverables to ensure the spirit and letter of the EPDP Charter is followed.)<br>
<br>
b. While our current answer to this question is not yet finely honed, it is likely that, from time to time, the EPDP Team will have question regarding the constraints / opportunities imposed by the GDPR. These questions might take the form of a proposed
access model (or elements of an access model). The EPDP Team will forward those to ICANN, which, in turn, can test them against its own knowledge base, with DPAs, with the EDPB, or elsewhere.<br>
<br>
c. As ICANN is a data controller involved in the collection, use and disclosure of the same data that is the subject matter of this Team’s work, it is expected that ICANN will work with the team on the successor to the Temporary Specification and an access model.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
I hope you find this response helpful. The team is keen to continue an active correspondence with ICANN in order to flesh out the framework provided by GDPR with detailed clarifications, implementation guidance and cases from other, similarly situated industries
that have faced many of these same issues.<br>
<br>
We also plan to remain in close communication with ICANN leaders on this topic, through the ICANN-provided liaisons to the EPDP Team.<br>
<br>
Sincerely,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Kurt<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Aug 14, 2018, at 8:17 AM, Goran Marby <<a href="mailto:goran.marby@icann.org">goran.marby@icann.org</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Kurt,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Today, ICANN org held a call to provide community leaders with updates regarding various GDPR activities. The slides and recording of the call are available at<span class="apple-converted-space"> </span><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resources_pages_data-2Dprotection-2Dmeetings-2D2017-2D12-2D08-2Den&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=W-_OkQQwhKn898NIlgvGuUTNiO7-nEQecuC3xuoFiAY&m=jNTcC8mK05gyGk-nDws3RcdO6nKZgiqcuQYA4YRDjHg&s=BwKM9G3PoGIFKSgOrykuqfPrjktyikGLxPuB_WuRDi4&e="><span style="color:#0B4CB4">https://www.icann.org/resources/pages/data-protection-meetings-2017-12-08-en</span><span style="color:#954F72">
[icann.org]</span></a>.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">On the call, a few community leaders reinforced the value of coordination between ICANN org and the EPDP Working Group, particularly around access model. To this end, please share with us any thoughts you might have regarding a process
by which (1) ICANN org can share guidance we receive from the DPAs and European Data Protection Board with the EPDP Working Group; and (2) How the EPDP Working Group will provide input regarding access to ICANN org to use in our interactions with DPAs and
European Data Protection Board to obtain legal guidance that will help guide the Working Group in its work. As you know, we post all information we receive through our blogs and engage with stakeholders, also through communications we post whether through
correspondence or comments via<span class="apple-converted-space"> </span><a href="mailto:gdpr@icann.org"><span style="color:#0B4CB4">gdpr@icann.org</span></a>. I look forward to hearing your thoughts on how we can continue to strengthen our work together
toward the common goal of having an access model that is guided by the law and supported by the community.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif">Best regards,</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif">Göran Marby</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif">President & CEO ICANN</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif">+1(310) 578 8690</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif">Cássia Oliveira</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif">Sr. Manager, Office of the President & CEO </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif"><a href="mailto:cassia.oliveira@icann.org">cassia.oliveira@icann.org</a></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Source Sans Pro",sans-serif">+1(310) 578 8656</span><o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>