<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:606887489;
mso-list-template-ids:1459679264;}
@list l0:level1
{mso-level-start-at:6;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1
{mso-list-id:739789781;
mso-list-template-ids:-721748178;}
@list l1:level1
{mso-level-start-at:2;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2
{mso-list-id:928192812;
mso-list-template-ids:-871200916;}
@list l2:level1
{mso-level-start-at:4;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l3
{mso-list-id:1464810516;
mso-list-template-ids:135842126;}
@list l3:level1
{mso-level-start-at:5;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l4
{mso-list-id:1753038330;
mso-list-template-ids:-420851520;}
@list l5
{mso-list-id:1872380816;
mso-list-template-ids:1709084076;}
@list l5:level1
{mso-level-start-at:3;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Ayden, we’ll take note of this and in the future will avoid sending these just before a call. As these were not expected to be discussed / reviewed during today’s meeting, we wanted to send these as soon as we found these in our inbox but
appreciate that it might have caused some distraction.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Best regards,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Marika <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Ayden Férdeline <icann@ferdeline.com><br>
<b>Reply-To: </b>Ayden Férdeline <icann@ferdeline.com><br>
<b>Date: </b>Thursday, August 23, 2018 at 07:02<br>
<b>To: </b>Marika Konings <marika.konings@icann.org><br>
<b>Cc: </b>"gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org><br>
<b>Subject: </b>[Ext] Re: [Gnso-epdp-team] FW: Responses to outstanding questions from the EPDP<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">This is not a criticism directed at those who have forwarded the responses on to us (thank you for that), but it is a request for ICANN org-
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">It is not helpful to receive responses like this 10 minutes before a call begins. In future I hope they can be provided at least 24 hours in advance of a call.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thank you,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Ayden Férdeline<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On 23 Aug 2018, at 14:50, Marika Konings <<a href="mailto:marika.konings@icann.org">marika.konings@icann.org</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Dear All,<span class="apple-converted-space"> </span><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"> <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal">Please find below the input from ICANN Org on the questions that were raised by the EPDP meeting on the 9<sup>th</sup>, 13<sup>th</sup>, and 16<sup>th</sup>. The responses will get posted shortly here:<a href="https://community.icann.org/x/ahppBQ"><span style="color:#954F72">https://community.icann.org/x/ahppBQ</span></a>.<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"> <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal">Best regards,<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"> <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal">Caitlin, Berry and Marika<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"> <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"> <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal">**<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt"> <o:p></o:p></span></p>
</div>
<ol style="margin-top:0in" start="1" type="1">
<li class="MsoNormal" style="mso-list:l4 level1 lfo1"><span style="font-size:12.0pt">Regarding Temporary Specification section 4.4.8 - Supporting a framework to address issues involving domain name registrations: the team requests additional specificity. Does
this mean that registrars and registries must support a uniform access mechanism when approved or is there some present requirement?<o:p></o:p></span></li></ol>
<div style="margin-left:.5in">
<p class="MsoNormal"><span style="font-size:12.0pt;color:#4472C4">RESPONSE: Section 4.4.8 identifies that addressing issues involving domain name registrations, including but not limited to: consumer protection, investigation of cybercrime, DNS abuse, and intellectual
property protection using a framework to be developed is a legitimate purpose for the processing of registration data. With regard to the second question, section 4.4.8 does not by itself require that registrars and registries must support a uniform access
mechanism when approved. Please note however that section 4.1 of Appendix A does have a requirement for registrars and registries to “provide reasonable access to Personal Data in Registration Data to third parties on the basis of legitimate interests pursued
by the third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Registered Name Holder or data subject pursuant to Article 6(1)(f) GDPR.” Separately, section 4.2 of Appendix A requires registrars and
registries to “provide reasonable access to Personal Data in Registration Data to a third party where the Article 29 Working Party/European Data Protection Board, court order of a relevant court of competent jurisdiction concerning the GDPR, applicable legislation
or regulation has provided guidance that the provision of specified non-public elements of Registration Data to a specified class of third party for a specified purpose is lawful.” Section 4.2 of Appendix A further requires that registrars and registries “provide
such reasonable access within 90 days of the date ICANN publishes any such guidance, unless legal requirements otherwise demand an earlier implementation.”</span><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt"> <o:p></o:p></span></p>
</div>
<ol style="margin-top:0in" start="2" type="1">
<li class="MsoNormal" style="mso-list:l1 level1 lfo2"><span style="font-size:12.0pt">Regarding Temporary Specification section 4.4.13 - Handling contractual monitoring requests: which data sets will be required to measure compliance against which contractual
provisions?<o:p></o:p></span></li></ol>
<div style="margin-left:.5in">
<p class="MsoNormal"><span style="font-size:12.0pt;color:#4472C4">RESPONSE: The data requested by ICANN Contractual Compliance will vary depending on the particular compliance issue. For example, for a registrant’s complaint that a renewal reminder email was
not received, ICANN Contractual Compliance may request from the registrar of record a copy of the communication to the Registered Name Holder.</span><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt"> <o:p></o:p></span></p>
</div>
<ol style="margin-top:0in" start="3" type="1">
<li class="MsoNormal" style="mso-list:l5 level1 lfo3"><span style="font-size:12.0pt">Can ICANN summarize in some searchable form the contacts and engagements with the EDPB and/or other DPAs in relation to the Temporary Specification for gTLD Registration Data?<o:p></o:p></span></li></ol>
<div style="margin-left:.5in">
<p class="MsoNormal"><span style="font-size:12.0pt;color:#4472C4">RESPONSE: ICANN org has been open and transparent with our engagements with the EDPB and DPAs. All of the formal written communications from EDPB and DPAs are published on ICANN correspondence.
In addition, we’ve had informal verbal conversations with the EDPB and DPAs to educate, inform, and ask for guidance. Summaries of those informal conversations are published in blogs. To assist the EPDP Team in its work, ICANN org will provide the EPDP Team
with a compiled list of correspondence received and blogs published thus far, including the topic of each correspondence/blog.</span><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt"> <o:p></o:p></span></p>
</div>
<ol style="margin-top:0in" start="4" type="1">
<li class="MsoNormal" style="mso-list:l2 level1 lfo4"><span style="font-size:12.0pt">In section 5.7 of the Temporary Specification (and other sections), what is the meaning of “reasonable access”? Is it access to personal data reasonably provided? Does “reasonably”
relate to the effort necessary to retrieve it? Does it mean how criteria for releasing it are applied, i.e., legitimate and not overcome by the rights of others? Should it just be “access”?<o:p></o:p></span></li></ol>
<div style="margin-left:.5in">
<p class="MsoNormal"><span style="font-size:12.0pt;color:#4472C4">RESPONSE: “Reasonable access” is not defined in the Temporary Specification. Generally, compliance with the requirement for registrars and registries to provide reasonable access to non-public
registration data is evaluated on a case-by-case basis, based on evidence provided by the requestor, including its request for access to non-public registration data, evidence of the requestor’s legitimate purpose for accessing the non-public registration
data, the timing and content of the contracted party’s response to the request (if any), and any other information or evidence relevant to assessing the request and response.</span><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt"> <o:p></o:p></span></p>
</div>
<ol style="margin-top:0in" start="5" type="1">
<li class="MsoNormal" style="mso-list:l3 level1 lfo5"><span style="font-size:12.0pt">Believing that ICANN org has its own GDPR implementation plan in place, it would be helpful for our group to understand the elements and implementation status of the plan so
that the Team can draw comparisons to the EPDP Team’s work.<o:p></o:p></span></li></ol>
<div style="margin-left:.5in">
<p class="MsoNormal"><span style="font-size:12.0pt;color:#4472C4">RESPONSE: ICANN org has been open and transparent about its work to get ready for GDPR both in terms of domain registration data collected and processed by registrars and registries (which we
refer to as “external” GDPR readiness), and personal data processed by ICANN org in the ordinary course of the organization’s operations such as finance, meetings, and human resources (which we refer to as “internal” GDPR readiness). ICANN org’s plans and
activities regarding “external” (domain registration data) GDPR compliance have been openly and transparently blogged and posted on the ICANN Data Protection page at <<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_dataprotectionprivacy&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=7_PQAir-9nJQ2uB2cWiTDDDo5Hfy5HL9rSTe65iXLVM&m=Nrf6bKrvsykZGHL24CAh_xRrvT36VWO3MZAaS9S3rwg&s=o5kpmLHVTAXiBcLLdjAkDo9fw_NDBpaL_W_RI4oBHVU&e="><span style="color:#954F72">https://www.icann.org/dataprotectionprivacy
[icann.org]</span></a>>. On 5 June 2018, ICANN’s CEO and President, Göran Marby, shared information about ICANN org’s “internal” efforts to be GDPR compliant via a blog. In the blog, Göran shared that several of ICANN’s policies have been updated. These include
an updated online</span><span style="font-size:12.0pt"> <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_policy&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=7_PQAir-9nJQ2uB2cWiTDDDo5Hfy5HL9rSTe65iXLVM&m=Nrf6bKrvsykZGHL24CAh_xRrvT36VWO3MZAaS9S3rwg&s=9eBxdr4sorcBGsA7vQP1IVjq2IzUlENO1qHvo9-VmHU&e="><span style="color:#954F72">Privacy
Policy [icann.org]</span></a><span style="color:#4472C4">, a revised</span> <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_tos&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=7_PQAir-9nJQ2uB2cWiTDDDo5Hfy5HL9rSTe65iXLVM&m=Nrf6bKrvsykZGHL24CAh_xRrvT36VWO3MZAaS9S3rwg&s=jdocKK6O5-gS9OhVMg5AglC8csh_s5PqX9a2mSQlIxc&e="><span style="color:#954F72">Terms
of Service [icann.org]</span></a><span style="color:#4472C4">, a revised</span> <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_cookies&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=7_PQAir-9nJQ2uB2cWiTDDDo5Hfy5HL9rSTe65iXLVM&m=Nrf6bKrvsykZGHL24CAh_xRrvT36VWO3MZAaS9S3rwg&s=u7QdQ-d1h3dqqc9AajKCAjSUyXiozU3toyklBpDwf1U&e="><span style="color:#954F72">Cookies
Policy [icann.org]</span></a><span style="color:#4472C4">, a new<span class="apple-converted-space"> </span></span><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_applicantnotice&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=7_PQAir-9nJQ2uB2cWiTDDDo5Hfy5HL9rSTe65iXLVM&m=Nrf6bKrvsykZGHL24CAh_xRrvT36VWO3MZAaS9S3rwg&s=4jPGDLmyRwu4RlCTBT4iWdpuI8TsOkHfcapFC2PNM04&e="><span style="color:#954F72">Notice
of Applicant Privacy [icann.org]</span></a> <span style="color:#4472C4">(relating to data processed for employment applications), and a revised </span><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__newgtlds.icann.org_en_applicants_agb_program-2Dprivacy&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=7_PQAir-9nJQ2uB2cWiTDDDo5Hfy5HL9rSTe65iXLVM&m=Nrf6bKrvsykZGHL24CAh_xRrvT36VWO3MZAaS9S3rwg&s=8_LInETU0eQiT-bwSUssWcI4XaTQgty3Ie0CQ1GAZh8&e="><span style="color:#954F72">New
gTLD Program Personal Data Privacy Statement [newgtlds.icann.org]</span></a><span style="color:#4472C4">. Additionally, ICANN org has also rolled out internal changes to the way we handle personal data, from data processing arrangements with vendors to our
various personnel policies. Read the full blog</span> <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_news_blog_data-2Dprotection-2Dprivacy-2Dupdate-2Dicann-2Ds-2Dgdpr-2Defforts-2Dwith-2Dtemporary-2Dspecification-2Dnow-2Din-2Deffect&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=7_PQAir-9nJQ2uB2cWiTDDDo5Hfy5HL9rSTe65iXLVM&m=Nrf6bKrvsykZGHL24CAh_xRrvT36VWO3MZAaS9S3rwg&s=rPkY8xbl1JpuTYQTFJlA1hCgwQftjmZ4YSes0XyEuKc&e="><span style="color:#954F72">here
[icann.org]</span></a><span style="color:#4472C4">.</span><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt"> <o:p></o:p></span></p>
</div>
<ol style="margin-top:0in" start="6" type="1">
<li class="MsoNormal" style="mso-list:l0 level1 lfo6"><span style="font-size:12.0pt">The Council envisioned, via the EPDP Charter, to have direct participation of ICANN org liaisons, within the EPDP Team. As we leave the Triage and head into substantive detail,
do the ICANN liaisons see a role or specific set of actions for ICANN supporting the team?<o:p></o:p></span></li></ol>
<div style="margin-left:.5in">
<p class="MsoNormal"><span style="font-size:12.0pt;color:#4472C4">RESPONSE: Section III of the EPDP Charter describes the role of ICANN org liaisons as “ICANN Staff Liaison: The ICANN Org GDD and Legal Liaisons are expected to provide timely input on issues
that may require ICANN Org input such as implementation-related queries. The ICANN Staff Liaisons are not expected to advocate for any position and/or participate in any EPDP Team consensus calls.” In line with this description of ICANN org liaisons’ role,
Göran Marby’s<span class="apple-converted-space"> </span><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_system_files_correspondence_marby-2Dto-2Dforrest-2Det-2Dal-2D02aug18-2Den.pdf&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=7_PQAir-9nJQ2uB2cWiTDDDo5Hfy5HL9rSTe65iXLVM&m=Nrf6bKrvsykZGHL24CAh_xRrvT36VWO3MZAaS9S3rwg&s=252ITNRRKWilGQCd9eVuh5i9gr_w4KjlW_grja81FIk&e="><span style="color:#954F72">response
[icann.org]</span></a><span class="apple-converted-space"> </span>to the GNSO Council regarding a request for appointment of ICANN org liaisons confirmed the scope of participation of the ICANN org liaisons as “Trang Nguyen from ICANN organization’s Global
Domains Division and Dan Halloran from ICANN’s legal team will join the working group’s mailing list and the group’s calls to coordinate responses to requests for GDD or legal input as needed to support the working group’s deliberations. Such requests will
ordinarily be responded to in writing, following consultation with internal and external experts as appropriate.”<span class="apple-converted-space"> </span></span><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>