<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">All,</div><div class="">A few points below that I committed to send to the list. </div><div class=""><br class=""></div><div class=""><b class="">Data matrix</b></div><div class=""><br class=""></div><div class="">During our last call, we have discussed a proposed methodology to slice and dice the work and document what data elements can be processed for what purpose based on what legal basis with what rationale. I have attached an attempt to capture that. This only covers the framework for capturing the collection of data by the registrar and the transfer from registrar to registry. The table would need to be extended to cover the additional processing activities, but at this stage it shall serve only to illustrate an approach where we could all feed our ideas into one document with a level of granularity that prevents us from conflating issues. </div><div class=""><br class=""></div><div class=""><b class="">4.4.8.</b></div><div class=""><br class=""></div><div class="">Also, when we discussed 4.4.8. I proposed we also discuss the purpose in concrete terms. Milton asked me to give an example. </div><div class=""><br class=""></div><div class="">4.4.8 reads: <span lang="EN-US" class="">Supporting<span style="letter-spacing:.3pt" class=""> </span>a<span style="letter-spacing:.3pt" class=""> </span>framework<span style="letter-spacing:.3pt" class=""> </span>to<span style="letter-spacing:.3pt" class=""> </span>address<span style="letter-spacing:.35pt" class=""> </span>issues<span style="letter-spacing:.3pt" class=""> </span>involving<span style="letter-spacing:.3pt" class=""> </span>domain<span style="letter-spacing:.3pt" class=""> </span>name<span style="letter-spacing:.3pt" class=""> </span>registrations,<span style="letter-spacing:
.3pt" class=""> </span>including<span style="letter-spacing:.35pt" class=""> </span>but<span style="letter-spacing:.3pt" class=""> </span>not</span><span lang="EN-US" style="letter-spacing: 1.25pt;" class=""> </span><span lang="EN-US" class="">limited to: consumer<span style="letter-spacing:.05pt" class=""> </span>protection, investigation<span style="letter-spacing:.05pt" class=""> </span>of cybercrime, DNS<span style="letter-spacing:
.05pt" class=""> </span>abuse, and<span style="letter-spacing:.05pt" class=""> </span>intellectual
property</span><span lang="EN-US" style="letter-spacing: 1.25pt;" class=""> </span><span lang="EN-US" class="">protection only.</span></div><div class=""><br class=""></div><div class="">Many in the group think this is too broad.</div><div class=""><br class=""></div><div class="">So let’s take IP protection.</div><div class=""><br class=""></div><div class="">If the purpose included the publication of all data of potential cybersquatters, including their payment data to allow for investigators to do their work efficiently, I think we would all agree that that would go too far. Yet, one could think that such action was covered by the purpose of 4.4.8..</div><div class=""><br class=""></div><div class="">On the other hand, if in the case of a UDRP proceeding, the data of the registrant shall be disclosed to the dispute resolution provider, we would probably (not to say hopefully) all agree that this would be fine. </div><div class=""><br class=""></div><div class="">So my plea is that when we are talking about all those issues that could fall under 4.4.8. - let’s come up with concrete suggestions as to what the parties involved are supposed to do. We should all put some thought into that. What shall be done in the area of consumer protection e.g.? Are we talking about collection of additional data elements? Disclosing them to third parties? Retaiing them for a longer period? In other work, what could or should consumer protection entail in the gTLD world? Same for the other aspects in 4.4.8.</div><div class=""><br class=""></div><div class=""><b class="">Playbook</b></div><div class=""><br class=""></div><div class="">Mark asked during the last call to send a link to the eco Playbook. Here it is:</div><div class=""><a href="https://www.eco.de/wp-content/uploads/2018/02/eco-domain-industry-playbook-v1.0-en.pdf" class="">eco GDPR Domain Industry Playbook</a></div><div class=""><br class=""></div><div class="">We have gone through a lot of the exercises that this group will need to go through, so I encourage you to take a look at it. Maybe we can reuse parts of it to expedite our work.</div><div class=""><br class=""></div><div class="">Don’t get me wrong - I am not trying to sell you the approach in the Playbook, but I think it can be a good basis to argue over certain questions. Finally, I happen to be one of the authors. The good sentences have likely been written by others.</div><div class="">The things you might not like surely come from me.</div><div class=""><br class=""></div><div class="">Best,</div><div class="">Thomas</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>