<div dir="ltr"><p class="gmail-MsoTitle" style="margin:0cm 0cm 0.0001pt;font-size:28pt;font-family:"Calibri Light",sans-serif;letter-spacing:-0.5pt"><span lang="EN-US">Suggested Redlines to ensure lawfulness of
processing is not limited to Article 6.1.f and thus subject to a balancing
test. </span></p>
<p class="MsoNormal" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif"><span lang="EN-US"> </span></p>
<p class="MsoNormal" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif"><span lang="EN-US"> </span></p>
<h1 style="margin:12pt 0cm 0.0001pt;break-after:avoid;font-size:16pt;font-family:"Calibri Light",sans-serif;color:rgb(47,84,150);font-weight:normal"><span lang="EN-US">Section 4.4</span></h1>
<p class="gmail-Default" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif;color:black"><span lang="EN-US"> </span></p>
<p class="gmail-Default" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif;color:black"><span lang="EN-US" style="font-size:11.5pt">However, such
Processing must be in a manner that complies with the GDPR, including on the
basis of a specific identified purpose for such Processing. Accordingly,
Personal Data included in Registration Data may be Processed on the lawful
bases as scoped in GDPR Article 2 or as enumerated in GDPR Article 6.1, and for at least the following
legitimate purposes: </span></p>
<p class="gmail-Default" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif;color:black"><span lang="EN-US" style="font-size:11.5pt">Comments from
Kavouss </span></p>
<p class="gmail-Default" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif;color:black"><span lang="EN-US" style="font-size:11.5pt">In order to enable
the reader to agree with the proposed changes, the referred Articles of GPDR
should be hyperlinked.However, therte are two WAYS:</span></p>
<p class="gmail-Default" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif;color:black"><span lang="EN-US" style="font-size:11.5pt">One WAY would be that
the Text of Temp .Specification, which at later date become definitive
specification should be self contained and self sufficient in order to avois </span><span lang="EN-US">D the readers to refer to other sources as well as to avoid
misinterpretation of several terms and associated qulaifiers mentioned in those
Articles.</span></p>
<p class="gmail-Default" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif;color:black"><span lang="EN-US">The Second way would be to make the text as
concise and short as possible but cross reference to othe Articles of GPDR with
the risk of unintended misiterpretations and lack of definitions of terms and
qualifiers used in those Articles </span></p>
<p class="gmail-Default" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif;color:black"><span lang="EN-US">Appendix A.4.1</span></p>
<p class="gmail-Default" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif;color:black"><span lang="EN-US"> </span></p>
<p class="gmail-Default" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif;color:black"><b><span lang="EN-US" style="font-size:11.5pt">4. Access to
Non-Public Registration Data </span></b></p>
<p class="gmail-Default" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif;color:black"><b><span lang="EN-US" style="font-size:11.5pt"> </span></b></p>
<p class="gmail-Default" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif;color:black"><span lang="EN-US" style="font-size:11.5pt">4.1. Registrar and
Registry Operator MUST provide reasonable access to Personal Data in
Registration Data to third parties on the lawful bases as scoped in GDPR
Article 2 and as enumerated in GDPR Article 6.1. </span></p>
<p class="gmail-Default" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif;color:black"><span lang="EN-US" style="font-size:11.5pt">See above comments </span></p>
<p class="gmail-Default" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif;color:black"><span lang="EN-US" style="font-size:11.5pt"> </span></p>
<p class="gmail-Default" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif;color:black"><span lang="EN-US"> </span></p>
<h1 style="margin:12pt 0cm 0.0001pt;break-after:avoid;font-size:16pt;font-family:"Calibri Light",sans-serif;color:rgb(47,84,150);font-weight:normal"><span lang="EN-US">Appendix C.2</span></h1>
<p class="gmail-Default" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif;color:black"><span lang="EN-US"> </span></p>
<p class="gmail-Default" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif;color:black"><b><span lang="EN-US" style="font-size:11.5pt">2. Lawfulness of
Processing </span></b></p>
<p class="gmail-Default" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif;color:black"><span lang="EN-US" style="font-size:11.5pt"> </span></p>
<p class="MsoNormal" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif"><span lang="EN-US" style="font-size:11.5pt">For Personal Data
Processed in connection with the Registration Data Directory Services, such
Processing will take place on the lawful bases as scoped in GDPR Article 2 and
as enumerated in GDPR Article 6.1, For other Personal Data collected for other
purposes, such Personal Data SHALL NOT be Processed unless a legal basis
specified under Article 6(1) GDPR applies.</span></p>
<p class="MsoNormal" style="margin:0cm 0cm 0.0001pt;font-size:12pt;font-family:Calibri,sans-serif"><span lang="EN-US" style="font-size:11.5pt">See above comments </span><span lang="EN-US"></span></p></div><br><div class="gmail_quote"><div dir="ltr">On Mon, Sep 3, 2018 at 10:10 PM Alex Deacon <<a href="mailto:alex@colevalleyconsulting.com">alex@colevalleyconsulting.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">All,<div><br></div><div>On Thursday I took an action to propose updates that ensures lawfulness of processing is not limited to Article 6.1.f (and thus subject to a balancing test). </div><div><br></div><div>I've attached a proposed redline for discussion. You will note it addresses Section 4.4 and Appendix C.2 (per my action) and for completeness I also updated Appendix A.4.1 for consistency. </div><div><br></div><div>Regards,</div><div>Alex</div><div><br></div><div><br></div><div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="m_856798209008078530gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">___________<div><b>Alex Deacon</b></div><div>Cole Valley Consulting</div><div><a href="mailto:alex@colevalleyconsulting.com" target="_blank">alex@colevalleyconsulting.com</a></div><div>+1.415.488.6009</div><div><br></div></div></div></div></div>
_______________________________________________<br>
Gnso-epdp-team mailing list<br>
<a href="mailto:Gnso-epdp-team@icann.org" target="_blank">Gnso-epdp-team@icann.org</a><br>
<a href="https://mm.icann.org/mailman/listinfo/gnso-epdp-team" rel="noreferrer" target="_blank">https://mm.icann.org/mailman/listinfo/gnso-epdp-team</a></blockquote></div>