<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Everyone: </div><div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""></div><div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">I am writing to discuss two items. Comments are very welcome. (I apologize for the length of the email.)</div><div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""></div><div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""></div><div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">I. DISCUSSION OF DATA ELEMENTS / ORGANIZATION OF OUR DISCUSSION<br class=""><div class=""><br class=""></div><div class="">I took on board the comments made during the last meeting regarding the need to discuss data elements and the apparent skipping from section to section of the Temporary Specification. </div><div class=""><br class=""></div><div class="">The project plan essentially follows the path described in the Charter: I.e.:</div><div class=""><br class=""></div><div class="">Data Process Purposes —> Data Processing —> Legitimate reasons for disclosure —> Data redaction —> some ancillary but important topics</div><div class=""><br class=""></div><div class="">I can see that the examination of the data collected (and therefore available for subsequent types of processing, including disclosure) was not explicitly included. To a certain extent, I think this data set was presumed set (at least by me) to be part of the data redaction discussions. Nonetheless, we cannot describe which data is redacted without specifically describing which data is collected in the first place. </div><div class=""><br class=""></div><div class="">With that in mind and the help of Thomas’ work, we will have that topic more explicitly in the agenda today. </div><div class=""><br class=""></div><div class="">For organization and jumping from topic to topic, I think we must, at the end of the day, cover each of the sections in the Temporary Specification and decide if and how each topic should be included in the policy. With that in mind we created a project plan that marched through the Temporary Specification in an order that (more-or-less) followed the charter or our common-sense dictates. </div><div class=""><br class=""></div><div class=""><img apple-inline="yes" id="F05CD898-F85B-437C-9D8C-215CA27CF933" src="cid:52AEA82B-1C1F-4237-B11B-EF1A793B4630@gateway" class=""></div><div class=""><br class=""></div><div class="">I included two topics per meeting with the idea that intercessional work would be required on each topic and, after 45 minutes on one topic, we would reach a point of diminishing returns. </div><div class=""><br class=""></div><div class="">I think that is still a good approach but we always retain the ability to extend a discussion if we are close to resolution on an issue. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">II. CONSENSUS POLICY ORGANIZATION REGARDING: PURPOSES FOR PROCESSING gTLD REGISTRATION DATA</div><div class=""><br class=""></div><div class="">In our last meeting, I believe we reached a joint understanding of the requirements to be considered a “Lawful Purpose for Processing gTLD Registration Data.” </div><div class=""><br class=""></div><div class="">We concluded that these would continue to be categorized under Lawfulness and Purposes of Processing gTLD Registration Data:</div><div class="">4.4.1. – Ability for Registered Name Holder to exercise its rights<br class="">4.4.3. – Enabling mechanism for identifying and contacting registered name holder<br class="">4.4.4. – Payment and invoicing<br class="">4.4.5. – Notification of technical issues<br class="">4.4.6. - Notification of commercial or technical changes<br class="">4.4.7. – Technical & administrative points of contact<br class="">4.4.11. – Safeguarding in case of failure<br class="">4.4.12. – Dispute resolution services<br class="">4.4.13. – ICANN Contractual Compliance</div><div class=""><br class=""></div><div class="">…and these would be memorialized under a different heading: </div><div class="">4.4.2. – Providing access based on legitimate interests not outweighed by the fundamental rights<br class="">4.4.8. – Supporting a framework to address consumer protection, investigation of cybercrime, DNS abuse, IP protection<br class="">4.4.9. – Framework to address LE needs<br class="">4.4.10. – Provision of zone files to Internet users</div><div class=""><br class=""></div><div class="">I think this was a great joint understanding of our team (that same understanding only occurred to me in the last several days) and will get us onto determining substance, i.e., the mechanisms for disclosure in the near term. </div><div class=""><br class=""></div><div class="">Ashley suggested the latter set be captured in an Appendix. I think that is a good recommendation. As GDPR interpretation evolves or different privacy regimes are adopted, the legitimate reasons (or reasons with a legal basis) for disclosing data to third parties and be changed with adoption of amendments to the Appendix. However, I think the third-party disclosure should be anchored in the Temporary Specification body and incorporate the Appendix by reference. This is similar to other sections of the Temporary Specification. </div><div class=""><br class=""></div><div class="">This could be done in one of the two ways in red below and add a new Appendix: </div><div class="">1. Scope<br class="">2. Definitions and Interpretation<br class="">3. Policy Effective Date<br class="">4. Lawfulness and Purposes of Processing gTLD Registration Data</div><div class=""><font color="#ff2600" class="">* Requirements for Data Disclosure to Third Parties (alternative A)</font><br class="">5. Requirements Applicable to Registry Operators and Registrars<br class="">6. Requirements Applicable to Registry Operators Only<br class="">7. Requirements Applicable to Registrars Only</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span><font color="#ff2600" class="">7.5 </font><span style="caret-color: rgb(255, 38, 0); color: rgb(255, 38, 0);" class="">Requirements for Data Disclosure to Third Parties (alternative B)</span><br class="">8. Miscellaneous<br class="">Appendix A: Registration Data Directory Services<br class="">Appendix B: Supplemental Data Escrow Requirements<br class="">Appendix C: Data Processing Requirements<br class="">Appendix D: Uniform Rapid Suspension<br class="">Appendix E: Uniform Domain Name Dispute Resolution Policy<br class="">Appendix F: Bulk Registration Data Access to ICANN<br class="">Appendix G: Supplemental Procedures to the Transfer Policy<br class=""><span style="caret-color: rgb(255, 38, 0); color: rgb(255, 38, 0);" class="">Appendix H: Third Party Disclosure</span></div><div class="">Annex: Important Issues for Further Community Action<br class=""><br class=""></div><div class=""><br class=""></div><div class="">Thanks for taking the time to read and consider this. It came out longer than I planned.</div><div class=""><br class=""></div><div class="">Best regards,</div><div class=""><br class=""></div><div class="">Kurt</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div></div></div></div></div></body></html>