<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
<div dir="ltr"></div>
<div dir="ltr">Dear All,</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">Please find below additional responses from ICANN Org to a number of outstanding questions. We’ll get these posted shortly on the related wiki page. </div>
<div dir="ltr"><br>
</div>
<div dir="ltr">Best regards,</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">Caitlin, Berry and Marika<br>
<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> —————————————</o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt"> </span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">The EPDP Team previously requested a summary of ICANN org’s contacts and engagements with the EPDP and DPAs. ICANN org provided a response, which is provided again
below for reference:</span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt"> </span><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="mso-bookmark:_MailOriginalBody"><span style="color:#4472C4">QUESTION: Can ICANN summarize in some searchable form the contacts and engagements with the EDPB and/or other DPAs in relation to the Temporary
Specification for gTLD Registration Data?</span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="color:#4472C4"> </span><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="mso-bookmark:_MailOriginalBody"><span style="color:#4472C4">RESPONSE: ICANN org has been open and transparent with our engagements with the EDPB and DPAs. All of the formal written communications from
EDPB and DPAs are published on ICANN correspondence. In addition, we’ve had informal verbal conversations with the EDPB and DPAs to educate, inform, and ask for guidance. Summaries of those informal conversations are published in blogs. To assist the EPDP
Team in its work, ICANN org will provide the EPDP Team with a compiled list of correspondence received and blogs published thus far, including the topic of each correspondence/blog.</span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt"> </span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">As follow-up to the above response, attached is a summary of correspondence between ICANN org and the EPDP/DPAs, as well as announcements and blogs relating to
ICANN org’s GDPR-related efforts. The document is marked as draft so that the EPDP Team can review and provide suggestions for re-organization or re-structuring of the content to best meet the EPDP Team’s needs.</span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt"> </span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">QUESTION: For which ICANN policies is admin/tech contact information currently a required data element and/or referenced in the policy?</span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt"> </span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">RESPONSE: Administrative and technical contact information is referenced in the following ICANN policies and procedures:</span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt"> </span><o:p></o:p></span></p>
<ul style="margin-top:0in" type="disc">
<li class="MsoNormal" style="mso-list:l0 level1 lfo3"><span style="mso-bookmark:_MailOriginalBody"></span><a href="https://www.icann.org/resources/pages/rdds-labeling-policy-2017-02-01-en"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">Registry
Registration Data Directory Services Consistent Labeling and Display Policy</span></span><span style="mso-bookmark:_MailOriginalBody"></span></a><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">. Output requirements for administrative
and technical contact information.</span></span><span style="mso-bookmark:_MailOriginalBody"><o:p></o:p></span></li><li class="MsoNormal" style="mso-list:l0 level1 lfo3"><span style="mso-bookmark:_MailOriginalBody"></span><a href="https://www.icann.org/resources/pages/thick-whois-transition-policy-2017-02-01-en"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">Thick
WHOIS Transition Policy for .COM, .NET, .JOBS</span></span><span style="mso-bookmark:_MailOriginalBody"></span></a><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">. Guidance to registry operators for handling output of administrative
and technical contact information where no data exists in the SRS during the period when registrars begin sending Thick WHOIS data to registry operators for all new registrations.</span></span><span style="mso-bookmark:_MailOriginalBody"><o:p></o:p></span></li><li class="MsoNormal" style="mso-list:l0 level1 lfo3"><span style="mso-bookmark:_MailOriginalBody"></span><a href="https://www.icann.org/resources/pages/udrp-rules-2015-03-11-en"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">Rules
for Uniform Domain Name Dispute Resolution Policy</span></span><span style="mso-bookmark:_MailOriginalBody"></span></a><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">. Notifications of complaints include administrative and technical
contacts information.</span></span><span style="mso-bookmark:_MailOriginalBody"><o:p></o:p></span></li><li class="MsoNormal" style="mso-list:l0 level1 lfo3"><span style="mso-bookmark:_MailOriginalBody"></span><a href="https://www.icann.org/en/resources/registrars/consensus-policies/wdrp"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">WHOIS
Data Reminder Policy</span></span><span style="mso-bookmark:_MailOriginalBody"></span></a><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">. WDRP notices may be presented to the registrant either directly or through the administrative
contact.</span></span><span style="mso-bookmark:_MailOriginalBody"><o:p></o:p></span></li><li class="MsoNormal" style="mso-list:l0 level1 lfo3"><span style="mso-bookmark:_MailOriginalBody"></span><a href="https://www.icann.org/resources/pages/transfer-policy-2016-06-01-en"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">Transfer
Policy</span></span><span style="mso-bookmark:_MailOriginalBody"></span></a><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">. Administrative contact along with the registered name holder have the authority to approve or deny a transfer
request. Because of this role, the administrative contact is referenced in parts of the transfer process as well as in the Registrar Transfer Dispute Resolution Policy.</span></span><span style="mso-bookmark:_MailOriginalBody"><o:p></o:p></span></li><li class="MsoNormal" style="mso-list:l0 level1 lfo3"><span style="mso-bookmark:_MailOriginalBody"></span><a href="http://newgtlds.icann.org/en/applicants/urs/rules-28jun13-en.pdf"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">Uniform
Rapid Suspension System (URS) Rules</span></span><span style="mso-bookmark:_MailOriginalBody"></span></a><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">. Notifications of complaints include administrative and technical contacts
information.</span></span><span style="mso-bookmark:_MailOriginalBody"><o:p></o:p></span></li></ul>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt"> </span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">QUESTION: We have spent most of this meeting exploring the role of compliance at ICANN, in order to support a proposal that ICANN has an implicit contract with
the registrant and that therefore 6 1 b applies as a grounds for processing. This would also facilitate ICANN operating a UAM on behalf of those who want the data. It might also explain Goran’s initiative in seeking some kind of recognition by EU authorities
that ICANN has a kind of quasi-regulator status, as the authority vested with the responsibility to manage the DNS. Given that all of this is outside the current configuration of ICANN as data controller, which would be more clear had we done a DPIA and had
we adequate data maps to work with….can we either get back to our Charter questions that we were mandated to address by the GNSO, or get a full explanation of what is going on and why we continue to be focused on the access question.</span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt"> </span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">RESPONSE: This request appears to be directed at the EPDP Team and not ICANN org as ICANN org does not dictate the direction of the EPDP Team’s discussion.</span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt"> </span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">QUESTION: Why hasn’t a Data Protection Impact Assessment been carried out to clarify data flows and ICANN’s relationship with the data subject in light of its acknowledged
role as a joint controller and Article 35 of the GDPR?</span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt"> </span><o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="mso-bookmark:_MailOriginalBody">RESPONSE: This question was also asked during the Data Protection/Privacy Update Webinar hosted by ICANN org on 8 October 2018. John Jeffrey, ICANN’s General Counsel and
Secretary provided the following response:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt"> </span><o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="mso-bookmark:_MailOriginalBody">“This is something that has been considered since the very beginning. One of the issues is when to do that in a way that is most timely and useful and how to do that. We
continue to evolve the thinking of how the interpretation of GDPR applies to WHOIS. We have a number of questions which have been addressed directly to the DPAs and the EDPB and we’ve have an ongoing discussion with the EC about how to interpret the GDPR.
We believe that those are a better format at this point than doing the assessment, but we continue to evaluate whether that assessment would be the right thing to do and when.”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt"><br>
The presentation for the webinar is posted </span></span><a href="https://www.icann.org/en/system/files/files/presentation-data-protection-privacy-08oct18-en.pdf"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">here</span></span><span style="mso-bookmark:_MailOriginalBody"></span></a><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">,
and the Adobe Connect recording is </span></span><a href="https://participate.icann.org/p29vt2uxodx/"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">here</span></span><span style="mso-bookmark:_MailOriginalBody"></span></a><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt">.
The question and response start at 0:27:00 in the Adobe Connect recording.</span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailOriginalBody"><span style="font-size:11.0pt"> </span><o:p></o:p></span></p>
</div>
</div>
</blockquote>
<blockquote type="cite">
<div dir="ltr"></div>
</blockquote>
</body>
</html>