<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><a name="_MailEndCompose"><span style='color:#1F497D'>Hi Milton,<o:p></o:p></span></a></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Thank you for your questions. Hopefully, this response will cure your concern.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>In short, staff understands this as an evolution of workbook template structure and perhaps Question #1 within the latest version can be reworded.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>You will recall that the first iteration of our workbooks only contained a Purpose Statement with a series of nine questions to better understand the purpose. During the LA F2F, we started to deliberate the lawful basis against the Purpose Statement only and by Wednesday morning of the F2F the lawful basis small team started to define multiple Processing Activities for each Purpose Statement. This is where the group recognized the possibility of a lawful basis for each defined Processing Activity and not just the Purpose Statement itself. As it turned out, a few of the questions within that set of nine was an initial attempt at defining a processing activity, but the first version of the workbook template fell short in that the Data Elements section along the left side only referred to the processing activity of Collection. The old workbook format outgrew its usefulness in that we also needed to identify/confirm the Data Elements for the other three standard Processing Activities such as Transmission, Disclosure, and Retention. Hence the launch of the next generation workbook the EPDP has been using for the last several weeks.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>As you will now see, each Processing Activity (Collection, Transmission, Disclosure, Retention) has its own lawful basis (either 6(1)(b) or 6(1)(f)) along with a brief rationale statement. The intent here is that each Processing Activity, its lawful basis, and its brief rational are each connected back to an reinforce the rationale for the Purpose Statement.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>With the latest version of the workbook, the attempt to complete the rationale for Question #1 of the Purpose Statement was to key off the part of question “if the purpose was based on a ICANN contract.” Or, as in Question #2 identifying the relevant ICANN bylaw that supports the definition of the Purpose Statement and finally Question #3 about the “picket fence” which is connected to both questions #1 & #2.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>In transitioning to the next version of the workbook template, I wanted to stay as true to the prior version as much as possible. Therefore, Question #1 did not change, even though the lawful basis determination in answering the question of “is the processing necessary to achieve the purpose” shifted to the Lawfulness of Processing Test section.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Would a modification of Question #1 address your concern to perhaps “Cite the relevant section of the ICANN contracts that corresponds to the above purpose, if any.”? In keeping with the nature of the drilling down framework, we can even swap Question #1 with Question #2 so that we start at the top with the identification of ICANN Bylaws and then second the identification ICANN contract provisions and third to the “picket fence” considerations.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Please advise if this may address the concerns you raise below.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Thank you.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Marika, Caitlin, and Berry.<o:p></o:p></span></p><div><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Berry Cobb<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>GNSO Policy Consultant<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>@berrycobb<o:p></o:p></span></p></div><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org] <b>On Behalf Of </b>Mueller, Milton L<br><b>Sent:</b> Monday, October 29, 2018 06:23<br><b>To:</b> GNSO EPDP<br><b>Subject:</b> [Gnso-epdp-team] Major issue in the Data Elements workbooks<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I’ve gone through three workbooks now (Purposes A, B and C) and have noticed a significant error in all three of them. Whoever did the last revision of these documents has confused the question whether something is within ICANN’s mission with the question whether it is lawful under GDPR.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>For example, in Purpose A, Purpose Rationale 1 asks, <o:p></o:p></p><p class=MsoNormal>“<span style='color:black'>1) If the purpose is based on an ICANN contract, is this lawful as tested against GDPR and other laws?”<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>The answer provided has struck out all the appropriate language about 6.1.b vs 6.1.f, and has inserted: “Yes, this purpose is lawful based on ICANN’s mission to coordinate the allocation and assignment of names in the root zone of the Domain Name System.” It goes on to cite the RAA. <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>Something similar has happened with Purposes B and C. Language about lawfulness under GDPR has been replaced with language about ICANN’s mission or contracts. <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>This is a mistake, and cannot stand. References to ICANN’s mission and contracts tell us nothing about whether something is “lawful as tested against GDPR and other laws.” <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>Perhaps the staff and Kurt can clarify how this happened. <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>NCSG members are preparing modified versions of the workbooks which correct the error, but it might be easier if whoever made these modifications would systematically reverse them. My problem is that I do not know what exact language regarding purpose rationale was accepted before these changes were made. <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal>Dr. Milton L. Mueller<o:p></o:p></p><p class=MsoNormal>Professor, School of Public Policy<o:p></o:p></p><p class=MsoNormal>Georgia Institute of Technology<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>