<div dir="ltr"><div>T<span class="gmail_default" style="font-family:verdana,sans-serif">he question was whether accurate Geo location can help CPs identify applicable laws. </span></div><div><span class="gmail_default" style="font-family:verdana,sans-serif"><br></span></div><div dir="auto">Yes <span class="gmail_default" style="font-family:verdana,sans-serif"> GDPR applies to data subjects who are "in" the EU. And </span>a lot of sources on Google say that EU citizens are not protected by GDPR when outside of the EU and it applies to <span class="gmail_default" style="font-family:verdana,sans-serif"> those who are "in" the </span>EU <span class="gmail_default" style="font-family:verdana,sans-serif"> when data being processed. </span> So non resident EU citizens (A French national living in China) is not a GDPR data subject. <span class="gmail_default" style="font-family:verdana,sans-serif"> There are still arguments over that as well. </span>The only thing that <span class="gmail_default" style="font-family:verdana,sans-serif"> might be clear is that those physically in the EU at the time of registration (regardless of their nationality) </span><span class="gmail_default" style="font-family:verdana,sans-serif"> </span>are data subject just to make sure gdpr coverage goes beyond citizenship. <span class="gmail_default" style="font-family:verdana,sans-serif"> But it is not clear what would happen to EU citizens on vacation or long stays in other countries. </span></div><div dir="auto"><span class="gmail_default" style="font-family:verdana,sans-serif"><br></span></div><div dir="auto"><span class="gmail_default" style="font-family:verdana,sans-serif"> Does being "in" the EU refer to the "location" of data subject at the time of registration or does it for EU citizens refer to the main place of residence? </span>A French <span class="gmail_default" style="font-family:verdana,sans-serif"> citizen </span>who registers a domain name on vacation in the Caribbean is not physically present in the EU at the time of registration. Is that person not subject to GDPR because they <span class="gmail_default" style="font-family:verdana,sans-serif"> were not in the EU </span>? Or if they register a domain in <span class="gmail_default" style="font-family:verdana,sans-serif"> P</span>ort of <span class="gmail_default" style="font-family:verdana,sans-serif"> S</span>pain indicating their location as Paris then what would happen<span class="gmail_default" style="font-family:verdana,sans-serif"> ?Is there a EDPB avice on this? </span></div><div dir="auto"><br></div><div dir="auto"><div class="gmail_default" style="font-family:verdana,sans-serif">All in all, yes GDPR applies to those who are "in" the EU regardless of their nationality. But in the case of domain name registration, geographical location does not clarify the applicable law in my opinion. Many other factors have to be taken into account. What is being in the EU? does that mean where they have their main residency? where they pay taxes? where their cruise is taking them? If we don't have clarity on this we cannot simply say if they make their geographical location clear we have established the applicable law correctly. </div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">Hadia I am glad you are asking which organizations would want to hide their physical address from the public. I hope this can provide some explanation as to why I get irritated when we are lumping all organizations together and ask for their sensitive data to be exposed to the public:</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">Organizations that are critical of their governments and even if established abroad can be under threat </div><div class="gmail_default" style="font-family:verdana,sans-serif">Organizations that work for minority rights and women rights </div><div class="gmail_default" style="font-family:verdana,sans-serif">Organizations that are trying to hold various actors accountable </div><div class="gmail_default" style="font-family:verdana,sans-serif">Organizations that analyze and criticize religious extremists </div><div class="gmail_default" style="font-family:verdana,sans-serif">Human rights law firms/HR lawyers in certain parts of this world are in prison</div><div class="gmail_default" style="font-family:verdana,sans-serif">... I can continue </div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">some say we are not here to protect and advance human rights. We are not here to violate HR and put people in danger either. We are not here to protect all consumers globally from whatever fraud regardless of whether it relates to DNS. We are not here to facilitate all kinds of law enforcement action that do not relate to security stability resiliency of DNS, we are not here to protect trademark and IP at any cost and at a global scale and beyond ICANN mission. </div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">Does distinguishing between legal and natural person help with advancing ICANN purpose and mission or third party interest? Please tell me how. </div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">I wish someone could answer my question. For the past three months, this group was dominated by access to WHOIS sensitive personal data discussion. We compromised. Access is now an ICANN purpose. Is it not enough? Is it not enough to pursue your purpose? Why is there a need for distinguishing between legal vs natural persons? If you have legitimate interest you can access anyway. Please let me know why it's not enough to give access to legitimate interest parties and redact orgs sensitive data too. </div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><br></div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><br></div><div><div><div class="gmail_quote"><div dir="ltr">On Sun, Nov 4, 2018 at 10:08 AM Arasteh <<a href="mailto:kavouss.arasteh@gmail.com" target="_blank">kavouss.arasteh@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto">Dear All<div>There are avalanche of contradicting messages</div><div>Everyone pushes for its own views</div><div>Pls ce the validity of all statement </div><div>Haida</div><div>Pls clarify what you said about GDPR against a clause of articles to validate what you stated .</div><div>Others are talking of accuracy</div><div>They are requested to explore what accuracy they are looking by giving examples</div><div>Fritz is kindly requested to reconcile all these contradictory statements </div><div>Regards</div><div>Kavouss </div><div><br><br><div id="m_7108843290738741423m_7429682099164704192m_-5825072784707499304m_-1123132385307418346AppleMailSignature" dir="ltr">Sent from my iPhone</div></div></div><div dir="auto"><div><div dir="ltr"><br>On 4 Nov 2018, at 15:02, Hadia Abdelsalam Mokhtar EL miniawi <<a href="mailto:Hadia@tra.gov.eg" target="_blank">Hadia@tra.gov.eg</a>> wrote:<br><br></div><blockquote type="cite"><div dir="ltr">
<div class="m_7108843290738741423m_7429682099164704192m_-5825072784707499304m_-1123132385307418346WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Hi Farzi,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Just a quick clarification GDPR does not apply to EU citizens not residing in the EU.
</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">The GDPR is not concerned with the citizenship it is concerned with where the person is located. If you leave an EU country and travel to a non EU country you are no longer
protected by the GDPR. </span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">The data rights of the EU citizens located outside of the EU is protected by the laws of the territory that they are at. The data rights of the registrants
is determined by their location (not their citizenship) in addition to the location of the controller and processor. And with regard to protecting registrants we should also not forget the necessity of protecting the registrants against domains hijacking and
thefts which could be devastating to the domain name holder not only financially but in terms of accessibility to the site in case it is a not for profit web page or domain and the rights of the registrants to be able to pursue their rights in this regard.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Finally and on another note which legal entities or businesses would like to be kept hidden??<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Best<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Hadia<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Gnso-epdp-team [<a href="mailto:gnso-epdp-team-bounces@icann.org" target="_blank">mailto:gnso-epdp-team-bounces@icann.org</a>]
<b>On Behalf Of </b>farzaneh badii<br>
<b>Sent:</b> Sunday, November 04, 2018 9:38 AM<br>
<b>To:</b> Alan Greenberg<br>
<b>Cc:</b> <a href="mailto:gnso-epdp-team-bounces@icann.org" target="_blank">gnso-epdp-team-bounces@icann.org</a>; <a href="mailto:alex@the-online.net" target="_blank">alex@the-online.net</a>; GNSO EPDP<br>
<b>Subject:</b> Re: [Gnso-epdp-team] Further Input from the IPC/BC on Small Team #1 and #2 issues<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif"">Dear Diane,<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif"">How can registrars determine the applicable law even if the geographical information is accurate? I don't think registrars can actually determine which law outside of their own jurisdiction
applies to their registrants even if they know the geographical location. For example, as far as I know EU citizens anywhere in the world are protected by GDPR. So their geographical location does not determine what law applies. Registrars have to abide by
their local laws, the court of law determines the applicable law and some registries have the choice of law clauses in their agreements with registrars which cannot be in conflict with the local laws of the registrars. All in all determining the "jurisdiction"
of data subject is not dependent only on the geographical location of the registrant in this case. <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif"">Also I think every domain name registrant regardless of where they are located deserve minimum data protection. They are consumers by the way! <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif"">I am getting increasingly puzzled by IPC/BC interpretation of "accuracy" of personal information of data subjects under GDPR. In my opinion the concept of accuracy in GDPR is actually supposed
to protect data subjects and not to be used against them. Accurate information is not about keeping the data accurate so that it can be displayed and accessed and mined by many around the world! The accuracy of data is a right given to data subjects so that
inaccurate data cannot be used against them in court and other forums, or be denied a service or end in violating their rights. I believe they have the right for their information to be accurate and not the responsibility (under GDPR) to maintain it accurately.
The registrars under GDPR have to maintain the data of domain name registrants "uptodate" to reduce privacy risks. They don't have to keep the database accurate so that they can distinguish between legal and natural persons. <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif"">I believe by ICO you mean Information Commissioners Office. Specifically this page: <a href="https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/principles/accuracy/" target="_blank">https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/principles/accuracy/</a> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif"">The natural v legal distinction is not only burdensome for the CPs or opens them to liability. It is dangerous for noncommercial/not for porfit/ advocacy organizations that have registered
domain names and are vulnerable to attacks of all sorts.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif"">I assume IPC/BC wants this distinction so that the org personal sensitive data won't be redacted. I would like to know why. I would like to know why while some groups are fiercely working
to have access to personal and sensitive data of domain name registrants for their legitimate interest, also work towards exposing domain name registrants sensitive data to the world. <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif"">Farzaneh </span>
<u></u><u></u></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Fri, Nov 2, 2018 at 10:13 PM Alan Greenberg <<a href="mailto:alan.greenberg@mcgill.ca" target="_blank">alan.greenberg@mcgill.ca</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">This all sounds right to me. Alan<br>
<br>
At 02/11/2018 09:28 PM, Plaut, Diane wrote:<br>
<br>
<br>
<u></u><u></u></p>
<p class="MsoNormal"><a name="m_7108843290738741423_m_7429682099164704192_m_-5825072784707499304_m_-1123132385307418346_m_5034246800143438820_m_-720202763000768"></a>Dear EPDP Team-<br>
<br>
In our efforts to overcome a significant hurdle through our EPDP work – that CPs have expressed they cannot rely on the accuracy of Registrant input and, therefore, are hesitant to distinguish between legal and natural persons or count on country information
input by Registrant’s because if it is not accurate, they are concerned they will be liable for identifying the person incorrectly or determining the applicable law incorrectly. We have discussed in the EPDP the prospect of trying to get input from DPAs
to confirm that it is reasonable to count on Registrant input. Thomas Rickert has most recently proposed in Barcelona, setting up a meeting with the EDPB and I have expressed my support and desire to partake in this and the legal effort. In the meanwhile,
I think it is beneficial for us to try to do our own research and show DPA insight on this topic. To this end, I provide below, guidance from the ICO on this topic. The IPC/BC wishes to add this to the Small Team #1and #2 comments in support of our positions
on the issues of supporting the distinction of legal and natural persons and applying relevant country laws.<br>
<b><u>The Accuracy of information provided by data subjects<br>
</u></b>Article 5(1)(d)/(2) GDPR provides that controllers have an obligation to demonstrate compliance with the requirement that:
<br>
<i>Personal data shall be…accurate and, where necessary, keept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay
(‘accuracy’).<br>
</i>According to the ICO, this means that controllers must take all reasonable steps to ensure that the personal data they hold is not incorrect or misleading as to any matter of fact. However, the GDPR does not explicitly distinguish between personal data
provided by the data subject, provided by a third party or created by the controller – the same obligation applies in each such caase.
<br>
<b>As to whether it is possible to rely on the data subject for the accuracy of the information, the ICO has confirmed in its guidance that this is possible. In particular, the ICO states</b> that: “In some cases it is reasonable to rely on the individual
to tell you when their personal data has changed, such as when they change address or other contact details. It may be sensible to periodically ask individuals to update their own details,
<b>but you do not need to take extreme measures to ensure your records are up to date, unless there is a corresponding privacy risk which justifies this</b>.†However, if the controller learns that information is no longer accurate/up to date (either from
the data subject or from other information which comes to light), the controller should update its records accordingly.<br>
<b>The ICO also recognizes that it may be impractical to check the accuracy of personal data someone else provides. In such cases, the ICO suggests that controllers must:
<br>
· accurately record the information provided;<br>
· accurately record the source of the information;<br>
· take “reasonable steps†in the circumstances to ensure the accuracy of the information; and<br>
· carefully consider any challenges to the accuracy of the information.</b>
<br>
<b>Given that the data subject itself inputs and supplies the data registration information (elements) in issue, there is a strong argument that under the above guidance by the ICO, it is reasonable to reply on the accuracy of this information for purposes
of distinguishing between legal and natural persons and for purposes of correct geographical information in relation to applicable law purposes.<br>
<br>
Moreover, in addition to and to support the above, the IPC and BC further strongly support the following legal recommendation be added to both Small Team #1 and Small Team #2 input that contractual provisions be added to agreements so that overall accuracy
standards are achieved, stating: <i>The above-identified Registrant represents and warrants that the data provided herein is true, complete and accurate</i>. It could even go one step further and expressly say that
<i>Registrar is entitled to rely on this data in making legal determinations including, without limitation, those related to GDPR and relevant data protection laws</i>. Nothing in the above, limits the application of the ICO guidance from supporting greater
accuracy required by all parties.<br>
</b> <br>
Sincerely,<br>
<br>
Diane<br>
<br>
<b>Diane Plaut<br>
</b>General Counsel and Privacy Officer<br>
<b>Error! Filename not specified.</b><br>
Direct +1 646-899-2806 
<a href="mailto:diane.plaut@corsearch.com" target="_blank"> diane.plaut@corsearch.com</a>
<br>
<a href="https://maps.google.com/?q=220+West+42&entry=gmail&source=g" target="_blank">220 West 42</a><sup>nd</sup> Street, 11<sup>th</sup> Floor, New York, NY 10036, United States
<a href="http://www.corsearch.com/" target="_blank">www.corsearch.com</a>
<br>
Join Corsearch on <a href="https://twitter.com/corsearch" target="_blank">Twitter</a>
<a href="https://www.linkedin.com/company/2593860/" target="_blank">Linkedin</a>
<a href="http://trademarksandbrands.corsearch.com/" target="_blank">Trademarks + Brands</a><br>
Customer Service/Platform Support: 1 800 SEARCH1™ (1 800 732 7241)
<a href="mailto:Corsearch.USCustomerService@corsearch.com" target="_blank"> Corsearch.USCustomerService@corsearch.com</a>
<br>
<br>
<b>Confidentiality Notice:</b> This email and its attachments (if any) contain confidential information of the sender. The information is intended only for the use by the direct addressees of the original sender of this email. If you are not an intended recipient
of the original sender (or responsible for delivering the message to such person), you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance of the contents of and attachments to this email is strictly
prohibited. If you have received this email in error, please immediately notify the sender at the address shown herein and permanently delete any copies of this email (digital or paper) in your possession.<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
Gnso-epdp-team mailing list<br>
<a href="mailto:Gnso-epdp-team@icann.org" target="_blank">Gnso-epdp-team@icann.org</a><br>
<a href="https://mm.icann.org/mailman/listinfo/gnso-epdp-team" target="_blank">https://mm.icann.org/mailman/listinfo/gnso-epdp-team</a><u></u><u></u></p>
</div>
<p class="MsoNormal">_______________________________________________<br>
Gnso-epdp-team mailing list<br>
<a href="mailto:Gnso-epdp-team@icann.org" target="_blank">Gnso-epdp-team@icann.org</a><br>
<a href="https://mm.icann.org/mailman/listinfo/gnso-epdp-team" target="_blank">https://mm.icann.org/mailman/listinfo/gnso-epdp-team</a><u></u><u></u></p>
</blockquote>
</div>
</div>
</div></blockquote><blockquote type="cite"><div dir="ltr"><span>_______________________________________________</span><br><span>Gnso-epdp-team mailing list</span><br><span><a href="mailto:Gnso-epdp-team@icann.org" target="_blank">Gnso-epdp-team@icann.org</a></span><br><span><a href="https://mm.icann.org/mailman/listinfo/gnso-epdp-team" target="_blank">https://mm.icann.org/mailman/listinfo/gnso-epdp-team</a></span></div></blockquote></div></div></blockquote></div></div>
</div></div>