<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt'>Dear EPDP Team,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Below, please find answers to questions the EPDP Team posed to ICANN org:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p style='margin:0in;margin-bottom:.0001pt;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><b><span style='color:black'>QUESTION:<span class=apple-converted-space> </span></span></b><span style='color:black'>The Temporary Specification for gTLD Registration Data EPDP Team is currently considering language on a “<a href="https://community.icann.org/display/EOTSFGRD/e.+Data+Elements+Workbooks?preview=/96207076/96212248/Purpose%20M%20-%20Data_Elements_Processing_Workbook%20-%2022%20October%202018_clean.docx"><span style='color:purple'>Purpose M</span></a>” regarding ICANN’s role in coordinating the development and implementation of policies concerning ICANN’s dispute resolution processes in the context of domain name registrations. Two of the processes currently being considered within scope of this purpose are the<span class=apple-converted-space> </span><a href="https://www.icann.org/resources/pages/pddrp-2014-01-09-en"><span style='color:purple'>PDDRP</span></a><span class=apple-converted-space> </span>(Post Delegation Dispute Resolution Process) and the<span class=apple-converted-space> </span><a href="https://www.icann.org/resources/pages/rrdrp-2014-01-09-en"><span style='color:purple'>RRDRP</span></a><span class=apple-converted-space> </span>(Registry Restrictions Dispute Resolution Process). It would particularly be very helpful and important to the EPDP Team if ICANN could provide clarification on any point within the processes of PDDRPs and RRDRPs where processing of gTLD Registration Data is necessary for the dispute resolution processes to be completed. This clarification should identify which (if any) data elements within gTLD Registration Data are necessary, as well as all parties involved in the processing activities.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p style='margin:0in;margin-bottom:.0001pt;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><b><span style='color:black'>RESPONSE:</span></b><span class=apple-converted-space><span style='color:black'> </span></span><span style='color:black;background:white'>The</span><span class=apple-converted-space><span style='color:#333333;background:white'> </span></span><span style='color:black'><a href="http://newgtlds.icann.org/en/applicants/agb/pddrp-rules-15oct13-en.pdf"><span style='color:#1155CC;background:white'>PDDRP rules</span></a></span><span class=apple-converted-space><span style='color:#333333;background:white'> </span></span><span style='color:black;background:white'>and the<span class=apple-converted-space> </span></span><span style='color:black'><a href="http://newgtlds.icann.org/en/applicants/agb/rrdrp-rules-15oct13-en.pdf"><span style='color:#1155CC;background:white'>RRDRP rules</span></a></span><span class=apple-converted-space><span style='color:#333333;background:white'> </span></span><span style='color:black;background:white'>each require the complainant (a trademark holder in PDDRP proceedings; an established institution in the relevant community in RRDRP proceedings) to “provide the name and address of the current owner of any at-issue domain name registration related to the dispute, to the best of the Complainant’s knowledge[.]” See PDDRP Rules, Section 3(b)(iv); RRDRP Rules, Section 3(b)(iv). The dispute resolution provider is required to serve the respondent (the registry operator) with a copy of the complaint, and to retain information related to the provider’s transmission of the complaint. Thus, these procedures may result in the complainant, provider, and/or respondent’s processing of gTLD registration data.</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black;background:white'>It should be noted that neither of these procedures have been used yet.</span><span style='font-size:11.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black;background:white'>ICANN org would not process gTLD registration data in proceedings of either of these procedures because they are administered by independent dispute resolution service providers. However, if either procedure is used and ICANN org receives a panel’s decision, then that decision would include gTLD registration data.</span><span style='font-size:11.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black;background:white'>On another note, the current wording of Purpose M states: “coordinating the development and implementation of policies concerning ICANN’s dispute resolution processes in the context of domain name registrations.” It is unclear how developing and implementation of policy would involve processing of gTLD registration data or personal data.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;color:black'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:11.0pt;color:black'>QUESTION:<span class=apple-converted-space> </span></span></b><span style='font-size:11.0pt;color:black'><o:p></o:p></span></p><p style='margin:0in;margin-bottom:.0001pt;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'>What is the rationale for not redacting organization field in the Temporary Specification?<o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><b><span style='font-size:11.0pt;color:black'> </span></b><span style='font-size:11.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><b><span style='font-size:11.0pt;color:black'>RESPONSE:<span class=apple-converted-space> </span></span></b><span style='font-size:11.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:11.0pt;color:black'> </span></b><span style='font-size:11.0pt;color:black'><o:p></o:p></span></p><p style='margin:0in;margin-bottom:.0001pt;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black;background:white'>Including the registrant organization field was determined to be consistent with ICANN org’s stated goal of complying with the GDPR while maintaining the WHOIS system to the greatest extent possible. The name of an organization refers to a legal person and not a natural person and therefore is arguably not covered under the GDPR. Additionally, the organization field is an optional field for registrants so to the extent that the registrant provides the organization name, the Temp Spec allows for publication of that information.</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p style='margin:0in;margin-bottom:.0001pt;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black;background:white'>Leading up to the development of the Temporary Specification, ICANN org consulted with the community and the DPAs to determine which data elements should continue to be made publicly available. Through the<span class=apple-converted-space> </span></span><span style='color:black'><a href="https://www.icann.org/en/system/files/files/gdpr-dataflow-matrix-whois-06nov17-en.pdf"><span style='color:#1155CC;background:white'>data matrix</span></a></span><span class=apple-converted-space><span style='color:#333333;background:white'> </span></span><span style='color:black;background:white'>exercise where ICANN org asked contracted parties and interested stakeholders to identify user types and purposes of data elements required by ICANN policies and contracts, 40 user purposes for the registrant organization field were identified</span><span style='color:#333333;background:white'>.</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p style='margin:0in;margin-bottom:.0001pt;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black;background:white'>For reference, Section 5.5.16(i) of the Interim Model for Compliance with ICANN Agreements and Policies in Relation to the European Union’s General Data Protection Regulation (also called the </span><span style='color:black'><a href="https://www.icann.org/en/system/files/files/gdpr-compliance-interim-model-08mar18-en.pdf"><span style='color:#1155CC;background:white'>Cookbook</span></a></span><span style='color:#333333;background:white'>)<span class=apple-converted-space> </span></span><span style='color:black;background:white'>states that “the registrant “organization” would be required to be published (if applicable) so that registrations of legal entities would readily include the name of the entity.”</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;color:black'><o:p> </o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:11.0pt;color:black'>--<o:p></o:p></span></b></p><p class=MsoNormal><span style='font-size:11.0pt;color:black'>Thank you.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;color:black'>Best regards,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;color:black'>Marika, Berry, and Caitlin<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p></div></body></html>