<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">I have to agree with Ayden that the answer to the first part of this question isn’t correct. The EDPB has shown concern about situations in which one-person organizations would reveal the identity
of a natural person. We understand fully that legal person data doesn’t normally raise any privacy concerns. That’s not what we were asking about. We were trying to address the specific case of one person orgs.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">--MM<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt">From:</span></b><span style="font-size:11.0pt"> Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org]
<b>On Behalf Of </b>Marika Konings<br>
<b>Sent:</b> Monday, November 19, 2018 8:38 PM<br>
<b>To:</b> gnso-epdp-team@icann.org<br>
<b>Subject:</b> [Gnso-epdp-team] ICANN Org Response to question re. Organization field<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Dear EPDP Team,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Hereby the ICANN Org response to the following question:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;color:black">Question:</span></b><span class="apple-converted-space"><span style="font-size:11.0pt;color:black"> </span></span><span style="font-size:11.0pt;color:black">1.) Has ICANN given any thought to
scenarios where the „Organization“ field might contain personal information? 2.) As the Organization field shall be populated on an optional basis, has ICANN given any thought to a consent requirement or, where another legal basis than Art. 6 I a GDPR was
considered, what legal basis shall be applicable based on what rationale?<o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:11.0pt;color:black"> <o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<b><span style="color:black">Response: </span></b><span style="color:black;background:white">The organization field, which is an optional field, was one of the topics of discussion among the community during the development of the Cookbook. See sections 5.4
and 5.5 of the<span class="apple-converted-space"> </span></span><a href="https://www.icann.org/en/system/files/files/gdpr-compliance-interim-model-08mar18-en.pdf"><span style="color:#1155CC;background:white">Cookbook</span></a><span style="color:#333333;background:white">.</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:11.0pt;color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:11.0pt;color:#333333;background:white">Additionally, the 5 July 2018<span class="apple-converted-space"> </span></span><a href="https://www.icann.org/en/system/files/correspondence/jelinek-to-marby-05jul18-en.pdf"><span style="font-size:11.0pt;color:#1155CC;background:white">letter</span></a><span class="apple-converted-space"><span style="font-size:11.0pt;color:#333333;background:white"> </span></span><span style="font-size:11.0pt;color:black;background:white">from
the European Data Protection Board states: “The GDPR does not apply to the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact
details of the legal person.” Recital 14 of the GDPR states: “</span><span style="font-size:11.0pt;color:black">This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal
persons, including the name and the form of the legal person and the contact details of the legal person.”<o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:11.0pt;color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:11.0pt;color:black;background:white">Registrars have always been obligated to inform and obtain consent from the registrants regarding what data elements are collected, what data elements are published, what data elements are optional,
and the intended uses and recipients of the data. (See for example Section<span class="apple-converted-space"> </span></span><a href="https://www.icann.org/resources/unthemed-pages/raa-1999-11-10-en#IIJ7b"><span style="font-size:11.0pt;color:#1155CC;background:white">II.J.7.b</span></a><span class="apple-converted-space"><span style="font-size:11.0pt;color:#333333;background:white"> </span></span><span style="font-size:11.0pt;color:#333333;background:white">in
the 1999 RAA and Section<span class="apple-converted-space"> </span></span><a href="https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en#3.7.7.4"><span style="font-size:11.0pt;color:#1155CC;background:white">3.7.7.4</span></a><span class="apple-converted-space"><span style="font-size:11.0pt;color:#333333;background:white"> </span></span><span style="font-size:11.0pt;color:#333333;background:white">of
the 2013 RAA.)</span><span style="font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:11.0pt;color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:11.0pt;color:black;background:white">The Temporary Specification relies on 6(1)(f) as the legal basis for the mandatory publication of certain fields, including registrant organization. As noted in our original response, the registrant
organization field refers to a legal person and not a natural person. The registrant may give consent for publication of additional fields, for example, the registrant name field.</span><span style="font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:11.0pt;color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:11.0pt;color:black;background:white">In considering the applicability of the possible legal bases and after consultations with the community, it was determined that 6(1)(f) was the most appropriate legal basis to support the stated goal
of complying with the GDPR while maintaining the existing WHOIS to the greatest extent possible.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">This response will get added to the Q&A section on the wiki:
</span><a href="https://community.icann.org/x/ahppBQ"><span style="font-size:11.0pt">https://community.icann.org/x/ahppBQ</span></a><span style="font-size:11.0pt;color:black">.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Caitlin, Berry and Marika<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><i><span style="font-size:10.0pt;color:black">Marika Konings</span></i></b><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt;color:black">Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) </span></i><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt;color:black">Email: </span></i><a href="mailto:marika.konings@icann.org"><i><span style="font-size:10.0pt">marika.konings@icann.org</span></i></a><i><span style="font-size:10.0pt;color:black"> </span></i><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt;color:black"> </span></i><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt;color:black">Follow the GNSO via Twitter @ICANN_GNSO</span></i><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt;color:black">Find out more about the GNSO by taking our </span></i><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_gnso&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=7_PQAir-9nJQ2uB2cWiTDDDo5Hfy5HL9rSTe65iXLVM&m=5DXgId95wrCsHi--pxTiJD7bMB9r-T5ytCn7od3CF2Q&s=Cg5uQf0yAfw-qlFZ0WNBfsLmmtBNUiH0SuI6Vg-gXBQ&e="><i><span style="font-size:10.0pt">interactive
courses</span></i></a><i><span style="font-size:10.0pt;color:black"> and visiting the </span></i><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gnso.icann.org_files_gnso_presentations_policy-2Defforts.htm-23newcomers&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=7_PQAir-9nJQ2uB2cWiTDDDo5Hfy5HL9rSTe65iXLVM&m=5DXgId95wrCsHi--pxTiJD7bMB9r-T5ytCn7od3CF2Q&s=tT-E2RoAucUb3pfL9zmlbRdq1sytaEf765KOEkBVCjk&e="><i><span style="font-size:10.0pt">GNSO
Newcomer pages</span></i></a><i><span style="font-size:10.0pt;color:black">. </span></i><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>