<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
If we use the “offered or made available by Registrar or its Affiliates” language, we need to add "or offered by an accredited P/P provider"<br>
<br>
“known Privacy or Proxy service” seems to cover both cases, although with someone vague language if the PPSAI ever completes.<br>
<br>
<b>Alan<br>
<br>
<br>
<blockquote type="cite" class="cite" cite="">From:</b> Mark Svancarek (CELA) <br>
<b>Sent:</b> Wednesday, December 19, 2018 12:37 PM<br>
<b>To:</b> Anderson, Marc <mcanderson@verisign.com>; jbladel@godaddy.com; caitlin.tubergen@icann.org<br>
<b>Subject:</b> RE: [Gnso-epdp-team] language re: affiliated privacy/proxy companies<br>
<br>
Alternately: <br>
"or offered by an accredited P/P provider"<br>
<br>
Although this assumes that PPSAI proceeds.<br>
<br>
<b>From:</b> Mark Svancarek (CELA) <br>
<b>Sent:</b> Wednesday, December 19, 2018 11:41<br>
<b>To:</b> 'Anderson, Marc' <<a href="mailto:mcanderson@verisign.com">mcanderson@verisign.com</a> >;
<a href="mailto:jbladel@godaddy.com">jbladel@godaddy.com</a>; <a href="mailto:caitlin.tubergen@icann.org">
caitlin.tubergen@icann.org</a> <br>
<b>Subject:</b> RE: [Gnso-epdp-team] language re: affiliated privacy/proxy companies<br>
<br>
Marc, I would prefer:<br>
<br>
“known Privacy or Proxy service” <br>
Which is a superset of <br>
“<i>offered or made available by Registrar or its Affiliates”<br>
</i> <br>
/msv<br>
<br>
<b>From:</b> Gnso-epdp-team <<a href="mailto:gnso-epdp-team-bounces@icann.org"> gnso-epdp-team-bounces@icann.org</a>>
<b>On Behalf Of </b>Anderson, Marc via Gnso-epdp-team<br>
<b>Sent:</b> Wednesday, December 19, 2018 09:09<br>
<b>To:</b> <a href="mailto:jbladel@godaddy.com">jbladel@godaddy.com</a>; <a href="mailto:caitlin.tubergen@icann.org">
caitlin.tubergen@icann.org</a> ; <a href="mailto:gnso-epdp-team@icann.org">gnso-epdp-team@icann.org</a><br>
<b>Subject:</b> Re: [Gnso-epdp-team] language re: affiliated privacy/proxy companies<br>
<br>
Hi all,<br>
<br>
James makes a good point, I support his edit.<br>
<br>
<br>
Caitlin’s proposed text has a typo showing “proxy/proxy” where I assume “privacy/proxy” is intended.<br>
<br>
<br>
I have concerns with the text “…Registrar MUST return in response to any query full WHOIS data…” More specifically, I don’t think “any” actually means “any” in this context, “full” is undefined and should more appropriately be “unredacted” and WHOIS should
be replaced with RDS or RDDS. I suggest: “…<i>Registrar MUST return unredacted data in response to RDDS queries… “<br>
</i> <br>
<br>
I understand the reason for this recommendation is so that Registrars do not redact registration data that is already protected by a known Privacy or Proxy service. If the Privacy/Proxy service is operating as intended than personally identifiable information
of the registrant has already been removed from the RDDS record and so further redacting it is redundant and creates an unnecessary hurdle for a requestor with a legitimate need to access the actual registration data behind the service. While Caitlin’s proposed
language is generally clear, sometimes an explanation of the intent can be helpful in particular when it comes time to implement the policy. I suggest adding text along these lines:<br>
<br>
<i>The intent of the working group in making this recommendation is that Registrars should not redact registration data that is already protected by a known Privacy/Proxy service. Redacting the RDS data of a Privacy/Proxy service provider shouldn’t be necessary
for GDPR compliance and creates an unnecessary hurdle for a requestor with a legitimate need to access the actual registration data behind the service.<br>
</i> <br>
<br>
On our Tuesday call we discussed the fact that it is not always know to the registrar that the registration is from a privacy/proxy service. I used the words “known Privacy or Proxy service” while Caitlin uses “<i>offered or made available by Registrar or
its Affiliates”.</i> I’m not sure which is better and perhaps this is a question for registrars. I’m sensitive to registrars potentially getting sideways with compliance over this. On last Thursday’s (meting #34) call, Marika talked to us about the “policy
change impact” section of the report which could include information on how to measure compliance. While we agreed on Thursday’s call to table that until we are a little further along in our policy recommendations, that does have me wondering if there is
language we could add so that Registrars and compliance are on the same page as to how this should be implemented and enforced?<br>
<br>
<br>
We also spoke about the currently on hold Privacy/Proxy implementation effort. I understand them to be on hold waiting our final policy recommendations as that may inform or otherwise impact their work. I am maybe being overly cautious here, but I want to
make sure nothing in our recommendations conflicts with or constrains the Privacy/Proxy group. Our group is responsible for GDPR compliance, their group for implementing a Privacy/Proxy policy. Some overlap may be unavoidable but we should leave Privacy/Proxy
policy to them. I’m thinking adding language that this recommendation is subject to that policy might be prudent. If there is no conflict then this recommendation stands, but if it conflicts with their policy, then their policy takes precedent.<br>
<br>
<br>
Thanks,<br>
Marc<br>
<br>
<br>
<br>
<br>
<b>From:</b> Gnso-epdp-team <<a href="mailto:gnso-epdp-team-bounces@icann.org"> gnso-epdp-team-bounces@icann.org</a>>
<b>On Behalf Of </b>James M. Bladel<br>
<b>Sent:</b> Wednesday, December 19, 2018 8:15 AM<br>
<b>To:</b> Caitlin Tubergen <<a href="mailto:caitlin.tubergen@icann.org"> caitlin.tubergen@icann.org</a>>; GNSO EPDP <<a href="mailto:gnso-epdp-team@icann.org">gnso-epdp-team@icann.org</a> ><br>
<b>Subject:</b> [EXTERNAL] Re: [Gnso-epdp-team] language re: affiliated privacy/proxy companies<br>
<br>
Hi All-<br>
<br>
This language is mostly ok (thanks Caitlin!), but the parenthetical example sideswipes the natural vs. legal debate. Recommend we change this:<br>
<br>
(e.g. where data associated with a natural person is masked)<br>
<br>
To this:<br>
(e.g. where data associated with <i>the Privacy/Proxy customer</i> is masked)<br>
<br>
Thanks-<br>
<br>
J.<br>
<br>
-------------<br>
James Bladel<br>
GoDaddy<br>
<hr>
<b>From:</b> Gnso-epdp-team <<a href="mailto:gnso-epdp-team-bounces@icann.org"> gnso-epdp-team-bounces@icann.org</a>> on behalf of Caitlin Tubergen <<a href="mailto:caitlin.tubergen@icann.org"> caitlin.tubergen@icann.org</a>><br>
<b>Sent:</b> Tuesday, December 18, 2018 18:48<br>
<b>To:</b> GNSO EPDP<br>
<b>Subject:</b> [Gnso-epdp-team] language re: affiliated privacy/proxy companies <br>
<br>
Dear All,<br>
<br>
Following up on an action item from today’s EPDP call, please find draft language regardingregistrar disclosure of privacy/proxy data to a requestor (section 2.6 of Appendix A of the Temp Spec).For ease of reference, the updated language is italicized.<br>
<br>
The EPDP Team recommends that in the case of a domain name registration where a Privacy/Proxy service,<i>offered or made available by Registrar or its Affiliates in connection with a registration is</i>used, (e.g. where data associated with a natural person
is masked), Registrar MUST return in response to any query full WHOIS data, including the existing proxy/proxy pseudonymized email. (emphasis added)<br>
<br>
Please respond to the list if you have any issues with the above draft language.<br>
<br>
Best regards,<br>
<br>
Marika, Berry, and Caitlin<br>
<br>
<br>
<br>
_______________________________________________<br>
Gnso-epdp-team mailing list<br>
Gnso-epdp-team@icann.org<br>
<a href="https://mm.icann.org/mailman/listinfo/gnso-epdp-team" eudora="autourl">https://mm.icann.org/mailman/listinfo/gnso-epdp-team</a></blockquote>
</body>
</html>