<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Open Sans";
panose-1:2 11 6 6 3 5 4 2 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Cambria;
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 6 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Thanks Alan and I just wanted to respond and echo your sentiments below. I have reviewed the latest language for Recommendation 7 and it appears to be fine as written and in-line with our various discussions on the topic.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I appreciate the questions posed by contractual compliance below but do not feel like it’s part of our remit to determine which specific data elements
<i>might</i> be needed by compliance going forward. As Alan point out, compliance would always have the option to ask for relevant data and provide a valid legal justification on a case by case basis.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Regards,<o:p></o:p></p>
<p class="MsoNormal">Matt<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of Alan Woods <alan@donuts.email><br>
<b>Date: </b>Tuesday, January 29, 2019 at 3:44 AM<br>
<b>To: </b>Marika Konings <marika.konings@icann.org><br>
<b>Cc: </b>"gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org><br>
<b>Subject: </b>Re: [Gnso-epdp-team] ICANN Compliance question in relation to EPDP Recommendation 7<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Dear all. <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">This appears to be along the lines and related to the issue which I raised regarding Recommendation 7. In this instance, I believe that the penny may have dropped. In truth, the ePDP team is working in a vacuum, and we cannot be hefted
with the expectation that we shall somehow discern the data which is deemed necessary by the various elements within ICANN Org. As such we need to be told whether any stakeholder, ICANN included, has a justifiable need for data to be disclosed in furtherance
of their function; with regards to this question from ICANN Compliance, it is, and always has been for them, (or any other, so motivated, stakeholder) to present and justify those needs for our consideration. We have tried to capture, as best as we can, the
obvious uses, but to supplement this, the ePDP has sought input and indeed in this instance have specifically asked "<em><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#172B4D"><a href="https://community.icann.org/display/EOTSFGRD/Input+from+ICANN+Org">How
does ICANN Contractual Compliance use WHOIS data</a>?". </span></em>ICANN compliance have responded with their
<a href="https://community.icann.org/display/EOTSFGRD/Input+from+ICANN+Org?preview=/90774122/97848455/Summary-Contractual-Compliance-Data-Processing-Activities.pdf">
data processing overview</a>, and the only element of 'in-scope data' noted therein was 'redacted registrant data' (assuming to mean actual underlying unredacted data ) for both "compliance tickets" and "audit program" tasks. All other elements noted, from
my reading, were either not personal data (e.g. ICANN approved DEA name) or personal data that fell under ICANN's sole controllership (e.g. PII relating to complaints made to ICANN compliance, or Contacts of DRPs). <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Therefore in response to ICANN Compliance's questions (as I see them):<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">1) <span style="color:red">"<i>is Recommendation 7 intended to limit all contractual requirements where ICANN is currently permitted to request information and records to only permitting ICANN to request the data elements listed in Recommendation
7’s chart"</i></span><i><span style="color:black"> </span></i>Yes. Such is the task we have. The workbooks are based on our experience, but mainly on the responses received; taking into account their responses, the ePDP defined and discerned what data elements
we felt were reasonable for disclosure for the task of contractual compliance to request in furtherance of what we would believe to be the Contractual Compliance tasks. Where there is an issue, this should be raised and a small team is currently reviewing
the workbooks and perhaps any necessary modifications can still be achieved. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">2) "<i><span style="color:red">can the EPDP team please clarify which contractual requirements Recommendation 7 applies to and how they should be changed". </span></i>Vis á vis ICANN Compliance, and recommendation 7, the ePDP is ONLY concerned
with the data that is required to be transferred from CP to ICANN for the purpose of compliance; therefore, we are necessarily limited to that which is allowed in the RAs and RAAs. I'm unsure as to what other specificity is necessary here. If other data is
necessary for ICANN compliance to do their task that they feel is not covered here, then they should provide detail. Additionally, it is not in the scope of the ePDP to suggest contractual amendments, that is a matter for ICANN and the CPH and we refer to
our recommendations 13 & 14. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">3) "<i><span style="color:red">may ICANN continue to request the information and records specified in the existing contractual requirements, with the understanding that if there is registration data included in the records requested that
it may be limited by the allowing contracted party to only include registration data from the list of data elements in the chart?" </span></i>ICANN may, of course, continue to make disclosure requests for 'additional' data. If there is a valid legal basis
and necessity for such disclosure for any such data element, then there should be no issue in making such a disclosure request to the CPs.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Disclaimer: Again due to time constraints, this is my own response and not necessarily the view of the RYSG. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Alan<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<table class="MsoNormalTable" border="0" cellpadding="0">
<tbody>
<tr>
<td style="padding:0in 5.25pt 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:7.5pt;margin-right:0in;margin-bottom:7.5pt;margin-left:0in">
<a href="http://donuts.domains/" target="_blank"><span style="text-decoration:none"><span style="color:blue"><img border="0" width="75" height="75" style="width:.7812in;height:.7812in" id="_x0000_i1029" src="https://storage.googleapis.com/signaturesatori/customer-C02zzlf7k/images/-54f9d8ac97e7f575bf497d10ac1f1aafafddf8afceab5f269d49034f01b3217b.png" alt="Donuts Inc."></span></span></a><o:p></o:p></p>
</td>
<td style="padding:0in 5.25pt 0in 0in">
<div>
<p class="MsoNormal" style="mso-margin-top-alt:7.5pt;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;line-height:12.75pt">
<b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#333333">Alan Woods</span></b><b><span style="font-size:10.5pt;font-family:"Tahoma",sans-serif;color:black"><o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:7.5pt;margin-right:0in;margin-bottom:7.5pt;margin-left:0in">
<span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#333333">Senior Compliance & Policy Manager, Donuts Inc.</span>
<o:p></o:p></p>
<div class="MsoNormal" align="center" style="mso-margin-top-alt:7.5pt;margin-right:0in;margin-bottom:7.5pt;margin-left:0in;text-align:center">
<hr size="0" width="100%" align="center">
</div>
<p class="MsoNormal" style="mso-margin-top-alt:7.5pt;margin-right:0in;margin-bottom:7.5pt;margin-left:0in">
<span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:#333333">The Victorians, </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:7.5pt;margin-right:0in;margin-bottom:7.5pt;margin-left:0in">
<span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:#333333">15-18 Earlsfort Terrace<br>
Dublin 2, County Dublin</span><span style="font-size:9.0pt;font-family:"Open Sans",sans-serif;color:#D6D6D6"><br>
</span><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:#333333">Ireland</span><br>
<br>
<a href="https://www.facebook.com/donutstlds" target="_blank"><span style="text-decoration:none"><span style="color:blue"><img border="0" id="_x0000_i1027" src="http://storage.googleapis.com/signaturesatori/icons/facebook.png" alt="http://storage.googleapis.com/signaturesatori/icons/facebook.png"></span></span></a> <a href="https://twitter.com/DonutsInc" target="_blank"><span style="text-decoration:none"><span style="color:blue"><img border="0" id="_x0000_i1026" src="http://storage.googleapis.com/signaturesatori/icons/twitter.png" alt="http://storage.googleapis.com/signaturesatori/icons/twitter.png"></span></span></a> <a href="https://www.linkedin.com/company/donuts-inc" target="_blank"><span style="text-decoration:none"><span style="font-size:10.5pt;color:blue"><img border="0" id="_x0000_i1025" src="http://storage.googleapis.com/signaturesatori/icons/linkedin.png" alt="http://storage.googleapis.com/signaturesatori/icons/linkedin.png"></span></span></a><o:p></o:p></p>
</div>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Cambria",serif">Please NOTE: This electronic message, including any attachments, may include privileged, confidential and/or inside information owned by Donuts Inc. . Any distribution or use of
this communication by anyone other than the intended recipient(s) is strictly prohibited and may be unlawful. If you are not the intended recipient, please notify the sender by replying to this message and then delete it from your system. Thank you.</span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Fri, Jan 25, 2019 at 11:08 PM Marika Konings <<a href="mailto:marika.konings@icann.org">marika.konings@icann.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Dear EPDP Team,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Please find hereby a question from ICANN Contractual Compliance in relation to recommendation #7:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><i><span style="color:black">Hi Kurt/EPDP Team,</span></i><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><i><span style="color:black"> </span></i><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><i><span style="color:black">There are multiple contractual requirements which require contracted parties to provide ICANN data and records which may include registration data (including,
but not limited to 2013 RAA Sections 3.4.3, 3.15 and 3.18; and new gTLD Base RA Section 2.11 and Specification 11, Section 3b). ICANN requires such documentation to facilitate its review of compliance with other provisions in the ICANN agreements and policies.
With this understanding, can the EPDP team please clarify which contractual requirements Recommendation 7 applies to and how they should be changed? Specifically, is Recommendation 7 intended to limit all contractual requirements where ICANN is currently permitted
to request information and records to only permitting ICANN to request the data elements listed in Recommendation 7’s chart? Or may ICANN continue to request the information and records specified in the existing contractual requirements, with the understanding
that if there is registration data included in the records requested that it may be limited by the allowing contracted party to only include registration data from the list of data elements in the chart? </span></i><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><i><span style="color:black"> </span></i><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><i><span style="color:black">Thank you,</span></i><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><i><span style="color:black">ICANN Contractual Compliance</span></i><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Best regards,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Caitlin, Berry and Marika<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Gnso-epdp-team mailing list<br>
<a href="mailto:Gnso-epdp-team@icann.org" target="_blank">Gnso-epdp-team@icann.org</a><br>
<a href="https://mm.icann.org/mailman/listinfo/gnso-epdp-team" target="_blank">https://mm.icann.org/mailman/listinfo/gnso-epdp-team</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>