<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">All,<div class="">I still think it is a mistake to dilute the language from where we were before we published the initial report. We are in in the process of analyzing public comment and establishing whether the comments received require us to amend our report / recommendations. What we heard and read were primarily implementation issues, which - as I hope we can agree by now - must not guide our decision, but the actually circumstances. Additionally, we heard and read about concerns, but no alternative has been suggested that would be a better solution to what we agreed on earlier. To me, that does not require a change of our recommendation. We are replacing a concrete recommendation with something vague without good reason.</div><div class=""><br class=""></div><div class="">Also, the language in our initial report allows for a change of model as we had the language in there that our recommendation is subject to further legal analysis (or something to that effect).</div><div class=""><br class=""></div><div class="">Thus, the JCA approach should be the starting point and only be deviated from if there is a sufficiently robust alternative.</div><div class=""><br class=""></div><div class="">I trust what unites us is the interest in ensuring that no-one in the ICANN ecosystem will be fined. Let’s just imagine two scenarios:</div><div class=""><br class=""></div><div class="">1. We say joint controllers and in fact the parties are independent controllers</div><div class=""><br class=""></div><div class="">In this scenario, there should not be any risk for the parties at all. </div><div class=""><br class=""></div><div class="">The reason for this assumption is that the data flows between joint controllers need to be legally sound as between third parties (or independent controller for that matter). Also, JCAs provide probably the highest protection level for data subjects. </div><div class=""><br class=""></div><div class="">2. We go for independent controllers and in fact a joint controller scenario is present</div><div class=""><br class=""></div><div class="">In this case, legal requirements would not be fulfilled. There would be a breach that could be sanctioned. In a proceeding with a supervisory authority, the authority will surely review the documents publicly available, which are eg.:</div><div class=""><br class=""></div><div class="">- a letter from the Art 29 WP suggesting a joint controller scenario might be present</div><div class="">- a memo from Wilson Sonsini pointing in the direction of joint controllers</div><div class="">- a memo from Hamilton suggesting a joint controller scenario</div><div class="">- a memo from ICANN quoting from the above and concluding that it should be independent controllers nonetheless.</div><div class=""><br class=""></div><div class="">I am afraid that the authorities will then say that we could have known that joint controllers should be the way to go and that we increase the liability risk for everyone by not doing so. </div><div class=""><br class=""></div><div class="">In other words, we would need to have very good reasons not to go for a joint controller scenario. The language in the initial report ensures that. The revised language not much so.</div><div class=""><br class=""></div><div class="">Thanks for reading all this.</div><div class=""><br class=""></div><div class="">Best,</div><div class="">Thomas</div><div class=""><br class=""></div><div class="">PS - In practical terms, I think joint controller agreements can be operationalized without insurmountable difficulties. In the long run, we should apply for a code of conduct anyway and we could present a different approach than joint controllers. If there is blessing for an alternative form the authorities via that route or by means of a guidance or other confirmation, we can certainly take a different and potentially more light-weight approach.</div><div class=""><br class=""></div><div class=""><div><br class=""><blockquote type="cite" class=""><div class="">Am 30.01.2019 um 14:40 schrieb Alan Woods <<a href="mailto:alan@donuts.email" class="">alan@donuts.email</a>>:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class="">Dear all, <div class=""><br class=""></div><div class="">I am perplexed, if not a little bit frustrated by continuous tendency to wordsmith matters out of existence here. </div><div class=""><br class=""></div><div class="">So this end, and regardless of the ultimate settling of Roles and Responsibilities can we just go back to basic principles and remind ourselves of the GDPR's requirements: </div><div class=""><br class=""></div><div class=""><b class="">Art 28:</b> (processor) "Processing by a processor shall be governed <b class=""><u class="">by a contract or other legal act</u></b>" <i class="">[emphasis added] </i></div><div class=""><b class="">Art 26:</b> (Joint Controllers) "They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, <b class=""><u class="">by means of an arrangement between them</u></b>" <i class="">[emphasis added] </i></div><div class=""><br class=""></div><div class="">I appreciate this is likely where Trang's suggestion is deriving from and I have no real issue with the concept of 'Arrangement' - but can we please be very clear, that as a contracted party, who's lead DPA is clearly going to be Ireland (as will also be the case for a number of other CPs), my interpretation MUST be led by the laws which will be applicable to me, which is the <a href="http://www.irishstatutebook.ie/eli/2018/act/7/section/79/enacted/en/html#sec79" class="">Data Protection Act, 2018</a>. Section 79. which states: </div><div class=""><br class=""></div><div class="">" Where 2 or more controllers jointly determine the purposes and means of the processing of personal data (in this Part referred to as “joint controllers”), they shall determine their respective responsibilities for compliance with this Part in a transparent manner<b class=""><u class=""> by means of an agreement in writing between them</u></b>, save in so far as the said responsibilities are determined by the law of the European Union or the law of the State. <i class="">[emphasis added] </i></div><div class=""><br class=""></div><div class="">So regardless of whether or not we are considered Processors, Controllers or Joint controllers at some point in time, CPs will require a Contract (or more correctly an addendum to our existing contracts) with ICANN, in writing, that governs the processing of data. </div><div class=""><br class=""></div><div class="">So long as it is clear, on the record, that whatever word is used, be it agreement, arrangement, or Ketubah, it means a legally binding instrument, then I'm fine with it. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Kind regards,</div><div class=""><br class=""></div><div class="">Alan</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br clear="all" class=""><div class=""><div dir="ltr" class="gmail_signature"><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><table style="padding:0px;margin:10px 0px;border:none" class=""><tbody class=""><tr class=""><td style="vertical-align:middle;padding:0px 7px 0px 0px" class=""><a href="http://donuts.domains/" rel="nofollow" target="_blank" class=""><img alt="Donuts Inc." height="75" src="https://storage.googleapis.com/signaturesatori/customer-C02zzlf7k/images/-54f9d8ac97e7f575bf497d10ac1f1aafafddf8afceab5f269d49034f01b3217b.png" width="75" class=""></a></td><td style="vertical-align:middle;padding:0px 7px 0px 0px;text-align:left" class="">
<div style="font-family: tahoma, sans-serif; font-size: 14px; line-height: 17px; font-weight: bold;" class=""><span style="font-size:12px" class=""><span style="font-family:arial,helvetica,sans-serif" class=""><span style="color:rgb(51,51,51)" class="">Alan Woods</span></span></span></div>
<div class=""><span style="font-size:12px" class=""><span style="font-family:arial,helvetica,sans-serif" class=""><span style="color:rgb(51,51,51)" class="">Senior Compliance & Policy Manager, Donuts Inc.</span></span></span>
<hr class=""><span style="font-size:11px" class=""><span style="font-family:arial,helvetica,sans-serif" class=""><span style="color:rgb(51,51,51)" class="">The Victorians, </span></span></span></div><div class=""><font color="#333333" face="arial, helvetica, sans-serif" class=""><span style="font-size:11px" class="">15-18 Earlsfort Terrace<br style="background-color:rgb(34,34,34)" class="">
Dublin 2, County Dublin</span></font><br style="color:rgb(214,214,214);font-family:"open sans";font-size:12px;background-color:rgb(34,34,34)" class=""><font color="#333333" face="arial, helvetica, sans-serif" class=""><span style="font-size:11px" class="">
Ireland</span></font><br class="">
<span style="font-size:11px" class=""><span style="font-family:arial,helvetica,sans-serif" class=""></span></span><br class="">
<span style="line-height:36px" class=""><a href="https://www.facebook.com/donutstlds" rel="nofollow" target="_blank" class=""><img src="http://storage.googleapis.com/signaturesatori/icons/facebook.png" class=""></a> <a href="https://twitter.com/DonutsInc" rel="nofollow" target="_blank" class=""><img src="http://storage.googleapis.com/signaturesatori/icons/twitter.png" class=""></a> </span><a href="https://www.linkedin.com/company/donuts-inc" rel="nofollow" target="_blank" class=""><span style="font-size:14px" class=""><img src="http://storage.googleapis.com/signaturesatori/icons/linkedin.png" class=""></span></a></div>
</td></tr></tbody></table><br class="">
</div><div class=""><span style="font-size:12pt;font-family:Cambria,serif" class="">Please NOTE: This electronic message, including any attachments, may include privileged, confidential and/or inside information owned by Donuts Inc. . </span><span style="font-size:12pt;font-family:Cambria,serif" class="">Any distribution or use of this communication by anyone other than the intended recipient(s) is strictly prohibited and may be unlawful. If you are not the intended recipient, please notify the sender by replying to this message and then delete it from your system. Thank you.</span><br class=""></div></div></div></div></div></div></div></div></div></div><br class=""></div></div></div></div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jan 29, 2019 at 1:18 AM Trang Nguyen <<a href="mailto:trang.nguyen@icann.org" class="">trang.nguyen@icann.org</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US" class="">
<div class="gmail-m_6441758728418381503WordSection1"><p class="MsoNormal"><span style="font-size:20pt;font-family:Calibri,sans-serif;color:windowtext" class="">Thank you, Sarah and Kristina for circulating revised text for recommendation 13. We would like to make one additional suggestion: replace “…negotiates and
enters into required data protection agreements…” with “…develop and implement any required data protection arrangements…” Referring to an “arrangement” instead of an “agreement” would provide greater flexibility during implementation, which might take the
form of an agreement, a policy, or a specification. Accordingly, the following sentence should also refer to “arrangement” instead of “agreement.”<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:20pt;font-family:Calibri,sans-serif;color:windowtext" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:20pt;font-family:Calibri,sans-serif;color:windowtext" class="">Also, we would like to ask for clarity on the sentence regarding indemnification. Implementation discussions will work out the details of allocation of responsibility
and liability and it’s not clear that liability should necessarily always rest with the party or parties that determine(s) the purposes and means of processing, for example in the case of a data breach. We look forward to additional discussions with the EPDP
Team on this. <u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:20pt;font-family:Calibri,sans-serif;color:windowtext" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal"><span style="font-size:20pt;font-family:Calibri,sans-serif;color:windowtext" class="">Dan and Trang<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:20pt;font-family:Calibri,sans-serif;color:windowtext" class="">ICANN Org Liaisons<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:20pt;font-family:Calibri,sans-serif;color:windowtext" class=""><u class=""></u> <u class=""></u></span></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in" class=""><p class="MsoNormal"><b class=""><span style="font-size: 20pt;" class="">From: </span></b><span style="font-size: 20pt;" class="">Gnso-epdp-team <<a href="mailto:gnso-epdp-team-bounces@icann.org" target="_blank" class="">gnso-epdp-team-bounces@icann.org</a>> on behalf of "Rosette, Kristina via Gnso-epdp-team" <<a href="mailto:gnso-epdp-team@icann.org" target="_blank" class="">gnso-epdp-team@icann.org</a>><br class="">
<b class="">Reply-To: </b>"Rosette, Kristina" <<a href="mailto:rosettek@amazon.com" target="_blank" class="">rosettek@amazon.com</a>><br class="">
<b class="">Date: </b>Monday, January 28, 2019 at 5:14 PM<br class="">
<b class="">To: </b>"<a href="mailto:gnso-epdp-team@icann.org" target="_blank" class="">gnso-epdp-team@icann.org</a>" <<a href="mailto:gnso-epdp-team@icann.org" target="_blank" class="">gnso-epdp-team@icann.org</a>><br class="">
<b class="">Subject: </b>Re: [Gnso-epdp-team] Recommendation 13 - Responsibilities of the Parties - email list discussion<u class=""></u><u class=""></u></span></p>
</div>
<div class=""><p class="MsoNormal"><span style="font-size:20pt;color:windowtext" class=""><u class=""></u> <u class=""></u></span></p>
</div><p class="MsoNormal"><a name="m_6441758728418381503__MailOriginalBody" class=""><span style="font-size:20pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)" class="">All,
</span></a><span class=""><span style="font-size:20pt" class=""><u class=""></u><u class=""></u></span></span></p><p class="MsoNormal"><span class=""><span style="font-size:20pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)" class=""> </span></span><span class=""><span style="font-size:20pt" class=""><u class=""></u><u class=""></u></span></span></p><p class="MsoNormal"><span class=""><span style="font-size:20pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)" class="">Subject to a friendly amendment, RySG supports the RrSG proposed text for Recommendation 13. Our friendly amendment
is to change “shall” to “should” in the 3<sup class="">rd</sup> sentence. </span></span><span class=""><span style="font-size:20pt" class=""><u class=""></u><u class=""></u></span></span></p><p class="MsoNormal"><span class=""><span style="font-size:20pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)" class=""> </span></span><span class=""><span style="font-size:20pt" class=""><u class=""></u><u class=""></u></span></span></p><p class="MsoNormal"><span class=""><span style="font-size:20pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)" class="">As revised, Recommendation 13 reads:</span></span><span class=""><span style="font-size:20pt" class=""><u class=""></u><u class=""></u></span></span></p><p class="MsoNormal"><span class=""><span style="font-size:20pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)" class=""> </span></span><span class=""><span style="font-size:20pt" class=""><u class=""></u><u class=""></u></span></span></p><p class=""><span class=""><span style="font-size:20pt;font-family:Verdana,serif" class="">The EPDP Team recommends that ICANN Org negotiates and enters into required data protection agreements, as appropriate, with the Contracted Parties. In
addition to the legally required components of such agreement, the agreement shall specify the responsibilities of the respective parties for the processing activities as described therein. Indemnification clauses should ensure that the risk for certain data
processing is borne by either one or multiple parties that determine the purpose and means of the processing. Due consideration should be given to the analysis carried out by the EPDP Team in its Final Report.</span></span><span class=""><span style="font-size:20pt" class=""><u class=""></u><u class=""></u></span></span></p><p class="MsoNormal"><span class=""><span style="font-size:20pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)" class="">Kristina
</span></span><span class=""><span style="font-size:20pt" class=""><u class=""></u><u class=""></u></span></span></p><p class="MsoNormal"><span class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)" class=""> </span><u class=""></u><u class=""></u></span></p>
<div class="">
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in" class=""><p class="MsoNormal"><span class=""><b class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:windowtext" class="">From:</span></b></span><span class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:windowtext" class="">
Gnso-epdp-team [mailto:<a href="mailto:gnso-epdp-team-bounces@icann.org" target="_blank" class="">gnso-epdp-team-bounces@icann.org</a>] <b class="">On Behalf Of </b>Sarah Wyld<br class="">
<b class="">Sent:</b> Monday, January 28, 2019 3:29 PM<br class="">
<b class="">To:</b> <a href="mailto:gnso-epdp-team@icann.org" target="_blank" class="">gnso-epdp-team@icann.org</a><br class="">
<b class="">Subject:</b> Re: [Gnso-epdp-team] Recommendation 13 - Responsibilities of the Parties - email list discussion</span><u class=""></u><u class=""></u></span></p>
</div>
</div><p class="MsoNormal"><span class=""> <u class=""></u><u class=""></u></span></p><p class=""><span class=""><span style="font-size:10pt;font-family:Verdana,serif" class="">Hello All,</span><u class=""></u><u class=""></u></span></p><p class=""><span class=""><span style="font-size:10pt;font-family:Verdana,serif" class="">Here is the RrSG's proposed text for Rec 13:</span><u class=""></u><u class=""></u></span></p>
<blockquote style="margin-top:5pt;margin-bottom:5pt" class=""><p class=""><span class=""><span style="font-size:10pt;font-family:Verdana,serif" class="">The EPDP Team recommends that ICANN Org negotiates and enters into required data protection agreements, as appropriate, with the Contracted Parties. In
addition to the legally required components of such agreement, the agreement shall specify the responsibilities of the respective parties for the processing activities as described therein. Indemnification clauses shall ensure that the risk for certain data
processing is borne by either one or multiple parties that determine the purpose and means of the processing. Due consideration should be given to the analysis carried out by the EPDP Team in its Final Report.</span><u class=""></u><u class=""></u></span></p>
</blockquote><p class=""><span class="">The RrSG is aware that ICANN's status as controller, joint or independent, is not yet fully determined. As such, this proposed wording allows the flexibility to determine the appropriate type of data protection
agreement following further input. <u class=""></u><u class=""></u></span></p>
<pre class=""><span class="">-- <u class=""></u><u class=""></u></span></pre>
<pre class=""><span class="">Sarah Wyld<u class=""></u><u class=""></u></span></pre>
<pre class=""><span class="">Domains Product Team<u class=""></u><u class=""></u></span></pre>
<pre class=""><span class="">Tucows<u class=""></u><u class=""></u></span></pre>
<pre class=""><span class="">+1.416 535 0123 Ext. 1392<u class=""></u><u class=""></u></span></pre>
<pre class=""><span class=""> <u class=""></u><u class=""></u></span></pre>
<pre class=""><span class=""> <u class=""></u><u class=""></u></span></pre>
<div class=""><p class="MsoNormal"><span class="">On 1/23/2019 6:22 PM, Kurt Pritz wrote:<u class=""></u><u class=""></u></span></p>
</div>
<blockquote style="margin-top:5pt;margin-bottom:5pt" class="">
<div class="">
<div class=""><p class="MsoNormal"><span class="">Hi Everyone:<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span class="">With the goal of progressing on issues via email, the leadership team has considered the discussion provided during the Toronto meeting
and suggests the following compromise language to address the different positions expressed. (This is a resend of an earlier email with only the subject line of the email updated.)<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span class=""><b class="">Discussion</b> <u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span class="">The language below is the same language proposed by the small team that reviewed the comments, but modified: <u class=""></u><u class=""></u></span></p>
<ul type="disc" class="">
<li class="MsoNormal">
<span class="">as suggested by Diane during the meeting to reflect that GDPR Art 28 is unlikely to apply in this situation, and<u class=""></u><u class=""></u></span></li><li class="MsoNormal">
<span class="">by an addition (bracketed & bolded below) to reference the analysis in the Final Report that this team recommends the creation of Joint Controller Agreements, to appropriately influence the negotiation of GDPR-compliant
agreements.<u class=""></u><u class=""></u></span></li></ul>
<div class=""><p class="MsoNormal"><span class=""> <u class=""></u><u class=""></u></span></p>
</div><p class="MsoNormal"><span class="">This language is intended to strike a balance between those preferring to leave some flexibility for ICANN Org and Contracted Parties
to consider the appropriate agreements and those preferring to be specific about the type of agreement to be pursued.<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span class="">I understand this is a complex topic that might require additional discussion but it is also possible that we cannot be dispositive
on this issue prior to a lengthy contract formation discussion that extends well beyond our time frames. For that reason, we are taking the liberty of making this recommendation and hope you accept it in the spirit it is offered.<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span class=""><b class="">Proposed Recommendation #13 Language</b><u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span class="">The EPDP Team recommends that ICANN Org negotiates and enters into required data protection agreements such as a
<s class="">Data Processing Agreement (GDPR Art. 28) or</s> Joint Controller Agreement (Art. 26), as appropriate, with the Contracted Parties. In addition to the legally required components of such agreement, the agreement shall specify the responsibilities of the respective
parties for the processing activities as described therein. Indemnification clauses shall ensure that the risk for certain data processing is borne by either one or multiple parties that determine the purpose and means of the processing. [<b class="">Due consideration
should be given to the analysis carried out by the EPDP Team in its Final Report.</b>]<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span class=""><b class="">Action:</b> <u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span class="">Please indicate on the mailing list whether you have any concerns about these modifications and/or what other aspects of this recommendation
should be discussed.<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span class="">Deadline: Monday, 28 January, additional email discussion might follow depending on responses. <u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span class="">Sincerely,<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span class="">Kurt<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span class=""> <u class=""></u><u class=""></u></span></p>
</div>
</div><p class="MsoNormal"><span class=""><br class="">
<br class="">
<br class="">
<u class=""></u><u class=""></u></span></p>
<pre class=""><span class="">_______________________________________________<u class=""></u><u class=""></u></span></pre>
<pre class=""><span class="">Gnso-epdp-team mailing list<u class=""></u><u class=""></u></span></pre>
<pre class=""><span class=""></span><a href="mailto:Gnso-epdp-team@icann.org" target="_blank" class=""><span class="">Gnso-epdp-team@icann.org</span><span class=""></span></a><span class=""><u class=""></u><u class=""></u></span></pre>
<pre class=""><span class=""></span><a href="https://mm.icann.org/mailman/listinfo/gnso-epdp-team" target="_blank" class=""><span class="">https://mm.icann.org/mailman/listinfo/gnso-epdp-team</span><span class=""></span></a><span class=""><u class=""></u><u class=""></u></span></pre>
</blockquote>
</div>
</div>
_______________________________________________<br class="">
Gnso-epdp-team mailing list<br class="">
<a href="mailto:Gnso-epdp-team@icann.org" target="_blank" class="">Gnso-epdp-team@icann.org</a><br class="">
<a href="https://mm.icann.org/mailman/listinfo/gnso-epdp-team" rel="noreferrer" target="_blank" class="">https://mm.icann.org/mailman/listinfo/gnso-epdp-team</a></blockquote></div>
_______________________________________________<br class="">Gnso-epdp-team mailing list<br class=""><a href="mailto:Gnso-epdp-team@icann.org" class="">Gnso-epdp-team@icann.org</a><br class="">https://mm.icann.org/mailman/listinfo/gnso-epdp-team</div></blockquote></div><br class=""></div></body></html>