<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:-webkit-standard;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:548877585;
mso-list-template-ids:465714082;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Dear All,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I have two comments with respect to the technical contact and the geographic based differentiation <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Two points with regard to the technical contact<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">First the technical contact does not need to be personal information example tech@company.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Second the registrar can easily notify the technical contact - within one month from registration or before the first contact with the data subject - because it has the contact information on file and thus will
have a means to demonstrate that in fact a notice has been provided. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Therefore if registrars inform data subjects that the technical contact should not be personal information and
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">put a system in place to notify the technical contact upon registration there should be no significant risk. In all cases registrars that decide to offer the technical contact are going to rely on methods that
educate the data subject and notify the third party that is they are going to put a complying process in place.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">With regard to geographic distinction - recommendation #16 - since we did not receive yet the legal advice in this regard<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">We could amend recommendation #16 to say " registrars are not obligated to do so now and until further legal advice has been received and discussed during phase II of the EPDP team work. Work of phase II may
compliment or replace this recommendation "<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Have a nice day<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">hadia<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org]
<b>On Behalf Of </b>Caitlin Tubergen<br>
<b>Sent:</b> Wednesday, February 13, 2019 6:10 AM<br>
<b>To:</b> Alan Greenberg; gnso-epdp-team@icann.org<br>
<b>Subject:</b> [Gnso-epdp-team] Issues with the report<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoPlainText">Hi Alan,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Please find answers to your questions in blue. <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">We are still looking into one of your questions, but noting the request for a quick reply, please see the answers below.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Thank you.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Best regards,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Marika, Berry, and Caitlin<o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:-webkit-standard;color:black">--<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:-webkit-standard;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">There are several issues with the report that are either incorrect, <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">or I do not know how the decisions were made (and several others also <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">do not know).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">- Rec #8 implies (but does not clearly say) that offering Tech <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Contacts is an option for registrars. In the interim report, we <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">raised the question of whether "optional" for the Tech fields meant <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">optional for the registrant, or optional for the registrar. I cannot <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">recall ever discussing this when we went over the comments, but <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">somehow it is now optional for registrars, requiring registrants to <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">shop around for a registrar that accepts the option - if indeed any <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">registrars will! When was this decided?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#4472C4"><o:p> </o:p></span></p>
<p class="MsoNormal" style="vertical-align:baseline"><span style="color:#4472C4">Please refer to the
<span class="MsoHyperlink"><span style="color:#4472C4"><a href="https://community.icann.org/display/EOTSFGRD/2019-01-24+EPDP+Team+call+%2339"><span style="color:#4472C4">24 January meeting</span></a></span></span> as well as the response from Bird & Bird re:
the liability associated with additional contact information. <o:p></o:p></span></p>
<p class="MsoNormal" style="vertical-align:baseline"><span style="color:#4472C4"><o:p> </o:p></span></p>
<p class="MsoNormal" style="vertical-align:baseline"><span style="color:#4472C4">As you may remember, there was an “informal vote” at the end of the 24 January call, during which there was no consensus with respect to the meaning of “optional”. In other words,
approximately half of the groups preferred optional to mean the registrar has the
<i>option</i> of offering a technical contact field to the registrant, and half of the groups preferred optional to mean the registrar must offer the technical contact field but the registrant has the
<i>option</i> of providing contact information for the technical contact field. <o:p>
</o:p></span></p>
<p class="MsoNormal" style="vertical-align:baseline"><span style="color:#4472C4"><o:p> </o:p></span></p>
<p class="MsoNormal" style="vertical-align:baseline"><span style="color:#4472C4">We noted, during the call, that we would document the status of the issue in the Final Report and await further legal advice.
<o:p></o:p></span></p>
<p class="MsoNormal" style="vertical-align:baseline"><span style="color:#4472C4"><o:p> </o:p></span></p>
<p class="MsoNormal" style="vertical-align:baseline"><span style="color:#4472C4">The following question was posted to legal counsel:<o:p></o:p></span></p>
<p class="MsoNormal" style="vertical-align:baseline"><span style="color:#4472C4"><o:p> </o:p></span></p>
<p class="MsoNormal"><i><span style="color:#4472C4">The EPDP Team also took note of a related footnote [from the EDPB] which states, “[if contact details for persons other than the RNH are provided] it should be ensured that the individual concerned is informed”.
The EPDP Team discussed whether this note implies that it is sufficient for the Registered Name Holder (RNH) to inform the individual it has designated as the technical contact, or whether the registrar may have the additional legal obligations to obtain consent.
The EPDP Team requested external legal counsel guidance on this topic who provided the following summary answer:</span></i><span style="color:#4472C4"><o:p></o:p></span></p>
<p class="MsoNormal"><i><span style="color:#4472C4"> </span></i><span style="color:#4472C4"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#4472C4">Legal Counsel provided the following response:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#4472C4"><o:p> </o:p></span></p>
<p class="MsoNormal"><i><span style="color:#4472C4">“In cases where the RNH and the technical contact are not the same person, relying on the RNH to provide notice on the registrar's behalf will not meet GDPR's notice requirements if the RNH fails to provide
the notice. While this may provide grounds for a contractual claim against the RNH, it is unlikely to provide a viable defence under the GDPR. Moreover, this arrangement will make it difficult for registrars to demonstrate that notice has been provided. If
notice is not effectively provided, this could affect the legitimate interests analysis, since technical contacts may not "reasonably expect" the manner in which their data will be processed. If relying on consent, such an arrangement would make it difficult
to document that consent has been provided”.<o:p></o:p></span></i></p>
<p class="MsoNormal"><span style="color:#4472C4"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#4472C4">If you would like to refer to the full response from Bird & Bird, please refer to the this
<span class="MsoHyperlink"><span style="color:#4472C4"><a href="https://community.icann.org/display/EOTSFGRD/Meetings+Legal+Committee+Framework?preview=/102138857/102145991/Technical%20Contact%20Memo.docx"><span style="color:#4472C4">memo</span></a></span></span>.
This response has also been documented in the Final Report. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">- Rec #16 takes geographic differentiation off the table. My <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">recollection is that we put that decision into Phase 2. When was this <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">decision taken?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#4472C4">Please refer to the email from Marc A. (see https://mm.icann.org/pipermail/gnso-epdp-team/2019-February/001543.html), which includes the text that is now in the Final Report. Feedback was requested, following
a number of positive responses to this approach (see <a href="https://mm.icann.org/pipermail/gnso-epdp-team/2019-February/001485.html">
https://mm.icann.org/pipermail/gnso-epdp-team/2019-February/001485.html</a>) - no objections were raised at the time; however, if your group believes this is in error, please flag this accordingly.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#4472C4"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#4472C4">Please also note the following question has been posed to legal counsel:
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#4472C4"><br>
<i>In light of the EDPB Guidance on territorial scope of GDPR, how do ICANN’s stable establishments within the EU impact its responsibilities as a data controller. The EDPB Guidance appears to suggest that ICANN, as a controller with stable establishments within
the EU, might be required to comply with GDPR? Is this the case even if the majority of processing activities (including registrar/reseller collection of data from RNH) take place outside of the EU? .<br>
<br>
Specifically:</i></span><i><span style="font-size:12.0pt;color:#4472C4"><o:p></o:p></span></i></p>
<ul style="margin-top:0in;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px" type="disc">
<li class="MsoNormal" style="color:#4472C4;mso-list:l0 level1 lfo1"><i>Do any of ICANN’s operations within the EU qualify as Establishments, as defined by Recital 22 of the GDPR?</i><i><span style="font-size:12.0pt"><o:p></o:p></span></i></li><li class="MsoNormal" style="color:#4472C4;mso-list:l0 level1 lfo1"><i> If ICANN is found to have Establishments within the EU, do these Establishments require ICANN (as a controller of gTLD Registration Directory Services related processing activities) to
be subject to article 3.1 of the GDPR?</i><i><span style="font-size:12.0pt"><o:p></o:p></span></i></li><li class="MsoNormal" style="color:#4472C4;mso-list:l0 level1 lfo1"><i>Do the answers to the above<span class="apple-converted-space"> </span>questions<span class="apple-converted-space"> </span>impact ICANN’s, and/or any associated controllers’ or processors’,
ability to distinguish between Registered Name Holders (RNH)/data subjects based on the geographic location of the RNHs in determining the geographic scope of GDPR?</i><i><span style="font-size:12.0pt"><o:p></o:p></span></i></li></ul>
<p class="MsoNormal"><span style="color:#4472C4"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">- Rec #18 does not make sense to me. It says that Temp Spec sections <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">4.1 and 4.2 are to be replaced "upon expiration". What is the purpose <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">of replacing these sections once the Temp Spec is no longer <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">operative? And how does that affect access? I note that Rec #28 <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">temporarily reinstates the Temp Spec, but the version PRIOR to expiration.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#4472C4">The work of the EPDP Team is to confirm, or not, the language in the Temporary Spec. In some cases, the Team confirmed the precise language in the Temporary Specification. Per the feedback of the EPDP Team, rather
than simply confirming language, we have inserted the specifically-agreed upon language within the Temporary Specification into the Final Report.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#4472C4"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#4472C4">In the case of Recommendation 18, the Team agreed to replace the language in the Temporary Specification with the language noted in the recommendation, noting that work in Phase 2 may complement or replace the
language within the recommendation. The Team agreed these new defined criteria would be effective as soon as the Temporary Specification expires, which is why it is denoted as such.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">- Rec #29 requires explicit action from registrars before the Admin <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">fields can be eliminated. Either we need to explicitly say that this <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">action must be taken prior to 29 February 2020, or we need to include <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">them in Rec #5 listing all RDDS fields flagging them as being there <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">only until the Rec #29 action is taken.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#4472C4">Thank you for flagging this. We could add a sentence that this action must be taken prior to 29 February 2020 if the EPDP Team agrees.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">On a less substantive level:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">- We say the Tech name and contact fields are option, but in the <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">various tables, the are not flagged with a trailing (opt.) like the <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">other optional fields are.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">- In Rec #8, why are Tech name and contacts transmitted by registries <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">to escrow but not by registrars (as currently required by the RAA)?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#4472C4"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#4472C4">We are looking into this and will revert to you shortly.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">- Rec #13 makes a reference to "Recommendation X". I presume this <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">should be Rec #6.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#4472C4">Yes, thank you for noting this. <o:p>
</o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">- Rec #21 makes reference to Thick and Thin registries, a concept <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">that we are told no longer exists.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#4472C4">The language you reference is part of the Temporary Specification that the Team agreed to confirm at its face-to-face meeting in Toronto. Please refer to Annex D of the Temporary Specification.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">The first issues have a direct bearing on whether the ALAC can <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">support this report and I would appreciate a quick reply.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">Alan<o:p></o:p></span></p>
<p class="MsoNormal" style="vertical-align:baseline"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="vertical-align:baseline"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>