<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    <p>Hi Chris,</p>
    <p>I am with Milton here as I felt that the statements in the letter
      were more than clear when it comes to disclosures to law
      enforcement and third parties.  The purposes of law enforcement
      and third parties are not purposes of ICANN and ICANN should stop
      trying to fit a square peg through the round hole of its own
      purposes. <br>
    </p>
    <p>Law enforcement has legal rights under which access to data
      processed for various other purposes may be requested, for example
      under Art. 6 I (c) GDPR. Similarly, third parties will need a
      legal basis for any and every access request and controllers must
      in their own responsibility carry out a balancing between the
      rights of the data subject affected in each case and the rights of
      the requester. <br>
    </p>
    <p>When they note under "Next Steps" that law enforcement needs a
      timely and workable solution going forward to ensure the ability
      of LEAs to access the data legitimately, that does not invalidate
      the basic legal assumptions they make before that. On the
      contrary, it supports their view that a disclosure model for LEAs
      that is compliant with the legal requirements as well as stable,
      transparent and predictable is necessary. <br>
    </p>
    <p>No one said this was going to be easy but there is no
      contradiction in the letter when it comes to its messages. <br>
    </p>
    <p>Best regards,</p>
    <p>Volker Greimann<br>
    </p>
    <p><br>
    </p>
    <div class="moz-cite-prefix">Am 23.04.2019 um 20:04 schrieb Mueller,
      Milton L:<br>
    </div>
    <blockquote type="cite"
cite="mid:SN6PR07MB45756B40F621C8C517ECEBF2A1230@SN6PR07MB4575.namprd07.prod.outlook.com">
      <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
      <meta name="Generator" content="Microsoft Word 15 (filtered
        medium)">
      <style><!--
/* Font Definitions */
@font-face
        {font-family:Helvetica;
        panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
        {font-family:"Cambria Math";
        panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
        {font-family:Verdana;
        panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
        {font-family:"PT Sans";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
        {mso-style-priority:99;
        color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {mso-style-priority:99;
        color:purple;
        text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
        {mso-style-name:msonormal;
        mso-margin-top-alt:auto;
        margin-right:0in;
        mso-margin-bottom-alt:auto;
        margin-left:0in;
        font-size:12.0pt;
        font-family:"Times New Roman",serif;}
p.p1, li.p1, div.p1
        {mso-style-name:p1;
        mso-margin-top-alt:auto;
        margin-right:0in;
        mso-margin-bottom-alt:auto;
        margin-left:0in;
        font-size:12.0pt;
        font-family:"Times New Roman",serif;}
p.p2, li.p2, div.p2
        {mso-style-name:p2;
        mso-margin-top-alt:auto;
        margin-right:0in;
        mso-margin-bottom-alt:auto;
        margin-left:0in;
        font-size:12.0pt;
        font-family:"Times New Roman",serif;}
p.p3, li.p3, div.p3
        {mso-style-name:p3;
        mso-margin-top-alt:auto;
        margin-right:0in;
        mso-margin-bottom-alt:auto;
        margin-left:0in;
        font-size:12.0pt;
        font-family:"Times New Roman",serif;}
span.EmailStyle22
        {mso-style-type:personal;
        font-family:"Calibri",sans-serif;
        color:#1F497D;}
span.EmailStyle23
        {mso-style-type:personal-compose;
        font-family:"Calibri",sans-serif;
        color:windowtext;}
.MsoChpDefault
        {mso-style-type:export-only;
        font-size:10.0pt;}
@page WordSection1
        {size:8.5in 11.0in;
        margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
        {page:WordSection1;}
--></style>
      <div class="WordSection1">
        <p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Chris<o:p></o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">There
            is no inconsistency between the two statements. I am
            struggling to understand why key members of ICANN’s board do
            not understand this.
            <o:p></o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Purposes
            determine what data is collected and how it can be used by
            the controller. Disclosure to third parties with legitimate
            interests is not a purpose ICANN has in collecting and using
            registrant data, but disclosure Is  nevertheless something
            that can happen legally when certain conditions are met.
            When a credit card company collects PII about me, its
            purpose is to facilitate financial transactions, it is not
            to provide my name and address to the police. But legally,
            the police can request disclosure of that information from
            the credit card company under certain conditions set by law.
            What is so difficult to understand there?
            <o:p></o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">In
            the statements below, the EC merely insists, correctly, upon
            distinguishing between ICANN’s purposes for collecting and
            using registrant data, and its reasons for disclosing it to
            third parties. This does not rule out all disclosure to
            third parties with legitimate interests.
            <o:p></o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F4E79;mso-style-textfill-fill-color:#1F4E79;mso-style-textfill-fill-alpha:100.0%">During
            the EPDP deliberations, the same point was made repeatedly
            by public comments, and a majority of the EPDP members.</span><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p></o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F4E79;mso-style-textfill-fill-color:#1F4E79;mso-style-textfill-fill-alpha:100.0%">The
            law is clear. Some in this debate are trying to erect a
            false dichotomy: either we have ICANN collecting and
            disclosing registrant data indiscriminately, as it did
            during the old Whois, or there is no disclosure to third
            parties at all. Do you really think this is the choice we
            have?
            <o:p></o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F4E79;mso-style-textfill-fill-color:#1F4E79;mso-style-textfill-fill-alpha:100.0%"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F4E79;mso-style-textfill-fill-color:#1F4E79;mso-style-textfill-fill-alpha:100.0%">--MM
          </span><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F4E79;mso-style-textfill-fill-color:#1F4E79;mso-style-textfill-fill-alpha:100.0%"><o:p></o:p></span></p>
        <p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
        <div>
          <div style="border:none;border-top:solid #E1E1E1
            1.0pt;padding:3.0pt 0in 0in 0in">
            <p class="MsoNormal"><b><span
                  style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif">
                Gnso-epdp-team <a class="moz-txt-link-rfc2396E" href="mailto:gnso-epdp-team-bounces@icann.org"><gnso-epdp-team-bounces@icann.org></a>
                <b>On Behalf Of </b>Chris Disspain<br>
                <b>Sent:</b> Tuesday, April 23, 2019 11:26 AM<br>
                <b>To:</b> Volker Greimann
                <a class="moz-txt-link-rfc2396E" href="mailto:vgreimann@key-systems.net"><vgreimann@key-systems.net></a><br>
                <b>Cc:</b> <a class="moz-txt-link-abbreviated" href="mailto:gnso-epdp-team@icann.org">gnso-epdp-team@icann.org</a><br>
                <b>Subject:</b> Re: [Gnso-epdp-team] European Commission
                comments on Phase 1 report<o:p></o:p></span></p>
          </div>
        </div>
        <p class="MsoNormal"><o:p> </o:p></p>
        <div>
          <div>
            <p class="MsoNormal"><span
                style="font-size:10.0pt;font-family:"Verdana",sans-serif">Indeed,
                thanks Volker. It is both important and useful. It is
                also confusing although that may only be to me. What is
                said below appears to be directly at odds with things
                being said by the DPAs and EC representatives.<o:p></o:p></span></p>
            <div>
              <p class="MsoNormal"><span
                  style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
            </div>
            <div>
              <p class="MsoNormal"><span
                  style="font-size:10.0pt;font-family:"Verdana",sans-serif">In
                  its statement of 27 May 2018 (<a
href="https://edpb.europa.eu/news/news/2018/european-data-protection-board-endorsed-statement-wp29-icannwhois_en"
                    moz-do-not-send="true">https://edpb.europa.eu/news/news/2018/european-data-protection-board-endorsed-statement-wp29-icannwhois_en</a>)
                  the EDPB said:<o:p></o:p></span></p>
            </div>
            <div>
              <p class="MsoNormal"><span
                  style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
            </div>
            <div>
              <p class="MsoNormal"><em><span
                    style="font-size:11.5pt;font-family:"PT
                    Sans";color:#1B253A">"As expressed also in
                    earlier correspondence with ICANN (including </span></em><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif"><a
                    href="http://ec.europa.eu/newsroom/just/document.cfm?doc_id=48839"
                    moz-do-not-send="true"><em><b><span
                          style="font-size:11.5pt;font-family:"PT
                          Sans";color:#3CA8D3;text-decoration:none">this
                          letter</span></b></em></a></span><em><span
                    style="font-size:11.5pt;font-family:"PT
                    Sans";color:#1B253A"> of December 2017 and </span></em><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif"><a
href="http://ec.europa.eu/newsroom/article29/document.cfm?action=display&doc_id=51021"
                    moz-do-not-send="true"><em><b><span
                          style="font-size:11.5pt;font-family:"PT
                          Sans";color:#3CA8D3;text-decoration:none">this
                          letter</span></b></em></a></span><em><span
                    style="font-size:11.5pt;font-family:"PT
                    Sans";color:#1B253A"> of April 2018),  WP29
                    expects ICANN to develop and implement a WHOIS model
                    which will enable legitimate uses by relevant
                    stakeholders, such as law enforcement, of personal
                    data concerning registrants in compliance with the
                    GDPR, without leading to an unlimited publication of
                    those data."</span></em><span
                  style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p></o:p></span></p>
              <div>
                <p class="MsoNormal"><span
                    style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
              </div>
              <div>
                <p class="MsoNormal"><span
                    style="font-size:10.0pt;font-family:"Verdana",sans-serif">And
                    during a Board GAC call last week on the Kobe GAC
                    Communique (<a
href="https://gac.icann.org/minutes/gac%20kobe%20communiqu%C3%A9%20-%20gac-board%20clarification%20call%20notes%20-%2015april2019%20(final).pdf)"
                      moz-do-not-send="true">https://gac.icann.org/minutes/gac%20kobe%20communiqué%20-%20gac-board%20clarification%20call%20notes%20-%2015april2019%20(final).pdf)</a> in
                    a discussion about the need for an access model, the
                    work carried out by the Technical Study Group to
                    design one and how ICANN can get legal advice for
                    the DPAs about the legality of that model, the
                    Commission said that although it was not is a
                    position to speak for the EU member of the GAC...:<o:p></o:p></span></p>
              </div>
              <div>
                <p class="MsoNormal"><span
                    style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
              </div>
              <div>
                <p class="MsoNormal"><span
                    style="font-size:10.0pt;font-family:"Verdana",sans-serif">"European
                    Commission reiterated its willingness to help
                    facilitate communications with DPAs, and in
                    particular the Belgian DPAs who it indicated has
                    been chosen to be the lead DPA on this issue for the
                    EU, a European Commission further suggested a
                    two-step process: first, considering with legal
                    advisors implementation options to achieve the aims
                    of the EPDP report; and second, start consulting
                    with the lead DPA to get their views before
                    consulting the full EDPB once more, with
                    facilitation from the Commission as needed"<o:p></o:p></span></p>
              </div>
              <div>
                <div>
                  <p class="MsoNormal"><span
                      style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
                </div>
                <div>
                  <p class="MsoNormal"><span
                      style="font-size:10.0pt;font-family:"Verdana",sans-serif">I’m
                      struggling to align the above with the input
                      below.<o:p></o:p></span></p>
                </div>
                <div>
                  <div>
                    <div>
                      <div>
                        <div>
                          <div>
                            <div>
                              <p class="p1"
                                style="margin:0in;margin-bottom:.0001pt"><span
style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:black"><o:p> </o:p></span></p>
                              <p class="p2"
                                style="margin:0in;margin-bottom:.0001pt;font-variant-ligatures:
                                normal;font-variant-caps:
                                normal;font-variant-east-asian:
                                normal;font-variant-position:
                                normal;text-align:start;-webkit-text-stroke-width:
                                0px;word-spacing:0px">
                                <span
style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#9443FB"><o:p> </o:p></span></p>
                              <p class="p2"
                                style="margin:0in;margin-bottom:.0001pt;font-variant-ligatures:
                                normal;font-variant-caps:
                                normal;font-variant-east-asian:
                                normal;font-variant-position:
                                normal;text-align:start;-webkit-text-stroke-width:
                                0px;word-spacing:0px">
                                <span
style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#9443FB">Cheers,<o:p></o:p></span></p>
                              <p class="p3"
                                style="margin:0in;margin-bottom:.0001pt;font-variant-ligatures:
                                normal;font-variant-caps:
                                normal;font-variant-east-asian:
                                normal;font-variant-position:
                                normal;min-height:
                                16px;text-align:start;-webkit-text-stroke-width:
                                0px;word-spacing:0px">
                                <span
style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#9443FB"><o:p> </o:p></span></p>
                              <p class="p2"
                                style="margin:0in;margin-bottom:.0001pt;font-variant-ligatures:
                                normal;font-variant-caps:
                                normal;font-variant-east-asian:
                                normal;font-variant-position:
                                normal;text-align:start;-webkit-text-stroke-width:
                                0px;word-spacing:0px">
                                <span
style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#9443FB">Chris<o:p></o:p></span></p>
                            </div>
                          </div>
                        </div>
                      </div>
                    </div>
                  </div>
                </div>
                <div>
                  <p class="MsoNormal"><span
                      style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
                </div>
                <div>
                  <p class="MsoNormal"><span
                      style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
                </div>
                <div>
                  <p class="MsoNormal"><span
                      style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
                </div>
                <div>
                  <p class="MsoNormal"><span
                      style="font-size:10.0pt;font-family:"Verdana",sans-serif"><br>
                      <br>
                      <o:p></o:p></span></p>
                  <blockquote
                    style="margin-top:5.0pt;margin-bottom:5.0pt">
                    <div>
                      <p class="MsoNormal"><span
                          style="font-size:10.0pt;font-family:"Verdana",sans-serif">On
                          18 Apr 2019, at 16:08, Ayden Férdeline <<a
                            href="mailto:icann@ferdeline.com"
                            moz-do-not-send="true">icann@ferdeline.com</a>>
                          wrote:<o:p></o:p></span></p>
                    </div>
                    <p class="MsoNormal"><span
                        style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
                    <div>
                      <div>
                        <p class="MsoNormal"><span
                            style="font-size:10.0pt;font-family:"Verdana",sans-serif">Thank
                            you for highlighting this important and
                            useful contribution, Volker.
                            <o:p></o:p></span></p>
                      </div>
                      <div>
                        <p class="MsoNormal"><span
                            style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
                      </div>
                      <div>
                        <div>
                          <div>
                            <p class="MsoNormal"><span
                                style="font-size:10.0pt;font-family:"Verdana",sans-serif">--
                                Ayden
                                <o:p></o:p></span></p>
                          </div>
                        </div>
                        <div>
                          <p class="MsoNormal"><span
                              style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
                        </div>
                      </div>
                      <div>
                        <p class="MsoNormal"><span
                            style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
                      </div>
                      <div>
                        <p class="MsoNormal"><span
                            style="font-size:10.0pt;font-family:"Cambria
                            Math",serif">‐‐‐‐‐‐‐</span><span
                            style="font-size:10.0pt;font-family:"Verdana",sans-serif">
                            Original Message
                          </span><span
                            style="font-size:10.0pt;font-family:"Cambria
                            Math",serif">‐‐‐‐‐‐‐</span><span
                            style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p></o:p></span></p>
                      </div>
                      <div>
                        <p class="MsoNormal"><span
                            style="font-size:10.0pt;font-family:"Verdana",sans-serif">On
                            Thursday, April 18, 2019 4:37 PM, Volker
                            Greimann <<a
                              href="mailto:vgreimann@key-systems.net"
                              moz-do-not-send="true">vgreimann@key-systems.net</a>>
                            wrote:<o:p></o:p></span></p>
                      </div>
                      <div>
                        <p class="MsoNormal"><span
                            style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
                      </div>
                      <blockquote
                        style="margin-top:5.0pt;margin-bottom:5.0pt">
                        <p class="MsoNormal"
                          style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif">Dear
                            fellow members,
                            <o:p></o:p></span></p>
                        <p class="MsoNormal"
                          style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif">the
                            European Commission just provided very
                            valuable and constructive insights into our
                            reports that we would be well-advised to
                            take into account in Phase 2:<o:p></o:p></span></p>
                        <p class="MsoNormal"
                          style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif"><a
href="https://mm.icann.org/pipermail/comments-epdp-recs-04mar19/attachments/20190417/6f0a65b2/CommentsontheTemporarySpecificationforgTLDRegistrationDataPolicyRecommendations-0001.pdf"
                              moz-do-not-send="true">https://mm.icann.org/pipermail/comments-epdp-recs-04mar19/attachments/20190417/6f0a65b2/CommentsontheTemporarySpecificationforgTLDRegistrationDataPolicyRecommendations-0001.pdf</a><o:p></o:p></span></p>
                        <p class="MsoNormal"
                          style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif">"<i>The
                              European Commission recognises this (the
                              recommendation of purposes and association
                              with processing activities) as a <b>long
                                due and important step forward</b> in
                              the ongoing reform of the WHOIS system.
                              Having a clear definition of the purposes
                              for the processing of the data in the
                              WHOIS system is an
                              <b>essential pre-requisite</b> for
                              ensuring a GDPR-compliant system.</i>"<o:p></o:p></span></p>
                        <p class="MsoNormal"
                          style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif">"<i>the
                              overall model would benefit from
                              <b>making even more explicit the links
                                between the purposes for processing
                                personal data and the specific
                                processing activity(ies) as well as the
                                specific personal data items.</b></i>"<o:p></o:p></span></p>
                        <p class="MsoNormal"
                          style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif">"<i>Accordingly,
                              the European Commission considers that
                              <b>the purposes</b> for processing WHOIS
                              personal data by ICANN and/or the
                              contracted parties
                              <b>should not include enabling access by
                                third parties</b>. This is also at the
                              core of the concerns expressed for some
                              time by the DPAs and the European Data
                              Protection Board (EDPB), which have
                              clarified that the purposes of ICANN and
                              contracted parties must
                              <b>not be conflated with the interests of
                                third parties</b> in accessing
                              registration data.</i>"<o:p></o:p></span></p>
                        <p class="MsoNormal"
                          style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif">"<i>Notwithstanding
                              the above, the European Commission would
                              like to acknowledge that maintaining such
                              a distinction does not per se limit WHOIS
                              data access by/disclosure to third
                              parties, but merely differentiates between<b>
                                ICANN’s own purposes</b> (e.g.
                              maintaining the security, stability and
                              resilience of the Domain Name System)
                              which are capable of justifying collection
                              of the data in the first place, and
                              subsequent processing (enabling access to
                              and disclosing WHOIS data) for legitimate
                              purposes pursued by third parties.</i>"<o:p></o:p></span></p>
                        <p class="MsoNormal"
                          style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif">"<i>In
                              the Report, Article 6(1) (f) of the GDPR
                              is often invoked. The European Commission
                              would like to recall that legitimate
                              interest is one of the six possible legal
                              bases provided under the GDPR1. (...)
                              Specifically, the legitimate interest<b>
                                needs to outweigh</b> the interest of
                              the individual concerned. Given that there
                              is an interference with the fundamental
                              right to data protection of an individual,
                              a balancing of interests is necessary to
                              properly justify the reasons for such an
                              interference. (...) The
                              <b>balancing is </b>thus <b>a
                                responsibility</b> (<b>not a prerogative</b>)
                              of the data controller.</i>"<o:p></o:p></span></p>
                        <p class="MsoNormal"
                          style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif">"<b><i>Third
                                parties seeking access also need a legal
                                basis for processing the data</i></b><i>.
                              For instance, an IPR rightholder might
                              have a legitimate interest to gain access
                              to WHOIS personal data in order to ensure
                              his/her IP right is protected and not
                              abused. The existence of
                              <b>such a right needs to be substantiated
                                and the necessity/proportionality of
                                accessing that data ascertained</b>.
                              This IPR rightholder might rely on Art.
                              6(1) (f).</i>"<o:p></o:p></span></p>
                        <p class="MsoNormal"
                          style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif">"<b><i>GDPR
                                legitimate interest cannot be used as a
                                legal basis for data processing by
                                public authorities</i></b>".<o:p></o:p></span></p>
                        <p class="MsoNormal"
                          style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif">"<i>With
                              regard to the various processing
                              activities involved in the WHOIS system,
                              the issue of whether they involve an <b>international
                                data transfer </b>under the GDPR should
                              be considered.</i> (...) it is also
                            necessary to identify
                            <b>an appropriate legal ground </b>for the
                            international transfer"<o:p></o:p></span></p>
                        <p class="MsoNormal"
                          style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif">"<i>the
                              current situation is affecting EU Member
                              State
                              <b>authorities’ ability</b> to obtain
                              legitimate access to this data, necessary
                              to enforce the law online, including in
                              relation to the fight against cybercrime</i>"<o:p></o:p></span></p>
                        <p class="MsoNormal"
                          style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif">All
                            this seems to point in a very clear
                            direction for our path ahead with regard to
                            the disclosure model we will be working on.
                            More on that when we get to this part of our
                            deliberations. <o:p>
                            </o:p></span></p>
                        <p class="MsoNormal"
                          style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
                        <div>
                          <div>
                            <p class="MsoNormal"><span
                                style="font-size:10.0pt;font-family:"Verdana",sans-serif">--
                                <o:p></o:p></span></p>
                          </div>
                          <div>
                            <p class="MsoNormal"><span
                                style="font-size:10.0pt;font-family:"Verdana",sans-serif">Volker
                                A. Greimann<o:p></o:p></span></p>
                          </div>
                          <div>
                            <p class="MsoNormal"><span
                                style="font-size:10.0pt;font-family:"Verdana",sans-serif">General
                                Counsel and Policy Manager<o:p></o:p></span></p>
                          </div>
                          <div>
                            <p class="MsoNormal"><b><span
                                  style="font-size:10.0pt;font-family:"Verdana",sans-serif">KEY-SYSTEMS
                                  GMBH</span></b><span
                                style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p></o:p></span></p>
                          </div>
                          <div>
                            <p class="MsoNormal"><span
                                style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
                          </div>
                          <div>
                            <p class="MsoNormal"><span
                                style="font-size:10.0pt;font-family:"Verdana",sans-serif">T:
                                +49 6894 9396901<o:p></o:p></span></p>
                          </div>
                          <div>
                            <p class="MsoNormal"><span
                                style="font-size:10.0pt;font-family:"Verdana",sans-serif">M:
                                +49 6894 9396851<o:p></o:p></span></p>
                          </div>
                          <div>
                            <p class="MsoNormal"><span
                                style="font-size:10.0pt;font-family:"Verdana",sans-serif">F:
                                +49 6894 9396851<o:p></o:p></span></p>
                          </div>
                          <div>
                            <p class="MsoNormal"><span
                                style="font-size:10.0pt;font-family:"Verdana",sans-serif">W:
                                <a href="http://www.key-systems.net/"
                                  moz-do-not-send="true">www.key-systems.net</a><o:p></o:p></span></p>
                          </div>
                          <div>
                            <p class="MsoNormal"><span
                                style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
                          </div>
                          <div>
                            <p class="MsoNormal"><span
                                style="font-size:10.0pt;font-family:"Verdana",sans-serif">Key-Systems
                                GmbH is a company registered at the
                                local court of Saarbruecken, Germany
                                with the registration no. HR B 18835<o:p></o:p></span></p>
                          </div>
                          <div>
                            <p class="MsoNormal"><span
                                style="font-size:10.0pt;font-family:"Verdana",sans-serif">CEO:
                                Alexander Siffrin<o:p></o:p></span></p>
                          </div>
                          <div>
                            <p class="MsoNormal"><span
                                style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
                          </div>
                          <div>
                            <p class="MsoNormal"><span
                                style="font-size:10.0pt;font-family:"Verdana",sans-serif">Part
                                of the CentralNic Group PLC (LON: CNIC)
                                a company registered in England and
                                Wales with company number 8576358.<o:p></o:p></span></p>
                          </div>
                        </div>
                      </blockquote>
                      <div>
                        <p class="MsoNormal"><span
                            style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
                      </div>
                      <p class="MsoNormal"><span
                          style="font-size:10.0pt;font-family:"Verdana",sans-serif">_______________________________________________<br>
                          Gnso-epdp-team mailing list<br>
                          <a href="mailto:Gnso-epdp-team@icann.org"
                            moz-do-not-send="true">Gnso-epdp-team@icann.org</a><br>
                          <a
                            href="https://mm.icann.org/mailman/listinfo/gnso-epdp-team"
                            moz-do-not-send="true">https://mm.icann.org/mailman/listinfo/gnso-epdp-team</a><o:p></o:p></span></p>
                    </div>
                  </blockquote>
                </div>
                <p class="MsoNormal"><span
                    style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
              </div>
            </div>
          </div>
        </div>
      </div>
    </blockquote>
    <div class="moz-signature">-- <br>
      Volker A. Greimann<br>
      General Counsel and Policy Manager<br>
      <strong style="border-bottom: 3px solid #5C46B5">KEY-SYSTEMS GMBH</strong><br>
      <br>
      T: +49 6894 9396901<br>
      M: +49 6894 9396851<br>
      F: +49 6894 9396851<br>
      W: <a class="moz-txt-link-abbreviated" href="http://www.key-systems.net">www.key-systems.net</a><br>
      <br>
      Key-Systems GmbH is a company registered at the local court of
      Saarbruecken, Germany with the registration no. HR B 18835<br>
      CEO: Alexander Siffrin<br>
      <br>
      Part of the CentralNic Group PLC (LON: CNIC) a company registered
      in England and Wales with company number 8576358.</div>
  </body>
</html>