<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US">Dear Caitlin, colleagues,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US">Please find below questions on the topics of the legal memos from the GAC:<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US">Accuracy<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US">. If current verification statistics provide that a large number of data is inaccurate isn't that a metric to deduce that the accuracy principle is not served
in a reasonable manner as demanded by the GDPR?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US">. According to the GDPR all personal data are processed based on the principle that they are necessary for the purpose for which they are collected. If those
data are necessary, how can the purpose be served while the data are inaccurate?
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US">. Can you provide an analysis on the third-parties mentioned in para 19 on which "ICANN and the relevant parties may rely on to confirm the accuracy of personal
data if it is reasonable to do so"? Do they become in such a scenario data processors?
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US">. How does the accuracy principle in connection to the parties' liability has to be understood in light of the accountability principle of the GDPR? What are
the responsibilities of ICANN and the contracted parties (who are subject to the GDPR) under Chapter IV pf the GDPR? If the contracted parties (as data controllers) engage third entities as processors (e.g. to provide data back-up services), what are the responsibilities
of these entities? What does this mean in terms of liabilities (in light of Art. 82 GDPR)?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US">. While in the first place it is up to the registrants to provide accurate details about themselves and it is up to the registrants not to mistakenly identify
themselves as natural or legal persons, the Memo on "Natural vs Legal persons" provides interesting ideas/suggestions for the contracted parties to proactively ensuring the reliability of information provided, including through measures to independently verify
the data. Could similar mechanisms be identified also for ensuring the reliability of the contact details of the registrant? Can best practices be drawn from the ccTLD?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US">Natural or non-natural persons<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US">. How is the (inaccurate or accurate) designation by the registrant about her status as non-natural person considered personal data information? If it's not is
the analysis about whether the accuracy principle applies relevant?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US">. How would the analysis provided take into account the possibility for registrants who are natural persons to "opt-in" for a full publication of their personal
data? Indeed it might be the case that some of these registrants might wish to ensure their details are available on WHOIS.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US">Technical contact
<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US">Most of the issue for not allowing this seems to be around the inability to verify if the RNH has obtained consent from the technical contact. When the CP's verify
the email address could consent also be confirmed for the term of the registration?
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US">General question:<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US">. How could anonymisatio/pseudonymisation techniques be of help in complying with the GDPR while also allowing for additional disclosure of certain data elements?
E.g. use of anonymised/pseudonymised emails and names, in particular in the context of registrations by legal persons.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US">Apologies again for the delay of our submission.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US">Georgios Tselentis (GAC-EPDP)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-left:36.0pt"><b><span lang="EN-US" style="font-size:11.0pt">From:</span></b><span lang="EN-US" style="font-size:11.0pt"> Gnso-epdp-team <gnso-epdp-team-bounces@icann.org>
<b>On Behalf Of </b>Caitlin Tubergen<br>
<b>Sent:</b> Wednesday, May 22, 2019 5:22 PM<br>
<b>To:</b> gnso-epdp-team@icann.org<br>
<b>Subject:</b> [Gnso-epdp-team] For your review - Clarifying Legal Questions Table<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span lang="EN-US" style="font-size:11.0pt">Dear EPDP Team,<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span lang="EN-US" style="font-size:11.0pt">Following up on an action item from our last meeting, please find attached a table which organizes the clarifying legal questions received to date. We will discuss the
table during our next meeting.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span lang="EN-US" style="font-size:11.0pt">Please note that the deadline for submitting additional clarifying questions is before 14:00 UTC on Thursday, 23 May. If additional questions come in before the deadline,
we will update the table accordingly.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span lang="EN-US" style="font-size:11.0pt">Thank you.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span lang="EN-US" style="font-size:11.0pt">Best regards,<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span lang="EN-US" style="font-size:11.0pt">Marika, Berry, and Caitlin<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span lang="EN-US" style="font-size:11.0pt;font-family:"Times New Roman",serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</body>
</html>