<div dir="ltr"><div>Hi Greg, <br></div><div>I agree, these non-LEA third parties have a valuable role to play and should benefit from some consideration in our work,...</div><div><br></div><div>...but they are not LEA and they have not been imbued with special investigative legal powers like LEAs have in their jurisdiction. So they cannot be treated as equals to LEAs as their legal basis for any request is by definition different from that of the LEAs of competent authority.</div><div><br></div><div>Yes, they fill a similar role, but they usually have next to no legal authority. They are, in essence, a normal third party requestor, like you and I would be.<br></div><div><br></div><div>As long as we keep that in mind in our work, we should be fine. <br></div><div><div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><span lang="EN-US">-- <br>Volker A. Greimann<br>General Counsel and Policy Manager<br><b>KEY-SYSTEMS GMBH</b><br><br>T: +49 6894 9396901<br>M: +49 6894 9396851<br>F: +49 6894 9396851<br>W: </span><a href="http://www.key-systems.net/" style="color:rgb(17,85,204)" target="_blank"><span lang="EN-US">www.key-systems.net</span></a><span lang="EN-US"><br><br>Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835<br>CEO: Alexander Siffrin<br><br>Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.</span><br></div></div></div><br></div></div></div><div id="DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br>
<table style="border-top:1px solid #d3d4de">
<tr>
<td style="width:55px;padding-top:13px"><a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank"><img src="https://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-orange-animated-no-repeat-v1.gif" alt="" width="46" height="29" style="width: 46px; height: 29px;"></a></td>
<td style="width:470px;padding-top:12px;color:#41424e;font-size:13px;font-family:Arial,Helvetica,sans-serif;line-height:18px">Virus-free. <a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank" style="color:#4453ea">www.avast.com</a>
</td>
</tr>
</table><a href="#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1"></a></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Jul 22, 2019 at 10:25 PM Greg Aaron <<a href="mailto:greg@illumintel.com">greg@illumintel.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div class="gmail-m_-4886407066487899250WordSection1"><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">As I mentioned on Thursday's call, criminal acts on the Internet are not dealt with exclusively by law enforcement. The vast majority of cases are dealt with by private entities, such as in-house investigators at networks, security companies dealing with phishing, private investigators, etc. etc. See also Recital 49.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">So, a fruitful approach to finding commonalities is to begin with the WHAT: WHAT is being investigated and WHAT the goals of the exercise are. In many cases, both a private party and an LE agent may use similar methods, and may be trying to accomplish similar goals. For example see the attached use case from SSAC – both LE and private entities go through these kinds of steps, with similar goals.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">Then perhaps comes the issue WHO is looking into it, and what differences that entails. The differences: Law Enforcement has a special status under the law, and may have a special GDPR basis when requesting data. And LE has some powers that private entities cannot deploy – such as arresting people and obtaining search warrants. <u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif"> <u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">So, I hope the team can consider these ideas at it proceeds.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">All best,<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">--greg<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p><div><div style="border-color:rgb(225,225,225) currentcolor currentcolor;border-style:solid none none;border-width:1pt medium medium;padding:3pt 0in 0in"><p class="MsoNormal"><b><span style="font-size:11pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11pt;font-family:"Calibri",sans-serif"> Gnso-epdp-team <<a href="mailto:gnso-epdp-team-bounces@icann.org" target="_blank">gnso-epdp-team-bounces@icann.org</a>> <b>On Behalf Of </b>Mueller, Milton L<br><b>Sent:</b> Wednesday, July 17, 2019 5:40 PM<br><b>To:</b> Janis Karklins <<a href="mailto:karklinsj@gmail.com" target="_blank">karklinsj@gmail.com</a>><br><b>Cc:</b> <a href="mailto:gnso-epdp-team@icann.org" target="_blank">gnso-epdp-team@icann.org</a><br><b>Subject:</b> Re: [Gnso-epdp-team] Materials for agenda item #4<u></u><u></u></span></p></div></div><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">Janis:<u></u><u></u></span></p><div><div><p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="color:rgb(31,73,125)">> </span>We are using cases to identify commonalities that would allow us, the Team, <span style="color:rgb(31,73,125)"><u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">> </span>to develop policy recommendations how to best implement provisions of GDPR.<span style="color:rgb(31,73,125)"><u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">I know that. That is exactly why I have proposed to consolidate them in the way I have. It seems to me that the commonalities in the cases I proposed to merge are fairly obvious. If it is a criminal case, for example, it really doesn’t matter a lot whether it is a copyright crime or a trademark crime or a phishing crime, the point is that you will have a government LEA requesting information needed to attribute and capture the criminal, which might be obtained through RDS or through subpoenas or other means. If someone can explain how the use case differs substantially in ways that affect the application of GDPR, let them do so. <u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal">Use cases are just a method that allows us to focus our attention to all necessary aspects of future policy recommendations. Therefore, cases need not be ideally drafted but rather represent/outline real life situations and help us understand concerns of different groups. <span style="color:rgb(31,73,125)"><u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">This comment is completely off the mark. Nothing in my document takes issue with any case because it is not “perfectly drafted.” It does not address the drafting at all. It talks about commonalities in their substance. You said: </span>“we should not try to agree on every word in the case, but rather to seek common understanding/ touch-points.<span style="color:rgb(31,73,125)">” </span><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">Which is exactly why I proposed to consolidate cases on more general terms. <u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p></div><div><p class="MsoNormal"><span style="color:rgb(31,73,125)">> </span>I would propose that we look at your proposal of use cases merger by e-mail <span style="color:rgb(31,73,125)"><u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">> </span>exchange and in the meantime, take most supported cases and discuss them <span style="color:rgb(31,73,125)"><u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">> </span>thru as suggested - thoroughly but quickly.<u></u><u></u></p></div><div><p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">This is not an acceptable proposal. In effect you are saying that you will ignore my proposed consolidation, and that we will waste time going case by case through all the cases anyway, based on an illegitimate survey that excluded half of the team. <u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">And when you say “thoroughly but quickly” you are living in a fantasy world. That will not happen. Think of how much time we spent on a single TM case. If the use cases have any value we need carefully consider the problems they pose. That will happen more efficiently if the cases are more general. That is why we need to consolidate the cases. We will raise this issue on the call tomorrow. <u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p></div><div><p class="MsoNormal"><span style="color:rgb(31,73,125)">> </span>I invite other Team members to join the conversation on Milton's proposal.<span style="color:rgb(31,73,125)"><u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">We will have that conversation tomorrow on the call.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">Dr. Milton L Mueller<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">Georgia Institute of Technology<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">School of Public Policy<u></u><u></u></span></p></div><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p></div></div></div>_______________________________________________<br>
Gnso-epdp-team mailing list<br>
<a href="mailto:Gnso-epdp-team@icann.org" target="_blank">Gnso-epdp-team@icann.org</a><br>
<a href="https://mm.icann.org/mailman/listinfo/gnso-epdp-team" rel="noreferrer" target="_blank">https://mm.icann.org/mailman/listinfo/gnso-epdp-team</a><br>
_______________________________________________<br>
By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a href="https://www.icann.org/privacy/policy" rel="noreferrer" target="_blank">https://www.icann.org/privacy/policy</a>) and the website Terms of Service (<a href="https://www.icann.org/privacy/tos" rel="noreferrer" target="_blank">https://www.icann.org/privacy/tos</a>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.</blockquote></div>