<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
<p><font size="+1"><font face="Lucida Grande">I am three weeks overdue to apologize for labeling this question as "stupid". Perhaps a better word would have been "basic". However, I am sorry if anyone, particularly Alan Greenberg and ALAC members generally
have taken offense to the characterization of the question (not Alan) as stupid.</font></font></p>
<p><font size="+1"><font face="Lucida Grande">Meanwhile, members may recall that I argued as hard as I could, along with Ayden, for some serious training in data protection law for team members, so that folks would become acclimatized to the concepts and basic
precepts. I also have argued for having a data protection lawyer present in the room who could raise his/her flag when we head off on a dead end because we are arguing something that simply will not hold water in an argument with a DPA. Sadly, we do not
have such a person in the room most of the time, no offence intended to the ICANN legal team who is present.
<br>
</font></font></p>
<p><font size="+1"><font face="Lucida Grande">Apologies for cross posting, but a manual for data protection officers has been published, funded by the EU and a number of Data Protection Commissioners. I think it is excellent, contains a good history of relevant
law and guidance for how data protection officers and the new role in the GDPR ought to be managed. It is written by two folks who have been at this since the 90s (colleagues so perhaps I am biased) Douwe Korff (emeritus London Metropolitan University) and
Marie Georges (ex-CNIL, also had been seconded by the CNIL to the European Commission during the struggle to get the original Directive 95/46 Directive passed). In case anyone thinks the concept of the DPO within an organization is new, it is not, during
the 90s the German data protection laws provided for this in companies of a certain size, and when Douwe wrote the annual compliance report for the Article 29 Working Party/the European Commission in 1998, he recommended that this concept be implemented more
broadly. Eventually, this happened, as it now forms part of the Regulation. Available here
<a class="moz-txt-link-freetext" href="http://www.fondazionebasso.it/2015/wp-content/uploads/2019/07/T4DATA-MANUAL-2019.pdf">
http://www.fondazionebasso.it/2015/wp-content/uploads/2019/07/T4DATA-MANUAL-2019.pdf</a></font></font><br>
</p>
<div class="moz-forward-container">Stephanie<br>
<br>
-------- Forwarded Message --------
<table class="moz-email-headers-table" cellspacing="0" cellpadding="0" border="0">
<tbody>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">Subject: </th>
<td>Re: [Gnso-epdp-team] REVISED: Question for legal advisors</td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">Date: </th>
<td>Tue, 30 Jul 2019 10:33:24 -0400</td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">From: </th>
<td>Stephanie Perrin <a class="moz-txt-link-rfc2396E" href="mailto:stephanie.perrin@mail.utoronto.ca">
<stephanie.perrin@mail.utoronto.ca></a></td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">To: </th>
<td><a class="moz-txt-link-abbreviated" href="mailto:gnso-epdp-team@icann.org">gnso-epdp-team@icann.org</a></td>
</tr>
</tbody>
</table>
<br>
<br>
<p><font size="+1"><font face="Lucida Grande">It really pains me to blow our legal budget asking stupid questions like this one. Forgive me for being blunt. As Milton has indicated very clearly, these are two separate issues, not to mention deliberative procedures,
for which guidelines have been written by numerous DPAs, and we continue to conflate them</font></font>.
<font size="+1">We all recognize that the ICANN data sharing ecosystem, like the cybercrime fighters data sharing ecosystem, has long relied on a trusted player system. Data protection law does not. If you don't care to believe me, then go ask a data protection
commissioner. Maybe Joe Cannataci will be kind, despite the long interval during which we never got back to him (i.e. since March 2017), and answer for free. Please don't blow our budget on this, we need it for really serious questions.<br>
</font></p>
<p><font size="+1">Stephanie</font></p>
<p><font size="+1">PS you all should have let us put Peter Kimpian on this committee as an expert observer. He could answer this one for free too.
</font><br>
</p>
<div class="moz-cite-prefix">On 2019-07-30 10:04, Mueller, Milton L wrote:<br>
</div>
<blockquote type="cite" cite="mid:SN6PR07MB4575EFB2C48B3ED32DE3BA40A1DC0@SN6PR07MB4575.namprd07.prod.outlook.com">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">></span>That mischaracterizes. The issue is not “can the balancing test be avoided.”
<span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">> </span>The question is about inputs into the decision-making process, and involving use
<span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">> </span>cases that the GDPR speaks actually speaks to specifically.<o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I don’t think I have mischaracterized the question. Any use case that requires a balancing test, requires a balancing test, not an assessment of the reputation of the requestor.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">> </span>We’re here to do reasonable research and diligence.
<span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">> </span>Quashing such is not something we should be doing,
<span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">> </span>and I’m sure none of us are afraid of answers.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Not at all afraid of the answer; my problem is that I think the answer is obvious. Since our ability to pose questions to legal experts is limited and it’s quite likely that not all of them will get posed, I
believe this one doesn’t rise to the level. But if the team as a whole really wants to devote scarce time to this, I’ll not stand in the way.
</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1
1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Mueller, Milton L <<a href="mailto:milton@gatech.edu" moz-do-not-send="true">milton@gatech.edu</a>>
<br>
<b>Sent:</b> Monday, July 29, 2019 4:44 PM<br>
<b>To:</b> Greg Aaron <<a href="mailto:greg@illumintel.com" moz-do-not-send="true">greg@illumintel.com</a>>; 'Alan Greenberg' <<a href="mailto:alan.greenberg@mcgill.ca" moz-do-not-send="true">alan.greenberg@mcgill.ca</a>>; 'EPDP' <<a href="mailto:gnso-epdp-team@icann.org" moz-do-not-send="true">gnso-epdp-team@icann.org</a>><br>
<b>Subject:</b> RE: [Gnso-epdp-team] REVISED: Question for legal advisors<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">I find the discussions of this proposed question to be fundamentally detached from legal and practical reality.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Essentially, this question boils down to this: can we avoid doing a balancing test if someone we think we trust wants the data?
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">The answer to that should be obvious.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">If the law requires a balancing test, it doesn’t matter _who_ the person making the inquiry is. It doesn’t matter how “trustworthy” they are, now nicely they ask, how sweetly they smile, the point here is that
the interest of the requestor in obtaining the information must be weighed against the rights to privacy of the data subject. You cannot skirt that balancing test without breaking the law. Full stop.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">This question makes about as much sense as asking the data subject to unilaterally determine the outcome of the test. “Hey, if we have a data subject we think is good and trustworthy, can we automatically nix
any disclosure requests because we think they are good guys?” No, you can’t do that. Balancing test means a balancing test. One party’s interests are weighed against the other’s. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I hope we do not waste our scarce legal time with something like this.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Dr. Milton L Mueller<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">School of Public Policy <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Georgia Institute of Technology<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1
1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Gnso-epdp-team <<a href="mailto:gnso-epdp-team-bounces@icann.org" moz-do-not-send="true">gnso-epdp-team-bounces@icann.org</a>>
<b>On Behalf Of </b>Greg Aaron<br>
<b>Sent:</b> Monday, July 29, 2019 3:22 PM<br>
<b>To:</b> 'Alan Greenberg' <<a href="mailto:alan.greenberg@mcgill.ca" moz-do-not-send="true">alan.greenberg@mcgill.ca</a>>; 'EPDP' <<a href="mailto:gnso-epdp-team@icann.org" moz-do-not-send="true">gnso-epdp-team@icann.org</a>><br>
<b>Subject:</b> Re: [Gnso-epdp-team] REVISED: Question for legal advisors<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Dear Alan, Mark, legal team:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Yes, this issue is a vital one to ask the legal advisers, and we must make sure they understand the issue. An additional way to explain it is below. Feel free to adapt or include any of this suggested language below if you like.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><snip><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">6(f) says that processing is lawful if it "is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms
of the data subject." <o:p></o:p></p>
<p class="MsoNormal">This language describes a general requirement that must be met. It does not describe any specific decision-making process or the threshold that must be reached to satisfy the balancing test in any specific case.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Question: can a data controller rely on advice or assertions that come from a qualified and trusted party in order to satisfy 6(f)’s balancing test? If it is possible, then what are the considerations? If not, why?
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Example: a third party is trying to mitigate a phishing attack. This third party is the victim of the attack, or is defending its customers. GDPR Recital 49 says that processing personal data for such a purpose “constitutes a legitimate
interest of the data controller concerned.” The third party makes a data request to the controller. The third party is in some way accredited, its identity and subject matter expertise are known to the data controller, and the third party makes representations
about the legitimacy and accuracy of its request. Can the data processor rely on this information and relationship?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"></snip><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">(And I also assume what you wrote -- accreditation could be withdrawn, the requestor is following data minimization practices, etc. etc.)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">BTW, am hoping to move away from “security researcher” as a blanket term to include those involved in operational security, for some previously explained reasons.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">--Greg<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1
1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Gnso-epdp-team <<a href="mailto:gnso-epdp-team-bounces@icann.org" moz-do-not-send="true">gnso-epdp-team-bounces@icann.org</a>>
<b>On Behalf Of </b>Alan Greenberg<br>
<b>Sent:</b> Wednesday, July 24, 2019 11:18 PM<br>
<b>To:</b> EPDP <<a href="mailto:gnso-epdp-team@icann.org" moz-do-not-send="true">gnso-epdp-team@icann.org</a>><br>
<b>Subject:</b> [Gnso-epdp-team] REVISED: Question for legal advisors<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">At Mark's suggestion, I have reformatted/reworded this for additional (hopefully) clarity.<br>
<br>
==============<br>
<br>
<b><u>Background:<br>
<br>
</u></b>If information is to be requested released to third parties, the controller or other party(ies) must decide whether the need for the data outweighs the data subject's right to privacy.<br>
<br>
If the decision is made by a human, the competing needs/rights can be carefully weighed to decide whether the request should be honoured. If we are to consider any form of automated decision process, it is unlikely that we can build a sufficiently robust artificial
intelligence engine to carry out the balancing operation. That raises the question of to what extent, based on appropriate accreditation processes, can we rely on the vetting during accreditation and the commitments made by the requester in order to be accredited
can be relied upon.<br>
<br>
<b><u>Examples:<br>
<br>
</u></b>As a simple case, if a UDRP provider (who is authenticated as such) makes a request claiming it is for an ongoing UDRP process, can it be presumed that it is an authentic request and simply grant it.<br>
<br>
For a more nuanced situation, if a cyber security researcher who has been properly accredited (the Anti-Phishing WG as an example) makes a request for specific data, can we assume that given the process under which they are accredited, we can be assured that
they need this data, have no practical alternative way of addressing the issue, and will only use/store the data appropriately<br>
<br>
Perhaps other specific cases should be cited in the question, but we do need guidance in the general case.
<br>
<br>
<b><u>Summary:<br>
<br>
</u></b>Without being able to rely on the reputation and assurances of the requester, I do not see how ANY automated process will be possible.<br>
<br>
<b><u>Question:<br>
<br>
</u></b>If a requester is properly vetted (accredited, authenticated) and has provided assurances they understand they may only request data that meets the balance test (ie their need is sufficiently great that it warrants releasing to them otherwise redacted
data), can an automated system presume that the GDPR balancing test has been satisfied?<br>
<br>
Of course, accreditation could be revoked if it comes to light that inappropriate requests are being made.<br>
<br>
<br>
At 24/07/2019 04:27 PM, Alan Greenberg wrote:<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">As requested during the last meeting, here is a question to go to the Legal Committee looking for a clear legal opinion.<br>
<br>
===============================<br>
<br>
If information is to be requested released to third parties, the controller or other party(ies) must decide whether the need for the data outweighs the data subject's right to privacy.<br>
<br>
If the decision is made by a human, the competing needs/rights can be carefully weighed to decide whether the request should be honoured. If we are to consider any form of automated decision process, it is unlikely that we can build a sufficiently robust artificial
intelligence engine to carry out the balancing operation. That raises the question of to what extent, based on appropriate accreditation processes, can we rely on the vetting during accreditation and the commitments made by the requester in order to be accredited
can be relied upon.<br>
<br>
Specifically, if a requester is properly vetted and provides assurances (and proof?) they understand the balancing that must be done, can the automated system presume that the balancing test has been satisfied.<br>
<br>
Of course, accreditation could be revoked if it comes to light that inappropriate requests are being made.<br>
<br>
In one simple case, if a UDRP provider (who is authenticated as such) make a request claiming it is for an ongoing UDRP process, can it be presumed that it is an authentic request and simply grant it.<br>
<br>
A less clear case is that of a cyber security researcher who has been properly accredited (the Anti-Phishing WG as an example).<br>
<br>
Perhaps other specific cases should be cited in the question, but we do need guidance in the general case. Without being able to rely on the reputation and assurances of the requester, I do not see how ANY automated process will be possible.<br>
<br>
Alan<o:p></o:p></p>
</blockquote>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Gnso-epdp-team mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Gnso-epdp-team@icann.org" moz-do-not-send="true">Gnso-epdp-team@icann.org</a>
<a class="moz-txt-link-freetext" href="https://mm.icann.org/mailman/listinfo/gnso-epdp-team" moz-do-not-send="true">https://mm.icann.org/mailman/listinfo/gnso-epdp-team</a>
_______________________________________________
By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a class="moz-txt-link-freetext" href="https://www.icann.org/privacy/policy" moz-do-not-send="true">https://www.icann.org/privacy/policy</a>) and the website Terms of Service (<a class="moz-txt-link-freetext" href="https://www.icann.org/privacy/tos" moz-do-not-send="true">https://www.icann.org/privacy/tos</a>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.</pre>
</blockquote>
</div>
</body>
</html>