<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:206454626;
mso-list-template-ids:-2104326632;}
@list l1
{mso-list-id:1654606217;
mso-list-template-ids:-2085979304;}
@list l1:level1
{mso-level-start-at:2;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:11.0pt;
mso-bidi-font-size:11.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;color:black'>Dear EPDP Team,<o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'>During the upcoming EPDP Team meeting, León will present the questions the Legal Committee has thus far agreed to send to outside counsel. As a reminder, the Legal Committee has been reviewing draft legal questions related to an SSAD that were submitted by members of the EPDP Team.<o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'>Please note the Legal Committee is still in the process of reviewing several questions, including an anchor question related to contracted party liability. The text of the additional questions will be forthcoming.<o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'>The below text has been reviewed, edited, and agreed to by a representative group of EPDP Team Members, and, as such, EPDP Leadership would ask the EPDP Team to review the questions with a level of deference and apply the “cannot live with” standard when reviewing the below text.<span class=apple-converted-space> </span><o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'>Thank you.<span class=apple-converted-space> </span><o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'>Best regards,<o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'>Marika, Berry, and Caitlin<o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'>--<o:p></o:p></span></p><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p class=MsoListParagraph style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='color:black'><span style='mso-list:Ignore'>1.<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>To what extent, if any, are contracted parties liable when a third party that accesses non-public WHOIS data under an accreditation scheme where by the accessor is accredited for the stated purpose, commits to certain reasonable safeguards similar to a code of conduct regarding use of the data, but misrepresents their intended purposes for processing such data, and subsequently processes it in a manner inconsistent with the stated purpose. Under such circumstances, if there is possibility of liability to contracted parties, are there steps that can be taken to mitigate or reduce the risk of liability to the contracted parties?<o:p></o:p></span></p><p class=MsoListParagraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px'><span style='color:black'> <o:p></o:p></span></p><p class=MsoListParagraph style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;text-indent:-.25in;mso-list:l1 level1 lfo2'><![if !supportLists]><span style='color:black'><span style='mso-list:Ignore'>2.<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:black'>Assuming that there is a policy that allows accredited parties to access non-public WHOIS data through an SSAD (and requires the accredited party to commit to certain reasonable safeguards similar to a code of conduct), is it legally permissible under Article 6(1)(f) to:<o:p></o:p></span></p><p class=MsoNormal style='font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px'><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p class=MsoListParagraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.75in;margin-bottom:.0001pt;text-indent:-.25in;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'>·</span><span style='font-family:"Times New Roman",serif;color:black'> <span class=apple-converted-space> </span></span><span style='color:black'>define specific categories of requests from accredited parties (e.g. rapid response to a malware attack or contacting a non-responsive IP infringer), for which there can be automated submissions for non-public WHOIS data, without having to manually verify the qualifications of the accredited parties for each individual disclosure request, and/or<o:p></o:p></span></p><p class=MsoListParagraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.75in;margin-bottom:.0001pt;text-indent:-.25in;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'>·</span><span style='font-family:"Times New Roman",serif;color:black'> <span class=apple-converted-space> </span></span><span style='color:black'>enable automated disclosures of such data, without requiring a manual review by the controller or processor of each individual disclosure request.<o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in;font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px'><span style='font-size:11.0pt;color:black'>In addition, if it is not possible to automate any of these steps, please provide any guidance for how to perform the balancing test under Article 6(1)(f).<o:p></o:p></span></p><p class=MsoNormal style='font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px'><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p class=MsoNormal style='margin-left:.25in;font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px'><span style='font-size:11.0pt;color:black'>For reference, please refer to the following potential safeguards:<o:p></o:p></span></p><p class=MsoNormal style='margin-left:.25in;font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px'><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p class=MsoListParagraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.75in;margin-bottom:.0001pt;text-indent:-.25in;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'>·</span><span style='font-family:"Times New Roman",serif;color:black'> <span class=apple-converted-space> </span></span><span style='color:black'>Disclosure is required under CP’s contract with ICANN (resulting from Phase 2 EPDP policy).<o:p></o:p></span></p><p class=MsoListParagraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.75in;margin-bottom:.0001pt;text-indent:-.25in;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'>·</span><span style='font-family:"Times New Roman",serif;color:black'> <span class=apple-converted-space> </span></span><span style='color:black'>CP’s contract with ICANN requires CP to notify the data subject of the purposes for which, and types of entities by which, personal data may be processed. CP is required to notify data subject of this with the opportunity to opt out before the data subject enters into the registration agreement with the CP, and again annually via the ICANN-required registration data accuracy reminder. CP has done so.<o:p></o:p></span></p><p class=MsoListParagraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.75in;margin-bottom:.0001pt;text-indent:-.25in;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'>·</span><span style='font-family:"Times New Roman",serif;color:black'> <span class=apple-converted-space> </span></span><span style='color:black'>ICANN or its designee has validated the requestor’s identity, and required that the requestor:<o:p></o:p></span></p><p class=MsoListParagraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:1.5in;margin-bottom:.0001pt;text-indent:-.25in;font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px'><span style='color:black'>o <span class=apple-converted-space> </span>represents that it has a lawful basis for requesting and processing the data,<o:p></o:p></span></p><p class=MsoListParagraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:1.5in;margin-bottom:.0001pt;text-indent:-.25in;font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px'><span style='color:black'>o <span class=apple-converted-space> </span>provides its lawful basis,<o:p></o:p></span></p><p class=MsoListParagraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:1.5in;margin-bottom:.0001pt;text-indent:-.25in;font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px'><span style='color:black'>o <span class=apple-converted-space> </span>represents that it is requesting only the data necessary for its purpose,<o:p></o:p></span></p><p class=MsoListParagraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:1.5in;margin-bottom:.0001pt;text-indent:-.25in;font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px'><span style='color:black'>o <span class=apple-converted-space> </span>agrees to process the data in accordance with GDPR, and<o:p></o:p></span></p><p class=MsoListParagraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:1.5in;margin-bottom:.0001pt;text-indent:-.25in;font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px'><span style='color:black'>o <span class=apple-converted-space> </span>agrees to standard contractual clauses for the data transfer.<o:p></o:p></span></p><p class=MsoListParagraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.75in;margin-bottom:.0001pt;text-indent:-.25in;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='color:black'>·</span><span style='font-family:"Times New Roman",serif;color:black'> <span class=apple-converted-space> </span></span><span style='color:black'>ICANN or its designee logs requests for non-public registration data, regularly audits these logs, takes compliance action against suspected abuse, and makes these logs available upon request by the data subject.<o:p></o:p></span></p><p class=MsoListParagraph style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:0in;margin-left:.75in;margin-bottom:.0001pt;font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px'><span style='color:black'> <o:p></o:p></span></p><ol start=3 type=1><li class=MsoListParagraph style='color:black;mso-list:l1 level1 lfo2'>In light of the <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_system_files_correspondence_odonohue-2Dto-2Dmarby-2D03may19-2Den.pdf&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=8K75qGdDlOta4kh6k2F0jrT195M3tF3J_Fxcz6EvuG2kYKDeA67ZTEnthHXAPVXH&m=2pdsBq3FQk-Nkb8vTkUe9hbbsKYG04wNdq9eoO57uok&s=LfTW_4f8-ycgWqCWGXRxfToxSMw6x9oh4ovjg-D2fYw&e=" title="https://www.icann.org/en/system/files/correspondence/odonohue-to-marby-03may19-en.pdf"><span style='color:#954F72'>3 May 2019 correspondence from the European Commission</span><span class=apple-converted-space><span style='color:#954F72;text-decoration:none'> </span></span><span style='color:#954F72'>[icann.org]</span></a>, are any updates on the <a href="https://community.icann.org/download/attachments/102138857/6%281%29%28b%29%20Memo.docx?version=1&modificationDate=1548874809000&api=v2"><span style='color:#954F72'>previous memo on 6(1)(b)</span></a> necessary? <o:p></o:p></li></ol><p class=MsoNormal style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:11.0pt;color:black'> <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p></div></body></html>