<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hi Volker, <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m sympathetic to the challenges involved in determining whether data is subject to data protection/privacy law (and which one(s) might apply), and totally get that’s part of why the EPDP Phase 1 decided not to make the distinction mandatory
for publication/redaction. (not saying I agree with the outcome, but I understand)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We can discuss secondary liability in more detail online if you’d like. To try to boil down my point, consider a registrar who has profited financially from the registration of a domain name which is being used in a trademark counterfeiting
scheme. Also consider that the registrar is on notice of the conduct (civil and/or criminal, depending on the jurisdiction) because the registrar has received a request for redacted WHOIS data. As a court would see it, this registrar has knowledge of wrongdoing,
is profiting from the wrongdoing, is in a position both technically and legally (registration agreement prohibits unlawful use of the domain) to stop the wrongdoing, possesses information about the wrongdoer, and chooses neither to stop the wrongdoing nor
provide information about the wrongdoer to the owner of the IP being infringed. This is a recipe for secondary liability.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span lang="EN-GB" style="font-size:10.0pt;color:black">Brian J. King
</span></b><span lang="EN-GB" style="font-size:10.0pt;color:black"> <br>
Director of Internet Policy and Industry Affairs<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;color:black">T +1 443 761 3726</span><u><span style="font-size:10.0pt;color:#0563C1"><a href="http://www.markmonitor.com"><span lang="EN-GB" style="color:#0563C1"><br>
</span><span style="color:#0563C1">markmonitor.com</span></a></span></u><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span lang="EN-GB" style="font-size:10.0pt;color:black">MarkMonitor<br>
</span></b><span lang="EN-GB" style="font-size:10.0pt;color:black">Protecting companies and consumers in a digital world<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>From:</b> Volker Greimann <vgreimann@key-systems.net> <br>
<b>Sent:</b> Friday, August 30, 2019 9:01 AM<br>
<b>To:</b> King, Brian <Brian.King@markmonitor.com><br>
<b>Cc:</b> farzaneh badii <farzaneh.badii@gmail.com>; GNSO EPDP <gnso-epdp-team@icann.org><br>
<b>Subject:</b> Re: [Gnso-epdp-team] Zero-Draft Doc- Assessment of the data being requested<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">That seems a bit of an extreme interpretation. We agreed not to make no differentiation based on geo for the smple fact that anything else would be an administrative nightmare.
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">There are so many variables why a set of data may be protected under the GDPR (and comparable regulations) that it seemed unfeasible to design a system that made such differentiations.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Consider the following scenarios triggering protection just under GDPR:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">-Registrar in EU<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">-Reseller in EU<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">-Registry in EU<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">-Reseller of reseller (whom we usually do not know) in the EU<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">-Registrant in EU <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">-Other Contact in EU<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">-Registrar outside the EU, but processing in the EU (For example using a Registrar backend service)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">-Registry outside the EU, but processing in the EU (For example using a Registry backend service)
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">-Registrar outside the EU, Reseller outside the EU but reseller processing in the EU<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">and many many more.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Having to look at each data set like this individually is simply not feasible for a contracted party, hence the decision (and need) to simply treat all data as protected.
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">And while I hate to contradict you Brian, the potentially problematic part is never the act of withholding, and always the act of disclosing, at least from a liability perspective.<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal">-- <br>
Volker A. Greimann<br>
General Counsel and Policy Manager<br>
<b>KEY-SYSTEMS GMBH</b><br>
<br>
T: +49 6894 9396901<br>
M: +49 6894 9396851<br>
F: +49 6894 9396851<br>
W: <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__www.key-2Dsystems.net_&d=DwMFaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=mIbt2RoiILHHK37EfokIxn4z4vBCeV5APNQsbr36nLo&s=MGBd0Y5i3nkyIsuMtHaKyQOXRY9rGZ81iotiZFFNGzc&e=" target="_blank"><span style="color:#1155CC">www.key-systems.net</span></a><br>
<br>
Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835<br>
CEO: Alexander Siffrin<br>
<br>
Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.<o:p></o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div id="DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2">
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="1" cellpadding="0" style="border:none;border-top:solid #D3D4DE 1.0pt">
<tbody>
<tr>
<td width="55" style="width:41.25pt;border:none;padding:9.75pt .75pt .75pt .75pt">
<p class="MsoNormal"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.avast.com_sig-2Demail-3Futm-5Fmedium-3Demail-26utm-5Fsource-3Dlink-26utm-5Fcampaign-3Dsig-2Demail-26utm-5Fcontent-3Dwebmail&d=DwMFaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=mIbt2RoiILHHK37EfokIxn4z4vBCeV5APNQsbr36nLo&s=p1GU0pWfm0l3-U4_u3R4Viu8-wrHhAsAUsZR1g7ONFA&e=" target="_blank"><span style="border:solid windowtext 1.0pt;padding:0in;text-decoration:none"><img border="0" width="46" height="29" style="width:.4791in;height:.302in" id="_x0000_i1025" src="cid:image001.jpg@01D55F1E.C3AD4DB0" alt="Image removed by sender."></span></a><o:p></o:p></p>
</td>
<td width="470" style="width:352.5pt;border:none;padding:9.0pt .75pt .75pt .75pt">
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#41424E">Virus-free.
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.avast.com_sig-2Demail-3Futm-5Fmedium-3Demail-26utm-5Fsource-3Dlink-26utm-5Fcampaign-3Dsig-2Demail-26utm-5Fcontent-3Dwebmail&d=DwMFaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=mIbt2RoiILHHK37EfokIxn4z4vBCeV5APNQsbr36nLo&s=p1GU0pWfm0l3-U4_u3R4Viu8-wrHhAsAUsZR1g7ONFA&e=" target="_blank">
<span style="color:#4453EA">www.avast.com</span></a> <o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Fri, Aug 30, 2019 at 1:56 PM King, Brian via Gnso-epdp-team <<a href="mailto:gnso-epdp-team@icann.org">gnso-epdp-team@icann.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">Hi Farzaneh, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">That’s not quite right. We decided that CPs could differentiate in the context of publication/redaction, not in the context of SSAD. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">In the SSAD context, the act of withholding data when someone needs it, without a legal basis for withholding it (i.e. application of privacy law), would be legally problematic for the entity withholding access. In this case, withholding
the data could make the controller secondarily liable for the bad actor’s conduct.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">So, the data must be disclosed unless there’s a legal basis for withholding it. For legal persons and natural persons not covered by data privacy law, there is no legal basis for withholding the data, and there
should be no balancing test. <o:p></o:p></p>
<div id="gmail-m_2393422508796001018AppleMailSignature">
<p class="MsoNormal">Brian J. King <o:p></o:p></p>
<div>
<p class="MsoNormal">Director of Internet Policy and Industry Affairs<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">MarkMonitor / Part of Clarivate Analytics<o:p></o:p></p>
<div>
<p class="MsoNormal">Phone: +1 (443) 761-3726<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><a href="mailto:brian.king@markmonitor.com" target="_blank">brian.king@markmonitor.com</a><o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
On Aug 30, 2019, at 7:22 AM, farzaneh badii <<a href="mailto:farzaneh.badii@gmail.com" target="_blank">farzaneh.badii@gmail.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif">I don't know if this has been flagged and I know that the zero draft is frozen for now but I believe the diagram about the assessment of the data requested Step 2, is not correct. It says that
if the data is non-EEA data may be released with no balancing test performed. In phase one we agreed that the contracted parties can make geo diff if they want. The ones that do not do geo diff should definitely follow the disclosure policy we are coming up
with and perform the balancing test regardless of EEA or non-EEA data. I don't think they should just release the data. As we argued, ICANN's policies are global. If disclosure is global, data protection has to be global too. <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif">Farzaneh </span>
<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><epdp-p2_swimlane_v0.2.2.pdf><o:p></o:p></p>
</div>
</blockquote>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">_______________________________________________<br>
Gnso-epdp-team mailing list<br>
<a href="mailto:Gnso-epdp-team@icann.org" target="_blank">Gnso-epdp-team@icann.org</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__mm.icann.org_mailman_listinfo_gnso-2Depdp-2Dteam&d=DwICAg&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=YDnfsCS-C6PX-k9KBPaWdGMlomR5c6Qzl9pKeq21yqk&s=21TqJSMQV0kHuTo9rha44EVs9jCy7uBr8L8cveIHb6c&e=" target="_blank">https://urldefense.proofpoint.com/v2/url?u=https-3A__mm.icann.org_mailman_listinfo_gnso-2Depdp-2Dteam&d=DwICAg&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=YDnfsCS-C6PX-k9KBPaWdGMlomR5c6Qzl9pKeq21yqk&s=21TqJSMQV0kHuTo9rha44EVs9jCy7uBr8L8cveIHb6c&e=</a>
<br>
_______________________________________________<br>
By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_policy&d=DwICAg&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=YDnfsCS-C6PX-k9KBPaWdGMlomR5c6Qzl9pKeq21yqk&s=VeFjG9M5NbXD9OqeCXKleOaEpa6_jMxj3EseaMJ5H2U&e=" target="_blank">https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_policy&d=DwICAg&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=YDnfsCS-C6PX-k9KBPaWdGMlomR5c6Qzl9pKeq21yqk&s=VeFjG9M5NbXD9OqeCXKleOaEpa6_jMxj3EseaMJ5H2U&e=</a>
) and the website Terms of Service (<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_tos&d=DwICAg&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=YDnfsCS-C6PX-k9KBPaWdGMlomR5c6Qzl9pKeq21yqk&s=7E_OKnno3mhFtTwXIwua0a8Qwg3_dmrXTO150Q4GL8Y&e=" target="_blank">https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_tos&d=DwICAg&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=YDnfsCS-C6PX-k9KBPaWdGMlomR5c6Qzl9pKeq21yqk&s=7E_OKnno3mhFtTwXIwua0a8Qwg3_dmrXTO150Q4GL8Y&e=</a>
). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.<o:p></o:p></p>
</div>
</blockquote>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Gnso-epdp-team mailing list<br>
<a href="mailto:Gnso-epdp-team@icann.org" target="_blank">Gnso-epdp-team@icann.org</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__mm.icann.org_mailman_listinfo_gnso-2Depdp-2Dteam&d=DwMFaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=mIbt2RoiILHHK37EfokIxn4z4vBCeV5APNQsbr36nLo&s=AqQdcpqmUEkLQTX-SFC03YY-slUMy9CSflI75Z4niCA&e=" target="_blank">https://mm.icann.org/mailman/listinfo/gnso-epdp-team</a><br>
_______________________________________________<br>
By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_policy&d=DwMFaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=mIbt2RoiILHHK37EfokIxn4z4vBCeV5APNQsbr36nLo&s=7ZPj8A98GQugu-8zY3qLhJuPrJsu9OzwGeocgTvoNxA&e=" target="_blank">https://www.icann.org/privacy/policy</a>)
and the website Terms of Service (<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_tos&d=DwMFaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=mIbt2RoiILHHK37EfokIxn4z4vBCeV5APNQsbr36nLo&s=Ch4dzCpEfRFCwrYj2AAKzPvty4XMUVpJd1pELLckxYM&e=" target="_blank">https://www.icann.org/privacy/tos</a>).
You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.<o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>