<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">Hi guys! I don’t know why I am receiving this mails but I am not sure if I should be getting them. Just bringing it to your attention. <div><br></div><div>Cheers!</div><div><br></div><div>León <br><br><div dir="ltr">Enviado desde mi iPhone</div><div dir="ltr"><br><blockquote type="cite">El oct. 9, 2019, a la(s) 1:53 p. m., James M. Bladel <jbladel@godaddy.com> escribió:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Helvetica Neue";
panose-1:2 0 5 3 0 0 0 2 0 4;}
@font-face
{font-family:"Helvetica Neue Light";
panose-1:2 0 4 3 0 0 0 2 0 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 2 6 3 5 4 5 2 3 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Helvetica Neue";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Helvetica Neue"">Not sure about everyone, but I plan to read (after lunch, of course) and maybe tee up some question for Amr during our call tomorrow.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Helvetica Neue""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Helvetica Neue"">J.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Helvetica Neue""><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica Neue Light"">-------------<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-family:"Helvetica Neue Light";color:#00B050">James Bladel<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-family:"Helvetica Neue Light"">GoDaddy</span><span style="font-size:12.0pt;font-family:"Helvetica Neue Light""><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Helvetica Neue""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Helvetica Neue""><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of Margie Milam <margiemilam@fb.com><br>
<b>Date: </b>Wednesday, October 9, 2019 at 13:37<br>
<b>To: </b>"Mark Svancarek (CELA) via Gnso-epdp-team" <gnso-epdp-team@icann.org>, "King, Brian" <Brian.King@markmonitor.com>, "alexATcolevalleyconsulting.com" <alex@colevalleyconsulting.com>, "sdelbiancoATnetchoice.org" <sdelbianco@netchoice.org>, Jennifer
Gore <Jennifer@winterfeldt.law><br>
<b>Subject: </b>[Gnso-epdp-team] FW: Updated Language Regarding Purposes<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div style="border:none;border-left:solid #A6A6A6 4.5pt;padding:0in 0in 0in 14.0pt">
<p class="MsoNormal" style="background:#EBEBEB"><span style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:black">Notice:</span><span style="color:black">
</span><span style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:black">This email is from an external sender.
</span><o:p></o:p></p>
</div>
<p> <o:p></o:p></p>
<div>
<p class="MsoNormal">Ugh—suggestions for dealing with this?<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Amr Elsadr <aelsadr@icannpolicy.ninja><br>
<b>Reply-To: </b>Amr Elsadr <aelsadr@icannpolicy.ninja><br>
<b>Date: </b>Wednesday, October 9, 2019 at 4:34 AM<br>
<b>To: </b>Margie Milam <margiemilam@fb.com><br>
<b>Subject: </b>Re: Updated Language Regarding Purposes</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<p class="MsoNormal">Hi Margie, <o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks for this. I’m still having trouble with the reference to Article 5.1.b, and its applicability here. The ICO guidance on the purpose limitation principle has only reinforced this (<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__ico.org.uk_for-2Dorganisations_guide-2Dto-2Ddata-2Dprotection_guide-2Dto-2Dthe-2Dgeneral-2Ddata-2Dprotection-2Dregulation-2Dgdpr_principles_purpose-2Dlimitation_&d=DwMGaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8&m=P8kQ3-cLXhICChBb4qTjEHvguZpoj0OFN7pjdIfsH6Y&s=Td_uk-yaqqcmbo600dsEJnKGVuVC7WiAsX-Kk43iavg&e=">https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/purpose-limitation/</a>).
The explanation of what the principle is, as well as the checklist associated with it all indicate to me that it is applicable to the Data Controller, not a 3rd party/Requestor for disclosure/access.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">My thinking is that if we are to proceed as you have suggested in your email below, the process needs to loop in the Data Controller, somehow. Some reasons why this might be necessary:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">1. It shouldn’t be up to the 3rd party to determine what additional purposes are or are not compatible. Ultimately, the Data Controller and Processor will be held accountable by the data subject, and possibly liable by a DPA for errors
in judgment on this, so should be looped in.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2. If the Controller is not (at a minimum) informed of additional purposes for which the personal data will be processed, I’m not sure how the Controller will track and keep records of how the data that was disclosed will be or was processed.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">3. If the Data Subject requests access to a report on how its personal data has been processed, it would need to make this request to the Controller with which it is familiar (likely the registrar). If the Controller is not involved in
the decision to process the personal data for additional compatible purposes, it will not be in a position to provide the Data Subject with a complete report on how the data was, or is being, processed, at least not until (or if) an audit is conducted.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">So let’s say there is a scenario where a Requestor has been granted disclosure/access to the personal data for a specific purpose, then discovers that there is(are) additional purpose(s) for which the personal data needs to be processed
further. This could be for compatible purposes, or other unrelated ones (but still fulfilling the requirements of a legitimate interest of the Requestor and supported by a legal basis).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">It’d make sense to me, that in this kind of scenario, some follow-up to the original request for disclosure be available where the Requestor communicates the need for further processing in the SSAD, and that there is some need for the Controller
to make a decision on wether to grant permission for this additional processing.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Also, since this would be a follow-up to a previously approved disclosure request, it might make sense that the follow-up is flagged for a quicker response time of the request for additional processing of the personal data for additional
purposes (compatible or unrelated). This could possibly be reflected in Building Blocks G and K?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I know this adds an administrative layer, and slightly slows things down, but it provides more certainty in the process as a whole, doesn’t it? I believe it would be necessary in order to protect the rights of all parties involved, as well
as provide the transparency in processing that you referred to in your proposed amendment to subsection C of Building Block D.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">If you agree with any of this, in principle, we can try some wordsmithing of the proposed amendment. If you have concerns, let’s try to address them first.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks again, Margie.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Amr<o:p></o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Oct 8, 2019, at 6:53 PM, Margie Milam <<a href="mailto:margiemilam@fb.com">margiemilam@fb.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal">Hi Amr –<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Following up on today’s homework – here’s a link to information from the UK Information Office that can help guide the drafting of this section:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__ico.org.uk_for-2Dorganisations_guide-2Dto-2Ddata-2Dprotection_guide-2Dto-2Dthe-2Dgeneral-2Ddata-2Dprotection-2Dregulation-2Dgdpr_principles_purpose-2Dlimitation_&d=DwMGaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8&m=P8kQ3-cLXhICChBb4qTjEHvguZpoj0OFN7pjdIfsH6Y&s=Td_uk-yaqqcmbo600dsEJnKGVuVC7WiAsX-Kk43iavg&e="><span style="color:#954F72">https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/purpose-limitation/</span></a></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Here’s what I suggest:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">The building block should use this language:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">“not incompatible with the original purpose, provided the new purpose is fair, lawful and transparent.”<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">The policy recommendation would also need to include specific disclosures to the registrant, describing the common purposes for 3<sup>rd</sup><span class="apple-converted-space"> </span>party access, so that the transparency requirement
is met.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Margie<o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
</div>
<span>_______________________________________________</span><br><span>Gnso-epdp-team mailing list</span><br><span>Gnso-epdp-team@icann.org</span><br><span>https://mm.icann.org/mailman/listinfo/gnso-epdp-team</span><br><span>_______________________________________________</span><br><span>By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.</span></div></blockquote></div></body></html>