<html><head></head><body>Hi,<div class=""><br class=""/></div><div class="">I find the response helpful. In fact, I find it to be more helpful than I anticipated. This issue came up during the 21 May EPDP Team meeting, because there was an expression of doubt concerning the scope of ICANN’s mission and bylaws, and wether the policy recommendations being considered by the EPDP Team at this time may be found to be outside of that scope - specifically, the issue of enforcement of compliance with Consensus Policies on actors other than Contracted Parties.</div><div class=""><br class=""/></div><div class="">The way the questions were framed, there was an assumption that the SSAD would be adopted as a Consensus Policy, which pretty much negates this concern. So while the answers to the questions themselves are pretty straight forward and predictable, the additional context in Göran’s response is really what I believe we were hoping to hear back from him on. Much appreciated for this, as far as I’m concerned.</div><div class=""><br class=""/></div><div class="">Having said that, the lingering doubt remains on a potential scenario where, as Göran mentioned, the ICANN Board will consider:</div><div class=""><br class=""/></div><div class="">1. Wether the policy recommendations developed by the EPDP Team, and adopted by the GNSO Council, fall within the scope of ICANN’s mission and bylaws.</div><div class="">2. Wether the policy recommendations developed by the EPDP Team, and adopted by the GNSO Council, are in the best interests of the ICANN Community and ICANN.</div><div class=""><br class=""/></div><div class="">This is also hardly surprising. To that, I’d ask that the concerns raised by members of the EPDP Team last week not discourage our Board and ICANN Org liaisons from flagging such issues moving forward. The sooner we hear from them on potential concerns, the sooner we can address them. I would find that to be a more desirable outcome than having the Board decline to adopt GNSO Recommendations developed by the EPDP Team, and beginning a cycle of consultation with the GNSO Council.</div><div class=""><br class=""/></div><div class="">Of course, this may be unavoidable in the event of (for example) input to the public comment period during the Board’s process to consider the GNSO’s recommendation raises issues the Board may find troubling. In the meantime, I hope we can consider this response to mean that last week’s concerns have been addressed, and that enforcing compliance of policies concerning the SSAD, and its users use of the system, is indeed within scope of ICANN’s mission and bylaws.</div><div class=""><br class=""/></div><div class="">Thanks.</div><div class=""><br class=""/></div><div class="">Amr</div><div class=""><div><br class=""/><blockquote type="cite" class=""><div class="">On May 29, 2020, at 9:14 PM, Eleeza Agopian <<a href="mailto:eleeza.agopian@icann.org" class="">eleeza.agopian@icann.org</a>> wrote:</div><br class="Apple-interchange-newline"/><div class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: TrebuchetMS; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Dear Janis and EPDP team,<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">We are sending the below on behalf of Göran.<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thanks,<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Eleeza and Dan<o:p class=""></o:p></div><div style="border-style: none none solid; border-bottom-width: 1pt; border-bottom-color: windowtext; padding: 0in 0in 1pt;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; border: none; padding: 0in;" class="">ICANN org liaisons<o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Dear Janis,<span class="Apple-converted-space"> </span><span style="font-family: Arial, sans-serif;" class=""><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thank you for the questions you shared with me. Given the complexity of some of your questions, I have added some additional context beneath the answers to your questions. We hope the team finds this helpful.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thank you,<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Göran<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">------------<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><i class=""><span style="font-size: 12pt;" class="">If SSAD becomes an adopted consensus policy, would ICANN Org will perform the Accreditation Authority function?<o:p class=""></o:p></span></i></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><i class=""><span style="font-size: 12pt;" class="">If SSAD becomes an adopted consensus policy, would ICANN Org will perform the central Gateway function?<o:p class=""></o:p></span></i></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><i class=""><span style="font-size: 12pt;" class=""><o:p class=""> </o:p></span></i></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">Yes, if the Board adopts the EPDP Phase 2 team’s recommendations as consensus policy, ICANN org would implement the functions the Board directs the org to assume. In the<span class="Apple-converted-space"> </span></span><a href="http://mm.icann.org/pipermail/gnso-epdp-team/attachments/20200505/e87c2719/SSADCostEstimateDiscussionPaper-0001.pdf" style="color: rgb(5, 99, 193); text-decoration: underline;" class=""><span style="font-size: 12pt; color: rgb(17, 85, 204);" class="">cost estimate document</span></a><span style="font-size: 12pt;" class=""><span class="Apple-converted-space"> </span>we recently shared with the EPDP, ICANN org indicated in its assumption that it would outsource these functions to a third party.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><i class=""><span style="font-size: 12pt;" class="">If SSAD becomes an adopted consensus policy, would ICANN Org enforce compliance of SSAD users and involved parties with its consensus policy?<o:p class=""></o:p></span></i></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: Arial, sans-serif;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">ICANN is prepared to enforce all consensus policies that are adopted by the ICANN Board. It is important to note that the SSAD recommendations contain requirements for gTLD registries and registrars, which would be enforced through the standard Contractual Compliance process. The SSAD recommendations also include other policies and requirements for other parties, including SSAD requestors. For each of these policies and requirements, the enforcement mechanisms would vary depending on the party. <span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><i class=""><span style="font-size: 12pt;" class="">Additionally, could ICANN Org please confirm the EPDP Team’s assumption that ICANN Org and Contracted Parties are joint controllers regarding disclosure of registration data through the SSAD?<o:p class=""></o:p></span></i></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><i class=""><span style="font-size: 12pt;" class=""><o:p class=""> </o:p></span></i></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">ICANN org acknowledges that this is the EPDP Team’s assumption at this stage. We also note Bird & Bird’s<span class="Apple-converted-space"> </span><a href="https://community.icann.org/download/attachments/117604842/ICANN-EPDP%20-%20Qs%201%20%26%202%20-%209th%20September%202019%5B2%5D.pdf?version=2&modificationDate=1568143518000&api=v2" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">Phase 2 “Liability” memo to the EPDP Team (9 September 2019)</a>, which stated that “the most likely outcome – and certainly most supervisory authorities’ starting position – is that CPs are controllers – and, given ICANN's role in determining purposes and means of processing, that they will be joint controllers with ICANN org in respect of their disclosure of Registration Data to Requesters via a SSAD.” Once the recommendations are finalized by the EPDP Team, approved by the GNSO Council, and adopted by the Board, this issue will be addressed during the implementation process.<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt; background-color: yellow; background-position: initial initial; background-repeat: initial initial;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">To implement the EPDP Team’s recommendations, ICANN org will determine, in consultation with the Implementation Review Team, what data protection arrangements will be required. This will include evaluating what processing of personal data is contemplated by the recommendations, and applying a step-by-step evaluation process to analyze each processing operation contemplated under the EPDP Team’s recommendations. At that stage, we will assess who controls what processing, and with whom, and enter into the necessary arrangements to account for this. This is not a matter of preference or contractual designation by the parties, but must be determined by applying the law to the facts presented for each distinct processing operation. (Ultimately, a data protection authority or a court would have the final say in how controllership provisions apply.) Given that this determination is so fact-specific and the SSAD model is not yet final, it is currently not possible to confirm the EPDP’s assumption of joint controllership in this context. <span class="Apple-converted-space"> </span><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">------------</span><span style="font-family: Arial, sans-serif; background-color: yellow; background-position: initial initial; background-repeat: initial initial;" class=""><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><i class=""><o:p class=""> </o:p></i></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><i class="">Additional context from ICANN org:</i><span class="Apple-converted-space"> </span>It’s important to emphasize that ICANN org considers the development of an SSAD to be within ICANN’s remit, as is the enforcement of GNSO consensus policies adopted by the ICANN Board, including policies related to gTLD registration data. ICANN’s<span class="Apple-converted-space"> </span><a href="https://www.icann.org/resources/pages/governance/bylaws-en/#article1" style="color: rgb(5, 99, 193); text-decoration: underline;" class=""><span style="color: rgb(17, 85, 204);" class="">Bylaws</span></a><span class="Apple-converted-space"> </span>recognize that ICANN coordinates the development and implementation of policies concerning the registration of second-level domain names in gTLDs. (See ICANN Bylaws, Section 1.1.) This includes policies, as outlined in Annex G-1 and Annex G-2 to the Bylaws, concerning issues for which uniform or coordinated resolution is reasonably necessary to facilitate interoperability, security and/or stability of the internet, registrar services, registry services, or the domain name system. (See ICANN Bylaws, Annex G-1) An example of this would be a policy addressing maintenance of and access to accurate and up-to-date information concerning registered names and name servers. ICANN org believes that implementation and enforcement of a policy for an SSAD would fall within this scope.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">The Board has previously recognized the critical nature of this work. The Board anticipated this effort in the Temporary Specification, under<span class="Apple-converted-space"> </span><a href="https://www.icann.org/resources/pages/gtld-registration-data-specs-en/#annex" style="color: rgb(5, 99, 193); text-decoration: underline;" class=""><span style="color: rgb(17, 85, 204);" class="">Annex: Important Issues for Further Community Action</span></a>, where it notes at 1: “continuing community work to develop an accreditation and access model that complies with GDPR, while recognizing the need to obtain additional guidance from Article 29 Working Party/European Data Protection Board.” Further, the EPDP’s own<span class="Apple-converted-space"> </span><a href="https://gnso.icann.org/sites/default/files/file/field-file-attach/temp-spec-gtld-rd-epdp-19jul18-en.pdf" style="color: rgb(5, 99, 193); text-decoration: underline;" class=""><span style="color: rgb(17, 85, 204);" class="">charter</span></a>, which was approved by the GNSO Council, clearly indicates that the development of policy recommendations for a System for Standardized Access to Non-Public Registration Data is within the remit of the EPDP.<span style="background-color: yellow; background-position: initial initial; background-repeat: initial initial;" class=""><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">When considering GNSO consensus policies for adoption, the ICANN Board will consider whether the recommendations themselves fall within the scope of ICANN’s Mission and Bylaws. As noted above, the concept of an SSAD seems to fit within this scope. Any EPDP recommendations approved by a GNSO Supermajority Vote shall be adopted by the Board unless, by a vote of more than two-thirds of the Board, the Board determines that such policy is not in the best interests of the ICANN community or ICANN. (See ICANN Bylaws, Annex A-1, Section 6). If the recommendation was approved by less than a GNSO Supermajority Vote, the majority vote of the Board would be sufficient to determine that such policy is not in the best interests of the ICANN community or ICANN. Any non-approval by the Board would trigger a consultation between the GNSO Council and the Board, which occurred with respect to a subset of the EPDP Phase 1 Team’s recommendations. The ICANN org and Board liaisons have endeavored during this EPDP to provide the team members with implementation-related and other guidance as the team has deliberated recommendations.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0in 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class=""><span style="font-size: 12pt;" class="">From:<span class="Apple-converted-space"> </span></span></b><span style="font-size: 12pt;" class="">Gnso-epdp-team <<a href="mailto:gnso-epdp-team-bounces@icann.org" class="">gnso-epdp-team-bounces@icann.org</a>> on behalf of Janis Karklins <<a href="mailto:karklinsj@gmail.com" class="">karklinsj@gmail.com</a>><br class=""/><b class="">Date:<span class="Apple-converted-space"> </span></b>Thursday, May 21, 2020 at 11:22 AM<br class=""/><b class="">To:<span class="Apple-converted-space"> </span></b>Goran Marby <<a href="mailto:goran.marby@icann.org" class="">goran.marby@icann.org</a>>, EPDP <<a href="mailto:gnso-epdp-team@icann.org" class="">gnso-epdp-team@icann.org</a>><br class=""/><b class="">Cc:<span class="Apple-converted-space"> </span></b>"<a href="mailto:gnso-epdp-lead@icann.org" class="">gnso-epdp-lead@icann.org</a>" <<a href="mailto:gnso-epdp-lead@icann.org" class="">gnso-epdp-lead@icann.org</a>><br class=""/><b class="">Subject:<span class="Apple-converted-space"> </span></b>[Gnso-epdp-team] Questions for clarification<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">Dear Goran,<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class=""> <o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">During recent meetings the EPDP Team has been examining public comments received on its Initial Report. Recommendations in the Initial Report are based on certain assumptions. For instance, the EPDP Team has been working under the assumption that ICANN Org (or its designee) would be the Accreditation Authority, and, accordingly, would be responsible for enforcing accredited SSAD users’ compliance with the Accreditation Policy, Acceptable Use Policy, etc. In addition, it is assumed that ICANN Org would perform the Central Gateway function.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class=""> <o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">Today’s discussion revealed that the Team’s assumptions may not be entirely correct. It was suggested that ICANN Org may have concerns regarding, for example, how this enforcement responsibility fits within its Mission and Bylaws as it is not yet clear how the contractual relationships would be structured between the Central Gateway Manager and accredited users, noting ICANN Org enforcement currently only occurs between ICANN Org and Contracted Parties where a direct contractual relationship exists.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class=""> <o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">It was also suggested that communication with ICANN Org would be useful to confirm all assumptions the Final report will be based on. In light of this, could ICANN Org please provide clarifications on the following questions:<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">If SSAD becomes an adopted consensus policy, would ICANN Org will perform the Accreditation Authority function?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">If SSAD becomes an adopted consensus policy, would ICANN Org will perform the central Gateway function?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">If SSAD becomes an adopted consensus policy, would ICANN Org enforces compliance of SSAD users and involved parties with its consensus policy?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class=""> <o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">Additionally, could ICANN Org please confirm the EPDP Team’s assumption that ICANN Org and<span style="" class="">Contracted Parties are joint controllers regarding disclosure of registration data through the SSAD?</span><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class=""> </span><span style="font-size: 12pt;" class=""><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">As the EPDP Team needs further information to prepare its final recommendations, we would appreciate answers, if possible, by<span class="Apple-converted-space"> </span><b class="">Friday, May 29</b>. Thank you in advance.</span><span style="font-size: 12pt;" class=""><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class=""> </span><span style="font-size: 12pt;" class=""><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">Best regards</span><span style="font-size: 12pt;" class=""><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">JK</span></div></div></div></div></blockquote></div><br class=""/></div></body></html>