<html><head></head><body>Hi,<div class=""><br class=""/></div><div class="">I don’t think we’ve discussed it enough, and am not sure what the relevance of adding the reference. Regulated entities can use the SSAD, same as anyone else, will require a legitimate interest just like any other SSAD user, and the CPs being asked to disclose data will need a legal basis to disclose registration data to the regulated entity, just like they would with any other SSAD user.</div><div class=""><br class=""/></div><div class="">If all that is being sought is an example of regulation making entities regulated, would (just for the sake of argument) it be ok to replace the NIS with HIPAA?</div><div class=""><br class=""/></div><div class="">The thing is, it isn’t clear to us how the footnote <b class=""><i class="">“allows these entities to request disclosure of redacted data to enable them to comply with their obligations under the NIS”</i></b>. I would assume that this is perfectly possible without the footnote, so what gives?</div><div class=""><br class=""/></div><div class="">Clearly, we haven’t discussed this nearly as much as we should have.</div><div class=""><br class=""/></div><div class="">Thanks.</div><div class=""><br class=""/></div><div class="">Amr</div><div class=""><div><br class=""/><blockquote type="cite" class=""><div class="">On Jul 28, 2020, at 8:30 PM, Margie Milam via Gnso-epdp-team <<a href="mailto:gnso-epdp-team@icann.org" class="">gnso-epdp-team@icann.org</a>> wrote:</div><br class="Apple-interchange-newline"/><div class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: TrebuchetMS; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Hi-<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Regarding the footnote – we need to retain the footnote since it gives a concrete example of what we mean by regulated companies, and, more importantly, it avoids confusion later that a digital service provider is not a regulated company for the purposes of Rec 7.<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">We’ve discussed the NIS directive as it applies to digital service providers numerous times, and have referred the team to the description<span class="Apple-converted-space"> </span><a href="https://ico.org.uk/for-organisations/the-guide-to-nis/digital-service-providers/" style="color: blue; text-decoration: underline;" class="">here:</a><span class="Apple-converted-space"> </span> Examples of the types of obligations are listed here:<span class="Apple-converted-space"> </span><span style="font-size: 10pt;" class=""><a href="https://ico.org.uk/for-organisations/the-guide-to-nis/key-concepts-and-definitions/" style="color: blue; text-decoration: underline;" class="">https://ico.org.uk/for-organisations/the-guide-to-nis/key-concepts-and-definitions/</a></span><span style="font-size: 10pt;" class="">. These pages describe how the<span class="Apple-converted-space"> </span><span style="background-color: white;" class="">NIS requires these types of organizations to have sufficient security to prevent any action that compromises either the data they store, or any related services they provide. This proactive requirement doesn’t commit ICANN to do anything specific related the NIS but allows these entities to request disclosure of redacted data to enable them to comply with their obligations under the NIS.<o:p class=""></o:p></span></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; background-color: white;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; background-color: white;" class="">All the best,<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; background-color: white;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; background-color: white;" class="">Margie<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; background-color: white;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0in 0.25in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0in 0in;" class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class=""><span style="font-size: 12pt;" class="">From:<span class="Apple-converted-space"> </span></span></b><span style="font-size: 12pt;" class="">Gnso-epdp-team <<a href="mailto:gnso-epdp-team-bounces@icann.org" class="">gnso-epdp-team-bounces@icann.org</a>> on behalf of Rafik Dammak <<a href="mailto:rafik.dammak@gmail.com" class="">rafik.dammak@gmail.com</a>><br class=""/><b class="">Date:<span class="Apple-converted-space"> </span></b>Monday, July 27, 2020 at 11:52 PM<br class=""/><b class="">To:<span class="Apple-converted-space"> </span></b>"Mueller, Milton L" <<a href="mailto:milton@gatech.edu" class="">milton@gatech.edu</a>><br class=""/><b class="">Cc:<span class="Apple-converted-space"> </span></b>"<a href="mailto:gnso-epdp-team@icann.org" class="">gnso-epdp-team@icann.org</a>" <<a href="mailto:gnso-epdp-team@icann.org" class="">gnso-epdp-team@icann.org</a>><br class=""/><b class="">Subject:<span class="Apple-converted-space"> </span></b>Re: [Gnso-epdp-team] Requestor Purpose - Rec 7<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thanks Mathew and Milton<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">@RySG/BC representatives is it acceptable for you to drop the footnote and have everyone to "live with" this recommendation without the footnote?<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Best,<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Rafik<o:p class=""></o:p></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div class=""><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Le mar. 28 juil. 2020 à 01:21, Mueller, Milton L <<a href="mailto:milton@gatech.edu" style="color: blue; text-decoration: underline;" class="">milton@gatech.edu</a>> a écrit :<o:p class=""></o:p></div></div><blockquote style="border-style: none none none solid; border-left-width: 1pt; border-left-color: rgb(204, 204, 204); padding: 0in 0in 0in 6pt; margin-left: 4.8pt; margin-right: 0in;" class="" type="cite"><div class=""><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">NCSG approves of the modified language, which is more generic (obligations of regulated entities). But we strongly object to the footnote being included. We have had no opportunity to review the EU NIS Directive legislation and its implications for disclosure or what it might commit ICANN to doing. During the consideration of this we asked for specific examples of what obligations we might be talking about and never got them. It's too late to include this now. We can accept item (iv) without the footnote.<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></div></div><div class="MsoNormal" align="center" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; text-align: center;"><hr size="0" width="100%" align="center" class=""/></div><div id="gmail-m_9205616789594008789divRplyFwdMsg" class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class=""><span style="" class="">From:</span></b><span style="" class=""><span class="Apple-converted-space"> </span>Gnso-epdp-team <<a href="mailto:gnso-epdp-team-bounces@icann.org" target="_blank" style="color: blue; text-decoration: underline;" class="">gnso-epdp-team-bounces@icann.org</a>> on behalf of Crossman, Matthew via Gnso-epdp-team <<a href="mailto:gnso-epdp-team@icann.org" target="_blank" style="color: blue; text-decoration: underline;" class="">gnso-epdp-team@icann.org</a>><br class=""/><b class="">Sent:</b><span class="Apple-converted-space"> </span>Monday, July 27, 2020 11:54 AM<br class=""/><b class="">To:</b><span class="Apple-converted-space"> </span><a href="mailto:gnso-epdp-team@icann.org" target="_blank" style="color: blue; text-decoration: underline;" class="">gnso-epdp-team@icann.org</a><span class="Apple-converted-space"> </span><<a href="mailto:gnso-epdp-team@icann.org" target="_blank" style="color: blue; text-decoration: underline;" class="">gnso-epdp-team@icann.org</a>><br class=""/><b class="">Subject:</b><span class="Apple-converted-space"> </span>[Gnso-epdp-team] Requestor Purpose - Rec 7</span><o:p class=""></o:p></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div class="">Hi team,<o:p class=""></o:p></div><div class=""> <o:p class=""></o:p></div><div class="">As an update, Margie, Brian, and I worked on a compromise for the Rec 7 language on Requestor Purposes. We agreed on the following edit to 7.1(a):<o:p class=""></o:p></div><div class=""> <o:p class=""></o:p></div><div class=""><u class="">7.1(a)</u><o:p class=""></o:p></div><div class=""> <o:p class=""></o:p></div><div class="">Requestors MUST submit data disclosure requests for specific purposes such as but not limited to: but not limited to: (i) criminal law enforcement, national or public security, (ii) non law enforcement investigations and civil claims, including, intellectual property infringement and UDRP and URS claims,<span class="Apple-converted-space"> </span><span style="color: red;" class="">(iii) consumer protection, abuse prevention, and network security, and (iv) obligations applicable to regulated entities.</span><a name="m_9205616789594008789_x__ftnref1" class=""></a><a href="x-msg://5/#m_9205616789594008789_x__ftn1" style="color: blue; text-decoration: underline;" class=""><span class=""><span style="font-size: 10pt; color: red;" class="">[1]</span></span><span class=""></span></a><span class=""></span><span style="font-size: 10pt; color: red;" class=""><span class="Apple-converted-space"> </span></span>Requestors MAY also submit data verification requests on the basis of Registered Name Holder (RNH) consent that has been obtained by the Requestor (and is at the sole responsibility of that Requestor), for example to validate the RNH’s claim of ownership of a domain name registration, or contract with the Requestor.<o:p class=""></o:p></div><div class=""> <o:p class=""></o:p></div><div class="">(Footnote below)<o:p class=""></o:p></div><div class=""><span style="font-size: 10pt; color: red;" class="">1 </span><span style="color: red;" class="">For example, the EU Directive on security of network and information systems (known as the NIS Directive) imposes specific obligations on Digital Service Providers and Operators of Essential Services.</span><o:p class=""></o:p></div><div class=""><span style="color: red;" class=""> </span><o:p class=""></o:p></div><div class="">With these changes this is no longer a CLW item for the RySG. Let us know if this new language causes any concern for other groups.<o:p class=""></o:p></div><div class=""> <o:p class=""></o:p></div><div class="">Thanks,<br class=""/>Matt<o:p class=""></o:p></div><div class=""> <o:p class=""></o:p></div><div class=""> <o:p class=""></o:p></div><div class=""><b class=""><span style="font-size: 10pt;" class="">Matthew Crossman</span></b><span style="font-size: 10pt; color: rgb(255, 153, 0);" class=""><span class="Apple-converted-space"> </span></span><span style="font-size: 10pt; color: rgb(68, 84, 106);" class="">|<span class="Apple-converted-space"> </span></span><b class=""><span style="font-size: 10pt; color: rgb(247, 150, 70);" class="">Amazon</span></b><span style="font-size: 10pt; color: rgb(255, 153, 0);" class=""><span class="Apple-converted-space"> </span><br class=""/></span><span style="font-size: 10pt;" class="">Corporate Counsel gTLD Registry, IP</span><o:p class=""></o:p></div><div class=""><span style="font-size: 10pt;" class="">P: 206-266-1103 | C: 530-574-2956</span><o:p class=""></o:p></div><div class=""><span style="font-size: 10pt;" class="">Email:<span class="Apple-converted-space"> </span><a href="mailto:mmcross@amazon.com" target="_blank" style="color: blue; text-decoration: underline;" class=""><span style="color: rgb(5, 99, 193);" class="">mmcross@amazon.com</span></a></span><o:p class=""></o:p></div><div class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br clear="all" class=""/><o:p class=""></o:p></div><div class="MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><hr size="0" width="35%" align="left" class=""/></div><div id="gmail-m_9205616789594008789x_ftn1" class=""><div class=""><a name="m_9205616789594008789_x__ftn1" class=""></a><a href="x-msg://5/#m_9205616789594008789_x__ftnref1" style="color: blue; text-decoration: underline;" class=""><span class="">[1]</span><span class=""></span></a><span class=""></span><span class="Apple-converted-space"> </span>This approach is very similar to the business model ARSI had previously discussed with the Author Central Pro teams for the .AUTHOR TLD.<o:p class=""></o:p></div></div></div></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">_______________________________________________<br class=""/>Gnso-epdp-team mailing list<br class=""/><a href="mailto:Gnso-epdp-team@icann.org" target="_blank" style="color: blue; text-decoration: underline;" class="">Gnso-epdp-team@icann.org</a><br class=""/><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__mm.icann.org_mailman_listinfo_gnso-2Depdp-2Dteam&d=DwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8&m=f40qXENVwTNlHaI3M3teHJv_-eTQbKL7yJarKwfvn3A&s=6X1FwkRZ2KxhtmfyU3Ndk1tLjP1ofTsGjuyEmOyppyo&e=" target="_blank" style="color: blue; text-decoration: underline;" class="">https://mm.icann.org/mailman/listinfo/gnso-epdp-team</a><br class=""/>_______________________________________________<br class=""/>By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_policy&d=DwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8&m=f40qXENVwTNlHaI3M3teHJv_-eTQbKL7yJarKwfvn3A&s=sOyjkCW5ErH-zqC67ds8MhFCp-dYrE_oiH5Tmq6nmf8&e=" target="_blank" style="color: blue; text-decoration: underline;" class="">https://www.icann.org/privacy/policy</a>) and the website Terms of Service (<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_tos&d=DwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=_4XWSt8rUHZPiRG6CoP4Fnk_CCk4p550lffeMi3E1z8&m=f40qXENVwTNlHaI3M3teHJv_-eTQbKL7yJarKwfvn3A&s=oB13Y4B3b0nGxJ7TpDWHafSmV6Qf7FE8zbFKWFAzahk&e=" target="_blank" style="color: blue; text-decoration: underline;" class="">https://www.icann.org/privacy/tos</a>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.</div></blockquote></div></div></div></div></blockquote></div><br class=""/></div></body></html>