[gnso-rds-pdp-wg] ICANN Meetings/Conversations with Data Protection and Privacy Commissioners

[Sam Lanfranco]

We are in a protracted dialogue (multilogue) where all sides are making 
good points but not always really addressing quite the same issue. Is 
there a way to impart a bit of order here so that evidence and analysis 
drive us toward enough clarity on specific issues that we can fabricate 
consensus, or identify that consensus is impossible?

Looking at the recent discussion it would appear that two issues have 
been conflated. The one is central to this rds-pdp-wg, and that is what 
should be in the minimum public data set and how to reconcile that 
process (as well as the nature of the data) to be consistent with 
emerging GDPR regimes. The other is with regard to privacy/proxy 
services. That can be, and should be, treated as a separate issue, 
probably outside the remit of this working group.

In my opinion we should be absolutely clear as to what we are trying to 
do. We are trying to identify that core of public personal data that 
should be in the open-access (no gated restrictions) record of 
information about the registrant of the URL. That personal data (and 
process) should not run afoul of the emerging GDPRs. Probably, 
eventually, ICANN will have to interact (as a stakeholder) with global 
and national efforts at GDPR policy making to reduce the "friction" 
between the minimum public data set and various GDPRs.

It is my opinion that it would be a mistake for either this WG to 
suggest, or ICANN to try to make it a policy, that privacy/proxy 
services be provided by all registrars It is up to registrars and 
registrants to sort out (through the market?) the terms under which 
privacy/proxy services are provided in the domain name market. I think 
privacy/proxy services are important but let the registrars and their 
customers sort that out in the market for related registration services. 
We should keep our focus, at this point, on the minimum public data set.

Sam Lanfranco
(NCSG/NPOC)