[gnso-rds-pdp-wg] Legal basis vs. lawful
Kathy Kleiman
kathy at kathykleiman.com
Fri Feb 9 00:06:58 UTC 2018
Tx for the invitation to join, Chuck, and following up on the discussion
of Sam and Tapani, let me add that criteria for processing must be
clearer than something broadly within ICANN's mission statement and
something permissible somewhere. The requirements under law are express
and concrete.
Specifically, GDPR Article 5(1)(b and c) states:
*Personal data shall be: **
**2. "collected for _specified, explicit and legitimate purposes _and
not further processed in a manner that is incompatible with those
purposes"* (the "purpose limitation") AND *
**3. "adequate, relevant and limited to what is necessary in relation
to the purposes for which they are processed"* (the "data minimisation"
requirement). [underline added]*
*
Thus, our first criteria of "consistent with ICANN's mission," is only
the first step and we need to go further than even the 3 criteria we are
discussing..
Second, lawful and legal enter us into a debate over words and I have to
agree with Sam and Tapani's analysis and let me add some of my own.
"Legal" is the term we use for actions expressly allowed under law. How
we process personal data under the GDRP falls into this category -- of
processing expressly allowed under law. Whereas the term lawful is used
for a much broader category of actions which are generally permissible
and allowable.
The term "legal" is much more consistent with our criteria statement
because the processing of personal data by ICANN must clearly have a
/valid legal basis/ as expressly defined by data protection laws.
Best regards,
Kathy
On 2/7/2018 10:53 AM, Sam Lanfranco wrote:
>
> Thanks Tapani,
>
> I will extract from your longer message.
> I deliberately kept my brief and less technical.
> I think we are in agreement here and I support your position.
>
> On 2/7/2018 1:07 AM, Tapani Tarvainen wrote:
>
> The key distinction, as I understand it, is that "lawful" would be
> defined by the negative, everything that some law does not prohibit,
> where as "legal basis" is defined by the positive, only things whose
> justification can be explicitly derived from law.
>
> <......>
>
> So I would prefer "legal basis" specifically in this sense: that any
> processing
> would have to be explicitly based on one of the criteria, or bases,
> as listed
> in GDPR Article 6, or similar explicit justification in other data
> protection legislation.
>
>
>
>
> _______________________________________________
> gnso-rds-pdp-wg mailing list
> gnso-rds-pdp-wg at icann.org
> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/gnso-rds-pdp-wg/attachments/20180208/40560ced/attachment-0001.html>
More information about the gnso-rds-pdp-wg
mailing list