<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"Lucida Grande";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle22
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle23
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;
font-weight:normal;
font-style:normal;}
span.EmailStyle24
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle26
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#993366;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:#993366">Chuck, there is certainly a place for open, public access to *<b>some</b>* of the data, but I firmly do not believe that all data should be freely available to everyone for
any purpose. In the RDAP implementation that my team has deployed we provide full access to unauthenticated clients for what we’re calling “thin” data. Our implementation (which I am fully planning to update based on this group’s work and recommendations)
requires identification and authentication for access to additional information. Reasonable people (that’s all of us, right? ;)) should be able to figure out which use cases warrant access to which data for which purposes.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:#993366"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#993366">Scott</span><span style="font-family:"Calibri","sans-serif";color:#993366"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:#993366"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Gomes, Chuck
<br>
<b>Sent:</b> Tuesday, January 24, 2017 2:34 PM<br>
<b>To:</b> Hollenbeck, Scott; gca@icginc.com; jgalvin@afilias.info; gnso-rds-pdp-wg@icann.org<br>
<b>Subject:</b> RE: [gnso-rds-pdp-wg] Now open: 18 January Poll on Purpose<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Scott,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Am I correct in concluding that such situations could be addressed by public access?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Chuck<o:p></o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></a></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">
<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org">gnso-rds-pdp-wg-bounces@icann.org</a> [<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org">mailto:gnso-rds-pdp-wg-bounces@icann.org</a>]
<b>On Behalf Of </b>Hollenbeck, Scott<br>
<b>Sent:</b> Tuesday, January 24, 2017 2:25 PM<br>
<b>To:</b> <a href="mailto:gca@icginc.com">gca@icginc.com</a>; <a href="mailto:jgalvin@afilias.info">
jgalvin@afilias.info</a>; <a href="mailto:gnso-rds-pdp-wg@icann.org">gnso-rds-pdp-wg@icann.org</a><br>
<b>Subject:</b> [EXTERNAL] Re: [gnso-rds-pdp-wg] Now open: 18 January Poll on Purpose<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:#1F497D">The situations Greg and Jim describe below are precisely why I think we need to consider that there are some uses for which no client authentication is required and some for
which it should be required – and that there should be a corresponding type and amount of information returned in response to a query based on what the user/client is willing to share.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:#1F497D">We already have “a query/response system that does not require credentials or permissions” in WHOIS. If WHOIS met our needs we wouldn’t be having this conversation.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Scott</span><span style="font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org">gnso-rds-pdp-wg-bounces@icann.org</a> [<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org">mailto:gnso-rds-pdp-wg-bounces@icann.org</a>]
<b>On Behalf Of </b>Greg Aaron<br>
<b>Sent:</b> Tuesday, January 24, 2017 1:53 PM<br>
<b>To:</b> James Galvin; RDS PDP WG<br>
<b>Subject:</b> [EXTERNAL] Re: [gnso-rds-pdp-wg] Now open: 18 January Poll on Purpose<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Dear Jim:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">If legitimate users must identify themselves before looking up a domain name, and are required to state their purpose for making that query, that is a significant collection
of data with huge privacy and security implications. It means that registrars and registry operators would collect information about what specific people are searching for, and why. Users who have perfectly legitimate uses are not currently required to
give up their identities and use cases – can such a change be justified?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">As a practical matter, a change would makes people jump through hoops unnecessarily. If we’re talking about thin data, that data is not sensitive or personally identifiable.
Thus there’s no reason for people who want to access it to declare their identities and use cases.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Currently our RDS system (WHOIS) is a public query/response system. You’re pointing to turning RDS into a credential-driven system. That poses enormous consequences for
privacy, security, and cost. A lot of people commented about those things in response to the EWG. See SAC061 or example.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">There are use cases that argue in favor of anonymous access. For example law enforcement investigators do not want to reveal what they are looking into, for obvious reasons.
I also assume that they do they want to violate terms of service or lie about who they are or what they are doing.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">The setup we currently have -- a query/response system that does not require credentials or permissions -- avoids the above problems, among others.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">All best,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">--Greg<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> James Galvin [<a href="mailto:jgalvin@afilias.info">mailto:jgalvin@afilias.info</a>]
<br>
<b>Sent:</b> Tuesday, January 24, 2017 12:55 PM<br>
<b>To:</b> RDS PDP WG <<a href="mailto:gnso-rds-pdp-wg@icann.org">gnso-rds-pdp-wg@icann.org</a>><br>
<b>Cc:</b> Greg Aaron <<a href="mailto:gca@icginc.com">gca@icginc.com</a>><br>
<b>Subject:</b> Re: [gnso-rds-pdp-wg] Now open: 18 January Poll on Purpose<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p><span style="font-family:"Arial","sans-serif"">I have a comment and a question about Greg’s suggestion/conclusion.<o:p></o:p></span></p>
<p><span style="font-family:"Arial","sans-serif"">First, while I appreciate the documented history and recollection of precedent, we are frequently reminded that we are starting with a clean slate. Thus the fact that “all use is allowed except when a use is
specifically prohibited” currently exists in contracts is not binding for us.<o:p></o:p></span></p>
<p><span style="font-family:"Arial","sans-serif"">Second, could you say more about how the rights of legitimate users are infringed by having to identify themselves before getting access to data? In my experience it is ordinary process to identify yourself
for access (and sometimes authenticate yourself) unless the circumstances are known to be anonymous or public. This group has to decide if the circumstances justify anonymous or public access, and what that means.<o:p></o:p></span></p>
<p><span style="font-family:"Arial","sans-serif"">Thanks,<o:p></o:p></span></p>
<p><span style="font-family:"Arial","sans-serif"">Jim<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"Arial","sans-serif""><o:p> </o:p></span></p>
<p><span style="font-family:"Arial","sans-serif"">On 23 Jan 2017, at 12:45, Greg Aaron wrote:<o:p></o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid #777777 1.5pt;padding:0in 0in 0in 4.0pt;margin-left:0in;margin-top:5.0pt;margin-right:0in;margin-bottom:3.75pt">
<div id="FAF656BE-2C5C-4F63-B49B-6760C2D861E8">
<div>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">The question is not “Is ICANN a law enforcement body?’’ (Clearly it is not.) The question is whether ICANN can require that data be collected and
published in order to facilitate various legitimate goals. The answer to that question is clearly “yes.”</span><span style="color:black"><o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> </span><span style="color:black"><o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:11.25pt;margin-left:0in;background:white">
<span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">ICANN’s Bylaws describe ICANN’s responsibilities and their scope – especially see Article 1, section 1, of ICANN’s Bylaws, entitled “Mission, Commitments and Core Values.” (</span><a href="https://www.icann.org/resources/pages/governance/bylaws-en/#article1"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">https://www.icann.org/resources/pages/governance/bylaws-en/#article1</span></a><span style="color:black">
)</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> Among other things, “ICANN's scope is to coordinate the development and implementation of policies: For which uniform or coordinated resolution is reasonably necessary to facilitate
the openness, interoperability, resilience, security and/or stability of the DNS including, with respect to gTLD registrars and registries… functional and performance specifications for the provision of registrar services; registrar policies reasonably necessary
to implement Consensus Policies relating to a gTLD registry; resolution of disputes regarding the registration of domain names... Examples of the above include, without limitation: …<span style="color:#333333">maintenance of and access to accurate and up-to-date
information concerning registered names and name servers”. </span></span><span style="color:black"><o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:11.25pt;margin-left:0in;background:white">
<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#333333">Years back it was decided that the collection and publication of the data was important for accomplishing some legitimate goals, in keeping with the above principles. And since
the old days there have been additional statements of note. For example in 2007 the GAC weighed in recognizing a number of specific legitimate uses, including “facilitating inquiries and subsequent steps to conduct trademark clearances and help counter intellectual
property infringement” and “contributing to user confidence in the Internet”, in keeping with law. We’re reviewing all this now; just saying that there’s a lot of precedent, and proposals for chnage need to address precedent.</span><span style="color:black"><o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:11.25pt;margin-left:0in;background:white">
<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#333333;background:white">Currently there is an approach that’s important to mention. The contracts say that registrars “shall permit
<i>use </i>of data it provides in response to queries <i>for any lawful purposes</i>”. [Emphases added; and except for “mass unsolicited, commercial messages” i.e. spamming, and some high-volume queries.) <i>Access
</i>is not prohibited or regulated. <i>All use is allowed</i> except when a use is specifically prohibited. </span><span style="color:black"><o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:11.25pt;margin-left:0in;background:white">
<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#333333;background:white">The alternative is to enumerate all allowable uses and to regulate access based on each user’s intent to honor those allowed uses. And that takes the world to
a place where a system must gatekeep all users, and parcel out data to them only after the assert or prove they have a legitimate use and that they will employ the data only for that purpose. IMHO that infringes upon the rights of legitimate users, and is
also a completely unmanageable solution.</span><span style="color:black"><o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:11.25pt;margin-left:0in;background:white">
<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#333333;background:white">All best,</span><span style="color:black"><o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:11.25pt;margin-left:0in;background:white">
<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#333333;background:white">--Greg</span><span style="color:black"><o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> </span><span style="color:black"><o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> </span><span style="color:black"><o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""> </span><span style="color:black"><o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> </span><span style="color:black"><o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p style="margin:0in;margin-bottom:.0001pt"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">
</span><a href="mailto:gnso-rds-pdp-wg-bounces@icann.org"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">gnso-rds-pdp-wg-bounces@icann.org</span></a><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> [</span><a href="mailto:gnso-rds-pdp-wg-bounces@icann.org"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">mailto:gnso-rds-pdp-wg-bounces@icann.org</span></a><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">]
<b>On Behalf Of </b>Kimpian Peter<br>
<b>Sent:</b> Monday, January 23, 2017 8:53 AM<br>
<b>To:</b> Stephanie Perrin <</span><a href="mailto:stephanie.perrin@mail.utoronto.ca"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">stephanie.perrin@mail.utoronto.ca</span></a><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">>;
</span><a href="mailto:gnso-rds-pdp-wg@icann.org"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">gnso-rds-pdp-wg@icann.org</span></a><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><br>
<b>Subject:</b> Re: [gnso-rds-pdp-wg] FW: Now open: 18 January Poll on Purpose</span><span style="color:black"><o:p></o:p></span></p>
</div>
</div>
<p style="margin:0in;margin-bottom:.0001pt"><span style="color:black"> <o:p></o:p></span></p>
<p><span style="font-family:"Arial","sans-serif";color:#777777">Dear All,<o:p></o:p></span></p>
<p><span style="font-family:"Arial","sans-serif";color:#777777"> <o:p></o:p></span></p>
<p><span style="font-family:"Arial","sans-serif";color:#777777">Adding to the purpose debate: usually it is common sense and wiedly reckognised that we don't collect personal data just for the sake of it or in bulk saying it will be good for one purpose or
another. Usually data controllers have the obligation to say openly in advance this is why I am going to process (ie collect, agregate, transfer, etc.) personal data. Being said that it can not be excluded that those data will be used/accessed for "higher"
common good and for the benefit for all by another athorised data controller. For example a telco company can if all conditions met disclose (!) data it previously collected to law enforcement agencies but this does not mean that the Telco compony can collect,
process etc data for law enforcement purpose...<o:p></o:p></span></p>
<p><span style="font-family:"Arial","sans-serif";color:#777777"> <o:p></o:p></span></p>
<p><span style="font-family:"Arial","sans-serif";color:#777777">My simple question to start with would be and always was: Is ICANN a law enforcement body? Does ICANN have any power/competence in fighting against crime? And it goes for other purposes as well:
Is ICANN an international trademark organisation? Etc...Is the answer given to those questions is shared by all the community of ICANN? In my sense we have to be sure that we answer first those questions before deciding on possible purposes (which does not
mean that discloser of data on a case-by case base according to international legal requirements will not be possible after this, but those will be exceptions !!!)<o:p></o:p></span></p>
<p><span style="font-family:"Arial","sans-serif";color:#777777"> <o:p></o:p></span></p>
<p><span style="font-family:"Arial","sans-serif";color:#777777">Best regards,<o:p></o:p></span></p>
<p><span style="font-family:"Arial","sans-serif";color:#777777"> <o:p></o:p></span></p>
<p><span style="font-family:"Arial","sans-serif";color:#777777">Peter<o:p></o:p></span></p>
<div>
<p style="margin:0in;margin-bottom:.0001pt"><span style="color:black">2017.01.22. 19:20 keltezéssel, Stephanie Perrin írta:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p><span style="font-size:13.5pt;font-family:"Lucida Grande";color:#777777">I love your analogy Shane, it is perfect. In data protection terms that would be a use. For a legitimate purpose... sledding. There might have to be repercussions if you cracked
the lid....that might be a data breach:-)</span><span style="font-family:"Arial","sans-serif";color:#777777"><o:p></o:p></span></p>
<p><span style="font-size:13.5pt;font-family:"Lucida Grande";color:#777777">I hate being a nit picker and calling out this distinction between purpose of collection as opposed to purpose for use and disclosure, but it is extremely important in terms of data
protection. Some laws are more clear than others on the distinction, and you are correct that if we are not careful DP laws will forbid the collection and disclosure of the data. It is certainly clear that for collection of thin data, there is ample justification
for collecting the info based on ICANN's limited mandate. However adding law enforcement and other similar website related investigative activities to the list of legitimate purposes is in my view opening a barn door. After a year of discussion we may understand
the nuance, that we are talking about thin data, etc etc but when the fruits of our labours are published, it looks like we have all agreed that law enforcement (eg) is a legitimate purpose for collecting registration data. In my view, it is not.</span><span style="font-family:"Arial","sans-serif";color:#777777"><o:p></o:p></span></p>
<p><span style="font-size:13.5pt;font-family:"Lucida Grande";color:#777777">cheers Stephanie</span><span style="font-family:"Arial","sans-serif";color:#777777"><o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="color:black"> <o:p></o:p></span></p>
<div>
<p style="margin:0in;margin-bottom:.0001pt"><span style="color:black">On 2017-01-22 04:03, Shane Kerr wrote:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre><span style="color:black">Greg,<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">If we can say that not all legitimate purposes have to be catered for,<o:p></o:p></span></pre>
<pre><span style="color:black">then I agree with you. :)<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">If we say that tracking down the registrar of a domain as part of<o:p></o:p></span></pre>
<pre><span style="color:black">trademark research is a legitimate purpose, that does not mean that we<o:p></o:p></span></pre>
<pre><span style="color:black">have to design the system for this purpose, right?<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">To try an analogy: We can recognize that using the plastic top of a<o:p></o:p></span></pre>
<pre><span style="color:black">garbage can as a sled is legitimate, but we don't insist on designing<o:p></o:p></span></pre>
<pre><span style="color:black">lids with sledding in mind.<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">Full disclosure: My own take on the "legitimate purpose" discussion<o:p></o:p></span></pre>
<pre><span style="color:black">with regards to "thin data" is that we need *some* purpose for both<o:p></o:p></span></pre>
<pre><span style="color:black">gathering and publishing the information, because otherwise privacy<o:p></o:p></span></pre>
<pre><span style="color:black">laws may prohibit companies from gathering or publishing it. Luckily I<o:p></o:p></span></pre>
<pre><span style="color:black">think that there are so many such purposes that the need for the<o:p></o:p></span></pre>
<pre><span style="color:black">information is indisputable.<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">Jumping ahead... as I said in a prior call (sorry for missing ones since<o:p></o:p></span></pre>
<pre><span style="color:black">then), I would prefer that the information is then allowed for any<o:p></o:p></span></pre>
<pre><span style="color:black">purpose, without restriction, because otherwise you have to have not<o:p></o:p></span></pre>
<pre><span style="color:black">only tiresome rules about what is allowed but also the Internet Police<o:p></o:p></span></pre>
<pre><span style="color:black">to enforce those rules, which seems like a step towards Armageddon.<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">Given that we're still talking about "thin data", which is basically<o:p></o:p></span></pre>
<pre><span style="color:black">just a pointer to a registrar who has *actual* data, my own<o:p></o:p></span></pre>
<pre><span style="color:black">recommendation is not to stress too much. This stuff is only very, very<o:p></o:p></span></pre>
<pre><span style="color:black">vaguely personally identifiable.<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">Cheers,<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">--<o:p></o:p></span></pre>
<pre><span style="color:black">Shane <o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">At 2017-01-21 14:51:29 -0500<o:p></o:p></span></pre>
<pre><span style="color:black">Greg Shatan </span><a href="mailto:gregshatanipc@gmail.com"><gregshatanipc@gmail.com></a><span style="color:black"> wrote:<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre><span style="color:black">I have to disagree. These are legitimate purposes for collection, as well<o:p></o:p></span></pre>
<pre><span style="color:black">as for disclosure.<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">Greg<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">On Fri, Jan 20, 2017 at 7:02 PM, Stephanie Perrin <<o:p></o:p></span></pre>
<pre><a href="mailto:stephanie.perrin@mail.utoronto.ca">stephanie.perrin@mail.utoronto.ca</a><span style="color:black">> wrote: <o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre><span style="color:black">I filled it out, but I am afraid for most of the purposes I could not<o:p></o:p></span></pre>
<pre><span style="color:black">agree. We do not *collect *data for many of those purposes. We disclose<o:p></o:p></span></pre>
<pre><span style="color:black">it to people for those purposes, but the purpose of collecting those data<o:p></o:p></span></pre>
<pre><span style="color:black">elements is not for tax collection, trademark enforcement actions, etc.<o:p></o:p></span></pre>
<pre><span style="color:black">This is the conflation issue I have raised repeatedly.<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">Apologies if I did not make that point clear enough on the call.<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">Stephanie Perrin<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">On 2017-01-20 17:35, Gomes, Chuck wrote:<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">Please note that our current poll ends in about 24 hours. So far only 16<o:p></o:p></span></pre>
<pre><span style="color:black">people have responded.<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">Chuck<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">*From:* </span><a href="mailto:gnso-rds-pdp-wg-bounces@icann.org">gnso-rds-pdp-wg-bounces@icann.org</a><span style="color:black"> [</span><a href="mailto:gnso-rds-pdp-wg">mailto:gnso-rds-pdp-wg</a><span style="color:black">-<o:p></o:p></span></pre>
<pre><a href="mailto:bounces@icann.org">bounces@icann.org</a><span style="color:black"> </span><a href="mailto:gnso-rds-pdp-wg-bounces@icann.org"><gnso-rds-pdp-wg-bounces@icann.org></a><span style="color:black">] *On Behalf Of *Lisa<o:p></o:p></span></pre>
<pre><span style="color:black">Phifer<o:p></o:p></span></pre>
<pre><span style="color:black">*Sent:* Wednesday, January 18, 2017 1:50 PM<o:p></o:p></span></pre>
<pre><span style="color:black">*To:* RDS PDP WG </span><a href="mailto:gnso-rds-pdp-wg@icann.org"><gnso-rds-pdp-wg@icann.org></a><span style="color:black"> </span><a href="mailto:gnso-rds-pdp-wg@icann.org"><gnso-rds-pdp-wg@icann.org></a><span style="color:black"><o:p></o:p></span></pre>
<pre><span style="color:black">*Subject:* [EXTERNAL] [gnso-rds-pdp-wg] Now open: 18 January Poll on<o:p></o:p></span></pre>
<pre><span style="color:black">Purpose<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">Dear all,<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">As directed in the 18 January WG call, this week's new Poll on Purpose is<o:p></o:p></span></pre>
<pre><span style="color:black">now open for WG member participation:<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><a href="https://www.surveymonkey.com/r/SZX9QJZ">https://www.surveymonkey.com/r/SZX9QJZ</a><span style="color:black"><o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">A PDF of this poll's questions and notes/recordings of the meeting are<o:p></o:p></span></pre>
<pre><span style="color:black">posted on the 18 January meeting page: </span><a href="https://community.icann.org/x/">https://community.icann.org/x/</a><span style="color:black"><o:p></o:p></span></pre>
<pre><span style="color:black">EbTDAw<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">This poll will close at *COB Saturday 21 January 2017*.<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">All WG members are encouraged to participate in this poll to help advance<o:p></o:p></span></pre>
<pre><span style="color:black">deliberation and prepare for next week's meeting.<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">Best regards,<o:p></o:p></span></pre>
<pre><span style="color:black">Lisa<o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">_______________________________________________<o:p></o:p></span></pre>
<pre><span style="color:black">gnso-rds-pdp-wg mailing </span><a href="mailto:listgnso-rds-pdp-wg@icann.orghttps://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg">listgnso-rds-pdp-wg@icann.orghttps://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg</a><span style="color:black"><o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<pre><span style="color:black">_______________________________________________<o:p></o:p></span></pre>
<pre><span style="color:black">gnso-rds-pdp-wg mailing list<o:p></o:p></span></pre>
<pre><a href="mailto:gnso-rds-pdp-wg@icann.org">gnso-rds-pdp-wg@icann.org</a><span style="color:black"><o:p></o:p></span></pre>
<pre><a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg">https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg</a><span style="color:black"><o:p></o:p></span></pre>
<pre><span style="color:black"> <o:p></o:p></span></pre>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:0in">
<span style="color:black"><o:p> </o:p></span></p>
<pre><span style="color:black">_______________________________________________<o:p></o:p></span></pre>
<pre><span style="color:black">gnso-rds-pdp-wg mailing list<o:p></o:p></span></pre>
<pre><a href="mailto:gnso-rds-pdp-wg@icann.org">gnso-rds-pdp-wg@icann.org</a><span style="color:black"><o:p></o:p></span></pre>
<pre><a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg">https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg</a><span style="color:black"><o:p></o:p></span></pre>
</blockquote>
</blockquote>
</blockquote>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:0in">
<span style="color:black"><o:p> </o:p></span></p>
<pre><span style="color:black">_______________________________________________<o:p></o:p></span></pre>
<pre><span style="color:black">gnso-rds-pdp-wg mailing list<o:p></o:p></span></pre>
<pre><a href="mailto:gnso-rds-pdp-wg@icann.org">gnso-rds-pdp-wg@icann.org</a><span style="color:black"><o:p></o:p></span></pre>
<pre><a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg">https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg</a><span style="color:black"><o:p></o:p></span></pre>
</blockquote>
<p style="margin:0in;margin-bottom:.0001pt"><span style="color:black"> <o:p></o:p></span></p>
</div>
</div>
</blockquote>
<div>
<p><span style="font-family:"Arial","sans-serif"">_______________________________________________<br>
gnso-rds-pdp-wg mailing list<br>
</span><a href="mailto:gnso-rds-pdp-wg@icann.org"><span style="font-family:"Arial","sans-serif"">gnso-rds-pdp-wg@icann.org</span></a><span style="font-family:"Arial","sans-serif""><br>
</span><a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg"><span style="font-family:"Arial","sans-serif";color:#3983C4">https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg</span></a><span style="font-family:"Arial","sans-serif""><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>