<div>My sincere apologies for missing this call; I had overlooked it in my calendar. From the notes below it sounds like it was a very insightful session, so I look forward very much to listening to the recording.<br><br>Best wishes,</div><div><br></div><div class="protonmail_signature_block "><div class="protonmail_signature_block-user "><div>Ayden Férdeline<br></div><div><a title="http://www.linkedin.com/in/ferdeline" href="http://www.linkedin.com/in/ferdeline">linkedin.com/in/ferdeline</a><br></div></div><div class="protonmail_signature_block-proton protonmail_signature_block-empty"><br></div></div><div><br></div><blockquote type="cite" class="protonmail_quote"><div>-------- Original Message --------<br></div><div>Subject: [gnso-rds-pdp-wg] Notes from Next-Gen RDS PDP WG call on Tuesday, 7 February 2017<br></div><div>Local Time: 7 February 2017 7:18 PM<br></div><div>UTC Time: 7 February 2017 19:18<br></div><div>From: lisa@corecom.com<br></div><div>To: gnso-rds-pdp-wg@icann.org<br></div><div><br></div><div class="WordSection1"><p class="MsoNormal">Dear all,<br></p><p class="MsoNormal">&nbsp;<br></p><p class="MsoNormal">Below please find notes from today’s RDS PDP WG call.<br></p><p class="MsoNormal">&nbsp;<br></p><p class="MsoNormal">Best regards,<br></p><p class="MsoNormal">Lisa<br></p><p class="MsoNormal">&nbsp;<br></p><p class="p4" style="margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><span class="highlight" style="background-color:white"><b><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Notes from&nbsp;Next-Gen RDS PDP WG call on Tuesday, 7 February 2017</span></span></span></b></span><br></p><p class="p4" style="margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><span class="highlight" style="background-color:white"><i><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">These high-level notes are designed to help PDP WG members navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at</span></span></span></span></i><i><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt"> <a href="https://community.icann.org/x/HIzRAw"><i>https://community.icann.org/x/HIzRAw</i></a></span></span></span></span></i><i><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt"></span></span></span></span></i></span><br></p><p style="margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">1. Roll call / SOI</span></span></span></span><br></p><ul type="disc"><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l5 level1 lfo8;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Roll call will be taken from Adobe Connect</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l5 level1 lfo8;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Please remind to update your SOIs as needed</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l5 level1 lfo8;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Please remember to state your name before speaking as well as muting your microphone when not speaking</span></span><br></li></ul><p style="margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial; font-variant-ligatures: normal; font-variant-caps: normal; orphans: 2; text-align: start; widows: 2; -webkit-text-stroke-width: 0px; word-spacing: 0px;"><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">2. Intro to Data Protection principles that may apply to thin data collection</span></span></span></span><br></p><p style="margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial; font-variant-ligatures: normal; font-variant-caps: normal; orphans: 2; text-align: start; widows: 2; -webkit-text-stroke-width: 0px; word-spacing: 0px;"><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">&nbsp;&nbsp; a. Overview from Stephanie Perrin &amp; Peter Kimpian</span></span></span></span><br></p><p style="margin-right: 0in; margin-left: 22.5pt; margin-bottom: 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial; font-variant-ligatures: normal; font-variant-caps: normal; orphans: 2; text-align: start; widows: 2; -webkit-text-stroke-width: 0px; word-spacing: 0px;"><span class="highlight" style="background-color:white"><u><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Presentation by Peter Kimpian</span></span></span></u><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt"></span></span></span></span><br></p><ul type="disc"><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l12 level1 lfo9;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">See slides at<span class="apple-converted-space">&nbsp;</span><a href="https://community.icann.org/download/attachments/64064540/Kimpian_pdp_rds_2_2_17.pdf"><span class="colour" style="color:rgb(59, 115, 175)">https://community.icann.org/download/attachments/64064540/Kimpian_pdp_rds_2_2_17.pdf</span></a></span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l12 level1 lfo9;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Right to privacy is a universal right, even if it is interpreted differently in different countries.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l12 level1 lfo9;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Individuals have to be in control of their personal data (the whole trail of data). Overarching principles: necessity, proportionality, purpose specification / purpose limitation.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l12 level1 lfo9;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">For data processing there has to be a legitimate aim/purpose. Lawful and fair means of data processing. Lawful = it has to be regulated and/or not forbidden by legislation.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l12 level1 lfo9;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Valid legal basis (law, consent, contract, vital interest of the individual). This concept is also present in other legal frameworks, not only the European one.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l12 level1 lfo9;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Data processing needs to be adequate, relevant and not excessive.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l12 level1 lfo9;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Data minimization principle: no processing of data for the sake of data, only for a purpose. During the processing, the data controller has the obligation to process the minimum amount of data that is fit for purpose.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l12 level1 lfo9;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">There are a number of exemptions (see slide 4). Always conditions to these exemptions. Need to establish criteria under which such exemptions are permissible.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l12 level1 lfo9;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Disclosure of data (slide 5) - same rules apply as for processing, however there is a third party that enters into the picture using the data for a secondary purpose.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l12 level1 lfo9;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Accountability (slide 6) - data controller is accountable for upholding data protection principles.</span></span><br></li></ul><p style="margin-right: 0in; margin-left: 22.5pt; margin-bottom: 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial; font-variant-ligatures: normal; font-variant-caps: normal; orphans: 2; text-align: start; widows: 2; -webkit-text-stroke-width: 0px; word-spacing: 0px;"><span class="highlight" style="background-color:white"><u><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Comments from Stephanie Perrin</span></span></span></u><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt"></span></span></span></span><br></p><ul type="disc"><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l8 level1 lfo10;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">One of the basic principles of data protection law is that processing needs to be fair and lawful.&nbsp;</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l8 level1 lfo10;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Fair = there need to be limits to the collection of PI. Collection needs to be focused on the purpose. Most common law countries, there has to be a legal mandate for a government department to collect data. This gets fuzzier in the private sector.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l8 level1 lfo10;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Private sector companies that are offering a service that is not mandatory, they can define what is relevant and gain consent. Notice and choice appears to have become the rule for Internet services, based on US practice.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l8 level1 lfo10;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">The restriction of collection of data to what is needed. Defining the purpose of collection is therefore fundamental.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l8 level1 lfo10;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">There are differences across countries with regards to data protection laws. and how some of these principles are applied. A good overview can be found here:<span class="apple-converted-space">&nbsp;</span><a href="https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2603502"><span class="colour" style="color:rgb(59, 115, 175)">https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2603502</span></a>.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l8 level1 lfo10;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">What is the purpose of ICANN in gathering personal information?</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l8 level1 lfo10;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Not arguing that potential uses are not appropriate or useful, but these potential uses for other purposes can be considered secondary use. This is not sufficient purpose for collection though.</span></span><br></li></ul><p style="margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial; font-variant-ligatures: normal; font-variant-caps: normal; orphans: 2; text-align: start; widows: 2; -webkit-text-stroke-width: 0px; word-spacing: 0px;"><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">&nbsp; &nbsp;b. Q&amp;A</span></span></span></span><br></p><ul type="disc"><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Q: Is ICANN the "data controller" in our world?&nbsp;&nbsp; Or is it the registries/registrars?&nbsp;&nbsp;</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">A: One view is that ICANN is the data controller, because it sets the RAA which defines collection, use and disclosure. Registrars and registries could be considered data processors WRT the data that ICANN tells them to collect and display, including all relevant policies. They are data controllers with respect to their own business operations, data they gather to sell other services for which ICANN does not set policy.&nbsp; So they are hybrid. It was pointed out that this issue was hotly debated during the EWG without reaching a conclusion.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">See Key Inputs section of wiki for A29 documents on concept of data controller and processor</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">See also chat dialog regarding application of the terms "data controller" and "data processor" to WHOIS data</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Q: What aspects of this apply to commercial entities?&nbsp; Would a commercial entity have the same right to privacy of their data as an individual data subject?&nbsp;&nbsp;</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">A: No. Privacy is a human right, linked to human beings (natural persons). There are discussions about this but for now no, only applies to human beings.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Q: For example, see WHOIS for domain name<span class="apple-converted-space">&nbsp;</span><a href="http://facebook.hu/"><span class="colour" style="color:rgb(59, 115, 175)">facebook.hu</span></a><span class="apple-converted-space">&nbsp;</span>- Has the Hungarian registry defined purposes for collecting this data? If so, could help us in our discussion for gTLDs.&nbsp;</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">A: Don't know if they have done so, or if they are compliant.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Q: Do these privacy principles just apply to Personally Identifiable Information (PII) or other types of information?&nbsp;</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">A: Yes - PII applies only to humans, and so human rights only apply to PII</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Q: Re: exemptions for protecting the data subject or the rights and freedoms of others - How do these exemptions apply to and inform our work in the RDS PDP?&nbsp;</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">A: Thousands of pages of case law of how courts have defined ways of striking a balance between contradicting rights. For example cases in Europe and also US - helpful but not absolute because future cases will also judge</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Re: commercial v personal data, it varies by jurisdiction whether employees of a company are considered to have rights to personal data (e.g., business card carve out). In for instance Germany you have to seek consent from employees before you put their name on the Internet.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Q: A lot of the arguments that took place in the PPSAI PDP examined needs of small organizations w/r/t protecting the privacy of data. But are those "other" privacy rights that apply to small organizations or data protection rights?&nbsp;</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">A: It depends - for example, volunteers may have data protection rights for their personal information.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">When it comes to ICANN and notice required of registrars to provide individuals when collecting registration data, do all registrars do this today? disclosure and obtaining consent ("a.k.a. notice and choice"?) is required under RAA 3.7.7.4 and 3.7.7.5.&nbsp; Registrars are required to "3.7.7.5 The Registered Name Holder shall consent to the data processing referred to in Subsection 3.7.7.4."</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Comment: the requirement wasn't to inform about rights, but to provide information sufficient to obtain "specific and informed consent of the subscriber ... prior to the inclusion of his personal data into all kinds of public directories (traditional telephony, mobile telephony, electronic mail, electronic signatures etc.) used for reverse or multi-criteria searches." Article 29 WP 33 Opinion 5/2000</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Q: Do we have a duty not to convey individual human rights to a commercial entity?&nbsp;</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">A: Spectrum of organizations (large, small...) but we need to deal with this. Many ccTLDs make a distinction between individual and commercial registrations (e.g., CIRA) Practices vary across ccTLDs and the jurisdictions in which they operate.&nbsp;</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">One view: Most ccTLD registries comply perfectly when it comes to personal data and data regulation/law in combination of whois output - at least in Europe</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Q: In WHOIS today, there is no formal method of distinguishing fields that contain personal data from fields that do not. Do we need to consider flagging the fields that contain personal data?&nbsp;</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">A: This certainly can be something this WG can consider when deliberating on policy or implementation guidance</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Shouldn't we be using privacy by design with we enter our deliberations?</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Q: Are there any of the "thin data" elements as we have discussed over the past few weeks considered PII?&nbsp;</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">A: One view: a small subset of thin data may not be considered personally identifiable because there's no name, address, or phone number - but if the data is traceable back to the individual, it may be considered "personal data." For example, if a timestamp links to an action that links to an individual, it's personal data - which is not to say that it cannot be disclosed. Becoming more of an issue w IoT - for example, refrigerator reporting activity may be linked to an individual's actions. See also file cabinet example.</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">"personal data" is a defined term in RAA "data about any identified or identifiable natural person."&nbsp;</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">See meeting handout for example of a "thin" WHOIS record data elements</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Sometimes depends on circumstance (e.g. IP address). European registries publish thin data and have gotten that vetted. Can this WG proceed without legal advice, whether reusing advice provided to thick data PDP or EWG, or seeking advice specific to this PDP</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Possible source of inspiration: "The principles have been drafted against a background of economies with separate policies that draw distinctions between data. Despite differences, framework has been drafted to ... apply to personal information which is information that can be used to identify an individual, including information which would not be personal alone but can be used in that way" (refer to transcript)</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Perhaps what we need to focus on is perhaps not whether data elements are personal data but rather look at each data element and decide whether it can be collected, whether it can be disclosed?</span></span><br></li><li class="MsoNormal" style="color:#333333;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo11;background:white"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Do we also need to balance the value of having this data disclosed for identified purposes?</span></span><br></li></ul><p style="margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial; font-variant-ligatures: normal; font-variant-caps: normal; orphans: 2; text-align: start; widows: 2; -webkit-text-stroke-width: 0px; word-spacing: 0px;"><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">&nbsp; &nbsp;c. Update on planning for Copenhagen session with Data Commissioners</span></span></span></span><br></p><p class="MsoListParagraph" style="text-indent: -0.25in; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Symbol"><span class="size" style="font-size:10pt"><span style="mso-list:Ignore">·<span class="font" style="font-family:&quot;Times New Roman&quot;"><span class="size" style="font-size:7pt">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span></span></span></span></span><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Session is planned on 13 March in Copenhagen during which data protection commissioners will debate these topics. Objective to have a better understanding of how privacy principles are interpreted by authorities and legislators.</span></span></span></span><br></p><p style="margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial; font-variant-ligatures: normal; font-variant-caps: normal; orphans: 2; text-align: start; widows: 2; -webkit-text-stroke-width: 0px; word-spacing: 0px;"><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">3. Begin deliberation on the Privacy charter question, starting with the following: (see&nbsp;&nbsp;<a href="https://community.icann.org/download/attachments/64064540/7FebMeeting-PrivacyForThinData-Handout.pdf?version=1&amp;modificationDate=1486398912000&amp;api=v2"><span class="colour" style="color:rgb(59, 115, 175)">meeting handout</span></a>)</span></span></span></span><br></p><p class="MsoListParagraph" style="text-indent: -0.25in; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Symbol"><span class="size" style="font-size:10pt"><span style="mso-list:Ignore">·<span class="font" style="font-family:&quot;Times New Roman&quot;"><span class="size" style="font-size:7pt">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span></span></span></span></span><i><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Question 4.1 (revised): For thin data only -- Do existing gTLD registration directory services policies sufficiently address compliance with applicable data protection, privacy, and free speech laws about purpose? If not, what requirements might those laws place on RDS policies regarding purposes associated with thin data?</span></span></span></i><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt"></span></span></span></span><br></p><p class="MsoListParagraph" style="text-indent: -0.25in; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Symbol"><span class="size" style="font-size:10pt"><span style="mso-list:Ignore">·<span class="font" style="font-family:&quot;Times New Roman&quot;"><span class="size" style="font-size:7pt">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span></span></span></span></span><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">See comments made under agenda item 2: Q&amp;A</span></span></span></span><br></p><p style="margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial; font-variant-ligatures: normal; font-variant-caps: normal; orphans: 2; text-align: start; widows: 2; -webkit-text-stroke-width: 0px; word-spacing: 0px;"><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">4. Information on planned dates for the RDS PDP WG meetings in Copenhagen:</span></span></span></span><br></p><p class="MsoListParagraph" style="text-indent: -0.25in; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Symbol"><span class="size" style="font-size:10pt"><span style="mso-list:Ignore">·<span class="font" style="font-family:&quot;Times New Roman&quot;"><span class="size" style="font-size:7pt">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span></span></span></span></span><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Saturday from 14.00 - 16.45 local time (main F2F) and</span></span></span></span><br></p><p class="MsoListParagraph" style="text-indent: -0.25in; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Symbol"><span class="size" style="font-size:10pt"><span style="mso-list:Ignore">·<span class="font" style="font-family:&quot;Times New Roman&quot;"><span class="size" style="font-size:7pt">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span></span></span></span></span><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Wednesday from 13.45 - 15.00 (secondary slot available)</span></span></span></span><br></p><p class="MsoListParagraph" style="text-indent: -0.25in; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Symbol"><span class="size" style="font-size:10pt"><span style="mso-list:Ignore">·<span class="font" style="font-family:&quot;Times New Roman&quot;"><span class="size" style="font-size:7pt">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span></span></span></span></span><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Remote participation will be available for those not being able to participate in person.</span></span></span></span><br></p><p style="margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial; font-variant-ligatures: normal; font-variant-caps: normal; orphans: 2; text-align: start; widows: 2; -webkit-text-stroke-width: 0px; word-spacing: 0px;"><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">5. Confirm action items and proposed decision points</span></span></span></span><br></p><p style="margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial; font-variant-ligatures: normal; font-variant-caps: normal; orphans: 2; text-align: start; widows: 2; -webkit-text-stroke-width: 0px; word-spacing: 0px;"><span class="highlight" style="background-color:white"><b><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Action:</span></span></span></b><span class="apple-converted-space"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">&nbsp;</span></span></span></span><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Leadership team to review today's discussion and identify points (if any) for confirmation in a poll or else continued deliberation in next week's call.</span></span></span></span><br></p><p style="margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial; font-variant-ligatures: normal; font-variant-caps: normal; orphans: 2; text-align: start; widows: 2; -webkit-text-stroke-width: 0px; word-spacing: 0px;"><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">6. Confirm next meeting date: Tuesday 14 February 2017 at 17.00 UTC</span></span></span></span><br></p><p class="p4" style="margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial; font-variant-ligatures: normal; font-variant-caps: normal; orphans: 2; text-align: start; widows: 2; -webkit-text-stroke-width: 0px; word-spacing: 0px;"><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">&nbsp;</span></span></span></span><br></p><p style="margin: 0in 0in 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><span class="highlight" style="background-color:white"><b><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">Meeting materials: <a href="https://community.icann.org/x/HIzRAw"><span style="font-weight:normal">https://community.icann.org/x/HIzRAw</span></a></span></span></span></b><b><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt"></span></span></b></span><br></p><p style="margin: 0in 0in 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><span class="highlight" style="background-color:white"><b><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">&nbsp;</span></span></span></b></span><br></p><p style="margin: 0in 0in 0.0001pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><span class="highlight" style="background-color:white"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:Arial, sans-serif"><span class="size" style="font-size:10.5pt">&nbsp;</span></span></span></span><br></p><p class="MsoNormal">&nbsp;<br></p></div></blockquote><div><br></div>