<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Lucida Grande";
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><a name="_MailEndCompose"><span style="color:#1F497D">There’s one point in Milton’s blog post (referencing text from the Hamilton memo) that I’d like to address:<o:p></o:p></span></a></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailEndCompose"><span style="color:#1F497D"><o:p> </o:p></span></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailEndCompose"><span style="color:#1F497D">“The report concludes that “it will not be practically feasible to fulfill the purposes listed under this section 2.7 through a layered access model” because such a
model, to comply with Article 6.1(f) GDPR, would require registrars to assess the status and interests of people requesting access on a case-by-case basis each time a request is made.”<o:p></o:p></span></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailEndCompose"><span style="color:#1F497D"><o:p> </o:p></span></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailEndCompose"><span style="color:#1F497D">This is true if one makes certain assumptions about how end-user identification and authorization processing is performed. It’s true if we try to do it using user names
and passwords issued by RDDS service providers, and I agree with the assessment that this kind of approach won’t work very well. Consequently, since 2015 I’ve been working on an OAuth-based mechanism for RDAP that will allow registrars and registries to make
access control and authorization decisions based on claims made by recognized (and maybe even accredited) identity providers who identify and authenticate requestors. The task of assessing “the status and interests of people requesting access” is shifted to
an entity that knows enough about these end-users to reliably perform that task well in advance of queries being sent. Access can then be granted based on the intersection of policy and requestor status/interest.<o:p></o:p></span></span></p>
<p class="MsoNormal"><span style="mso-bookmark:_MailEndCompose"><span style="color:#1F497D"><o:p> </o:p></span></span></p>
<div>
<p class="MsoNormal"><span style="mso-bookmark:_MailEndCompose"><span style="color:#1F497D">Scott<o:p></o:p></span></span></p>
</div>
<p class="MsoNormal"><span style="mso-bookmark:_MailEndCompose"><span style="color:#1F497D"><o:p> </o:p></span></span></p>
<span style="mso-bookmark:_MailEndCompose"></span>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:windowtext">From:</span></b><span style="color:windowtext"> gnso-rds-pdp-wg [mailto:gnso-rds-pdp-wg-bounces@icann.org]
<b>On Behalf Of </b>Stephanie Perrin<br>
<b>Sent:</b> Saturday, January 27, 2018 11:30 PM<br>
<b>To:</b> gnso-rds-pdp-wg@icann.org<br>
<b>Subject:</b> [EXTERNAL] [gnso-rds-pdp-wg] Purposes<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p><span style="font-size:13.5pt;font-family:"Lucida Grande",serif">For those interested in an analysis of the problem Hamilton has run into in trying to determine legitimate purposes for processing (our topic this week), Milton Mueller has a blog...https://www.internetgovernance.org/2018/01/25/looming-battle-gdpr-purpose-whois-icann/</span><o:p></o:p></p>
<p><span style="font-size:13.5pt;font-family:"Lucida Grande",serif">cheers Stephanie Perrin</span><o:p></o:p></p>
</div>
</div>
</body>
</html>