<html>
<body>
[I really wish that when a topic morphs, the Subject line be
adjusted!]<br><br>
GDPR is one set of rules (potentially with multiple interpretations by
the various privacy commissioners). Other jurisdictions may have other
rules, perhaps with stronger privacy, perhaps less. There is nothing to
say that one country might not set rules saying that all domain names
must have full (current) WHOIS information public, and we would have to
comply, allowing registrars/registries in that country to follow their
local law.<br><br>
Yes, it is an ugly world and such a rule may well cause
registrars/registries to set up business in that country, or NOT set up
business there. And registrants might select them or avoid them.<br><br>
Alan<br><br>
At 13/02/2018 08:57 AM, Volker Greimann wrote:<br><br>
<blockquote type=cite class=cite cite="">I am afraid that if we create
different policies for different regions, we will break the model,
encourage forum shopping and encourage firewalling of entire geographic
sections of the net. I hope that is not what we are doing here. <br><br>
GDPR will cause some breakage of this and I see it as our mission to fix
this breakage of the standard by proposing a unified model once again.
<br><br>
Ultimately, if this solution does what the EU has been asking for, e.g.
protect legitimate use cases of registration data as well as the rights
of the data subjects, there is no reason why it should not be universally
applicable. <br><br>
Best,<br><br>
Volker<br><br>
Am 13.02.2018 um 00:04 schrieb Chuck:<br>
<blockquote type=cite class=cite cite="">Volker,<br>
<br>
The WG could recommend policies that are ‘universally applicable to all
registrations’ but I seriously doubt that will happen in today’s
world. That would be much simpler than policies that vary by region
and users, but is it realistic?<br>
<br>
Chuck<br>
<br>
<b>From:</b> gnso-rds-pdp-wg
[<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org">
mailto:gnso-rds-pdp-wg-bounces@icann.org</a>] <b>On Behalf Of </b>Volker
Greimann<br>
<b>Sent:</b> Monday, February 12, 2018 2:30 PM<br>
<b>To:</b> Michael Palage
<a href="mailto:michael@palage.com"><michael@palage.com></a><br>
<b>Cc:</b>
<a href="mailto:gnso-rds-pdp-wg@icann.org">gnso-rds-pdp-wg@icann.org</a>
<br>
<b>Subject:</b> Re: [gnso-rds-pdp-wg] Legal basis vs. lawful<br>
<br>
Michael is right. ICANN iOS based on the thought of “One World; one
Internet”. This also means that the policies it creates should be
universally applicable to all registrations, if possible. IF we start
creating policy that diverges, that would only lead to further
fragmentation and undermine the founding ideal of ICANN itself. Our aim
should be to create one policy that can be applied to all or most
registrations and that can be implemented by all registrars alike. <br>
<br>
While we will likely have a certain amount of fragmentation following May
25 as each contracted party applies its own solution, it should be our
goal to overcome this and present a new unified policy that works for all
contracted parties. <br>
<br>
Volker<br>
<br>
<br><br>
<dl>
<dd>On 12. Feb 2018, at 20:27, Michael Palage
<<a href="mailto:michael@palage.com">michael@palage.com</a>>
wrote:
<dd>
<dd>Greg/John,
<dd>
<dd>I will respectfully push back on your legal over simplification of
the GDPR.
<dd>
<dd>The exterritorial aspect of the GDPR set forth in Article 3 is NOT
just limited to EU residents/citizens. As Michele has noted in the
past, the GDPR requires BlackKnight as an Irish legal entity to protect
all of its customers data (EU/Non-EU) in compliance with GDPR, as well as
US entities that target and conduct business within the EU.
<dd>
<dd>Now your points about the distinction between natural and legal
persons is a fair one and one that has been noted in EU and Art 29
communications. Could you please share the basis of your
proposition that 97% of all domain name registrations are registered by
legal entities.
<dd>
<dd>As I have note previously the long term viability of the ICANN
multi-stakeholder model is at risk as national governments continue to
pass national laws that impact the operation of the Internet.
However, the European Union is NOT alone in advancing Privacy
Legislation, in fact data localization is perhaps the next biggest
lurking threat to the domain name system.
<dd>
<dd>Best regards,
<dd>
<dd>Michael
<dd>
<dd>
<dd>
<dd>
<dd>
<dd>
<dd>From: gnso-rds-pdp-wg
[<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org">
mailto:gnso-rds-pdp-wg-bounces@icann.org</a>] On Behalf Of John Horton
via gnso-rds-pdp-wg
<dd>Sent: Monday, February 12, 2018 1:22 PM
<dd>To: Greg Aaron
<<a href="mailto:gca@icginc.com">gca@icginc.com</a>>
<dd>Cc:
<a href="mailto:gnso-rds-pdp-wg@icann.org">gnso-rds-pdp-wg@icann.org</a>
<dd>Subject: Re: [gnso-rds-pdp-wg] Legal basis vs. lawful
<dd>
<dd>I think Greg is right on. There's simply no justification to force a
law that is only intended to apply to a) EU residents/citizens that are
b) natural persons not using the domain name for commercial purposes, to
the remaining...what? 97% - 99% of the world's registrant population?
That would be a balanced way to implement all of this. <br>
<dd>John Horton
<dd>President and CEO, LegitScript
<dd>
<dd>Follow LegitScript:
<a href="http://www.linkedin.com/company/legitscript-com">LinkedIn</a>
|
<a href="https://www.facebook.com/LegitScript">Facebook</a> |
<a href="https://twitter.com/legitscript">Twitter</a> |
<a href="http://blog.legitscript.com/">Blog</a> |
<a href="http://go.legitscript.com/Subscription-Management.html">
Newsletter</a>
<dd>
<dd>
<dd>On Mon, Feb 12, 2018 at 9:57 AM, Greg Aaron
<<a href="mailto:gca@icginc.com">gca@icginc.com</a>> wrote:
<dl>
<dd>I don’t know if we arrive at the same place.
<dd>
<dd>GDPR is based on one principle. It states what is legal.
It's explicit about what you _are allowed to do_; granted there’s some
flexibility and room for interpretation. It’s like saying
what’s inside a box.
<dd>
<dd>U.S. law is one based on different principles. AFAIK U.S.
consumer protection law does not enumerate specifically what is
lawful. Instead it tends to state what is illegal, what you are
_not allowed to do_. It’s like saying what’s outside the
box. The U.S. doesn’t have something like GDPR that spells
out legal bases for collecting data, i.e. the enumerated allowable
reasons. Instead the trade and consumer protection laws basically
say: entities have the right to form contracts between themselves, they
should live up to the contract, don’t surprise people, don’t do
certain dishonest things.
<dd>
<dd>Here's the problem: if one makes the GDPR principle the ICANN
standard and you apply it to all registrations, then practices that are
allowable in one place under the law (like the U.S.) would no longer be
allowed there by ICANN policy. ICANN would be choosing one
legal approach or regime for everyone in the world.
<dd>
<dd>The alternative is to apply the GDRP only to those that it is
designed to protect: registrants in the EU.
<dd>
<dd>For example, there’s nothing in U.S. law that prohibits a U.S.
registrar from having a contract that says publication of full contact
data in WHOIS is a condition of registering a domain name if you
are a registrant in the U.S.
<dd>
<dd>See
<a href="https://iapp.org/news/a/explaining-the-gdpr-to-an-american/">
https://iapp.org/news/a/explaining-the-gdpr-to-an-american/</a> for
more.
<dd>
<dd>
<dd>
<dd>From: gnso-rds-pdp-wg
[<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org">
mailto:gnso-rds-pdp-wg-bounces@icann.org</a>] On Behalf Of Silver,
Bradley via gnso-rds-pdp-wg
<dd>Sent: Friday, February 9, 2018 2:54 PM
<dd>To: Volker Greimann
<<a href="mailto:vgreimann@key-systems.net">
vgreimann@key-systems.net</a>>;
<a href="mailto:gnso-rds-pdp-wg@icann.org">gnso-rds-pdp-wg@icann.org</a>
<br>
<dd>Subject: Re: [gnso-rds-pdp-wg] Legal basis vs. lawful
<dd>
<dd>It is true that the GDPR is prescriptive, although also rather
open-ended (hence our current pickle). But regardless of the term
we use, don’t we arrive at the same place: which is that if
something that requires a legal basis is done without one, it will be
unlawful? Using Kathy’s example, if data is processed without
complying with minimization or purpose principles, will such processing
not run afoul of the law, and hence be unlawful?
<dd>
<dd>There are important distinctions between the meaning of “legal
basis” which implies that a law requires something to be affirmatively
present, versus “lawful”, which means that something is not
prohibited by law. Ultimately though, isn’t “lawfulness”, the
same end point, regardless?
<dd>
<dd>From: gnso-rds-pdp-wg
[<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org">
mailto:gnso-rds-pdp-wg-bounces@icann.org</a>] On Behalf Of Volker
Greimann
<dd>Sent: Friday, February 09, 2018 11:27 AM
<dd>To:
<a href="mailto:gnso-rds-pdp-wg@icann.org">gnso-rds-pdp-wg@icann.org</a>
<dd>Subject: Re: [gnso-rds-pdp-wg] Legal basis vs. lawful
<dd>
<dd>I do not see how. Kathy's analysis seems sound. The flexibility
within the GDPR still only allows processing in very specific
cicumstances, all of which are listed in the GDPR.
<dd>
<dd>Am 09.02.2018 um 16:45 schrieb Victoria Sheckler:
<dl>
<dd>Kathy’s analysis breaks down on a practical level when one looks at
the GDPR and what it says about when data can be processed. The
GDPR allows for flexibility for what can be processed and when, and
kathy’s analysis overlooks that point.
<dd>
<dd>From: gnso-rds-pdp-wg
[<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org">
mailto:gnso-rds-pdp-wg-bounces@icann.org</a>] On Behalf Of Kathy Kleiman
<dd>Sent: Thursday, February 8, 2018 7:07 PM
<dd>To:
<a href="mailto:gnso-rds-pdp-wg@icann.org">gnso-rds-pdp-wg@icann.org</a>
<dd>Subject: Re: [gnso-rds-pdp-wg] Legal basis vs. lawful
<dd>
<dd>Tx for the invitation to join, Chuck, and following up on the
discussion of Sam and Tapani, let me add that criteria for processing
must be clearer than something broadly within ICANN's mission statement
and something permissible somewhere. The requirements under law are
express and concrete.
<dd>Specifically, GDPR Article 5(1)(b and c) states:
<dd>Personal data shall be:
<dd>2. "collected for specified, explicit and
legitimate purposes and not further processed in a manner that is
incompatible with those purposes" (the "purpose
limitation") AND
<dd>3. "adequate, relevant and limited to what is
necessary in relation to the purposes for which they are processed"
(the "data minimisation" requirement). [underline
added]<br>
<dd>Thus, our first criteria of "consistent with ICANN's
mission," is only the first step and we need to go further than even
the 3 criteria we are discussing..<br>
<dd>Second, lawful and legal enter us into a debate over words and I have
to agree with Sam and Tapani's analysis and let me add some of my own.
<br>
<dd>"Legal" is the term we use for actions expressly allowed
under law. How we process personal data under the GDRP falls into this
category -- of processing expressly allowed under law. Whereas the term
lawful is used for a much broader category of actions which are generally
permissible and allowable.<br><br>
<dd>The term "legal" is much more consistent with our criteria
statement because the processing of personal data by ICANN must clearly
have a valid legal basis as expressly defined by data protection laws.
<br>
<dd>Best regards,
<dd>Kathy <br>
<dd>On 2/7/2018 10:53 AM, Sam Lanfranco wrote:
<dl>
<dd>Thanks Tapani,
<dd>I will extract from your longer message.
<dd>I deliberately kept my brief and less technical.
<dd>I think we are in agreement here and I support your position.
<dd>On 2/7/2018 1:07 AM, Tapani Tarvainen wrote:<br>
<dd>The key distinction, as I understand it, is that "lawful"
would be
<dd> defined by the negative, everything that some law does not
prohibit,
<dd>where as "legal basis" is defined by the positive, only
things whose
<dd>justification can be explicitly derived from law. <br>
<dd> <......><br>
<dd>So I would prefer "legal basis" specifically in this sense:
that any processing
<dd> would have to be explicitly based on one of the criteria, or
bases, as listed
<dd>in GDPR Article 6, or similar explicit justification in other data
protection legislation. <br>
<br>
<br>
<br>
<br>
<br><br>
<dd><pre>_______________________________________________</pre><br>
<br>
<br><br>
<dd><pre>gnso-rds-pdp-wg mailing list</pre><br>
<br>
<br><br>
<dd><pre><a href="mailto:gnso-rds-pdp-wg@icann.org">
gnso-rds-pdp-wg@icann.org</a></pre><br>
<br>
<br><br>
<dd><pre>
<a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" eudora="autourl">
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg</a></pre>
</dl>
<dd>
<dd> <br>
<br><br>
<dd><pre>_______________________________________________</pre><br>
<br>
<br><br>
<dd><pre>gnso-rds-pdp-wg mailing list</pre><br>
<br>
<br><br>
<dd><pre><a href="mailto:gnso-rds-pdp-wg@icann.org">
gnso-rds-pdp-wg@icann.org</a></pre><br>
<br>
<br><br>
<dd><pre>
<a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" eudora="autourl">
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg</a></pre>
</dl>
<dd> <hr>
<b><i>
<dd>Reminder: Any email that requests your login credentials or that asks
you to click on a link could be a phishing attack. If you have any
questions regarding the authenticity of this email or its sender, please
contact the IT Service Desk at
<a href="tel:%28212%29%20484-6000">212.484.6000</a> or via email at
<a href="mailto:ITServices@timewarner.com">ITServices@timewarner.com</a>
<hr>
</i></b>
<dd>This message is the property of Time Warner Inc. and is intended only
for the use of the addressee(s) and may be legally privileged and/or
confidential. If the reader of this message is not the intended
recipient, or the employee or agent responsible to deliver it to the
intended recipient, he or she is hereby notified that any dissemination,
distribution, printing, forwarding, or any method of copying of this
information, and/or the taking of any action in reliance on the
information herein is strictly prohibited except by the intended
recipient or those to whom he or she intentionally distributes this
message. If you have received this communication in error, please
immediately notify the sender, and delete the original message and any
copies from your computer or storage system. Thank you.<br>
<dd>_______________________________________________
<dd>gnso-rds-pdp-wg mailing list
<dd><a href="mailto:gnso-rds-pdp-wg@icann.org">
gnso-rds-pdp-wg@icann.org</a>
<dd>
<a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" eudora="autourl">
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg</a><br><br>
</dl>
<dd>
<dd>_______________________________________________
<dd>gnso-rds-pdp-wg mailing list
<dd><a href="mailto:gnso-rds-pdp-wg@icann.org">
gnso-rds-pdp-wg@icann.org</a>
<dd>
<a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" eudora="autourl">
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg</a><br><br>
</dl> <br>
-- <br>
Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.<br><br>
Mit freundlichen Grüßen,<br><br>
Volker A. Greimann<br>
- Rechtsabteilung -<br><br>
Key-Systems GmbH<br>
Im Oberen Werk 1<br>
66386 St. Ingbert<br>
Tel.: +49 (0) 6894 - 9396 901<br>
Fax.: +49 (0) 6894 - 9396 851<br>
<a href="mailto:vgreimann@key-systems.net">Email:
vgreimann@key-systems.net</a><br><br>
Web: <a href="http://www.key-systems.net">www.key-systems.net</a> /
<a href="http://www.rrpproxy.net/" eudora="autourl">www.RRPproxy.net</a>
<br>
<a href="http://www.domaindiscount24.com">www.domaindiscount24.com</a> /
<a href="http://www.brandshelter.com/" eudora="autourl">
www.BrandShelter.com</a><br><br>
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:<br>
<a href="http://www.facebook.com/KeySystems">
www.facebook.com/KeySystems</a><br>
<a href="http://www.twitter.com/key_systems" eudora="autourl">
www.twitter.com/key_systems</a><br><br>
Geschäftsführer: Alexander Siffrin<br>
Handelsregister Nr.: HR B 18835 - Saarbruecken<br>
Umsatzsteuer ID.: DE211006534<br><br>
Member of the KEYDRIVE GROUP<br>
<a href="http://www.keydrive.lu">www.keydrive.lu</a><br><br>
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen
Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder
Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese
Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns
per E-Mail oder telefonisch in Verbindung zu setzen.<br><br>
--------------------------------------------<br><br>
Should you have any further questions, please do not hesitate to contact
us.<br><br>
Best regards,<br><br>
Volker A. Greimann<br>
- legal department -<br><br>
Key-Systems GmbH<br>
Im Oberen Werk 1<br>
66386 St. Ingbert<br>
Tel.: +49 (0) 6894 - 9396 901<br>
Fax.: +49 (0) 6894 - 9396 851<br>
Email:
<a href="mailto:vgreimann@key-systems.net">vgreimann@key-systems.net</a>
<br><br>
Web: <a href="http://www.key-systems.net">www.key-systems.net</a> /
<a href="http://www.rrpproxy.net/" eudora="autourl">www.RRPproxy.net</a>
<br>
<a href="http://www.domaindiscount24.com">www.domaindiscount24.com</a> /
<a href="http://www.brandshelter.com/" eudora="autourl">
www.BrandShelter.com</a><br><br>
Follow us on Twitter or join our fan community on Facebook and stay
updated:<br>
<a href="http://www.facebook.com/KeySystems">
www.facebook.com/KeySystems</a><br>
<a href="http://www.twitter.com/key_systems" eudora="autourl">
www.twitter.com/key_systems</a><br><br>
CEO: Alexander Siffrin<br>
Registration No.: HR B 18835 - Saarbruecken<br>
V.A.T. ID.: DE211006534<br><br>
Member of the KEYDRIVE GROUP<br>
<a href="http://www.keydrive.lu">www.keydrive.lu</a><br><br>
This e-mail and its attachments is intended only for the person to whom
it is addressed. Furthermore it is not permitted to publish any content
of this email. You must not use, disclose, copy, print or rely on this
e-mail. If an addressing or transmission error has misdirected this
e-mail, kindly notify the author by replying to this e-mail or contacting
us by telephone.<br>
</blockquote><br>
Content-Type: text/plain; charset="us-ascii"<br>
Content-Transfer-Encoding: 7bit<br>
Content-Disposition: inline<br>
X-Microsoft-Exchange-Diagnostics:<br>
<x-tab> </x-tab>
1;YQXPR0101MB1589;27:Ga5LygSUnZxLRDrrqk26gs5xsZiIqS2xtjalNER59Ud7uLFPiggPCUE2uiZiMk37t9ofGXJiL1NeDtvz55qfniYXPIdMKek/EzfmmNEbt/8FtMaChTQPkmFvWu6iXTv8<br>
X-Microsoft-Antispam-Message-Info:<br>
<x-tab> </x-tab>
D43nmLDk/koUDJeAVxvI/mzQMGHvTT63oiYllZXniJgNGrJYX7hCbjyL8SNcS6GMmx7y0ldDyrx/dMoI+gm2owNCs3Zeo9FPmotTLqYVxm0xqLkMIqGeNiYAwg3GBxVhTsZWAA9nbomAVBGQDILNYQ==<br>
<br>
_______________________________________________<br>
gnso-rds-pdp-wg mailing list<br>
gnso-rds-pdp-wg@icann.org<br>
<a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" eudora="autourl">
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg</a></blockquote>
</body>
</html>