<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
No but they will be the ones punished for other stakeholders decisions first of any<br class="">
<div class="">
<div class=""><span class="Apple-style-span" style=" border-collapse: separate; border-spacing: 0px;">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">--</div>
<div class="">Med vänliga hälsningar / Kind Regards / Med vennlig hilsen</div>
</div>
</span><span class="Apple-style-span" style=" orphans: 2; text-align: -webkit-auto; widows: 2; border-collapse: separate; border-spacing: 0px;">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
</div>
</span><span class="Apple-style-span" style=" orphans: 2; text-align: -webkit-auto; widows: 2; border-collapse: separate; border-spacing: 0px;">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class=""><br class="">
Benny Samuelsen<br class="">
Registry Manager - Domainexpert<br class="">
<br class="">
Nordreg AB - ICANN accredited registrar</div>
<div class="">IANA-ID: 638</div>
</div>
</span><span class="Apple-style-span" style=" orphans: 2; text-align: -webkit-auto; widows: 2; border-collapse: separate; border-spacing: 0px;">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Phone: +46.42197000<br class="">
Direct: +47.32260201<br class="">
Mobile: +47.40410200</div>
</span></div>
</div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">On 13 Feb 2018, at 17:23, Dotzero <<a href="mailto:dotzero@gmail.com" class="">dotzero@gmail.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class="">
<div class="">
<div class="">Volcker,<br class="">
<br class="">
</div>
Registrars are not the only constituency with a stake in this. <br class="">
<br class="">
</div>
Michael Hammer<br class="">
</div>
<div class="gmail_extra"><br class="">
<div class="gmail_quote">On Tue, Feb 13, 2018 at 11:13 AM, Volker Greimann <span dir="ltr" class="">
<<a href="mailto:vgreimann@key-systems.net" target="_blank" class="">vgreimann@key-systems.net</a>></span> wrote:<br class="">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF" class="">
<p class="">Hi Mike,</p>
<p class="">no, sensible because a great number of registrars will be forced to deal with this anyway, because this will affect a great many of registrations and therefore it makes sense to take this as a basis. Of course we will then need to see if there need
to be tweaks to accomodate for other jurisdictions, but as more as more countries are adopting similar regimes....</p>
<p class="">Sure it will be more restrictive than open access and some people may have a harder time than today getting at certain information, but with tiered access access would still be possible for those with overriding legitimate interests. That is the
model the EU commission hinted at. Not the only model, but a working one.<span class="HOEnZb"><font color="#888888" class=""><br class="">
</font></span></p>
<span class="HOEnZb"><font color="#888888" class="">
<p class="">Volker<br class="">
</p>
</font></span>
<div class="">
<div class="h5"><br class="">
<div class="m_-5981583062905781775moz-cite-prefix">Am 13.02.2018 um 17:04 schrieb Dotzero:<br class="">
</div>
<blockquote type="cite" class="">
<div dir="ltr" class="">
<div class="">Volker, you assert that "it would be sensible to take GDPR as a basis and start from there". Perhaps sensible from your perspective and easier from your perspective but ICANN is an international organization - primarily dealing with technical/administrative
issues - and it MUST take an approach that, as best it can, accommodates the laws and practices of various jurisdictions around the world. Your proposed approach, quite simply does not do that.<br class="">
<br class="">
</div>
Michael Hammer<br class="">
</div>
<div class="gmail_extra"><br class="">
<div class="gmail_quote">On Tue, Feb 13, 2018 at 10:54 AM, Volker Greimann <span dir="ltr" class="">
<<a href="mailto:vgreimann@key-systems.net" target="_blank" class="">vgreimann@key-systems.net</a>></span> wrote:<br class="">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF" class="">
<p class="">I think that it would be sensible to take the GDPR as a basis and start from there. Obviously, where it conflicts with other applicable laws, we should make sure to accomodate those as well, but as the EU Commission and others have pointed out is
that compliance with GDPR does not preclude providing certain access levels to certain parties. What those levels would be and who those parties could be should be the main focus of our work.
<br class="">
</p>
<div class="">
<div class="m_-5981583062905781775h5"><br class="">
<div class="m_-5981583062905781775m_692055522894869952moz-cite-prefix">Am 13.02.2018 um 15:41 schrieb Chuck:<br class="">
</div>
<blockquote type="cite" class="">
<div class="m_-5981583062905781775m_692055522894869952WordSection1">
<p class="MsoNormal"><span style="color:windowtext" class="">Volker,</span></p>
<div class=""><span style="color:windowtext" class=""> </span><br class="webkit-block-placeholder">
</div>
<p class="MsoNormal"><span style="color:windowtext" class="">Are you saying that you think that RDS policies should be designed to comply with European regulations and then applied to all other jurisdictions in the world?</span></p>
<div class=""><span style="color:windowtext" class=""> </span><br class="webkit-block-placeholder">
</div>
<p class="MsoNormal"><span style="color:windowtext" class="">Chuck</span></p>
<div class=""><span style="color:windowtext" class=""> </span><br class="webkit-block-placeholder">
</div>
<div class="">
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0in 0in 0in" class="">
<p class="MsoNormal"><b class=""><span style="color:windowtext" class="">From:</span></b><span style="color:windowtext" class=""> Volker Greimann [<a class="m_-5981583062905781775m_692055522894869952moz-txt-link-freetext" href="mailto:vgreimann@key-systems.net" target="_blank">mailto:vgreimann@key-systems.<wbr class="">net</a>]
<br class="">
<b class="">Sent:</b> Tuesday, February 13, 2018 5:58 AM<br class="">
<b class="">To:</b> Chuck <a class="m_-5981583062905781775m_692055522894869952moz-txt-link-rfc2396E" href="mailto:consult@cgomes.com" target="_blank">
<consult@cgomes.com></a>; 'Michael Palage' <a class="m_-5981583062905781775m_692055522894869952moz-txt-link-rfc2396E" href="mailto:michael@palage.com" target="_blank">
<michael@palage.com></a><br class="">
<b class="">Cc:</b> <a class="m_-5981583062905781775m_692055522894869952moz-txt-link-abbreviated" href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank">
gnso-rds-pdp-wg@icann.org</a><br class="">
<b class="">Subject:</b> Re: [gnso-rds-pdp-wg] Legal basis vs. lawful</span></p>
</div>
</div>
<div class=""> <br class="webkit-block-placeholder">
</div>
<p class="">I am afraid that if we create different policies for different regions, we will break the model, encourage forum shopping and encourage firewalling of entire geographic sections of the net. I hope that is not what we are doing here.
</p>
<p class="">GDPR will cause some breakage of this and I see it as our mission to fix this breakage of the standard by proposing a unified model once again.
</p>
<p class="">Ultimately, if this solution does what the EU has been asking for, e.g. protect legitimate use cases of registration data as well as the rights of the data subjects, there is no reason why it should not be universally applicable.
</p>
<p class="">Best,</p>
<p class="">Volker</p>
<div class=""> <br class="webkit-block-placeholder">
</div>
<div class="">
<p class="MsoNormal">Am 13.02.2018 um 00:04 schrieb Chuck:</p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt" class="">
<p class="MsoNormal">Volker,</p>
<div class=""> <br class="webkit-block-placeholder">
</div>
<p class="MsoNormal">The WG could recommend policies that are ‘universally applicable to all registrations’ but I seriously doubt that will happen in today’s world. That would be much simpler than policies that vary by region and users, but is it realistic?</p>
<div class=""> <br class="webkit-block-placeholder">
</div>
<p class="MsoNormal">Chuck</p>
<div class=""> <br class="webkit-block-placeholder">
</div>
<div class="">
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0in 0in 0in" class="">
<p class="MsoNormal"><b class="">From:</b> gnso-rds-pdp-wg [<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org" target="_blank" class="">mailto:gnso-rds-pdp-wg-bounce<wbr class="">s@icann.org</a>]
<b class="">On Behalf Of </b>Volker Greimann<br class="">
<b class="">Sent:</b> Monday, February 12, 2018 2:30 PM<br class="">
<b class="">To:</b> Michael Palage <a href="mailto:michael@palage.com" target="_blank" class="">
<michael@palage.com></a><br class="">
<b class="">Cc:</b> <a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" class="">
gnso-rds-pdp-wg@icann.org</a><br class="">
<b class="">Subject:</b> Re: [gnso-rds-pdp-wg] Legal basis vs. lawful</p>
</div>
</div>
<div class=""> <br class="webkit-block-placeholder">
</div>
<p class="MsoNormal">Michael is right. ICANN iOS based on the thought of “One World; one Internet”. This also means that the policies it creates should be universally applicable to all registrations, if possible. IF we start creating policy that diverges, that
would only lead to further fragmentation and undermine the founding ideal of ICANN itself. Our aim should be to create one policy that can be applied to all or most registrations and that can be implemented by all registrars alike. </p>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal">While we will likely have a certain amount of fragmentation following May 25 as each contracted party applies its own solution, it should be our goal to overcome this and present a new unified policy that works for all contracted parties. </p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal">Volker</p>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
<div class="">
<p class="MsoNormal"><br class="">
<br class="">
<br class="">
</p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt" class="">
<div class="">
<p class="MsoNormal">On 12. Feb 2018, at 20:27, Michael Palage <<a href="mailto:michael@palage.com" target="_blank" class="">michael@palage.com</a>> wrote:</p>
</div>
<div class=""> <br class="webkit-block-placeholder">
</div>
<div class="">
<div class="">
<p class="MsoNormal">Greg/John,</p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal">I will respectfully push back on your legal over simplification of the GDPR.</p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal">The exterritorial aspect of the GDPR set forth in Article 3 is NOT just limited to EU residents/citizens. As Michele has noted in the past, the GDPR requires BlackKnight as an Irish legal entity to protect all of its customers data (EU/Non-EU)
in compliance with GDPR, as well as US entities that target and conduct business within the EU.</p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal">Now your points about the distinction between natural and legal persons is a fair one and one that has been noted in EU and Art 29 communications. Could you please share the basis of your proposition that 97% of all domain name registrations
are registered by legal entities.<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span></p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal">As I have note previously the long term viability of the ICANN multi-stakeholder model is at risk as national governments continue to pass national laws that impact the operation of the Internet. However, the European Union is NOT alone
in advancing Privacy Legislation, in fact data localization is perhaps the next biggest lurking threat to the domain name system. <span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span></p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal">Best regards,</p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal">Michael</p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal"><b class="">From:</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span>gnso-rds-pdp-wg [<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org" target="_blank" class="">mailto:gnso-rds-pdp-wg-bounce<wbr class="">s@icann.org</a>]<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><b class="">On
Behalf Of<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span></b>John Horton via gnso-rds-pdp-wg<br class="">
<b class="">Sent:</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span>Monday, February 12, 2018 1:22 PM<br class="">
<b class="">To:</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span>Greg Aaron <<a href="mailto:gca@icginc.com" target="_blank" class="">gca@icginc.com</a>><br class="">
<b class="">Cc:</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" class="">gnso-rds-pdp-wg@icann.org</a><br class="">
<b class="">Subject:</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span>Re: [gnso-rds-pdp-wg] Legal basis vs. lawful</p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<div class="">
<div class="">
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:#444444" class="">I think Greg is right on. There's simply no justification to force a law that is only intended to apply to a) EU residents/citizens that are b) natural persons not using
the domain name for commercial purposes, to the remaining...what? 97% - 99% of the world's registrant population? That would be a balanced way to implement all of this. </span></p>
</div>
</div>
</div>
<div class="">
<div class="">
<p class="MsoNormal"><br clear="all" class="">
</p>
</div>
<div class="">
<div class="">
<div class="">
<div class="">
<div class="">
<div class="">
<div class="">
<div class="">
<div class="">
<div class="">
<div class="">
<div class="">
<div class="">
<div class="">
<div class="">
<div class="">
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:#073763" class="">John Horton<br class="">
President and CEO, LegitScript</span></p>
</div>
<div class="">
<div class="">
<p class="MsoNormal"><img style="width:1.0in;height:.375in" id="m_-5981583062905781775m_692055522894869952_x0000_i1025" src="https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&revid=0B13GfLt8zwZJSG9zOUVwN1lFKzFrRVlnaWU0NGZ4RmdkUjg4PQ" width="96" height="36" border="0" class=""></p>
</div>
<div class="">
<div class="">
<div class=""><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif" class=""> </span><br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal"><b class=""><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#444444" class="">Follow</span></b><b class=""><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#0b5394" class=""> </span></b><b class=""><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif" class="">Legit</span></b><b class=""><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#0b5394" class="">Script</span></b><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif" class="">: <a href="http://www.linkedin.com/company/legitscript-com" target="_blank" class=""><span style="color:#cc0000" class="">LinkedIn</span></a>
| <a href="https://www.facebook.com/LegitScript" target="_blank" class=""><span style="color:#6aa84f" class="">Facebook</span></a> | <a href="https://twitter.com/legitscript" target="_blank" class=""><span style="color:#674ea7" class="">Twitter</span></a>
| </span><u class=""><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#ff9900" class=""><a href="http://blog.legitscript.com/" target="_blank" class=""><span style="color:#1155cc" class="">Blog</span></a></span></u><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif" class=""> |</span><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#ff9900" class=""> <a href="http://go.legitscript.com/Subscription-Management.html" target="_blank" class=""><span style="color:#ff9900" class="">Newsletter</span></a></span></p>
</div>
<div class="">
<div class=""><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif" class=""> </span><br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#ff9900" class=""><img style="width:.4791in;height:1.0in" id="m_-5981583062905781775m_692055522894869952_x0000_i1026" src="https://www.legitscript.com/wp-content/uploads/2015/09/LegitScript-Workplace.png" width="46" height="96" border="0" class=""><img style="width:.4895in;height:1.0104in" id="m_-5981583062905781775m_692055522894869952_x0000_i1027" src="https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJTmNWbmcwOTVJMXc&revid=0B13GfLt8zwZJQlZWOXVGbG9acC9nRGhzdEkxclFJVytCWVNjPQ" width="47" height="97" border="0" class=""></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<div class="">
<p class="MsoNormal">On Mon, Feb 12, 2018 at 9:57 AM, Greg Aaron <<a href="mailto:gca@icginc.com" target="_blank" class=""><span style="color:purple" class="">gca@icginc.com</span></a>> wrote:</p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt" class="">
<div class="">
<div class="">
<div class="">
<p class="MsoNormal">I don’t know if we arrive at the same place. <span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span></p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal">GDPR is based on one principle. It states what is legal. It's explicit about what you _are allowed to do_; granted there’s some flexibility and room for interpretation. It’s like saying what’s inside a box.</p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal">U.S. law is one based on different principles. AFAIK U.S. consumer protection law does not enumerate specifically what is lawful. Instead it tends to state what is illegal, what you are _not allowed to do_. It’s like saying what’s outside
the box. The U.S. doesn’t have something like GDPR that spells out legal bases for collecting data, i.e. the enumerated allowable reasons. Instead the trade and consumer protection laws basically say: entities have the right to form contracts between themselves,
they should live up to the contract, don’t surprise people, don’t do certain dishonest things. <span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span></p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal">Here's the problem: if one makes the GDPR principle the ICANN standard and you apply it to all registrations, then practices that are allowable in one place under the law (like the U.S.) would no longer be allowed there by ICANN policy.
ICANN would be choosing one legal approach or regime for everyone in the world. <span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span></p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal">The alternative is to apply the GDRP only to those that it is designed to protect: registrants in the EU.</p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal">For example, there’s nothing in U.S. law that prohibits a U.S. registrar from having a contract that says publication of full contact data in WHOIS is a condition of registering a domain name if you are a registrant in the U.S.</p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal">See<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><a href="https://iapp.org/news/a/explaining-the-gdpr-to-an-american/" target="_blank" class=""><span style="color:purple" class="">https://iapp.org/news/a/ex<wbr class="">plaining-the-gdpr-to-an-americ<wbr class="">an/</span></a>
for more.</p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0in 0in 0in" class="">
<div class="">
<p class="MsoNormal"><b class="">From:</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span>gnso-rds-pdp-wg [<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org" target="_blank" class=""><span style="color:purple" class="">mailto:gnso-rds-pdp-wg-bounce<wbr class="">s@icann.org</span></a>]<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><b class="">On
Behalf Of<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span></b>Silver, Bradley via gnso-rds-pdp-wg<br class="">
<b class="">Sent:</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span>Friday, February 9, 2018 2:54 PM<br class="">
<b class="">To:</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span>Volker Greimann <<a href="mailto:vgreimann@key-systems.net" target="_blank" class=""><span style="color:purple" class="">vgreimann@key-systems.net</span></a>>;<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" class=""><span style="color:purple" class="">g<wbr class="">nso-rds-pdp-wg@icann.org</span></a></p>
</div>
<div class="">
<div class="">
<div class="">
<p class="MsoNormal"><br class="">
<b class="">Subject:</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span>Re: [gnso-rds-pdp-wg] Legal basis vs. lawful</p>
</div>
</div>
</div>
</div>
</div>
<div class="">
<div class="">
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal"><span style="color:#1f497d" class="">It is true that the GDPR is prescriptive, although also rather open-ended (hence our current pickle). But regardless of the term we use, don’t we arrive at the same place: which is that if something
that requires a legal basis is done without one, it will be unlawful? Using Kathy’s example, if data is processed without complying with minimization or purpose principles, will such processing not run afoul of the law, and hence be unlawful? <span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span></span></p>
</div>
<div class="">
<div class=""><span style="color:#1f497d" class=""> </span><br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal"><span style="color:#1f497d" class="">There are important distinctions between the meaning of “legal basis” which implies that a law requires something to be affirmatively present, versus “lawful”, which means that something is not prohibited
by law. Ultimately though, isn’t “lawfulness”, the same end point, regardless? <span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span></span></p>
</div>
<div class="">
<div class=""><span style="color:#1f497d" class=""> </span><br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in" class="">
<div class="">
<p class="MsoNormal"><b class=""><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif" class="">From:</span></b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif" class=""> </span></span><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif" class="">gnso-rds-pdp-wg
[</span><a href="mailto:gnso-rds-pdp-wg-bounces@icann.org" target="_blank" class=""><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:purple" class="">mailto:gnso-rds-pdp-wg-bounce<wbr class="">s@icann.org</span></a><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif" class="">]<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><b class="">On
Behalf Of<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span></b>Volker Greimann<br class="">
<b class="">Sent:</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span>Friday, February 09, 2018 11:27 AM<br class="">
<b class="">To:</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span></span><a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" class=""><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:purple" class="">gnso-rds-pdp-wg@icann.org</span></a><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif" class=""><br class="">
<b class="">Subject:</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span>Re: [gnso-rds-pdp-wg] Legal basis vs. lawful</span></p>
</div>
</div>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif" class="">I do not see how. Kathy's analysis seems sound. The flexibility within the GDPR still only allows processing in very specific cicumstances, all of which are listed
in the GDPR.</span></p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<div class="">
<p class="MsoNormal">Am 09.02.2018 um 16:45 schrieb Victoria Sheckler:</p>
</div>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt" class="">
<div class="">
<p class="MsoNormal">Kathy’s analysis breaks down on a practical level when one looks at the GDPR and what it says about when data can be processed. The GDPR allows for flexibility for what can be processed and when, and kathy’s analysis overlooks that point.</p>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0in 0in 0in" class="">
<div class="">
<p class="MsoNormal"><b class="">From:</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span>gnso-rds-pdp-wg [<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org" target="_blank" class=""><span style="color:purple" class="">mailto:gnso-rds-pdp-wg-bounce<wbr class="">s@icann.org</span></a>]<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><b class="">On
Behalf Of<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span></b>Kathy Kleiman<br class="">
<b class="">Sent:</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span>Thursday, February 8, 2018 7:07 PM<br class="">
<b class="">To:</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" class=""><span style="color:purple" class="">gnso-rds-pdp-wg@icann.org</span></a><br class="">
<b class="">Subject:</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span>Re: [gnso-rds-pdp-wg] Legal basis vs. lawful</p>
</div>
</div>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div class="">
<p class="MsoNormal">Tx for the invitation to join, Chuck, and following up on the discussion of Sam and Tapani, let me add that criteria for processing must be clearer than something broadly within ICANN's mission statement and something permissible somewhere.
The requirements under law are express and concrete.<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span></p>
</div>
<div class="">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif" class="">Specifically, GDPR Article 5(1)(b and c) states:</span></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><b class="">Personal data shall be:<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><br class="">
2. "collected for<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><u class="">specified, explicit and legitimate purposes<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span></u>and not
further processed in a manner that is incompatible with those purposes"</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span>(the "purpose limitation") AND<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><b class=""><br class="">
3. "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed"</b><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span>(the "data minimisation" requirement). [underline
added]<b class=""><br class="">
</b><br class="">
Thus, our first criteria of "consistent with ICANN's mission," is only the first step and we need to go further than even the 3 criteria we are discussing..<br class="">
<br class="">
Second, lawful and legal enter us into a debate over words and I have to agree with Sam and Tapani's analysis and let me add some of my own.<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><br class="">
<br class="">
"Legal" is the term we use for actions expressly allowed under law. How we process personal data under the GDRP falls into this category -- of processing expressly allowed under law. Whereas the term lawful is used for a much broader category of actions which
are generally permissible and allowable.<br class="">
<br class="">
The term "legal" is much more consistent with our criteria statement because the processing of personal data by ICANN must clearly have a<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><i class="">valid legal basis</i><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span>as
expressly defined by data protection laws.<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><br class="">
<br class="">
Best regards,<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><br class="">
Kathy<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><br class="">
<br class="">
On 2/7/2018 10:53 AM, Sam Lanfranco wrote:</p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt" class="">
<div class="">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif" class="">Thanks Tapani,</span></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">I will extract from your longer message.<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><br class="">
I deliberately kept my brief and less technical.<br class="">
I think we are in agreement here and I support your position.</p>
<div class="">
<div class="">
<p class="MsoNormal"><span style="color:#660000" class="">On 2/7/2018 1:07 AM, Tapani Tarvainen wrote:<br class="">
<br class="">
The key distinction, as I understand it, is that "lawful" would be<br class="">
defined by the negative, everything that some law does not prohibit,<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span></span></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="color:#660000" class="">where as "legal basis" is defined by the positive, only things whose<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><br class="">
justification can be explicitly derived from law.<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><br class="">
<br class="">
<......><br class="">
<br class="">
So I would prefer "legal basis" specifically in this sense: that any processing<br class="">
would have to be explicitly based on one of the criteria, or bases, as listed<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><br class="">
in GDPR Article 6, or similar explicit justification in other data protection legislation.<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><br class="">
<br class="">
</span><br class="">
<br class="">
<br class="">
<br class="">
</p>
<pre class="">______________________________<wbr class="">_________________</pre>
<pre class="">gnso-rds-pdp-wg mailing list</pre>
<pre class=""><a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" class=""><span style="color:purple" class="">gnso-rds-pdp-wg@icann.org</span></a></pre>
<pre class=""><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__mm.icann.org_mailman_listinfo_gnso-2Drds-2Dpdp-2Dwg&d=DwMDaQ&c=tq9bLrSQ8zIr87VusnUS92RmR2KtbW6AiQIx78dtRmA&r=TAA3GKe6tpWdv3RbCks6TRrjaTx9d0J3KzemA65KYpA&m=fOG1O9n2_DhDKrVj0wrojDKlYIsDeLHzwtDlEi-f9Ng&s=GditP_BvWvjE7xFIYot7e5akySiL4RPKaCgA_X_fyTE&e=" target="_blank" class=""><span style="color:purple" class="">https://mm.icann.org/mailman/l<wbr class="">istinfo/gnso-rds-pdp-wg</span></a></pre>
</blockquote>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
<div style="margin-bottom: 12pt;" class=""><span class=""> </span><br class="webkit-block-placeholder">
</div>
<pre class="">______________________________<wbr class="">_________________</pre>
<pre class="">gnso-rds-pdp-wg mailing list</pre>
<pre class=""><a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" class=""><span style="color:purple" class="">gnso-rds-pdp-wg@icann.org</span></a></pre>
<pre class=""><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__mm.icann.org_mailman_listinfo_gnso-2Drds-2Dpdp-2Dwg&d=DwMDaQ&c=tq9bLrSQ8zIr87VusnUS92RmR2KtbW6AiQIx78dtRmA&r=TAA3GKe6tpWdv3RbCks6TRrjaTx9d0J3KzemA65KYpA&m=fOG1O9n2_DhDKrVj0wrojDKlYIsDeLHzwtDlEi-f9Ng&s=GditP_BvWvjE7xFIYot7e5akySiL4RPKaCgA_X_fyTE&e=" target="_blank" class=""><span style="color:purple" class="">https://mm.icann.org/mailman/l<wbr class="">istinfo/gnso-rds-pdp-wg</span></a></pre>
</blockquote>
<div class="">
<div class=""><span class=""> </span><br class="webkit-block-placeholder">
</div>
</div>
<div class="MsoNormal" style="text-align:center" align="center"><span class="">
<hr align="center" width="100%" size="2" class="">
</span></div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:12.0pt" class=""><br class="">
<b class=""><i class=""><br class="">
Reminder: Any email that requests your login credentials or that asks you to click on a link could be a phishing attack. If you have any questions regarding the authenticity of this email or its sender, please contact the IT Service Desk at<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span><a href="tel:%28212%29%20484-6000" target="_blank" class=""><span style="color:purple" class="">212.484.6000</span></a><span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span>or
via email at<span class="m_-5981583062905781775m_692055522894869952apple-converted-space"> </span></i></b></span><a href="mailto:ITServices@timewarner.com" target="_blank" class=""><b class=""><i class=""><span style="font-size:12.0pt" class="">ITServices@timewarner.com</span></i></b></a></p>
<div class="MsoNormal" style="text-align:center" align="center">
<hr align="center" width="100%" size="2" class="">
</div>
<div class="">
<p class="MsoNormal">This message is the property of Time Warner Inc. and is intended only for the use of the addressee(s) and may be legally privileged and/or confidential. If the reader of this message is not the intended recipient, or the employee or agent
responsible to deliver it to the intended recipient, he or she is hereby notified that any dissemination, distribution, printing, forwarding, or any method of copying of this information, and/or the taking of any action in reliance on the information herein
is strictly prohibited except by the intended recipient or those to whom he or she intentionally distributes this message. If you have received this communication in error, please immediately notify the sender, and delete the original message and any copies
from your computer or storage system. Thank you.</p>
</div>
</div>
</div>
</div>
</div>
<div class="">
<p class="MsoNormal"><br class="">
______________________________<wbr class="">_________________<br class="">
gnso-rds-pdp-wg mailing list<br class="">
<a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" class=""><span style="color:purple" class="">gnso-rds-pdp-wg@icann.org</span></a><br class="">
<a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" target="_blank" class=""><span style="color:purple" class="">https://mm.icann.org/mailman/l<wbr class="">istinfo/gnso-rds-pdp-wg</span></a></p>
</div>
</blockquote>
</div>
<div class="">
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif" class="">______________________________<wbr class="">_________________<br class="">
gnso-rds-pdp-wg mailing list<br class="">
<a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" class="">gnso-rds-pdp-wg@icann.org</a><br class="">
<a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" target="_blank" class="">https://mm.icann.org/mailman/l<wbr class="">istinfo/gnso-rds-pdp-wg</a></span></p>
</div>
</blockquote>
</div>
<div class=""> <br class="webkit-block-placeholder">
</div>
<div class="">
<div class="">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif" class="">-- <br class="">
Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.<br class="">
<br class="">
Mit freundlichen Grüßen,<br class="">
<br class="">
Volker A. Greimann<br class="">
- Rechtsabteilung -<br class="">
<br class="">
Key-Systems GmbH<br class="">
<a href="https://maps.google.com/?q=Im+Oberen+Werk+1+%0D+66386+St.+Ingbert&entry=gmail&source=g" class="">Im Oberen Werk 1</a><br class="">
66386 St. Ingbert<br class="">
Tel.: <a href="tel:+49%206894%209396901" value="+4968949396901" target="_blank" class="">
+49 (0) 6894 - 9396 901</a><br class="">
Fax.: <a href="tel:+49%206894%209396851" value="+4968949396851" target="_blank" class="">
+49 (0) 6894 - 9396 851</a><br class="">
<a href="mailto:vgreimann@key-systems.net" target="_blank" class="">Email: vgreimann@key-systems.n<wbr class="">et</a><br class="">
<br class="">
Web: <a href="http://www.key-systems.net/" target="_blank" class="">www.key-systems.net</a> / <a href="http://www.rrpproxy.net/" target="_blank" class="">www<wbr class="">.RRPproxy.net</a><br class="">
<a href="http://www.domaindiscount24.com/" target="_blank" class="">www.domaindiscount24.com</a> / <a href="http://www.brandshelter.com/" target="_blank" class="">www<wbr class="">.BrandShelter.com</a><br class="">
<br class="">
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:<br class="">
<a href="http://www.facebook.com/KeySystems" target="_blank" class="">www.facebook.com/KeySystems</a><br class="">
<a href="http://www.twitter.com/key_systems" target="_blank" class="">www.twitter.com/key_systems</a><br class="">
<br class="">
Geschäftsführer: Alexander Siffrin<br class="">
Handelsregister Nr.: HR B 18835 - Saarbruecken<br class="">
Umsatzsteuer ID.: DE211006534<br class="">
<br class="">
Member of the KEYDRIVE GROUP<br class="">
<a href="http://www.keydrive.lu/" target="_blank" class="">www.keydrive.lu</a><br class="">
<br class="">
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten
wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.<br class="">
<br class="">
------------------------------<wbr class="">--------------<br class="">
<br class="">
Should you have any further questions, please do not hesitate to contact us.<br class="">
<br class="">
Best regards,<br class="">
<br class="">
Volker A. Greimann<br class="">
- legal department -<br class="">
<br class="">
Key-Systems GmbH<br class="">
<a href="https://maps.google.com/?q=Im+Oberen+Werk+1+%0D+66386+St.+Ingbert&entry=gmail&source=g" class="">Im Oberen Werk 1</a><br class="">
66386 St. Ingbert<br class="">
Tel.: <a href="tel:+49%206894%209396901" value="+4968949396901" target="_blank" class="">
+49 (0) 6894 - 9396 901</a><br class="">
Fax.: <a href="tel:+49%206894%209396851" value="+4968949396851" target="_blank" class="">
+49 (0) 6894 - 9396 851</a><br class="">
Email: <a href="mailto:vgreimann@key-systems.net" target="_blank" class="">vgreimann@key-systems.n<wbr class="">et</a><br class="">
<br class="">
Web: <a href="http://www.key-systems.net/" target="_blank" class="">www.key-systems.net</a> / <a href="http://www.rrpproxy.net/" target="_blank" class="">www<wbr class="">.RRPproxy.net</a><br class="">
<a href="http://www.domaindiscount24.com/" target="_blank" class="">www.domaindiscount24.com</a> / <a href="http://www.brandshelter.com/" target="_blank" class="">www<wbr class="">.BrandShelter.com</a><br class="">
<br class="">
Follow us on Twitter or join our fan community on Facebook and stay updated:<br class="">
<a href="http://www.facebook.com/KeySystems" target="_blank" class="">www.facebook.com/KeySystems</a><br class="">
<a href="http://www.twitter.com/key_systems" target="_blank" class="">www.twitter.com/key_systems</a><br class="">
<br class="">
CEO: Alexander Siffrin<br class="">
Registration No.: HR B 18835 - Saarbruecken<br class="">
V.A.T. ID.: DE211006534<br class="">
<br class="">
Member of the KEYDRIVE GROUP<br class="">
<a href="http://www.keydrive.lu/" target="_blank" class="">www.keydrive.lu</a><br class="">
<br class="">
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error
has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.</span></p>
</div>
</div>
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
</div>
</blockquote>
<div class=""> <br class="webkit-block-placeholder">
</div>
</div>
</blockquote>
<br class="">
</div>
</div>
</div>
<br class="">
______________________________<wbr class="">_________________<br class="">
gnso-rds-pdp-wg mailing list<br class="">
<a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" class="">gnso-rds-pdp-wg@icann.org</a><br class="">
<a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" rel="noreferrer" target="_blank" class="">https://mm.icann.org/mailman/l<wbr class="">istinfo/gnso-rds-pdp-wg</a><br class="">
</blockquote>
</div>
<br class="">
</div>
</blockquote>
<br class="">
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
_______________________________________________<br class="">
gnso-rds-pdp-wg mailing list<br class="">
<a href="mailto:gnso-rds-pdp-wg@icann.org" class="">gnso-rds-pdp-wg@icann.org</a><br class="">
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg</div>
</blockquote>
</div>
<br class="">
</body>
</html>