<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">This makes a lot os good sense to me<div><br></div><div>Holly<br><div><br></div><div><br><div style=""><div>On 15 Feb 2018, at 3:14 am, Volker Greimann <<a href="mailto:vgreimann@key-systems.net">vgreimann@key-systems.net</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">
  
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  
  <div text="#000000" bgcolor="#FFFFFF"><p>Best case: Everyone agrees on a common adoption of an
      implementation for an RDS that is fully compliant with all
      applicable data protection laws and still provides for an ability
      to get access to that data if a legitimate interest in accessing a
      particular data set exists. Data retention will be reduced to the
      maximum allowable limit under the jurisdiction the registrar
      operates in (nothin new here, just re-stating what should already
      be the case), and collection will be limited to those data sets
      for which valid justifications exist at the time the service is
      requested. <br>
    </p><p>Legitimate accessors could be: LEAs of appropriate jurisdiction
      (either registrar or data subject), accredited/certified
      accessors, entities acting on behalf of data subject, etc. <br>
    </p><p>Heretic thought of the day: We will probably be looking at a
      thin/distributed model again, or at least a model where data does
      not leave certain jurisdictions without legitimate
      reasons/justification.</p><p><br>
    </p><p>For a possible example of how a GDPR compliant RDS might look,
      please have a look at:</p><p><a class="moz-txt-link-freetext" href="http://webwhois.nic.amsterdam/">http://webwhois.nic.amsterdam/</a>  and <br>
    </p><p>search for: <br>
    </p><p><i>dejong.amsterdam</i> for an example of a domain with data
      provided by a private individual, or</p><p><i>neuken.amsterdam</i> for an example of a domain with data
      provided by an organization.<br>
    </p><p>Also note that certain requesters can be provided with access to
      full data whois under:</p>
    <pre><a class="moz-txt-link-freetext" href="http://nic.amsterdam/whois-privacy">http://nic.amsterdam/whois-privacy</a>
</pre>
    This would be one possible implementation of the tiered access model
    suggested by the EWG.<br>
    <br>
    I am not saying thisis the perfect model, but it is _a_ possible
    model that has already been given a nod by the dutch data privacy
    official. It does provide full access to certain parties with
    legitimate interest.<br>
    <br>
    <br>
    Heretic thought of the day #2: It may be the case that we have
    looked at this entire issue from the wrong end. I know we agreed on
    the existing work plan, but instead of debating endlessly about
    purposes and legal vs. legitimate, we might have been better served
    by at first building a tight model and then look at what can and
    should be collected into this model and who would be given access to
    what and how. <br>
    <br>
    VG<br>
    <br>
    <br>
    <div class="moz-cite-prefix">Am 14.02.2018 um 16:41 schrieb DANIEL
      NANGHAKA:<br>
    </div>
    <blockquote type="cite" cite="mid:CAD4W+iOjQBNa-AY0A3WWK11szmjmGSF2p18N3pjcj+hOYPwi+g@mail.gmail.com">GDPR
      is one of the issues that calls for compliance. We should not
      neglect the other global issues. What we need is a bench mark then
      after follow the global compliance standards. GDPR is not the
      only. At the beginning of this WG, there was a review of the
      different Policies and laws which we cannot just throw away. GDPR
      should not make us loose our direction but we review the GDPR and
      discuss how it affects RDS.
      <div><br>
      </div>
      <div> <br>
        <br>
        On Wednesday, February 14, 2018, Chuck <<a href="mailto:consult@cgomes.com" moz-do-not-send="true">consult@cgomes.com</a>>
        wrote:<br>
        <blockquote class="gmail_quote" style="margin:0 0 0
          .8ex;border-left:1px #ccc solid;padding-left:1ex">
          <div link="blue" vlink="purple" lang="EN-US">
            <div><p class="MsoNormal">I apologize for injecting this
                message way to late in the thread and for not responding
                to Alan Greenberg’s suggestion yesterday, but I was
                unavoidably offline for the last 18+ hours.</p><div> <br class="webkit-block-placeholder"></div><p class="MsoNormal">As of now, let’s change the title of
                this thread to ‘Using the GDPR as a basis for RDS
                Policy’.  For any future responses to earlier messages
                about this topic, please change the subject.</p><div> <br class="webkit-block-placeholder"></div><p class="MsoNormal">Note that I changed the subject in my
                reply.  Feel free to respond to this message with
                additional discussion about messages below.  I hope this
                works; if anyone has a different suggestion regarding
                how to do this, please feel free to communicate it.</p><div> <br class="webkit-block-placeholder"></div><p class="MsoNormal">Chuck</p><div> <br class="webkit-block-placeholder"></div>
              <div>
                <div style="border:none;border-top:solid #e1e1e1
                  1.0pt;padding:3.0pt 0in 0in 0in"><p class="MsoNormal"><b>From:</b> gnso-rds-pdp-wg
                    [mailto:<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org" target="_blank" moz-do-not-send="true">gnso-rds-pdp-wg-<wbr>bounces@icann.org</a>]
                    <b>On Behalf Of </b>Paul Keating<br>
                    <b>Sent:</b> Wednesday, February 14, 2018 4:38 AM<br>
                    <b>To:</b> Dotzero <<a href="mailto:dotzero@gmail.com" target="_blank" moz-do-not-send="true">dotzero@gmail.com</a>>;
                    Volker Greimann <<a href="mailto:vgreimann@key-systems.net" target="_blank" moz-do-not-send="true">vgreimann@key-systems.net</a>><br>
                    <b>Cc:</b> RDS PDP WG <<a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" moz-do-not-send="true">gnso-rds-pdp-wg@icann.org</a>><br>
                    <b>Subject:</b> Re: [gnso-rds-pdp-wg] Legal basis
                    vs. lawful</p>
                </div>
              </div><div> <br class="webkit-block-placeholder"></div>
              <div><p class="MsoNormal"><span style="font-size: 10.5pt;">Correct but
                    they are the ones collecting the data so unless they
                    are convinced of the need and legal ability they
                    simply will not collect it.  Processing only comes
                    after collection.</span></p>
              </div>
              <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
              </div>
              <div style="border:none;border-top:solid #b5c4df
                1.0pt;padding:3.0pt 0in 0in 0in"><p class="MsoNormal"><b>From:
                    </b><span style="">gnso-rds-pdp-wg
                    <<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org" target="_blank" moz-do-not-send="true">gnso-rds-pdp-wg-bounces@<wbr>icann.org</a>>
                    on behalf of Dotzero <<a href="mailto:dotzero@gmail.com" target="_blank" moz-do-not-send="true">dotzero@gmail.com</a>><br>
                    <b>Date: </b>Tuesday, February 13, 2018 at 5:23 PM<br>
                    <b>To: </b>Volker Greimann <<a href="mailto:vgreimann@key-systems.net" target="_blank" moz-do-not-send="true">vgreimann@key-systems.net</a>><br>
                    <b>Cc: </b>RDS PDP WG <<a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" moz-do-not-send="true">gnso-rds-pdp-wg@icann.org</a>><br>
                    <b>Subject: </b>Re: [gnso-rds-pdp-wg] Legal basis
                    vs. lawful</span></p>
              </div>
              <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
              </div>
              <blockquote style="border:none;border-left:solid #b5c4df
                4.5pt;padding:0in 0in 0in
                4.0pt;margin-left:3.75pt;margin-right:0in">
                <div>
                  <div>
                    <div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size: 10.5pt;">Volcker,</span></p>
                    </div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size: 10.5pt;">Registrars
                        are not the only constituency with a stake in
                        this. </span></p>
                  </div><p class="MsoNormal"><span style="font-size: 10.5pt;">Michael
                      Hammer</span></p>
                </div>
                <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                  <div><p class="MsoNormal"><span style="font-size: 10.5pt;">On Tue, Feb
                        13, 2018 at 11:13 AM, Volker Greimann <<a href="mailto:vgreimann@key-systems.net" target="_blank" moz-do-not-send="true">vgreimann@key-systems.net</a>>
                        wrote:</span></p>
                    <blockquote style="border:none;border-left:solid
                      #cccccc 1.0pt;padding:0in 0in 0in
                      6.0pt;margin-left:4.8pt;margin-right:0in">
                      <div><p><span style="font-size: 10.5pt;">Hi
                            Mike,</span></p><p><span style="font-size: 10.5pt;">no,
                            sensible because a great number of
                            registrars will be forced to deal with this
                            anyway, because this will affect a great
                            many of registrations and therefore it makes
                            sense to take this as a basis. Of course we
                            will then need to see if there need to be
                            tweaks to accomodate for other
                            jurisdictions, but as more as more countries
                            are adopting similar regimes....</span></p><p><span style="font-size: 10.5pt;">Sure
                            it will be more restrictive than open access
                            and some people may have a harder time than
                            today getting at certain information, but
                            with tiered access access would still be
                            possible for those with overriding
                            legitimate interests. That is the model the
                            EU commission hinted at. Not the only model,
                            but a working one.</span></p><p><span style="font-size:10.5pt;color:#888888">Volker</span></p>
                        <div>
                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                            <div><p class="MsoNormal"><span style="font-size: 10.5pt;">Am
                                  13.02.2018 um 17:04 schrieb Dotzero:</span></p>
                            </div>
                            <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
                              <div>
                                <div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size: 10.5pt;">Volker,
                                      you assert that "it would be
                                      sensible to take GDPR as a basis
                                      and start from there". Perhaps
                                      sensible from your perspective and
                                      easier from your perspective but
                                      ICANN is an international
                                      organization - primarily dealing
                                      with technical/administrative
                                      issues - and it MUST take an
                                      approach that, as best it can,
                                      accommodates the laws and
                                      practices of various jurisdictions
                                      around the world. Your proposed
                                      approach, quite simply does not do
                                      that.</span></p>
                                </div><p class="MsoNormal"><span style="font-size: 10.5pt;">Michael
                                    Hammer</span></p>
                              </div>
                              <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                <div><p class="MsoNormal"><span style="font-size: 10.5pt;">On
                                      Tue, Feb 13, 2018 at 10:54 AM,
                                      Volker Greimann <<a href="mailto:vgreimann@key-systems.net" target="_blank" moz-do-not-send="true">vgreimann@key-systems.net</a>>
                                      wrote:</span></p>
                                  <blockquote style="border:none;border-left:solid
                                    #cccccc 1.0pt;padding:0in 0in 0in
                                    6.0pt;margin-left:4.8pt;margin-right:0in">
                                    <div><p><span style="font-size: 10.5pt;">I
                                          think that it would be
                                          sensible to take the GDPR as a
                                          basis and start from there.
                                          Obviously, where it conflicts
                                          with other applicable laws, we
                                          should make sure to accomodate
                                          those as well, but as the EU
                                          Commission and others have
                                          pointed out is that compliance
                                          with GDPR does not preclude
                                          providing certain access
                                          levels to certain parties.
                                          What those levels would be and
                                          who those parties could be
                                          should be the main focus of
                                          our work. </span></p>
                                      <div>
                                        <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">Am
                                                13.02.2018 um 15:41
                                                schrieb Chuck:</span></p>
                                          </div>
                                          <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
                                            <div><p class="MsoNormal"><span style="font-size:10.5pt">Volker,<span style=""></span></span></p><div><span style="font-size:10.5pt"> <span style=""></span></span><br class="webkit-block-placeholder"></div><p class="MsoNormal"><span style="font-size:10.5pt">Are you saying that you think that RDS policies
                                                  should be designed to
                                                  comply with European
                                                  regulations and then
                                                  applied to all other
                                                  jurisdictions in the
                                                  world?<span style=""></span></span></p><div><span style="font-size:10.5pt"> <span style=""></span></span><br class="webkit-block-placeholder"></div><p class="MsoNormal"><span style="font-size:10.5pt">Chuck<span style=""></span></span></p><div><span style="font-size:10.5pt"> <span style=""></span></span><br class="webkit-block-placeholder"></div>
                                              <div>
                                                <div style="border:none;border-top:solid
                                                  #e1e1e1
                                                  1.0pt;padding:3.0pt
                                                  0in 0in 0in"><p class="MsoNormal"><b><span style="font-size:10.5pt">From:</span></b><span style="font-size:10.5pt">
                                                      Volker Greimann [<a href="mailto:vgreimann@key-systems.net" target="_blank" moz-do-not-send="true">mailto:vgreimann@key-systems.<wbr>net</a>]
                                                      <br>
                                                      <b>Sent:</b>
                                                      Tuesday, February
                                                      13, 2018 5:58 AM<br>
                                                      <b>To:</b> Chuck <a href="mailto:consult@cgomes.com" target="_blank" moz-do-not-send="true"><consult@cgomes.com></a>;
                                                      'Michael Palage' <a href="mailto:michael@palage.com" target="_blank" moz-do-not-send="true"><michael@palage.com></a><br>
                                                      <b>Cc:</b> <a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" moz-do-not-send="true">gnso-rds-pdp-wg@icann.org</a><br>
                                                      <b>Subject:</b>
                                                      Re:
                                                      [gnso-rds-pdp-wg]
                                                      Legal basis vs.
                                                      lawful<span style=""></span></span></p>
                                                </div>
                                              </div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div><p><span style="font-size: 10.5pt;">I
                                                  am afraid that if we
                                                  create different
                                                  policies for different
                                                  regions, we will break
                                                  the model, encourage
                                                  forum shopping and
                                                  encourage firewalling
                                                  of entire geographic
                                                  sections of the net. I
                                                  hope that is not what
                                                  we are doing here. </span></p><p><span style="font-size: 10.5pt;">GDPR
                                                  will cause some
                                                  breakage of this and I
                                                  see it as our mission
                                                  to fix this breakage
                                                  of the standard by
                                                  proposing a unified
                                                  model once again. </span></p><p><span style="font-size: 10.5pt;">Ultimately,
                                                  if this solution does
                                                  what the EU has been
                                                  asking for, e.g.
                                                  protect legitimate use
                                                  cases of registration
                                                  data as well as the
                                                  rights of the data
                                                  subjects, there is no
                                                  reason why it should
                                                  not be universally
                                                  applicable. </span></p><p><span style="font-size: 10.5pt;">Best,</span></p><p><span style="font-size: 10.5pt;">Volker</span></p><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                              <div><p class="MsoNormal"><span style="font-size: 10.5pt;">Am 13.02.2018 um 00:04 schrieb
                                                    Chuck:</span></p>
                                              </div>
                                              <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"><p class="MsoNormal"><span style="font-size: 10.5pt;">Volker,</span></p><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div><p class="MsoNormal"><span style="font-size: 10.5pt;">The WG could recommend policies
                                                    that are
                                                    ‘universally
                                                    applicable to all
                                                    registrations’ but I
                                                    seriously doubt that
                                                    will happen in
                                                    today’s world.  That
                                                    would be much
                                                    simpler than
                                                    policies that vary
                                                    by region and users,
                                                    but is it realistic?</span></p><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div><p class="MsoNormal"><span style="font-size: 10.5pt;">Chuck</span></p><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                <div>
                                                  <div style="border:none;border-top:solid
                                                    #e1e1e1
                                                    1.0pt;padding:3.0pt
                                                    0in 0in 0in"><p class="MsoNormal"><b><span style="font-size: 10.5pt;">From:</span></b><span style="font-size: 10.5pt;">
                                                        gnso-rds-pdp-wg
                                                        [<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org" target="_blank" moz-do-not-send="true">mailto:gnso-rds-pdp-wg-<wbr>bounces@icann.org</a>]
                                                        <b>On Behalf Of
                                                        </b>Volker
                                                        Greimann<br>
                                                        <b>Sent:</b>
                                                        Monday, February
                                                        12, 2018 2:30 PM<br>
                                                        <b>To:</b>
                                                        Michael Palage <a href="mailto:michael@palage.com" target="_blank" moz-do-not-send="true"><michael@palage.com></a><br>
                                                        <b>Cc:</b> <a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" moz-do-not-send="true">gnso-rds-pdp-wg@icann.org</a><br>
                                                        <b>Subject:</b>
                                                        Re:
                                                        [gnso-rds-pdp-wg]
                                                        Legal basis vs.
                                                        lawful</span></p>
                                                  </div>
                                                </div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div><p class="MsoNormal"><span style="font-size: 10.5pt;">Michael is right. ICANN iOS based
                                                    on the thought of
                                                    “One World; one
                                                    Internet”. This also
                                                    means that the
                                                    policies it creates
                                                    should be
                                                    universally
                                                    applicable to all
                                                    registrations, if
                                                    possible. IF we
                                                    start creating
                                                    policy that
                                                    diverges, that would
                                                    only lead to further
                                                    fragmentation and
                                                    undermine the
                                                    founding ideal of
                                                    ICANN itself. Our
                                                    aim should be to
                                                    create one policy
                                                    that can be applied
                                                    to all or most
                                                    registrations and
                                                    that can be
                                                    implemented by all
                                                    registrars alike. </span></p>
                                                <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                </div>
                                                <div><p class="MsoNormal"><span style="font-size: 10.5pt;">While we will likely have a certain
                                                      amount of
                                                      fragmentation
                                                      following May 25
                                                      as each contracted
                                                      party applies its
                                                      own solution, it
                                                      should be our goal
                                                      to overcome this
                                                      and present a new
                                                      unified policy
                                                      that works for all
                                                      contracted
                                                      parties. </span></p>
                                                </div>
                                                <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                </div>
                                                <div><p class="MsoNormal"><span style="font-size: 10.5pt;">Volker</span></p>
                                                  <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                  </div>
                                                  <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                    <div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size: 10.5pt;"><br>
                                                          <br>
                                                        </span></p>
                                                      <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
                                                        <div><p class="MsoNormal"><span style="font-size: 10.5pt;">On 12. Feb 2018, at 20:27, Michael
                                                          Palage <<a href="mailto:michael@palage.com" target="_blank" moz-do-not-send="true">michael@palage.com</a>>
                                                          wrote:</span></p>
                                                        </div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                        <div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">Greg/John,</span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">I will respectfully push back on
                                                          your legal
                                                          over
                                                          simplification
                                                          of the GDPR.</span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">The exterritorial aspect of the
                                                          GDPR set forth
                                                          in Article 3
                                                          is NOT just
                                                          limited to EU
residents/citizens.  As Michele has noted in the past, the GDPR requires
                                                          BlackKnight as
                                                          an Irish legal
                                                          entity to
                                                          protect all of
                                                          its customers
                                                          data
                                                          (EU/Non-EU) in
                                                          compliance
                                                          with GDPR, as
                                                          well as US
                                                          entities that
                                                          target and
                                                          conduct
                                                          business
                                                          within the EU.</span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">Now your points about the
                                                          distinction
                                                          between
                                                          natural and
                                                          legal persons
                                                          is a fair one
                                                          and one that
                                                          has been noted
                                                          in EU and Art
                                                          29
                                                          communications. 
                                                          Could you
                                                          please share
                                                          the basis of
                                                          your
                                                          proposition
                                                          that 97% of
                                                          all domain
                                                          name
                                                          registrations
                                                          are registered
                                                          by legal
                                                          entities.<span> </span></span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">As I have note previously the long
                                                          term viability
                                                          of the ICANN
                                                          multi-stakeholder
                                                          model is at
                                                          risk as
                                                          national
                                                          governments
                                                          continue to
                                                          pass national
                                                          laws that
                                                          impact the
                                                          operation of
                                                          the Internet. 
                                                          However, the
                                                          European Union
                                                          is NOT alone
                                                          in advancing
                                                          Privacy
                                                          Legislation,
                                                          in fact data
                                                          localization
                                                          is perhaps the
                                                          next biggest
                                                          lurking threat
                                                          to the domain
                                                          name system. <span> </span></span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">Best regards,</span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">Michael</span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><b><span style="font-size: 10.5pt;">From:</span></b><span><span style="font-size: 10.5pt;"> </span></span><span style="font-size: 10.5pt;">gnso-rds-pdp-wg [<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org" target="_blank" moz-do-not-send="true">mailto:gnso-rds-pdp-wg-<wbr>bounces@icann.org</a>]<span> </span><b>On
                                                          Behalf Of<span> </span></b>John
                                                          Horton via
                                                          gnso-rds-pdp-wg<br>
                                                          <b>Sent:</b><span> </span>Monday,
                                                          February 12,
                                                          2018 1:22 PM<br>
                                                          <b>To:</b><span> </span>Greg
                                                          Aaron <<a href="mailto:gca@icginc.com" target="_blank" moz-do-not-send="true">gca@icginc.com</a>><br>
                                                          <b>Cc:</b><span> </span><a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" moz-do-not-send="true">gnso-rds-pdp-wg@icann.org</a><br>
                                                          <b>Subject:</b><span> </span>Re:
[gnso-rds-pdp-wg] Legal basis vs. lawful</span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div>
                                                          <div>
                                                          <div><p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#444444">I
                                                          think Greg is
                                                          right on.
                                                          There's simply
                                                          no
                                                          justification
                                                          to force a law
                                                          that is only
                                                          intended to
                                                          apply to a) EU
residents/citizens that are b) natural persons not using the domain name
                                                          for commercial
                                                          purposes, to
                                                          the
                                                          remaining...what?
                                                          97% - 99% of
                                                          the world's
                                                          registrant
                                                          population?
                                                          That would be
                                                          a balanced way
                                                          to implement
                                                          all of this. </span><span style="font-size: 10.5pt;"></span></p>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          <div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;"><br clear="all">
                                                          </span></p>
                                                          </div>
                                                          <div>
                                                          <div>
                                                          <div>
                                                          <div>
                                                          <div>
                                                          <div>
                                                          <div>
                                                          <div>
                                                          <div>
                                                          <div>
                                                          <div>
                                                          <div>
                                                          <div>
                                                          <div>
                                                          <div>
                                                          <div><p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#073763">John
                                                          Horton<br>
                                                          President and
                                                          CEO,
                                                          LegitScript</span><span style="font-size: 10.5pt;"></span></p>
                                                          </div>
                                                          <div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;"><img style="width:1.0in;height:.375in" src="https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJRXE5UTAtclVxdTg&revid=0B13GfLt8zwZJSG9zOUVwN1lFKzFrRVlnaWU0NGZ4RmdkUjg4PQ" moz-do-not-send="true" height="36" width="96" border="0"></span></p>
                                                          </div>
                                                          <div>
                                                          <div><div><span style="font-size: 9pt; font-family: Helvetica, sans-serif;"> </span><span style="font-size: 10.5pt;"></span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#444444">Follow</span></b><b><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#0b5394"> </span></b><b><span style="font-size: 9pt; font-family: Helvetica, sans-serif;">Legit</span></b><b><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#0b5394">Script</span></b><span style="font-size: 9pt; font-family: Helvetica, sans-serif;">: <a href="http://www.linkedin.com/company/legitscript-com" target="_blank" moz-do-not-send="true"><span style="color:#cc0000">LinkedIn</span></a>  |  <a href="https://www.facebook.com/LegitScript" target="_blank" moz-do-not-send="true"><span style="color:#6aa84f">Facebook</span></a> 
                                                          |  <a href="https://twitter.com/legitscript" target="_blank" moz-do-not-send="true"><span style="color:#674ea7">Twitter</span></a> 
                                                          |  </span><u><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#ff9900"><a href="http://blog.legitscript.com/" target="_blank" moz-do-not-send="true"><span style="color:#1155cc">Blog</span></a></span></u><span style="font-size: 9pt; font-family: Helvetica, sans-serif;">  |</span><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#ff9900">  <a href="http://go.legitscript.com/Subscription-Management.html" target="_blank" moz-do-not-send="true"><span style="color:#ff9900">Newsletter</span></a></span><span style="font-size: 10.5pt;"></span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 9pt; font-family: Helvetica, sans-serif;"> </span><span style="font-size: 10.5pt;"></span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#ff9900"><img style="width:.4791in;height:1.0in" src="https://www.legitscript.com/wp-content/uploads/2015/09/LegitScript-Workplace.png" moz-do-not-send="true" height="96" width="46" border="0"><img style="width:.4895in;height:1.0104in" src="https://docs.google.com/uc?export=download&id=0B13GfLt8zwZJTmNWbmcwOTVJMXc&revid=0B13GfLt8zwZJQlZWOXVGbG9acC9nRGhzdEkxclFJVytCWVNjPQ" moz-do-not-send="true" height="97" width="47" border="0"></span><span style="font-size: 10.5pt;"></span></p>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">On Mon, Feb 12, 2018 at 9:57 AM,
                                                          Greg Aaron
                                                          <<a href="mailto:gca@icginc.com" target="_blank" moz-do-not-send="true"><span style="color:purple">gca@icginc.com</span></a>>
                                                          wrote:</span></p>
                                                          </div>
                                                          <blockquote style="border:none;border-left:solid
                                                          #cccccc
                                                          1.0pt;padding:0in
                                                          0in 0in
6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
                                                          <div>
                                                          <div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">I don’t know if we arrive at the
                                                          same place. <span> </span></span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">GDPR is based on one principle.  It
                                                          states what is
                                                          legal.  It's
                                                          explicit about
                                                          what you _are
                                                          allowed to
                                                          do_; granted
                                                          there’s some
                                                          flexibility
                                                          and room for
                                                          interpretation.  
                                                          It’s like
                                                          saying what’s
                                                          inside a box.</span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">U.S. law is one based on different
                                                          principles. 
                                                          AFAIK U.S.
                                                          consumer
                                                          protection law
                                                          does not
                                                          enumerate
                                                          specifically
                                                          what is
                                                          lawful. 
                                                          Instead it
                                                          tends to state
                                                          what is
                                                          illegal, what
                                                          you are _not
                                                          allowed to
                                                          do_.   It’s
                                                          like saying
                                                          what’s outside
                                                          the box.   The
                                                          U.S. doesn’t
                                                          have something
                                                          like GDPR that
                                                          spells out
                                                          legal bases
                                                          for collecting
                                                          data, i.e. the
                                                          enumerated
                                                          allowable
                                                          reasons. 
                                                          Instead the
                                                          trade and
                                                          consumer
                                                          protection
                                                          laws basically
                                                          say: entities
                                                          have the right
                                                          to form
                                                          contracts
                                                          between
                                                          themselves,
                                                          they should
                                                          live up to the
                                                          contract,
                                                          don’t surprise
                                                          people, don’t
                                                          do certain
                                                          dishonest
                                                          things.  <span> </span></span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">Here's the problem: if one makes
                                                          the GDPR
                                                          principle the
                                                          ICANN standard
                                                          and you apply
                                                          it to all
                                                          registrations,
                                                          then practices
                                                          that are
                                                          allowable in
                                                          one place
                                                          under the law
                                                          (like the
                                                          U.S.) would no
                                                          longer be
                                                          allowed there
                                                          by ICANN
                                                          policy. 
                                                           ICANN would
                                                          be choosing
                                                          one legal
                                                          approach or
                                                          regime for
                                                          everyone in
                                                          the world. <span> </span></span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">The alternative is to apply the
                                                          GDRP only to
                                                          those that it
                                                          is designed to
                                                          protect:
                                                           registrants
                                                          in the EU.</span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">For example, there’s nothing in
                                                          U.S. law that
                                                          prohibits a
                                                          U.S. registrar
                                                          from having a
                                                          contract that
                                                          says
                                                          publication of
                                                          full contact
                                                          data in WHOIS
                                                          is  a
                                                          condition of
                                                          registering a
                                                          domain name if
                                                          you are a
                                                          registrant in
                                                          the U.S.</span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">See<span> </span><a href="https://iapp.org/news/a/explaining-the-gdpr-to-an-american/" target="_blank" moz-do-not-send="true"><span style="color:purple">https://iapp.org/news/a/<wbr>explaining-the-gdpr-to-an-<wbr>american/</span></a> 
                                                          for more.</span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div>
                                                          <div style="border:none;border-top:solid
                                                          #e1e1e1
                                                          1.0pt;padding:3.0pt
                                                          0in 0in 0in">
                                                          <div><p class="MsoNormal"><b><span style="font-size: 10.5pt;">From:</span></b><span><span style="font-size: 10.5pt;"> </span></span><span style="font-size: 10.5pt;">gnso-rds-pdp-wg [<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org" target="_blank" moz-do-not-send="true"><span style="color:purple">mailto:gnso-rds-pdp-wg-<wbr>bounces@icann.org</span></a>]<span> </span><b>On
                                                          Behalf Of<span> </span></b>Silver,
                                                          Bradley via
                                                          gnso-rds-pdp-wg<br>
                                                          <b>Sent:</b><span> </span>Friday,
                                                          February 9,
                                                          2018 2:54 PM<br>
                                                          <b>To:</b><span> </span>Volker
                                                          Greimann <<a href="mailto:vgreimann@key-systems.net" target="_blank" moz-do-not-send="true"><span style="color:purple">vgreimann@key-systems.net</span></a>>;<span> </span><a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" moz-do-not-send="true"><span style="color:purple">g<wbr>nso-rds-pdp-wg@icann.org</span></a></span></p>
                                                          </div>
                                                          <div>
                                                          <div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;"><br>
                                                          <b>Subject:</b><span> </span>Re:
[gnso-rds-pdp-wg] Legal basis vs. lawful</span></p>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          <div>
                                                          <div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size:10.5pt;color:#1f497d">It is true that the GDPR is
                                                          prescriptive,
                                                          although also
                                                          rather
                                                          open-ended
                                                          (hence our
                                                          current
                                                          pickle).  But
                                                          regardless of
                                                          the term we
                                                          use, don’t we
                                                          arrive at the
                                                          same place: 
                                                          which is that
                                                          if something
                                                          that requires
                                                          a legal basis
                                                          is done
                                                          without one,
                                                          it will be
                                                          unlawful? 
                                                          Using Kathy’s
                                                          example, if
                                                          data is
                                                          processed
                                                          without
                                                          complying with
                                                          minimization
                                                          or purpose
                                                          principles,
                                                          will such
                                                          processing not
                                                          run afoul of
                                                          the law, and
                                                          hence be
                                                          unlawful? <span> </span></span><span style="font-size: 10.5pt;"></span></p>
                                                          </div>
                                                          <div><div><span style="font-size:10.5pt;color:#1f497d"> </span><span style="font-size: 10.5pt;"></span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size:10.5pt;color:#1f497d">There are important distinctions
                                                          between the
                                                          meaning of
                                                          “legal basis”
                                                          which implies
                                                          that a law
                                                          requires
                                                          something to
                                                          be
                                                          affirmatively
                                                          present,
                                                          versus
                                                          “lawful”,
                                                          which means
                                                          that something
                                                          is not
                                                          prohibited by
                                                          law. 
                                                          Ultimately
                                                          though, isn’t
                                                          “lawfulness”,
                                                          the same end
                                                          point,
                                                          regardless? <span> </span></span><span style="font-size: 10.5pt;"></span></p>
                                                          </div>
                                                          <div><div><span style="font-size:10.5pt;color:#1f497d"> </span><span style="font-size: 10.5pt;"></span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div>
                                                          <div style="border:none;border-top:solid
                                                          #b5c4df
                                                          1.0pt;padding:3.0pt
                                                          0in 0in 0in">
                                                          <div><p class="MsoNormal"><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif;">From:</span></b><span><span style="font-size: 10pt; font-family: Tahoma, sans-serif;"> </span></span><span style="font-size: 10pt; font-family: Tahoma, sans-serif;">gnso-rds-pdp-wg
                                                          [</span><span style="font-size: 10.5pt;"><a href="mailto:gnso-rds-pdp-wg-bounces@icann.org" target="_blank" moz-do-not-send="true"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:purple">mailto:gnso-rds-pdp-wg-<wbr>bounces@icann.org</span></a></span><span style="font-size: 10pt; font-family: Tahoma, sans-serif;">]<span> </span><b>On
                                                          Behalf Of<span> </span></b>Volker
                                                          Greimann<br>
                                                          <b>Sent:</b><span> </span>Friday,
                                                          February 09,
                                                          2018 11:27 AM<br>
                                                          <b>To:</b><span> </span></span><span style="font-size: 10.5pt;"><a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" moz-do-not-send="true"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:purple">gnso-rds-pdp-wg@icann.org</span></a></span><span style="font-size: 10pt; font-family: Tahoma, sans-serif;"><br>
                                                          <b>Subject:</b><span> </span>Re:
[gnso-rds-pdp-wg] Legal basis vs. lawful</span><span style="font-size: 10.5pt;"></span></p>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size: 9pt; font-family: Helvetica, sans-serif;">I
                                                          do not see
                                                          how. Kathy's
                                                          analysis seems
                                                          sound. The
                                                          flexibility
                                                          within the
                                                          GDPR still
                                                          only allows
                                                          processing in
                                                          very specific
                                                          cicumstances,
                                                          all of which
                                                          are listed in
                                                          the GDPR.</span><span style="font-size: 10.5pt;"></span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">Am 09.02.2018 um 16:45 schrieb
                                                          Victoria
                                                          Sheckler:</span></p>
                                                          </div>
                                                          </div>
                                                          <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">Kathy’s analysis breaks down on a
                                                          practical
                                                          level when one
                                                          looks at the
                                                          GDPR and what
                                                          it says about
                                                          when data can
                                                          be processed. 
                                                          The GDPR
                                                          allows for
                                                          flexibility
                                                          for what can
                                                          be processed
                                                          and when, and
                                                          kathy’s
                                                          analysis
                                                          overlooks that
                                                          point.</span></p>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div>
                                                          <div style="border:none;border-top:solid
                                                          #e1e1e1
                                                          1.0pt;padding:3.0pt
                                                          0in 0in 0in">
                                                          <div><p class="MsoNormal"><b><span style="font-size: 10.5pt;">From:</span></b><span><span style="font-size: 10.5pt;"> </span></span><span style="font-size: 10.5pt;">gnso-rds-pdp-wg [<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org" target="_blank" moz-do-not-send="true"><span style="color:purple">mailto:gnso-rds-pdp-wg-<wbr>bounces@icann.org</span></a>]<span> </span><b>On
                                                          Behalf Of<span> </span></b>Kathy
                                                          Kleiman<br>
                                                          <b>Sent:</b><span> </span>Thursday,
                                                          February 8,
                                                          2018 7:07 PM<br>
                                                          <b>To:</b><span> </span><a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" moz-do-not-send="true"><span style="color:purple">gnso-rds-pdp-wg@icann.org</span></a><br>
                                                          <b>Subject:</b><span> </span>Re:
[gnso-rds-pdp-wg] Legal basis vs. lawful</span></p>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">Tx for the invitation to join,
                                                          Chuck, and
                                                          following up
                                                          on the
                                                          discussion of
                                                          Sam and
                                                          Tapani, let me
                                                          add that
                                                          criteria for
                                                          processing
                                                          must be
                                                          clearer than
                                                          something
                                                          broadly within
                                                          ICANN's
                                                          mission
                                                          statement and
                                                          something
                                                          permissible
                                                          somewhere. The
                                                          requirements
                                                          under law are
                                                          express and
                                                          concrete.<span> </span></span></p>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size: 9pt; font-family: Helvetica, sans-serif;">Specifically,
                                                          GDPR Article
                                                          5(1)(b and c)
                                                          states:</span><span style="font-size: 10.5pt;"></span></p>
                                                          </div><p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size: 10.5pt;">Personal
                                                          data shall be:<span> </span><br>
                                                          2.   
                                                          "collected for<span> </span><u>specified,
                                                          explicit and
                                                          legitimate
                                                          purposes<span> </span></u>and
                                                          not further
                                                          processed in a
                                                          manner that is
                                                          incompatible
                                                          with those
                                                          purposes"</span></b><span><span style="font-size: 10.5pt;"> </span></span><span style="font-size: 10.5pt;">(the
                                                          "purpose
                                                          limitation")
                                                          AND<span> </span><b><br>
                                                          3.   
                                                          "adequate,
                                                          relevant and
                                                          limited to
                                                          what is
                                                          necessary in
                                                          relation to
                                                          the purposes
                                                          for which they
                                                          are processed"</b><span> </span>(the
                                                          "data
                                                          minimisation"
                                                          requirement). 
                                                          [underline
                                                          added]<b><br>
                                                          </b><br>
                                                          Thus, our
                                                          first criteria
                                                          of "consistent
                                                          with ICANN's
                                                          mission," is
                                                          only the first
                                                          step and we
                                                          need to go
                                                          further than
                                                          even the 3
                                                          criteria we
                                                          are
                                                          discussing..<br>
                                                          <br>
                                                          Second, lawful
                                                          and legal
                                                          enter us into
                                                          a debate over
                                                          words and I
                                                          have to agree
                                                          with Sam and
                                                          Tapani's
                                                          analysis and
                                                          let me add
                                                          some of my
                                                          own.<span> </span><br>
                                                          <br>
                                                          "Legal" is the
                                                          term we use
                                                          for actions
                                                          expressly
                                                          allowed under
                                                          law. How we
                                                          process
                                                          personal data
                                                          under the GDRP
                                                          falls into
                                                          this category
                                                          -- of
                                                          processing
                                                          expressly
                                                          allowed under
                                                          law. Whereas
                                                          the term
                                                          lawful is used
                                                          for a much
                                                          broader
                                                          category of
                                                          actions which
                                                          are generally
                                                          permissible
                                                          and allowable.<br>
                                                          <br>
                                                          The term
                                                          "legal" is
                                                          much more
                                                          consistent
                                                          with our
                                                          criteria
                                                          statement
                                                          because the
                                                          processing of
                                                          personal data
                                                          by ICANN must
                                                          clearly have a<span> </span><i>valid
                                                          legal basis</i><span> </span>as
                                                          expressly
                                                          defined by
                                                          data
                                                          protection
                                                          laws.<span> </span><br>
                                                          <br>
                                                          Best regards,<span> </span><br>
                                                          Kathy<span> </span><br>
                                                          <br>
                                                          On 2/7/2018
                                                          10:53 AM, Sam
                                                          Lanfranco
                                                          wrote:</span></p>
                                                          <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
                                                          <div><p class="MsoNormal"><span style="font-size: 9pt; font-family: Helvetica, sans-serif;">Thanks
                                                          Tapani,</span><span style="font-size: 10.5pt;"></span></p>
                                                          </div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size: 10.5pt;">I
                                                          will extract
                                                          from your
                                                          longer
                                                          message.<span> </span><br>
                                                          I deliberately
                                                          kept my brief
                                                          and less
                                                          technical.<br>
                                                          I think we are
                                                          in agreement
                                                          here and I
                                                          support your
                                                          position.</span></p>
                                                          <div>
                                                          <div><p class="MsoNormal"><span style="font-size:10.5pt;color:#660000">On 2/7/2018 1:07 AM, Tapani
                                                          Tarvainen
                                                          wrote:<br>
                                                          <br>
                                                          The key
                                                          distinction,
                                                          as I
                                                          understand it,
                                                          is that
                                                          "lawful" would
                                                          be<br>
                                                           defined by
                                                          the negative,
                                                          everything
                                                          that some law
                                                          does not
                                                          prohibit,<span> </span></span><span style="font-size: 10.5pt;"></span></p>
                                                          </div>
                                                          </div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:10.5pt;color:#660000">where
                                                          as "legal
                                                          basis" is
                                                          defined by the
                                                          positive, only
                                                          things whose<span> </span><br>
                                                          justification
                                                          can be
                                                          explicitly
                                                          derived from
                                                          law.<span> </span><br>
                                                          <br>
                                                           
                                                          <......><br>
                                                          <br>
                                                          So I would
                                                          prefer "legal
                                                          basis"
                                                          specifically
                                                          in this sense:
                                                          that any
                                                          processing<br>
                                                           would have to
                                                          be explicitly
                                                          based on one
                                                          of the
                                                          criteria, or
                                                          bases, as
                                                          listed<span> </span><br>
                                                          in GDPR
                                                          Article 6, or
                                                          similar
                                                          explicit
                                                          justification
                                                          in other data
                                                          protection
                                                          legislation.<span> </span><br>
                                                          <br>
                                                          </span><span style="font-size: 10.5pt;"><br>
                                                          <br>
                                                          <br>
                                                          </span></p>
                                                          <pre><span style="">______________________________<wbr>_________________</span></pre>
                                                          <pre><span style="">gnso-rds-pdp-wg mailing list</span></pre>
                                                          <pre><span style=""><a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" moz-do-not-send="true"><span style="color:purple">gnso-rds-pdp-wg@icann.org</span></a></span></pre>
                                                          <pre><span style=""><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__mm.icann.org_mailman_listinfo_gnso-2Drds-2Dpdp-2Dwg&d=DwMDaQ&c=tq9bLrSQ8zIr87VusnUS92RmR2KtbW6AiQIx78dtRmA&r=TAA3GKe6tpWdv3RbCks6TRrjaTx9d0J3KzemA65KYpA&m=fOG1O9n2_DhDKrVj0wrojDKlYIsDeLHzwtDlEi-f9Ng&s=GditP_BvWvjE7xFIYot7e5akySiL4RPKaCgA_X_fyTE&e=" target="_blank" moz-do-not-send="true"><span style="color:purple">https://mm.icann.org/mailman/<wbr>listinfo/gnso-rds-pdp-wg</span></a></span></pre>
                                                          </blockquote>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div><div style="margin-bottom: 12pt;"><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          <pre><span style="">______________________________<wbr>_________________</span></pre>
                                                          <pre><span style="">gnso-rds-pdp-wg mailing list</span></pre>
                                                          <pre><span style=""><a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" moz-do-not-send="true"><span style="color:purple">gnso-rds-pdp-wg@icann.org</span></a></span></pre>
                                                          <pre><span style=""><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__mm.icann.org_mailman_listinfo_gnso-2Drds-2Dpdp-2Dwg&d=DwMDaQ&c=tq9bLrSQ8zIr87VusnUS92RmR2KtbW6AiQIx78dtRmA&r=TAA3GKe6tpWdv3RbCks6TRrjaTx9d0J3KzemA65KYpA&m=fOG1O9n2_DhDKrVj0wrojDKlYIsDeLHzwtDlEi-f9Ng&s=GditP_BvWvjE7xFIYot7e5akySiL4RPKaCgA_X_fyTE&e=" target="_blank" moz-do-not-send="true"><span style="color:purple">https://mm.icann.org/mailman/<wbr>listinfo/gnso-rds-pdp-wg</span></a></span></pre>
                                                          </blockquote>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          <div class="MsoNormal" style="text-align:center" align="center"><span style="font-size: 10.5pt;">
                                                          <hr size="2" align="center" width="100%"></span></div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size: 12pt;"><br>
                                                          <b><i><br>
                                                          Reminder: Any
                                                          email that
                                                          requests your
                                                          login
                                                          credentials or
                                                          that asks you
                                                          to click on a
                                                          link could be
                                                          a phishing
                                                          attack.  If
                                                          you have any
                                                          questions
                                                          regarding the
                                                          authenticity
                                                          of this email
                                                          or its sender,
                                                          please contact
                                                          the IT Service
                                                          Desk at<span> </span><a href="tel:%28212%29%20484-6000" target="_blank" moz-do-not-send="true"><span style="color:purple">212.484.6000</span></a><span> </span>or via email
                                                          at<span> </span></i></b></span><span style="font-size: 10.5pt;"><a href="mailto:ITServices@timewarner.com" target="_blank" moz-do-not-send="true"><b><i><span style="font-size:12.0pt">ITServices@timewarner.com</span></i></b></a></span></p>
                                                          <div class="MsoNormal" style="text-align:center" align="center"><span style="font-size: 10.5pt;">
                                                          <hr size="2" align="center" width="100%"></span></div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;">This message is the property of
                                                          Time Warner
                                                          Inc. and is
                                                          intended only
                                                          for the use of
                                                          the
                                                          addressee(s)
                                                          and may be
                                                          legally
                                                          privileged
                                                          and/or
                                                          confidential.
                                                          If the reader
                                                          of this
                                                          message is not
                                                          the intended
                                                          recipient, or
                                                          the employee
                                                          or agent
                                                          responsible to
                                                          deliver it to
                                                          the intended
                                                          recipient, he
                                                          or she is
                                                          hereby
                                                          notified that
                                                          any
                                                          dissemination,
                                                          distribution,
                                                          printing,
                                                          forwarding, or
                                                          any method of
                                                          copying of
                                                          this
                                                          information,
                                                          and/or the
                                                          taking of any
                                                          action in
                                                          reliance on
                                                          the
                                                          information
                                                          herein is
                                                          strictly
                                                          prohibited
                                                          except by the
                                                          intended
                                                          recipient or
                                                          those to whom
                                                          he or she
                                                          intentionally
                                                          distributes
                                                          this message.
                                                          If you have
                                                          received this
                                                          communication
                                                          in error,
                                                          please
                                                          immediately
                                                          notify the
                                                          sender, and
                                                          delete the
                                                          original
                                                          message and
                                                          any copies
                                                          from your
                                                          computer or
                                                          storage
                                                          system. Thank
                                                          you.</span></p>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          <div><p class="MsoNormal"><span style="font-size: 10.5pt;"><br>
______________________________<wbr>_________________<br>
gnso-rds-pdp-wg mailing list<br>
                                                          <a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" moz-do-not-send="true"><span style="color:purple">gnso-rds-pdp-wg@icann.org</span></a><br>
                                                          <a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" target="_blank" moz-do-not-send="true"><span style="color:purple">https://mm.icann.org/mailman/<wbr>listinfo/gnso-rds-pdp-wg</span></a></span></p>
                                                          </div>
                                                          </blockquote>
                                                          </div>
                                                          <div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                          </div>
                                                          </div><p class="MsoNormal"><span style="font-size: 9pt; font-family: Helvetica, sans-serif;">______________________________<wbr>_________________<br>
gnso-rds-pdp-wg mailing list<br>
                                                          <a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" moz-do-not-send="true">gnso-rds-pdp-wg@icann.org</a><br>
                                                          <a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" target="_blank" moz-do-not-send="true">https://mm.icann.org/mailman/<wbr>listinfo/gnso-rds-pdp-wg</a></span><span style="font-size: 10.5pt;"></span></p>
                                                        </div>
                                                      </blockquote>
                                                    </div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                    <div>
                                                      <div><p class="MsoNormal"><span style="font-size: 9pt; font-family: Helvetica, sans-serif;">-- <br>
                                                          Bei weiteren
                                                          Fragen stehen
                                                          wir Ihnen
                                                          gerne zur
                                                          Verfügung.<br>
                                                          <br>
                                                          Mit
                                                          freundlichen
                                                          Grüßen,<br>
                                                          <br>
                                                          Volker A.
                                                          Greimann<br>
                                                          -
                                                          Rechtsabteilung
                                                          -<br>
                                                          <br>
                                                          Key-Systems
                                                          GmbH<br>
                                                          <a href="https://maps.google.com/?q=Im+Oberen+Werk+1+%0D+66386+St.+Ingbert&entry=gmail&source=g" target="_blank" moz-do-not-send="true">Im Oberen Werk 1</a><br>
                                                          66386 St.
                                                          Ingbert<br>
                                                          Tel.: <a href="tel:+49%206894%209396901" target="_blank" moz-do-not-send="true">+49 (0) 6894 - 9396 901</a><br>
                                                          Fax.: <a href="tel:+49%206894%209396851" target="_blank" moz-do-not-send="true">+49 (0) 6894 - 9396 851</a><br>
                                                          <a href="mailto:vgreimann@key-systems.net" target="_blank" moz-do-not-send="true">Email: vgreimann@key-systems.<wbr>net</a><br>
                                                          <br>
                                                          Web: <a href="http://www.key-systems.net/" target="_blank" moz-do-not-send="true">www.key-systems.net</a> / <a href="http://www.rrpproxy.net/" target="_blank" moz-do-not-send="true">www<wbr>.RRPproxy.net</a><br>
                                                          <a href="http://www.domaindiscount24.com/" target="_blank" moz-do-not-send="true">www.domaindiscount24.com</a> / <a href="http://www.brandshelter.com/" target="_blank" moz-do-not-send="true">www<wbr>.BrandShelter.com</a><br>
                                                          <br>
                                                          Folgen Sie uns
                                                          bei Twitter
                                                          oder werden
                                                          Sie unser Fan
                                                          bei Facebook:<br>
                                                          <a href="http://www.facebook.com/KeySystems" target="_blank" moz-do-not-send="true">www.facebook.com/KeySystems</a><br>
                                                          <a href="http://www.twitter.com/key_systems" target="_blank" moz-do-not-send="true">www.twitter.com/key_systems</a><br>
                                                          <br>
Geschäftsführer: Alexander Siffrin<br>
Handelsregister Nr.: HR B 18835 - Saarbruecken<br>
                                                          Umsatzsteuer
                                                          ID.:
                                                          DE211006534<br>
                                                          <br>
                                                          Member of the
                                                          KEYDRIVE GROUP<br>
                                                          <a href="http://www.keydrive.lu/" target="_blank" moz-do-not-send="true">www.keydrive.lu</a><br>
                                                          <br>
                                                          Der Inhalt
                                                          dieser
                                                          Nachricht ist
                                                          vertraulich
                                                          und nur für
                                                          den
                                                          angegebenen
                                                          Empfänger bestimmt.
                                                          Jede Form der
                                                          Kenntnisgabe,
Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist
                                                          unzulässig.
                                                          Sollte diese
                                                          Nachricht
                                                          nicht für Sie
                                                          bestimmt sein,
                                                          so bitten wir
                                                          Sie, sich mit
                                                          uns per E-Mail
                                                          oder
                                                          telefonisch in
                                                          Verbindung
                                                          zu setzen.<br>
                                                          <br>
------------------------------<wbr>--------------<br>
                                                          <br>
                                                          Should you
                                                          have any
                                                          further
                                                          questions,
                                                          please do not
                                                          hesitate to
                                                          contact us.<br>
                                                          <br>
                                                          Best regards,<br>
                                                          <br>
                                                          Volker A.
                                                          Greimann<br>
                                                          - legal
                                                          department -<br>
                                                          <br>
                                                          Key-Systems
                                                          GmbH<br>
                                                          <a href="https://maps.google.com/?q=Im+Oberen+Werk+1+%0D+66386+St.+Ingbert&entry=gmail&source=g" target="_blank" moz-do-not-send="true">Im Oberen Werk 1</a><br>
                                                          66386 St.
                                                          Ingbert<br>
                                                          Tel.: <a href="tel:+49%206894%209396901" target="_blank" moz-do-not-send="true">+49 (0) 6894 - 9396 901</a><br>
                                                          Fax.: <a href="tel:+49%206894%209396851" target="_blank" moz-do-not-send="true">+49 (0) 6894 - 9396 851</a><br>
                                                          Email: <a href="mailto:vgreimann@key-systems.net" target="_blank" moz-do-not-send="true">vgreimann@key-systems.<wbr>net</a><br>
                                                          <br>
                                                          Web: <a href="http://www.key-systems.net/" target="_blank" moz-do-not-send="true">www.key-systems.net</a> / <a href="http://www.rrpproxy.net/" target="_blank" moz-do-not-send="true">www<wbr>.RRPproxy.net</a><br>
                                                          <a href="http://www.domaindiscount24.com/" target="_blank" moz-do-not-send="true">www.domaindiscount24.com</a> / <a href="http://www.brandshelter.com/" target="_blank" moz-do-not-send="true">www<wbr>.BrandShelter.com</a><br>
                                                          <br>
                                                          Follow us on
                                                          Twitter or
                                                          join our fan
                                                          community on
                                                          Facebook and
                                                          stay updated:<br>
                                                          <a href="http://www.facebook.com/KeySystems" target="_blank" moz-do-not-send="true">www.facebook.com/KeySystems</a><br>
                                                          <a href="http://www.twitter.com/key_systems" target="_blank" moz-do-not-send="true">www.twitter.com/key_systems</a><br>
                                                          <br>
                                                          CEO: Alexander
                                                          Siffrin<br>
                                                          Registration
                                                          No.: HR B
                                                          18835 -
                                                          Saarbruecken<br>
                                                          V.A.T. ID.:
                                                          DE211006534<br>
                                                          <br>
                                                          Member of the
                                                          KEYDRIVE GROUP<br>
                                                          <a href="http://www.keydrive.lu/" target="_blank" moz-do-not-send="true">www.keydrive.lu</a><br>
                                                          <br>
                                                          This e-mail
                                                          and its
                                                          attachments is
                                                          intended only
                                                          for the person
                                                          to whom it
                                                          is addressed.
                                                          Furthermore it
                                                          is not
                                                          permitted to
                                                          publish any
                                                          content of
                                                          this email.
                                                          You must not
                                                          use, disclose,
                                                          copy, print or
                                                          rely on this
                                                          e-mail. If an
                                                          addressing
                                                          or transmission
                                                          error has
                                                          misdirected
                                                          this e-mail,
                                                          kindly notify
                                                          the author by
                                                          replying
                                                          to this e-mail
                                                          or contacting
                                                          us by
                                                          telephone.</span><span style="font-size: 10.5pt;"></span></p>
                                                      </div>
                                                    </div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                                  </div>
                                                </div>
                                              </blockquote><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                            </div>
                                          </blockquote><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                                        </div>
                                      </div>
                                    </div><p class="MsoNormal"><span style="font-size: 10.5pt;"><br>
                                        ______________________________<wbr>_________________<br>
                                        gnso-rds-pdp-wg mailing list<br>
                                        <a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" moz-do-not-send="true">gnso-rds-pdp-wg@icann.org</a><br>
                                        <a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" target="_blank" moz-do-not-send="true">https://mm.icann.org/mailman/<wbr>listinfo/gnso-rds-pdp-wg</a></span></p>
                                  </blockquote>
                                </div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                              </div>
                            </blockquote><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                          </div>
                        </div>
                      </div>
                    </blockquote>
                  </div><div><span style="font-size: 10.5pt;"> </span><br class="webkit-block-placeholder"></div>
                </div><p class="MsoNormal"><span style="font-size: 10.5pt;">______________________________<wbr>_________________
                    gnso-rds-pdp-wg mailing list <a href="mailto:gnso-rds-pdp-wg@icann.org" target="_blank" moz-do-not-send="true">gnso-rds-pdp-wg@icann.org</a>
                    <a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" target="_blank" moz-do-not-send="true">https://mm.icann.org/mailman/<wbr>listinfo/gnso-rds-pdp-wg</a></span></p>
              </blockquote>
            </div>
          </div>
        </blockquote>
      </div>
      <br>
      <br>
      -- <br>
      <div dir="ltr">
        <div>
          <div dir="ltr">
            <div>
              <div dir="ltr">
                <div>
                  <div dir="ltr">
                    <div>
                      <div dir="ltr">
                        <div>
                          <div dir="ltr">
                            <div> <br>
                              Regards <br>
                              Nanghaka Daniel K.<br>
                              <span style="font-size:small">Executive
                                Director - ILICIT Africa / Chair -
                                FOSSFA / Community Lead - ISOC Uganda
                                Chapter / Geo4Africa Lead / Organising
                                Team - FOSS4G2018</span><br>
                              Mobile +256 772 898298 (Uganda)<br>
                            </div>
                            <div>Skype: daniel.nanghaka<br>
                            </div>
                            <div><br>
                            </div>
                            <div>-----------------------------------------
                              <i>"Working for Africa" </i>-----------------------------------------<br>
                              <br>
                              <br>
                            </div>
                          </div>
                        </div>
                      </div>
                    </div>
                  </div>
                </div>
              </div>
            </div>
          </div>
        </div>
      </div>
      <br>
    </blockquote>
    <br>
  </div>

_______________________________________________<br>gnso-rds-pdp-wg mailing list<br><a href="mailto:gnso-rds-pdp-wg@icann.org">gnso-rds-pdp-wg@icann.org</a><br>https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg</blockquote></div><br></div></div></body></html>