<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<font face="Courier New, Courier" size="4">Rec SG.1<br>
<br>
New sentence added at the end:<br>
<br>
The ICANN Board should require that the ICANN Organization, in consultation with data security and privacy expert(s), ensure that all contracts with contracted parties (to include Privacy/Proxy services when such contracts exist) include uniform and strong
requirements for the protection of registrant data and for ICANN to be notified in the event of any data breach. The data security expert(s) should also consider and advise on what level or magnitude of breach warrants such notification.<br>
<br>
In carrying out this review, the data security and privacy expert(s) should consider to what extent GDPR regulations, which many but not all ICANN contracted parties are subject to, could or should be used as a basis for ICANN requirements. The ICANN Board
must either negotiate appropriate contractual changes or initiate a GNSO PDP to consider effecting such changes.<br>
<br>
The ICAN Board should consider whether and to what extent notifications of breaches that it receives should be publicly disclosed.<br>
</font>
</body>
</html>