<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Source Sans Pro";
panose-1:2 11 5 3 3 4 3 2 2 4;}
@font-face
{font-family:"Helvetica Neue";
panose-1:2 0 5 3 0 0 0 2 0 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:595.0pt 842.0pt;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:629945441;
mso-list-template-ids:1133920642;}
@list l0:level1
{mso-level-start-at:2;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1
{mso-list-id:664672066;
mso-list-template-ids:216023902;}
@list l2
{mso-list-id:1571306557;
mso-list-template-ids:1470636672;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:●;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
mso-text-animation:none;
text-decoration:none;
text-underline:none;
text-decoration:none;
text-line-through:none;}
@list l2:level2
{mso-level-number-format:bullet;
mso-level-text:○;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
mso-text-animation:none;
text-decoration:none;
text-underline:none;
text-decoration:none;
text-line-through:none;}
@list l2:level3
{mso-level-number-format:bullet;
mso-level-text:■;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
mso-text-animation:none;
text-decoration:none;
text-underline:none;
text-decoration:none;
text-line-through:none;}
@list l2:level4
{mso-level-number-format:bullet;
mso-level-text:●;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
mso-text-animation:none;
text-decoration:none;
text-underline:none;
text-decoration:none;
text-line-through:none;}
@list l2:level5
{mso-level-number-format:bullet;
mso-level-text:○;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
mso-text-animation:none;
text-decoration:none;
text-underline:none;
text-decoration:none;
text-line-through:none;}
@list l2:level6
{mso-level-number-format:bullet;
mso-level-text:■;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
mso-text-animation:none;
text-decoration:none;
text-underline:none;
text-decoration:none;
text-line-through:none;}
@list l2:level7
{mso-level-number-format:bullet;
mso-level-text:●;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
mso-text-animation:none;
text-decoration:none;
text-underline:none;
text-decoration:none;
text-line-through:none;}
@list l2:level8
{mso-level-number-format:bullet;
mso-level-text:○;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
mso-text-animation:none;
text-decoration:none;
text-underline:none;
text-decoration:none;
text-line-through:none;}
@list l2:level9
{mso-level-number-format:bullet;
mso-level-text:■;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
mso-text-animation:none;
text-decoration:none;
text-underline:none;
text-decoration:none;
text-line-through:none;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Dear SSR2 Review Team members,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Please see the below response from ICANN org to initial and follow-up questions from the SSR2 Review Team regarding GDPR.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>Review Team volunteers: <span style="background:yellow;mso-highlight:yellow">Eric, Norm, Laurin, Kerry-Ann, Noorul</span></b><o:p></o:p></p>
<p class="MsoNormal"><b>Workstream: Future Challenges</b><o:p></o:p></p>
<p class="MsoNormal"><b>Topic: Privacy protections </b><i>(DNS over TLS / over HTTPS; Circular dependencies between WebPKI and DNSSEC; Impact on Proactive anti-abuse and investigations)</i><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Response from ICANN org:<o:p></o:p></p>
<p class="MsoNormal"><span lang="EN">ICANN’s achievement of recent GDPR-related milestones, including the (a) the Board’s
<a href="https://www.icann.org/news/announcement-2018-05-17-en">approval of the Temporary Specification</a> for gTLD Registration Data (Temp Spec) and (b) the GNSO Council’s
<a href="https://www.icann.org/news/announcement-2019-03-04-en">4 March 2019 adoption</a> of the Final Recommendations of the Expedited Policy Development Process on the Temporary Specification for gTLD Registration Data (Final Recommendations), is the product
of an unprecedented investment of ICANN org, Board, and community resources. Reaching these milestones was a notable accomplishment, but ICANN’s work related to GDPR is by no means complete.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN">ICANN org provides this answer, which is focused on GDPR-related impacts on the availability of registration directory data, in response to the SSR2 Review Team’s initial and follow-up questions, as follows:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN"><o:p> </o:p></span></p>
<ul style="margin-top:0in" type="disc">
<li class="MsoNormal" style="margin-left:0in;mso-list:l2 level1 lfo3"><span lang="EN">How will ICANN continue to follow up on the GDPR and related decisions?<o:p></o:p></span></li><li class="MsoNormal" style="margin-left:0in;mso-list:l2 level1 lfo3"><span lang="EN">What is ICANN’s response to GDPR in the spirit of ensuring facilitation of investigation and research?
<o:p></o:p></span></li><li class="MsoNormal" style="margin-left:0in;mso-list:l2 level1 lfo3"><span lang="EN">How will the work of the e-PDP working group be synergised with the recommendation of the various working groups releasing recommendations that it would impact at the same
time? <o:p></o:p></span></li><li class="MsoNormal" style="margin-left:0in;mso-list:l2 level1 lfo3"><span lang="EN">The German Appellate Court decision on ICANN Request to Preserve WHOIS Data is one of the cases in point. This case was highly publicized when the GDPR came into effect however,
since then, how these decisions are catalogued and analyzed to inform policy is not clear. This is what we refer to as ‘related decisions’.<o:p></o:p></span></li></ul>
<p class="MsoNormal"><span lang="EN"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN">ICANN’s GDPR Follow-Up<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="EN">The ICANN Board will continue to oversee ICANN org’s efforts related to GDPR, as we rapidly approach the 20 May 2019 expiration of the Temp Spec. ICANN org executives manage subject-matter experts from various departments
who are supporting the community’s efforts, including through the anticipated implementation of the policy and contractual changes included in the EPDP Team’s Final Recommendations.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN">ICANN org will continue to engage in a range of forums and with a range of stakeholders on GDPR-related issues that are relevant to ICANN's mission, including privacy and law enforcement. ICANN org will continue to engage
with the European community (including the European Data Protection Board), data protection agencies, and other relevant stakeholders to gain a better understanding of the relevant aspects of GDPR related to the work of ICANN org and its contracts with registry
operators and registrars. <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN">In terms of cataloguing relevant judicial developments, ICANN org tracks and posts GDPR-related judicial decisions in which ICANN is involved on
<a href="https://www.icann.org/resources/pages/data-protection-announcements-2017-12-08-en">
this webpage</a>. This page is a resource for ICANN org and the broader community to inform all of our activities, including as a resource for policy development. ICANN org’s<a href="https://www.icann.org/legislative-report-2019">
</a><a href="https://www.icann.org/legislative-report-2019">Global Legislative and Regulatory Tracking report</a> is another source of information for the community on relevant developments in other jurisdictions, as we understand that the landscape outside
of Europe is also undergoing change. ICANN org also recently released its <a href="https://www.icann.org/en/system/files/files/proposed-org-engagement-govt-standards-charter-25feb19-en.pdf">
draft</a><a href="https://www.icann.org/en/system/files/files/proposed-org-engagement-govt-standards-charter-25feb19-en.pdf"> charter</a> for engagement on legislative and regulatory activity, describing the types of educational efforts that ICANN org will
undertake (where appropriate) in order to allow lawmakers to understand the potential impacts on ICANN’s mission.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN">Recommended New gTLD Registration Data Policy<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="EN">In working to address GDPR, ICANN org’s goal has been to preserve WHOIS to the greatest extent possible while also complying with applicable laws.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN">ICANN’s mission and mandate, as stated in ICANN’s Bylaws, led to WHOIS obligations encapsulated in ICANN consensus policies and agreements that ICANN org has with registry operators and registrars. In the pre-Temp Spec environment,
these policies and contractual obligations set the minimum requirements governing the collection, retention, escrow, transfer, and display of registration data, which included contact information of the registrant, administrative, and technical contacts as
well as technical information associated with a domain name. The GDPR imposed new obligations that would have made it impossible, without a step such as adoption of the Temp Spec, for ICANN org, registry operators, and registrars to continue to comply with
ICANN org agreements and the law. This would have resulted in the inability of ICANN org to enforce its contracts. This would also have resulted in each registry operator and registrar making its own determination regarding what gTLD registration data should
be collected, transferred, and published, leading to a fragmentation of the globally distributed WHOIS system. Fragmentation of the WHOIS system would jeopardize the availability of registration data, which is essential to ensuring the security and stability
of the Internet, including to mitigate attacks that threaten the stable and secure operation of the Internet.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN">The consensus policy recommendations of the EPDP Team will, provided such recommendations are approved by the Board, become a new gTLD Registration Data Policy (Policy). This Policy will require registry operators and registrars
to collect, retain, and publish a reduced amount of registrant data, compared to ICANN’s pre-GDPR requirements. This Policy will reduce the amount of registration data that contracted parties will be required to make available to third parties, including those
involved in investigations and research. However, pending additional work by the EPDP Team on access to gTLD registration data in Phase 2, this Policy will require registry operators and registrars to publish, in a publicly accessible section of their websites,
the mechanism and process for submitting requests for lawful disclosure of nonpublic registration data (See
<a href="https://gnso.icann.org/sites/default/files/file/field-file-attach/epdp-gtld-registration-data-specs-final-20feb19-en.pdf">
EPDP Team Recommendation 18</a>). <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN">The EPDP Team is expected to consider in Phase 2 whether a standardized model for lawful disclosure of non-public registration data should be adopted, and, if such a system is adopted, the specifics about who would have
access to that system and what registration data would be made available (See <a href="https://gnso.icann.org/sites/default/files/file/field-file-attach/epdp-gtld-registration-data-specs-final-20feb19-en.pdf">
EPDP Team Recommendation 3</a>). In this context, the EPDP Team will consider, among other issues, disclosure in the context of intellectual property infringement and DNS abuse cases. The EPDP Team recognized that ICANN has a responsibility to foster openness,
interoperability, resilience, security, and/or stability of the DNS in accordance with its stated mission. The EPDP Team also recognized that ICANN may have a purpose to require actors in the ecosystem to respond to data disclosure requests that are related
to the security, stability, and resilience of the system. The EPDP Team is expected to consider in Phase 2 whether additional purposes should be considered to facilitate ICANN org’s Office of the Chief Technology Officer to carry out its mission (See
<a href="https://gnso.icann.org/sites/default/files/file/field-file-attach/epdp-gtld-registration-data-specs-final-20feb19-en.pdf">
EPDP Team Recommendation 2</a>). <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">ssr2-coordination <ssr2-coordination-bounces@icann.org> on behalf of "Barrett, Kerry-Ann" <kabarrett@oas.org><br>
<b>Date: </b>Saturday, March 9, 2019 at 5:27 AM<br>
<b>To: </b>Russ Housley <housley@vigilsec.com><br>
<b>Cc: </b>ssr2-coordination <ssr2-coordination@icann.org><br>
<b>Subject: </b>Re: [Ssr2-coordination] [EXT] KERRY-ANN: Clarification request: Privacy protections question<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">Hi Russ <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">See clarification below. Please let me know if there has been progress on the ICANN GDPR track I’m unaware of but I just did a search before writing the response and couldn’t find anything publicly available
. <o:p></o:p></p>
<div id="AppleMailSignature">
<p class="MsoNormal">Sincerely, <o:p></o:p></p>
<div>
<p class="MsoNormal">Kerry-Ann Barrett<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Cybersecurity Policy Specialist<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Organization of American States <o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
On Mar 8, 2019, at 11:48 PM, Russ Housley <<a href="mailto:housley@vigilsec.com">housley@vigilsec.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">Kerry-Ann: <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Can you provide clarification?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Russ<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><b><span style="font-family:"Helvetica Neue",sans-serif">From:
</span></b><span style="font-family:"Helvetica Neue",sans-serif">Eric Osterweil <<a href="mailto:eric@osterweil.net">eric@osterweil.net</a>></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><b><span style="font-family:"Helvetica Neue",sans-serif">Subject: Re: ERIC: Clarification request: Privacy protections question</span></b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><b><span style="font-family:"Helvetica Neue",sans-serif">Date:
</span></b><span style="font-family:"Helvetica Neue",sans-serif">March 8, 2019 at 11:14:13 PM EST</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><b><span style="font-family:"Helvetica Neue",sans-serif">To:
</span></b><span style="font-family:"Helvetica Neue",sans-serif">Russ Housley <<a href="mailto:housley@vigilsec.com">housley@vigilsec.com</a>></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><b><span style="font-family:"Helvetica Neue",sans-serif">Cc:
</span></b><span style="font-family:"Helvetica Neue",sans-serif">ssr2-coordination <<a href="mailto:ssr2-coordination@icann.org">ssr2-coordination@icann.org</a>></span><o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">I looked at this question and I think this is more in Kerry-Ann’s bailiwick than mine. Can we ask her to weigh in so that we don’t lose the goal of the question?
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Eric<o:p></o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Mar 8, 2019, at 11:46 AM, Russ Housley <<a href="mailto:housley@vigilsec.com">housley@vigilsec.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Eric: <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I think your paper is now behind you. No one else has spoken up, so will you please send a response to Jennifer.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Russ<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Feb 24, 2019, at 1:19 PM, Russ Housley <<a href="mailto:housley@vigilsec.com">housley@vigilsec.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Eric: <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Once your paper is behind you, if one of the others has not spoken up, please offer a clarification for the Review Team to consider.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Russ<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Feb 22, 2019, at 5:07 AM, Jennifer Bryce <<a href="mailto:jennifer.bryce@icann.org">jennifer.bryce@icann.org</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal" style="background:white">Dear SSR2 Review Team,<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"> <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white">Some clarification is sought on the below question. Would volunteers from the group asking the question please review the below request and provide further guidance?<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><br>
<b>Review Team volunteers:<span class="apple-converted-space"> </span><span style="background:yellow">Eric, Norm, Laurin, Kerry-Ann, Noorul</span></b><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><b>Workstream: Future Challenges</b><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><b>Topic: Privacy protections<span class="apple-converted-space"> </span></b><i>(DNS over TLS / over HTTPS; Circular dependencies between WebPKI and DNSSEC; Impact on Proactive anti-abuse and investigations)</i><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"> <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white">Q: How will ICANN continue to follow up on the GDPR and related decisions?<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"> <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white">Clarification requested from ICANN org:<i> </i><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><i> </i><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white">In providing our response:<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"> <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<ol style="margin-top:0in" start="1" type="1">
<li class="MsoNormal" style="margin-left:0in;mso-list:l1 level1 lfo1;background:white">
Is there an expectation for us to look into each of the technical topics, i.e.:<span style="font-size:12.0pt"><o:p></o:p></span></li></ol>
<div style="margin-left:.75in">
<p class="MsoNormal" style="text-indent:-.25in;background:white"><span style="font-size:10.0pt;font-family:Symbol">·</span><span style="font-size:7.0pt;font-family:"Times New Roman",serif"> <span class="apple-converted-space"> </span></span>DNS over
TLS/over HTTPS;<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div style="margin-left:.75in">
<p class="MsoNormal" style="text-indent:-.25in;background:white"><span style="font-size:10.0pt;font-family:Symbol">·</span><span style="font-size:7.0pt;font-family:"Times New Roman",serif"> <span class="apple-converted-space"> </span></span>Circular
dependencies between WebPKI and DNNSEC; and<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div style="margin-left:.75in">
<p class="MsoNormal" style="text-indent:-.25in;background:white"><span style="font-size:10.0pt;font-family:Symbol">·</span><span style="font-size:7.0pt;font-family:"Times New Roman",serif"> <span class="apple-converted-space"> </span></span>Impact on
Proactive anti-abuse and investigations.<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div style="margin-left:.75in">
<p class="MsoNormal" style="text-indent:-.25in;background:white"> NO, THIS WAS NOT THE INTENT OF THE QUESTION. WHILE SPECIFIC RECOMMENDATIONS RELATED TO GDPR AND DNS MAY BE MADE ONCE THE REVIEW IS COMPLETE. <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="background:white">OR<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"> <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<ol style="margin-top:0in" start="2" type="1">
<li class="MsoNormal" style="margin-left:0in;mso-list:l0 level1 lfo2;background:white">
Is the SSR2 RT looking for a more general, broad response i.e. what ICANN is doing re: GDPR; and how ICANN will continue to follow up/keep abreast on GDPR developments.<span style="font-size:12.0pt"><o:p></o:p></span></li></ol>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
<p class="MsoNormal">YES, IN PART. But more specifically in an effort to avoid liability under the GDPR, registrars are refraining from publishing WHOIS information. Instead, under the temporary specification developed by ICANN, many are providing a randomized
email address or web-based contact only, which can be used to contact the registrant anonymously.
<o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt">The temporary specification also requires each registrar to determine, on a case-by-case basis, whether the party requesting the personal information has a legitimate interest in the information and whether it outweighs
the privacy interests of the registrant. This has hampered many law enforcement investigations and the work of researchers as well. Why is this relevant? The absence of a clear way forward hampers protections from an investigative and compliance perspective.
Therefore the questions seeks to ask ‘ what is ICANNs response to GDPR in the spirit of ensuring facilitation of investigation and research?’/ ‘how will the work of the e-PDP working group synergised with the recommendation of the various working groups releasing
recommendations that it would impact at the same time’<o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;font-stretch: normal"><o:p> </o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;font-stretch: normal">2. What does GDPR and “<b><u>related decisions</u></b>” specifically mean in this context? <o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt;font-stretch: normal">THE <span style="font-size:13.5pt">German Appellate Court decision on </span>ICANN<span style="font-size:13.5pt"> Request to Preserve </span>WHOIS<span style="font-size:13.5pt">Data is one of
the case in point. This case was highly publicized when the GDPR came into effect however since then, how these decisions are catalogued and analyzed to inform policy is not clear. This is what we refer to as ‘related decisions’.</span><o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="background:white"> <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white">Thank you,<br>
Jennifer<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.5pt">-- </span><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal" style="background:white"><b><span style="font-size:10.0pt;font-family:"Source Sans Pro";color:#595959">Jennifer Bryce</span></b><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Source Sans Pro";color:#595959">Senior Reviews Coordinator </span><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Source Sans Pro";color:#595959">Internet Corporation for Assigned Names and Numbers (ICANN)</span><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Source Sans Pro""> </span><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Source Sans Pro";color:#595959">Email:<span class="apple-converted-space"> </span><a href="mailto:jennifer.bryce@icann.org"><span style="color:#954F72">jennifer.bryce@icann.org</span></a></span><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Source Sans Pro";color:#595959">Skype: jennifer.bryce.icann</span><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Source Sans Pro";color:#595959"><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__www.icann.org_&d=DwMF-g&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=VuRMFw6YascG5ysc1jEHBZgGTtD6QSLrFmqdvMx5FM8&m=dd3XdrKvugTkoUcuCqykpYVQ9UxbxxfBUHvO7emHWcA&s=7GhK68VU8T68rbwOe3TaWexv6QToX6TdSFNL0_ZsJ9s&e="><span style="color:#954F72">www.icann.org
[icann.org]</span></a></span><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;background:white">_______________________________________________</span><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif"><br>
<span style="background:white">Ssr2-review mailing list</span><br>
</span><a href="mailto:Ssr2-review@icann.org"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#954F72;background:white">Ssr2-review@icann.org</span></a><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif"><br>
</span><a href="https://mm.icann.org/mailman/listinfo/ssr2-review"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#954F72;background:white">https://mm.icann.org/mailman/listinfo/ssr2-review</span></a><o:p></o:p></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</blockquote>
</div>
</div>
</body>
</html>