<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Arial",sans-serif;
color:windowtext;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="FR" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US">Dear Councilors,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US">Please note Janis’s report of his meeting with the ODP team last week. Feel free to share any questions you may have.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US">Note also the webinar on Thursday, which unfortunately clashes with our wrap-up.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US">Regards
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US">Philippe<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b>From:</b> Janis Karklins <karklinsj@gmail.com> <br>
<b>Sent:</b> Tuesday, October 26, 2021 12:32 PM<br>
<b>To:</b> FOUQUART Philippe INNOV/NET <philippe.fouquart@orange.com><br>
<b>Cc:</b> Yuko Green <yuko.green@icann.org>; Caitlin Tubergen <caitlin.tubergen@icann.org><br>
<b>Subject:</b> SSAD OPD - meeting with staff report<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-family:"Arial",sans-serif">Dear Councilors,</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-family:"Arial",sans-serif"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-family:"Arial",sans-serif">I am including a summary of my recent meeting with the ICANN Org SSAD ODP colleagues on 20 October.</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-family:"Arial",sans-serif"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-family:"Arial",sans-serif">The SSAD ODP Team identified additional questions and assumptions, which we discussed during our meeting. The assumptions and my responses are annexed to this
message for your information. The SSAD ODP Team plans, pending no objection from the GNSO Council, to proceed with its work on the basis of these assumptions and my responses thereto. The verified assumptions will be used by the SSAD ODP Team as it continues
to work on an assessment to inform the Board’s review of the EPDP Phase 2 SSAD-related policy recommendations.</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-family:"Arial",sans-serif"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-family:"Arial",sans-serif">Lastly, we briefly discussed the upcoming SSAD ODP Project Update #3 and Community Discussion Webinar, which will take place during ICANN72 on Thursday, 28
October at 19:30 UTC. The SSAD ODP Team recognizes that this session conflicts with the GNSO Council Wrap-Up; however, if any councilors have additional questions not addressed during the session, I am happy to bring these to the attention of the SSAP ODP
Team during our next meeting in November.</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-family:"Arial",sans-serif"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-family:"Arial",sans-serif">Please let me know if you have any questions or concerns regarding my responses to the SSAD ODP Team.</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-family:"Arial",sans-serif"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-family:"Arial",sans-serif">Thank you.</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-family:"Arial",sans-serif"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-family:"Arial",sans-serif">Best regards,</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-family:"Arial",sans-serif">JK</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="592" style="width:444.0pt;border-collapse:collapse">
<tbody>
<tr style="height:269.5pt">
<td width="286" valign="top" style="width:214.5pt;border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;height:269.5pt">
<p class="MsoNormal" style="line-height:115%"><span style="font-size:10.0pt;line-height:115%;font-family:"Arial",sans-serif"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-size:10.0pt;line-height:115%;font-family:"Arial",sans-serif">The areas identified in the SSAD that interact with ICANN Contractual Compliance, like requestor/data subject procedural complaints
and Contracted Party SLA issues, appear to integrate well within the existing processes that ICANN Contractual Compliance employs. For instance, the complaints from requestors and data subjects could come through external facing complaint forms that would
be developed, and if needed, automated processes may be developed for processing issues such as those related to SLA violations. From there, the complaints can be processed per ICANN Contractual Compliance’s standard approach and processes.</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-size:10.0pt;line-height:115%;font-family:"Arial",sans-serif;color:#500050"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><i><span lang="EN" style="font-size:10.0pt;line-height:115%;font-family:"Arial",sans-serif;color:#500050">Question 1: Does the proposed approach regarding development of potential complaint forms or automated notifications
(where possible) fulfill the intentions of the recommendations?</span></i><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
</td>
<td width="62" valign="top" style="width:46.5pt;border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;height:269.5pt">
<p class="MsoNormal" style="line-height:115%"><span lang="EN"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
</td>
<td width="244" valign="top" style="width:183.0pt;border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;height:269.5pt">
<p class="MsoNormal" style="line-height:115%"><span lang="EN"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN">Indeed, it was intention – to use the existing ICANN compliance mechanism in case the requestors or registries/registrars could file a compliance complaint in situations prescribed by the policy
recommendations.</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN">It was never planned, though, that data subjects would use ICANN's compliance mechanism in SSAD context.</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="line-height:115%"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="592" style="width:444.0pt;border-collapse:collapse">
<tbody>
<tr style="height:593.5pt">
<td width="286" valign="top" style="width:214.5pt;border:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;height:593.5pt">
<p class="MsoNormal" style="margin-top:20.0pt;line-height:115%"><b><span lang="EN" style="font-size:10.0pt;line-height:115%;font-family:"Arial",sans-serif">Automation of Disclosure Request Processing</span></b><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-size:10.0pt;line-height:115%;font-family:"Arial",sans-serif">Per recommendation 9.4, only the following categories are considered to meet the criteria for automated processing of data
disclosure:</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:47.0pt;line-height:115%"><span lang="EN" style="font-size:10.0pt;line-height:115%">·</span><span lang="EN" style="font-size:7.0pt;line-height:115%;font-family:"Times New Roman",serif">
</span><span lang="EN" style="font-size:10.0pt;line-height:115%;font-family:"Arial",sans-serif">Requests from Law Enforcement in local or otherwise applicable jurisdictions with either 1) a confirmed GDPR 6(1)e lawful basis or 2) processing is to be carried
out under a GDPR, Article 2 exemption;</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:47.0pt;line-height:115%"><span lang="EN" style="font-size:10.0pt;line-height:115%">·</span><span lang="EN" style="font-size:7.0pt;line-height:115%;font-family:"Times New Roman",serif">
</span><span lang="EN" style="font-size:10.0pt;line-height:115%;font-family:"Arial",sans-serif">The investigation of an infringement of the data protection legislation allegedly committed by ICANN/Contracted Parties affecting the registrant;</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:47.0pt;line-height:115%"><span lang="EN" style="font-size:10.0pt;line-height:115%">·</span><span lang="EN" style="font-size:7.0pt;line-height:115%;font-family:"Times New Roman",serif">
</span><span lang="EN" style="font-size:10.0pt;line-height:115%;font-family:"Arial",sans-serif">Request for city field only, to evaluate whether to pursue a claim or for statistical purposes;</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:47.0pt;line-height:115%"><span lang="EN" style="font-size:10.0pt;line-height:115%">·</span><span lang="EN" style="font-size:7.0pt;line-height:115%;font-family:"Times New Roman",serif">
</span><span lang="EN" style="font-size:10.0pt;line-height:115%;font-family:"Arial",sans-serif">No personal data on registration record that has been previously disclosed by the Contracted Party.</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN" style="font-size:10.0pt;line-height:115%;font-family:"Arial",sans-serif"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><i><span lang="EN" style="font-size:10.0pt;line-height:115%;font-family:"Arial",sans-serif">Question 2: We note the first bullet specifically references the GDPR. Our understanding is the above categories were included
in the legal guidance provided to the EPDP Team, and the legal guidance specifically referenced the GDPR. Our assumption is the EPDP Team considered this guidance in developing this recommendation but did not intend to exclude privacy laws outside the GDPR.
In other words, though this first use case only references the specific scenario in which a law enforcement requestor has a legal basis for processing under GDPR 6(1)e (or whose processing is explicitly exempted from GDPR’s restrictions on data processing),
other law enforcement authorities who are outside the EU might also qualify for automated disclosure if they have a comparable legitimate interest in processing such data under their own local law. Can you please confirm if this assumption is correct (or if,
conversely, the intention was only for EU law enforcement requests to have the potential for automation under this use case)?
</span></i><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><b><i><span lang="EN" style="font-size:10.0pt;line-height:115%;font-family:"Arial",sans-serif"> </span></i></b><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><i><span lang="EN" style="font-size:10.0pt;line-height:115%;font-family:"Arial",sans-serif;color:black">If the above assumption is correct, we also note the recommendation provides for the automation of the use
cases described in 9.4.1 - 9.4.4 “from the time of the launch of the SSAD”. The SSAD ODP Team will ensure the Operational Design Assessment will include the automation of the specified use cases from Day 1; however, we will note that other use cases outside
of the GDPR may be added in future, provided the appropriate processes are followed.
</span></i><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
</td>
<td width="62" valign="top" style="width:46.5pt;border:solid black 1.0pt;border-left:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;height:593.5pt">
<p class="MsoNormal" style="line-height:115%"><span lang="EN"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
</td>
<td width="244" valign="top" style="width:183.0pt;border:solid black 1.0pt;border-left:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;height:593.5pt">
<p class="MsoNormal" style="line-height:115%"><span lang="EN"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span lang="EN">The assumption is correct. Even EPDP was created to develop ICANN policy to accommodate the GDPR requirements, the EPDP Team took broader approach and attempted to formulate recommendations that
would correspond not only to the GDPR, but also to all existing and possible future privacy regulations in different parts of the world. Reference to specific provisions of GDPR in 9.4.1 is evident as it was existing regulation at the time of the formulation
of the recommendation.</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="line-height:115%"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
</div>
<PRE>_________________________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
</PRE></body>
</html>