[GNSO-Accuracy-ST] Potential Additional Questions to ICANN Org

Tue Mar 1 18:16:27 UTC 2022

Hi Michael,

as one of the objectors, let me elaborate.

When we want to look at accuracy, the status quo as a whole must be the
gold standard for measuring. By only looking at a subset of domain names
that have already demonstrably been identified as problematic, we will not
be getting an unbiased result that gives _any_ insight on the issue (if
there is an issue) of accuracy in the whole ecosystem. Especially since
criminals tend not to provide their real contact details but are usually
quite crafty at still meeting the formal requirements.

In other words, by proposing to use only this subset of domain names for a
study that is intended to inform future discussions, you are loading the
dice towards a desired outcome.

I find it disappointing that as chair you do not seem to be following the
core principles of neutrality and are characterizing a very reasonable
opposition against an unreasonable approach as "disappointing".

As a scoping team we cannot narrow down the scope until the desired outcome
is assured, but we need a 360° view of the issue instead. Only then can we
make an unbiased determination on the actual scope of the issue and provide
a sound basis for any subsequent policy work.

-- 
Volker A. Greimann
General Counsel and Policy Manager
*KEY-SYSTEMS GMBH*

T: +49 6894 9396901
M: +49 6894 9396851
F: +49 6894 9396851
W: www.key-systems.net

Key-Systems GmbH is a company registered at the local court of
Saarbruecken, Germany with the registration no. HR B 18835
CEO: Oliver Fries and Robert Birkner

Part of the CentralNic Group PLC (LON: CNIC) a company registered in
England and Wales with company number 8576358.

This email and any files transmitted are confidential and intended only for
the person(s) directly addressed. If you are not the intended recipient,
any use, copying, transmission, distribution, or other forms of
dissemination is strictly prohibited. If you have received this email in
error, please notify the sender immediately and permanently delete this
email with any files that may be attached.

On Tue, Mar 1, 2022 at 6:15 PM Michael Palage <michael at palage.com> wrote:

> Hello Becky,
>
>
>
> I think we are in agreement that the processing/disclosing of non-public
> PII involves a two part test: legitimate interest and proportionate
> interest.  As you and others may recall this is why I have proposed that
> any limited restart of the ARS program involve a sampling of the data from
> the monthly DAAR reporting.
>
>
>
> From a legitimate interest standpoint, the domains reported in DAAR (e.g.
> malware, phishing, SPAM) are clearly involved in illegal activity in most
> jurisdictions. I do not see any situation in which ICANN would not easily
> clear this bar. Would you agree?
>
>
>
> With regard to the proportionality (balancing test), as will be discussed
> in the upcoming ICANN73 meeting, there are two types of potential
> registrations involving abusive domains, maliciously registered domain
> names and compromised domain names. From a “balancing test” ICANN easily
> clears any proportionality bar when looking at maliciously registered
> domain names.  Would you agree?
>
>
>
> With regard to compromised domains, while this balancing test is a little
> more substantive than with malicious domain names, I believe this is a bar
> that ICANN Org and the Contracting Parties should easily be able to clear
> in almost every scenario. Unlike the old Whois/RDDS that made registrant
> data publicly available for scraping, this proposed audit would be limited
> to a restrictive number of parties, ICANN, third-party vendor, and
> contracting party. Would you agree?
>
>
>
> I am also in agreement with your comments distinguishing between targeted
> processing/disclosure versus bulk processing/disclosure.  This is why I
> made the specific proposal to restart ADR on a limited scale targeting just
> Abusive Domain Names reported via DAAR. This targeted focus should address
> your bulk processing claims. Would you agree?
>
>
>
> What I found disappointing when I brought this to the consideration of the
> entire Working Group is that several Contracting Parties opposed this
> potential reasonable path forward because they thought that this would
> potentially skew the accuracy results. These Contracting Parties instead
> were adamant that any survey would need to involve the entire data set. My
> concern with this position is that any demands to include the entire set is
> potentially a non-start for processing in a legal compliant manner per the
> GDPR.
>
>
>
> In order to further explore your claim that the DPA is a red hearing,
> perhaps the Registry and Registrars representatives could go back to their
> respective stakeholders groups and ask for scenarios in which they would be
> willing to transfer data to ICANN or a designated vendor to check the
> accuracy of data. Would you agree with me that this data point would be
> extremely helpful in resolving potential ambiguity between the parties and
> their respective roles?
>
>
>
> In closing, I want to thank both Becky and Melina for your respective
> feedback and I look forward to additional constructive feedback going
> forward.
>
>
>
> Best regards,
>
>
>
> Michael
>
>
>
> *From:* STROUNGI Melina <Melina.STROUNGI at ec.europa.eu>
> *Sent:* Tuesday, March 1, 2022 11:13 AM
> *To:* Becky Burr <becky.burr at board.icann.org>; michael at palage.com
> *Cc:* gnso-accuracy-st at icann.org
> *Subject:* RE: [GNSO-Accuracy-ST] Potential Additional Questions to ICANN
> Org
>
>
>
> Dear Becky, all,
>
>
>
> many thanks for your additional suggestions.
>
>
>
> my two cents on the below:
>
>
>
> I support the distinction proposed by Becky, but would recommend replacing
> ‘proportionate’ with ‘under the GDPR’ so we are fully covered.
>
>
>
> The original question raised was “*Is ICANN able to access registration
> data under the GDPR on the basis that it has a legitimate interest in
> checking the accuracy of the data? “*
>
> The reference alone to the GDPR means that indeed the balancing test has
> been taken into account. As you rightly point out the GDPR requires a
> balancing test when ‘legitimate interests’ is used as a legal basis. So in
> my view as long as there is a reference to the GDPR there is no need to
> explicitly add the proportionate part. It is already implied. Plus, a more
> general reference is more encompassing in the sense that it takes into
> account the totality of the balancing test (i.e., data subjects’ interests
> etc.)
>
>
>
> Having said that I am all supportive of asking all of these questions (in
> general I am in favor of asking as many questions as we can think of as
> this is at the heart of our scoping tasks), but I would maintain –on top of
> what you suggest –the specific question on whether ICANN ever received or
> plans to receive legal advice on this particular topic.
>
> If I recall correctly this had been discussed in our accuracy scoping
> meeting  of 17 February and was proposed as a question to be addressed to
> Brian so he can forward it to ICANN compliance.
>
>
>
> In order to be able to progress with our discussions, it is important to
> know where exactly ICANN would base their assessment on these questions
> (i.e., whether they have received specific in-house or external legal
> advice, including but not limited to any correspondence with the EDPB).
>
>
>
> I have now tried to integrate Becky’s suggestion to the original
> questions. Hope this helps.
>
>
>
>
>
> *Question 1*
>
>    1. Does ICANN have a legitimate interest under the GDPR in accessing *domain
>    name registration data in response to complaints* that the data is
>    inaccurate? Has ICANN ever received or plans to receive legal advice on
>    this particular topic?
>    2. Does ICANN have a legitimate interest under the GDPR in *proactively
>    *acquiring *bulk access* to domain name registration data to undertake
>    an accuracy audit, even with respect to data for which it has no basis to
>    question its accuracy? Has ICANN ever received or plans to receive legal
>    advice on this particular topic?
>
> *Question 2*
>
> *For either scenario a or b under question 1*: Does ICANN believe that a
> Data Protection Agreement between itself and the Contracted Parties is a
> necessary legal requirement for requesting and receiving this data, and if
> so for what legal reason? What happens if the registrar receiving the
> access request disagrees with ICANN's application of the balancing test,
> i.e., does ICANN have the contractual authority to enforce its access
> request?
>
> Best,
>
> Melina
>
>
>
>
>
> *From:* GNSO-Accuracy-ST <gnso-accuracy-st-bounces at icann.org> *On Behalf
> Of *Becky Burr
> *Sent:* Tuesday, March 1, 2022 4:27 PM
> *To:* michael at palage.com
> *Cc:* gnso-accuracy-st at icann.org
> *Subject:* Re: [GNSO-Accuracy-ST] Potential Additional Questions to ICANN
> Org
>
>
>
> Michael -
>
>
>
> Respectfully, and without taking a position on whether these questions are
> relevant or timely, I think the questions need to be more nuanced to
> produce useful answers.
>
>    1. Does ICANN have a legitimate *and proportionate *interest in
>    accessing *individual registration records in response to credible
>    complaints* that the data is inaccurate? If so, is a DPA required to
>    access data in such situations?  What happens if the registrar receiving
>    the access request disagrees with ICANN's application of the balancing
>    test, i.e., does ICANN have the contractual authority to enforce its access
>    request?
>    2. Does ICANN have a legitimate *and proportionate* interest in *proactively
>    *acquiring *bulk access* to registrant data to undertake an accuracy
>    audit, even with respect to data for which it has no basis to question its
>    accuracy?  If so, is a DPA necessary to do so?  What happens if the
>    registrar receiving the access request disagrees with ICANN's application
>    of the balancing test, i.e., does ICANN have the contractual authority to
>    enforce its access request?
>
> It is important to keep in mind that a legitimate interest is necessary *but
> not sufficient* under GDPR.  The processing necessary to satisfy a
> legitimate interest must be proportionate, i.e., not outweighed by the
> privacy rights of the individual data subject(s).  As a result, the two
> situations (access to a single record based on reasonable grounds to
> believe the data is inaccurate v. proactive access without individualized
> suspicion) are quite different from a data protection perspective, with the
> first being far less complicated to defend.  In addition, a CP's
> contractual obligations, e.g., under the RAA, may be different in those
> situations.
>
>
>
> FWIW, I think the DPA issue is a bit of a red herring here.   Presumably,
> ICANN's requests for one-off data can be handled in the same way that
> anyone else's access request is handled, e.g., if the data is to be
> transferred outside of the EU by imposing controller to controller Standard
> Contractual Clauses as the terms and conditions of such access on a
> case-by-case basis.  If the EDPB were to confirm that ICANN's* bulk
> access* to data for proactive checking was legitimate and proportionate,
> it's clear to me that a narrowly focused DPA between ICANN and CPs
> applicable to data access for the specific purpose of checking accuracy
> (e.g., prohibiting onward transfer, etc.) could be crafted.  The real
> question is whether (i) the temp spec /epdp phase 1 policy obligating CPs
> to provide reasonable access for legitimate and proportionate purposes
> encompasses bulk access or (ii) some other provision of the agreements
> produces an obligation to provide bulk access.
>
>
>
> Apologies for being pedantic here.  None of us can say with any certainty
> what GDPR does or does not permit as that determination is ultimately made
> by individual data protection authorities and/or the EDPB.  We are asking
> ICANN for its views on what GDPR would permit in specific circumstances, so
> the relevant circumstances should be articulated precisely to produce
> useful answers.
>
>
>
> b
>
>
>
>
>
> On Thu, Feb 24, 2022 at 5:12 PM Michael Palage <michael at palage.com> wrote:
>
> Hello Everyone,
>
>
>
> Over the past couple of weeks there has been a recurring theme in our
> calls and in some of the side discussions that I have had with some members
> regarding about how the potential lack of a Data Processing Agreement
> between ICANN Org and the Contracting Parties might negatively impact our
> future work and/or recommendations.
>
>
>
> Therefore I would like to propose to the group for their consideration the
> following additional questions that we may want to propose to ICANN Org as
> we continue our work:
>
>
>
> •            “Is ICANN able to access registration data under the GDPR on
> the basis that it has a legitimate interest in checking the accuracy of the
> data?  Has ICANN ever received or plans to receive legal advice on this
> particular topic?
>
>
>
> •            Does ICANN believe that the Data Protection Agreement between
> itself and the Contracted Parties is a necessary legal requirement for
> requesting and receiving this data, and if so for what legal reason?"
>
>
>
> As always I welcome any thoughts and or considerations?
>
>
>
> Best regards,
>
>
>
> Michael
>
>
>
>
>
> _______________________________________________
> GNSO-Accuracy-ST mailing list
> GNSO-Accuracy-ST at icann.org
> https://mm.icann.org/mailman/listinfo/gnso-accuracy-st
> <https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-accuracy-st__;!!DOxrgLBm!UNIutLhtKN79DDAyXMFbwLBM5YmXBcSEX_Z4GrdQYmzW9hzoy8-8tEvp-nQ58gfd3kyLTw-r$>
>
> _______________________________________________
> By submitting your personal data, you consent to the processing of your
> personal data for purposes of subscribing to this mailing list accordance
> with the ICANN Privacy Policy (https://www.icann.org/privacy/policy
> <https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm!UNIutLhtKN79DDAyXMFbwLBM5YmXBcSEX_Z4GrdQYmzW9hzoy8-8tEvp-nQ58gfd3uHvF4Qg$>)
> and the website Terms of Service (https://www.icann.org/privacy/tos
> <https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!UNIutLhtKN79DDAyXMFbwLBM5YmXBcSEX_Z4GrdQYmzW9hzoy8-8tEvp-nQ58gfd3p4iJdXc$>).
> You can visit the Mailman link above to change your membership status or
> configuration, including unsubscribing, setting digest-style delivery or
> disabling delivery altogether (e.g., for a vacation), and so on.
>
> _______________________________________________
> GNSO-Accuracy-ST mailing list
> GNSO-Accuracy-ST at icann.org
> https://mm.icann.org/mailman/listinfo/gnso-accuracy-st
>
> _______________________________________________
> By submitting your personal data, you consent to the processing of your
> personal data for purposes of subscribing to this mailing list accordance
> with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and
> the website Terms of Service (https://www.icann.org/privacy/tos). You can
> visit the Mailman link above to change your membership status or
> configuration, including unsubscribing, setting digest-style delivery or
> disabling delivery altogether (e.g., for a vacation), and so on.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mm.icann.org/pipermail/gnso-accuracy-st/attachments/20220301/b3249089/attachment-0001.html>