<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1721705992;
mso-list-template-ids:-945380418;}
@list l0:level1
{mso-level-number-format:alpha-lower;
mso-level-text:"%1\)";
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
mso-ascii-font-family:"Times New Roman";
mso-fareast-font-family:Calibri;
mso-hansi-font-family:"Times New Roman";
mso-bidi-font-family:"Times New Roman";}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Dear Becky, all,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">many thanks for your additional suggestions.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">my two cents on the below:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I support the distinction proposed by Becky, but would recommend replacing ‘proportionate’ with ‘under the GDPR’ so we are fully covered.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">The original question raised was “<i>Is ICANN able to access registration data
<u>under the GDPR</u> on the basis that it has a legitimate interest in checking the accuracy of the data? “</i><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">The reference alone to the GDPR means that indeed the balancing test has been taken into account. As you rightly point out the GDPR requires a balancing test
when ‘legitimate interests’ is used as a legal basis. So in my view as long as there is a reference to the GDPR there is no need to explicitly add the proportionate part. It is already implied. Plus, a more general reference is more encompassing in the sense
that it takes into account the totality of the balancing test (i.e., data subjects’ interests etc.)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Having said that I am all supportive of asking all of these questions (in general I am in favor of asking as many questions as we can think of as this is at the
heart of our scoping tasks), but I would maintain –on top of what you suggest –the specific question on whether ICANN ever received or plans to receive legal advice on this particular topic.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">If I recall correctly this had been discussed in our accuracy scoping meeting of 17 February and was proposed as a question to be addressed to Brian so he can
forward it to ICANN compliance.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">In order to be able to progress with our discussions, it is important to know where exactly ICANN would base their assessment on these questions (i.e., whether
they have received specific in-house or external legal advice, including but not limited to any correspondence with the EDPB).
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I have now tried to integrate Becky’s suggestion to the original questions. Hope this helps.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><u>Question 1<o:p></o:p></u></p>
<p class="MsoListParagraph" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="font-size:10.0pt"><span style="mso-list:Ignore">a)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]>Does ICANN have a legitimate interest under the GDPR in accessing
<i>domain name registration data in response to complaints</i> that the data is inaccurate? Has ICANN ever received or plans to receive legal advice on this particular topic?
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:36.0pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="font-size:10.0pt"><span style="mso-list:Ignore">b)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]>Does ICANN have a legitimate interest under the GDPR in
<i>proactively </i>acquiring <i>bulk access</i> to domain name registration data to undertake an accuracy audit, even with respect to data for which it has no basis to question its accuracy? Has ICANN ever received or plans to receive legal advice on this particular
topic? <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><u>Question 2<o:p></o:p></u></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><u>For either scenario a or b under question 1</u>: Does ICANN believe that a Data Protection Agreement between itself and the Contracted Parties is a necessary legal requirement
for requesting and receiving this data, and if so for what legal reason? What happens if the registrar receiving the access request disagrees with ICANN's application of the balancing test, i.e., does ICANN have the contractual authority to enforce its access
request? <o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Best,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Melina<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> GNSO-Accuracy-ST <gnso-accuracy-st-bounces@icann.org>
<b>On Behalf Of </b>Becky Burr<br>
<b>Sent:</b> Tuesday, March 1, 2022 4:27 PM<br>
<b>To:</b> michael@palage.com<br>
<b>Cc:</b> gnso-accuracy-st@icann.org<br>
<b>Subject:</b> Re: [GNSO-Accuracy-ST] Potential Additional Questions to ICANN Org<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Michael -<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Respectfully, and without taking a position on whether these questions are relevant or timely, I think the questions need to be more nuanced to produce useful answers.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:36.0pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="font-size:10.0pt"><span style="mso-list:Ignore">c)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]>Does ICANN have a legitimate <b>and proportionate </b>
interest in accessing <i>individual registration records in response to credible complaints</i> that the data is inaccurate? If so, is a DPA required to access data in such situations? What happens if the registrar receiving the access request disagrees with
ICANN's application of the balancing test, i.e., does ICANN have the contractual authority to enforce its access request? <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:36.0pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="font-size:10.0pt"><span style="mso-list:Ignore">d)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]>Does ICANN have a legitimate <b>and proportionate</b> interest in
<i>proactively </i>acquiring <i>bulk access</i> to registrant data to undertake an accuracy audit, even with respect to data for which it has no basis to question its accuracy? If so, is a DPA necessary to do so? What happens if the registrar receiving the
access request disagrees with ICANN's application of the balancing test, i.e., does ICANN have the contractual authority to enforce its access request?<o:p></o:p></p>
<div>
<p class="MsoNormal">It is important to keep in mind that a legitimate interest is necessary
<i>but not sufficient</i> under GDPR. The processing necessary to satisfy a legitimate interest must be proportionate, i.e., not outweighed by the privacy rights of the individual data subject(s). As a result, the two situations (access to a single record
based on reasonable grounds to believe the data is inaccurate v. proactive access without individualized suspicion) are quite different from a data protection perspective, with the first being far less complicated to defend. In addition, a CP's contractual
obligations, e.g., under the RAA, may be different in those situations.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">FWIW, I think the DPA issue is a bit of a red herring here. Presumably, ICANN's requests for one-off data can be handled in the same way that anyone else's access request is handled, e.g., if the data is to be transferred outside of the
EU by imposing controller to controller Standard Contractual Clauses as the terms and conditions of such access on a case-by-case basis. If the EDPB were to confirm that ICANN's<i> bulk access</i> to data for proactive checking was legitimate and proportionate,
it's clear to me that a narrowly focused DPA between ICANN and CPs applicable to data access for the specific purpose of checking accuracy (e.g., prohibiting onward transfer, etc.) could be crafted. The real question is whether (i) the temp spec /epdp phase
1 policy obligating CPs to provide reasonable access for legitimate and proportionate purposes encompasses bulk access or (ii) some other provision of the agreements produces an obligation to provide bulk access. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Apologies for being pedantic here. None of us can say with any certainty what GDPR does or does not permit as that determination is ultimately made by individual data protection authorities and/or the EDPB. We are asking ICANN for its views
on what GDPR would permit in specific circumstances, so the relevant circumstances should be articulated precisely to produce useful answers. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">b<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Thu, Feb 24, 2022 at 5:12 PM Michael Palage <<a href="mailto:michael@palage.com">michael@palage.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hello Everyone,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Over the past couple of weeks there has been a recurring theme in our calls and in some of the side discussions that I have had with some members regarding about how the potential
lack of a Data Processing Agreement between ICANN Org and the Contracting Parties might negatively impact our future work and/or recommendations.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Therefore I would like to propose to the group for their consideration the following additional questions that we may want to propose to ICANN Org as we continue our work:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">• “Is ICANN able to access registration data under the GDPR on the basis that it has a legitimate interest in checking the accuracy of the data? Has ICANN ever received
or plans to receive legal advice on this particular topic? <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">• Does ICANN believe that the Data Protection Agreement between itself and the Contracted Parties is a necessary legal requirement for requesting and receiving this data,
and if so for what legal reason?" <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">As always I welcome any thoughts and or considerations?<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Best regards,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Michael<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
GNSO-Accuracy-ST mailing list<br>
<a href="mailto:GNSO-Accuracy-ST@icann.org" target="_blank">GNSO-Accuracy-ST@icann.org</a><br>
<a href="https://urldefense.com/v3/__https:/mm.icann.org/mailman/listinfo/gnso-accuracy-st__;!!DOxrgLBm!UNIutLhtKN79DDAyXMFbwLBM5YmXBcSEX_Z4GrdQYmzW9hzoy8-8tEvp-nQ58gfd3kyLTw-r$" target="_blank">https://mm.icann.org/mailman/listinfo/gnso-accuracy-st</a><br>
<br>
_______________________________________________<br>
By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a href="https://urldefense.com/v3/__https:/www.icann.org/privacy/policy__;!!DOxrgLBm!UNIutLhtKN79DDAyXMFbwLBM5YmXBcSEX_Z4GrdQYmzW9hzoy8-8tEvp-nQ58gfd3uHvF4Qg$" target="_blank">https://www.icann.org/privacy/policy</a>)
and the website Terms of Service (<a href="https://urldefense.com/v3/__https:/www.icann.org/privacy/tos__;!!DOxrgLBm!UNIutLhtKN79DDAyXMFbwLBM5YmXBcSEX_Z4GrdQYmzW9hzoy8-8tEvp-nQ58gfd3p4iJdXc$" target="_blank">https://www.icann.org/privacy/tos</a>). You can
visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.<o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>