[Gnso-epdp-legal] Outstanding action items reminder

[Crossman, Matthew]

Hi everyone,

Here is a brief summary of my thoughts on why we don’t need to ask the proposed question on 6.1(e) and can rely on Bird & Bird’s existing advice.

Proposed Question: To what extent can disclosures of non-public registration data to third parties for the purposes identified in the Final Report Rec. 1 be justified under GDPR’ Article 6(1)e (public interest), in light of the EC’s recognition that: “With regard to the formulation of purpose two, the European Commission acknowledges ICANN’s central role and responsibility for ensuring the security, stability and resilience of the Internet Domain Name System and that in doing so it acts in the public interest.”

Position: We should not ask Bird & Bird whether disclosure of non-public registration data is justified under 6.1(e) because, per Bird & Bird’s existing advice, a necessary condition for the use of 6.1(e) is an existing basis in EU or Member State law.

  *   Processing of personal data is permissible under 6.1(e)<https://gdpr-info.eu/art-6-gdpr/> if the “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.” However, “[t]he basis for the processing referred to in [6.1(e)] shall be laid down by: Union law; or Member State law to which the controller is subject.” (See 6.3<https://gdpr-info.eu/art-6-gdpr/>).  Recital 45<https://gdpr-info.eu/recitals/no-45/> also confirms that “[w]here processing . . . is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, the processing should have a basis in Union or Member State law.” (emphasis mine).
  *   In other words, processing under 6.1(e) has two required conditions: it must be (i) necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; AND (ii) the processing should have a basis in Union or Member State law. (emphasis mine)
  *   The existing memo from Bird & Bird on Question 4 confirms that a basis in Union or Member State law is required. “Art 6(3)<https://gdpr-info.eu/art-6-gdpr/> makes clear that the task or authority in question must be laid down by EU or Member State law and that the processing must meet an objective of public interest and be proportionate to the legitimate aim pursued.” (emphasis mine)
  *   Even assuming for the purpose of argument that the EC letter is authoritative in determining whether ICANN has an “objective of public interest”, it is apparent that ICANN currently has no authority to perform that task based on EU or Member State law.
  *   In light of the guidance from the ICANN Board to our committee to “avoid[] duplication and look[] to past and current efforts, where available, as there may be existing legal advice the EPDP Team could utilize,” I suggest we strike this question since Bird & Bird’s existing advice confirms that 6.1(e) is not applicable in this context.

Thanks,
Matt


From: Gnso-epdp-legal <gnso-epdp-legal-bounces at icann.org> On Behalf Of Caitlin Tubergen
Sent: Friday, October 11, 2019 12:55 PM
To: gnso-epdp-legal at icann.org
Subject: [Gnso-epdp-legal] Outstanding action items reminder

Dear Phase 2 Legal Committee:

Gentle reminder of the following outstanding action items from our last meeting:

1. Matthew, Brian, Margie, Stephanie and Hadia to provide high-level summaries of legal memos for the plenary to review by Monday, 14 October.
2. LC to review Margie’s proposed updated text to Question 11 (re: security practitioners) – question to be discussed during the next call on Tuesday, 15 October.
3. Brian and Matthew to summarize the two positions re: questions 12 and 13 and propose whether Bird & Bird should opine on this. Legal Committee to discuss the positions during its next meeting.

Thank you.

Best regards,

Marika, Berry, and Caitlin


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/gnso-epdp-legal/attachments/20191014/fc155cda/attachment.html>