[Gnso-epdp-legal] Legal Committee Homework - LC Call, 15 Feb. 2020 @ 15:00 UTC

Wed Feb 26 01:25:19 UTC 2020

Hi all,

During our call last week I took the action to summarize the legal advice received from Bird & Bird on the publication of the City field. I've highlighted Bird & Bird's suggestion on next steps and pulled out key points from their analysis in order to help inform the plenary discussion on this issue (so apologies if I've inadvertently left out your favorite line in the memo).  Welcome any comments, questions, or suggestions.

Thanks,
Matt

Publication of City Field Legal Advice

Key Takeaway for EPDP Team

*         Bird & Bird advises that further information is required in order to determine whether the Article 6(1)(f) balancing test is satisfied for universal publication of the City field in public RDDS. In particular, the EPDP team should develop additional information regarding the benefits to third-parties: are they sufficiently meaningful to justify universal publication, or only applicable to limited use cases? Additionally, the EPDP team should develop more facts regarding the potential impact of universal publication on the rights and interests of data subjects. Following the collection of that data, the parties should conduct a detailed assessment (as outlined below) to determine whether the third party interests outweigh those of the data subject. (3.16-3.17)

Analysis Summary

*         The City field is personal data if the registered name holder is a natural person. (2.1-2.9)

*         The key question is whether universal publication of the City field in public RDDS (not case-by-case disclosure) is justified based on the interests of third party rights holders. Answering this question requires performing the Article 6(1)(f) balancing test. Therefore, universal publication requires (i) an identified legitimate interest; (ii) processing must be "necessary" to pursue that interest; and (iii) the rights and interests of the data subject must not outweigh the legitimate interest pursued by the controller. (2.10-3.3)

*         Recommendation #6 in the Initial Report contains a summary of the process for performing the balancing test discussed in this memo. When considering the strength of the interest here, Bird & Bird advises that the more compelling the public or community interests, and the more clearly acknowledged and expected it is in the community and by data subjects that the controller can process data in pursuit of those interests, the more heavily this legitimate interest weighs in the balance. However, "private enforcement" of the law should not be used to legitimize intrusive practices that, if carried out by a government, are prohibited on privacy grounds. (3.4-3.9)

*         EU case law supports finding a legitimate interest where personal data will permit third party rights-holders to more easily vindicate their rights. Moreover, "necessity" does not require a demonstration that there are no other less intrusive means of achieving the result. However, the controllers must show that publishing the City field is proportionate. (3.10-3.11)

*         In order to conduct the balancing test, the controllers need to consider: (i) whether universal publication creates a significant benefit for third party rights holders; and (ii) the risks to the rights and interests of the data subjects. (3.13-3.15)

*         As part of their preliminary analysis, Bird & Bird observed that the benefits appear marginal in the EU, as IP rights tend to be national rather than local. The City field may be more relevant in other jurisdictions like the United States, but this suggests that the data is only relevant to some registered name holders. As a result, the universal publication of the City field would mean personal data is published for registered name holders where the data is unlikely to deliver any benefit. (3.13-3.14)

*         Regarding the risks to the data subject, Bird & Bird observed that if the parties can demonstrate sufficient benefits to publication, the increased risk that some registered name holders would face claims they would not otherwise face should not preclude publication of the City field. However, in limited circumstances the publication of the City field may result in unique threats to the registered name holder (e.g., a blog discussing the author's sexuality in a place where this is illegal or immoral, or publishing political views that are a threat to the orthodoxy). In these circumstances, publication of the City field could increase the risks faced by the author by increasing the likelihood of identification. While Bird & Bird did not have sufficient information to draw conclusions about that risk, it a factor that the EPDP team should consider in their analysis. (3.15)

*         Bird & Bird notes that a survey of similar practices among ccTLDs in the EU shows a mixed practice with some publishing the City field (e.g., .EU (City field but no address), .FR and .BE (full address details)) and some not (e.g., .UK, .DE). (3.18)

From: Gnso-epdp-legal <gnso-epdp-legal-bounces at icann.org> On Behalf Of policy at bacinblack.com
Sent: Sunday, February 16, 2020 3:32 PM
To: gnso-epdp-legal at icann.org
Subject: [Gnso-epdp-legal] Legal Committee Homework - LC Call, 15 Feb. 2020 @ 15:00 UTC

Dear Legal Committee:

Please come prepared to discuss the following items during the next meeting on Tuesday, 18 February at 15:00 UTC.

  1.  Given the plenary discussion on the proposed questions on legal vs. natural, accuracy, territorial scope, and reverse look-ups, does the Legal Committee believe any questions should be updated/removed? *Note: as the topic of reverse look-ups is no longer included in the Initial Report, should this question be removed? *

  1.  Following Bird & Bird's advice re: pseudonymous email addresses<https://community.icann.org/display/EOTSFGRD/EPDP+-P2+Legal+subteam?preview=/111388744/126424478/Memo%20-%20ICANN%20-%2004.02.2020.docx>, does the Legal Committee recommend any follow-up questions? Following review of the advice received, can the Legal Committee recommend a draft response to the following topic from the Annex: Important Issues for Further Community Action<https://www.icann.org/resources/pages/gtld-registration-data-specs-en/#annex>?

-          Addressing the feasibility of requiring unique contacts to have a uniform anonymized email address across domain name registrations at a given Registrar, while ensuring security/stability and meeting the requirements of Section 2.5.1 of Appendix A

  1.  Following Bird & Bird's advice re: city field, does the Legal Committee recommend additional follow-up questions or a draft response to the following Priority 2 item:

>From the EPDP Team Phase 1 Final Report:

EPDP Team Recommendation #11

The EPDP Team recommends that redaction must be applied as follows to this data
element:

Data Element

Redacted

Registrant Field

  *   City

Yes

The EPDP Team expects to receive further legal advice on this topic, which it will analyze
in phase 2 of its work to determine whether or not this recommendation should be
modified.

Berry Cobb
@berrycobb
GNSO Policy Consultant

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/gnso-epdp-legal/attachments/20200226/0634b19c/attachment-0001.html>