[Gnso-epdp-team] Purpose C

[Ayden Férdeline]

I have concerns regarding this purpose.

The provision of admin and tech contact data is not necessary in order to perform the registration of a domain name.

So, I disagree that these fields “should be mandatory with instructions to the registrants on options for filling them out as implied in the EDPB letter of 05 July 2018.” I did not read the EDPB letter as insinuating that.

Under item 9, it now says, “2) If the fields are not filled in, either they need to default to the Registrant Contact information or we need an access process that defaults back to the registrant’s info when there are admin/tech requests. In either case, the registrant should be clearly informed.”

If I am understanding this correctly, I do not agree that the admin and tech contact fields should be pre-filled with registrant contact data. This is inconsistent with the principles of data minimisation enshrined within the GDPR, as the ICANN v EPAG Domainservices case has shown, and which is cited in the 5 July 2018 EDPB letter referenced below.

I note that within the current scope of their contracts, registrars must be able to contact their customers, so if the goal of this purpose is to “enable communication or notification to the Registered Name Holder … of technical and/or administrative issues with a Registered Name,” this should be possible without a third party having direct access to their personal data. This could be fulfilled by way of a contact form or message relay system, for instance.

I am increasingly skeptical that there is a need to release personal information directly to third parties (though in certain circumstances this might be necessary). I ordered an Uber last week, and when I called the driver, the Uber app masked my number and theirs, and now connected the call through some kind of relay system (like eBay uses for emails between buyer and seller) to prevent the disclosure of our phone numbers and to protect both of our privacy rights.

If this technology is being deployed by others, perhaps we can avail of it too.

Kind regards,

Ayden Férdeline

> On 15 Oct 2018, at 04:50, Alan Greenberg <alan.greenberg at mcgill.ca> wrote:
>
> I have updated Purpose C and a copy is attached.
>
> 1. I deleted the various "stream of consciousness dialogue" and tried
> to just leave in the final conclusions.
>
> 2. Under item 9, I further discussed the issue of whether the
> administrative and technical contact fields are in fact optional (and
> must either default to the registrant contact information, or have
> that registrant contact information delivered in lieu of the blank
> fields when data is made available as later agreed during access
> discussions) or whether it should be mandatory with instructions to
> the registrants on options for filling them out as implied in the
> EDPB letter of 05 July 2018.
>
> Alan_______________________________________________
> Gnso-epdp-team mailing list
> Gnso-epdp-team at icann.org
> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<Purpose C - Data_Elements_Processing_Workbook_v0.4.5-ag.docx>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/gnso-epdp-team/attachments/20181015/3531bbf0/attachment.html>