[Gnso-epdp-team] Discussion of Temporary Specification §§4.1-4.3

[Mueller, Milton L]

Kurt,
I think Amr has responded to you but I just want to see if I understood what you were saying.

As Amr said, it’s very clear from law that purpose dictates the nature and scope of data processing. So it makes no sense for you to say that we have to settle purpose before discussing what forms of data are mandated by ICANN’s mission. ICANN’s mission is what determines purpose. So you have to settle that first.

On the other hand, if I understand your long message, you may be saying that it would be easier to reach agreement if we go through the list of data elements currently collected and find out if there is any disagreement about that. This is actually what I suggested some time ago, which is why I sent you the list of redacted data elements and have been asking other SGs and ACs to express their view on that for some time. We may indeed discover that there is not much disagreement about that.

Is that what you were saying? I can’t tell from the message below.

--MM

From: Gnso-epdp-team [mailto:gnso-epdp-team-bounces at icann.org] On Behalf Of Kurt Pritz
Sent: Thursday, September 6, 2018 2:31 AM
To: Amr Elsadr <aelsadr at icannpolicy.ninja>; GNSO EPDP <gnso-epdp-team at icann.org>
Subject: [Gnso-epdp-team] Discussion of Temporary Specification §§4.1-4.3

Hello Amr (and everyone):

I am writing in response to your proposal that the team considers Temporary Specification §§4.1-4.3 (with reference to the ICANN Bylaws and mission) prior to our discussion of data elements.

I think understand the reasoning behind your request but still believe we should finish the “purposes” and “data elements” discussion before going into the reach of ICANN’s mission and Bylaws. Let me test out my reasons for this:

With regard to the ICANN mission and Bylaws I believe there is a range of opinions among the stakeholder groups on our team as to the extent that the ICANN mission and Bylaws enable the collection, use and disclosure of personal data,

In the best case, which I view as unlikely, we would develop a consensus opinion on this issue. Thus would be a helpful but not dispositive guide for identifying which data elements are collected and how they are used / disclosed. We’d still have to undertake that.

More likely, I believe there would be a discussion without a consensus result. Even in that case, we would next take up the task of identifying data elements to be collected by registrars and their subsequent processing.

Given that we have existing data collection and processing practices that were adequate pre-GDPR, it seems better to weigh those practices against GDPR and see what remains. Given the discussion at the end of the last meeting, it appears that the currently collected set of data is adequate for the currently identified needs of those seeking personal data disclosure. I can anticipate where there might be differences (we will see) but if an agreement is struck regarding the collection and disclosure od data elements, it seems accommodation on policy statements is more likely.

Taking a slightly different approach to the same point: I think we should be discussing the section 4.4 elements, legitimate reasons for disclosure, and Appendix A against the GDPR and not against the ICANN Bylaws and mission.

I understand that §§4.1 and 4.2 are elements  in the Temporary Specification and must be discussed (I am not sticking my head in the ground here - I don’t think), but it is more efficient to discuss these paragraphs later — and especially if we don’t agree on data elements collected and processed.

I think Alan G. was on to something in his earlier email where he said we should focus on what’s needed for our policy. Our goal is  to identify (as a matter of policy):

  *   The legitimate purposes for processing registrant data
  *   the set of data to be collected by registrars and
  *   identifying the legitimate reasons (i.e., reasons with a legal basis) for disclosing that data to third parties.

This, of course is an oversimplification but it is where we should focus. (I know others have made these comments before. I think Amr’s inquiry is a good time to restate what some others have said.)

I hope this was clear and helpful to the discussion.

Best regards,

Kurt

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/gnso-epdp-team/attachments/20180906/246fceb4/attachment-0001.html>