[Gnso-epdp-team] Issues with the report

[Alan Greenberg]

Thanks Caitlin. Sorry for delay in replying. See comments below on Rec #8..

At 12/02/2019 11:10 PM, Caitlin Tubergen wrote:

- Rec #8 implies (but does not clearly say) that offering Tech
Contacts is an option for registrars. In the interim report, we
raised the question of whether "optional" for the Tech fields meant
optional for the registrant, or optional for the registrar. I cannot
recall ever discussing this when we went over the comments, but
somehow it is now optional for registrars, requiring registrants to
shop around for a registrar that accepts the option - if indeed any
registrars will! When was this decided?

Please refer to the 24 January meeting<https://community.icann.org/display/EOTSFGRD/2019-01-24+EPDP+Team+call+%2339> as well as the response from Bird & Bird re: the liability associated with additional contact information.

As you may remember, there was an “informal vote” at the end of the 24 January call, during which there was no consensus with respect to the meaning of “optional”. In other words, approximately half of the groups preferred optional to mean the registrar has the option of offering a technical contact field to the registrant, and half of the groups preferred optional to mean the registrar must offer the technical contact field but the registrant has the option of providing contact information for the technical contact field.

We noted, during the call, that we would document the status of the issue in the Final Report and await further legal advice.

The following question was posted to legal counsel:

The EPDP Team also took note of a related footnote [from the EDPB] which states, “[if contact details for persons other than the RNH are provided] it should be ensured that the individual concerned is informed”. The EPDP Team discussed whether this note implies that it is sufficient for the Registered Name Holder (RNH) to inform the individual it has designated as the technical contact, or whether the registrar may have the additional legal obligations to obtain consent. The EPDP Team requested external legal counsel guidance on this topic who provided the following summary answer:

Legal Counsel provided the following response:

“In cases where the RNH and the technical contact are not the same person, relying on the RNH to provide notice on the registrar's behalf will not meet GDPR's notice requirements if the RNH fails to provide the notice. While this may provide grounds for a contractual claim against the RNH, it is unlikely to provide a viable defence under the GDPR. Moreover, this arrangement will make it difficult for registrars to demonstrate that notice has been provided. If notice is not effectively provided, this could affect the legitimate interests analysis, since technical contacts may not "reasonably expect" the manner in which their data will be processed. If relying on consent, such an arrangement would make it difficult to document that consent has been provided”.

If you would like to refer to the full response from Bird & Bird, please refer to the this memo<https://community.icann.org/display/EOTSFGRD/Meetings+Legal+Committee+Framework?preview=/102138857/102145991/Technical%20Contact%20Memo.docx>. This response has also been documented in the Final Report.

AG: I am not sure that the permission of the contact is relevant since any e-mail address published would be anonymized. Nevertheless, there are industry-standard methods for the registrar to get such approval - it is used pretty much every time you subscribe to a mailing list and for many other transactions. You send an e-mail to the address confirming that they accept using their address.

My problem here is that as you say, the group WAS divided. Typically in that case we either accept the status quo (what is done today or in the Temp Spec). Instead we took an option that was favoured by one part of the group for which there is no precedent.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/gnso-epdp-team/attachments/20190215/c289ef59/attachment-0001.html>