[Gnso-epdp-team] EPDP Phase 2A Chair Update to GNSO Council -- Initial Report

[Drazek, Keith]

Dear GNSO Council Leadership Team,

In my capacity as Chair of the Expedited Policy Development Process (EPDP) on the Temporary Specification for gTLD Registration Data (Phase 2A), I am pleased to report to the GNSO Council that the Phase 2A team has finalized its Initial Report for public comment. The Initial Report includes a status update on the deliberations of the EPDP 2A team and primarily poses questions around five key issues and possible recommendations for community feedback. The public comment period will run for 45 days from 03 June to 19 July 2021.

The EPDP 2A team has not yet reached consensus on whether there should be new consensus policy elements, amendments to the existing Phase 1 recommendations, or if the existing policies are sufficient at this time. This is a key area of focus for the community during the public comment period and the EPDP 2A team looks forward to considering all inputs, and especially new information, as we work to develop policy recommendations in a Final Report.

The five key areas where new community input is requested are:

1.      As the report indicates, there are substantially different views on the question of whether changes are needed to the Phase 1 recommendation which allows for differentiation between legal and natural person data, but does not require it. Some are of the view that changes are warranted, while others believe that the Phase 1 recommendation does not require changes at this time.



2.      The EPDP Team has noted there are a number of potential relevant developments such as NIS2, decisions by pertinent tribunals and data protection authorities, as well as the possible adoption of the Phase 2 recommendations on a Standardized System for Access and Disclosure (SSAD) that may require, or benefit from, a renewed consideration of the question of whether any further policy changes are necessary. The EPDP Phase 2A preliminary recommendation included in the Initial Report suggests that the Council should monitor these developments to decide if/when (re)consideration is warranted, while others have suggested that this is already the responsibility of the Council and as such, neither monitoring nor specific triggering points need to be specifically called out. Community input is sought on if/how this recommendation is necessary for future GNSO Council consideration of any new policy work. Further information from the Council on how this monitoring suggestion is helpful is also welcomed.



3.      As a possible new requirement, the EPDP Team has discussed the introduction of a standardized data element to facilitate and harmonize practices for those Contracted Parties who do choose to differentiate between legal and natural person data, but some important questions remain and are called out in the Initial Report, as follows:



   a.   Should a standardized data element be available for a Contracted Party to use? If yes, why? If no, why not? Why is harmonization of practices beneficial or problematic?
   b.   If yes, what field or fields should be used and what possible values should be included, if different from the ones identified in the Initial Report (Registrant Legal Person - Yes/No/Unspecified)?
   c.   If such a standardized data element is available, MUST a Contracted Party who decides to differentiate use this standardized data element or should supporting this standardized data element remain optional for a Contracted Party that implements this differentiation?



4.      The EPDP Team has developed guidance for Contracted Parties who choose to differentiate but there are a number of questions that are put out for community input:



   a.   Does this guidance as written provide sufficient information and resources to Registrars and Registry Operators who wish to differentiate? If not, what is missing and why?
   b.   Are there additional elements that should be included?
   c.   Are there legal and regulatory considerations not yet considered in this Initial Report, that may inform Registries and Registrars in deciding whether and how to differentiate, and if so, how?
   d.   If a Registrar or Registry Operator decides to differentiate, should this guidance become a requirement that can be enforced if not followed ("MUST, if Contracted Party decides to differentiate")?



5.      The EPDP Team has put forward a preliminary recommendation that Contracted Parties who choose to publish a registrant- or registration-based email address in the publicly accessible RDDS should ensure appropriate safeguards for the data subject in line with relevant guidance on anonymization techniques provided by their Data Protection Authority(ies) and the appended legal guidance in this recommendation. The EPDP Team asks:



   a.   Does this guidance as written provide sufficient information and resources to Registrars and Registry Operators who wish to publish a registrant- or registration-based email address?
   b.   If not, what is missing and why?

   In summary, irrespective of whether consensus is ultimately reached on the above issues, the EPDP 2A Team will continue working during the public comment period to ensure we remain on track for publication of a Final Report by the end of August 2021. The EPDP 2A Team appreciates the ongoing support of the GNSO Council as we conduct this important policy work, and we very much look forward to receiving, reviewing, and incorporating the community's feedback.

   Please advise if the GNSO Council has any follow-up questions for the EPDP Phase 2A team.

   Sincerely,

   Keith Drazek



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mm.icann.org/pipermail/gnso-epdp-team/attachments/20210607/bb7f9dc9/attachment.html>