[gnso-rds-pdp-wg] Legal basis vs. lawful

[Ayden Férdeline]

Thank you for this, Kathy. I find this explanation very helpful and agree with your analysis.

Best wishes,

Ayden Férdeline

-------- Original Message --------
On 9 February 2018 1:06 AM, Kathy Kleiman <kathy at kathykleiman.com> wrote:

> Tx for the invitation to join, Chuck, and following up on the discussion of Sam and Tapani, let me add that criteria for processing must be clearer than something broadly within ICANN's mission statement and something permissible somewhere. The requirements under law are express and concrete.
>
> Specifically, GDPR Article 5(1)(b and c) states:
>
> Personal data shall be:
> 2.    "collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes" (the "purpose limitation") AND
> 3.    "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed" (the "data minimisation" requirement).  [underline added]
>
> Thus, our first criteria of "consistent with ICANN's mission," is only the first step and we need to go further than even the 3 criteria we are discussing..
>
> Second, lawful and legal enter us into a debate over words and I have to agree with Sam and Tapani's analysis and let me add some of my own.
>
> "Legal" is the term we use for actions expressly allowed under law. How we process personal data under the GDRP falls into this category -- of processing expressly allowed under law. Whereas the term lawful is used for a much broader category of actions which are generally permissible and allowable.
>
> The term "legal" is much more consistent with our criteria statement because the processing of personal data by ICANN must clearly have a valid legal basis as expressly defined by data protection laws.
>
> Best regards,
> Kathy
>
> On 2/7/2018 10:53 AM, Sam Lanfranco wrote:
>
>> Thanks Tapani,
>>
>> I will extract from your longer message.
>> I deliberately kept my brief and less technical.
>> I think we are in agreement here and I support your position.
>>
>> On 2/7/2018 1:07 AM, Tapani Tarvainen wrote:
>>
>> The key distinction, as I understand it, is that "lawful" would be
>>  defined by the negative, everything that some law does not prohibit,
>> where as "legal basis" is defined by the positive, only things whose
>> justification can be explicitly derived from law.
>>
>>   <......>
>>
>> So I would prefer "legal basis" specifically in this sense: that any processing
>>  would have to be explicitly based on one of the criteria, or bases, as listed
>> in GDPR Article 6, or similar explicit justification in other data protection legislation.
>>
>> _______________________________________________
>> gnso-rds-pdp-wg mailing list
>> gnso-rds-pdp-wg at icann.org
>>
>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/gnso-rds-pdp-wg/attachments/20180209/977d7953/attachment.html>