[IRT.RegDataPolicy] Tech contact consent

[Amr Elsadr]

Hi,

Lending my support to everything in Sarah's email below. The draft Consensus Policy language (sections 8.3 and 8.3.2) should only allow for publication of Tech Contact personal information upon gaining consent when the Registered Name Holder and the Tech Contact are the same (assuming this is implementable).

However, the EPDP Team did not review privacy/data protection law requirements when processing of personal information is performed when this personal information was not obtained from the data subject (such as a Tech Contact who is not the same natural person as the Registered Name Holder). The EPDP Team, therefore, did not make a recommendation on how to gain consent to publish this data.

Thanks.

Amr

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Thursday, July 18, 2019 2:42 PM, Sarah Wyld <swyld at tucows.com> wrote:

> Hello team,
>
> There is some great discussion in the Google Doc (https://docs.google.com/document/d/1OuZT7xL5wuV1ynVmpVNxFycU93gvPlvbzx_g9lXCYCw/edit?ts=5d2f60ce#) about the possibility for the Tech contact to consent to publication of their data (name, phone and email), but I think it's a bit easier to consider it by email, so I will start this discussion and look forward to hearing what everyone else thinks.
>
> I see it as two separate questions, one of which is already resolved and the other remaining open.
>
> 1 - can the RNH grant consent for publication of Tech contact data?
>
> Based on comments in the doc (including mine) and Dennis's subsequent changes, there is agreement that it is not possible for one person to consent to publication of another person's data. So, if the RNH is also the Tech contact, then maybe they could grant consent (if it's possible in an automated manner for the registrar to know that these contacts are the same, which may not be possible) but certainly if it's a different person then this is not an option.
>
> 2 - can the Tech contact grant consent for publication of its own data?
>
> Although on the surface this sounds straightforward, I think it's actually a problem.
>
> There is no Recommendation in the Phase 1 final report relating to the Tech contact granting consent. Rec 5 explains what the tech contact may be ("For the purpose of the Technical contact, which is optional for the Registered Name Holder to complete (and if the Registrar provides this option), Registrars are to advise the Registered Name Holder at the time of registration that the Registered Name Holder is free to (1) designate the same person as the registrant (or its representative) as the technical contact; or (2) provide contact information which does not directly identify the technical contact person concerned.") Rec 6 requires that the RNH can consent to publication ("The EPDP Team recommends that, as soon as commercially reasonable, Registrar must provide the opportunity for the Registered Name Holder to provide its Consent to publish redacted contact information, as well as the email address, in the RDS for the sponsoring registrar.") Rec 10 requires that the tech contact is redacted. Rec 13 refers again to the RNH consenting to publication of their data ("1) The EPDP Team recommends that the Registrar MUST provide an email address or a web form to facilitate email communication with the relevant contact, but MUST NOT identify the contact email address or the contact itself, unless as per Recommendation #6, the Registered Name Holder has provided consent for the publication of its email address.")
>
> Additionally, the Registrar may not have a legal basis on which to publish the Tech contact data (again, assuming it is not known to be the same as the RNH data). There is no contractual relationship between the registrar and the tech contact, so 'performance of a contract' cannot be the basis for publication, and because there is no contractual relationship it would be improper for the registrar to communicate with the tech contact (the registrar does not have any legal basis on which to process the tech contact's data) even just to send them an email about this consent request.
>
> As such, for question 2 the answer should be no, the Tech contact cannot grant consent to publish their data.
>
> Thanks,
>
> --
> Sarah Wyld
> Domains Product Team
> Tucows
> +1.416 535 0123 Ext. 1392
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/irt.regdatapolicy/attachments/20190721/2aca2523/attachment.html>