[IRT.RegDataPolicy] IRT Liaison report on Rec7 during the 20Aug2020 GNSO Council Meeting

[Sebastien at registry.godaddy]

Dear IRT,

As per our discussion during our IRT call on 19Aug2020, I reported yesterday (20Aug2020) to the GNSO Council the IRT’s request for clarification on the prior existence of a Legal Basis to support the transfer of data under Rec 7.

For clarity, I now have to present the said request in writing. I propose the following wording, but invite your input.
As has been the case all along in this exercise, this is not a reflexion of my personal point of view, but should represent the different points of view of the IRT. Please ensure yours is reflected.

For the sake of council members who may not all be as familiar with the topic as we are, I would like to submit a limited relevant number of reference documents for their review.
Please confirm that the ones I have included are indeed relevant and the links I have provided are the most direct to the latest/final versions of the said documents.



[Date]
RE: EPDP Phase 1 Recommendation 7 – Legal Basis

Dear GNSO Council,

In an attempt to resolve a different in interpretation of the EPDP Phase I Recommendation 7, the IRT is seeking clarification with regards to the existence of legal basis which covers the transfer of data (including personal data) from Registrars to Registries, in all cases.

Recommendation 7 states:
“The EPDP Team recommends that the specifically-identified data elements under “[t]ransmission of registration data from Registrar to Registry”, as illustrated in the aggregate data elements workbooks, must be transferred from registrar to registry provided an appropriate legal basis exists and data processing agreement is in place. In the aggregate, these data elements are:”

[followed by the list of data points that may be transferred, some marked as Mandatory (The domain name, fields pertaining to the Registrar and Domain Statuses), others as Optional (contact fields, name servers, Registrar expiry date and Reseller)]
Ref: https://gnso.icann.org/sites/default/files/file/field-file-attach/epdp-gtld-registration-data-specs-final-20feb19-en.pdf


The IRT remains divided in the interpretation of the mention “provided an appropriate legal basis exists and data processing agreement is in place” with:

  *   Parties who consider the mention key as in their view a legal basis may not exist in all cases and must be established for each TLD,
  *   Parties who consider the mention relevant, view the legal basis as pre-established under Consensus Policy and expect that the currently negotiated data processing agreement (between ICANN and the CPH) will reflect the said legal basis,
  *   Parties who consider legal basis established in all cases in this context, and seek to remove the sentence for the avoidance of confusion.


Further, each party cites in its argument:

  *   The EPDP Phase I Final Report and the underlying work - https://gnso.icann.org/sites/default/files/file/field-file-attach/epdp-gtld-registration-data-specs-final-20feb19-en.pdf
  *   Existing Consensus Policy including but not limited to the Thick RDDS (WHOIS) Transition Policy - https://www.icann.org/resources/pages/thick-whois-transition-policy-2017-02-01-en
  *   The “Bird & Bird memo” of 8 March 2019 “Advice on the legal basis for transferring Thick WHOIS” - https://community.icann.org/download/attachments/102138857/ICANN%20-%20Memo%20on%20thick%20Whois%5B1%5D.docx?version=1&modificationDate=1552176734000&api=v2
and related public comments submitted in the context of the above.


Question to the GNSO Council:

  *   Does the GNSO Council advise that there exists under Consensus Policy and in accordance with GDPR a legal basis which covers the transfer of data, including personal data, between Registrar and Registries in all cases?


[IRT Liaison signature]



Kindly,


Sebastien Ducos
GoDaddy Registry | Senior Client Services Manager
[signature_1081474336]
+61449623491
Level 8, 10 Queens Road
Melbourne, VIC, Australia
3004
sebastien at registry.godaddy<mailto:sebastien at registry.godaddy>
www.linkedin.com/in/sebastienducos<https://www.linkedin.com/in/sebastienducos>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/irt.regdatapolicy/attachments/20200821/a11b2d23/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 39875 bytes
Desc: image001.png
URL: <http://mm.icann.org/pipermail/irt.regdatapolicy/attachments/20200821/a11b2d23/image001-0001.png>