<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:"Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Dear Janis,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We identified 2 additional questions/assumptions that we would like GNSO Council’s confirmation and/or clarifications.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Question 1:<o:p></o:p></p>
<p class="MsoNormal"><span style="color:black">Recommendation 9.4 states: Per the legal guidance obtained (see<span class="apple-converted-space"> </span><a href="https://community.icann.org/download/attachments/111388744/ICANN_Automation%20memo%2023%20April%202020%5B1%5D.pdf?version=1&modificationDate=1588031170000&api=v2" title="https://community.icann.org/download/attachments/111388744/ICANN_Automation%20memo%2023%20April%202020%5B1%5D.pdf?version=1&modificationDate=1588031170000&api=v2"><span style="color:#0563C1">Advice
on use cases re automation in the context of disclosure of non-public registrant data</span></a><span class="apple-converted-space"> </span>- April 2020), the EPDP Team recommends that the following types of disclosure requests, for which legal permissibility
has been indicated under GDPR for full automation (in-take as well as processing of disclosure decision) MUST be automated from the time of the launch of the SSAD:<o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black">Recommendation 9.4.4 states: No personal data on registration record that has been previously disclosed by the Contracted Party.<o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black">ICANN org understands this mandatory automated use case 4 to apply only when a contracted party has notified the central gateway operator that this use case applies for a specific domain name, as the central gateway operator would
not know which domain names’ registration data contain no persona data, or if the CPs have previously disclosed the data on the ground of use case 4. Can you please confirm this is the intent of the Policy Recommendation?<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Question 2:<o:p></o:p></p>
<p class="MsoNormal"><span style="color:black">As you can </span><span style="color:black">see in our briefing from ICANN72 presentation concerning identity
</span><span style="color:black">verification, ICANN org understands the EPDP recommendations to contemplate two different types of accredited SSAD users who may be associated with a legal person: (a) individuals who are <b>affiliated with </b>an org (e.g.
an employee), and (b) individuals who <b>represent</b> an org (such as an outside counsel, brand management firm, etc).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">For each of these types of individuals, we are expecting that the accreditation authority will first verify the individual’s identity, and then the individual’s association with the legal person. The individual’s
association with the legal person would be a “declaration” tied to the individual’s accreditation, which takes into account that one individual could be associated with more than one legal entity who has individuals using the SSAD. This is the “signed assertion”
concept referenced in the EPDP Team’s Final Report.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">One issue we will need to resolve during implementation is how to manage multiple individuals’ associations with the same legal entity. Can you let us know if the approaches we’ve identified are aligned with the
community expectations in this </span><span style="color:black">regard, if not, can you share any additional thinking regarding the community expectations?</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">The first approach we identified was that each individual’s association with a legal entity will need to be individually verified (so that even if one person has demonstrated an association with an entity, the
second, third, fourth, etc individuals will also need to do the same). Alternatively, a second, alternative, approach would be that once one person is accredited and associated with a legal entity in the SSAD, additional individuals claiming association
with the legal entity could be added (or verified) by the initial individual to gain accreditation and be associated with the entity. However, this approach may raise operational challenges, particularly in large, global entities that may have many individuals
seeking SSAD accreditation. This also may not work in cases where the first individual accredited and associated with an organization is an organizational representative, since a representative may not be able to verify individuals within the org, or other
individuals who represent the org.<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We look forward to discussing this matter during our next call with you.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Regards,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">Yuko Yokoyama</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">Program Director</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">Strategic Initiatives, Global Domains & Strategy</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">Internet Corporation for Assigned Names and Numbers (ICANN)</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"> E-mail: <a href="mailto:yuko.green@icann.org"><span style="color:#0563C1">yuko.green@icann.org</span></a></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"><a href="http://www.icann.org/" title="http://www.icann.org/"><span style="color:#0563C1">www.icann.org</span></a></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>