Tracking Tool

For the priority level definitions add in text "Implementation to begin once any preconditions are met."

Operational Input

- All to review and confirm operational input is taken into account in report and recommendations.

Rec# #11 Common Interface

- ICANN org to follow up with Susan/Volker and see whether these two highlighted questions can be removed

Rec#10 Privacy/Proxy Services

- Issue #1: leave it as is and remove comment.

Rec#5-9 Data Accuracy

- Alan to address section issues with Lili

Rec#4 Compliance

- Susan to review action items

- Alan to complete action item on paragraph on current situation, and consider GDPR control issues.

Susan

Alan

Rec#3: Outreach

- Add comment in the public comment tool rather than in the report

Single Whois Policy

- p3: "were suspended and later terminated due to the ongoing effort to adress GDPR" (+ remove paragraph afterwards)

- p4: remove dash after "In any event'"

- p4: delete highlighted section

p6: Move four bullet points to "research section", and report "none" under "Recommendations"

Strategic Priority

- p6 Alan to clean up wording on p6 "but that was in fact done"

- p9 Alan to update paragraph

- p10: replace most/many with "some"

- p12: add footnote on "soft policy "such as guidance documents, best practices."

- p13: add a note in the report "any timeline mentioned in the report make reference to when the board takes action."

Review team members/subject matter experts are invited to

• review with care their sections in the report (looking for errors, inconsistencies)
• confirm the section is consistent and tight, by Friday 18 January 2019 23:59 UTC. (Extra day allowed for Stephanie, considering the ePDP meeting)
• come up with suggestions before plenary call #47 as to how the sections can be cleaned up.

WHOIS1 Rec #4: Compliance: Under “Possible Impact GDPR and other applicable laws” Alan to add a paragraph on current situation pointing out the paradox of goodwill vs doing it properly. Add sentence on whether contractual compliance can verify compliance if they can't look at the data.

Subgroup 3 - Law Enforcement Needs: Jackie to emphasize the "at minimum" sentence in rationale. Replace the "or" at the end of the 4th line with an "and".

SG.1: Alan to review body of the report with an eye to section 3.2 of the 2013 RAA.

LE.2

• Add a clause for factoring costs/benefits in this recommendation.
• Remove “extending” , and add “conducting comparable” in the recommendation.

R10.1 Due to the many changes made to the recommendation, send out an email showing recommendation before and after changes.

R3.2 Remove “in light of GDPR-driven changes,”, and remove “effectively” in the original text. Move the reference to GDPR, and other substantial policy changes into the dialogue. Add ”in light of substantial policy changes, ICANN should consider the need for education.”

CM.5 Clarify in recommendation what a “risk base approach is”. Stephanie provided: “A risk-based approach simply means that you do a risk assessment before you take an action to determine whether it’s really necessary.”

CM.3 Review team to use the GAC term, which is underserved regions, as there are some conflicting views on Global South.

CM.1 Rephrase the recommendation so that the board decide how to best implement this recommendation.

SG.1: Alan to add clarification as well as a reference to the RAA 2013 section 3.2.

LE.2

Implementation note “review should be implemented as soon as possible and at the latest within 6 months” should be reviewed to factor in section 4.6 of the ICANN Bylaws where  the ICANN Board has six months within receipt of the final report to consider the review team’s recommendations. and to consider he review team’s recommendations.

LE.1

• Implementation note “review should be implemented as soon as possible and at the latest within 6 months” should be reviewed to factor in section 4.6 of the ICANN Bylaws where  the ICANN Board has six months within receipt of the final report to consider the review team’s recommendations.
• Review this recommendation and specify what we mean by regular, by perhaps clarifying recommendation itself and also adding a little rationale to explain the two reasons that review team see for conducting such surveys and studies, which are, A, to do an ex-ante impact assessment of projected new policies or prepare a review team, or B, to evaluate new policies once they are in place. 
• Bring the above and survey questions to the EPDP (Alan) and GAC (Cathrin)

R4.2 Remove “Sanctions should be applied if significant deficiencies in RDS (WHOIS) data validation or verification are identified.” Or make it clear that we are talking about sanctions that are on the books.

R1.1 | R1.2 

• Recommendation refers to reports covering all the ongoing legislative initiatives, but in fact, should also identify previous legislative efforts across the globe.
• Implementation note “review should be implemented as soon as possible and at the latest within 6 months” should be reviewed to factor in section 4.6 of the ICANN Bylaws where  the ICANN Board has six months within receipt of the final report to consider the review team’s recommendations. 

Instead of trying to assign a high, medium or low priority, describe when RT believes this recommendation should be implemented and what the target completion date should be. Include a description of an ideal completion date recognizing some of the ongoing dependencies, and consideration should be given to resources (costs, community resources) that would be needed.

Carlton to reword BY.1

Objective 5: Safeguarding Registrant Data

• Reply to I2C comment: “we support compliance with law and support compliance with ICANN contracts.”
• Reply to BC comment “RT is specifying that they believe ICANN org must be notified of data breaches. Review team is saying use reasonable industry standards in protecting data.”

Susan/Jackie to rework some of the basic language  in this section to lead it up to that recommendation.

LE.2

• Response to ALAC comment: “The only way that they do that is their results may cause entities to take action which may enhance law enforcement activities. There is no direct connection, it depends on the details. Such enhancements may not be possible.”
• Response to I2C comment: “regular basis was our best attempt at identifying a group of people who often work in conjunction with law enforcement but not on a formal basis”.
• Response to NCSG comment, add a clause “factoring costs/benefits analysis”. Also, reword the recommendation to define what “extend” means.
• Response to DNRC comment: “RT is not clear as to how your comment responds to the possibility of polling the third parties that are not law enforcement agencies. We are not proposing noncompliance with law, we are proposing an assessment of needs.”
• Response to RrSG comment: Review team will consider extending concept  of surveys and studies but not the pool of the survey takers.

LE.1

• Reply to RySG, BC and ALAC comment: Noted, and Cathrin to work with Jackie to add clarifying text/update rationale to reflect difference between use of surveys and studies. Surveys and studies may allow us to recognize we have to make changes and that is a multi-stage project.
•  Reply to RrSG comment: RT takes this comment onboard, the need should be addressed in future iterations.
• Reply to NCSG comment: MSSI to estimate number of hours spent on the LE survey in response to NCSG request for estimated cost associated with conducting the survey.

R15.1

• RT to add a sentence to that effect, focusing on outcomes and effectiveness on an annual report basis.
• Stephanie to liaise with Jackie on adding a sentence in recommendation to amplify the impact evaluation. “The impact evaluation not being just greater accuracy for the benefit of third parties seeking data from ICANN, but response burden on the contracted parties that inevitably winds up for higher cost for end users.”

Review Team

Stephanie

Jackie

R11.2: RySG comment: Complete agreement and certainly in line with what RT  were imagining would be done, even though RT is not recommending what to change the name of the page to.

R11.1:

• ALAC comment: At this point, there is data available and lawfully available that the portal is not delivering, and RT believes  that needs to be rectified and not wait for things to change. The portal may well have to change going forward, but not delivering data currently implies broken,  RT stands by the current request to do this in a shorter term.
• BC/NCSG Comment: RT to respond to these two comments, but no action taken to change the recommendation. 

Recommendation CM.3 to be deleted. Alan to add this as a more targeted outreach in the relevant recommendation. The existence of ARS is not relevant in the future and this item will be moved under outreach.

Alan to reword CM.1 so that it does not say “the Board should negotiate …”. The goal is to ensure the recommendation is not dictating a PDP but suggesting a change somehow.

Objective 6: Contractual Compliance Actions: public comment from Domain Name Rights Coalition: Review team is not aware that we are recommending brute force enforceability and anything relating to suspending domains other than what is in our current policies. Review team is not aware of any abuse issues of the ARS because the data in the ARS is randomly sampled. The review team is not aware of the legal issues surrounding unilateral release of the domain name, it is an option given to the complainant currently.

R4.2 (DNRC): What is in the WHOIS database, whatever will be available after RDS changes have been implemented, still needs to remain accurate.

R4.1 (RrSG and NCSG comments) Volker to provide language (suggested text: “Enforce registrar obligations with regard to RDS data accuracy requirements.”) to update recommendation 4.1 based on RrSG and NCSG comments.

R4.1 (DNRC Public Comment):Report in Public Comment form “as we read this, you’re requesting that we essentially ignore certain current contractual terms. That would require policy change and that is outside of this review’s scope”

Double check whether the recommendation number R5.1 was in response to whois1 rec5 or rec 5-9. Adjust numbering as needed.

Outreach: Domain Name Rights Coalition comment: Alan to clarify that there has been a lot of internal communications within ICANN engagement groups, but it’s clear that there's a certain disconnect with the areas.

R1.1, 1.2 (NCSG): Reaffirm/strengthen strategic priority, making sure that in the implementation note, the reference to dialoging with stakeholders is there, and it should not be purely the board acting unilaterally.

Add explanation in the report on recommendations numbering

Review and update glossary

ICANN org to act on NCSG comments on draft report clarity, in preparation of the face-to-face meeting.

Review team to consider extending coverage of the recommendation R1.2  to the council as well.

Emphasize in recommendation R1.1 that the focus should be global as opposed to either just Europe or just the US.

Reword recommendation BY.1 to make sure that ““safeguard registrant data” are incorporated into it. 

Staff to look into giving editing rights to Alan and Susan on the Privacy Proxy section.

R10.1:  both versions to be sent out to the list for review until 20 December 23:59 UTC. Alan to provide Jackie with text to add reference to 2013 RAA and successor document.

ICANN org to share via email the draft report public comments received.

On Roadmap - Those who cannot make it to the final consensus call, should send objections prior to the call. 

On Roadmap - All are reminded to send objections asap and edits by 26 August

On Executive Summary - Penholders to review paragraph relating to their topic(s) and send any edits they may have. 

On OECD related Bylaws amendment - Alan to call for objections to be sent to review team list by 26 August.

On OECD related Bylaws amendment - Alan to produce language for B.1 by COB today to propose replacement language.

On Compliance - C.M.2 to be retained as in draft report with edits 10 -15 %, including a footnote explaining we are seeking input on percentage and impacts on registrant's rights

On Data Accuracy - Alan to produce note framing 5.1.

On Data Accuracy - ICANN compliance to look into possibility of providing samples. 

On Data Accuracy - ICANN org to confirm availability of Compliance (and if possible ARS staff) for a meeting on 27 September 2018

On Roadmap to Draft Report - ICANN Org to indicate in consolidated draft which sections have not been discussed on plenary calls since F2F3

On F2F4 - ICANN Org to check on 10-12 December availability with Erika and Lili, and to check with meetings team on the most cost effective venue(s)

On Strategic Priority - Cathrin to look into possible updates to address Stephanie's comments regarding implementation of RT1's recommendation on incentivization and lack of documentation this RT could use to review/assess that implementation. Any updates to be included in the consolidated report must be provided by COB 14 August.

On Law Enforcement Needs - ICANN org to update recommendation LE.2 to refer to "cybersecurity professionals working with law enforcement" instead of "CSP and related professionals" and to frame recommendation in a manner similar to LE.1 (The ICANN Board should resolve...)

On Data Accuracy - ICANN Org to update new proposed recommendation R5.1 in consolidated report, including examples in supporting text (see agreement above)

On Executive Summary - Alan to deliver executive summary for review by COB 13 August

On Bylaws Amendments: Alan to deliver bylaws amendment for review by COB 13 August

Standardize RDS (WHOIS) throughout the draft report (consistent with ToR)

Send any edits/comments on Brussels meeting report by August 13 - 23:59 UTC     

Incorporate changes needed to sections (using redline) and submit them to the list

Review all drafts and be prepared to raise any final edits on Monday's call

ICANN org to resend table of agreed recommendations. 

On Data Accuracy - Leaders to discuss allocation of budget for a potential meeting with those present for the ePDP meeting with ICANN compliance.

During copy editing, support staff to ensure that:

• All recommendations are addressed to “The ICANN Board” and “shall negotiate contract terms” or “initiate a PDP”

• Each acronym is spelled out upon first use

• Refer to to organizations correctly and consistently (e.g., ICANN Contractual Compliance) throughout

ICANN62: Rapporteurs who are not in a position to define what they are recommending to flag what they want to present in Panama in their draft report.

ICANN org to begin populating draft report sections that pertain to background, methodology etc.

Alan to update safeguarding registrant data subgroup report based on discussions; ICANN Org to update engagement slide (as appropriate) to match updated subgroup report.

All to review open emails/action items in the next 36 hours, and submit subgroup reports ASAP.

• Enquire whether 24-25-26 July is still available in meetings team schedule and to issue doodle poll  including week of July 16, 24-25, 25-26 July (if still available). All RT members to hold off on bookings in the meantime. 
• Verify with Travel Services whether airplane tickets which were issued can be re-issued, reimbursed.

Letter to Theresa / Public Comment Entry:
- Put in a reference to increased cost post-FY19, in case there was a pause
- Correct the wording where it says 10 working group members, to reflect that Chris is a member but did not vote on this matter

Draft statement based on input received in collaboration with leadership team, then circulate to RT

ICANN org to confirm how much was budgeted in FY18.

ICANN org to update Engagement Session based on input received from Carlton and Alan, circulate the updated version with the review team for approval.

ICANN org to relay questions & concerns on collecting consent for answering the survey raised by Cathrin.

Alan to confirm RT’s intent to comment that no pause or change in scope is appropriate at this time.

ICANN org to extend this Wednesday’s leadership call to 60 minutes.

CANN org to recirculate the Brussels doodle poll to review team for prompt completion.

Rapporteurs to begin fleshing out the subgroup report template - https://community.icann.org/download/attachments/71604697/Proposed%20Subgroup%20Report%20Structure.docx?version=1&modificationDate=1519202465000&api=v2[community.icann.org]

Deadline for subgroup report is 5 April in preparation for Brussels face-to-face meeting (16-17-18 April) 

Reach out to ICANN org if you need help transcribing input

ICANN org to look into logistics to inform remote participants about last-minute agenda updates.

RT to submit any comments on agreements/action items by Wednesday 25 April 2018, COB.

No plenary call scheduled for 30 April. 

• ICANN Org to send a reminder about approved slides deadline to all:

• • Monday 9 April COB – ICANN org support team to send draft slides to subgroup Rapporteurs
  • Thursday 12 April COB – Rapporteurs to send final updates to slides to ICANN org support team
  • Friday 13 April COB – ICANN org support team to circulate final slide-deck with the review team

All rapporteurs to submit final slides no later than Thursday 12 April to enable final deck to be distributed on Friday 13 April.

ICANN org to send out a note to the review team “URGENT: unless we hear any objections, the meetings post the Face-to-Face meeting #2 will be switched to Mondays @14:00 UTC”.

ICANN 62 to be discussed at next plenary meeting 

Rapporteurs who have not addressed planning questions (i.e. Cathrin, Susan, Stephanie, Thomas) to send their input to the RDS-WHOIS2 Review Team list as soon as possible.

Subgroups to come back with a plan and answers to roadmap questions by 19 February. 

Send email to review team inviting them to provide comments on blog post by Tuesday 27 February 23:59 UTC.

Rapporteurs who are delayed in answering questions (due 9 February) to send their input as soon as possible.

• WHOIS1 Rec #1 - Strategic Priority: Cathrin Bauer-Bulst
• WHOIS1 Rec #4: Compliance: Susan Kawaguchi (next steps plan submitted)
• WHOIS Rec #10: Privacy/Proxy Services: Volker Greimann
• WHOIS Rec #11: Common Interface: Volker Greimann
• Anything New: Stephanie Perrin
• Law Enforcement Needs: Thomas Walden
• Consumer Trust: Erika Mann

By Friday 9 February 2018, rapporteurs must provide answers to the following questions:

• Has your subgroup identified any needed briefings/resources?
• How will your subgroup review/analyze relevant documentation? (for example, will you divide review between subgroup members)
• How will you conduct investigation of identified objectives?
• (for example, will you need calls or conduct work via email)
• How will you conduct relevant interviews (as appropriate)?
• How will your subgroup produce its summary of key findings?

ICANN org to look into the possibility of organizing a face-to-face meeting on 23-24 June 2018 and to advise.

Compliance subgroup to review the document, Susan and subgroup to confirm action plan based on the answers received.

Add Carlton to Consumer Trust subgroup & subgroup mailing list

1) Terms of Reference: Alan in conjunction with leadership team to make minor tweaks to terms of reference to reflect the discussion on plenary call.

Review Team members (Susan, Stephanie, Erika, Thomas, Carlton, Alan) to send completed Statement of Interests form and signed Conflict of Interest policy asap to staff list. Four Review Team Members had already completed their forms at the time of the face-to-face meeting. 

5) Request for written implementation briefings: ICANN org to provide a date estimation 

Subgroups Status & Next Steps: Anything New: Stephanie to review background materials and discuss with subgroup to fill in first pass planning doc. 

Subgroup status & next steps

• Outreach: add reference to WHOIS information Portal and Consolidated WHOIS Lookup Tool, and Registrant’s Benefits and Responsibilities. Update to reflect that no independent expert needed.
• Compliance: add “request to be fleshed out during interviews” to the last two items listed in requested materials

Request for briefings:  Review team to review alan's email and send suggestions/comments via email list.

RDS/WHOIS2 leadership to confirm Stephanie’s request for a briefing on contractual compliance/RAA. 

Scope & Objectives: - WHOIS1 Recs: ICANN org to inventory changes made to WHOIS policies since the first RT completed.

Subgroups Matrix: ICANN org to send out an email to Rec#10 subgroup pointing out that Volker will not be able to address the issue until mid-January. Susan volunteering to join the subgroup. ICANN org to update matrix.

Terms of Reference: Every RT member to respond to Alan's email no later than Tuesday 12 Dec.

Terms of Reference: Alan to send the review team a call for consensus to adopt the ToR and Work Plan.

Terms of Reference: 

• "Replacement and Removal of Members": add text from operating standards: "Depending on the remaining time of a review, or any other factors, the relevant SO/AC may choose not to nominate a replacement candidate."

• On page 18, first paragraph, delete "by ICANN Organization"

• Update hyperlink to final version of Limited Scope Proposal

• Update table in Appendix 2 to remove references to Actions and green highlighted comments in right-most column

Work plan: Susan, Chris, Erika to review the work plan and provide input/comments.

Briefing on GDPR: ICANN org to provide an update on this request

ICANN org to send an email recap on subgroups to the review team.

Scheduling: Leadership to liaise offline on confirming the plenary call time. Next Monday's call scheduled at the standing call time.

Terms of Reference

1) Change revised due date to Nov 28 2017

2) Move background on limited scope to appendix and replace with summary paragraph

3) accept consensus edit on page 5

4) comment A4 is withdrawn, text to remain

5) add RDS definition to page 7

6) edits to pages 9 and 10 accepted with no objections

7) Accept edits to pages 13-14 except for deleting "and am willing to implement it"

8) Add disclaimer that work plan is a living document (Alice to draft language)

9) Text proposed by Alan (A11) to be included on page 12 under Support from ICANN Organization

10) Retain (updated) scope table in appendix

Scope & Objectives: Review Team members to review these items and confirm by the end of next week that the Scope discussion can be considered frozen (adopted).

On work plan: ICANN Org to provide overview of external expert engagement process and needs.

On Terms of Reference: ICANN org to draft text for deliverables and timeframes based on agreements reached in this meeting, for leadership review.

On Terms of Reference: Alan (with Susan’s help) to propose text describing consensus policy for the group.

ICANN org to provide options and costs for F2F meetings before and after ICANN61 and ICANN62.

Terms of Reference: - ICANN org to add RDAP definition and shorten IDN definition. 

Implementation Briefings Questions: - RT members to review Implementation Briefings questions and send any additional questions or changes by Tuesday 17 October

Provide estimates on how many review team members will be funded to travel at ICANN meetings/would not incur travel expenses.

Statement of Interest: Send a reminder to Stephanie, Erika and Susan to sign and return SoI/CoI.

Fact Sheet: Place a comment on fact sheet wiki page, that it is currently pending review.

ICANN org to distribute blog entry to list (COMPLETE - Thanks, Cathrin!): https://www.icann.org/news/blog/data-protection-privacy-activity-recap[icann.org]

Statement of Interests: RT members who have not sent their SoI/CoI yet to do so by Monday, 23 October. ICANN org to send a reminder to those who have not returned their forms on Tuesday, 24 October.

Subgroups Matrix: Set concise mailings lists for each subgroup, add Alan to each mailing list.

Plenary call: Prepare a doodle poll to select the timing of upcoming plenary calls.

RDS/WHOIS2 leadership to communicate draft Scope identified at the Face-to-Face meeting to the ccNSO.

Scope & Objectives: - WHOIS1 Recs: Susan to lead discussion during next plenary call on a framework to measure and assess the effectiveness of RT1 recommendations.

ICANN org to provide Cathrin with template for 1st pass scoping of effort/tasks required for each work area; Cathrin to further develop template for agreement by leadership. 

Objectives: Expressions of interest and first-pass planning assignments

- ICANN org to update and resend table of assignments to review team, requesting any changes be suggested no later than Monday. ICANN org to also send an email to those who are not on the call to confirm assignments. If any changes are needed, ICANN org to make the necessary changes in advance of next plenary call.

Statement of Interests: - ICANN org to clarify what is meant by signing electronically.

ICANN org to schedule two plenary calls on Oct 12 and 19 at 12:30 UTC for 90 min, new plenary call time will be proposed post Abu-Dhabi.

On work plan: Scope, Terms of Reference, Workplan to be adopted and relayed to Board by November 24.

On work plan: ICANN org to circulate new version of the workplan by next week. 

On Terms of Reference: Any review team member who wishes to add a definition to the Terms of Reference should provide a draft definition by 12 October.

ICANN org to draft meeting communique for leadership review.

ICANN org to provide list of questions raised on WHOIS1 implementation reports for recs 1, 2, 3, 6, 7, 9, 15, 16 for leadership approval.

ICANN Org to reach out to Thomas on topics he would be interested to contribute to. 

ICANN org to provide updated Scope and Objectives table to reflect tentative agreements reached during meeting. 

ICANN Org to come back to leadership with proposal suggested assignment for 1st pass scoping, based on expressed interests, to distribute workload across team and include one member of the leadership on each item. 

Fill in the ICANN 60 doodle (http://doodle.com/poll/q35x2qxtipnyna9h) by COB today and/or confirm planning to attend. If no quorum, the meeting will be cancelled. 

ICANN org to send list of questions to RT list - Leaders to confirm list of questions on set of briefings #2 

Send your preliminary questions on WHOIS1 implementation

Cathrin to look at three definitions of “law enforcement” and to suggest language for working definition. 

Address fact sheet question on time allocated for research/studies

On ToR: On dependencies, identify all known groups for Review Team consideration

On leadership responsibilities: Edit item #2 - use identify when speaking in individual capacity

Read draft Terms of Reference and to suggest edits and/or offer comments in comment boxes or track-changes

Create doodle poll to capture availability so a decision can be reached in the next coming weeks.  Any modifications to the meeting schedule would be in place until the first FtoF meeting in October. 

Create doodle poll to identify who on the RT will be in Abu Dhabi. 

Circulate a poll with potential meeting times for next calls.

/