FINAL VERSION SUBMITTED (IF RATIFIED)
The final version to be submitted, if the draft is ratified, will be placed here by upon completion of the vote.
FINAL DRAFT VERSION TO BE VOTED UPON BY THE ALAC
The final draft version to be voted upon by the ALAC will be placed here before the vote is to begin.
DRAFT SUBMITTED FOR DISCUSSION
The first draft submitted will be placed here before the call for comments begins. The Draft should be preceded by the name of the person submitting the draft and the date/time. If, during the discussion, the draft is revised, the older version(S) should be left in place and the new version along with a header line identifying the drafter and date/time should be placed above the older version(s), separated by a Horizontal Rule (available + Insert More Content control).
https://docs.google.com/document/d/1k0tXFJARrV9NfAHYAH71O6tlyQlh_kDE9CmNm_D1jEc/edit?usp=sharing
Revised Submission presentation on 30-Nov-22
3 Comments
Alan Greenberg
The requested format for comments is as follows:
For each of the sections of the draft policy:
Specify:
A. The section
For each of the other potentially affected policies:
Alan Greenberg
Hadia's first comments submitted 2 November 2022.
The ALAC appreciates the opportunity to provide its comments on the gTLD registration data consensus policy. As this policy sets the necessary foundation for the processing of gTLD registration data. Namely, the purposes for the processing of the gTLD registration data and data elements required to be collected, published and redacted, it is important to accurately implement this policy in due time. However, we would like to note that according to recommendation number 18, response time to disclosure requests were meant to be finalized through the requirements set during the implementation stage. As such we do not agree with section number 10.6 as it sets responses to urgent lawful disclosure requests to up to two business days. This would mean if a request comes on a weekend, the response to an urgent lawful disclosure request could be provided after four days. We need to remember that urgent requests are requests related to circumstances that pose an imminent threat to life, serious bodily injury, critical infrastructure, or child exploitation. Therefore, the response time set in section 10 in relation to urgent requests does not satisfy the purpose of the request.
The ALAC also notes that in accordance with recommendation number 18, the ALAC does not expect that the implementation of Section 10 (Disclosure Requests) will prevent or hinder the undergoing work in relation to a standardized system for access/disclosure (SSAD).
Alan Greenberg
Section 4. Policy Effective Date: The draft policy gives registrars and registries 540 days (18 months) to implement. Although some parties may implement quicker, that places the effective implementation date in the 4th quarter of 2024. That is almost 6 years from the finalization of the EPDP Final Report and 5.5 years from adoption by the Board. Surely this can be expedited. Contracted parties will have had over 4 years to begin preparing!
It is either humourous or sad to note that the EPDP Team (of which I was a member) envisioned that the Implementation Review Team AND the actual contracted party implementation should be able to complete in one year following the issuing of the Final Report.
Section 10. Disclosure Requests: I tend to agree with Hadia.
The Final Report said "A separate timeline of [less than X business days] will considered for the response to ‘Urgent’ Reasonable Disclosure Requests, those Requests for which evidence is supplied to show an immediate need for disclosure [time frame to be finalized and criteria set for Urgent requests during implementation]."
It is important to note the definition of "URGENT" requests. “Urgent Requests for Lawful Disclosure” are limited to circumstances that pose an imminent threat to life, serious bodily injury, critical infrastructure, or child exploitation in cases where disclosure of the data is necessary in combatting or addressing this threat. Critical infrastructure means the physical and cyber systems that are vital in that their incapacity or destruction would have a debilitating impact on economic security or public safety.
It is unfortunate that the report specified "business days" as the basis for the policy. That being said, to set it a TWO days in light of the definition of Urgent requests is just mind-boggling!
Background: The document gives the data the EPDP Team issued its Initial report and the date the GNSO Council adopted the Final Report, but does not give the date of the Final Report (20 February 2019).
Thick Whois Policy: The change to this policy is simply an note saying: As of [INSERT Registration Data Policy Effective Date] all requirements of this Policy have been superseded by the Registration Data Policy.
HOW SAD!