Page History
...
For other times: https://tinyurl.com/y4lbewdq
Info |
---|
PROPOSED AGENDA
a) Substantive review of SSAD questions (beginning where LC left off during last LC meeting) Updated Question 11 Status: Thomas, Volker, Brian and Margie to work together on refining this question in advance of the next LC call on Tuesday, 15 October. (Text proposed by Margie): Is it permissible under GDPR to provide fast, automated, and non-rate limited responses (as described in SSAC 101) to nonpublic WHOIS data for properly credentialed security practitioners1 (as defined in SSAC 101) who are responsible for defense against e-crimes (including network operators, providers of online services, commercial security services, cyber-crime investigators) for use in investigations and mitigation activities to protect their network, information systems or services (as referenced in GDPR Recital 49) and have agreed on appropriate safeguards? Or would any automated disclosure carry a potential for liability of the disclosing party, or the controllers or processors of such data? Can counsel provide examples of safeguards (such as pseudonymization/anonymization) that should be considered? For purposes of this question, please assume the following safeguards are in place:
Footnote 1: SSAC defines “security practitioners” in SSAC 101 as those who have a responsibility to perform specific types of functions (as specified in Section 3) related to the identification and mitigation of malicious activity, and the correction of problems that negatively affect services and users online. Updated Question 12 and 13 Status: Brian and Matthew to summarize the two positions re: questions 12 and 13 and propose whether Bird & Bird should opine on this. Legal Committee to discuss the positions during its next meeting. (Previous text proposed by Margie)
Background: The recent EC Letter [icann.org] provides clarification regarding the possible legal bases for disclosure of non-public registration data to in the section entitled “Legal Bases for Processing”, and noted: “As explained in our comments, Art. 6(1)f GDPR (legitimate interest) is one of the six possible legal bases provided under Art. 6(1) GDPR. For instance, disclosure of nonpublic gTLD registration data could be necessary for compliance with a legal obligation to which the contracted parties are subject (see Art. 6(1)c GDPR).” and “With regard to the formulation of purpose two, the European Commission acknowledges ICANN’s central role and responsibility for ensuring the security, stability and resilience of the Internet Domain Name System and that in doing so it acts in the public interest.” Questions:
3. Questions previously put on hold pending further legal advice and/or EPDP Team discussion
a) Additional topics noted in plenary sessions, where an EPDP Member requested the topic be considered by the Legal Committee
Status: Thomas, Volker, Brian and Margie to consider these items in their review of Q11.
Assume that registrars notify their registrants up-front of the purposes of data collection, under what circumstances the data may be released, the right to object, etc. a. When a data controller receives a legitimate third-party data request, under what circumstances is the controller required under GDPR to explicitly notify the data subject that a request has occurred, and/or that it has provided data to a third party? b. Under what circumstances do data subjects have the right to object under GDPR to the release of their data to third parties? Per Bird & Bird's Question 3 memo, ICANN's use cases do not involve profiling or highly sensitive data categories (race, political affiliation, etc.), and "a decision to release information via the SSAD is would not in itself have legal effect on the data subject." c. Are data controllers ever required to notify the data subject of theidentity of a third-party requestor? d. Please confirm: when a data subject objects to processing, the decision to release the data resides with the data controller? e. If a registrant must be notified of a request and then be given the opportunity to object, please explain how this process can be reconciled with or integrated into a SSAD that is designed to provide timely data exchange when possible and does not involve "a decision based solely on automated processing". (See Bird & Bird's Question 3 memo, paragraph 1.12.)
https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-09/cp190112en.pdf , where the Court clarified the applicability of GDPR outside of the EU, and stated: “However, it states that numerous third States do not recognise the right to dereferencing or have a different approach to that right. The Court adds that the right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. In addition, the balance between the right to privacy and the protection of personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world.” Does this ruling affect:
In light of this ECJ decision, using the same assumptions identified for Q1 and Q2, would there be less risk under GDPR to contracted parties if: a. the SSAD allowed automated disclosure responses to requests submitted by accredited entities for redacted data of registrants and/or controllers located outside of the EU, for legitimate purposes (such as cybersecurity investigations and mitigation)and/or other fundamental rights such as intellectual property infringement investigations (See Article 17, Section 2 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:12012P/TXT); and/or b. ICANN served as the sole entity making disclosure decisions for the SSAD, and directly provided access to the redacted data from a processing center outside of the EU (such as from ICANN’s Los Angeles Headquarters)?
b) Agree on next steps 4. Presentation of high-level summaries of legal memos
5. Wrap and confirm next meeting to be scheduled a) Confirm action items BACKGROUND DOCUMENTS |
Info | ||
---|---|---|
| ||
Audio Recording Zoom Recording Chat Transcript |
...