2019-01-02 EPDP Small meeting on Legal Committee Framework

PROPOSED AGENDA

1. Roll Call & SOI Updates (5 minutes)
2. Review / Present on open action items (20 minutes)
1. Open actions list:
1. Margie to draft conflict of interest language for this team to review by the end of the week. (open)
2. Thomas to draft CCWG lessons learned, e.g., one law firm preferred, early intervention from Board liaisons preferred, for this team to review by the end of the week. (open)
3. Berry to provide written update on the procurement process. (will present at call)
4. Caitlin to send initial question assignments to team members. (see below), https://mm.icann.org/pipermail/gnso-epdp-legal/2018-December/000004.html
3. Continue developing EPDP Questions requiring legal advice (30 minutes)
4. Wrap and confirm next meeting to be scheduled for Wednesday 9 January 2019 at 14.00 UTC
1. Confirm action items

Question 1: Hadia, Emily, Leon

The EPDP Team also took note of a related footnote which states, “[if contact details for persons other than the RNH are provided] it should be ensured that the individual concerned is informed”. The EPDP Team discussed whether this note implies that it is sufficient for the Registered Name Holder (RNH) to inform the individual it has designated as the technical contact, or whether the registrar may have the additional legal obligations to obtain consent. The EPDP Team agreed to request further clarification from the EDPB on this point. (p. 33 of Initial Report)

Question 2: Laureen, Kristina, Margie

(For the EDPB) If registrars allow registrants to self-identify at the time as a natural or legal person, who will be held liable if the registrant incorrectly self-identifies and personal information is publicly displayed? Apart from self-identification, and educational materials to inform the registrant, are there any other ways in which risk of liability could be mitigated by registrars? (p. 53 of Initial Report)

Question 3: Thomas, Diane, Tatiana

As noted below, the EPDP Team disagreed about the application of Art. 6(1)b, namely, does the reference ‘to which the data subject is party’ limit the use of this lawful basis to only those entities that have a direct contractual relationship with the Registered Name Holder? Similarly, in relation to Art. 6(1)(b), questions arose regarding how to apply “necessary for the performance of a contract”; specifically, does this clause solely relate to the registration and activation of a domain, or, alternatively, could related activities such as fighting DNS abuse also be considered necessary for the performance of a contract? The EPDP Team plans to put these questions forward to the European Data Protection Board (EDPB) to obtain further clarity in order to help inform its deliberations. (p. 57 of the Initial Report)

BACKGROUND DOCUMENTS

Mp3

Adobe Connect Recording