AT-LARGE GATEWAY

At-Large Website

ALAC

RALOs

At-Large Regional Policy Engagement Program (ARPEP)

At-Large Governance

At-Large Reports

Policy Comments & Advice

Working Groups

ICANN Meetings

At-Large Summit (ATLAS III)

At-Large Review Implementation Plan Development

ALAC and RALO Elections, Selections, and Appointments

At-Large Priority Activities - 2021

Public Comment CloseStatement
Name 

Status

Assignee(s)

Call for
Comments Open		Call for
Comments
Close 		Vote OpenVote CloseDate of SubmissionStaff Contact and EmailStatement Number

17 April 2019

GNSO Expedited Policy Development Process (EPDP) on the Temporary Specification for gTLD Registration Data Policy Recommendations for ICANN Board Consideration


ADOPTED

as ALAC advice to the ICANN Board.

10Y, 1N, 4A

Alan Greenberg

Hadia Elminiawi

05 April 2019

10 April 2019

13 April 2019

17 April 2019

17 April 2019

Marika Konings
Policy-staff@icann.org

AL-ALAC-ST-0419-01-00-EN

Hide the information below, please click here 

See NTIA Letter to ICANN regarding the EPDP:

Brief Overview

Purpose: This public comment proceeding seeks to obtain community input prior to Board action on the final policy recommendations of the Generic Names Supporting OrganizationExpedited Policy Development Process on the Temporary Specification for gTLD Registration Data.

Current Status: The GNSO Council approved the policy recommendations during its meeting on 4 March 2019.

Next Steps: The ICANN Board is expected to take action on the approved policy recommendations.

Section I: Description and Explanation

At its meeting on 4 March 2019, the Generic Names Supporting Organization (GNSO) Council voted to adopt all the recommendations contained in the Final Report from the Team that it had chartered to conduct an Expedited Policy Development Process (EPDP) to develop policy recommendations concerning the Temporary Specification for gTLD Registration Data. The GNSO's adopted recommendations will now be sent to the ICANN Board for its review. In line with the ICANN Bylaws, this public comment forum is being opened so that the community has a reasonable opportunity to comment on the adopted recommendations prior to Board action.

The Final Report contains twenty-nine (29) recommendations addressing amongst others: purposes for processing data; details on the collection and transfer of specifically-identified data elements; display and redaction of specifically-identified data elements; treatment of current ICANN Consensus Policies; a proposed implementation bridge, and; items to be further discussed during Phase 2 of the EPDP Team's work.

Section II: Background

On 17 May 2018, the ICANN Board of Directors (ICANN Board) adopted the Temporary Specification for generic top-level domain (gTLD) Registration Data ("Temporary Specification") pursuant to the procedures for the establishment of temporary policies in ICANN's agreements with Registry Operators and Registrars ("Contracts"). The Temporary Specification provides modifications to existing requirements in the Registrar Accreditation and Registry Agreements in order to comply with the European Union's General Data Protection Regulation ("GDPR"). Following adoption of a temporary specification, the procedure for Temporary Policies as outlined in the Registrar Accreditation and Registry Agreements, provides the Board "shall immediately implement the Consensus Policy development process set forth in ICANN's Bylaws." Additionally, the procedure provides this Consensus Policy development process on the Temporary Specification must be carried out within a one-year period as the Temporary Specification can only remain in force for up to one year; from the effective date of 25 May 2018, i.e., the Temporary Specification will expire on 25 May 2019.

On 19 July 2018, the GNSO Council initiated an Expedited Policy Development Process (EPDP) and chartered the EPDP on the Temporary Specification for gTLD Registration Data team. Unlike other GNSO PDP efforts, which are open for anyone to join, the GNSO Council chose to limit the membership composition of this EPDP, primarily in recognition of the need to complete the work in a relatively short timeframe and to resource the effort responsibly. GNSO Stakeholder Groups, the Governmental Advisory Committee (GAC), the Country Code Names Supporting Organization (ccNSO), the At-Large Advisory Committee (ALAC), the Root Server System Advisory Committee (RSSAC), and the Security and Stability Advisory Committee (SSAC) were each invited to appoint up to a set number of members and alternates, as outlined in the charter. In addition, the ICANN Board and ICANN Org were invited to assign a limited number of liaisons to this effort. A call for volunteers to the aforementioned groups was issued in July and the EPDP Team held its first meeting on 1 August 2018.

The EPDP Team published its Initial Report for public comment on 21 November 2018. From 21 December-31 January 2019, the EPDP Team reviewed all public comments received using the Public Comment Review Tool (PCRT). The EPDP Team incorporated public comments into its Final Report, where it believed warranted. The report, which was finalized and delivered to the GNSO Council on 20 February 2019 contains 29 recommendations, all of which received full consensus / consensus support, apart from two recommendations (#2 – additional purposes and #16 – geographic basis, which were labelled as 'divergence'). The GNSO Council considered the Final Report during its meetings on 14 February, 21 February and 4 March 2019 (see https://gnso.icann.org/en/group-activities/calendar for further details).

Section III: Relevant Resources

EPDP Team Final Report

Section IV: Additional Information



Section V: Reports

FINAL VERSION SUBMITTED (IF RATIFIED)

The final version to be submitted, if the draft is ratified, will be placed here by upon completion of the vote. 


FINAL DRAFT VERSION TO BE VOTED UPON BY THE ALAC

The final draft version to be voted upon by the ALAC will be placed here before the vote is to begin.


DRAFT SUBMITTED FOR DISCUSSION

The first draft submitted will be placed here before the call for comments begins. The Draft should be preceded by the name of the person submitting the draft and the date/time. If, during the discussion, the draft is revised, the older version(S) should be left in place and the new version along with a header line identifying the drafter and date/time should be placed above the older version(s), separated by a Horizontal Rule (available + Insert More Content control).

v05:

Third draft of ALAC advice (13 April):

Second draft of ALAC advice (10 April):

First draft of ALAC advice:

9 Comments

  1. Evin Erdogdu

    Copy of mailing list thread

    On Thu, 4 Apr 2019, 17:54 Carlton Samuels wrote:

    Thick WHOIS made sense back then - and some of us were savaged for taking that position! - and still does today, if only because if every GTLD operator has the same obligations it is easier to check compliance. 

    The distinction between legal and natural persons and why that would matter is, um, well, I am loathe to commit 2 more brain cells to that argument. 

    The wave and momentum of national data privacy law and regulations is tacking the EU way. So in the final analysis a geographic distinction has no long term value.

    Do we have a new solution to offer anywhere? 

    And why does this 'advise the Board request/require' sound so much like we got popped in the mouth in the schoolyard and ran to teacher for justice?

    A better posture is to make the arguments we favour sharper and put them on the wire for the WG to see. 

    Orchestrate and manufacture consent!

    Carlton.

  2. Evin Erdogdu

    Copy of mailing list thread

    Seun Ojedeji's reply to Carlton:

    Hello Carlton,

     

    I hear you loud and clear, but if we are being realistic, I think the level of representation that exist within the ePDP may be a factor on how far one can push these things. I have heard a couple of times that the numbers don't matter but how loud we  "constructively" scream, well within ICANN, that's probably nothing more than a good motivational speech.

     

    Attempts has been made to get this through via the ePDP without luck and since ALAC practically has a milk teeth on ePDP, I don't think it will be out of order to utilize that which we've always been reminded of as being our role, which is to advice; hopefully there are still some permanent teeth left in there.


    Regards

  3. Evin Erdogdu

    Copy of mailing list thread

    On Thu, 4 Apr 2019, 09:06 Bastiaan Goslings wrote:

    Thanks a lot, Alan - your and Hadia’s efforts are much appreciated

    (I was not on yesterday’s CPWG call so do not know how this was discussed)

    It might not come as a surprise, but I do not agree with the advice on ‘Geographic Differentiation’. Both when it comes to the framing/introduction as well as the conclusion. I do not have time to elaborate on this know, but happy to do so later - in the meantime see my previous comments.

    I can agree with the 'Thick WHOIS’ concerns - the part on 'Legal/Natural Person Differentiation' seems redundant to me though, this is already covered by rec#17: 'The EPDP Team will determine and resolve the Legal vs. Natural issue in Phase 2’

    cheers
    Bastiaan

  4. Evin Erdogdu

    Copy of mailing list thread

    Seun Ojedeji's reply to Bastiaan Goslings:

    Dear Bastiaan, all

    Thanks Alan (and Haidia?) for this draft, 

    On the geographic differentiation am more inclined towards maintaining our request for it to be discussed at phase2. During the early discussion of phase 1,  a few members of the ePDP including (ALAC) made an attempt to push for a scenario where we use this opportunity to address (or provide a foundation for) a system that will not only address GDPR but also address other privacy related laws that may spring up from other parts of the world. There was a significant push back from the contracted side (including NCSG) strongly(and rightly so) insisting that this was an exercise solely meant for GDPR. I then wonder why the ePDP would want to apply the GDPR globally when it in "theory/practice" does not "protect/affect" the global users.

    So I think and believe that we still need to make that distinction and differentiation. If that differentiation exist then it will be easier to evaluate the effect of GDPR with regards to data of users "protected" by it and those who are not and perhaps it will help appreciate the good/bad of the GDPR syndrome. An attempt to apply a regional policy to global users should not be supported by ALAC.

    That said, I will suggest that the security point being enumerated under the geographic differentiation(from the moreover paragraph) should perhaps be assigned a sub heading as it's an important point that needs to be maintained even if we decide not to keep the geographic differentiation concern.

    Regards
    PS: Unless otherwise stated, my views here are always as an end user and not representative of the views of any other hats I may wear.

  5. Evin Erdogdu

    Copy of mailing list thread

    On Thu, Apr 4, 2019 at 5:32 AM Marita Moll wrote:

    For Bastiaan and anyone else who was not able to make the call, I made the following points on this issue:

    1. I am not crazy about the idea of issuing this advice to the board but, if we are going to do it, let's make sure we a really good reason to raise any of these issues.

    2. I could rationalize the Thick WhoIs item as there has been new legal advice in the meantime so we are asking that this advice be given full consideration.

    3. I can almost rationalize the Geographic Differentiation" as there seems to have been a commitment by the Chair that this issue would be reopened in Phase 2 and it does not appear to be on the agenda. Also, there has been some new legal opinion. I am not agreeing with the position but as I understand it, this is a request to continue the discussion -- as per a commitment that was made.

    4. I am not in favour of the last item -- requesting a redo on the Legal/Natural Persons decisions-- it is already covered, as Bastiaan says, scheduled to be discussed in Phase 2 and our bringing it up in this way seems like whining. There was a suggestion on the call that we could ask for a study. I did say that that might make a difference -- offering something new to the current situation. But then, I also don't see why that request could not be made during the discussions.

    In summary, I am not challenging anyone's position on the substance of these issues. I am just asking that we make sure there is something new, something that takes the advice being offered beyond a complaint on the terms of the report as it currently stands.

    Marita

  6. Evin Erdogdu

    Copy of mailing list thread

    Maureen Hilyard's reply to Marita:

    Thank you Marita for this concise and helpful summary of the current discussion. Like you I think that if we are to be making advice to the Board it should suggest an alternative approach to an issue of concern rather than disagreeing with what has already been decided or will be discussed in phase 2. Our advice needs to be innovative.

    My 2c as I unfortunately haven't had enough time in the day to follow all the details.
    Maureen

  7. Evin Erdogdu

    Copy of mailing list thread

    Evan Leibovitch's reply to Seun Ojedeji:

    On Thu, 4 Apr 2019 at 14:41, Seun Ojedeji wrote:

    I hear you loud and clear, but if we are being realistic, I think the level of representation that exist within the ePDP may be a factor on how far one can push these things. I have heard a couple of times that the numbers don't matter but how loud we  "constructively" scream, well within ICANN, that's probably nothing more than a good motivational speech.

    This is a truism for far more than this PDP. ;-)

    I agree with and support Carlton's and Siva's PoV.

    Seun, we KNOW from experience that our advice usually falls on deaf ears, especially when it runs afoul of industry entitlement. We are heeded when convenient and bypassed when not. As such, it is frustrating to me to encounter the all-too-frequent argument that we should tone down our views with the aim of being "realistic", that our opening position be one of compromise.  Those wanting to act in the corporate interest rather than the public interest have historically lacked such a sense of chivalry. As a result this tactic is proven to fail, let's not keep repeating it.

    If arguments strongly asserting (our collective view of) the public interest are "unrealistic", then that speaks more to ICANN's reality than our own.


    -- 

    Evan Leibovitch, Toronto Canada

  8. Evin Erdogdu

    Copy of mailing list thread

    Bastiaan Gosling's reply to Alan Greenberg:

    Hi Alan,

    > On 5 Apr 2019, at 21:31, Alan Greenberg wrote:
    > 
    > Bastiaan, let me understand. What we are asking
    > for is an opportunity for the EPDP to have a
    > discussion weighing the pros and cons  - the
    > balancing consideration called for under GDPR in
    > deciding what data needs to be redacted.

    The way I read the draft advise we are arguing for a lot more.

    > So you are against the EPDP using the balance
    > test prescribed by GDPR - something that was not done during Phase 1?

    I’m not sure where you got that from, me supposedly being 'against the EPDP using the balance test prescribed by GDPR’. Let me reiterate myself:

    https://mm.icann.org/pipermail/cpwg/2019-March/000986.html

    I think I am pretty clear there: while I might disagree with you and others on the substance of the topic, if it was agreed up, based on 'the recollection of the ALAC and SSAC as well as the EPDP Chair’, that the (non-) necessity of geo distinction of registrants would be further discussed and decided on in phase 2, then I will most certainly support us reminding the board of that. But, again, that is not (only) what the draft advice is arguing for IMO.

    thanks
    Bastiaan

  9. Alan Greenberg

    Thanks to Evin for copying these message to the Wiki. My comments follow:


    Carlton

    The wave and momentum of national data privacy law and regulations is tacking the EU way. So in the final analysis a geographic distinction has no long term value.

    Do we have a new solution to offer anywhere? 

    And why does this 'advise the Board request/require' sound so much like we got popped in the mouth in the schoolyard and ran to teacher for justice?

    A better posture is to make the arguments we favour sharper and put them on the wire for the WG to see. 

    There is no question that more jurisdictions may protect their subjects' privacy, but it is far from universal and more important, we have a principal of not over-complying to such legislation. That is a major issue here. Moreover, it is crucial that we actually have the debate over the benefits of redacting vs not redacting. Even under GDPR privacy is not absolute and can be over-ridden with cause. Note that a number of European ccTLDs do NOT redact "personal" information.

    Regarding the last points, the problem is that the WG has consciously decided not to consider certain issues. Making them "sharper" will not help, particularly if they are not on the agenda to discuss at all.

    Bastiaan

    I can agree with the 'Thick WHOIS’ concerns - the part on 'Legal/Natural Person Differentiation' seems redundant to me though, this is already covered by rec#17:'The EPDP Team will determine and resolve the Legal vs. Natural issue in Phase 2’

    It is not redundant. We are asking that the Board explicitly support considering the pros vs cons. Phase 1 has clearly demonstrated that the SSAC, ALAC and others SAYING we should consider this has fallen on deaf ears and there has been no interest in doing so. Only privacy issues and costs or liabilities to contracted parties has been considered.

    Marita


    4. I am not in favour of the last item -- requesting a redo on the Legal/Natural Persons decisions-- it is already covered, as Bastiaan says, scheduled to be discussed in Phase 2 and our bringing it up in this way seems like whining. There was a suggestion on the call that we could ask for a study. I did say that that might make a difference -- offering something new to the current situation. But then, I also don't see why that request could not be made during the discussions.

    In summary, I am not challenging anyone's position on the substance of these issues. I am just asking that we make sure there is something new, something that takes the advice being offered beyond a complaint on the terms of the report as it currently stands.

    On 4, see my answer to Bastiaan.  The group has shown no interest in having a full debate. There has been mention of a study (for Geographic differentiation as well) and I think it is a good idea to reiterate it here. The EPDP has seemingly decided that we will address access issues before returning to phase 1 items, so we will have time for such a study.

    Maureen

    Thank you Marita for this concise and helpful summary of the current discussion. Like you I think that if we are to be making advice to the Board it should suggest an alternative approach to an issue of concern rather than disagreeing with what has already been decided or will be discussed in phase 2. Our advice needs to be innovative.

    This is not the place to suggest an alternative approach to the substantive issue. The Board is not in a position to make decisions on these issues. It is up to the PDP to do that, as long as it is convened. All we can do is make it clear to the Board that the discussions may not happen if they do not take action.

    Bastiaan

    …based on 'the recollection of the ALAC and SSAC as well as the EPDP Chair’, that the (non-) necessity of geo distinction of registrants would be further discussed and decided on in phase 2, then I will most certainly support us reminding the board of that. But, again, that is not (only) what the draft advice is arguing for IMO.

    The wording in the draft is "The ALAC advises the Board to request [require] that the issue of geographic differentiation be re-opened during the EPDP Phase 2 in light of the new legal opinion and the lack of considering the competing needs of privacy vs the benefits of non-redaction on cyber-security activities and that the ensuing discussion factor in the needs of those using the data for cyber-security and other legitimate purposes."

    That is: Have the discussion and consider all issues including the ones that were ignored in Phase 1.


    The revised version includes a 4th item of advice requesting that a study be done on how other entities have implemented legal/natural and geographic differentiation (in light of contracted parties saying both are too difficult and too risky) and a study on the impact of the Temprary Spec implementation on cyber-security efforts.