FINAL VERSION SUBMITTED (IF RATIFIED)
The final version to be submitted, if the draft is ratified, will be placed here by upon completion of the vote.
Note: ALAC statement was submitted via Google Form. The final responses submitted were based on the below PDF.
FINAL DRAFT VERSION TO BE VOTED UPON BY THE ALAC
The final draft version to be voted upon by the ALAC will be placed here before the vote is to begin.
The ALAC thanks ICANN for putting forward the EPDP phase two addendum to the initial report of the gTLD registration data for public comment and takes this opportunity to provide its comments herein
Preliminary recommendation #20 Display of Information of affiliated vs. accredited privacy/proxy providers.
Since all domains registered via accredited privacy/proxy services providers will be labeled as such in the domain registration data, the ALAC fully supports the recommendation. Should the domain registration be done via accredited privacy-proxy provider the data must not be redacted.
The ALAC notes that in the recommendation and the text, there are multiple references to “data associated with a natural person”. In fact a privacy/proxy registration may mask the data of ANY registrant, whether natural or legal person. As the recommendation stands, it might be construed that masking of the p/p service RDDS data would be allowed if the underlying registrant is a legal person, and that was not what was intended.
The ALAC also notes that Privacy & Proxy Services Accreditation Issue (PPSAI) PDP implementation has been halted pending the EPDP outcomes. The EPDP has determined that there is no need for the PPSAI implementation to be halted. The PPSAI PDP starting in 2013 and the recommendations were approved by the Board in 2016. The implementation MUST be completed with haste and the EPDP must make a clear recommendation to that effect.
Preliminary Conclusion – Legal vs. Natural Persons
On April 9th, the EPDP team received legal advice from Bird & Bird that includes information relevant to some concerns related to the differentiation between legal and natural persons’ registration data. In response to the concern that registrants might wrongfully self identify themselves the legal advice says independent verification measures that would identify miss-labelled registrants would be considered a reasonable accuracy measure. In addition, Bird & Bird had previously provided other measures that could be taken to address this issue. Previous memos have addressed concerns related to the data of the legal persons including personal information of natural persons. In addition, concerns related to the practicality and costs associated with the differentiation are currently being addressed through a survey conducted by ICANN org. The survey addresses the feasibility and costs, examples of industries that have successfully implemented the differentiation between legal and natural persons’ registration data and the various risks associated with the differentiation, the result of the survey should be available in May. Taking into account
- The interest of the Internet end-users and their right to be able to confirm the legitimacy of websites registered by legal persons.
- Burdening the system with unnecessary requests and thus leading to an inefficient system for access/disclosure of none publicly available registration data.
- Wasting the information that we currently have and the other that would be available through the survey by not acting upon it.
The ALAC believes potential next steps are feasible at the current stage if the will exists.
For avoidance of doubt, the ALAC does not agree to return the issue to the GNSO for possible action (or inaction) at some unknown future date.
The ALAC understands that differentiation may be difficult for existing registrations and that some time may be needed to fully implement differentiation, but that is not a reason to not immediately do so for new registrations and to begin the process of adjusting existing registrations.
Preliminary Conclusion – City Field Redaction and Preliminary Recommendation #21. Data Retention
The ALAC supports the recommendations.
Preliminary Conclusion – OCTO Purpose
In light of preliminary recommendation number 22, purpose two, the ALAC supports not adding a purpose in relation to ICANN’s Office of the Chief Technology Officer. We believe that ICANN purpose number two would cover such a purpose for OCTO when required.
Preliminary Conclusion - Feasibility of unique contacts to have a uniform anonymized email address
The ALAC cannot support the rejection of anonymized email addresses. The Bird & Bird memo clearly equates “masking” of email addresses with “the data controller hands over part of this dataset”. The form of anonymization that the EPDP has considered does not include providing ANY PART of the original address and thus the term “masking” is entirely inappropriate.
The ALAC can see no way in which a party other that the Registrar who created the anonymization could associate the new address with the registrant. Moreover, saying that the anonymized address allows contact and is thus personal information implies the same thing for a Web Link which also allows contact.
The ALAC particularly notes that Item 9 of the Bird & Bird memo gives significant benefits to using an anonymized address.
Lastly, if the EPDP were to not allow anonymized email addresses to be published, then the ALAC believes that the EPDP has an obligation to recommend options for what IS legitimately allowed to ensure registrant contactability.
Preliminary Conclusion – Accuracy and Whois Accuracy Reporting System
In light of the current information, provided by Bird & Bird in relation to the accuracy of the registration data, the ALAC is of the view that a recommendation with regard to accuracy is possible at this stage and that such a recommendation would either definitively address the issue or, at worst, would help and inform the GNSO scoping team. To that end, the ALAC does not support the recommendation. The EPDP Phase 1 Report committed that this issue would be covered, and that commitment was an essential component of the ALAC supporting that report.
The ALAC notes that the RDS-WHOIS2 Specific Review made a strong recommendation that resumed operation of the Accuracy Reporting System or something comparable is essential given the high rate of inaccuracy observed on pre-GDPR WHOIS data and the fact that the EPDP Phase 1 recommendation significantly reduced the number of possible contact points, increasing the potential for uncontactability. The SSR2 Specific Review makes a comparable recommendation in its draft report.
Preliminary Recommendation #22. Purpose 2
In light of the EDPB letter and ICANN board recommendation in relation to this ICANN purpose, the ALAC fully supports adding the stated purpose to the ICANN purposes for processing gTLD registration data mentioned in recommendation one of the EPDP phase one final report.
DRAFT SUBMITTED FOR DISCUSSION
The first draft submitted will be placed here before the call for comments begins. The Draft should be preceded by the name of the person submitting the draft and the date/time. If, during the discussion, the draft is revised, the older version(S) should be left in place and the new version along with a header line identifying the drafter and date/time should be placed above the older version(s), separated by a Horizontal Rule (available + Insert More Content control).
Posted by Alan Greenberg & Hadia Elminiawi 30 April 2020
Color Key: Original Text, Added/Changed 27 April, Added/Changed 30 April. All discussed during CPWG call on 29 April 2020
The ALAC thanks ICANN for putting forward the EPDP phase two addendum to the initial report of the gTLD registration data for public comment and takes this opportunity to provide its comments herein
Preliminary recommendation #20 Display of Information of affiliated vs. accredited privacy/proxy providers.
Since all domains registered via accredited privacy/proxy services providers will be labeled as such in the domain registration data, the ALAC fully supports the recommendation. Should the domain registration be done via accredited privacy-proxy provider the data must not be redacted.
The ALAC notes that in the recommendation and the text, there are multiple references to “data associated with a natural person”. In fact a privacy/proxy registration may mask the data of ANY registrant, whether natural or legal person. As the recommendation stands, it might be construed that masking of the p/p service RDDS data would be allowed if the underlying registrant is a legal person, and that was not what was intended.
The ALAC also notes that Privacy & Proxy Services Accreditation Issue (PPSAI) PDP implementation has been halted pending the EPDP outcomes. The EPDP has determined that there is no need for the PPSAI implementation to be halted. The PPSAI PDP starting in 2013 and the recommendations were approved by the Board in 2016. The implementation MUST be completed with haste and the EPDP must make a clear recommendation to that effect.
Preliminary Conclusion – Legal vs. Natural Persons
On April 9th, the EPDP team received legal advice from Bird & Bird that includes information relevant to some concerns related to the differentiation between legal and natural persons’ registration data. In response to the concern that registrants might wrongfully self identify themselves the legal advice says independent verification measures that would identify miss-labelled registrants would be considered a reasonable accuracy measure. In addition, Bird & Bird had previously provided other measures that could be taken to address this issue. Previous memos have addressed concerns related to the data of the legal persons including personal information of natural persons. In addition, concerns related to the practicality and costs associated with the differentiation are currently being addressed through a survey conducted by ICANN org. The survey addresses the feasibility and costs, examples of industries that have successfully implemented the differentiation between legal and natural persons’ registration data and the various risks associated with the differentiation, the result of the survey should be available in May. Taking into account
- The interest of the Internet end-users and their right to be able to confirm the legitimacy of websites registered by legal persons.
- Burdening the system with unnecessary requests and thus leading to an inefficient system for access/disclosure of none publicly available registration data.
- Wasting the information that we currently have and the other that would be available through the survey by not acting upon it.
The ALAC believes potential next steps are feasible at the current stage if the will exists.
For avoidance of doubt, the ALAC does not agree to return the issue to the GNSO for possible action (or inaction) at some unknown future date.
The ALAC understands that differentiation may be difficult for existing registrations and that some time may be needed to fully implement differentiation, but that is not a reason to not immediately do so for new registrations and to begin the process of adjusting existing registrations.
Preliminary Conclusion – City Field Redaction and Preliminary Recommendation #21. Data Retention
The ALAC supports the recommendations.
Preliminary Conclusion – OCTO Purpose
In light of preliminary recommendation number 22, purpose two, the ALAC supports not adding a purpose in relation to ICANN’s Office of the Chief Technology Officer. We believe that ICANN purpose number two would cover such a purpose for OCTO when required.
Preliminary Conclusion - Feasibility of unique contacts to have a uniform anonymized email address
The ALAC cannot support the rejection of anonymized email addresses. The Bird & Bird memo clearly equates “masking” of email addresses with “the data controller hands over part of this dataset”. The form of anonymization that the EPDP has considered does not include providing ANY PART of the original address and thus the term “masking” is entirely inappropriate.
The ALAC can see no way in which a party other that the Registrar who created the anonymization could associate the new address with the registrant. Moreover, saying that the anonymized address allows contact and is thus personal information implies the same thing for a Web Link which also allows contact.
The ALAC particularly notes that Item 9 of the Bird & Bird memo gives significant benefits to using an anonymized address.
Lastly, if the EPDP were to not allow anonymized email addresses to be published, then the ALAC believes that the EPDP has an obligation to recommend options for what IS legitimately allowed to ensure registrant contactability.
Preliminary Conclusion – Accuracy and Whois Accuracy Reporting System
In light of the current information, provided by Bird & Bird in relation to the accuracy of the registration data, the ALAC is of the view that a recommendation with regard to accuracy is possible at this stage and that such a recommendation would either definitively address the issue or, at worst, would help and inform the GNSO scoping team. To that end, the ALAC does not support the recommendation. The EPDP Phase 1 Report committed that this issue would be covered, and that commitment was an essential component of the ALAC supporting that report.
The ALAC notes that the RDS-WHOIS2 Specific Review made a strong recommendation that resumed operation of the Accuracy Reporting System or something comparable is essential given the high rate of inaccuracy observed on pre-GDPR WHOIS data and the fact that the EPDP Phase 1 recommendation significantly reduced the number of possible contact points, increasing the potential for uncontactability. The SSR2 Specific Review makes a comparable recommendation in its draft report.
Preliminary Recommendation #22. Purpose 2
In light of the EDPB letter and ICANN board recommendation in relation to this ICANN purpose, the ALAC fully supports adding the stated purpose to the ICANN purposes for processing gTLD registration data mentioned in recommendation one of the EPDP phase one final report.
Original version posted by Hadia Elminiawi 22 April 2020
The ALAC thanks ICANN for putting forward the EPDP phase two addendum to the initial report of the gTLD registration data for public comment and takes this opportunity to provide its comments herein
Preliminary recommendation #20 Display of Information of affiliated vs. accredited privacy/proxy providers.
Since all domains registered via accredited privacy/proxy services providers will be labeled as such in the domain registration data, the ALAC fully supports the recommendation. Should the domain registration be done via accredited privacy-proxy provider the data must not be redacted.
Preliminary Conclusion – Legal vs. Natural Persons
On April 9, the EPDP team received Bird & Bird response to the legal committee in relation to two questions regarding the accuracy of the registration data and the differentiation between natural and legal persons’ personal information. In addition, the ICANN org survey in relation to the feasibility and costs, examples of industries that have successfully implemented the differentiation and the various risks associated is to be delivered in May. To that end, although the EPDP team has agreed that the topic of legal vs natural is not on the critical path for the delivery of the final report on a system for access/disclosure of nonpublic registration data, the ALAC is of the view that a recommendation in relation to legal vs natural is possible at this stage. The ALAC would not like to waste the opportunity to have a more efficient system nor would we like to waste all the hard work and discussions that have occurred in this regard. For that, the ALAC does not agree to the preliminary conclusion on Legal vs Natural Persons. We believe that the EPDP team has not made use of the information available in this regard and that potential next steps are feasible at the current stage if the will exists.
Preliminary Conclusion – City Field Redaction and Preliminary Recommendation #21. Data Retention
The ALAC supports the recommendations.
Preliminary Conclusion – OCTO Purpose
In light of preliminary recommendation number 22, purpose two, the ALAC supports not adding a purpose in relation to ICANN’s Office of the Chief Technology Officer. We believe that ICANN purpose number two would cover such a purpose for OCTO when required.
Preliminary Conclusion - Feasibility of unique contacts to have a uniform anonymized email address
In light of the legal recommendation received the ALAC supports the recommendation.
Preliminary Conclusion – Accuracy and Whois Accuracy Reporting System
In light of the current information, provided by Bird & Bird in relation to the accuracy of the registration data, the ALAC is of the view that a recommendation with regard to accuracy is possible at this stage and that such a recommendation would help and inform the GNSO scoping team. To that end, the ALAC does not support the recommendation.
Preliminary Recommendation #22. Purpose 2
In light of the EDPB letter and ICANN board recommendation in relation to this ICANN purpose, the ALAC fully supports adding the stated purpose to the ICANN purposes for processing gTLD registration data mentioned in recommendation one of the EPDP phase one final report.
10 Comments
Hadia Elminiawi
The ALAC thanks ICANN for putting forward the EPDP phase two addendum to the initial report of the gTLD registration data for public comment and takes this opportunity to provide its comments herein
Preliminary recommendation #20 Display of Information of affiliated vs. accredited privacy/proxy providers.
Since all domains registered via accredited privacy/proxy services providers will be labeled as such in the domain registration data, the ALAC fully supports the recommendation. Should the domain registration be done via accredited privacy-proxy provider the data must not be redacted.
Preliminary Conclusion – Legal vs. Natural Persons
On April 9, the EPDP team received Bird & Bird response to the legal committee in relation to two questions regarding the accuracy of the registration data and the differentiation between natural and legal persons’ personal information. In addition, the ICANN org survey in relation to the feasibility and costs, examples of industries that have successfully implemented the differentiation and the various risks associated is to be delivered in May. To that end, although the EPDP team has agreed that the topic of legal vs natural is not on the critical path for the delivery of the final report on a system for access/disclosure of nonpublic registration data, the ALAC is of the view that a recommendation in relation to legal vs natural is possible at this stage. The ALAC would not like to waste the opportunity to have a more efficient system nor would we like to waste all the hard work and discussions that have occurred in this regard. For that, the ALAC does not agree to the preliminary conclusion on Legal vs Natural Persons. We believe that the EPDP team has not made use of the information available in this regard and that potential next steps are feasible at the current stage if the will exists.
Preliminary Conclusion – City Field Redaction and Preliminary Recommendation #21. Data Retention
The ALAC supports the recommendations.
Preliminary Conclusion – OCTO Purpose
In light of preliminary recommendation number 22, purpose two, the ALAC supports not adding a purpose in relation to ICANN’s Office of the Chief Technology Officer. We believe that ICANN purpose number two would cover such a purpose for OCTO when required.
Preliminary Conclusion - Feasibility of unique contacts to have a uniform anonymized email address
In light of the legal recommendation received the ALAC supports the recommendation.
Preliminary Conclusion – Accuracy and Whois Accuracy Reporting System
In light of the current information, provided by Bird & Bird in relation to the accuracy of the registration data, the ALAC is of the view that a recommendation with regard to accuracy is possible at this stage and that such a recommendation would help and inform the GNSO scoping team. To that end, the ALAC does not support the recommendation.
Preliminary Recommendation #22. Purpose 2
In light of the EDPB letter and ICANN board recommendation in relation to this ICANN purpose, the ALAC fully supports adding the stated purpose to the ICANN purposes for processing gTLD registration data mentioned in recommendation one of the EPDP phase one final report.
Alan Greenberg
I support what Hadia has proposed and have one minor change and several additional comments, all shown in RED below.
The ALAC thanks ICANN for putting forward the EPDP phase two addendum to the initial report of the gTLD registration data for public comment and takes this opportunity to provide its comments herein
Preliminary recommendation #20 Display of Information of affiliated vs. accredited privacy/proxy providers.
Since all domains registered via accredited privacy/proxy services providers will be labeled as such in the domain registration data, the ALAC fully supports the recommendation. Should the domain registration be done via accredited privacy-proxy provider the data must not be redacted.
The ALAC notes that in the recommendation and the text, there are multiple references to “data associated with a natural person”. In fact a privacy/proxy registration may mask the data of ANY registrant, whether natural or legal person. As the recommendation stands, it might be construed that masking of the p/p service RDDS data would be allowed if the underlying registrant is a legal person, and that was not what was intended.
Preliminary Conclusion – Legal vs. Natural Persons
On April 9, the EPDP team received Bird & Bird response to the legal committee in relation to two questions regarding the accuracy of the registration data and the differentiation between natural and legal persons’ personal information. In addition, the ICANN org survey in relation to the feasibility and costs, examples of industries that have successfully implemented the differentiation and the various risks associated is to be delivered in May. To that end, although the EPDP team has agreed that the topic of legal vs natural is not on the critical path for the delivery of the final report on a system for access/disclosure of nonpublic registration data, the ALAC is of the view that a recommendation in relation to legal vs natural is possible at this stage. The ALAC would not like to waste the opportunity to have a more efficient system nor would we like to waste all the hard work and discussions that have occurred in this regard. For that, the ALAC does not agree to the preliminary conclusion on Legal vs Natural Persons. We believe that the EPDP team has not made use of the information available in this regard and that potential next steps are feasible at the current stage if the will exists.
For avoidance of doubt, the ALAC does not agree to return the issue to the GNSO for possible action (or inaction) at some unknown future date.
The ALAC understands that differentiation may be difficult for existing registrations and that some time may be needed to fully implement differentiation, but that is not a reason to not do so for new registrations and to begin the process of adjusting existing registrations.
Preliminary Conclusion – City Field Redaction and Preliminary Recommendation #21. Data Retention
The ALAC supports the recommendations.
Preliminary Conclusion – OCTO Purpose
In light of preliminary recommendation number 22, purpose two, the ALAC supports not adding a purpose in relation to ICANN’s Office of the Chief Technology Officer. We believe that ICANN purpose number two would cover such a purpose for OCTO when required.
Preliminary Conclusion - Feasibility of unique contacts to have a uniform anonymized email address
In light of the legal recommendation received the ALAC supports the recommendation.
However, the ALAC believes that the EPDP has an obligation to recommend options for what IS legitimately allowed to ensure registrant contactability.
Preliminary Conclusion – Accuracy and Whois Accuracy Reporting System
In light of the current information, provided by Bird & Bird in relation to the accuracy of the registration data, the ALAC is of the view that a recommendation with regard to accuracy is possible at this stage and that such a recommendation would either definitively address the issue or would help and inform the GNSO scoping team. To that end, the ALAC does not support the recommendation.
The ALAC notes that the RDS-WHOIS2 Specific Review made a strong recommendation that resumed operation of the Accuracy Reporting System or something comparable is essential given the high rate of inaccuracy observed on pre-GDPR WHOIS data and the fact that the EPDP Phase 1 recommendation significantly reduced the number of possible contact points, increasing the potential for uncontactability. The SSR2 Specific Review makes a comparable recommendation in its draft report.
Preliminary Recommendation #22. Purpose 2
In light of the EDPB letter and ICANN board recommendation in relation to this ICANN purpose, the ALAC fully supports adding the stated purpose to the ICANN purposes for processing gTLD registration data mentioned in recommendation one of the EPDP phase one final report.
Justine Chew
Makes sense. All good. Thank you.
Bastiaan Goslings
Thanks for this, Hadia Elminiawi and Alan Greenberg
I have some questions regarding (our proposed response to) the 'Display of information of affiliated vs. accredited privacy / proxy providers’ Preliminary Recommendation and the ‘Legal vs. Natural Persons’ Preliminary Conclusion.
When it comes to the ‘'Display of information of affiliated vs. accredited privacy / proxy providers’ Preliminary Recommendation’ Alan proposes to add:
‘As the recommendation stands, it might be construed that masking of the p/p service RDDS data would be allowed if the underlying registrant is a legal person, and that was not what was intended.'
I do not know if the recommendation is ‘construed’ as such. The way I read it, it explicitly says that ‘where data associated with a natural person is masked’ that this is just an example (‘e.g.’). I am not knowledgeable when it comes to the details of privacy/proxy services, but imagine that when a legal person registers a domain using a privacy/proxy service, that the whole point (‘intention’) is that direct contact details/data are masked. Right? Are we suggesting to change associated policy and forbid legal persons to use a privacy/proxy service? As the text is now, it is unclear to me what we are exactly suggesting, because we initially state that ‘the ALAC fully supports the recommendation’.
When it comes to the ‘Legal vs. Natural Persons’ Preliminary Conclusion’, we first of all refer to the B&B memo from the 9th of April - while the addendum for public comment was published, or at least finalised, on the 26th of March. Which means the letter is out of scope in terms of commenting on the addendum. Of course we can refer to this if the memo contains information that puts the preliminary recommendation in a different light, but then we must do so explicitly, I think. Furthermore, based on the executive summary, the B&B memo is about the ‘Accuracy Principle’ and not about the Legal vs Natural persons topic.
We say ‘although the EPDP team has agreed that the topic of legal vs natural is not on the critical path for the delivery of the final report on a system for access/disclosure of nonpublic registration data’. Is that meant to paraphrase a statement from the EPDP chair, i.e. from a mail including the B&B memo sent on 16 april? Where he says ‘As the accuracy topic is not on the EPDP Team’s critical path for delivery of its Final Report on the System for Standardized Access/Disclosure, the EPDP Team will not consider the legal guidance at this time.’? If so, ‘the topic of legal vs natural’ is not the same thing as ‘the accuracy topic’, right?
More importantly, we propose to say ‘the ALAC is of the view that a recommendation in relation to legal vs natural is possible at this stage’. From the text that follows however, it does not become clear, for me, what that recommendation is. Besides the fact that supposedly ‘the ALAC does not agree to the preliminary conclusion on Legal vs Natural Persons’.
(I then assume that _everyone_ ‘would not like to waste the opportunity to have a more efficient system nor would (they) like to waste all the hard work and discussions that have occurred’.)
Also, if we add the ‘For avoidance of doubt, the ALAC does not agree to return the issue to the GNSO for possible action (or inaction) at some unknown future date’, I think we need to explain _why_ we do not agree. If it is just about the ‘unknown future date’ then we need to say so. and maybe propose a date etc. If it is about ‘returning the issue to the GNSO’ _Council_ as a matter of principle, even if a hard date and actions are included, then we also need to substantiate that, I believe.
Hadia Elminiawi
Hi Bastian,
Thank you for your comment. With regard to the legal vs Natural, indeed the answer of Bird & Bird came after the addendum was out and this is the whole point, we now have new information that was not available before and it does make sense to make use of this information. Natural vs legal is a topic that we did not reach consensus on and some of the reasons were related to the accuracy topic where CPs were afraid that some registrants would wrongfully identify themseleves, which could lead to the publication of the personal information of natural persons, the memo of bird & Bird related to accuracy addresses this point and I think we could make use of it with regard to the natural vs legal recomendtation. The recomendation suggests differing the natural vs legal topic and the intent here is to say lets not do so and make use of the new information that we have, however how to make use of the new information will need to be still discussed within the group. Let me try to rephrase the above comment to reflect your comments, the intent of the recomendation and make a suggestion.
Matthias M. Hudobnik
Dear all, I fully support the idea of taking the memo of Bird & Bird related to the debate about legal vs natural person into account!
Hadia Elminiawi
Preliminary Conclusion – Legal vs. Natural Persons
On April 9th, the EPDP team received legal advice from Bird & Bird that includes information relevant to some concerns related to the differentiation between legal and natural persons’ registration data. In response to the concern that registrants might wrongfully self identify themselves the legal advice says independent verification measures that would identify miss-labelled registrants would be considered a reasonable accuracy measure. In addition, Bird & Bird had previously provided other measures that could be taken to address this issue. Previous memos have addressed concerns related to the data of the legal persons including personal information of natural persons. In addition, concerns related to the practicality and costs associated with the differentiation are currently being addressed through a survey conducted by ICANN org. The survey addresses the feasibility and costs, examples of industries that have successfully implemented the differentiation between legal and natural persons’ registration data and the various risks associated with the differentiation, the result of the survey should be available in May. Taking into account
The ALAC does not agree to the preliminary conclusion on Legal vs Natural Persons. We believe potential next steps are feasible at the current stage if the will exists.
For avoidance of doubt, the ALAC does not agree to return the issue to the GNSO for possible action (or inaction) at some unknown future date.
The ALAC understands that differentiation may be difficult for existing registrations and that some time may be needed to fully implement differentiation, but that is not a reason to not do so for new registrations and to begin the process of adjusting existing registrations.
Hadia Elminiawi
Preliminary Conclusion - Feasibility of unique contacts to have a uniform anonymized email address
The ALAC cannot support the rejection of anonymized email addresses. The Bird & Bird memo clearly equates “masking” of email addresses with “the data controller handing over part of the dataset”. The form of anonymization that the EPDP has considered does not include providing ANY PART of the original address and thus the term “masking” is entirely inappropriate.
The ALAC can see no way, in which a party other than the Registrar who created the anonymization could associate the new address with the registrant. Moreover, saying that the anonymized address allows contact and that this is personal information implies the same thing for a Web Link which also allows contact.
Moreover, Item 9 of the Bird & Bird memo gives significant benefits to using an anonymized address.
Lastly, if the EPDP were to not allow anonymized email addresses to be published, then the ALAC believes that the EPDP has an obligation to recommend options for what IS legitimately allowed to ensure registrant contactability.
Alan Greenberg
A revised statement is now posted including the changes I proposed on 27 April (in red), and those added since by both Hadia and me (in blue).
All of these changes were discussed during the CPWG meeting on Wednesday, 29 April 2020.
The unusual number of last minute changes are due to discussions with other groups within the EPDP, ensuring that the ALAC statement is as complete as possible.
Virtually everything that is in this statement agrees with and is supported by previous statements of the ALAC.
For those who wish to see the legal memos mentioned in the statement:
The Bird & Bird memo on Legal/Natural
The Bird & Bird memo of 09 April
Alan Greenberg
Seeing no additional comments, I have copied the statement into the version to be voted on.