2022-08-11 Registration Data Accuracy Scoping Team- Meeting #36

Notes/ Action Items

Action Items

1. Michael to send an email with further guidance on next steps and timing to the list. 
2. Staff will relay to GNSO Council Leadership that the write up for assignments #1 and #2 will not be ready in time for review and consideration during the Council’s August meeting as originally planned. (COMPLETED) 
3. Staff support team to accept all minor edits in the write up. Recommendation #2 will be updated by removing “stress” and addition of footnote as suggested by ICANN org, in addition to edits made during the call in the google doc. Alternative recommendation #2 language will be removed.

Notes

1. Welcome & Chair Updates

• Mason Cole replaced Susan Kawaguchi as the Business Constituency’s (BC) representative to the team.

      2. Review of items flagged for consideration (see https://docs.google.com/document/d/1cV5ExSZD6G-owksGmMEmig0OXVdGcAUU/edit [docs.google.com] )– Scoping team to consider:

1. Recommendation #2 – edits proposed by RrSG and ICANN org

• The chair referenced options outlined in his email for moving the draft report forward.
• The Intellectual Property Constituency (IPC) would prefer to use another word rather than audit.
• Alan Greenberg (ALAC): Text should be modified to note that the analysis should not be in violation of registrar agreements. Group has been discussing the submission of registrations, with potentially false data, to see whether the registrar processes will notice it or not.
• Sarah Wyld (RrSG): The gap analysis proposal F is not the same as deep dive Proposal F. It is not clear how the suggestion of doing test registrations is different from Proposals B and C in our gap analysis, which were proposals to do a third party assessment.

o    The original recommendation was in order for ICANN org to do a registrar audit, we need to think about that separately from the idea of hiring a third party to do testing, because those are two different things.

• Agreement to remove the language referencing “stress” testing, as that implies something different than what the group proposed. The use of the word testing would be accepted. We cannot bring in a third party to do stuff we aren’t going to do ourselves (e.g., data processor delegation).
• Fictitious data is not permissible under the Registration Agreement. If we grant exemptions we're back to the problem from the last meeting of the testing not being secret anymore.
• ICANN staff agreed to translate the conversation from the previous meeting into a recommendation in the report, which is what the proposed language represents. Sarah Wyld, Brian Gutterman, and Alan Greenberg provided input as well as the IPC. 
• Stephanie Perrin (NCSG): Checks by ICANN org to ensure that things are being done correctly is a little different than an audit. I thought it was confirmed that we couldn’t use false data.
• Owen Smigelski (RrSG): RDDS Specification Section 2 of RAA is about Service Level Agreements (SLAs). The RAA amendment is actually currently under way, but narrowly limited to replacing WHOIS with RDAP. There is no possibility to add anything else, including new language to address feasibility to verify compliance by using false registration data. 

o    Some suggested that further exploration might be warranted, while others felt that at this stage this would not be necessary.  

• Absent any guidance from the European Data Protection Board (EDPB), every registrar will conduct the balancing test individually. The answer is not clear without guidance from the EDPB. 

              b. Alternative recommendation #2 – proposed by the IPC

• IPC believes testing is in the community interest. There needs to be an agreement on some sort of testing that is planned, coordinated, and cooperative.
• The NCSG believes ICANN org would have to evaluate its risk in each jurisdiction, which might be a non-starter for legal services. 
• IPC is happy to withdraw its Alternative 2 language and provide a reasonable edit to Rec 2 that covers concerns related to testing.
• Agreement to explore what type of testing would be possible within the current bounds of the RA and RAA.  
• ICANN org statement to be added as a footnote:  “For the record, ICANN Compliance will not submit, directly or through a third party, deliberately false registration data to registrars either as part of an audit or any other enforcement measure.” 
• Alan Greenberg (ALAC): This is ICANN org’s current interpretation of the RAA. This might be changed and interpreted differently in the future.
  
  

            c. Alternative recommendation #3 – proposed by the IPC

            d. New recommendation #4 – proposed by the IPC

• IPC proposed alternative text that all work be suspended until ICANN and contracting parties agree to a Data Processing Agreement that can be shared publicly.
• The EU GAC rep at ICANN 74 did indicate in the GAC BOARD meeting that they would respond. Did indicate that the EC would be responding to ICANN’s request. 
• The staff support team pointed out that the reference to “pausing” in the original recommendation is specific to the consideration of proposals that require access to registration data. 

            e. Confirm next steps

• The chair agreed that another call would be needed. He agreed to send out further instructions via email in relation to next steps and timing. 

      3. Finalize write up for assignments #1 and #2 for delivery to GNSO Council:

1. 1. Confirm timing & next steps
   2. Possible meeting at ICANN75

     4. Confirm action items

1. Michael to send an email with further guidance on next steps and timing to the list. 
2. Staff will relay to GNSO Council Leadership that the write up for assignments #1 and #2 will not be ready in time for review and consideration during the Council’s August meeting as originally planned. (COMPLETED) 
3. Staff support team to accept all minor edits in the write up. Recommendation #2 will be updated by removing “stress” and addition of footnote as suggested by ICANN org, in addition to edits made during the call in the google doc. Alternative recommendation #2 language will be removed.