<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<meta http-equiv="CONTENT-TYPE" content="text/html;
charset=ISO-8859-1">
<p style="margin-bottom: 0in; font-style: normal"><font
face="Calibri, sans-serif"><font size="4">To Rafik, NCSG
Executive Committee and NCSG Membership,</font></font></p>
<p style="margin-bottom: 0in; font-style: normal"><font
face="Calibri, sans-serif"><font size="4">There is an important,
but very quiet comment proceeding that has been taking place
this summer. It is the </font></font><font face="Calibri,
sans-serif"><font size="4"><i>Review
of the ICANN Procedure for Handling WHOIS Conflicts with
Privacy Law</i></font></font><font face="Calibri,
sans-serif"><font size="4"><i> </i>at <i><a
href="https://www.icann.org/public-comments/whois-conflicts-procedure-2014-05-22-en">https://www.icann.org/public-comments/whois-conflicts-procedure-2014-05-22-en</a></i></font></font>
</p>
<p style="margin-bottom: 0in">Stephanie put out a call for comments,
and not seeing any, I drafted these. It has been dismayeding ever
since ICANN adopted its Consensus Procedure for Handling WHOIS
Conflicts with Privacy law -- because it basically requires that
Registrars and Registries have to be sued or receive an official
notice of violation before they can ask ICANN for a waiver of the
Whois requirements. That always seemed very unfair- that you have
to be exposed to allegation of illegal activity in order to
protect yourself or your Registrants under your national data
protection and privacy laws.<br>
</p>
<p style="margin-bottom: 0in">In the more recent Data Retention
Specification, of the 2013 RAA, ICANN Staff and Lawyers saw this
problem and corrected it -- now Registrars can be much more
pro-active in showing ICANN that a certain clause in their
contract (e.g., extended data retention) is a clear violation of
their national law (e.g., more limited data retention). <br>
</p>
<p style="margin-bottom: 0in; font-style: normal"><font
face="Calibri, sans-serif"><font size="4">So to this important
comment proceeding, I drafted these comments for us to submit.
As Reply Comments (during the Reply Period), we are asked to
respond to other commenters. That's easy as the European
Commission and Registrar Blacknight submitted useful comments.
<br>
</font></font></p>
<p style="margin-bottom: 0in; font-style: normal"><font
face="Calibri, sans-serif"><font size="4">Rafik, can we edit,
finalize and submit by the deadline on Friday? Comments below
and attached. If you have edits, in the interest of time,
kindly suggest alternate language. Tx!!<br>
</font></font></p>
<p style="margin-bottom: 0in; font-style: normal"><font
face="Calibri, sans-serif"><font size="4">Best,<br>
Kathy<br>
--------------------------------------------------------------------------------------------------------<br>
</font></font>
<meta http-equiv="CONTENT-TYPE" content="text/html;
charset=ISO-8859-1">
</p>
<p style="margin-bottom: 0in; font-style: normal">
<title></title>
<meta name="GENERATOR" content="OpenOffice.org 3.3 (Win32)">
<style type="text/css">
<!--
@page { margin: 0.79in }
P { margin-bottom: 0.08in }
A:link { so-language: zxx }
-->
</style>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">DRAFT
NCSG Response to the Questions of the </font></font>
</p>
<font face="Calibri, sans-serif"><font size="4"><i>Review
of the ICANN Procedure for Handling WHOIS Conflicts with
Privacy Law</i></font></font><font face="Calibri,
sans-serif"><font size="4"><i><br>
<a
href="https://www.icann.org/public-comments/whois-conflicts-procedure-2014-05-22-en">https://www.icann.org/public-comments/whois-conflicts-procedure-2014-05-22-en</a></i></font></font>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4"><b>Introduction</b></font></font></p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">The
Noncommercial Stakeholders Group represents noncommercial
organizations in their work in the policy and proceedings of
ICANN
and the GNSO. We respectfully submit as an opening premise
that every
legal business has the right and obligation to operate
within the
bounds and limits of its national laws and regulations. No
legal
business establishes itself to violate the law; and to do so
is an
invitation to civil and criminal penalties. ICANN Registries
and
Registrars are no different – they want and need to abide by
their
laws. </font></font>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">Thus,
it is timely for ICANN to raise the questions of this
proceeding,
</font></font><font face="Calibri, sans-serif"><font size="4"><i>Review
of
the ICANN Procedure for Handling WHOIS Conflicts with
Privacy Law</i></font></font><font face="Calibri,
sans-serif"><font size="4">
(albeit at a busy time for the Community and at the height
of summer;
we expect to see more interest in this time towards the
Fall). We
submit these comments in response to the issues raises and
the
questions asked. </font></font>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4"><b>Background</b></font></font></p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">The
</font></font><font face="Calibri, sans-serif"><font size="4"><i>ICANN
Procedure
for Handling Whois Conflicts with Privacy Law </i></font></font><font
face="Calibri, sans-serif"><font size="4">was
adopted in 2006 after years of debate on Whois issues. This
Consensus
Procedure was the first step of recognition that data
protection laws
and privacy law DO apply to the personal and sensitive data
being
collected by Registries and Registrars for the Whois
database. </font></font>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">But
for those of us in the Noncommercial Users Constituency (now
part of
the Noncommercial Stakeholders Group/NCSG) who helped
debate, draft
and adopt this Consensus Procedure in the mid-2000s, we were
always
shocked that the ICANN Community did not do more. At the
time,
multiple Whois Task Forces were at work with multiple
proposals which
include important and pro-active suggestions to allow
Registrars and
Registries to come into compliance with their national data
protection and privacy laws. </font></font>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">At
the time, we never expected this Consensus Procedure to be
an end
itself – but the first step of many steps. It was an “end”
for
too long, so we are glad the discussion is reopened and once
again we
seek to allow Registrars and Registries to be in full
compliance with
their national data protection and privacy laws – from the
moment
they enter into their contracts with ICANN.</font></font></p>
<p style="margin-bottom: 0in"><b><font face="Calibri, sans-serif"><font
size="4">II.
Data Protection and Privacy Laws – A Quick Overview of the
Principles that Protect the Personal and Sensitive Data of
Individuals and Organizations/Small Businesses </font></font></b>
</p>
<b>
</b>
<p style="margin-left: 1.2in; margin-bottom: 0in"><font
face="Calibri, sans-serif"><font size="4"><i><b>[Stephanie,
Tamir or Others with Expertise in Canadian and European
Data
Protection Laws may choose to add something here]. </b></i></font></font>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4"><span style="font-style: normal"><span
style="font-weight: normal">III</span></span><i><b>. </b></i>Questions
asked of the Community in this Proceeding </font></font>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">The
ICANN Review Paper raised a number of excellent questions.
In keeping
with the requirements of a Reply Period, these NCSG comments
will
address both our comments and those comments we particularly
support
in this proceeding.</font></font></p>
<ol>
<ol>
<li>
<p style="margin-bottom: 0in"><font face="Calibri,
sans-serif"><font size="4">Is it impractical for ICANN
to require that a contracted party already has
litigation or a government proceeding initiated
against it prior to being able to invoke the Whois
Procedure?</font></font></p>
</li>
</ol>
</ol>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">1.1
Response: Yes, it is completely impractical (and
ill-advised) to
force a company to violate a national law as a condition of
complying
with that national law. Every lawyer advises businesses to
comply
with the laws and regulations of their field. To do
otherwise is to
face fines, penalties, loss of the business, even jail for
officers
and directors. Legal business strives to be law-abiding; no
officer
or director wants to go to jail for her company's
violations. It is
the essence of an attorney's advice to his/her clients to
fully
comply with the laws and operate clearly within the clear
boundaries
and limits of laws and regulations, both national, by
province or
state and local. </font></font>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">In
these Reply Comments, we support and encourage ICANN to
adopt
policies consistent with the initial comments submitted by
the
European Commission: </font></font>
</p>
<ul>
<ul>
<li>
<p style="margin-bottom: 0in"><font face="Calibri,
sans-serif"><font size="4">that the Whois Procedure be
changed from requiring specific prosecutorial action
instead to allowing “demonstrating evidence of a
potential conflict widely and e.g. accepting
information on the legislation imposing requirements
that the contractual requirements would breach as
sufficient evidence.” (European Commission comments)</font></font></p>
</li>
</ul>
</ul>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">We
also agree with Blacknight:</font></font></p>
<ul>
<ul>
<li>
<p style="margin-bottom: 0in">“<font face="Calibri,
sans-serif"><font size="4">It's completely illogical for
ICANN to require that a contracting party already has
litigation before they can use a process. We would
have loved to use a procedure or process to get
exemptions, but expecting us to already be litigating
before we can do so is, for lack of a better word,
nuts.” (Blacknight comments in this proceeding).</font></font></p>
</li>
</ul>
</ul>
<p style="margin-bottom: 0in"><br>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4"> 1.1a
How can the triggering event be meaningfully defined?</font></font></p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">1.1 a Response: This
is an important question. Rephrased, we might ask together –
what
must a Registry or Registrar show ICANN in support of its
claim that
certain provisions involving Whois data violate provisions
of
national data protection and privacy laws?</font></font></p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">NCSG
respectfully submits that there are at least four
“triggering
events” that ICANN should recognize: </font></font>
</p>
<ul>
<ul>
<li>
<p style="margin-bottom: 0in"><font face="Calibri,
sans-serif"><font size="4">Evidence from a national Data
Protection Commissioner or his/her office (or from a
internationally recognized body of national Data
Protection Commissioners in a certain region of the
world, including the Article 29 Working Party that
analyzes the national data protection and privacy
laws) that ICANN's contractual obligations for
Registry and/or Registrar contracts violate the data
protection laws of their country or their group of
countries; </font></font> </p>
</li>
<li>
<p style="margin-bottom: 0in"><font face="Calibri,
sans-serif"><font size="4">Evidence of legal and/or
jurisdictional conflict arising from analysis
performed by ICANN's legal department or by national
legal experts hired by ICANN to evaluate the Whois
requirements of the ICANN contracts for compliance and
conflicts with national data protection laws and
cross-border transfer limits) (similar to the process
we understand was undertaken for the data retention
issue); </font></font> </p>
</li>
</ul>
</ul>
<p style="margin-bottom: 0in"><br>
</p>
<ul>
<ul>
<li>
<p style="margin-bottom: 0in"><font face="Calibri,
sans-serif"><font size="4">Receipt of a written legal
opinion from a nationally recognized law firm in the
applicable jurisdiction that states that the
collection, retention and/or transfer of certain Whois
data elements as required by Registrar or Registry
Agreements is “reasonably likely to violate the
applicable law” of the Registry or Registrar (per the
process allowed in RAA Data Retention Specification);
or</font></font></p>
</li>
</ul>
</ul>
<p style="margin-bottom: 0in"><br>
</p>
<ul>
<ul>
<li>
<p style="margin-bottom: 0in"><font face="Calibri,
sans-serif"><font size="4">An official opinion of any
other governmental body of competent jurisdiction
providing that compliance with the data protection
requirements of the Registry/Registrar contracts
violates applicable national law (although such
pro-active opinions may not be the practice of the
Data Protection Commissioner's office). </font></font>
</p>
</li>
</ul>
</ul>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">The
above list draws from the comments of the European
Commission, Data
Retention Specification of the 2013 Registrar Accreditation
Agreement, and sound compliance and business practices for
the ICANN
General Counsel's office. </font></font>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">We
further agree with Blacknight that the requirements for
triggering
any review and consideration by ICANN be: simple and
straightforward,
quick and easy to access. </font></font>
</p>
<p style="margin-bottom: 0in"><br>
</p>
<font face="Calibri, sans-serif"><font size="4">1.3 Are there
any components of the triggering event/notification portion of
the RAA's Data Retention waiver process that should be
considered as optional for incorporation into a modified Whois
Procedure?</font></font>
<p style="margin-bottom: 0in"><br>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">1.3
Response: Absolutely, the full list in 1.1a above, together
with
other constructive contributions in the Comments and Reply
Comments
of this proceeding, should be strongly considered for
incorporation
into a modified Whois Procedure, or simply written into the
contracts
of the Registries and Registrars contractual language, or a
new Annex
or Specification. </font></font>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">We
respectfully submit that the obligation of Registries and
Registrars
to comply with their national laws is not a matter of
multistakeholder decision making, but a matter of law and
compliance.
In this case, we wholeheartedly embrace the concept of
building a
process together that will allow exceptions for data
protection and
privacy laws to be adopted quickly and easily. </font></font>
</p>
<p style="margin-bottom: 0in"><br>
</p>
<font face="Calibri, sans-serif"><font size="4"> 1.4 Should
parties be permitted to invoke the Whois Procedure before
contracting with ICANN as a registrar or registry?</font></font>
<p style="margin-bottom: 0in"><br>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">1.4
Response: Of course, Registries and Registrars should be
allowed to
invoke the Whois Procedure, or other appropriate annexes and
specifications that may be added into Registry and Registrar
contracts with ICANN. As discussed above, the right of a
legal
company to enter into a legal contracts is the most basic of
expectations under law.</font></font></p>
<p style="margin-bottom: 0in"><br>
</p>
<font face="Calibri, sans-serif"><font size="4"> 2.1 Are there
other relevant parties who should be included in this step?</font></font>
<p style="margin-bottom: 0in"><br>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">2.1
Response: We agree with the EC that ICANN should be working
as
closely with National Data Protection Authorities as they
will allow.
In light of the overflow of work into these national
commissions, and
the availability of national experts at law firms, ICANN
should also
turn to the advice of private experts, such as
well-respected law
firms who specialize in national data protection laws. The
law firm's
opinions on these matters would help to guide ICANN's
knowledge and
evaluation of this important issue. </font></font>
</p>
<p style="margin-bottom: 0in"><br>
</p>
<font face="Calibri, sans-serif"><font size="4"> 3.1 How is an
agreement reached and published?</font></font>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">3.1
Response. As discussed above, compliance with national law
may not be
the best matter for negotiation within a multistakeholder
process. It
really should not be a chose for others to make whether you
comply
with your national data protection and privacy laws. That
said, the
process of refining the Consensus Procedure, and adopting
new
policies and procedures, or simply putting new contract
provisions,
annexes or specifications into the Registry and Registrar
contracts
SHOULD be subject to community discussion, notification and
review. But once the new process is adopted, we think the
new changes,
variations, modifications or exceptions of Individual
Registries and
Registrars need go through a public review and process. The
results,
however, Should be published for Community notification and
review. </font></font>
</p>
<p style="margin-bottom: 0in"><br>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">We
note that in conducting the discussion with the Community on
the
overall or general procedure, policy or contractual changes,
ICANN
should be assertive in its outreach to the Data Protection
Commissioners. Individual and through their organizations,
they have
offered to help ICANN evaluate this issue numerous times.
The Whois
Review Team noted the inability of many external bodies to
monitor
ICANN regularly, but the need for outreach to them by ICANN
staff
nonetheless: </font></font>
</p>
<p style="margin-bottom: 0in"><br>
</p>
<p style="margin-left: 1.96in; margin-bottom: 0in"><font
face="Calibri, sans-serif"><font size="4"><b>Recommendation
3: Outreach</b></font></font></p>
<p style="margin-left: 1.96in; margin-bottom: 0in"><font
face="Calibri, sans-serif"><font size="4"><b>ICANN
should ensure that WHOIS policy issues are accompanied by
cross-community</b></font></font></p>
<p style="margin-left: 1.96in; margin-bottom: 0in"><font
face="Calibri, sans-serif"><font size="4"><b>outreach,
including outreach to the communities outside of ICANN
with a
specific</b></font></font></p>
<p style="margin-left: 1.96in; margin-bottom: 0in"><font
face="Calibri, sans-serif"><font size="4"><b>interest
in the issues, and an ongoing program for consumer
awareness.</b></font></font></p>
<p style="margin-bottom: 0in; font-weight: normal"><font
face="Calibri, sans-serif"><font size="4">This
is a critical policy item for such outreach and input. </font></font>
</p>
<p style="margin-bottom: 0in"><br>
</p>
<font face="Calibri, sans-serif"><font size="4"> 3.2 If there
is an agreed outcome among the relevant parties, should the
Board be involved in this procedure?</font></font>
<p style="margin-bottom: 0in"><br>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">3.2
Response: Clearly, the changing of the procedure, or the
adoption of
a new policy or new contractual language for Registries and
Registrars, Board oversight and review should be involved.
But once
the new procedure, policy or contractual language is in
place, then
subsequent individual changes, variations, modifications or
exceptions should be handled through the process and ICANN
Staff –
as the Data Retention Process is handled today. </font></font>
</p>
<p style="margin-bottom: 0in"><br>
</p>
<font face="Calibri, sans-serif"><font size="4">4.1 Would it
be fruitful to incorporate public comment in each of the
resolution scenarios?</font></font>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">4.1
Response: We think this question means whether there should
be public
input on each and every exception? We respectfully submit
that the
answer is No. Once the new policy, procedure or contractual
language
is adopted, then the process should kick in and the
Registrar/Registry should be allowed to apply for the
waiver,
modification or revision consistent with its data protection
and
privacy laws. Of course, once the waiver or modification is
granted,
the decision should be matter of public record so that other
Registries and Registrars in the jurisdiction know and so
that the
ICANN Community as a whole can monitor this process'
implementation
and compliance.</font></font></p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">Step
Five: Public notice</font></font></p>
<p style="margin-bottom: 0in"><br>
</p>
<font face="Calibri, sans-serif"><font size="4">5.2 Is the
exemption or modification termed to the length of the
agreement? Or is it indefinite as long as the contracted party
is located in the jurisdiction in question, or so long as the
applicable law is in force.</font></font>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">5.2
Response: We agree with the European Commission in its
response, “<i>By
logic the exemption or modification shall be in place as
long as the
party is subject to the jurisdiction in conflict with
ICANN rules. If
the applicable law was to change, or the contacted party
moved to a
different jurisdiction, the conditions should be reviewed
to assess
if the exemption is still justified.” But provided it is
the same
parties, operating under the same laws, the modification
or change
should continue through the duration of the relationship
between the
Registry/Registrar and ICANN. </i> </font></font>
</p>
<p style="margin-bottom: 0in"><br>
</p>
<font face="Calibri, sans-serif"><font size="4"> 5.3 Should an
exemption or modification based on the same laws and facts
then be granted to other affected contracted parties in the
same jurisdiction without invoking the Whois Procedure</font></font>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">5.3
Response. The European Commission in its comments wrote, and
we
strongly agree: <i>“the same exception should apply to
others in
the same jurisdiction who can demonstrate that they are in
the same
situation.” </i>Further, Blacknight wrote and we support:
<i>“if
ANY registrar in Germany, for example, is granted a waiver
based on
German law, than ALL registrars based in Germany should
receive the
same treatment.” </i><span style="font-style: normal">
Once a
national data protection or privacy law is interpreted as
requiring
and exemption or modification, it should be available to
all
Registries/Registrars in that country.</span></font></font></p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">Further,
we recommend that ICANN should be required to notify each
gTLD
Registry and Registrar in the same jurisdiction as that of
the
decision so they will have notice of the change.</font></font></p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">We
thank ICANN staff for holding this comment period. </font></font>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">Respectfully
submitted, </font></font>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">NCSG
</font></font>
</p>
<p style="margin-bottom: 0in"><br>
</p>
<p style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">DRAFT
</font></font>
</p>
<br>
</p>
<title></title>
<meta name="GENERATOR" content="OpenOffice.org 3.3 (Win32)">
<style type="text/css">
<!--
@page { margin: 0.79in }
P { margin-bottom: 0.08in }
A:link { so-language: zxx }
-->
</style>
</body>
</html>