<html><body>
<div style="font-size: 13px; font-family: tahoma; color: rgb(0, 0, 0);
font-weight: 400; font-style: normal; background-image: none;
background-attachment: scroll; background-origin: padding-box;
background-clip: border-box; background-color: rgba(0, 0, 0, 0);
background-size: auto; background-position: 0% 0%; background-repeat: repeat
repeat;"> </div>
<div style="font-family: tahoma; color: rgb(0, 0, 0); font-size: 13px;
font-weight: 400; font-style: normal; background-image: none;
background-attachment: scroll; background-origin: padding-box;
background-clip: border-box; background-color: rgba(0, 0, 0, 0);
background-size: auto; background-position: 0% 0%; background-repeat: repeat
repeat;">
<div>Fantastic work Kathy! Surely we don’t want to introduce the
‘ICANN defense’ into the international legal vernacular
(‘Sorry your honour, ICANN made me do it!’).</div>
<div> </div>
<div>Two minor suggestions:</div>
<div> </div>
<div>1. The NCSG is much more than mere organizations; we’re also the
home of individual noncommercial users within the GNSO. Perhaps we could
reflect that in the introduction, such as:</div>
<div> </div>
<div>The Noncommercial Stakeholders Group represents noncommercial
organizations <em>and individual noncommercial users </em>in their work in
the policy and proceedings of ICANN and the GNSO.</div>
<div> </div>
<div>2. As the third “triggering event” you have, in part,
“Receipt of a written legal opinion from a nationally recognized law
firm in the applicable jurisdiction”. </div>
<div> </div>
<div>Here in the United Kingdom some of the most prominent solicitors
practicing in both the cyber and privacy realms are solo practitioners,
often practicing in combination with a part time lecturing career. Think of,
for example, Jeremy Phillips. I’d hate to give the big law firms any
advantage over the equally qualified solicitor or barrister who does not
belong to a firm. Consider, perhaps amending the statement, as such:</div>
<div> </div>
<div>Receipt of a written legal opinion from a nationally recognized law
firm <em>or qualified legal practitioner</em> in the applicable
jurisdiction.</div>
<div><br />
Thanks for considering and thanks again, Kathy, for all of this. It’s
really great work!</div>
<blockquote style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px;
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">-----Original
Message-----<br />
From: Kathy Kleiman <kathy@KATHYKLEIMAN.COM><br />
To: NCSG-DISCUSS@LISTSERV.SYR.EDU<br />
Date: Tue, 29 Jul 2014 13:44:44 -0400<br />
Subject: Draft Comments for Whois Proceeding<br />
<div style="margin-bottom: 0in; font-style: normal"><font face="Calibri,
sans-serif"><font size="4">To Rafik, NCSG Executive Committee and NCSG
Membership,</font></font></div>
<div style="margin-bottom: 0in; font-style: normal"><font face="Calibri,
sans-serif"><font size="4">There is an important, but very quiet comment
proceeding that has been taking place this summer. It is the </font></font>
<font face="Calibri,
sans-serif"><font size="4"><i>Review of the ICANN Procedure for
Handling WHOIS Conflicts with Privacy Law</i></font></font><font
face="Calibri,
sans-serif"><font size="4"><i> </i>at <i><a
href="https://www.icann.org/public-comments/whois-conflicts-procedure-2014-05-22-en">
https://www.icann.org/public-comments/whois-conflicts-procedure-2014-05-22-en</a>
</i></font></font></div>
<div style="margin-bottom: 0in">Stephanie put out a call for comments, and
not seeing any, I drafted these. It has been dismayeding ever since
ICANN adopted its Consensus Procedure for Handling WHOIS Conflicts with
Privacy law -- because it basically requires that Registrars and Registries
have to be sued or receive an official notice of violation before they can
ask ICANN for a waiver of the Whois requirements. That always seemed very
unfair- that you have to be exposed to allegation of illegal activity in
order to protect yourself or your Registrants under your national data
protection and privacy laws.</div>
<div style="margin-bottom: 0in">In the more recent Data Retention
Specification, of the 2013 RAA, ICANN Staff and Lawyers saw this problem and
corrected it -- now Registrars can be much more pro-active in showing ICANN
that a certain clause in their contract (e.g., extended data retention) is a
clear violation of their national law (e.g., more limited data
retention).</div>
<div style="margin-bottom: 0in; font-style: normal"><font face="Calibri,
sans-serif"><font size="4">So to this important comment proceeding, I
drafted these comments for us to submit. As Reply Comments (during the Reply
Period), we are asked to respond to other commenters. That's easy as the
European Commission and Registrar Blacknight submitted useful comments.
</font></font></div>
<div style="margin-bottom: 0in; font-style: normal"><font face="Calibri,
sans-serif"><font size="4">Rafik, can we edit, finalize and submit by the
deadline on Friday? Comments below and attached. If you have edits, in
the interest of time, kindly suggest alternate language. Tx!!</font></font>
</div>
<div style="margin-bottom: 0in; font-style: normal"><font face="Calibri,
sans-serif"><font size="4">Best,<br />
Kathy<br />
--------------------------------------------------------------------------------------------------------</font>
</font></div>
<div style="margin-bottom: 0in; font-style: normal">
<style type="text/css"><!--
@page { margin: 0.79in }
P { margin-bottom: 0.08in }
A:link { so-language: zxx }
-->
</style>
</div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">DRAFT NCSG Response to the Questions of the </font></font></div>
<font face="Calibri, sans-serif"><font size="4"><i>Review of the ICANN
Procedure for Handling WHOIS Conflicts with Privacy Law</i></font></font><br
/>
<font face="Calibri,
sans-serif"><font size="4"><i><a
href="https://www.icann.org/public-comments/whois-conflicts-procedure-2014-05-22-en">
https://www.icann.org/public-comments/whois-conflicts-procedure-2014-05-22-en</a>
</i></font></font>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4"><b>Introduction</b></font></font></div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">The Noncommercial Stakeholders Group represents noncommercial
organizations in their work in the policy and proceedings of ICANN and the
GNSO. We respectfully submit as an opening premise that every legal business
has the right and obligation to operate within the bounds and limits of its
national laws and regulations. No legal business establishes itself to
violate the law; and to do so is an invitation to civil and criminal
penalties. ICANN Registries and Registrars are no different – they
want and need to abide by their laws. </font></font></div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">Thus, it is timely for ICANN to raise the questions of this
proceeding, </font></font><font face="Calibri, sans-serif"><font size="4"><i>
Review of the ICANN Procedure for Handling WHOIS Conflicts with Privacy
Law</i></font></font><font face="Calibri,
sans-serif"><font size="4"> (albeit at a busy time for the
Community and at the height of summer; we expect to see more interest in
this time towards the Fall). We submit these comments in response to the
issues raises and the questions asked. </font></font></div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4"><b>Background</b></font></font></div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">The </font></font><font face="Calibri, sans-serif"><font size="4">
<i>ICANN Procedure for Handling Whois Conflicts with Privacy Law </i></font>
</font><font face="Calibri, sans-serif"><font size="4">was adopted in 2006
after years of debate on Whois issues. This Consensus Procedure was the
first step of recognition that data protection laws and privacy law DO apply
to the personal and sensitive data being collected by Registries and
Registrars for the Whois database. </font></font></div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">But for those of us in the Noncommercial Users Constituency (now
part of the Noncommercial Stakeholders Group/NCSG) who helped debate, draft
and adopt this Consensus Procedure in the mid-2000s, we were always shocked
that the ICANN Community did not do more. At the time, multiple Whois Task
Forces were at work with multiple proposals which include important and
pro-active suggestions to allow Registrars and Registries to come into
compliance with their national data protection and privacy laws. </font>
</font></div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">At the time, we never expected this Consensus Procedure to be an
end itself – but the first step of many steps. It was an
“end” for too long, so we are glad the discussion is reopened
and once again we seek to allow Registrars and Registries to be in full
compliance with their national data protection and privacy laws – from
the moment they enter into their contracts with ICANN.</font></font></div>
<div style="margin-bottom: 0in"><b><font face="Calibri, sans-serif"><font
size="4">II. Data Protection and Privacy Laws – A Quick Overview of
the Principles that Protect the Personal and Sensitive Data of Individuals
and Organizations/Small Businesses </font></font></b></div>
<b> </b>
<div style="margin-left: 1.2in; margin-bottom: 0in"><font face="Calibri,
sans-serif"><font size="4"><i><b>[Stephanie, Tamir or Others with Expertise
in Canadian and European Data Protection Laws may choose to add something
here]. </b></i></font></font></div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4"><span style="font-style: normal"><span style="font-weight: normal">
III</span></span><i><b>. </b></i>Questions asked of the Community in this
Proceeding </font></font></div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">The ICANN Review Paper raised a number of excellent questions. In
keeping with the requirements of a Reply Period, these NCSG comments will
address both our comments and those comments we particularly support in this
proceeding.</font></font></div>
<ol>
<li>
<ol>
<li>
<div style="margin-bottom: 0in"><font face="Calibri,
sans-serif"><font size="4">Is it impractical for ICANN to
require that a contracted party already has litigation or a government
proceeding initiated against it prior to being able to invoke the Whois
Procedure?</font></font></div>
</li>
</ol>
</li>
</ol>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">1.1 Response: Yes, it is completely impractical (and ill-advised)
to force a company to violate a national law as a condition of complying
with that national law. Every lawyer advises businesses to comply with the
laws and regulations of their field. To do otherwise is to face fines,
penalties, loss of the business, even jail for officers and directors. Legal
business strives to be law-abiding; no officer or director wants to go to
jail for her company's violations. It is the essence of an
attorney's advice to his/her clients to fully comply with the laws and
operate clearly within the clear boundaries and limits of laws and
regulations, both national, by province or state and local. </font></font>
</div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">In these Reply Comments, we support and encourage ICANN to adopt
policies consistent with the initial comments submitted by the European
Commission: </font></font></div>
<ul>
<li>
<ul>
<li>
<div style="margin-bottom: 0in"><font face="Calibri,
sans-serif"><font size="4">that the Whois Procedure be
changed from requiring specific prosecutorial action instead to allowing
“demonstrating evidence of a potential conflict widely and e.g.
accepting information on the legislation imposing requirements that the
contractual requirements would breach as sufficient evidence.”
(European Commission comments)</font></font></div>
</li>
</ul>
</li>
</ul>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">We also agree with Blacknight:</font></font></div>
<ul>
<li>
<ul>
<li>
<div style="margin-bottom: 0in">“<font face="Calibri,
sans-serif"><font size="4">It's completely illogical for
ICANN to require that a contracting party already has litigation before they
can use a process. We would have loved to use a procedure or process to get
exemptions, but expecting us to already be litigating before we can do so
is, for lack of a better word, nuts.” (Blacknight comments in this
proceeding).</font></font></div>
</li>
</ul>
</li>
</ul>
<div style="margin-bottom: 0in"> </div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4"> 1.1a How can the triggering event be
meaningfully defined?</font></font></div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">1.1 a Response: This is an important question. Rephrased, we might
ask together – what must a Registry or Registrar show ICANN in support
of its claim that certain provisions involving Whois data violate provisions
of national data protection and privacy laws?</font></font></div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">NCSG respectfully submits that there are at least four
“triggering events” that ICANN should recognize: </font></font>
</div>
<ul>
<li>
<ul>
<li>
<div style="margin-bottom: 0in"><font face="Calibri,
sans-serif"><font size="4">Evidence from a national Data
Protection Commissioner or his/her office (or from a internationally
recognized body of national Data Protection Commissioners in a certain
region of the world, including the Article 29 Working Party that analyzes
the national data protection and privacy laws) that ICANN's contractual
obligations for Registry and/or Registrar contracts violate the data
protection laws of their country or their group of countries; </font></font>
</div>
</li>
<li>
<div style="margin-bottom: 0in"><font face="Calibri,
sans-serif"><font size="4">Evidence of legal and/or
jurisdictional conflict arising from analysis performed by ICANN's legal
department or by national legal experts hired by ICANN to evaluate the Whois
requirements of the ICANN contracts for compliance and conflicts with
national data protection laws and cross-border transfer limits) (similar to
the process we understand was undertaken for the data retention issue);
</font></font></div>
</li>
</ul>
</li>
</ul>
<div style="margin-bottom: 0in"> </div>
<ul>
<li>
<ul>
<li>
<div style="margin-bottom: 0in"><font face="Calibri,
sans-serif"><font size="4">Receipt of a written legal
opinion from a nationally recognized law firm in the applicable jurisdiction
that states that the collection, retention and/or transfer of certain Whois
data elements as required by Registrar or Registry Agreements is
“reasonably likely to violate the applicable law” of the
Registry or Registrar (per the process allowed in RAA Data Retention
Specification); or</font></font></div>
</li>
</ul>
</li>
</ul>
<div style="margin-bottom: 0in"> </div>
<ul>
<li>
<ul>
<li>
<div style="margin-bottom: 0in"><font face="Calibri,
sans-serif"><font size="4">An official opinion of any other
governmental body of competent jurisdiction providing that compliance with
the data protection requirements of the Registry/Registrar contracts
violates applicable national law (although such pro-active opinions may not
be the practice of the Data Protection Commissioner's office). </font>
</font></div>
</li>
</ul>
</li>
</ul>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">The above list draws from the comments of the European Commission,
Data Retention Specification of the 2013 Registrar Accreditation Agreement,
and sound compliance and business practices for the ICANN General
Counsel's office. </font></font></div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">We further agree with Blacknight that the requirements for
triggering any review and consideration by ICANN be: simple and
straightforward, quick and easy to access. </font></font></div>
<div style="margin-bottom: 0in"> </div>
<font face="Calibri, sans-serif"><font size="4">1.3 Are
there any components of the triggering event/notification portion of the
RAA's Data Retention waiver process that should be considered as
optional for incorporation into a modified Whois Procedure?</font></font>
<div style="margin-bottom: 0in"> </div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">1.3 Response: Absolutely, the full list in 1.1a above, together
with other constructive contributions in the Comments and Reply Comments of
this proceeding, should be strongly considered for incorporation into a
modified Whois Procedure, or simply written into the contracts of the
Registries and Registrars contractual language, or a new Annex or
Specification. </font></font></div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">We respectfully submit that the obligation of Registries and
Registrars to comply with their national laws is not a matter of
multistakeholder decision making, but a matter of law and compliance. In
this case, we wholeheartedly embrace the concept of building a process
together that will allow exceptions for data protection and privacy laws to
be adopted quickly and easily. </font></font></div>
<div style="margin-bottom: 0in"> </div>
<font face="Calibri, sans-serif"><font size="4"> 1.4
Should parties be permitted to invoke the Whois Procedure before contracting
with ICANN as a registrar or registry?</font></font>
<div style="margin-bottom: 0in"> </div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">1.4 Response: Of course, Registries and Registrars should be
allowed to invoke the Whois Procedure, or other appropriate annexes and
specifications that may be added into Registry and Registrar contracts with
ICANN. As discussed above, the right of a legal company to enter into a
legal contracts is the most basic of expectations under law.</font></font>
</div>
<div style="margin-bottom: 0in"> </div>
<font face="Calibri, sans-serif"><font size="4"> 2.1 Are
there other relevant parties who should be included in this step?</font>
</font>
<div style="margin-bottom: 0in"> </div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">2.1 Response: We agree with the EC that ICANN should be working as
closely with National Data Protection Authorities as they will allow. In
light of the overflow of work into these national commissions, and the
availability of national experts at law firms, ICANN should also turn to the
advice of private experts, such as well-respected law firms who specialize
in national data protection laws. The law firm's opinions on these
matters would help to guide ICANN's knowledge and evaluation of this
important issue. </font></font></div>
<div style="margin-bottom: 0in"> </div>
<font face="Calibri, sans-serif"><font size="4"> 3.1 How
is an agreement reached and published?</font></font>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">3.1 Response. As discussed above, compliance with national law may
not be the best matter for negotiation within a multistakeholder process. It
really should not be a chose for others to make whether you comply with your
national data protection and privacy laws. That said, the process of
refining the Consensus Procedure, and adopting new policies and procedures,
or simply putting new contract provisions, annexes or specifications into
the Registry and Registrar contracts SHOULD be subject to community
discussion, notification and review. But once the new process is adopted, we
think the new changes, variations, modifications or exceptions of Individual
Registries and Registrars need go through a public review and process. The
results, however, Should be published for Community notification and review.
</font></font></div>
<div style="margin-bottom: 0in"> </div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">We note that in conducting the discussion with the Community on the
overall or general procedure, policy or contractual changes, ICANN should be
assertive in its outreach to the Data Protection Commissioners. Individual
and through their organizations, they have offered to help ICANN evaluate
this issue numerous times. The Whois Review Team noted the inability of many
external bodies to monitor ICANN regularly, but the need for outreach to
them by ICANN staff nonetheless: </font></font></div>
<div style="margin-bottom: 0in"> </div>
<div style="margin-left: 1.96in; margin-bottom: 0in"><font face="Calibri,
sans-serif"><font size="4"><b>Recommendation 3: Outreach</b></font></font>
</div>
<div style="margin-left: 1.96in; margin-bottom: 0in"><font face="Calibri,
sans-serif"><font size="4"><b>ICANN should ensure that WHOIS policy issues
are accompanied by cross-community</b></font></font></div>
<div style="margin-left: 1.96in; margin-bottom: 0in"><font face="Calibri,
sans-serif"><font size="4"><b>outreach, including outreach to the
communities outside of ICANN with a specific</b></font></font></div>
<div style="margin-left: 1.96in; margin-bottom: 0in"><font face="Calibri,
sans-serif"><font size="4"><b>interest in the issues, and an ongoing program
for consumer awareness.</b></font></font></div>
<div style="margin-bottom: 0in; font-weight: normal"><font face="Calibri,
sans-serif"><font size="4">This is a critical policy item for such outreach
and input. </font></font></div>
<div style="margin-bottom: 0in"> </div>
<font face="Calibri, sans-serif"><font size="4"> 3.2 If
there is an agreed outcome among the relevant parties, should the Board be
involved in this procedure?</font></font>
<div style="margin-bottom: 0in"> </div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">3.2 Response: Clearly, the changing of the procedure, or the
adoption of a new policy or new contractual language for Registries and
Registrars, Board oversight and review should be involved. But once the new
procedure, policy or contractual language is in place, then subsequent
individual changes, variations, modifications or exceptions should be
handled through the process and ICANN Staff – as the Data Retention
Process is handled today. </font></font></div>
<div style="margin-bottom: 0in"> </div>
<font face="Calibri, sans-serif"><font size="4">4.1 Would
it be fruitful to incorporate public comment in each of the resolution
scenarios?</font></font>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">4.1 Response: We think this question means whether there should be
public input on each and every exception? We respectfully submit that the
answer is No. Once the new policy, procedure or contractual language is
adopted, then the process should kick in and the Registrar/Registry should
be allowed to apply for the waiver, modification or revision consistent with
its data protection and privacy laws. Of course, once the waiver or
modification is granted, the decision should be matter of public record so
that other Registries and Registrars in the jurisdiction know and so that
the ICANN Community as a whole can monitor this process' implementation
and compliance.</font></font></div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">Step Five: Public notice</font></font></div>
<div style="margin-bottom: 0in"> </div>
<font face="Calibri, sans-serif"><font size="4">5.2 Is
the exemption or modification termed to the length of the agreement? Or is
it indefinite as long as the contracted party is located in the jurisdiction
in question, or so long as the applicable law is in force.</font></font>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">5.2 Response: We agree with the European Commission in its
response, “<i>By logic the exemption or modification shall be in place
as long as the party is subject to the jurisdiction in conflict with ICANN
rules. If the applicable law was to change, or the contacted party moved to
a different jurisdiction, the conditions should be reviewed to assess if the
exemption is still justified.” But provided it is the same parties,
operating under the same laws, the modification or change should continue
through the duration of the relationship between the Registry/Registrar and
ICANN. </i> </font></font></div>
<div style="margin-bottom: 0in"> </div>
<font face="Calibri, sans-serif"><font size="4"> 5.3
Should an exemption or modification based on the same laws and facts then be
granted to other affected contracted parties in the same
jurisdiction without invoking the Whois Procedure</font>
</font>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">5.3 Response. The European Commission in its comments wrote, and we
strongly agree: <i>“the same exception should apply to others in the
same jurisdiction who can demonstrate that they are in the same
situation.” </i>Further, Blacknight wrote and we support: <i>“if
ANY registrar in Germany, for example, is granted a waiver based on German
law, than ALL registrars based in Germany should receive the same
treatment.” </i><span style="font-style: normal"> Once a national data
protection or privacy law is interpreted as requiring and exemption or
modification, it should be available to all Registries/Registrars in that
country.</span></font></font></div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">Further, we recommend that ICANN should be required to notify each
gTLD Registry and Registrar in the same jurisdiction as that of the decision
so they will have notice of the change.</font></font></div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">We thank ICANN staff for holding this comment period. </font></font>
</div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">Respectfully submitted, </font></font></div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">NCSG </font></font></div>
<div style="margin-bottom: 0in"> </div>
<div style="margin-bottom: 0in"><font face="Calibri, sans-serif"><font
size="4">DRAFT </font></font></div>
<div> </div>
<style type="text/css"><!--
@page { margin: 0.79in }
P { margin-bottom: 0.08in }
A:link { so-language: zxx }
-->
</style>
</blockquote>
</div>
</body></html>