<div dir="ltr"><div><br></div><div>Just checking that I sent directly to Milton. Now sharing on the list </div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">---------- Forwarded message ---------<br>From: <strong class="gmail_sendername" dir="auto">Akinremi Peter Taiwo</strong> <span dir="auto"><<a href="mailto:compsoftnet@gmail.com">compsoftnet@gmail.com</a>></span><br>Date: Tue, Apr 27, 2021 at 11:05 AM<br>Subject: Re: [NCSG-PC] EPDP policy issues<br>To: Mueller, Milton L <<a href="mailto:milton@gatech.edu">milton@gatech.edu</a>><br></div><br><br><div dir="ltr"><p class="MsoNormal" style="margin:0in;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:"Times New Roman",serif"><br></span></p><p class="MsoNormal" style="margin:0in;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:"Times New Roman",serif">Thanks to the EPDP team especially Milton and Stephanie for
bringing this issue to the members attention. As said by Tatiana, we are all
aware of natural and legal debate especially for those that have been following
the EPDP conversations. While there is no one size fit answer to address the
issues of natural vs legal privacy protection, NCSG should have a position that
is driven by consensus. </span></p>
<p class="MsoNormal" style="margin:0in;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:"Times New Roman",serif">While thanking the EPDP team that represents NCSG, it is
expected of the team to have discussed among themselves having a common
approach feeding to the EPDP conversations rather than having our members
openly disagreeing with each other. That could be done on our list to help us have
a common ground, but not on other working groups where we are nominated to represent
NCSG. </span></p>
<p class="MsoNormal" style="margin:0in;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:"Times New Roman",serif"> </span></p>
<p class="MsoNormal" style="margin:0in;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:"Times New Roman",serif">Our position on the natural and legal persons privacy conversation
should be driven by the core values of NCSG. We need long standing members of
the NCSG to comment and other experts for us to determine NCSG position to the
current EPDP discussions. PC should take this seriously and explore what is
best for the people we represent and not what individuals think is best.</span></p><p class="MsoNormal" style="margin:0in;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:"Times New Roman",serif"><br></span></p>
<p class="MsoNormal" style="margin:0in;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:"Times New Roman",serif">Registrants’
information should be protected and any opportunity for its exploitation should
not be allowed nor granted. Whatever mechanism that is in discussion should
have privacy by design and default. That should apply to either natural or
legal persons. Registrants PII should not be published and should not fall into
wrong hands and its usage. Registrants who are the data subjects (individual,
employees) should be in control, have their privacy respected and preserved,
and should decide how their data is processed. Registrars should not be given
the privilege to decide for the registrants or influence data subjects' decisions on how their data is processed. </span></p>
<p class="MsoNormal" style="margin:0in;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:"Times New Roman",serif"> </span></p>
<p class="MsoNormal" style="margin:0in;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:"Times New Roman",serif">Our concern should
be that registrants’ information is not publicly published which is the current
reflection of whois directory. Whois directory should not be abused. NCSG should not be cut in the web of these
discussions but should have a firm positioned on the privacy rights of the registrants.
Influence is on the increase on what the whois should contain and not. Why the
growing interest by the CPs differentiating natural and legal persons? what
will happen in the years to come if that is done? </span></p><p class="MsoNormal" style="margin:0in;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:"Times New Roman",serif"><br></span></p><p class="MsoNormal" style="margin:0in;line-height:normal"><font face="Times New Roman, serif"><span style="font-size:16px">My thoughts !</span></font></p><p class="MsoNormal" style="margin:0in;line-height:normal"><font face="Times New Roman, serif"><span style="font-size:16px"><br></span></font></p><p class="MsoNormal" style="margin:0in;line-height:normal"><font face="Times New Roman, serif"><span style="font-size:16px"><br></span></font></p></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Apr 24, 2021 at 10:45 PM Mueller, Milton L <<a href="mailto:milton@gatech.edu" target="_blank">milton@gatech.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div>
<p class="MsoNormal">Dear Noncommercials,<u></u><u></u></p>
<p class="MsoNormal">I am one of your representatives of the EPDP, and ICANN working group that is trying to bring ICANN’s Whois policy into compliance with privacy principles.
<u></u><u></u></p>
<p class="MsoNormal">Just yesterday we received this statement from the current chair of the group, Keith Drazek:<u></u><u></u></p>
<p style="margin-right:0in;margin-left:0.25in;margin-bottom:0.0001pt;vertical-align:baseline">
<span style="font-size:7pt"> </span><span style="font-size:6pt;font-family:Calibri,sans-serif">
</span><span style="font-size:11pt;font-family:Calibri,sans-serif">The EPDP Team is a representative group – you have all been appointed by your respective groups to represent them in this effort. As a result, any proposals and interventions you make are
expected to be on behalf of your group. We understand that this requires significant coordination which is not always possible in real-time but it is important that we do not find ourselves in a situation where a specific proposal or suggestion is debated
to then find that other members of the same group do not stand behind the proposal or suggestion. <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt"><u></u> <u></u></span></p>
<p class="MsoNormal">I suspect Keith found it necessary to say this because lately another NCSG representative on the EPDP, Stephanie, and I have been openly disagreeing. Let me explain what the disagreement is about. We will have to appeal to the Policy Committee,
and the membership, to help resolve it. <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Privacy protections under the GDPR only apply to natural persons, that is to say living breathing humans, not to legal persons, i.e. corporations or companies. And in most cases, we do not mind if company data is published in their domain
record. In many cases it can even help with economic and legal accountability. However, we both recognize that there is a large gray area of small companies or home offices where the line between personal and legal is thin, blurry or nonexistent. A registrant
that is formally a legal person may want the privacy protection of a natural person.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">One of the issues we are dealing with in Phase 2 is whether and how registrars should differentiate between those two types of registrants. Under the current Phase 1 agreement, contracted parties are not required to differentiate between
registrants who are legal or natural persons, but they can do so if they wish to. I believe both Stephanie and I (and the contracted parties) agree on NOT requiring them to differentiate.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">But if registrars DO choose to differentiate, we have to worry about HOW they do it. Currently, the EPDP is working on a guidance document that will set out ways to do it. I want to make sure that the guidance protects the rights of registrants.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">My position is that registrants should be given a clear choice to self-designate as a legal person or not. When given that choice, they must be clearly told that their data will be published, and if they don’t want the data published, they
should not self-designate as a legal person. Under my view, the registrant, and the registrant alone, should decide for themselves whether to declare as legal person or not.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Stephanie’s position is that registrants are not smart enough to make this choice for themselves. Worse, her belief that registrants cannot look out for their own interests makes her in favor of the idea that REGISTRARS should be able to
make the choice for them. In other words, a commercial registrar, based on their own information about you, could decide that you are registering a domain name on behalf of a company and classify you as a legal person without your participation or consent.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">In my view, this is a very bad idea, even a dangerous one. It makes the registrar responsible for verifying certain aspects of your identity. We already know that those who want more surveillance and control of registrants want registrars
to be more restrictive and take on a bigger role vetting who is registering domains. This idea is also very bad for the registrars, because if a registrar is making the decision about whether you are a legal or natural person, then the registrar will be legally
liable for the decision. Further down the road, those who want a more restrictive internet will love the precedent set, they will ask the registrars to do more and more to vet and regulate their customers.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I believe that Stephanie has good motives for her position; as I understand it she thinks that if registrars have this ability to decide for the registrant, they will err on the side of non-disclosure. But this is very naïve. Yes, some
of the registrars we are dealing with in EPDP are sincere supporters of their customers privacy. But others are not. Further, Stephanie is forgetting about the fact that many registrars are operating in authoritarian countries where individual rights are not
respected. I am also deeply troubled by a position that registrants are children who cannot take care of themselves. I think Stephanie’s position is also motivated by the view that we are better off if there is no differentiation at all. This may be true,
but it is unrealistic. The default policy, ALREADY, is that registrars will be able to differentiate if they want to. I am trying to plan for the possibility that many of them will want to. If they do, we want registrants to be in control of their status,
not registrars or any other third party allegedly acting on their behalf.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">My hope is that the membership and the PC will resolve this issue in favor of the “registrant in control” position.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Sorry for the long message<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Dr. Milton L Mueller<u></u><u></u></p>
<p class="MsoNormal">Georgia Institute of Technology<u></u><u></u></p>
<p class="MsoNormal">School of Public Policy<u></u><u></u></p>
<p class="MsoNormal"><img width="196" height="79" style="width:2.0416in;height:0.8194in" id="m_1660625141626719061gmail-m_3859472474802514140Picture_x0020_1" src="cid:17912c5a3585b16b21" alt="IGP_logo_gold block"><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
_______________________________________________<br>
NCSG-PC mailing list<br>
<a href="mailto:NCSG-PC@lists.ncsg.is" target="_blank">NCSG-PC@lists.ncsg.is</a><br>
<a href="https://lists.ncsg.is/mailman/listinfo/ncsg-pc" rel="noreferrer" target="_blank">https://lists.ncsg.is/mailman/listinfo/ncsg-pc</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><font face="arial, sans-serif" color="#000000">Best regards</font></div><div><font face="arial, sans-serif" color="#000000"><br></font></div><div dir="ltr"><font face="arial, sans-serif" color="#666666"><b>Taiwo Peter Akinremi</b></font></div><div dir="ltr"><font color="#999999" face="arial, sans-serif">------ ------ ------- </font><span style="color:rgb(153,153,153);font-family:arial,sans-serif">------ ------ ------- </span><span style="color:rgb(153,153,153);font-family:arial,sans-serif">------ ------ ------- </span><span style="color:rgb(153,153,153);font-family:arial,sans-serif">------ ------ ------- </span><span style="color:rgb(153,153,153);font-family:arial,sans-serif">------ ------ ------</span><font color="#999999" face="arial, sans-serif"><br></font><div><font face="arial, sans-serif" size="1"> IT Manager/Advisory</font></div><div><font size="1"><span style="font-family:arial,sans-serif"><b>Phone</b>; +2348187476292, +2347063830177 <b>Skype</b>: <span><span><span>akinremi</span></span></span><span><span><span>.</span></span></span><span><span><span>taiwo</span></span></span></span><font face="arial, sans-serif"><br></font></font></div><div><div><font face="arial, sans-serif" size="1"><b>Email:</b> <a href="mailto:info@compsoftnet.com.ng" target="_blank">info@compsoftnet.com.ng</a> <b>Website:</b> </font><a href="http://www.compsoftnet.com.ng" style="font-family:arial,sans-serif" target="_blank"><font size="1">www.compsoftnet.com.ng</font></a></div><div>___________________________________________</div></div></div></div></div></div></div></div></div></div>
</div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><font face="arial, sans-serif" color="#000000">Best regards</font></div><div><font face="arial, sans-serif" color="#000000"><br></font></div><div dir="ltr"><font face="arial, sans-serif" color="#666666"><b>Taiwo Peter Akinremi</b></font></div><div dir="ltr"><font color="#999999" face="arial, sans-serif">------ ------ ------- </font><span style="color:rgb(153,153,153);font-family:arial,sans-serif">------ ------ ------- </span><span style="color:rgb(153,153,153);font-family:arial,sans-serif">------ ------ ------- </span><span style="color:rgb(153,153,153);font-family:arial,sans-serif">------ ------ ------- </span><span style="color:rgb(153,153,153);font-family:arial,sans-serif">------ ------ ------</span><font color="#999999" face="arial, sans-serif"><br></font><div><font face="arial, sans-serif" size="1"> IT Manager/Advisory</font></div><div><font size="1"><span style="font-family:arial,sans-serif"><b>Phone</b>; +2348187476292, +2347063830177 <b>Skype</b>: <span><span><span>akinremi</span></span></span><span><span><span>.</span></span></span><span><span><span>taiwo</span></span></span></span><font face="arial, sans-serif"><br></font></font></div><div><div><font face="arial, sans-serif" size="1"><b>Email:</b> <a href="mailto:info@compsoftnet.com.ng" target="_blank">info@compsoftnet.com.ng</a> <b>Website:</b> </font><a href="http://www.compsoftnet.com.ng" style="font-family:arial,sans-serif" target="_blank"><font size="1">www.compsoftnet.com.ng</font></a></div><div>___________________________________________</div></div></div></div></div></div></div></div></div></div></div>