<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p>thanks Tapani, I think you have put your finger on the
fundamental "disagreement" here between myself and Milton. I
certainly, as I have said, do not endorse the registrars using
this "designation" as legal or natural as an excuse to release
more personal data. Milton is worried about that, and he is quite
right to worry about it. <br>
</p>
<p>In an effort to simplify the reams of material that have appeared
both on this list and in the discussions on the EPDP list, chats
and skype channels, Kathy Kleiman and I came up with this
relatively short statement after Volker read into the record last
Thursday, the position of the registrars. Here it is, I hope
folks agree with us:</p>
<p>
</p>
<p class="MsoNormal"><span lang="EN-US">Fellow NCSG members, </span></p>
<p class="MsoNormal"><span lang="EN-US">We would like to work
together to share our
rationale for Option 1 – maintaining the status quo and not
asking further follow-up
questions, mandatory or otherwise, about legal and natural
persons. While the
EPDP phase 2a discussions have been an educational and
interesting exercise, we
are not under any obligation to change the existing policy, or
further
complicate it.</span></p>
<p class="MsoNormal"><span lang="EN-US">As we have all discussed,
legal/natural person
questions<i style="mso-bidi-font-style:normal"> are very
complicated for many
of our members</i> who are often noncommercial and non-profit
organizations whose
structure and ways of obtaining domain names do not resemble
those of the large
corporations other stakeholder groups represent. Our members may
have many
layers of privacy protection in less-well-known sections of the
GDPR, other
local law, Constitutions and international conventions.<span style="mso-spacerun:yes"> </span></span></p>
<p class="MsoNormal"><span lang="EN-US">We learned that recent
studies show that
50% of gTLD domain name registrations are for natural persons –
and at least 25%
more have overlapping entity and personal data (e.g., the
organization name has
personal data in it and is thus protected as personal data).<span style="mso-spacerun:yes"> </span></span></p>
<p class="MsoNormal"><span lang="EN-US">Stephanie and Kathy shared
their concerns
for legal/natural person questions during our long work on the
Proxy and
Privacy<span style="mso-spacerun:yes"> </span>Accreditation
Working Group.<span style="mso-spacerun:yes"> </span><span style="mso-spacerun:yes"> </span>We
worked closely with the Registrars Stakeholder Group to protect
registrant
privacy – including Battered Women’s Shelters, family planning
clinics, and
girls educational institutions – all of which may be legal
entities, but have protectable
data due to obvious danger from disclosure in certain countries.<span style="mso-spacerun:yes"> </span><span style="mso-spacerun:yes"> </span></span></p>
<p class="MsoNormal"><b style="mso-bidi-font-weight:normal"><i style="mso-bidi-font-style:
normal"><span lang="EN-US">In light of the complicated world
around us, we
support Option 1- the Status Quo.</span></i></b><span lang="EN-US"><span style="mso-spacerun:yes"> </span>We ask the
NCSG to adopt this as our stance. <span style="mso-spacerun:yes"> </span><b style="mso-bidi-font-weight:normal">Based
on the existing policy which makes differentiation of
legal/natural persons
optional for each registrar, we believe we already have the </b></span></p>
<p class="MsoListParagraphCxSpFirst" style="text-indent:-18.0pt;mso-list:l0 level1 lfo1"><span style="mso-ascii-font-family:Calibri;mso-fareast-font-family:Calibri;
mso-hansi-font-family:Calibri;mso-bidi-font-family:Calibri" lang="EN-US"><span style="mso-list:Ignore">-<span style="font:7.0pt "Times New Roman"">
</span></span></span><b style="mso-bidi-font-weight:normal"><span lang="EN-US">best way to fight DNS Abuse, </span></b></p>
<p class="MsoListParagraphCxSpMiddle" style="text-indent:-18.0pt;mso-list:l0 level1 lfo1"><span style="mso-ascii-font-family:Calibri;mso-fareast-font-family:Calibri;
mso-hansi-font-family:Calibri;mso-bidi-font-family:Calibri" lang="EN-US"><span style="mso-list:Ignore">-<span style="font:7.0pt "Times New Roman"">
</span></span></span><b style="mso-bidi-font-weight:normal"><span lang="EN-US">best way to protect individuals and noncommercial
organizations, and
</span></b></p>
<p class="MsoListParagraphCxSpLast" style="text-indent:-18.0pt;mso-list:l0 level1 lfo1"><span style="mso-ascii-font-family:Calibri;mso-fareast-font-family:Calibri;
mso-hansi-font-family:Calibri;mso-bidi-font-family:Calibri" lang="EN-US"><span style="mso-list:Ignore">-<span style="font:7.0pt "Times New Roman"">
</span></span></span><b style="mso-bidi-font-weight:normal"><span lang="EN-US">best way to follow GDPR and other applicable
human rights and free
speech laws </span></b></p>
<p class="MsoNormal" style="margin-left:36.0pt"><b style="mso-bidi-font-weight:
normal"><i style="mso-bidi-font-style:normal"><span lang="EN-US">Therefore,
we
recommend NCSG “hold the line” and stick with Option 1. </span></i></b></p>
<p class="MsoNormal"><i style="mso-bidi-font-style:normal"><span lang="EN-US">As
the Registrars wrote in their EPDP Statement on Thursday April
29: <b style="mso-bidi-font-weight:normal">We have heard
plenty of vocal support in
this group to <span style="mso-spacerun:yes"> </span>[differentiate
between
legal and natural persons in a mandatory fashion], but to
date the RrSG have
not heard any compelling reason to create policy that makes
this dramatic shift
to the domain registration landscape.</b></span></i></p>
<p class="MsoNormal"><b style="mso-bidi-font-weight:normal"><span lang="EN-US">We
agree.</span></b><span lang="EN-US"><span style="mso-spacerun:yes">
</span>Nothing will stop other stakeholder groups from demanding
further
disclosure of data, and lobbying other parties including
governments. <b style="mso-bidi-font-weight:normal">What we can
do in ICANN is come up with the
best solution for us at this time.</b></span></p>
<p class="MsoNormal"><span lang="EN-US">Many thanks to the members
of our NCSG EPDP
Team for your hard work. This has been a long road.<span style="mso-spacerun:yes"> </span>With new studies, new
information and legal
opinions, we think we have a clear and strategic path forward.<span style="mso-spacerun:yes"> </span>We believe our position to
be closely aligned
with that of the Registrar Stakeholder Group, which they
articulated on April
29 (see below).</span></p>
<div style="mso-element:para-border-div;border:none;border-bottom:solid
windowtext 1.0pt;
mso-border-bottom-alt:solid windowtext .75pt;padding:0cm 0cm 1.0pt
0cm">
<p class="MsoNormal" style="border:none;mso-border-bottom-alt:solid windowtext .75pt;
padding:0cm;mso-padding-alt:0cm 0cm 1.0pt 0cm"><span lang="EN-US">Best, Kathy Kleiman
and Stephanie Perrin</span></p>
</div>
<p class="MsoNormal"><b style="mso-bidi-font-weight:normal"><i style="mso-bidi-font-style:
normal"><span lang="EN-US">The Registrar Stakeholder Group
issued their position
statement on Thursday (4/29):</span></i></b></p>
<p class="MsoNormal"><i style="mso-bidi-font-style:normal"><span lang="EN-US">The
members of the RrSG EPDP team have participated in this
process in good faith
since day one and will continue to do so; however, we need to
be crystal clear
that members of our Stakeholder Group, whom we are here to
represent, have
voiced and recently reconfirmed their strong opposition to any
policy coming
out of this group that makes differentiation between natural
and legal persons
for domain registrations mandatory.</span></i></p>
<p class="MsoNormal"><i style="mso-bidi-font-style:normal"><span lang="EN-US"> </span></i></p>
<p class="MsoNormal"><i style="mso-bidi-font-style:normal"><span lang="EN-US">We
have heard plenty of vocal support in this group to do just
that, but to date
the RrSG have not heard any compelling reason to create policy
that makes this
dramatic shift to the domain registration landscape. The
Contracted Party can
make the most accurate assessment of their own legal,
technical, and commercial
risks and obligations, and is the only party that can
determine what level of
risk they should assume. The scope of this EPDP Phase 2a is to
consider if changes
are required for the relevant Recommendation; it has become
clear through this
process that no such changes are required</span></i></p>
<p class="MsoNormal"><i style="mso-bidi-font-style:normal"><span lang="EN-US"> </span></i></p>
<p class="MsoNormal"><i style="mso-bidi-font-style:normal"><span lang="EN-US">To
the extent this group can focus its energies on guidance to
contracted parties
which choose on their own to make this differentiation, we
continue to believe
that is a worthwhile exercise. We believe that guidance
materials including
educational information provided by ICANN in multiple
languages would help
contracted parties educate registrants and this would be a
valuable effort.</span></i></p>
<p class="MsoNormal"><i style="mso-bidi-font-style:normal"><span lang="EN-US"> </span></i></p>
<p class="MsoNormal"><i style="mso-bidi-font-style:normal"><span lang="EN-US">That
said, based on analysis done by our stakeholder group's
members, we reject the
notion that the majority of registered domain names are
registered to legal
entities. We further remind this team that we have not yet
seen evidence that
increased publication of registration data will address any of
the problems
which have been mentioned so far in this phase, and that the
registration data
is reliably and promptly available to those who do have a
legitimate reason to
access it.</span></i></p>
<p class="MsoNormal"><i style="mso-bidi-font-style:normal"><span lang="EN-US"> </span></i></p>
<p class="MsoNormal"><i style="mso-bidi-font-style:normal"><span lang="EN-US">Finally
we note that this statement represents the official position
of the Registrar
Stakeholder group, and statements from members of other groups
participating in
the EPDP do not represent our group’s position.</span></i></p>
<p class="MsoNormal"><i style="mso-bidi-font-style:normal"><span lang="EN-US">(Source:
Transcript of EPDP-Phase 2A Team Call, 29 April 2021,
Statement of Volker
Greimann on behalf of the Registrars Stakeholder Group read
into the record)</span></i></p>
<p class="MsoNormal"><span lang="EN-US">___________</span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p>
<style>@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;
mso-font-charset:77;
mso-generic-font-family:decorative;
mso-font-pitch:variable;
mso-font-signature:3 0 0 0 -2147483647 0;}@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;
mso-font-charset:0;
mso-generic-font-family:roman;
mso-font-pitch:variable;
mso-font-signature:3 0 0 0 1 0;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;
mso-font-charset:0;
mso-generic-font-family:swiss;
mso-font-pitch:variable;
mso-font-signature:-469750017 -1073732485 9 0 511 0;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{mso-style-unhide:no;
mso-style-qformat:yes;
mso-style-parent:"";
margin-top:0cm;
margin-right:0cm;
margin-bottom:8.0pt;
margin-left:0cm;
line-height:107%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:Calibri;
mso-fareast-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;
mso-ansi-language:EN-US;}p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
mso-style-unhide:no;
mso-style-qformat:yes;
margin-top:0cm;
margin-right:0cm;
margin-bottom:8.0pt;
margin-left:36.0pt;
mso-add-space:auto;
line-height:107%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:Calibri;
mso-fareast-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;
mso-ansi-language:EN-US;}p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst
{mso-style-priority:34;
mso-style-unhide:no;
mso-style-qformat:yes;
mso-style-type:export-only;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
mso-add-space:auto;
line-height:107%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:Calibri;
mso-fareast-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;
mso-ansi-language:EN-US;}p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle
{mso-style-priority:34;
mso-style-unhide:no;
mso-style-qformat:yes;
mso-style-type:export-only;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
mso-add-space:auto;
line-height:107%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:Calibri;
mso-fareast-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;
mso-ansi-language:EN-US;}p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast
{mso-style-priority:34;
mso-style-unhide:no;
mso-style-qformat:yes;
mso-style-type:export-only;
margin-top:0cm;
margin-right:0cm;
margin-bottom:8.0pt;
margin-left:36.0pt;
mso-add-space:auto;
line-height:107%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:Calibri;
mso-fareast-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;
mso-ansi-language:EN-US;}.MsoChpDefault
{mso-style-type:export-only;
mso-default-props:yes;
font-size:11.0pt;
mso-ansi-font-size:11.0pt;
mso-bidi-font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:Calibri;
mso-fareast-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;
mso-ansi-language:EN-US;}.MsoPapDefault
{mso-style-type:export-only;
margin-bottom:8.0pt;
line-height:107%;}div.WordSection1
{page:WordSection1;}ol
{margin-bottom:0cm;}ul
{margin-bottom:0cm;}</style></p>
<p><br>
</p>
<div class="moz-cite-prefix">On 2021-05-04 12:34 a.m., Tapani
Tarvainen wrote:<br>
</div>
<blockquote type="cite" cite="mid:20210504043414.GA124098@vesikko.tarvainen.info">
<pre class="moz-quote-pre" wrap="">EXTERNAL EMAIL:
On Sun, Apr 25, 2021 at 07:54:43PM +0000, Mueller, Milton L (<a class="moz-txt-link-abbreviated" href="mailto:milton@GATECH.EDU">milton@GATECH.EDU</a>) wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">The one thing I want to prevent when it comes to legal and natural
distinction is to enable some stakeholders to use the distinction as
an excuse for making more registrants data public and accessible.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Entering this discussion a bit late, having read the long thread,
I find myself in perfect agreement with Milton on that point.
Indeed the very idea that the legal vs. natural person distinction
could be used that way is fundamentally broken. It is based on a
(possibly deliberate) misreading of the GDPR.
When GDPR says it doesn't apply to legal persons, it does *not* mean
that if some data is about a legal person it follows that it isn't
personal and therefore out of scope for GDPR.
What it means is that if the data is about a legal person it does
not follow that it is personal data - but it could still be, as
Mark Leiser well explained. Same piece of data can be both about
a legal and a natural person (or several) at the same time.
But this cannot be fixed by letting registrants choose whether or not
to declare themselves as legal or natural persons, or decline to do
either. Nor does it help to let registrars determine that by other
means.
The status of some data as personal or not cannot be determined on the
basis of whether or not it is about a legal person.
It could be used as a data point, but it's really a useless one.
If we divide registrants into three categories:
(1) natural persons,
(2) legal persons whose data nonetheless is personal so
that GDPR applies and
(3) legal persons whose data is non-personal,
there's no need to distinguish between (1) and (2) and attempting to
do so will only confuse the issue. Whatever process is used to
distinguish between (2) and (3) will, if done right, automatically
take care of (1) as well.
A registrar that assumes a registrant's data is non-personal because
the registrant is a legal person will be in violation of the GDPR.
Really the only right solution is to forgo the very idea of asking
registrants if they're legal or natural persons. That distinction can
not be used in any useful way by the registrars, it can only be abused
(and almost certainly will).
I haven't followed the EPDP much so I don't know if that can still be
done there, but if not, I expect ICANN will find itself staring at the
pointy end of an EU court decision once more.
--
Tapani Tarvainen
</pre>
</blockquote>
</body>
</html>