[update] What is happening at the policy group on domain name registrants data and GDPR

[farzaneh badii]

Dear all,

As a member of EPDP I would like to update you on a couple of issues and
the status of the group so far. Note that I have not consulted with other
NCSG EPDP members about this update so they can correct me if I have worded
anything wrong. But the brief is based on our interventions and
interactions on mailing lists:

**We have to comment on the initial report of the team until Monday, if
there are issues, propose changes by 9 Nov, schedule more calls if needed,
and then they will publish the initial report by Friday 16 and issue the
call for public comment on 19 Nov. I have created this link for NCSG EPDP
members to comment:**https://docs.google.com/document/d/1La0BDT4b-Roz3b4fL4vC0896h8RApgTMC-lnPRkmf7o/edit?usp=sharing
<https://docs.google.com/document/d/1La0BDT4b-Roz3b4fL4vC0896h8RApgTMC-lnPRkmf7o/edit?usp=sharing>*



1. We are preparing the first draft of ICANN's purposes for which it
collects personal and sensitive data of domain name registrants. It is
important for us to keep the purposes limited to the narrow mission of
ICANN.

2. One of ICANN purposes is to develop and implement policies
regarding *dispute
resolution of domain names* (as opposed to the use of such domain names).
This means to facilitate dispute resolution such as URS and UDRP, ICANN
processes the data.
In a rather curious approach, in the beginning of our deliberations at
EPDP, a suggestion was put forward to add the following dispute resolution
mechanisms as well: PDDRP, RRDRP   (read about them here:
https://www.icann.org/resources/pages/rpm-drp-2017-10-04-en.
Recommending these dispute resolution mechanisms be added to the purpose of
ICANN is due to very ambiguous reasons. It is not clear why it was
suggested in the beginning *(note that they were not mentioned in Temp
Spec)*
- *PDDRP*: From what I am reading of the policies the registries do not
need personal information of domain name registrants for such disputes.
PDDRP page 4, clearly says sets a couple of requirements and says
specifically complaint should have the personal info of domain name
registrant to the best of complainant knowledge. Nowhere registries are in
need of all the data elements of domain name registration to comply with
PDDRP.

- *RRDRP: The RRDRP is intended to address circumstances in which a
community-based New gTLD Registry Operator deviates from the registration
restrictions outlined in its Registry Agreement.*

*https://www.icann.org/resources/pages/rrdrp-2014-01-09-en
<https://www.icann.org/resources/pages/rrdrp-2014-01-09-en>*

This dispute resolution mechanism is about registries that for example are
for a specific community. .LAW might only allow lawyers to register. So  if
a non lawyer has registered a .law domain name or there is systematic
abuse, the registry can be challenged.

But nowhere in the RRDRP procedure, it states that the "registry" has to
process the Registration Data for the purpose of RRDRP. Page 5 and 6 of the
procedure(find the procedure on the above link) does not say anything about
that. One reason to add this might be for registrars to transfer the data
to registries. If you look at page 7 of the RRDRP procedure (response that
registry should provide) nowhere WHOIS data elements are even mentioned.
 *Also note that "As of 17 July 2018 there have been no RRDRP *cases."
https://www.icann.org/resources/pages/cct-metrics-rpm-2016-06-27-en

3. Distinguishing between legal and natural domain name registrants: we
have taken the stance that there should be no distinction because data of
organizations can also be sensitive and should not be exposed to the whole
world.

4. Publication of geographic location should not be mandatory

5.  Maintaining the security, stability and resiliency of the Domain Name
System in accordance with ICANN’s mission through the enabling of lawful
access for legitimate third-party interests to data elements collected for
other purposes identified herein; [sent a separate email]






































Farzaneh
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ncsg.is/pipermail/ncsg-discuss/attachments/20181104/9f5b9761/attachment.htm>