Update from NCSG representatives on the EPDP

[Ayden Férdeline]

Dear all,

As you may be aware, the NCSG has six members and 3 alternates actively participating in the Expedited Policy Development Process on the Temporary Specification for gTLD Registration Data (EPDP) working group.

The EPDP has been tasked with determining whether the Temporary Specification for gTLD Registration Data should become a Consensus Policy as-is, or with modifications, while complying with the GDPR and other relevant privacy and data protection laws. The Temporary Specification was not developed by the community but by ICANN org in response to the GDPR, and it is what now obliges gTLD registries and registrars to redact personal information from public Whois records.

We’re sending you this update today so that you know what positions we’ve been advocating for within the EPDP, and to let you know where the EPDP is with its work.

What has been happening over the past three months:

The EPDP team has been meeting at least twice a week - often more frequently - to consider complex policy questions that have stymied the ICANN community for 20 years. We have been reviewing the Temporary Specification while creating new policy recommendations and answering our charter questions. The NCSG has had a strong attendance record with a full slate of six representatives on 26 out of our 28 calls, and we’ve been active in drafting and reviewing all of the EPDP’s outputs to date.

What happened today:

[Today the EPDP team published our Initial Report.](https://www.icann.org/public-comments/epdp-gtld-registration-data-specs-initial-2018-11-21-en) This is now open for public comment for 30 days. The NCSG will submit a formal response to this report, and you can help us draft that. But you can also submit comments in your individual capacity or encourage other organisations, like digital rights groups that you have a connection to, to comment too. Please do bring the report to the attention of any contacts you might have at other organisations.

What’s inside the report:

The Initial Report does not necessarily reflect where the EPDP Team as a whole has agreement; rather, it reflects issues that we have discussed, and where we may benefit from further community input before we take a formal consensus call.

The initial report is 130-pages long, including an executive summary which ends on page 28 of the report, and contains all the EPDP Team recommendations. It also includes a helpful overview of the EPDP Team approach to answering its Charter questions.

The rest of the report includes a more detailed description of the deliberations that have taken place, including a description of the Purposes identified by the EPDP Team for which legitimate interests exist to process gTLD Registration Data, what data elements and processing activities are involved, in addition to the lawful bases these purposes are grounded in, as well as which parties involved were identified as Data Controllers or Processors. These have formed the basis for most of the EPDP Team recommendations.

Public comments that are submitted will have real weight; so even if you support a recommendation, please do consider submitting a comment to that effect and explaining why!

Over the coming weeks as the NCSG begins to draft a comment to the Initial Report of the EPDP, we would like to hear from you as to what our positions should be. At the moment, here’s where we suggest the NCSG stands on the recommendations that have been published today:

Rec #

Description of Recommendation

Proposed NCSG position

1

List of purposes for the processing of gTLD registration data

Support purposes 1,3,4,5,6

Oppose purposes 2, 7

2

Commitment to develop policy for standardized access to non-public registration data

We can live with the current wording of this recommendation.

3

Accuracy requirements will not be affected by this policy.

Support

4

Data element collection requirements for Registrars.

Support

5

Data elements to be transferred from Registrar to Registry.

No position at this time.

6

ICANN org enters into data processing agreements with escrow providers.

Support

7

ICANN org updates contractual requirements for Registrars and Registries to transfer necessary data to ICANN Compliance when required.

Support

8

Data redaction requirements

Largely support, but organization name and city should also be redacted.

9

Registrars to provide guidance and education to registrants concerning the organization name field.

Oppose

10

Registrars must redact registrant email address, but must provide anonymized email or web form link.

Support

11

Data retention period is life of a registration plus one year.

Support

12

Reasonable access to non-public data, as per the Temp Spec, remains in place until disclosure terms solved.

Support

13

ICANN Org negotiates and enters into a Joint Controller Agreement with the Contracted Parties.

Support

14

Responsible parties and the lawful basis for their processing activities.

Support

15

Keep Temp Spec policies for URS and UDRP until they are superseded by the work of the RPMs PDP WG (if any).

Support

16

Disclosure of registrant data during a complaint

Possibly support

17

Relationship between access framework and RPMs PDP

Support

18

ICANN Org must enter into data processing agreements with dispute resolution providers.

Support

19

Requirements of the Temporary Specification are maintained in relation to the Transfer Policy until such time as these are superseded by recommendations that may come out of the Transfer Policy review.

Support

20

Encourage the GNSO Council to review the Transfer Policy in light of the GDPR.

Support

21

ICANN Org to enter into data protection agreements or Joint Controller Agreements with non-contracted party entities involved in registration data processing such as data escrow providers and EBERO providers.

Support

22

In implementing these recommendations, existing policies and procedures must be updated to ensure consistency with recommendations.

Support

The work of the EPDP team is not over. We will continue to meet twice a week to address our remaining charter questions and, come January, we’ll be reviewing the public comments submitted on the Initial Report and make progress towards our Final Report. We have a third face-to-face meeting scheduled for Toronto, Canada in January to do just that.

This will be the only opportunity that you have to formally comment on our work, so please do consider doing so.

It is not foreseen that there will be another comment window before our Final Report is taken to the GNSO Council for its consideration (tentatively on 14 February). If adopted by the GNSO Council, the GNSO will send the EPDP Team’s recommendations as GNSO recommendations to the ICANN Board for possible adoption as a Consensus Policy.

The NCSG members and alternates of the EPDP Team are, of course, available to answer any questions and/or provide further context and insight into the work that has been done in developing this report. We look forward to working with all of you over the next month to draft an NCSG response to the now open public comment period.

Kind regards,

NCSG representatives on the EPDP

Additional reading:

Public comment page: https://www.icann.org/public-comments/epdp-gtld-registration-data-specs-initial-2018-11-21-en

Direct link to the EPDP team Initial Report:

https://gnso.icann.org/sites/default/files/file/field-file-attach/epdp-gtld-registration-data-specs-initial-21nov18-en.pdf

EPDP team wiki space, with links to call transcripts and mailing list archives:

https://community.icann.org/display/EOTSFGRD/EPDP+on+the+Temporary+Specification+for+gTLD+Registration+Data

EPDP team charter:

https://community.icann.org/display/EOTSFGRD/EPDP+Team+Charter
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ncsg.is/pipermail/ncsg-discuss/attachments/20181122/3ba71f84/attachment.htm>