Some update on EPDP work /Privacy in WHOIS

[farzaneh badii]

Our update on EPDP work is overdue, so I thought I write my thoughts and
report a bit on the developments, and others from EPDP team can chime in if
they think I got something wrong.

*where we are at:*
we are now finalizing the preliminary report and need to come to a
consensus quickly and send the report off to the council for approval. So
pressure is high. We have to come up with an interim policy plan  to cover
the gap between implementation and approval of the recs.

*Our principles: *
- Maximum data protection for domain name registrants globally
- Accountable disclosure and accountable receipt  of domain name
registrants personal info
- Side with providing data protection when in doubt whether GDPR applies
- Keep ICANN's mission limited

I have attached a PDF with markation of what we have problems with or
doubts for the moment. I am still working on it but it's attached.

 *Purposes for domain name registrants data processing -*



   1. Purpose 1. To establish registrants rights (generally is a good
   purpose, in favor of registrants). Note that some would like to add the
   word obligation of domain name registrants to this purpose which we have
   resisted and argued that if they want to do that they need a
   standalone purpose.
   2. Contributing to the maintenance of SSR through disclosure to lawful
   requests: we initially opposed this purpose because it's not a purpose for
   data processing. you don't collect data to disclose it later to third
   parties. Now the purpose has canged to: "Contributing to the maintenance of
   the security, stability, and resiliency of theDomain Name System in
   accordance with ICANN’s mission through enabling responses to lawful data
   disclosure requests." This is not a bad compromise. But the footnotes are
   not very helpful. The first footnote says that this purpose does not
   preclude IP based requests. Though this was a compromise makes me very
   worried. We have always said that SSR does not include IP issues and this
   footnote can make it easier to include IP in SSR in the future. My solution
   would be to re-word this and say: This purpose does not preclude
   lawful disclosure for non-SSR issues i.e. trademark infringement (in
   accordance with ICANN bylaws). The details of the disclosure will be
   discussed in phase two.

What we have achieved so far (relatively):
1. there might be no differentiation between legal and natural persons
2.Tech admin contact might become optional
3. There might be no differentiation in treating domain name registrants
based on their geographical location
4. Thin registries might not have to implement thick registries policy
(unsure about that, please correct me if I am wrong)






Farzaneh
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ncsg.is/pipermail/ncsg-discuss/attachments/20190203/599b6e14/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: EPDP Team Draft Final Report - Annotated.pdf
Type: application/pdf
Size: 3940013 bytes
Desc: not available
URL: <http://lists.ncsg.is/pipermail/ncsg-discuss/attachments/20190203/599b6e14/attachment.pdf>