Some update on EPDP work /Privacy in WHOIS

[Ayden Férdeline]

Hi James,

For purpose 2, the EPDP team has completed four lawfulness of processing tests, one for each of the following activities:

- collection of registration data
- transfer of registration data from registrar to registry
- disclosure of non-public registration data to third parties
- retention of registration data by registrar

In the case of the disclosure of registration data to third parties, we are not relying on consent, therefore Article 7 does not apply. We have assessed this as being a 6(1)(f) (legitimate interest) processing activity. However, in recognition of the fact that such a disclosure is not technically necessary to perform the registration contract between the registrant and registrar, the contracted party would still need to perform the requisite balancing test to ensure the third party's legitimate interests override the fundamental rights and freedoms of the data subject, before registration data is disclosed.

Best wishes,

Ayden

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Sunday, February 3, 2019 4:08 AM, James Gannon <james at CYBERINVASION.NET> wrote:

> Would love to know how purpose 2 is defined on a legal basis and also how it complies with Art 7 section 4.
>
>> On 3 Feb 2019, at 09:45, farzaneh badii <farzaneh.badii at gmail.com> wrote:
>>
>> Our update on EPDP work is overdue, so I thought I write my thoughts and report a bit on the developments, and others from EPDP team can chime in if they think I got something wrong.
>>
>> where we are at:
>> we are now finalizing the preliminary report and need to come to a consensus quickly and send the report off to the council for approval. So pressure is high. We have to come up with an interim policy plan  to cover the gap between implementation and approval of the recs.
>>
>> Our principles:
>> - Maximum data protection for domain name registrants globally
>> - Accountable disclosure and accountable receipt  of domain name registrants personal info
>> - Side with providing data protection when in doubt whether GDPR applies
>> - Keep ICANN's mission limited
>>
>> I have attached a PDF with markation of what we have problems with or doubts for the moment. I am still working on it but it's attached.
>>
>>  Purposes for domain name registrants data processing -
>>
>> - Purpose 1. To establish registrants rights (generally is a good purpose, in favor of registrants). Note that some would like to add the word obligation of domain name registrants to this purpose which we have resisted and argued that if they want to do that they need a standalone purpose.
>> - Contributing to the maintenance of SSR through disclosure to lawful requests: we initially opposed this purpose because it's not a purpose for data processing. you don't collect data to disclose it later to third parties. Now the purpose has canged to: "Contributing to the maintenance of the security, stability, and  resiliency of theDomain Name System in accordance with ICANN’s mission through enabling responses to lawful data disclosure requests." This is not a bad compromise. But the footnotes are not very helpful. The first footnote says that this purpose does not preclude IP based requests. Though this was a compromise makes me very worried. We have always said that SSR does not include IP issues and this footnote can make it easier to include IP in SSR in the future. My solution would be to re-word this and say: This purpose does not preclude lawful disclosure for non-SSR issues i.e. trademark infringement (in accordance with ICANN bylaws). The details of the disclosure will be discussed in phase two.
>>
>> What we have achieved so far (relatively):
>> 1. there might be no differentiation between legal and natural persons
>> 2.Tech admin contact might become optional
>> 3. There might be no differentiation in treating domain name registrants based on their geographical location
>> 4. Thin registries might not have to implement thick registries policy (unsure about that, please correct me if I am wrong)
>>
>> Farzaneh
>> <EPDP Team Draft Final Report - Annotated.pdf>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ncsg.is/pipermail/ncsg-discuss/attachments/20190203/4360c354/attachment.htm>