At-Large Workspace: Initial Report of the Expedited Policy Development Process (EPDP) on the Temporary Specification for gTLD Registration Data Team
AttachmentsPublic Comment Close | Statement | Status | Assignee(s) | Call for | Call for | Vote Open | Vote Close | Date of Submission | Staff Contact and Email | Statement Number |
|---|---|---|---|---|---|---|---|---|---|---|
|
|
|
|
Hide the information below, please click here
FINAL VERSION SUBMITTED (IF RATIFIED)
The final version to be submitted, if the draft is ratified, will be placed here by upon completion of the vote.
FINAL DRAFT VERSION TO BE VOTED UPON BY THE ALAC
The final draft version to be voted upon by the ALAC will be placed here before the vote is to begin.
DRAFT SUBMITTED FOR DISCUSSION
The first draft submitted will be placed here before the call for comments begins. The Draft should be preceded by the name of the person submitting the draft and the date/time. If, during the discussion, the draft is revised, the older version(S) should be left in place and the new version along with a header line identifying the drafter and date/time should be placed above the older version(s), separated by a Horizontal Rule (available + Insert More Content control).
Comments
Comment from Holly:
Hi Alan
For some reason, I wasn’t able to comment on the wiki. So this is what I would have said:
My one word of caution is back to first principles. WE are so focussed on the GDPR that we forget that other jurisdictions also have privacy legislation that could well oblige the registrar/reseller to not publish personal information/some personal information of the registrant. So I”d rather stay with a position that allows all registrars/resellers - in whatever jurisdiction globally - to respect their national privacy legislation - as is currently allowed under the RAA - the ability to comply with national laws. So that comes close to the view originally agreed upon as you penned it: ‘those who felt that a contracted party could decide whether to do it or not’. Perhaps reword, but accept that contracted parties may well be subject to their own privacy laws in jurisdictions outside of the EU.
Holly
My reply:
I agree that we should be drafting something more specific that just for GDPR, but we are where we are and time constraints do not give us that luxury. But local law may well be more stringent than GDPR, or less so. And ultimately local law wins. Hopefully various laws do not conflict (such as if one country were to rule that ALL registrations were to be made public).
ICANN entered into this with the intent of being 100% GDPR (or ultimately other law) compliant, but keeping as much of what we were doing before as is compliant. The draft statement is aligned with that. So yes, a contracted party MUST be able to comply with whatever laws apply. That is not their "choice". What we are talking about is whether they should be allowed to make up new rules that are not law and ICANN should simply say "sure, go ahead". THAT I feel is what we are saying no to.
Regarding "Perhaps reword, but accept that contracted parties may well be subject to their own privacy laws in jurisdictions outside of the EU.", I think that is a GREAT addition to our comment, not just for this particular question, but as an over-riding principle that we need to remember. I think there is a place to put it and I will!
Alan
I share Holly's concern even as I recognize that the ePDP WG Charter binds the team to a certain focus.
To be clear, I have no problem making it clear that all contracted parties are allowed to and indeed must follow all laws/regulations to which they are subject, and am happy to add such a statement.
The question is whether they should be able to redact virtually all information even if they are NOT subject to laws/regulations that require it.
Thanks Alan and Hadia for this intial draft, after a quick read here are 2 minor points i like to state:
item 50: I do think response is partly Yes/No(i actually do not think both should have been merge together in a question). That said, I suggest we should be more explicit about billing contact by stating clearly that they should remain none-public. I don't think the last part is necessary (to say ALAC has not idea of what a billing contact is used for is strange, if not for anything a typical registrant would know its used for payment).
item 70: I indeed agree with the rationale
item 77: I think its not just "displaying" that the question was referring to. The process of identification goes beyond just display, so while i agree with the intent of our text in leaving it to the registrant to decide, i suggest that we use the actual wording intended in the original question which is identification.
Seun thanks for taking the time to do this!
Q 50: I agree neither Yes not No is the right answer, but the form requires one answer. I though a No would get more attention.
There is a typo in the answer regarding billing contact - it should have been "Billing contacts are not part of the public WHOIS and the ALAC has no concern with what is done with them."
To be clear, the Billing Contact is vestigial (you can Google it if you are not familiar with the word but it refers to something that may have had a purpose once but no longer has any function). Pre-GDPR, it was not displayed in the public WHOIS, and it is not used by Registrars (who have their own non-WHOIS account information).
Q70: Thanks!
Q77: I don't think that the phrase "...subject to the registrant being given and option to consent to be identified." properly conveys the intent. I would make a wording change in our answer though saying "...subject to the registrant being given an option to consent to the allow the information to be publicly published/displayed."
The first draft of the EPDP Response is now uploaded. It is essentially the same as that presented on the CPWG call on 28 Nov 2018.
One point on which there was significant discussion on the call was whether we should support geographic differentiation - that is, only apply redaction if the geographic location of the registrar/registry and the registrant warrant it or allow contracted parties ot redact for all registrations. When this was previously discussed, there was quite a divide between those who felt we should differentiate, and those who felt that a contracted party could decide whether to do it or not (ie a registrar, for instance) could decide to treat all registrants as if they were in the EU, and similarly a registrar outside of the EU (with no connection there) could also redact all data.
One of the things that has changed is that the European Data Protection Board has recently issued a document making it clear that an organization with NO presence or processing in the EU, offering services through the web, could have EU-based customers and not be subject to the GDPR - IF they do not explicitly target EU customers. Simple availability of a website in the EU does not constitute targeting. That take a large number of contracted parties who many of us had thought would be subject to the GDPR out of the game. See
On the CPWG when the question as ask about supporting geographic differentiation (oe Registrars/Registries should only redact when GDPR requires it, the overwhelming number agree (via check marks or voiced comments). This position is reflected in answers 86 and 89.
Please add your comments or thoughts on any of the replies here.