<html>
<body>
Thanks Jonathan. <br><br>
And note that Registrars and Registries (who have similar goals - to
ensure that they comply and are not subject to being non-compliant and
fined) have 6 voices as does the NCSG. We have 2.<br><br>
Alan<br><br>
At 08/08/2018 11:41 AM, Jonathan Zuck wrote:<br>
<blockquote type=cite class=cite cite="">Folks,<br>
Handicapping the outcome and determining the interests we will attempt to
represent are two very different exercises that we would do well not to
conflate. It may very well be the case that whois is not currently GDPR
compliant. That does nothing to change the fact that end users benefit
from cybersecurity research, reputational databases and IP enforcement
(as it often pertains to malware). So the point is NOT to be the smartest
person in the room who already has the answers. The point is to
vigorously represent those who, at present, have no voice in this
discussion: the typical end user engaged in end user activities on the
internet. None of that implies non-compliance with the GDPR but it might
mean choosing a few places to “test the fences,” so to speak,
or creative alternatives for facilitating the work of the 3<sup>rd</sup>
parties on which end users rely.<br>
<br>
Everyone seems to be freaking out about this statement when it’s not
the case where ours will be the only voice. There are many voices, of
which we are simply one. We serve our constituency better by being only
one and not attempting to be the “every voice.” The biggest business
interest in this is registrars and registries and they are well
represented by both themselves and the NCUC under cover of representing
the registrant. We don’t denigrate the registrant but instead are there
to represent end users. There’s nothing wrong with being a minority
voice and losing more battles than we win. We should still be doing our
best to represent those interests.<br>
<br>
<b>From: </b>ALAC <alac-bounces@atlarge-lists.icann.org> on behalf
of Hadia Abdelsalam Mokhtar EL miniawi <Hadia@tra.gov.eg><br>
<b>Date: </b>Wednesday, August 8, 2018 at 9:27 AM<br>
<b>To: </b>John Laprise <jlaprise@gmail.com><br>
<b>Cc: </b>At-Large Worldwide <alac@atlarge-lists.icann.org>, Alan
Greenberg <alan.greenberg@mcgill.ca><br>
<b>Subject: </b>Re: [ALAC] ALAC Statement regarding EPDP<br>
<br>
We certainly need to have legal bases corresponding to the stated
purposes, I am not sure that we do have these now<br>
<br>
hadia <br>
<br>
<b>From:</b> John Laprise
[<a href="mailto:jlaprise@gmail.com" eudora="autourl">
mailto:jlaprise@gmail.com</a>] <br>
<b>Sent:</b> Wednesday, August 08, 2018 3:22 PM<br>
<b>To:</b> Hadia Abdelsalam Mokhtar EL miniawi<br>
<b>Cc:</b> Alan Greenberg; At-Large Worldwide; Holly Raiche<br>
<b>Subject:</b> Re: [ALAC] ALAC Statement regarding EPDP<br>
<br>
Full disclosure: I am one of the GDPR leads at the (non-internet) non
profit I work for. I'm up to my eyeballs in GDPR implementation. I
understand the technical specification and it's rationale but do not
think IMO that the WHOIS regime is GDPR compliant. ICANN collects far
more data than required from a contractual point of view and violates
GDPR's data minimzation principles.<br>
On Wed, Aug 8, 2018, 7:10 AM John Laprise
<<a href="mailto:jlaprise@gmail.com">jlaprise@gmail.com</a>>
wrote:<br>
<dl>
<dd>GDPR only recognizes data subjects (their associated PII),
controllers, and processors. So should we. We should avoid confusion by
singling out groups and in most balance tests, privacy interests of data
subjects is the guiding factor.<br>
<dd>On Wed, Aug 8, 2018, 6:40 AM Hadia Abdelsalam Mokhtar EL miniawi
<<a href="mailto:Hadia@tra.gov.eg">Hadia@tra.gov.eg</a>>
wrote:<br>
<dl>
<dd>Hi Holly and all,<br>
<br>
<dd>Sorry could not reply earlier though I read the email and all the
later comments because I was at the MEAC SIG and going through the EPDP
survey.<br><br>
<dd>So for sure I am not asking for access for individual consumers, I
edited Alan's original statement adding to it the customers but missing
that the statement askes for access, my mistake. So first I don't think
that in our statement we should specifically refer to access (Which is
referenced in Annex A of the temporary specification) but we should
rather state our position with regard to the whole EPDP. The EPDP
addresses four parts<br>
<dd>1. Purposes for processing Registration Data<br>
<dd>2. Required Data Processing activities (with 10 items one of which
addresses access)<br>
<dd>3. Data Processing terms<br>
<dd>4. Updates to other Consensus Policies<br><br>
<dd>The most important of which in my opinion is the purposes for
processing registration data based on which the access would be granted.
By no means do we want to send the message that data privacy is not
important and that we are only concerned with law enforcement and
cybersecurity. As I mentioned before the impact of the GDPR on
WHOIS will be felt by the individual internet customers and not
only those who identify cyber attackers and the law enforcement
agencies.<br><br>
<dd>I don't think that it serves us right to be speaking solely about
cybersecurity and law enforcement agencies or being regarded as
their advocates as for sure we are the advocates of the Internet end
users.<br><br>
<dd>So I suggest the following edits with regard to item 4 of Alan's
statement inviting others to modify/add if more clarity is
required<br><br>
<dd>"our main concern is about protecting the rights and interests
of individual internet users and consumers as well as third parties
like consumer protection agencies, law enforcement, cybersecurity
researchers, those combating fraud in domain names, and others who help
protect users from phishing, malware, spam, fraud, DDoS attacks. Those
who work to ensure that the Internet is a safe and secure place for users
and to do so need timely information about certain websites, all within
the constraints of GDPR of course."<br><br>
<br>
<dd>Best<br>
<dd>Hadia<br><br>
<dd>-----Original Message-----<br>
<dd>From: Holly Raiche
[<a href="mailto:h.raiche@internode.on.net" eudora="autourl">
mailto:h.raiche@internode.on.net</a>] <br>
<dd>Sent: Monday, August 06, 2018 12:47 AM<br>
<dd>To: Hadia Abdelsalam Mokhtar EL miniawi<br>
<dd>Cc: Jonathan Zuck; Carlton Samuels; Evan Leibovitch; At-Large
Worldwide; Alan Greenberg<br>
<dd>Subject: Re: [ALAC] ALAC Statement regarding EPDP<br><br>
<dd>Sorry Hadia, but I absolutely cannot agree to your
paragraph.<br><br>
<dd>We have made it clear from the beginning that whatever the final
outcome reached by the EPDP, it must come within the GDPR. As I
have stated many times, the GDPR has to cover many industries,
businesses, governmental practices, and therefore, is necessarily general
- which gives room when applying those general rules to particular
situations. So there is room to talk about circumstances in which
particular parties will have access to some/all of the information.
<br><br>
<dd>We can argue for access within the recognised category of
cybersafety, misuse of information, etc. But one thing the GDPR will not
do is permit ordinary individuals unfettered access to personal
information. So arguing for individual, unfettered access puts us
outside of the GDPR - and outside of the remit of the EPDP. <br><br>
<dd>Holly<br><br>
<dd>On 6 Aug 2018, at 12:31 am, Hadia Abdelsalam Mokhtar EL miniawi
<<a href="mailto:Hadia@tra.gov.eg">Hadia@tra.gov.eg</a>>
wrote:<br><br>
<dd>> Hi All,<br>
<dd>> <br>
<dd>> <br>
<dd>> As Alan mentioned that we (the members and alternates) had
agreed on the statement, however I was of the view of adding a few lines
about the consumers, all Internet users are consumers in a way or
another. The conflict between the obligations of the GDPR and WHOIS will
hinder the work of those who work on identifying cyber attackers
and the law enforcement agencies but more importantly the impact of the
GDPR on WHOIS will be felt by the individual internet customers.
Therefore as the representatives of the interests of the end
users I see that we need to mention them in our statement. I also suggest
removing WHOIS and just putting the need for access in a timely manner
instead. We could end up with another system not necessarily WHOIS, so
below is my suggestion for item number 4<br>
<dd>> <br>
<dd>> <br>
<dd>> "Although some Internet users consult WHOIS and will not be
able to do so in some cases going forward, our main concern is access for
individual consumers as well as third parties like consumer protection
agencies, law enforcement, cybersecurity researchers, those combating
fraud in domain names, and others who help protect users from phishing,
malware, spam, fraud, DDoS attacks, those who work to ensure that the
Internet is a safe and secure place for users and to do so need timely
information about certain websites, all within the constraints of GDPR of
course."<br>
<dd>> <br>
<dd>> Kind Regards<br>
<dd>> Hadia<br>
<dd>> <br>
<dd>> <br>
<dd>> <br>
<dd>> <br>
<dd>> ________________________________<br>
<dd>> From: ALAC
<<a href="mailto:alac-bounces@atlarge-lists.icann.org">
alac-bounces@atlarge-lists.icann.org</a>> on behalf of Jonathan Zuck
<<a href="mailto:JZuck@innovatorsnetwork.org">
JZuck@innovatorsnetwork.org</a>><br>
<dd>> Sent: 04 August 2018 18:29<br>
<dd>> To: Carlton Samuels; Evan Leibovitch<br>
<dd>> Cc: At-Large Worldwide; Alan Greenberg<br>
<dd>> Subject: Re: [ALAC] ALAC Statement regarding EPDP<br>
<dd>> <br>
<dd>> Wow. A “rancid falsehood.” Agree, of course, but love
the language.<br>
<dd>> <br>
<dd>> From: ALAC
<<a href="mailto:alac-bounces@atlarge-lists.icann.org">
alac-bounces@atlarge-lists.icann.org</a>> On Behalf Of Carlton
Samuels<br>
<dd>> Sent: Saturday, August 4, 2018 11:54 AM<br>
<dd>> To: Evan Leibovitch
<<a href="mailto:evan@telly.org">evan@telly.org</a>><br>
<dd>> Cc: At-Large Worldwide
<<a href="mailto:alac@atlarge-lists.icann.org">
alac@atlarge-lists.icann.org</a>>; Alan Greenberg
<<a href="mailto:alan.greenberg@mcgill.ca">alan.greenberg@mcgill.ca</a>
><br>
<dd>> Subject: Re: [ALAC] ALAC Statement regarding EPDP<br>
<dd>> <br>
<dd>> I have to tell you my friend this one leaves me gobsmacked every
time. And, underscores the immorality of the false equivalence.<br>
<dd>> <br>
<dd>> Sure, let us accept that the bye-law change was orchestrated by
some rube from SoyaBeanField, Nebraska who may be challenged by the
ordinary meaning of 'individual internet users" to which the bye-law
of title refers.<br>
<dd>> <br>
<dd>> And let us concede the term 'individual internet users' may be
subject to interpretation. But you cannot escape context in
assessing meaning.<br>
<dd>> <br>
<dd>> If one knows anything of the domain name system and the domain
name market, it should not be a stretch to consider and recognize that
purely on these facts, if one chooses to take title to a domain name and
become a registrant, the interests of a registrant will likely diverge,
even pivot, from that of an individual internet user!<br>
<dd>> <br>
<dd>> This has troubled me as long as I have caucused with the
At-Large. Yes, we should welcome every opinion in these councils. And
yes, I will stand at the barricade to preserve the right for all opinions
to contend and even be heard.<br>
<dd>> <br>
<dd>> But it is a rancid falsehood to ascribe the same value to all of
them.<br>
<dd>> <br>
<dd>> -Carlton<br>
<dd>> <br>
<dd>> <br>
<dd>> ==============================<br>
<dd>> Carlton A Samuels<br>
<dd>> Mobile: 876-818-1799<br>
<dd>> Strategy, Process, Governance, Assessment & Turnaround<br>
<dd>> =============================<br>
<dd>> <br>
<dd>> <br>
<dd>> On Fri, Aug 3, 2018 at 4:28 PM Evan Leibovitch
<<a href="mailto:evan@telly.org">evan@telly.org</a>
<<a href="mailto:evan@telly.org" eudora="autourl">
mailto:evan@telly.org</a>>> wrote:<br>
<dd>> Hi all.<br>
<dd>> <br>
<dd>> I agree with Holly, Carlton and Kan. I am frankly surprised that
this debate continues to be litigated. How little has changed after a
decade of talk. Two things:<br>
<dd>> <br>
<dd>> 1. Alan's point that "if registrant needs
differ from those of the 4 billion Internet users who are not
registrants, those latter needs take precedence" ought not to be
controversial, yet somehow it still is to some. The ICANN Bylaws assign
to ALAC the role of representing the interests of those who are impacted
by domains yet neither buy nor sell them. While there are those among us
who own domains and even a few who sell them, such interests already have
representation elsewhere in ICANN through multiple vectors. In the vast
majority of instances the needs of domain owners align with those of the
billions who would use those domains to access goods and services. Alan's
statement, which is consistent with both the Bylaws and past practice, is
that on the few occasions when those interests may collide, ALAC sides
with those who have no other voice in ICANN. This is nothing new and has
no reason to be renegotiated now.<br>
<dd>> 2. It is neither inconsistent with the GRPR nor
mocking its intentions to state accurately that privacy has been
demonstrably abused within the world of domains to enable unethical and
illegal conduct. It wholly appropriate for At-Large -- in speaking for
those who have been scammed and those who wish not to be scammed in the
future -- to request that the legitimate need for privacy be accompanied
by safeguards against shielding those who cause harm. To me this takes
two forms: (a) demand for robust and efficient due process to address
such abuse when discovered and (b) accuracy of information so that the
result of valid due process reveals useful data. It is reasonable to
assert that the unintended consequence of privacy without such public
safeguards may be worse than the problems privacy rules seek to fix.<br>
<dd>> - Evan<br>
<dd>> _______________________________________________<br>
<dd>> ALAC mailing list<br>
<dd>>
<a href="mailto:ALAC@atlarge-lists.icann.org">
ALAC@atlarge-lists.icann.org</a><br>
<dd>>
<a href="https://atlarge-lists.icann.org/mailman/listinfo/alac" eudora="autourl">
https://atlarge-lists.icann.org/mailman/listinfo/alac</a><br>
<dd>> <br>
<dd>> At-Large Online:
<a href="http://www.atlarge.icann.org">http://www.atlarge.icann.org</a>
<br>
<dd>> ALAC Working Wiki:
<a href="https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALAC)">
https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALAC)</a>
<br><br>
<dd>_______________________________________________<br>
<dd>ALAC mailing list<br>
<dd><a href="mailto:ALAC@atlarge-lists.icann.org">
ALAC@atlarge-lists.icann.org</a><br>
<dd>
<a href="https://atlarge-lists.icann.org/mailman/listinfo/alac" eudora="autourl">
https://atlarge-lists.icann.org/mailman/listinfo/alac</a><br><br>
<dd>At-Large Online:
<a href="http://www.atlarge.icann.org">http://www.atlarge.icann.org</a>
<br>
<dd>ALAC Working Wiki:
<a href="https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALAC)">
https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALAC)</a>
<br>
</dl>
</dl></blockquote></body>
</html>