<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Thanks John<div><br></div><div>It’s really helpful hearing from someone who has to implement GDPR - and can bring those insights to the table. </div><div><br></div><div>I think we all struggle to work through - first - whether ICANN is the data processor or controller, and from there, what information is actually required by whom, used by whom and accessed by whom.</div><div><br></div><div>If there were an easy answer, I think we’d be there. But none of this is easy, so this insight is really welcome.</div><div><br></div><div>Thank you</div><div><br></div><div>Holly<br><div><div>On 29 Aug 2018, at 10:37 am, John Laprise <<a href="mailto:jlaprise@gmail.com">jlaprise@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="EN-US" link="blue" vlink="purple" style="font-family: Verdana; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 12pt; font-family: Garamond, serif; color: rgb(31, 73, 125);">So in my day job I was one of the GDPR implementation leads and we’ve just wrapped up the initial work. We were assisted by an external consultancy. That said, if anything SSAC did not go far enough.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 12pt; font-family: Garamond, serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 12pt; font-family: Garamond, serif; color: rgb(31, 73, 125);">ICANN has a contractual basis for data collection related to the contracts it signs. The claim of legitimate interest is stretched well beyond it’s intent and in fact the EU has opined on the balancing test required. My understanding of the balancing test would call into question even legitimate law enforcement requests where the PII was of an individual or organization known to be persecuted. In that case, couldn’t exert legitimate interest if it fails the balance test.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 12pt; font-family: Garamond, serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 12pt; font-family: Garamond, serif; color: rgb(31, 73, 125);">I am sympathetic to the needs of security researchers and law enforcement but ICANN data collection does not exist for them, though it is used by them. The proper scope is identifying what data SSAC and RSAC need and use to advance ICANN’s mission.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 12pt; font-family: Garamond, serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 12pt; font-family: Garamond, serif; color: rgb(31, 73, 125);">While rationale for data collection is one pain point, another that my org discover was in terms of data transfer/processing. Legitimate interest is not recognized rationale there. Moreover as a US nonprofit ICANN is ineligible for PrivacyShield which could give it some cover.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 12pt; font-family: Garamond, serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 12pt; font-family: Garamond, serif; color: rgb(31, 73, 125);">Finally and perhaps to make matters worse, the technical spec instruct registries on data collection. I confess that at this point I’m not sure whether ICANN is acting as a data controller or a data processor. In a sense, the registries are data controllers and ICANN is the data processor, thrusting the onus of compliance upon registries.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 12pt; font-family: Garamond, serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 12pt; font-family: Garamond, serif; color: rgb(31, 73, 125);">I’m at the limits of my GDPR for the day so additional thoughts would be welcome.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 12pt; font-family: Garamond, serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 12pt; font-family: Garamond, serif; color: rgb(31, 73, 125);">Best,<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 12pt; font-family: Garamond, serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 12pt; font-family: Garamond, serif; color: rgb(31, 73, 125);">John<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 12pt; font-family: Garamond, serif; color: rgb(31, 73, 125);"> </span></div><div><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0in 0in;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><b>From:</b><span class="Apple-converted-space"> </span>ALAC <<a href="mailto:alac-bounces@atlarge-lists.icann.org" style="color: purple; text-decoration: underline;">alac-bounces@atlarge-lists.icann.org</a>><span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Holly Raiche<br><b>Sent:</b><span class="Apple-converted-space"> </span>Tuesday, August 28, 2018 2:17 PM<br><b>To:</b><span class="Apple-converted-space"> </span>Marita Moll <<a href="mailto:mmoll@ca.inter.net" style="color: purple; text-decoration: underline;">mmoll@ca.inter.net</a>>; ALAC <<a href="mailto:alac@atlarge-lists.icann.org" style="color: purple; text-decoration: underline;">alac@atlarge-lists.icann.org</a>><br><b>Cc:</b><span class="Apple-converted-space"> </span>Alan Greenberg <<a href="mailto:alan.greenberg@mcgill.ca" style="color: purple; text-decoration: underline;">alan.greenberg@mcgill.ca</a>><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [ALAC] EPDP Early input<o:p></o:p></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Thanks Marita<o:p></o:p></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">I like your wording. Ys it is a big document and I like your wording as to wha it is in the report that we endorse. <o:p></o:p></div></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Holly<o:p></o:p></div><div><div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">On 29 Aug 2018, at 1:18 am, Alan Greenberg <<a href="mailto:alan.greenberg@mcgill.ca" style="color: purple; text-decoration: underline;">alan.greenberg@mcgill.ca</a>> wrote:<o:p></o:p></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><br><br><o:p></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Marita, I am not sure that your synopsis is all that different from endorsing the entire paper when you start examining the rationales, but I would be happy to accept that if we can get closure on it quickly. Time is our enemy in this overall EPDP process.<br><br>Alan<br><br><br>At 28/08/2018 10:38 AM, Marita Moll wrote:<br><br><br><o:p></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-family: 'Times New Roman', serif;">Sorry to have missed the call -- still confusing midnight Monday with midnight Tuesday -- I guess I will get used to the format.<br></span><br><span style="font-family: 'Times New Roman', serif;">I just read this really well done SSAC report which is clear and thorough. But there is a lot in there. I wonder if we should do a blanket endorsement of everything without careful analysis.<span class="Apple-converted-space"> </span><br></span><br><span style="font-family: 'Times New Roman', serif;">Could we not have a more nuanced position? For example, we could say that, in line with our mandate to support end-users, we support SSAC's position on ensuring that security professionals and law enforcement have adequate access to WHOIS/RDS data.<span class="Apple-converted-space"> </span><br></span><br><span style="font-family: 'Times New Roman', serif;">If that is the point we want to make.<br></span><br><span style="font-family: 'Times New Roman', serif;">Marita</span><br><br>On 8/28/2018 2:23 AM, Alan Greenberg wrote:<br><br><o:p></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 11pt; font-family: Calibri, sans-serif;">As I mentioned on the ALAC call that has just completed, all EPDP participant groups have been given the opportunity to provide "early input" into the EPDP.<span class="Apple-converted-space"> </span><br><br>So far, the SSAC and the NCSG has done so. Their input can be found at<a href="https://community.icann.org/x/Ag9pBQ" style="color: purple; text-decoration: underline;">https://community.icann.org/x/Ag9pBQ</a>.<br><br>The SSAC's input consisted of their recent report SAC101. A copy is attached for your convenience.<br><br>I would like to suggest that the ALAC submit a statement saying that we support SAC101, as it is in line with our stated position of trying to ensure that security professionals and law enforcement have adequate access to WHOIS/RDS data.<br><br>I open the floor for discussion and will initiate a Consensus Call later in the week.<br><br>Alan<span class="Apple-converted-space"> </span><br><br><o:p></o:p></p><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';">_______________________________________________<o:p></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';">ALAC mailing list<o:p></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';"><a href="mailto:ALAC@atlarge-lists.icann.org" style="color: purple; text-decoration: underline;"><o:p></o:p></a></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';"><span class="MsoHyperlink" style="color: blue; text-decoration: underline;"><a href="mailto:ALAC@atlarge-lists.icann.org" style="color: purple; text-decoration: underline;">ALAC@atlarge-lists.icann.org</a></span><o:p></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';"><a href="https://atlarge-lists.icann.org/mailman/listinfo/alac" style="color: purple; text-decoration: underline;"><o:p></o:p></a></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';"><span class="MsoHyperlink" style="color: blue; text-decoration: underline;"><a href="https://atlarge-lists.icann.org/mailman/listinfo/alac" style="color: purple; text-decoration: underline;">https://atlarge-lists.icann.org/mailman/listinfo/alac</a></span><o:p></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';"><o:p> </o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';">At-Large Online:<o:p></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';"><a href="http://www.atlarge.icann.org/" style="color: purple; text-decoration: underline;">http://www.atlarge.icann.org</a><o:p></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';">ALAC Working Wiki:<o:p></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';"><a href="https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALAC)" style="color: purple; text-decoration: underline;"><o:p></o:p></a></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';"><span class="MsoHyperlink" style="color: blue; text-decoration: underline;"><a href="https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALAC)" style="color: purple; text-decoration: underline;">https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALAC)</a></span><o:p></o:p></pre></blockquote><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><br>_______________________________________________<br>ALAC mailing list<br><a href="mailto:ALAC@atlarge-lists.icann.org" style="color: purple; text-decoration: underline;">ALAC@atlarge-lists.icann.org</a><br><a href="https://atlarge-lists.icann.org/mailman/listinfo/alac" style="color: purple; text-decoration: underline;">https://atlarge-lists.icann.org/mailman/listinfo/alac</a><br><br>At-Large Online:<span class="Apple-converted-space"> </span><a href="http://www.atlarge.icann.org/" style="color: purple; text-decoration: underline;">http://www.atlarge.icann.org</a><br>ALAC Working Wiki:<span class="Apple-converted-space"> </span><a href="https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALAC" style="color: purple; text-decoration: underline;">https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALAC</a><span class="Apple-converted-space"> </span>)<o:p></o:p></div></blockquote></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">_______________________________________________<br>ALAC mailing list<br><a href="mailto:ALAC@atlarge-lists.icann.org" style="color: purple; text-decoration: underline;">ALAC@atlarge-lists.icann.org</a><br><a href="https://atlarge-lists.icann.org/mailman/listinfo/alac" style="color: purple; text-decoration: underline;">https://atlarge-lists.icann.org/mailman/listinfo/alac</a><br><br>At-Large Online:<span class="Apple-converted-space"> </span><a href="http://www.atlarge.icann.org/" style="color: purple; text-decoration: underline;">http://www.atlarge.icann.org</a><br>ALAC Working Wiki:<span class="Apple-converted-space"> </span><a href="https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALAC)" style="color: purple; text-decoration: underline;">https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(ALAC)</a></div></blockquote></div></div></div></div></blockquote></div><br></div></body></html>