Please review ICANN Expected Standards of Behavior here: https://www.icann.org/resources/pages/expected-standards-2016-06-28-en**Reminder, when using chat, please select all panelists and attendees in order for chat to be captured after the meeting.

For the chat to be archived, it needs to be set to “panelists and attendees”

https://docs.google.com/document/d/156jajwvAkl1l5VsdWXpznrghkKyMUD2bhKkS20X7Xrg/edit#

Just for the record: I had mentioned multiple times that I would prefer to talk about the risk for those involved in the domain name registration, i.e. ICANN, Rys and Rrs. I thought we had agreed on that, but I will not die in the ditch over this.

Apologies. The rewrite for Q5 is also in the word doc, not the google link that I just posted.

@Thomas, perhaps best to make your comment verbally?

+1 Jan

**Reminder, when using chat, please select all panelists and attendees in order for chat to be captured after the meeting.

Right Volker - that’s a second declaration

How long do you want to make the registration process?

Where is the benefit for the registrant?

It could be done afterwards

As a reminder, Becky updated the consolidated question to include this text: Are there additional or alternative mitigation and/or verification steps that a Contracted Party could take to further reduce/eliminate liability associated with inadvertent publication of personal data in connection with reliance on a registrant’s self-designation, e.g. confirming the existence of corporate identifiers (Inc., GmbH, Ltd. Etc.), reviewing account holder data for indicia of legal personhood, etc.? To what degree would each such additional step reduce liability?

+1 Thomas

Policy? We are not creating policy in 2b. We are creating guidance for voluntary implementation, right?

Correct Becky.

We’re creating consensus policies that impose requirements not guidance

@Thomas not only the UK but also some other countries have similar laws

@Hadia. Right. I just referred to GDPR and the mirrored GDPR in the UK.

Margie, read the charter again:

ii. What guidance, if any, can be provided to Registrars and/or Registries who differentiate between registrations of legal and natural persons.

@volker - that does not limit the charter to only providing guidance

Its still a PDP

Well, good luck passing anything but guidance

+1 Alan

We’ll try to see if there’s a way to propose binding policy - the advice is meant to allow consensus building for a policy that can work for all stakeholders

I do not see a path towards that

As a suggestion, perhaps the question can point to specific areas of prior advice to help target and focus the advice the LC seeks? As framed now, this could incur greater expense by just reviewing all the memos in total?

How is a caveat laden legal advice going to help us create a policy today?

surely we are going for clarity and not more questions posed? Was this not a previous criticism of the legal advices?

If Margies comment now were a public comment, my response would be: @Noted"

not personal dat a

*data

Let’s cross the NIS II bridge when we get to it in a few years

NIS2 basically tells us to hurry up and build the SSAD ;-)

Legal obligation is 6-1-c under GDPR

agreed Volker

@Kieth makes sense

Becky +1

This is not critical path ,material for this pdpd

https://docs.google.com/document/d/1UCP86uPZJBA_oh_4lfa6GwisfqnXUgbi5kdq-VOQCS0/edit#heading=h.gjdgxs

The EPDP-Phase 2A - Legal Sub-team call will take place on Tuesday, 09 March 2021 at 14:00 UTC for 60 minutes.

All good.

Thank you!

Thursday is a normal meeting again?

This is a 90-minute call.

https://docs.google.com/document/d/1UCP86uPZJBA_oh_4lfa6GwisfqnXUgbi5kdq-VOQCS0/edit#

Yes, Thursday is a normal Plenary call.

I do not object to Laureens proposal to withdraw

I think we lost Margie as we were moving to wrap. Can someone ping her and let her know we're still going?

I reached out to Margie.

exactly

yes but per registrant leads to correlation

this is reverse lookup in 2 steps

a single SSAD request relates to a single domain and the registration data of that domain. If we have a single pseudonymized email for that registrant, a single SSAD request will now allow the identification of that registrant in all registrations... So I do feel that defeats the issue. It is no longer pseudonymized to both CP and third party.

Thanks all. I need to drop a few minutes early. Thanks for all the good ongoing work.

Time check: 2 Min.

Sorry, I need to leave. All the best, Thomas

Thank you all - bye for now