<div dir="ltr"><div>Hi Rafik and Stephanie and everyone else,<br><br>I see the risk but currently don't see this item as diverting too much energy from our substantive policy work. 1) It's a fairly well constrained little piece of work, 2) we're responding to a request / invitation to be helpful, and 3) the call for input has brought in a lot of new and enthusiastic volunteers from our group. <br>
<br>My hope (both personally and also in capacity as NCSG PC chair) would be that we can get a nice, discrete (as in well-bounded and not too time-consuming) piece of work done, show our useful expertise more broadly, and then channel some of our new volunteers towards the GNSO policy work on whois. Let's use it as an onboarding - Stephanie's call for volunteers got more response than most of our policy requests. I would like to think of this item as a 'gateway drug' to other privacy issues in ICANN!<br>
<br></div><div>Maria<br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On 6 April 2014 07:44, Rafik Dammak <span dir="ltr"><<a href="mailto:rafik.dammak@gmail.com" target="_blank">rafik.dammak@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Stephanie,<div><br></div><div>I am afraid that the focus on thing like ICANN collecting data about volunteers and participants can divert the scarce resources we have , instead of working whois-related issues </div>
<div class="gmail_extra">more clarity about the strategy and scope would be helpful</div><div class="gmail_extra"><br></div><div class="gmail_extra">Best Regards,</div><div class="gmail_extra"><br clear="all"><div><div dir="ltr">
<div>Rafik </div></div></div>
<br><br><div class="gmail_quote">2014-04-06 15:41 GMT+09:00 Stephanie Perrin <span dir="ltr"><<a href="mailto:stephanie.perrin@mail.utoronto.ca" target="_blank">stephanie.perrin@mail.utoronto.ca</a>></span>:<div><div class="h5">
<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">I am afraid I don’t understand the question Rafik..we offered to tell them what is wrong with their policy. Item one, is the scope is too narrow. A full policy covers everything. This is what the law would demand, if they were in a jurisdiction with law.<div>
<div><br><div><div>On Apr 6, 2014, at 2:18 AM, Rafik Dammak <<a href="mailto:rafik.dammak@gmail.com" target="_blank">rafik.dammak@gmail.com</a>> wrote:</div><br><blockquote type="cite"><div dir="ltr">Hi Stephanie,<div>
<br></div><div>I read the document but I am somehow puzzled by the scope:</div><div>- are we talking about privacy within ICANN in regard to the policies development there like in the case of RAA, Whois, new directory services? then providing a privacy framework for ICANN policies, systematic assessment of policy impact on privacy and data protection etc</div>
<div>- or it is just about ICANN collecting personal data from the community , staff etc </div><div><br></div><div>the scope matters because the resources and the focus we can have at NCSG level. as you know we have already an existing group to discuss privacy within NCSG , with those involved in several working group around whois.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">Best Regards,</div><div class="gmail_extra"><br clear="all"><div><div dir="ltr">Rafik </div></div>
<br><br><div class="gmail_quote">2014-04-02 20:07 GMT+09:00 Stephanie Perrin <span dir="ltr"><<a href="mailto:stephanie.perrin@mail.utoronto.ca" target="_blank">stephanie.perrin@mail.utoronto.ca</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">Further to this note, there is an opening very draft preface to our comments on the ICANN privacy policy, on the pad set up by Niels. I attach the word version here, for anyone who is interested in this project. To join the work group, contact Stefania<div>
It is a conversation starter, no where near a final draft. </div><div></div></div><br><div style="word-wrap:break-word"><br><div><div>On Mar 30, 2014, at 2:45 PM, Stephanie Perrin <<a href="mailto:stephanie.perrin@mail.utoronto.ca" target="_blank">stephanie.perrin@mail.utoronto.ca</a>> wrote:</div>
<br><blockquote type="cite">
<div style="word-wrap:break-word"><blockquote type="cite" style="font-family:LucidaGrande"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style="word-wrap:break-word"><blockquote type="cite"><div style="word-wrap:break-word">Further to Robin’s note, I am pasting in a thread that originated in NCUC following our meeting with the ICANN Board. </div>
</blockquote></div></blockquote></div></div></blockquote><div><br></div><div>Numerous members of the NCUC have already volunteered to work on developing a gap analysis of the existing ICANN privacy policies, with a view to providing advice back to the Board as to what needs to be done to bring ICANN privacy policies up to the expected levels. Please join in, as you can see from Bruce Tonkin’s note back to us, there is a rather poor web policy, for which I promised to provide a critique. I attach a few other jobs that need to be done rather soon, if anyone would like to volunteer. Here is a snippet which I just sent out to the NCUC volunteers: </div>
<div><br></div><div>OK, perhaps one group of folks would like to have a look at the policy for new Gtlds, available here, and prepare a critique of what is missing (gap analysis) <p class="MsoNormal"><span style="font-size:10pt;font-family:Times">gTLD Program is addressed in a separate personal data privacy statement at </span><a href="http://newgtlds.icann.org/en/applicants/agb/program-privacy" target="_blank"><span style="font-size:10pt;font-family:Times;color:blue">http://newgtlds.icann.org/en/applicants/agb/program-privacy</span></a><span style="font-size:10pt;font-family:Times">.<u></u><u></u></span></p>
<div><div style="font-family:LucidaGrande">We could also use some help from someone on analysing the transparency and accountability principles, where the disclosure stuff is apparently buried. One of the major criticisms of these policies is that it is very difficult for a user/participant at ICANN to find out what is happening to their data. </div>
<div style="font-family:LucidaGrande">Another task where I would love some help from an American Attorney, is whether it is legally possible to declare a total disclaimer to breach liability in the state of California, where there are data breach disclosure rules. (see the following snippet of the policy which I am dubbing a web policy):</div>
<p class="MsoNormal" style="font-family:LucidaGrande;margin-left:36pt"><span style="font-family:Times">Due to the open communication nature of the Internet, ICANN cannot represent, warrant or guarantee that communications stored on ICANN servers will be free from unauthorized access by third parties, loss, misuse or alterations. While ICANN will take reasonable and appropriate security measures to protect against unauthorized access, disclosure, alteration or destruction of personal information received, ICANN DISCLAIMS ANY AND ALL LIABILITY FOR UNAUTHORIZED ACCESS OR USE OR COMPROMISE OF YOUR PERSONAL INFORMATION. USERS ARE ADVISED THAT THEY SUBMIT SUCH PERSONAL INFORMATION AT THEIR OWN RISK.<u></u><u></u></span></p>
<div style="font-family:LucidaGrande">I have to say this is one of the paragraphs that really put me right over the top….caps included.</div><div style="font-family:LucidaGrande">Any volunteers for this task, I am working on the three pager and the basic critique of the web policy.</div>
<div style="font-family:LucidaGrande">cheers steph</div><div style="font-family:LucidaGrande">PS I have still not found the alleged staff policy, if anyone knows where it is please let me know</div><div style="font-family:LucidaGrande">
</div></div></div><div>Kind regards, </div><div>Stephanie Perrin</div><br><blockquote type="cite" style="font-family:LucidaGrande"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style="word-wrap:break-word"><blockquote type="cite"><div style="word-wrap:break-word"><div><div>On 26 Mar 2014, at 1:59 pm, Stephanie Perrin <<a href="mailto:stephanie.perrin@mail.utoronto.ca" target="_blank">stephanie.perrin@mail.utoronto.ca</a>> wrote:</div>
<br><blockquote type="cite"><div style="word-wrap:break-word">I will certainly volunteer to provide the first draft of a commentary on the “privacy policy”. I believe I am already on the hook for that, and if folks can self identify if they have an interest in this area, we can call it a group and I will send out the marked up copy. If people prefer to use a platform (e.g. googledocs) let us know. <div>
cheers Stephanie Perirn<br><div><div>On Mar 26, 2014, at 1:43 AM, William Drake <<a href="mailto:william.drake@uzh.ch" target="_blank">william.drake@uzh.ch</a>> wrote:</div><br><blockquote type="cite"><div style="word-wrap:break-word">
Hi<div><br></div><div>We have a number of folks who work on privacy policy. Would anyone be interested in organizing a group to provide an input to ICANN on its policy regarding the collection and use of personal data?</div>
<div><br></div><div>Bill</div><div><br><div><div>Begin forwarded message:</div><br><blockquote type="cite"><div style="margin:0px"><span style="font-family:Helvetica"><b>From: </b></span><span style="font-family:Helvetica">Bruce Tonkin <<a href="mailto:Bruce.Tonkin@melbourneit.com.au" target="_blank">Bruce.Tonkin@melbourneit.com.au</a>><br>
</span></div><div style="margin:0px"><span style="font-family:Helvetica"><b>Subject: </b></span><span style="font-family:Helvetica"><b>RE: ICANN privacy policy</b><br></span></div><div style="margin:0px"><span style="font-family:Helvetica"><b>Date: </b></span><span style="font-family:Helvetica">March 25, 2014 at 5:15:07 PM GMT+8<br>
</span></div><div style="margin:0px"><span style="font-family:Helvetica"><b>To: </b></span><span style="font-family:Helvetica">William Drake <<a href="mailto:william.drake@uzh.ch" target="_blank">william.drake@uzh.ch</a>><br>
</span></div><div style="margin:0px"><span style="font-family:Helvetica"><b>Cc: </b></span><span style="font-family:Helvetica">Rafik Dammak <<a href="mailto:rafik.dammak@gmail.com" target="_blank">rafik.dammak@gmail.com</a>>, "marie-laure Lemineur (<a href="mailto:mllemineur@gmail.com" target="_blank">mllemineur@gmail.com</a>)" <<a href="mailto:mllemineur@gmail.com" target="_blank">mllemineur@gmail.com</a>>, David Cake <<a href="mailto:dave@difference.com.au" target="_blank">dave@difference.com.au</a>>, Maria Farrell <<a href="mailto:maria.farrell@gmail.com" target="_blank">maria.farrell@gmail.com</a>>, "<a href="mailto:magaly.pazello@gmail.com" target="_blank">magaly.pazello@gmail.com</a>" <<a href="mailto:magaly.pazello@gmail.com" target="_blank">magaly.pazello@gmail.com</a>>, "<a href="mailto:kdrstoll@gmail.com" target="_blank">kdrstoll@gmail.com</a>" <<a href="mailto:kdrstoll@gmail.com" target="_blank">kdrstoll@gmail.com</a>>, "Amr Elsadr (<a href="mailto:aelsadr@egyptig.org" target="_blank">aelsadr@egyptig.org</a>)" <<a href="mailto:aelsadr@egyptig.org" target="_blank">aelsadr@egyptig.org</a>>, Fadi Chehade <<a href="mailto:fadi.chehade@icann.org" target="_blank">fadi.chehade@icann.org</a>>, John Jeffrey <<a href="mailto:john.jeffrey@icann.org" target="_blank">john.jeffrey@icann.org</a>><br>
</span></div><br><div>Yes indeed - your addresses were just ones that I had to hand.<br><br>Regards,<br>Bruce Tonkin<br><br><br>-----Original Message-----<br>From: William Drake [<a href="mailto:william.drake@uzh.ch" target="_blank">mailto:william.drake@uzh.ch</a>] <br>
Sent: Tuesday, 25 March 2014 5:10 PM<br>To: Bruce Tonkin<br>Cc: Rafik Dammak; marie-laure Lemineur (<a href="mailto:mllemineur@gmail.com" target="_blank">mllemineur@gmail.com</a>); David Cake; Maria Farrell; <a href="mailto:magaly.pazello@gmail.com" target="_blank">magaly.pazello@gmail.com</a>; <a href="mailto:kdrstoll@gmail.com" target="_blank">kdrstoll@gmail.com</a>; Amr Elsadr (<a href="mailto:aelsadr@egyptig.org" target="_blank">aelsadr@egyptig.org</a>); Fadi Chehade; John Jeffrey<br>
Subject: Re: ICANN privacy policy<br><br>Hi Bruce<br><br>Thanks for this. I assume this is an open invitation that we can share with our privacy mavens who are not not on the Cc, correct?<br><br>Best<br><br>Bill<br><br>
On Mar 25, 2014, at 4:33 PM, Bruce Tonkin <<a href="mailto:Bruce.Tonkin@melbourneit.com.au" target="_blank">Bruce.Tonkin@melbourneit.com.au</a>> wrote:<br>
<br><blockquote type="cite">Hello All,<br><br>Regarding the discussion of ICANN's use of private information in the NCSG meeting with the Board today.<br><br>With respect to ICANN's policy for collection and use of personal data, we do have a published privacy policy.<br>
<br>See: <a href="http://www.icann.org/en/help/privacy" target="_blank">http://www.icann.org/en/help/privacy</a><br><br>We would welcome a review of this policy to determine if it needs to be improved. IT was last updated in Oct 2012.<br>
<br>Also with respect to staff/HR information etc - I will see what information is available on internal policies.<br><br>Regards,<br>Bruce Tonkin<br><br><br><br><br></blockquote><br></div></blockquote></div><br></div></div>
_______________________________________________<br>Ncuc-discuss mailing list<br><a href="mailto:Ncuc-discuss@lists.ncuc.org" target="_blank">Ncuc-discuss@lists.ncuc.org</a><br><a href="http://lists.ncuc.org/cgi-bin/mailman/listinfo/ncuc-discuss" target="_blank">http://lists.ncuc.org/cgi-bin/mailman/listinfo/ncuc-discuss</a><br>
</blockquote></div><br></div></div>_______________________________________________<br>Ncuc-discuss mailing list<br><a href="mailto:Ncuc-discuss@lists.ncuc.org" target="_blank">Ncuc-discuss@lists.ncuc.org</a><br><a href="http://lists.ncuc.org/cgi-bin/mailman/listinfo/ncuc-discuss" target="_blank">http://lists.ncuc.org/cgi-bin/mailman/listinfo/ncuc-discuss</a><br>
</blockquote></div><br></div></blockquote></div></blockquote></div></div></blockquote><div><div>On Mar 30, 2014, at 2:34 PM, Robin Gross <<a href="mailto:robin@ipjustice.org" target="_blank">robin@ipjustice.org</a>> wrote:</div>
<br><blockquote type="cite">This is an open, archived list for those wishing to develop privacy policy.<br><br>Make the most of it!<br><br>_______________________________________________<br>Privacy mailing list<br><a href="mailto:Privacy@ipjustice.org" target="_blank">Privacy@ipjustice.org</a><br>
<a href="http://mailman.ipjustice.org/listinfo/privacy" target="_blank">http://mailman.ipjustice.org/listinfo/privacy</a><br></blockquote></div><br></div></blockquote></div><br></div><br>_______________________________________________<br>
Ncuc-discuss mailing list<br>
<a href="mailto:Ncuc-discuss@lists.ncuc.org" target="_blank">Ncuc-discuss@lists.ncuc.org</a><br>
<a href="http://lists.ncuc.org/cgi-bin/mailman/listinfo/ncuc-discuss" target="_blank">http://lists.ncuc.org/cgi-bin/mailman/listinfo/ncuc-discuss</a><br>
<br></blockquote></div><br></div></div>
</blockquote></div><br></div></div></div></blockquote></div></div></div><br></div></div>
<br>_______________________________________________<br>
Ncuc-discuss mailing list<br>
<a href="mailto:Ncuc-discuss@lists.ncuc.org">Ncuc-discuss@lists.ncuc.org</a><br>
<a href="http://lists.ncuc.org/cgi-bin/mailman/listinfo/ncuc-discuss" target="_blank">http://lists.ncuc.org/cgi-bin/mailman/listinfo/ncuc-discuss</a><br>
<br></blockquote></div><br></div>