[NCUC-DISCUSS] [Privacy] this is a space for privacy work
Stephanie Perrin
stephanie.perrin at mail.utoronto.ca
Mon Apr 7 01:29:19 CEST 2014
Thanks, and thanks for the reminder about plaintext, I keep forgetting!
Cheers Stephanie
On 2014-04-06, at 6:06 PM, Ron Wickersham wrote:
>
>
> On Sun, 6 Apr 2014, Stephanie Perrin wrote:
>
>> In response to your very reasonable request for objectives and plan, I whipped up a very quick summary of what I see as possible priorities for NCSG in response to what is going on at the moment. I hope it at least explains what I am thinking….
>> Cheers Stephanie
>
> hi Stephanie,
>
> thank you so very, very much for the summary you posted (which i have
> converted to plain text with for people who may have difficulty reading
> the .docx encoding in your attachment.
>
> reading that along with the excellent note you sent just previously
> where you point out that the issue is that agreements where the users
> (wheether they be individuals or organizations) have no current weight
> in negotiations but are imposed by "secret" or non-public negotiations
> to protect proprietary business models of registrars and registries.
>
> this has educated me to the necessary scope that must be included
> if the narrow whois disclosure is to have any real meaning for users
> of the DNS system.
>
> -ron
>
> the text of your document follows directly and after that the rest
> of the e-mail that i found so helpful:
>
> ### Strawman Privacy Action Plan for NCSG ###
>
> There are a number of issues in ICANN at the moment, which have impacts on privacy:
> 1) Response to the EWG report, which made four concrete recommendations re privacy policy:
> a) Develop a system for anonymous domain registration for groups and individuals at extreme risk, using secure credentials
> b) Develop binding corporate rules for ICANN
> c) Continue work on accreditation of privacy/proxy services
> d) Establish a mechanism to accredit and log those who wish to access user information beyond the basic public contact data, notably law enforcement officials and the IP constituency, but also potentially including third party data rich services such as who was. 2) Response to the 2013 RAA and the call for comments on data retention requirements.
> 3) Response to the ATRT report, particularly regarding respect for privacy and expected management standards and metrics. At the moment, this element is lacking.
> A few possible goals which we have not discussed in a fulsome manner, might include:
> 1) Seizing this opportunity, upon receipt of the EWG report and capitalizing on the movement to mature the ICANN bottom-up multistakeholder model during the Netmundial discussion, with a view to moving up a notch or two on the maturity model with respect to privacy.
> 2) Getting a comprehensive privacy policy in place that will set policy for all the other instruments, rather than the other way around
> 3) Putting in place binding corporate rules, that respect existing data protection law where it applies, and raise the bar for other jurisdictions that do not have it.
> 4) Naming a person who is accountable for all aspects of privacy compliance, usually called a data protection authority or chief privacy officer. 5) Making sure that we move forward on the privacy protective recommendations of the EWG, and develop a constituency both inside and outside ICANN that will help us implement them, particularly with respect to anonymous domain registration, which is an important but complex item with high symbolic value.
>
> Action plan
> 1) Point out to the Board that their current privacy policies are inadequate (done in Singapore).
> 2) Followup with a detailed criticism of what exists, with suggestions for improvement (started working group at Singapore, draft is started). Next step is to recommend (somehow) binding corporate rules for the organization.
> 3) Endorse the EWG recommendations (done in the NCSG comments, more work will be required after London)
> 4) Respond to questionnaires which are being sent out to gather stakeholder views, as they may sway EWG recommendations to the Board.
> 5) Start a campaign to gather support for anonymous domain registration, and start figuring out how to implement (waiting for an outline of work from Stephanie P)
> 6) Staff up the Privacy/Proxy working group (done, and thank goodness we have so many on the team, they are needed). Align with allies (breakfast in Singapore). Need to strategize on how best to maintain positions on this group, next step probably will be to support registrars in sending comments on the RAA. 7) Figure out a strategy for the recommendations to accredit access to the RDS or Whois replacement. LEAs are the easy part, what about law firms acting for IPC actors?
>
> Stephanie Perrin
> April 6 2014
>
>
>
>> On Apr 6, 2014, at 12:59 PM, Stephanie Perrin <stephanie.perrin at mail.utoronto.ca> wrote:
>>
>>> Data protection is about collection, use and disclosure. WHOIS is about disclosure. The collection is enforced through the collection instruments forced on the registrars (separate contract, which acts as a policy instrument, to which the registrants are not a party). Further data elements are gathered and retained through the data retention requirements, which occurs in the RAA agreement too. Data disclosed in the WHOIS is only one small piece...even through proxy services, additional registrant data is available through proxy service providers (separate, as yet ungoverned but soon to be covered either through the new Whois or through the privacy/proxy services accreditation). This data has to be mapped visually so people get it...whois is actually only a small piece. Re scoping in the HR data...this is an area where I cannot find a policy. How is HR data managed, given the fact that it is being transferred from jurisdictions with law (BRussels, Singapore) to a jurisdiction with a patchwork (California)? I consider this to be a driver.....pointing it out costs us nothing, and makes it worthwhile for ICANN to address this and other gaps. Obviously I think staff needs privacy rights, but it is not the focus of this work.
>>> Sorry to be abrupt, but I have spent all year arguing this stuff at the EWG....hours and hours, more like weeks, and I find that basic knowledge about how data protection works on the ground is not evident when we argue about Whois. This is what makes it so tiresome. I think we should more time at our meetings talking about substance, we get overtaken by process (the bane of every organization's existence) so we can make more meaningful interventions on policy.
>>> I will try to sketch in the data map next, but if people can think of other places where data is collected, that would be very helpful. Remember that one of the most basic rights that ICANN is silent about, is the right to access your own information, correct it, and make notifications if ICANN does not accept those corrections. It is mentioned in the second policy, the one on the new Gtld applications. It needs to be reflected in all the data collections.
>>> On another note, I am still looking for a volunteer attorney to check the caveats re data breach/liability. one of my privacy pals has indicated:
>>>> Due to the open communication nature of the Internet, ICANN cannot represent, warrant or guarantee that communications stored on ICANN servers will be free from unauthorized access by third parties, loss, misuse or alterations. While ICANN will take reasonable and appropriate security measures to protect against unauthorized access, disclosure, alteration or destruction of personal information received, ICANN DISCLAIMS ANY AND ALL LIABILITY FOR UNAUTHORIZED ACCESS OR USE OR COMPROMISE OF YOUR PERSONAL INFORMATION. USERS ARE ADVISED THAT THEY SUBMIT SUCH PERSONAL INFORMATION AT THEIR OWN RISK.
>>>>
>>> "First, if anyone could evade a breach notice law by writing a disclaimer, then everyone would do it. Second, there is nothing in the law that says it applies unless disclaimed. Indeed, there is a provision that says expressly "(a) Any waiver of a provision of this title is contrary to
>>> public policy and is void and unenforceable.". I'm pretty sure that applies to breach notification. It's Cal. Civil Code 1798.84. Third, it isn't clear that the language above says anything about breach notice. It disclaims liability, a different subject. Whether you can disclaim liability for everything is something that I rather doubt. Again, if you could, then everyone would disclaim liability for everything, ..."
>>>
>>> Personally, I would argue that this caveat is all about getting out from breach disclosure and liability, given the amounts California authorizes. However, I am not a lawyer. It would be nice to have a firm, authoritative, "you cannot put a clause like this disclaiming all liability in your web policy". We have quite a few lawyers on this list, I suspect. Looking for some free advice.
>>> cheers stephanie
>>> On 2014-04-06, at 12:24 PM, Rafik Dammak wrote:
>>>
>>>> Hi Stephanie,
>>>> An issue like whois who got the attention of many for years cannot be considered small.
>>>>
>>>> I was asking about clear strategy, goals and scope. For example, I cannot really understand the data protection for human resources as priority now for us.
>>>> I do understand about a privacy policy and framework so ICANN get the point about privacy in all aspects but not sure about your approach. It can be confusing.
>>>>
>>>> Reading maria email, a short brief looks doable for the short term. I was only asking what are the objectives and the plan.
>>>>
>>>> Best.
>>>>
>>>> Rafik
>>>>
>>>> On Apr 7, 2014 1:17 AM, "Stephanie Perrin" <stephanie.perrin at mail.utoronto.ca> wrote:
>>>> I dont agree at all. You cannot have a privacy policy that focuses on only one rather small element. This is why Whois has not been resolved, all the other pieces are separate.
>>>> On 2014-04-06, at 2:44 AM, Rafik Dammak wrote:
>>>>
>>>>> Hi Stephanie,
>>>>>
>>>>> I am afraid that the focus on thing like ICANN collecting data about volunteers and participants can divert the scarce resources we have , instead of working whois-related issues
>>>>> more clarity about the strategy and scope would be helpful
>>>>>
>>>>> Best Regards,
>>>>>
>>>>> Rafik
>>>>>
>>>>>
>>>>> 2014-04-06 15:41 GMT+09:00 Stephanie Perrin <stephanie.perrin at mail.utoronto.ca>:
>>>>> I am afraid I don’t understand the question Rafik..we offered to tell them what is wrong with their policy. Item one, is the scope is too narrow. A full policy covers everything. This is what the law would demand, if they were in a jurisdiction with law.
>>>>>
>>>>> On Apr 6, 2014, at 2:18 AM, Rafik Dammak <rafik.dammak at gmail.com> wrote:
>>>>>
>>>>>> Hi Stephanie,
>>>>>>
>>>>>> I read the document but I am somehow puzzled by the scope:
>>>>>> - are we talking about privacy within ICANN in regard to the policies development there like in the case of RAA, Whois, new directory services? then providing a privacy framework for ICANN policies, systematic assessment of policy impact on privacy and data protection etc
>>>>>> - or it is just about ICANN collecting personal data from the community , staff etc
>>>>>>
>>>>>> the scope matters because the resources and the focus we can have at NCSG level. as you know we have already an existing group to discuss privacy within NCSG , with those involved in several working group around whois.
>>>>>>
>>>>>> Best Regards,
>>>>>>
>>>>>> Rafik
>>>>>>
>>>>>>
>>>>>> 2014-04-02 20:07 GMT+09:00 Stephanie Perrin <stephanie.perrin at mail.utoronto.ca>:
>>>>>> Further to this note, there is an opening very draft preface to our comments on the ICANN privacy policy, on the pad set up by Niels. I attach the word version here, for anyone who is interested in this project. To join the work group, contact Stefania
>>>>>> It is a conversation starter, no where near a final draft.
>>>>>>
>>>>>>
>>>>>> On Mar 30, 2014, at 2:45 PM, Stephanie Perrin <stephanie.perrin at mail.utoronto.ca> wrote:
>>>>>>
>>>>>>>>> Further to Robin’s note, I am pasting in a thread that originated in NCUC following our meeting with the ICANN Board.
>>>>>>>
>>>>>>> Numerous members of the NCUC have already volunteered to work on developing a gap analysis of the existing ICANN privacy policies, with a view to providing advice back to the Board as to what needs to be done to bring ICANN privacy policies up to the expected levels. Please join in, as you can see from Bruce Tonkin’s note back to us, there is a rather poor web policy, for which I promised to provide a critique. I attach a few other jobs that need to be done rather soon, if anyone would like to volunteer. Here is a snippet which I just sent out to the NCUC volunteers:
>>>>>>>
>>>>>>> OK, perhaps one group of folks would like to have a look at the policy for new Gtlds, available here, and prepare a critique of what is missing (gap analysis)
>>>>>>> gTLD Program is addressed in a separate personal data privacy statement at http://newgtlds.icann.org/en/applicants/agb/program-privacy.
>>>>>>>
>>>>>>> We could also use some help from someone on analysing the transparency and accountability principles, where the disclosure stuff is apparently buried. One of the major criticisms of these policies is that it is very difficult for a user/participant at ICANN to find out what is happening to their data.
>>>>>>> Another task where I would love some help from an American Attorney, is whether it is legally possible to declare a total disclaimer to breach liability in the state of California, where there are data breach disclosure rules. (see the following snippet of the policy which I am dubbing a web policy):
>>>>>>> Due to the open communication nature of the Internet, ICANN cannot represent, warrant or guarantee that communications stored on ICANN servers will be free from unauthorized access by third parties, loss, misuse or alterations. While ICANN will take reasonable and appropriate security measures to protect against unauthorized access, disclosure, alteration or destruction of personal information received, ICANN DISCLAIMS ANY AND ALL LIABILITY FOR UNAUTHORIZED ACCESS OR USE OR COMPROMISE OF YOUR PERSONAL INFORMATION. USERS ARE ADVISED THAT THEY SUBMIT SUCH PERSONAL INFORMATION AT THEIR OWN RISK.
>>>>>>>
>>>>>>> I have to say this is one of the paragraphs that really put me right over the top….caps included.
>>>>>>> Any volunteers for this task, I am working on the three pager and the basic critique of the web policy.
>>>>>>> cheers steph
>>>>>>> PS I have still not found the alleged staff policy, if anyone knows where it is please let me know
>>>>>>>
>>>>>>> Kind regards,
>>>>>>> Stephanie Perrin
>>>>>>>
>>>>>>>>> On 26 Mar 2014, at 1:59 pm, Stephanie Perrin <stephanie.perrin at mail.utoronto.ca> wrote:
>>>>>>>>>
>>>>>>>>>> I will certainly volunteer to provide the first draft of a commentary on the “privacy policy”. I believe I am already on the hook for that, and if folks can self identify if they have an interest in this area, we can call it a group and I will send out the marked up copy. If people prefer to use a platform (e.g. googledocs) let us know.
>>>>>>>>>> cheers Stephanie Perirn
>>>>>>>>>> On Mar 26, 2014, at 1:43 AM, William Drake <william.drake at uzh.ch> wrote:
>>>>>>>>>>
>>>>>>>>>>> Hi
>>>>>>>>>>>
>>>>>>>>>>> We have a number of folks who work on privacy policy. Would anyone be interested in organizing a group to provide an input to ICANN on its policy regarding the collection and use of personal data?
>>>>>>>>>>>
>>>>>>>>>>> Bill
>>>>>>>>>>>
>>>>>>>>>>> Begin forwarded message:
>>>>>>>>>>>
>>>>>>>>>>>> From: Bruce Tonkin <Bruce.Tonkin at melbourneit.com.au>
>>>>>>>>>>>> Subject: RE: ICANN privacy policy
>>>>>>>>>>>> Date: March 25, 2014 at 5:15:07 PM GMT+8
>>>>>>>>>>>> To: William Drake <william.drake at uzh.ch>
>>>>>>>>>>>> Cc: Rafik Dammak <rafik.dammak at gmail.com>, "marie-laure Lemineur (mllemineur at gmail.com)" <mllemineur at gmail.com>, David Cake <dave at difference.com.au>, Maria Farrell <maria.farrell at gmail.com>, "magaly.pazello at gmail.com" <magaly.pazello at gmail.com>, "kdrstoll at gmail.com" <kdrstoll at gmail.com>, "Amr Elsadr (aelsadr at egyptig.org)" <aelsadr at egyptig.org>, Fadi Chehade <fadi.chehade at icann.org>, John Jeffrey <john.jeffrey at icann.org>
>>>>>>>>>>>>
>>>>>>>>>>>> Yes indeed - your addresses were just ones that I had to hand.
>>>>>>>>>>>>
>>>>>>>>>>>> Regards,
>>>>>>>>>>>> Bruce Tonkin
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> -----Original Message-----
>>>>>>>>>>>> From: William Drake [mailto:william.drake at uzh.ch]
>>>>>>>>>>>> Sent: Tuesday, 25 March 2014 5:10 PM
>>>>>>>>>>>> To: Bruce Tonkin
>>>>>>>>>>>> Cc: Rafik Dammak; marie-laure Lemineur (mllemineur at gmail.com); David Cake; Maria Farrell; magaly.pazello at gmail.com; kdrstoll at gmail.com; Amr Elsadr (aelsadr at egyptig.org); Fadi Chehade; John Jeffrey
>>>>>>>>>>>> Subject: Re: ICANN privacy policy
>>>>>>>>>>>>
>>>>>>>>>>>> Hi Bruce
>>>>>>>>>>>>
>>>>>>>>>>>> Thanks for this. I assume this is an open invitation that we can share with our privacy mavens who are not not on the Cc, correct?
>>>>>>>>>>>>
>>>>>>>>>>>> Best
>>>>>>>>>>>>
>>>>>>>>>>>> Bill
>>>>>>>>>>>>
>>>>>>>>>>>> On Mar 25, 2014, at 4:33 PM, Bruce Tonkin <Bruce.Tonkin at melbourneit.com.au> wrote:
>>>>>>>>>>>>
>>>>>>>>>>>>> Hello All,
>>>>>>>>>>>>>
>>>>>>>>>>>>> Regarding the discussion of ICANN's use of private information in the NCSG meeting with the Board today.
>>>>>>>>>>>>>
>>>>>>>>>>>>> With respect to ICANN's policy for collection and use of personal data, we do have a published privacy policy.
>>>>>>>>>>>>>
>>>>>>>>>>>>> See: http://www.icann.org/en/help/privacy
>>>>>>>>>>>>>
>>>>>>>>>>>>> We would welcome a review of this policy to determine if it needs to be improved. IT was last updated in Oct 2012.
>>>>>>>>>>>>>
>>>>>>>>>>>>> Also with respect to staff/HR information etc - I will see what information is available on internal policies.
>>>>>>>>>>>>>
>>>>>>>>>>>>> Regards,
>>>>>>>>>>>>> Bruce Tonkin
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> _______________________________________________
>>>>>>>>>>> Ncuc-discuss mailing list
>>>>>>>>>>> Ncuc-discuss at lists.ncuc.org
>>>>>>>>>>> http://lists.ncuc.org/cgi-bin/mailman/listinfo/ncuc-discuss
>>>>>>>>>>
>>>>>>>>>> _______________________________________________
>>>>>>>>>> Ncuc-discuss mailing list
>>>>>>>>>> Ncuc-discuss at lists.ncuc.org
>>>>>>>>>> http://lists.ncuc.org/cgi-bin/mailman/listinfo/ncuc-discuss
>>>>>>>>>
>>>>>>> On Mar 30, 2014, at 2:34 PM, Robin Gross <robin at ipjustice.org> wrote:
>>>>>>>
>>>>>>>> This is an open, archived list for those wishing to develop privacy policy.
>>>>>>>>
>>>>>>>> Make the most of it!
>>>>>>>>
>>>>>>>> _______________________________________________
>>>>>>>> Privacy mailing list
>>>>>>>> Privacy at ipjustice.org
>>>>>>>> http://mailman.ipjustice.org/listinfo/privacy
>>>>>>>
>>>>>>
>>>>>>
>>>>>> _______________________________________________
>>>>>> Ncuc-discuss mailing list
>>>>>> Ncuc-discuss at lists.ncuc.org
>>>>>> http://lists.ncuc.org/cgi-bin/mailman/listinfo/ncuc-discuss
>>>>>>
>>>>>>
>>>>>
>>>>>
>>>>
>>>
>>> _______________________________________________
>>> Ncuc-discuss mailing list
>>> Ncuc-discuss at lists.ncuc.org
>>> http://lists.ncuc.org/cgi-bin/mailman/listinfo/ncuc-discuss
>>
> _______________________________________________
> Ncuc-discuss mailing list
> Ncuc-discuss at lists.ncuc.org
> http://lists.ncuc.org/cgi-bin/mailman/listinfo/ncuc-discuss
More information about the Ncuc-discuss
mailing list