RE: [council] Version 2: Proposed motion regarding Personal Data that is collected and retained by registrars

["Bruce Tonkin" <Bruce.Tonkin@xxxxxxxxxxxxxxxxxx>]

Hello Marilyn,

With respect to the motion, I think procedurally the proposer and
seconder could withdraw the previous motion tabled in Marrakech (ie me
and Tony Holmes), and then I can call for a seconder for a new motion.
Alternatively we can vote on amending the original motion etc, - but I
think that might get too cumbersome.


Thanks for the suggested changes.  Some comments below.


> 
> 
> See inserts below in CAPS.
> 
> 
> > "The GNSO Council notes that, consistent with generally accepted 
> > privacy principles, Registrars are required under clause 3.7.7.4 of 
> > the Registrar Accreditation Agreement to provide notice to 
> each new or 
> > renewed Registered Name Holder stating:
> >
> > (i) The purposes for which any Personal Data collected from the 
> > applicant are intended;
> >
> > (ii) The intended recipients or categories of recipients of 
> the data 
> > (including the Registry Operator and others who will 
> receive the data 
> > from Registry Operator);
> >
> > (iii) Which data ELEMENTS are obligatory and which data 
> ELEMENTS, if 
> > any,
> are voluntary;
> > and
> >
> > (iv) How the Registered Name Holder or data subject can 
> access and, if 
> > necessary, CORRECT OR rectify the data held about them.
> >


The text above is a direct quote from the current registrar agreement (I
have changed the numbering to avoid confusion) - so I would prefer to
leave that text unchanged.


> > To further understand the range of purposes for which data is 
> > COLLECTED
> AND USED [intended],
> > the GNSO proposes the following steps:


"Used" and "intended to be used" are different concepts.   The focus of
the motion is on the purpose of collecting the data.   Of course any
data that is obtained by a third party (ie not the registrant or
registrar) may be used in different ways.  Part 3 of the motion is
attempting to summarise how the public information is used.




> >
> > (1) The ICANN staff will review a sample of registrar 
> agreements with 
> > Registered Name Holders to identify some of the purposes for which 
> > registrars collect Personal Data in the course of 
> registering a domain 
> > name for their customers.
> >
> > (2) The ICANN staff will review a REPRESENTATIVE sample of ccTLD 
> > registry
> or ccTLD
> > registrar agreements, TAKING INTO ACCOUNT THE ISSUES OF GEOGRAPHICAL
> DIVERSITY AND RULE OF LAW VARIANCES, with registrants to 
> identify some of the purposes
> > for which these organisations collect AND DISPLAY Personal Data from
> registrants.

This motion is focussed on the purpose for collecting data.  I think it
should stay constained to that topic.   I think we have previously
reviewed how ccTLDs display data as part of the WHOIS task force work.


> >
> > (3) The ICANN staff will summarise the current material that has 
> > resulted from WHOIS discussions since 2002 that document 
> the current 
> > uses of the data that is currently made public through the WHOIS 
> > service. [WHAT IS THE TIME FRAME FOR THIS PROJECT?]

A good question.  I would hope no more than 4 weeks, but the staff can
hopefully provide an estimate based on their current work items.



Regards,
Bruce Tonkin