Source: https://www.icann.org/resources/board-material/minutes-2018-05-13-en
Timestamp: 2019-04-22 05:38:17+00:00

Document:
A Regular Meeting of the ICANN Board of Directors was held in person on 13 May 2018 in Vancouver, Canada at 17:00 local time.
In addition to the Chair, the following Directors participated in all or part of the meeting: Maarten Botterman, Becky Burr, Ron da Silva, Sarah Deutsch, Chris Disspain (Vice Chair), Avri Doria, Rafael Lito Ibarra, Khaled Koubaa, Akinori Maemura, Göran Marby (President and CEO), George Sadowsky, León Felipe Sanchez Ambia, Matthew Shears, Mike Silber, and Lousewies van der Laan.
The following Board Liaisons participated in all or part of the meeting: Manal Ismail (GAC Liaison), and Jonne Soininen (IETF Liaison).
The following Board Liaisons sent their Apologies: Ram Mohan (SSAC Liaison) and Kaveh Ranjbar (RSSAC Liaison).
Resolved (2018.05.13.01), the Board approves the minutes of the 15 March 2018 Regular Meeting of the ICANN Board.
Whereas, during its meeting on 30 January 2018, the GNSO Council resolved to recommend that the ICANN Board of Directors adopt the proposed changes to Section 11.3.i of the ICANN Bylaws to reflect new GNSO voting thresholds which are different from the current threshold of a simple majority vote of each House (see https://www.icann.org/en/system/files/files/proposed-revisions-bylaws-article-11-gnso-redline-19jun17-en.pdf [PDF, 39 KB]).
Whereas, the addition of voting thresholds to Section 11.3.i of the ICANN Bylaws as proposed by the GNSO constitutes a "Standard Bylaw Amendment" under Section 25.1 of the Bylaws.
Whereas, the ICANN Bylaws require that Standard Bylaw Amendments be published for public comment prior to the approval by the Board, and on 15 March 2018 the ICANN Board of Directors directed these proposed amendments to be posted for public comment.
Whereas, the public comment was opened on 26 March 2018 and closed on 05 May 2018.
Whereas, after taking public comments into account, the Board considered the proposed amendment for adoption.
Resolved (2018.05.13.05), the ICANN Board of Directors approves the amendment of the ICANN Bylaws [PDF, 106 KB] to include the proposed changes to section 11.3.i of the ICANN Bylaws, including the rewording for clarity proposed by the Registries Stakeholder Group, to reflect additional GNSO voting thresholds which are different from the current threshold of a simple majority vote of each House to address all the new or additional rights and responsibilities in relation to participation of the GNSO as a Decisional Participant in the Empowered Community.
The action being approved today is the amendment of the ICANN Bylaws to include the proposed changes to section 11.3.i of the ICANN Bylaws to reflect additional GNSO voting thresholds which are different from the current threshold of a simple majority vote of each House (see https://www.icann.org/en/system/files/files/proposed-revisions-bylaws-article-11-gnso-redline-19jun17-en.pdf [PDF, 39 KB]). These additional voting thresholds are intended to address all the new or additional rights and responsibilities in relation to participation of the GNSO as a Decisional Participant in the Empowered Community to fully implement these new or additional rights and responsibilities as they appear in the revised GNSO Operating Procedures published on 30 January 2018 (see https://gnso.icann.org/en/council/op-procedures-30jan18-en.pdf [PDF, 1.68 MB]). Per Article 2 of Annex D of the ICANN Bylaws, Standard Bylaw Amendments, the Board approval of these amendments then provides the Empowered Community an opportunity to consider if it will initiate a Rejection Action.
These Bylaw amendments are the result of a process that was initiated when on 27 May 2016 the ICANN Board adopted a set of new ICANN Bylaws that reflect changes needed to implement the IANA Stewardship Transition Proposal. Following the completion of the transition, the GNSO Council recognized that changes may need to be made to the GNSO's current Operating Procedures and related mechanisms, as well as to the ICANN Bylaws. The goal was to give effect to the new roles and obligations of the GNSO under the new ICANN Bylaws, including but not limited to the GNSO's participation in the Empowered Community.
The GNSO Council tasked the GNSO Rights & Obligations Under Revised Bylaws Drafting Team to put forward recommendations for changes to ICANN Bylaws and GNSO Operating Procedures to enable effective GNSO participation in ICANN activities. The GNSO Council accepted the Drafting Team's recommendations, which were translated into changes in the GNSO Operating Procedures and additional voting thresholds in section 11.3.i of the ICANN Bylaws. During its meeting on 30 January 2018, the GNSO Council resolved unanimously (https://community.icann.org/display/gnsocouncilmeetings/Motions+30+January+2018) to recommend that the ICANN Board of Directors adopt the proposed amendments to the ICANN Bylaws.
ICANN Organization opened a public forum on 26 March 2018. At the close of the public comment period on 05 May 2018, per the ICANN organization's Report [PDF, 364 KB] on Public Comments, there were five comments received. Of these comments, the Registries Stakeholder Group (RySG), the Registrar Stakeholder Group (RrSG), the Non-Commercial Stakeholder Group (NCSG), the Business Constituency (BC), and the Intellectual Property Constituency (IPC) supported the proposed additions to section II.3.i. Although BC restated its position that "GNSO Council is not the appropriate vehicle for GNSO to exercise Empowered Community rights and responsibilities", and the IPC noted a reservation with regards to application of the voting threshold outside the scope of the policy development process, the BC states that it "supports the recommended voting thresholds and changes to Bylaws" and the IPC states that it "is in favor of the GNSO Council's resolution to make needed changes to Section 11.3.i of the ICANN Bylaws, and urges for this proposal's adoption by the ICANN Board." The RySG also suggested a minor rewording of section II.3.i to improve clarity.
With the public comment completed, the Board is now considering the proposed amendment for adoption. In taking this action, the Board has considered the amendment to the ICANN Bylaws as forwarded by the GNSO Council, the public comments, and the ICANN Organization's public comment report.
There is no anticipated fiscal impact from adopting the proposed changes to the Bylaws. Approval of the resolution will not impact the security, stability and resiliency of the domain name. This action is consistent with ICANN's mission and serves the public interest by supporting the effectiveness and ongoing improvement of ICANN's accountability and governance structures.
Whereas, the Thick WHOIS Consensus Policy requires that Verisign is to begin accepting "Thick" registration data from registrars starting 28 May 2018, all new domain name registrations must be submitted to the registry as "Thick" starting on 28 October 2018 at the latest, and all relevant registration data for existing domain names must be migrated from "Thin" to "Thick" by 31 July 2019.
Whereas, in preparation to complete the deployment to accept Thick WHOIS data, Verisign proposed amendments to the registry-registrar agreements for .COM and .NET.
Whereas, the Registrar Stakeholder Group and Verisign expressed concerns about agreeing to Verisign's proposed amendments based on issues relating to the European Union's General Data Protection Regulation.
Whereas, ICANN organization has been facilitating discussions between Verisign and the Registrar Stakeholder Group to reach agreement on the proposed amendments to the registry-registrar agreements to implement the Thick WHOIS Consensus Policy.
Whereas, Verisign and the Registrar Stakeholder Group are at an impasse and need additional time to reach agreement on the proposed amendments to the applicable registry-registrar agreements to implement the Thick WHOIS Consensus Policy.
Whereas, the deferred enforcement period will allow the ICANN organization to continue to engage with the relevant European authorities including the European Union Article 29 Working Party, data protection agencies, contracted parties, and other pertinent stakeholders to gain a better understanding of the relevant aspects of GDPR and how it relates to ICANN's work and the organization's policies and contracts with registries and registrars, including the Thick WHOIS Consensus Policy.
Resolved (2018.05.13.06), the President and CEO, or his designee(s), is authorized to defer compliance enforcement of the Thick WHOIS Consensus Policy for six months to 30 November 2018, 30 April 2019 and 31 January 2020, respectively, to allow additional time for the registrars and Verisign to reach agreement on amendments needed to applicable registry-registrar agreements to implement the Policy.
The Thick WHOIS Consensus Policy requires Verisign to begin accepting "Thick" registration data from registrars starting 28 May 2018, registrars to submit Thick registration data to the .COM, .NET, and .JOBS registries for all new domain name registrations starting on 28 October 2018, and the migration of all existing domain registration data from Thin to Thick by 31 July 2019. In preparation to complete the deployment to accept Thick WHOIS data, Verisign, the registry operator for .COM and .NET and the back-end registry services provider for .JOBS, proposed amendments to the registry-registrar agreements for .COM and .NET in order to have the legal framework necessary for Verisign to begin accepting registrar transmission of Thick data to the registry. While the Thick WHOIS Consensus Policy also applies to the .JOBS TLD, the registry operator for .JOBS, Employ Media, did not require changes to the Registry-Registrar Agreement to begin accepting Thick registration data and registrars have already started submitting Thick registration data as per the Policy to Employ Media.
The ICANN organization followed its published Registry-Registrar Agreement amendment procedure and forwarded the proposed amendments to the Registrar Stakeholder Group for review. The Registrar Stakeholder Group expressed concerns about agreeing to the proposed amendments based on issues relating to the European Union's General Data Protection Regulation (GDPR), which takes effect on 25 May 2018. As such, the next step outlined in the procedure is for the ICANN organization to consult with the registry operator and the Registrar Stakeholder Group to resolve these concerns.
ICANN organization has been facilitating discussions between Verisign and the Registrar Stakeholder Group to reach agreement on the proposed amendments to the registry-registrar agreements, but the parties have not yet reached agreement. Additionally, the ICANN organization is investigating whether there are potential compliance issues under its agreements with registries and registrars because of the European Union's General Data Protection Regulation ("GDPR"). The ICANN organization is working with registries, registrars and various stakeholders to understand these potential compliance issues. Based on initial reviews and communications, including with some data protection agencies, ICANN organization understands that compliance with GDPR will have an impact on the WHOIS system.
On 29 June 2017, ICANN organization approved Verisign's request for an extension to an optional milestone date in the Policy for registrars to begin voluntarily submitting Thick data to the registry. This extension was granted to provide Verisign, ICANN, and the Registrar Stakeholder Group with more time to continue discussions in hopes of achieving a resolution, while still taking reasonable steps to comply with the Policy. This optional 1 August 2017 milestone date was later extended to 29 November 2017.
To allow additional time for the registrars and Verisign to reach agreement on amendments needed to the registry-registrar agreements to implement the Policy, the Board is taking action at this time to authorize the ICANN President and CEO to defer compliance enforcement of the Thick WHOIS Policy for six months. This deferred enforcement period will also allow the ICANN organization to continue to engage with the relevant European authorities including the European Union Article 29 Working Party, data protection agencies, contracted parties, and other pertinent stakeholders to gain a better understanding of the relevant aspects of GDPR and how it relates to ICANN's work and the organization's policies and contracts with registries and registrars, including the Thick WHOIS Consensus Policy.
As a result of the Board's action, ICANN organization will begin compliance enforcement of the Policy requirement for registrars to submit all new domain name registrations to the registry as Thick starting on 30 April 2019, and all relevant registration data for existing domain names must be migrated from Thin to Thick by 31 January 2020. The optional milestone date for registrars to begin voluntarily submitting Thick data to the registry will be 30 November 2018.
During this period of deferred compliance enforcement, ICANN organization will continue to work with Verisign and the Registrar Stakeholder Group to facilitate discussions on the proposed amendments. ICANN organization will also provide updates to the community on the progress to come into compliance with the Thick WHOIS Consensus Policy. During this extension period, the Registrar Stakeholder Group has indicated [PDF, 43 KB] that it will "continue to engage with ICANN and Verisign regarding the RRA changes, ICANN's role under the GDPR, and steps needed to implement the Thick WHOIS transition."
The Board's action is not anticipated to have a fiscal impact on ICANN beyond what is already anticipated in the current budget. This resolution is an organizational administrative function for which no public comment is required. This action is in the public interest as it helps to ensure a consistent and coordinated implementation of policies in gTLDs, which is also aligned with ICANN's mission.
Whereas, members of the registrar community have expressed a need for an additional ICANN-designated Registrar Data Escrow agent with regional support capability in the European Union.
Whereas, the ICANN Global Domains Division intends to provide an additional ICANN-designated Registrar Data Escrow agent with regional support in the European Union and an understanding of the European Union General Data Protection Regulation (GDPR).
Whereas, ICANN organization has published a Request For Proposal to identify an additional Registrar Data Escrow Agent.
Whereas, the ICANN org has completed the Request For Proposal and determined that DENIC eG has demonstrated its capability to support registrar data escrow services and is the preferred provider.
Resolved (2018.05.13.07), the Board authorizes the President and CEO, or his designee(s), to enter into, and make disbursements in furtherance of, a new DENIC eG contract for a term of 36 months with total cost not to exceed US$[REDACTED].
Resolved (2018.05.13.08), specific items within this resolution shall remain confidential for negotiation purposes pursuant to Article 3, Section 3.5(b) and (d) of the ICANN Bylaws until the President and CEO determines that the confidential information may be released.
The ICANN organization understands, based upon feedback from the registrar community, the need to enhance the RDE Program and provide an additional ICANN-designated RDE agent with regional support in the European Union.
ICANN org posted a request for proposal on 17 August 2017 to to identify one or more additional ICANN-designated RDE agents with the capability to offer broad global or multiregional support. During this process the ICANN org identified service areas that could be enhanced with an additional ICANN-designated RDE agent and considered those in the RFP evaluation.
As a result, ICANN org identified DENIC eG to have a clear understanding of the needs of the registrar community and the capability to perform at the appropriate service levels. In addition, DENIC eG has broad understanding of the current industry and of the ICANN's multistakeholder model.
This action will have a fiscal impact on the organization, as each additional ICANN-designated RDE agent results in additional fixed cost, but it will provide ICANN org with ICANN-designated RDE agents that enhance diversity and competition.
Resolved (2018.05.13.09), that the Board requests RSSAC, SSAC and RZERC to provide the Board advices on "Updated Plan for Continuing the Root KSK Rollover" and associated plan documents, and report back to the Board by 10 August 2018 if possible.
The plan to roll the DNS root KSK was temporarily paused on 27 September 2017 due to unexpected input that caused the community to question how ready validating resolvers were for the roll that was coming just a few weeks later. For months after that, ICANN org analyzed the data that became available that caused the temporary pause and found that continuing the process of the root KSK roll would be warranted.
Based on that research, ICANN org asked the technical community to recommend a plan of action. The suggestion from that community was that ICANN should proceed with the KSK roll procedure in an orderly fashion.
The community response received by 2 April 2018 was strongly in favor of the published plan (with some suggestions of additional outreach that ICANN org could do before October 2018). Based on the community response, ICANN org created the "Updated Plan for Continuing the Root KSK Rollover" and also revised the original KSK roll plan documents to show which steps had already been taken, and which steps still needed to be taken using the revised dates. These plan document are available at <https://www.icann.org/resources/pages/ksk-rollover-operational-plans>.
The community input on the proposed plan came from a variety of Advisory Committees, Stakeholder Groups, organizations, and individuals, but comments were not received from either RSSAC or SSAC. RSSAC is a respected advisor on stability of the root zone, and SSAC is a respected advisor on matters that relate to the security and stability of the DNS. The Board is taking action at this time to request input from the RSSAC and the SSAC about the Updated Plan for Continuing the Root KSK Rollover so that this input may be taken into account as part of the Board's deliberations on whether or not to approve the Updated Plan.
The request for input from the RSSAC and SSAC is not anticipated to have any fiscal impact on the ICANN organization beyond that which has already been accounted for in the budgeted resources necessary for ongoing support of the RSSAC and SSAC.
All members of the Board present voted in favor of Resolutions 2018.05.15.01, 2018.05.13.02, 2018.05.13.03, 2018.05.13.04, 2018.05.13.05, 2018.05.13.06, 2018.05.13.07, 2018.05.13.08, and 2018.05.13.09. The Resolutions carried.
Ron da Silva, Chair of the Board Risk Committee, introduced the agenda item. Ron explained that this resolution relates to a request from the Registries Stakeholder Group to refund the $5,000 trademark clearinghouse one-time registry rights protection mechanism access fee.
Christine Willett, VP of gTLD Operations, provided additional background information relevant to the resolution. The registry operators were required to pay a one-time US $5,000 fee for connectivity and access to the trademark clearinghouse to support sunrise and claims operations. The $5,000 was only specified in the registry agreement which was published and finalized in July of 2013. Although the version of the Applicant Guidebook published before the opening round of application submission generally referenced a fee to connect, but did not identify a specific amount. The $5,000 fee was paid by over 1200 contracted and delegated registry operators. The fees were passed along to the administrator of the trademark database. This request is to refund those fees from the ICANN New gTLD Program proceeds, and would amount to a total of $6.2 million. At present, it is anticipated that this would only be refunded to those operators who have actually paid the fees. Anyone who did not pay the fee will not be reimbursed. Following this resolution, ICANN organization will cease charging a $5,000 fee to any further operators who become contracted and delegated under the program.
Whereas, the Trademark Clearinghouse (TMCH) is a global repository for trademark data established by ICANN org in March 2013.
Whereas, the need for the TMCH was foreseen during the development of the New gTLD Program and the Applicant Guidebook (AGB).
Whereas, the TMCH fees for registries are defined in Section 6.4 of the Registry Agreement (RA), which states that a registry is to pay a one-time rights protection mechanism (RPM) access fee of $5,000 and also a $0.25 transactional fee per Sunrise Registration and Claims registrations.
Whereas, in October 2017, the RySG requested a refund of the one-time RPM access fee of $5,000 for each registry that accessed the TMCH from remaining New gTLD Program funds.
Whereas, the ICANN Board has determined that while the concept for the TMCH was foreseen in the AGB, the pricing and fees were not. The $5,000 fee was first defined in the 2013 version of the RA, and was not specified in the RA version included with the AGB or the version made available prior to the application period.
Whereas, the New gTLD Program is nearly complete, and there is more clarity surrounding the availability of the remaining New gTLD Program funds, but it could take several additional years before all risks and liabilities are fully known and quantified.
Resolved (2018.05.13.10), the ICANN Board directs the President and CEO or his designee(s) to take all steps necessary to provide a refund of $5,000, as soon as practicable, to the contracted registries or registry operators (including those that have terminated their contracts or whose TLD delegation has been revoked) that have paid to ICANN the one-time RPM access fee as defined in Section 6.4 of the RA.
Fifteen Board members voted in favor of Resolution 2018.05.13.10. Becky Burr abstained. The Resolution carried.
What are the options being considered? What factors did the Board find significant?
In considering the RySG request, the Board contemplated a range of options, including maintaining the status quo (no refund), refunding now, or deferring consideration of the request until the end of the New gTLD Program. In weighing these options, the Board considered a number of factors, including: Is providing a refund consistent with the AGB or RA? Is it consistent with other New gTLD Program Funding Approaches? Does providing a refund now allow ICANN org to account for other risks/costs?
With regard to not providing a refund, the Board considered that the TMCH fee provision seeks to cover costs associated with providing TMCH services. Indeed, the primary argument in favor of this approach is that the concept for the TMCH was foreseen in the AGB, and the RA—agreed to by the registries—contains provisions for the TMCH fees.
However, the Board also considered that, while the concept for the TMCH was foreseen in the AGB, the pricing and fees were not. The $5,000 fee was first defined in the 2013 version of the RA, and was not specified in the RA version included with the AGB or the version made available prior to the application period. Additionally, funding the TMCH by collecting pass-through fees from registry operators is not consistent with the approach used to fund other operational services in support of the New gTLD program operations. Other aspects of the program were paid for directly out of application fees.
As such, the Board considered the option of providing the refund, and whether that could be done now or should be done at the close of the New gTLD Program. The Board considered that it may be prudent to wait to consider this request until the close of the New gTLD Program. This option allows for completion of the risk assessment and quantification effort currently underway, prior to providing the refund to the registries. If—at the close of the New gTLD Program—it has been determined that all risks and other costs have been accounted for, then the Board could consider at that time to provide a refund of the $5,000 RPM access fee to all registries. The Board also considered that many requests for refunding or offsetting fees have been and/or will be received and that other aspects of ICANN org's New gTLD Program operations that may require additional funding over the next few years.
However, the Board also considered that the New gTLD Program is largely complete, and there is already more clarity surrounding the availability of New gTLD Program funds and that it could require several additional years before all risks and liabilities are fully known and quantified. The Board also weighed, as noted above, that the fees were first defined in the 2013 version of the RA, and not in the RA version included with the AGB or made available prior to the application period. Additionally, refunding the fees is also consistent with the approach used to fund other operational services in support in the New gTLD Program, as it would be using application fees to cover the cost of the TMCH for registries. For these reasons, the Board has determined that the option to refund the fee to the registries is the most reasonable.
The Board's action will have a fiscal impact on ICANN. The funding of the refund is expected to come from the unspent portion of the New gTLD program application fees. The estimated amount of these new gTLD program funds remaining available to cover for "hard-to-predict" costs (including risks), in addition to the evaluation expenses remaining to be incurred, is expected to be $81,609,000, resulting from the most recent projections produced as part of the Draft FY19 Operating Plan and Budget. The total refund amount of $6,210,000 would come to reduce by as much the estimated amount of funds remaining available to cover for "hard-to-predict" costs.
Taking this action will help support ICANN's mission to ensure the stable and secure operation of the Internet's unique identifier systems. This action benefits the ICANN community as it provides transparency regarding use of the New gTLD Program remaining funds.
Becky Burr introduced the agenda item. Becky explained that ICANN has been working for over a year with the community stakeholders and users of WHOIS, governments, and data protection authorities, to ensure that we have a path for GDPR compliance on the 25th of May when the General Data Protection Regulation (GDPR), comes into full force and effect. Consistent with that, ICANN published a proposed interim compliance model known as the Calzone Model, which would provide access to certain non-personal data in a public setting and then access to non-public registration data containing personal information for legitimate purposes. Before publishing the Calzone Model, ICANN solicited and received comments from affected stakeholders and members of the community, contracted parties, the Governmental Advisory Committee, and also consulted with the Article 29 Working Party on issues of implementation and adoption that model.
ICANN also signaled that it would be looking to adopt a temporary specification and policy to implement necessary changes to ensure that the contracted parties continue to collect and make available WHOIS data as permitted by the GDPR. On 11 May 2018, ICANN org presented a draft temporary specification to the Board and community for consideration.
Becky noted that the Board spent most of its past two days in very detailed conversation discussing not only the specific provisions of the proposed temporary specification, but also discussing potential alternatives to a temporary specification, the implications of adopting a temporary specification, and future steps towards adoption. The Board has provided significant input to ICANN org on the proposed temporary specification.
While the Board does not feel ready to adopt a temporary specification at this point as its discussions are ongoing, the Board does intend to consider adoption of that on or about 17 May 2018.
The Board asked ICANN org to revise the proposed temporary specification and publish it so that the community has the benefit of being able to view an updated document and discuss prior to Board action. Additionally, the Board wants to have the time to make sure that ICANN org has carefully included the Board's inputs as well as to understand how ICANN org reviewed, considered, and included as appropriate other items raised by the ICANN community.
Becky thanked ICANN org for the enormous amount of work that has gone into producing the proposed resolution at hand.
The Chair echoed Becky's sentiments.
Whereas, the European Union's General Data Protection Regulation (GDPR) is a set of rules adopted by the European Parliament, the European Council and the European Commission that imposes new obligations on all companies and organizations that collect and maintain any "personal data" of residents of the European Union, as defined under EU data protection law. The GDPR will take full effect on 25 May 2018.
Whereas, the GDPR has given new prominence and urgency to the long-standing debate about WHOIS and data protection and privacy.
Whereas, over the past several months ICANN org has consulted with community stakeholders, contracted parties, European data protection authorities, legal experts, and interested governments to understand the potential impact of the GDPR to personal data that participants in the gTLD domain name ecosystem collect, display and process (including registries and registrars) pursuant to ICANN contracts and policies. ICANN's policies are set by the ICANN community.
Whereas, through an iterative process and with feedback from the community, ICANN org developed a proposed interim model for how ICANN and gTLD registries and registrars could continue to comply with ICANN contractual requirements and community-developed policies in relation to the GDPR (the "Proposed Interim Compliance Model").
Whereas, ICANN org requested and has received guidance from the Article 29 Working Party concerning the Proposed Interim Compliance Model, including areas where ICANN has received governmental advice and input reflecting differing views.
Whereas, the GAC provided advice to the Board in its San Juan Communiqué (15 March 2018) concerning the Proposed Interim Compliance Model. The advice was the subject of an exchange between the Board and the GAC to clarify the Board's understanding of the advice.
Whereas, ICANN org communicated with European data protection authorities and requested adequate time for gTLD registries and registrars to implement the Proposed Interim Compliance Model once additional clarification from the data protection authorities was incorporated into the Proposed Interim Compliance Model.
Whereas, ICANN is continuing to discuss with the ICANN community proposed accreditation models.
Whereas, to cause compliance with the Proposed Interim Compliance Model, ICANN org drafted a temporary specification utilizing the procedure for Temporary Policies established in the Registry Agreement and the Registrar Accreditation Agreement (the "Temporary Specification for gTLD Registration Data" or "Temporary Specification"). A proposed Temporary Specification was shared with the Board and community on 11 May 2018.
Whereas, adopting a Temporary Specification can contribute to the Board's upholding the global public interest. Without a unified policy solution in place at the time that the GDPR goes into full effect, there is a real risk of fragmentation in the collection, processing, and availability of gTLD Registration Data as Registry Operators and Registrars take different paths to bring themselves into compliance with the law. A Temporary Specification instead sets out the unified manner through which Registry Operators and Registrars are expected to collect, process, display and provide access to this data. ICANN org can then enforce compliance against its contracts in case these requirements were not met. A fragmented system would be counter to current WHOIS practice and may cause harm.
Whereas, the Board, at its Vancouver workshop, has engaged in a substantial and robust review over two days regarding a proposed Temporary Specification, including identification of questions and potential improvements, and wants to share with the community the updates to a proposed Temporary Specification generated as a result of the Board's review to date.
Whereas, during May 2018, the Board has received multiple letters from parts of the ICANN community regarding the contents of a draft Temporary Specification.
Whereas, the Board has communicated to the GAC that the Board made a preliminary determination that its approach in a proposed Temporary Specification is inconsistent or could be viewed as inconsistent with certain items of GAC advice in the San Juan Communiqué. The Board provided a scorecard to reflect items of the GAC's advice that the Board may reject because of this.
Whereas, ICANN org continues to engage with the Article 29 Working Party to seek clarity on guidance provided by the Article 29 Working Party about the Proposed Interim Compliance Model.
Resolved (2018.05.13.11), the Board intends to move to a decision on the adoption of a proposed Temporary Specification on gTLD Registration Data (pursuant to the procedures in the Registry Agreement and Registrar Accreditation Agreement concerning the establishment of temporary policies) on or about 17 May 2018. The Board intends to use this additional time to confirm that appropriate modifications are incorporated into a proposed Temporary Specification prior to considering adoption. Upon adoption, a proposed Temporary Specification would be effective for a 90-day period beginning 25 May 2018, and the Board would reaffirm its temporary adoption every 90 calendar days for a total period not to exceed one year.
Whether the modifications in a proposed Temporary Specification to existing requirements concerning the processing of personal data in registration data are justified and an immediate establishment of a proposed Temporary Specification is necessary to maintain the stability or security of Registrar Services, Registry Services or the DNS or the Internet.
Whether a proposed Temporary Specification is as narrowly tailored as feasible to achieve the objective to maintain the stability or security of Registrar Services, Registry Services or the DNS or the Internet.
Resolved (2018.05.13.13), the global public interest is served by the implementation of a unified policy governing aspects of the gTLD Registration Data when the GDPR goes into full effect.
Resolved (2018.05.13.14) the Board directs the ICANN President and CEO, or his designee(s), to continue to support the Board in discussion across the ICANN community regarding the refinements made prior to the Board's consideration of a proposed Temporary Specification for adoption. The ICANN President and CEO, or his designee(s), are directed to share with the ICANN community the updates to a proposed Temporary Specification generated as a result of the Board's review to date.
All members of the Board present voted in favor of Resolutions 2018.05.13.11, 2018.05.13.12, 2018.05.13.13, and 2018.05.13.14. The Resolutions carried.
The European Union's General Data Protection Regulation (GDPR) will go into effect on 25 May 2018. The GDPR is a set of rules adopted by the European Parliament, the European Council and the European Commission that will impose new obligations on all companies and organizations that collect and maintain any "personal data" of residents of the European Union, as defined under EU data protection law. The GDPR impacts how personal data is collected, displayed and processed among participants in the gTLD domain name ecosystem (including registries and registrars) pursuant to ICANN contracts and policies. Modifications need to be made prior to 25 May to allow ICANN and gTLD registries and registrars could continue to comply with ICANN contractual requirements and community-developed policies in relation to the GDPR. Though there has been significant work across the ICANN community to reach a compliance model, ICANN-adopted policies need to be updated to allow compliance with the GDPR. A full community-developed consensus policy is not yet available. Without a unified applicable policy in place, there will be fragmentation in how ICANN's contracted parties implement their own compliance programs in relation to gTLD Registration Data. As such, a unified applicable policy is needed in place prior to 25 May 2018, and doing so is in the public interest. The public interest is not served if the ICANN Board fails to take action on this critical issue.
ICANN org's agreements with registries and registrars require compliance with Board-adopted temporary policies or specifications. To develop a temporary policy or specification, at least two-thirds of the Board must vote to approve the temporary specification, and the changes in the specification must be justified and "necessary to maintain the stability or security of Registrar Services, Registry Services or the DNS or the Internet." The temporary policy or specification must be as narrowly tailored as feasible to achieve those objectives.
ICANN org, in consultation with the Board, has been exploring the possibility of a temporary policy or specification as a mechanism to implement the Interim GDPR Compliance Model. A draft of a proposed Temporary Specification for gTLD Registration Data ("Temporary Specification") was released to the Board and the community on 11 May 2018. That proposed Temporary Specification is drafted to establish temporary requirements for how ICANN and gTLD registries and registrars will continue to comply with existing ICANN contractual requirements and community-developed policies in relation to the GDPR.
The Board has been in workshop since 11 May 2018, and has used the time since the publication of a proposed Temporary Specification to engage in substantial discussion with ICANN organization, which has resulted in additional proposed changes. Also since the 11 May 2018 publication, the ICANN Board has received letters from multiple parts of the ICANN community, regarding the contents of the draft Temporary Specification.
The Board has identified that because of the significance of the Board approving a Temporary Specification, it is appropriate for the Board to take additional time prior to adoption, both for the Board's review and to have opportunities to discuss with the ICANN community on the contents of a proposed Temporary Specification. The Board has also identified that taking action on a Temporary Specification is within the public interest, because of the need for a uniformly applicable policy drafted to achieve compliance with the GDPR. It is important that a Temporary Specification be adopted so that it can be in force on 25 May 2018.
The work towards development of a Temporary Specification is consistent with ICANN's mission "[…] to ensure the stable and secure operation of the Internet's unique identifier systems […]". As one of ICANN's primary roles is to be responsible for the administration of the topmost levels of the Internet's identifiers, facilitating the ability to identify the holders of those identifiers is a core function of ICANN.
ICANN's mission to ensure the security and stability of the operation of the Internet's system of unique identifiers has led to the obligations associated with providing WHOIS that are in ICANN consensus policies and contracts that ICANN has with registries and registrars. These policies and contractual obligations govern the collection, retention, escrow, transfer, and display of WHOIS registration data, which includes contact information of natural and legal persons as well as technical information associated with a domain name. Through these policies and contracts, ICANN sets the minimum requirements for WHOIS, ensuring the availability of WHOIS information to mitigate attacks that threaten the stable and secure operation of the Internet and to serve the public service uses above.
WHOIS is not a single, centrally managed database. Rather, registration data is held in disparate locations and administered by multiple registries and registrars. They each set their own conventions for the WHOIS service, consistent with the minimum requirements established in their contracts with ICANN.
Many gTLD registries and registrars are concerned about whether ICANN policies and contracts requiring them to collect, create, retain, escrow, and publish a variety of data elements related to registry/registrar operations, domain name registrations, and registrants are in conflict with the GDPR.
To ensure continued availability of WHOIS to the greatest extent possible and other processing of gTLD registration data while complying with the GDPR and avoid fragmentation of the WHOIS, a proposed Temporary Specification will provide a single, uniform interim model to ensure a common framework for registration data directory services. To continue this public service and maintain the security and stability of the Internet, a proposed Temporary Specification will allow for continued provision of WHOIS services via ICANN's contracts with domain name registries and accredited registrars.
As required when a temporary policy or specification is adopted, upon adoption, the Board will also take action to implement the consensus policy development process. The Board will consult with the GNSO Council on potential paths forward (e.g. Expedited Policy Development Process) for considering a proposed Temporary Specification in a consensus policy development process which must be concluded in a one year time period.
The Board is aware that some parts of the ICANN community has begun work to define an Accreditation Model for access to personal data in Registration Data. The Board encourages the community to continue this work, taking into account any advice and guidance that Article 29 Working Party or European Data Protection Board might provide on the topic.
The Board is also taking action today to confirm that Board will continue to move forward with the Bylaws Consultation meeting between the GAC and the Board to address elements of a proposed Temporary Specification that are inconsistent or could be viewed as inconsistent with items of the GAC advice in the San Juan Communiqué. Article 12, Section 12.2(a)(ix) of the ICANN Bylaws permits the GAC to "put issues to the Board directly, either by way of comment or prior advice, or by way of specifically recommending action or new policy development or revision to existing policies." The Bylaws require the Board to take into account the GAC's advice on public policy matters in the formulation and adoption of the polices. If the Board decides to take an action that is not consistent with the GAC advice, it must inform the GAC and state the reasons why it decided not to follow the advice. Any GAC advice approved by a full consensus of the GAC (as defined in the Bylaws) may only be rejected by a vote of no less than 60% of the Board, and the GAC and the Board will then try, in good faith and in a timely and efficient manner, to find a mutually acceptable solution. Taking steps to move forward with the Board-GAC Bylaws Consultation process will have a positive impact on the community because it will assist with resolving the advice from the GAC concerning ICANN's approach for enforcing compliance with agreements with registries and registrars in relation to the GDPR.
The Board's action today is intended to support the continued security, stability or resiliency of the DNS, as it provides some certainty to the ICANN community that a Temporary Specification will be in place prior to 25 May 2018. Upon adoption, a proposed Temporary Specification will assist in maintaining WHOIS to the greatest extent possible while the community works to develop a consensus policy. While not initiated by today's decision, the expected initiation of focused consensus policy development work to consider a proposed Temporary Specification is anticipated to have an impact on financial resources as the research and work progresses. If the resource needs are greater than the amounts currently budgeted to perform work on WHOIS- and GDPR-related issues, the President and CEO will bring any additional resource needs to the Board Finance Committee for consideration, in line with existing fund request practices.
Chris Disspain, Chair of the Board Accountability Mechanisms Committee (BAMC), introduced the agenda item. Chris provided a summary of Reconsideration Request 17-5, which was filed by community applicant DotKids Foundation challenging ICANN organization's decision to take the Requestor's .KIDS community generic top-level domain (gTLD) application off hold before the Community Priority Evaluation (CPE) Process Review was completed. The Requestor was invited to and participated in CPE. The Requetor did not prevail in CPE. In 2016, the Requestor sought reconsideration of the CPE Provider's evaluation of its community application. That reconsideration request was denied. In 2017, the ICANN Board initiated the CPE Process Review. As part of the Review, the Board Governance Committee (BGC) decided that place on hold all the then pending reconsideration requests relating to the CPE process pending completion of the CPE Process Review. The Requestor did not have a pending reconsideration request at the time and therefor its application and the .KIDS/.KID contention was not placed on hold. As a result, the .KIDS/.KID contention was invited to participate in an ICANN Auction (Auction). Two days before the deadline to submit information for the Auction, the Requestor filed Request 17-5. The filing of Request 17-5 resulted in placing the Requestor' application and the .KIDS/.KID contention set on hold.
On 15 March 2017, the Board accepted the findings of the CPE Process Reviews, declared CPE Process Review completed, concluded that there would be no changes to the CPE process for the current round and directed the BAMC to resume consideration of the Reconsideration Requests relating to the CPE process that were placed on hold pending completion of the Review.
The BAMC has considered Request 17-5 and recommended that reconsideration be denied on the basis that that the Requestor has received the relief requested and therefore Request 17-5 is moot as the CPE Process Review has been completed.
Becky Burr abstained from consideration of this matter noting potential conflicts.
Whereas, the Requestor did not have a pending accountability mechanism regarding the CPE process during the CPE Process Review and therefore, its application and the .KID/.KIDS contention set were free proceed through the application and contention resolution process as called for in the Applicant Guidebook.
Whereas, on 15 March 2018, in Resolutions 2018.03.15.08 through 2018.03.15.11, the Board: acknowledged and accepted the findings set forth in the CPE Process Review Reports; declared that the CPE Process Review was complete; concluded that, as a result of the findings in the CPE Process Review Reports there would be no overhaul or change to the CPE process for this current round of the New gTLD Program; and directed the Board Accountability Mechanisms Committee (BAMC) to move forward with consideration of the remaining Reconsideration Requests relating to the CPE process that were placed on hold pending completion of the CPE Process Review.
Whereas, the BAMC previously determined that Request 17-5 is sufficiently stated and sent the Request to the Ombudsman for review and consideration in accordance with Article 4, Section 4.2(j) and (k) of the ICANN Bylaws.
Whereas, the BAMC has carefully considered the merits of Request 17-5 and all relevant materials and recommended that Request 17-5 be denied on the basis that that the Requestor has received the relief requested and therefore Request 17-5 is moot as the CPE Process Review has been completed; and that the Requestor's claims are unsupported because ICANN organization adhered to established policies and procedures when it took the .KID/.KIDS contention set off hold after the resolution of all accountability mechanisms affecting the contention set. The Board agrees.
Whereas, the Requestor did not file a rebuttal to the BAMC Recommendation on Request 17-5 within the allotted time under Article 4, Section 4.2(q) of the Bylaws.
Resolved (2018.05.13.15), the Board adopts the BAMC Recommendation on Request 17-5 [PDF, 146 KB].
Fifteen Board members voted in favor of Resolution 2018.05.13.15. Becky Burr abstained. The Resolution carried.
The Board previously directed the President and CEO or his designees to undertake a review of the "process by which ICANN [organization] interacted with the [Community Priority Evaluation] CPE Provider, both generally and specifically with respect to the CPE reports issued by the CPE Provider" as part of the Board's oversight of the New gTLD Program (Scope 1).8 The Board's action was part of the ongoing discussions regarding various aspects of the CPE process.
Thereafter, the BGC determined that the review should also include: (i) an evaluation of whether the CPE criteria were applied consistently throughout each CPE report (Scope 2); and (ii) a compilation of the research relied upon by the CPE Provider to the extent such research exists for the evaluations that are the subject of pending Reconsideration Requests relating to the CPE process (Scope 3).9 Scopes 1, 2, and 3 are collectively referred to as the CPE Process Review. The BGC determined that the following pending Reconsideration Requests would be on hold until the CPE Process Review was completed: 14-30 (.LLC),10 14-32 (.INC),11 14-3312 (.LLP), 16-3 (.GAY), 16-5 (.MUSIC), 16-8 (.CPA), 16-11 (.HOTEL), and 16-12 (.MERCK).13 The Requestor did not have a pending reconsideration request regarding the CPE process when the CPE Process Review began and therefore, its application and the .KID/.KIDS contention set proceeded through the application process and nothing was placed on hold.
On 2 October 2017, ICANN organization invited the Requestor to an ICANN Auction for the .KID/.KIDS contention set.14 Between October and December 2017, ICANN organization sent the Requestor several reminders to submit certain requested information by an 8 December 2017 deadline in order to participate in the ICANN-facilitated Auction.
The full factual background is set forth in the BAMC Recommendation [PDF, 146 KB], which the Board has reviewed and considered, and which is incorporated here.
On 5 April 2018, the BAMC recommended that Request 17-5 be denied on the basis that: (1) the Requestor has received the relief requested and therefore Request 17-5 is moot as the CPE Process Review has been completed; and (2) ICANN organization complied with established policy(ies) when it took the .KID/.KIDS contention set off hold after the resolution of all accountability mechanisms affecting the contention set and therefore Request 17-5 does not set forth a proper basis for reconsideration for the reasons set forth in the BAMC Recommendation [PDF, 146 KB], which are incorporated here.
Whether ICANN organization complied with applicable Commitments, Core Values, and established policies when it took the .KID/.KIDS contention set off "Hold" status and resumed processing the contention set in accordance with the New gTLD Program by scheduling an ICANN Auction after the Requester's Reconsideration Request 16-6 was denied in July 2016.
The Board has reviewed and thoroughly considered Request 17-5 and all relevant materials, including the BAMC Recommendation [PDF, 146 KB]. The Board finds the analysis set forth in the BAMC Recommendation [PDF, 146 KB], which is incorporated here, to be sound.
The Requestor has Received the Relief Requested, and Therefore Request 17-5 is Moot.
On 13 December 2017, while the .KID/.KIDS contention set was on hold pending resolution of Request 17-5, ICANN organization published three reports in connection with the CPE Process Review.21 On 15 March 2018, the ICANN Board acknowledged and accepted the findings set forth in the three CPE Process Review reports, and declared that the CPE Process Review was complete.22 Accordingly, the relief requested in Request 17-5 has been rendered moot by virtue of the Board's Resolution 2018.03.15.10 declaring that the CPE Process Review has been completed.
ICANN Complied with Its Commitments When it Moved Forward with Processing the .KID/.KIDS Contention Set By Scheduling an Auction.
The Requestor suggested that other community applicants "not explicitly identified in the CPE process review (e.g., the .SPA CEP/IRP by Donuts) have been put on hold we believe due to the ongoing CPE process review," such that the Requestor asserts that taking its application and the .KID/.KIDS contention set off hold before the CPE Process Review is complete "is therefore counter to the established processes."23 As discussed in detail in the the BAMC Recommendation [PDF, 146 KB], which is incorporated herein, the Requestor's position conflates multiple issues and relies on inaccurate facts. Further, the Requestor does not indicate which "established processes" it believes ICANN organization violated by taking the .KID/.KIDS contention off hold following the resolution of Request 16-6 in July 2016,24 nor does the Requestor provide any evidence of such a process violation, because none exists.
Ultimately, the Requestor has not identified any element of ICANN's Mission, Commitments, Core Values, or established ICANN policy(ies) violated by ICANN organization's correspondence with the Requestor, as none were violated. Accordingly, reconsideration is not warranted.
Pursuant to Article 4, Section 4.2(q), the Requestor has 15 days from the receipt of the BAMC's Recommendation on Request 17-5 to submit a rebuttal, which expired on 20 April 2018. On 16 April 2017, the Requestor indicated that it intended to file a rebuttal. (See Attachment D to the Reference Materials.) However, no rebuttal was filed by the 20 April 2018 deadline, and none has been filed to date.
While the Bylaws specify that Board's final decision shall be made within 135 days of initial receipt of the Reconsideration Request by the BAMC, in this instance, the 135 days expired on same day at the deadline for the Requestor to submit a rebuttal. The Board previously expected to to consider Request 17-5 at a meeting on on 17 April 2017, before the 135-day deadline. However, as the Requestor indicated that he intended to submit a rebuttal, the Board did not take up this item on 17 April 2018 meeting, as it was important to issue a final determination on a full and complete record and allow the Requestor the opportunity to submit its rebuttal. As such, this is the first practical opportunity that the Board has to consider this matter.
The President and CEO provided an updated on the status of engagement efforts between the Amazon Cooperation Treaty Organization's member states and the Amazon corporation related to the .AMAZON generic top-level domain application, as committed in response to GAC Advice in its Abu Dhabi Communiqué.
1 For the draft January 2012 version of the AGB, see: https://newgtlds.icann.org/en/applicants/agb/guidebook-full-11jan12-en.pdf [PDF, 3.8 MB].
2 See: https://www.icann.org/en/system/files/correspondence/diaz-to-atallah-03oct17-en.pdf [PDF, 127 KB].
3 Request 17-5, § 2, at Pg. 2.
5 Update on Application Status and Contention Sets, available at https://newgtlds.icann.org/en/applicants/advisories/application-contention-set-14mar14-en.
6 Prior to 22 July 2017, the BGC was designated by the ICANN Board to review and consider Reconsideration Requests pursuant to Article 4, Section 4.2 of the Bylaws. See ICANN Bylaws, 1 October 2016, Art. 4, § 4.2(e), available at https://www.icann.org/resources/pages/bylaws-2016-09-30-en#article4.
7 Attachment 1, at Pg. 1-3.
10 Reconsideration Request 14-30 was withdrawn on 7 December 2017. See https://www.icann.org/en/system/files/files/reconsideration-14-30-dotregistry-request-redacted-07dec17-en.pdf [PDF, 600 KB].
11 Reconsideration Request 14-32 was withdrawn on 11 December 2017. See https://www.icann.org/en/system/files/files/reconsideration-14-32-dotregistry-request-redacted-11dec17-en.pdf [PDF, 626 KB].
12 Reconsideration Request 14-33 was withdrawn on 15 February 2018. See https://www.icann.org/en/system/files/files/reconsideration-14-33-dotregistry-request-redacted-15feb18-en.pdf [PDF, 42 KB].
14 Attachment 1, at Pg. 3.
15 Request 17-5, § 2, at Pg. 2.
16 Update on Application Status and Contention Sets, available at https://newgtlds.icann.org/en/applicants/advisories/application-contention-set-14mar14-en.
19 Request 17-5, § 8, at Pg. 6.
20 See Application Details, "Application Status," available at https://gtldresult.icann.org/applicationstatus/applicationdetails/161; see also http://newgtlds.icann.org/en/applicants/auctions.
23 Request 17-5, § 7, at Pg. 6.
25 ICANN Bylaws, 22 July 2017, Art. 1, § 1.2(a)(v).
26 Request 17-5, § 4, at Pg. 2.

References: § 2
 Art. 4
 § 4
 § 2
 § 8
 § 7
 Art. 1
 § 1
 § 4