Purpose

·         Remove burden from entity providing disclosure 

·         Provide code of contract or series of contracts

·         Spread liability (without diminishing protections for data subjects)

·         Provide process pathway to track data / monitoring

Who serves as accreditor

·         Entity develops request or proposal

·         Competent authority with legal basis; demonstrates consistency with Article 42 and 43

·         EPDP sets outline and principles and assessment activities

Accreditor

Tasks

Authentication – confirm identity

Establish preliminary determination on lawful basis

Consider how to manage volume requests

NOTE: Authorization process is not necessarily with the accreditor. Sub-team will consider whether Authorization should rest with another entity or with the accreditor or unique criteria

Role: Certifying Accreditor

No Agreement, options discussed:

·         ICANN – difficult because they process of data 

·         Independent Data Trust

·         DPA

Role: Accreditation Body(ies)

·         WIPO

·         Law enforcement­–each country would have one entry point. i.e. in U.S. it might be FBI or in other countries, it would be the national country.

·         Europol and Interpol–agree this is not possible for law enforcement agencies, at least not for certain countries

·         Limit # of accrediting bodies to be able to manage system

·         Create track for entities that are not accredited

Role: Auditor

Agree that auditing is needed; unclear who should conduct audits

Role & Process: De-Accreditation

EPDP agrees that de-accreditation should be a component

Accreditor must be compliant with DPAs

Need to establish how to do this, such as:

·         Safeguards, prevent entity from setting up shop next door

·         Remedial action, i.e. may not shut down immediately, some corrective action is possible

Decision to Disclose

Joint Controller

Who Balances?

Entity with Legal Basis

Options: Who Decides?

{Note: EPDP did not decide on preferred option in LA. Group will consider options and potentially write a letter to Board to frame questions}

JC Agreement 

§  Responsibilities identified in agreement; CPs cannot increase their risk

§  Must be correct to manage liability / risk

§  Liability is clearly defined (ICANN or CPs)

§  Establish Joint and Severable Liability

Contracted Parties

ICANN

Independent Data Trust

PROS/CONS

+ Most accountable to data subject

+ Has physical access to data

- Lack of consistency with hundreds of CPs applying policy to make decision to disclose

- ICANN unable to indemnify CPs (maybe, shared risk possible)

+ Bird & Bird Memo states that CPs are controllers and retain liabilities

PROS/CONS

+ Reduce risk of liability to CPs

+ Provides consistency

+ One party that performs decision and auditing role might be preferable

+ Build body of work / decisions consistently

Considerations for all Options

Standardized clearing house

Timely Response

Insurance to alleviate risk or establishing risk fund may be possible

ICANN sets rules so it has to be a joint controller

SSAD 

Not required by law

Goal = predictable

Easier

Set Up

Cost of Providing and Making Available an Investigative Tool

Cost Sharing

Share cost across the system

Direct and indirect beneficiaries

Share costs across the system

CPs contribute intangible resources via in-house staff, etc. 

Use

Look at other Models

ANTICIPATED BENEFITS: Certainty to Process ­ Cost Savings

SSAC

All participants have costs:

• Central system = ICANN
• CPs: receive, review, reply
• Requestors: accreditation, query-making

Issue subsidies? Letting market work

RDS as basic service / core service

Passing costs to requestors: May burden victims.

GAC

1. Any financing model should not be profit/revenue generating
2. System should not provide financial disincentives to requestors acting on behalf of public authorities

CPH

1. Any financial model should not be profit/revenue generating
2. Cost Neutral and borne by beneficiaries
3. Not a hidden tax / pass through charge to registrants / data subject
4. Integration costs represent CPH contributions

ALAC

Consider:

·         Costs

·         Cost Savings

·         Accreditation costs borne by users

·         Charge / Requestor: consideration of public interest exception

·         Chares passed through to registrants seems inevitable (it’s part of the infrastructure)

NCSG

Costs [potential funder]

1. Capital / set up costs [Large Users]
2. Accreditation costs [Flat fee per time period]
3. Usage costs (per request) [per request fee, cost-based. Higher for non-accredited]
4. Insurance costs [unsure]
5. Audit / enforcements [unsure, ICANN / DPAs?]

CSG

OK for cost-sharing to vary by volume, requestor type, legal obligation, etc.

Fees on per-request basis are problematic

Must not create disincentives to costs reductions