08:13:37 <RRSAgent> RRSAgent has joined #dpvcg
08:13:37 <RRSAgent> logging to https://www.w3.org/2018/12/04-dpvcg-irc
08:14:39 <Niklas> soon!
08:14:46 <Niklas> we haven't started yet.
08:14:55 <harsh> rigo is setting up webex
08:15:47 <AxelPolleres> AxelPolleres has joined #dpvcg
08:16:12 <rigo> rigo has joined #dpvcg
08:16:15 <AxelPolleres> chair: Axel Polleres
08:16:29 <rigo> rrsagent, please set log public
08:16:29 <AxelPolleres> scribe: javier
08:16:35 <harsh> scribe: harsh
08:16:35 <rigo> rrsagent, pointer
08:16:35 <RRSAgent> See https://www.w3.org/2018/12/04-dpvcg-irc#T08-16-35-1
08:16:56 <rigo> rrsagent, please draft minutes
08:16:56 <RRSAgent> I have made the request to generate https://www.w3.org/2018/12/04-dpvcg-minutes.html rigo
08:17:06 <rigo> trackbot, start meeting
08:17:08 <harsh> Axel: Summary of yesterday - we talked a lot about personal data and purposes, and collected/assigned some actions.
08:17:09 <trackbot> RRSAgent, make logs public
08:17:11 <special> Axel summarises the work from yesterday, mainly data and purposes
08:17:12 <trackbot> Meeting: Data Privacy Vocabularies and Controls Community Group Teleconference
08:17:12 <trackbot> Date: 04 December 2018
08:17:51 <harsh> Fajar: created a table-based layout for purposes for action at https://www.w3.org/community/dpvcg/wiki/Purposes_for_handling_Personal_Data
08:18:34 <special> Harsh:What is top-level? A class without a parent?
08:18:51 <special> Fajar: In principle that's it, but we have to see case by case
08:19:08 <special> Axel: what is usage?
08:19:22 <special> Fajar: If it is used in a use case
08:19:36 <special> Axel: It could be good to have one example of each
08:20:25 <Javier> Javier has joined #dpvcg
08:20:26 <AxelPolleres> each purpose should have at least one example use case (from the existing ones or otherwise describe one possible scneario, ideally based on a real service)
08:20:31 <harsh> scribe: Javier
08:20:42 <Bud> Bud has joined #dpvcg
08:20:59 <Javier> Axel: next point would be kinds of processing, if we follow the agenda
08:21:23 <Javier> Harsh: We could start with means of legitimation for personal data processing
08:21:34 <rigo> simonstey: webexroom is open: https://mit.webex.com/meet/rigo
08:21:51 <AxelPolleres> topic: Means of legitimation for personal data processing
08:22:17 <harsh> mail by Eva on legal basis https://lists.w3.org/Archives/Public/public-dpvcg/2018Nov/0030.html
08:22:37 <harsh> another https://lists.w3.org/Archives/Public/public-dpvcg/2018Nov/0020.html
08:23:56 <AxelPolleres> eva: presenting her diagram from https://lists.w3.org/Archives/Public/public-dpvcg/2018Nov/0030.html
08:24:17 <Javier> Eva: First step is to check if personal data is involved
08:24:31 <Javier> otherwise, GDPR is not applicable (end of workflow)
08:25:26 <Javier> else, maybe it is not sure if personal data is involved... In such a case, the GDPR is not applicable in the presented cases (see picture)
08:26:04 <dlewis> dlewis has joined #dpvcg
08:26:12 <Javier> Axel: what about national police laws?
08:26:21 <Javier> Rigo: national parlament has to make a law according to the guidelines.. national laws apply
08:26:49 <AxelPolleres> Police and Justice also provide access rights to data subjects, but these are regulated in the implementaiton of Directive 2016/680 and in national laws
08:27:00 <Javier> Eva: if no exemption apply, then GDPR applies and there is a need to determine legal ground
08:27:57 <Javier> If special categories apply (e.g. sensitive data according to Art.9) then one has to take special considerations
08:28:26 <Fajar> Fajar has joined #dpvcg
08:29:17 <Javier> ... With no special category, then the default legal ground applies (consent art 6. par 1(a)... etc.)
08:30:03 <Javier> ... Task carried out in public interest (but no police), e.g. registration of a car
08:30:44 <Javier> Axel: Is this collection or also processing, or sharing?
08:30:52 <Javier> rigo: It is all, collection, processing and sharing
08:31:28 <harsh> Axel: is there an example of a processing/purpose in public interest that is not based on legal grounds?
08:31:47 <harsh> Eva: We have an example in the TR use-case regarding money laundering.
08:32:35 <harsh> Eva: Anti-money laundering rules require background checks, but they only give legal grounds to the financial institutions and not the affiliated parties.
08:32:56 <Javier> TR is not under this legal ground
08:33:07 <Javier> .. need to be fixed
08:36:41 <Javier> Rigo: TR is a full encompassing data collector from multiple sources. They can check the anti-money laundry and they provide the result to the bank. And the laws encourage to do so, because they can do these checks, they are capable of it.It is a part of the system, but it is not covered by these legal grounds
08:37:09 <harsh> Eva: The current money laundering rules/law are not compatible with the fundamental GDPR rights, and could be stuck down by the EU courts
08:38:23 <Javier> Eva: Processing is everything from the first collection of data, and you have to determine the legitime interest for each category the company has
08:39:22 <Javier> Rigo: Even processing not listed there... is covered
08:40:16 <Javier> Eva: Back to the figure... legitimate interest is a rather open concept
08:41:41 <Javier> Rigo: It is open on purpose, e.g to cover targeted advertisement
08:42:33 <Javier> ... It can also apply to a third party, applies to everything
08:43:58 <Javier> ... It takes the approach of: everything is prohibited except these cases... and the exceptions are described openly to cover all "tricky" cases
08:45:45 <AxelPolleres> eva: legistimate interest is 3 steps: 1. is it legitimate interest of the data controller (e.g. business), 2. are there interests of data subjects that could be contrary, 3. is the contrary interest of a greater weight than the company one. —> need to be documented.
08:47:57 <Javier> Rigo: In any case, the subject can fire a "Do not Track" token, and this case instead of legitime interest one should check Art 21, p.5-- at any moment the user can oppose
08:48:09 <AxelPolleres> eva: for example, extensive profiling is not allowed
08:49:21 <Javier> Rigo: The regulation is clear that they don't like profiles not under the control of the data subject
08:49:42 <Javier> ... see Cambridge Analytica case
08:50:09 <Javier> Eva: data protection law at such protects society
08:50:51 <Javier> Dave: autonomy is interesting, because they have to weight that concept with e.g. targeted advertisement
08:51:59 <Javier> Rigo: There is a study saying that targeted advertisement can result in 4% more sales, at the cost of 500% price increase
08:52:31 <Javier> Eva: Back to the figure, last point is freedom of expression (e.g. journalism)
08:53:48 <Eva> Eva has joined #dpvcg
08:53:50 <AxelPolleres> Rigo: taking pictures in public is partially exempt in Germany by freedom of “arts” law… explaining...
08:55:24 <Javier> Rigo: Remember the  3 issues: linking policies to instance data, making policy statements, and having personal data attributes sorted out such that they are part of the linking
08:55:53 <Javier> ... anything that does not fit in the picture is not legal
08:57:18 <AxelPolleres> Requirement… we need to flag personal data as “sensetitiveArticle”
08:57:20 <Javier> Eva: Back to picture, if the category of the data is special (e.g. sensitive), then there are different legal grounds (e.g. legitimate interest is not applicable there)
08:57:52 <simonstey> http://www.privacy-regulation.eu/en/article-9-processing-of-special-categories-of-personal-data-GDPR.htm
08:57:57 <Javier> ...The full list of these special legal grounds need to be collected
08:59:53 <AxelPolleres> eva: Legal grounds … under article 9 are a lsit on their own, but overlaps
09:00:35 <AxelPolleres> … e.g. article 6 also allows implicit consent, article 9 only explicit consent
09:01:03 <Bud> Bud has joined #dpvcg
09:01:18 <Javier> if you have an article 9 consent, anything else works too
09:01:34 <AxelPolleres> rigo: article 9 legal grounds are stronger than article 6 grounds
09:01:39 <Javier> Fajar: So it's the same as saying article 9 has higher conditions
09:01:41 <simonstey> https://easygdpr.eu/gdpr-article/6/ vs https://easygdpr.eu/gdpr-article/9/
09:02:27 <Javier> Axel: Some time ago we had what the features of consent  could be. Can we expand this to all types?
09:02:35 <Javier> Rigo and Eva: yes
09:03:37 <Javier> Axel: The company has to specify based on which they operate (don't need to categorize), just the buckets
09:04:06 <Javier> Harsh: The idea is to have the top level, and just go into the details if needed
09:04:58 <Javier> Axel: I think for the processing we have to do the same
09:05:29 <Javier> Rigo: In the purpose, the important is why?
09:06:06 <Javier> Axel: The idea is: I used this data based on this legal ground for this purpose and processed it like that
09:07:50 <Javier> Rigo: if you write a policy, you give the category of the collected data, and the category of the purpose.  In a special context, you do have the instance data (semantic data lake) and you can point to it directly
09:08:09 <Javier> Axel: But we need the legal background, this part is missing
09:08:32 <Javier> eva: Yes, we need to consider it
09:09:45 <Javier> legal ground is the union of the boxes in Eva's picture, and when you define the policy you have to define your legal ground, and this would allow inference...
09:10:22 <Javier> what are the element of consent and which can be specifified in a machine readable way
09:10:42 <simonstey> https://www.w3.org/TR/odrl-vocab/#term-consentingParty
09:10:48 <Javier> ... some cases are open for interpretation, but some not
09:10:50 <simonstey> https://www.w3.org/TR/odrl-vocab/#term-obtainConsent
09:12:03 <Javier> Rigo: We need to have buckets/boxes to help people defining the policies
09:12:21 <Javier> Eva: smart move is to try to place yourself in one of the boxes
09:12:55 <AxelPolleres> AxelPolleres has joined #dpvcg
09:14:08 <Javier> Fajar: I think SPECIAL has the way to specify the consent, but there is not legal ground represented, right?
09:14:58 <Javier> Rigo: There could be another box of the MCM
09:15:04 <Javier> Eva: we are not dealing with legal ground in our SPECIAL use cases
09:16:09 <Javier> Axel: which components would have the leg. interest?
09:16:33 <Javier> Rigo: I see a bucket list, that can be expanded
09:17:07 <Javier> Harsh: But Axel mentions the justification of why you fit into a specific bucket
09:17:58 <Javier> Fajar: Is L.I a purpose?
09:18:08 <simonstey> https://easygdpr.eu/gdpr-recital/recital-47/ clarifies on the weighing of interests to determine if consent is required
09:18:27 <Javier> Rigo: no no, it is not, it's the legal ground of your purpose
09:19:03 <Javier> Bud: I was also fighting with terms and went through the GDPR definitions, doing NLP of the terms
09:19:19 <Javier> ... some apply to processing, I tried to collect and categorize
09:19:52 <Javier> ... I came out that the purpose is a primary thing, the first thing, and from then you structure the rest
09:20:26 <Javier> ... Maybe there is an overlap, but I would put first the purpose and hanging from there the data that you need, etc.
09:20:35 <AxelPolleres> Bud: purpos should always be the first thing… because data used, processing and legal ground will need to be justified by the purpose
09:21:43 <Javier> coffee break
09:28:51 <simonstey> q+
09:30:23 <AxelPolleres> axel: we should distinguish between processing that generates personal data and processing that does not  generate personal data (e.. eggregation/anonymisation
09:30:25 <AxelPolleres> )
09:32:01 <simonstey> ack simonstey
09:32:30 <AxelPolleres> Simonstey: does right of erasure also affect the aggregated data, i.e. can I insist on erasing my data from the aggreagation.
09:33:01 <AxelPolleres> rigo: that would probably make our statistic system collapse.
09:34:00 <AxelPolleres> Axel: same applies for the right to rectification, I’d say, no?
09:34:09 <Javier> ... If the purpose is to aggregate data, then we can assume there is no personal data
09:34:21 <AxelPolleres> Eva: this is currently being discussed on the level of DPAs
09:34:59 <Javier> Rigo: We need an aggregation justification, modelling wise
09:35:45 <Javier> Axel: If you collect data for a later aggregation... you have to ask for permission, right?
09:37:23 <Javier> Rigo: In case of heatmaps, e.g. GDPR is not applicable
09:38:00 <Javier> Axel: is anonymization a process?
09:38:47 <Javier> Rigo: Yes, on the fly, only retaning the personal data... is this personal data? No, you don't have a right, GDPR does not apply
09:39:15 <Javier> ... you can only avoid if you don't give the data first
09:39:32 <Javier> ... if you aggregate data in the fly, without storing then it is not personal data
09:39:35 <AxelPolleres> Rigo: processing personal data on-the-fly without retaining it, i.e. with arriving in non-personal, anonmymized/aggregated data is ok.
09:40:24 <Javier> Axel: but it is impossible to process without storing somehow...
09:40:36 <Javier> Rigo: yes, it is ephemeral
09:43:37 <AxelPolleres> Axel: conclusion: let’s just distinguish between processing that retains/generates personal data (e.g. enrichment/classification/generating personalised recommendations) and processing that doesn’t (e.g. aggregation/anonymisation)
09:44:05 <AxelPolleres> topic: processing
09:44:32 <Javier> Bud presents the summary figure of his study
09:44:51 <Javier> ... but more details will be provided during a telco
09:45:21 <AxelPolleres> ACTION: Bud to prepare a presentation for next DPVCG telco next week.
09:45:21 <trackbot> Error finding 'Bud'. You can review and register nicknames at <https://www.w3.org/community/dpvcg/track/users>.
09:45:22 <Javier> ... next week
09:45:50 <AxelPolleres> ACTION: Axel to prepare an agenda for next week.
09:45:50 <trackbot> Created ACTION-45 - Prepare an agenda for next week. [on Axel Polleres - due 2018-12-11].
09:46:24 <AxelPolleres> ACTION: Rigo to post-process minutesof f2f and check wherther all actions have been recorded
09:46:24 <trackbot> Created ACTION-46 - Post-process minutesof f2f and check wherther all actions have been recorded [on Rigo Wenning - due 2018-12-11].
09:46:49 <AxelPolleres> ACTION: Bud to prepare a presentation for “elements of processing” next DPVCG telco next week.
09:46:49 <trackbot> Error finding 'Bud'. You can review and register nicknames at <https://www.w3.org/community/dpvcg/track/users>.
09:47:02 <rigo> Action: Axel to invite, set Agenda for a DPVCG teleconference on 11 December
09:47:02 <trackbot> Created ACTION-47 - Invite, set agenda for a dpvcg teleconference on 11 december [on Axel Polleres - due 2018-12-11].
09:47:35 <Javier> Harsh: We haven't talked of controllers, subjects... and storage and security
09:48:03 <AxelPolleres> topic: categories of data controllers, recipients, etc.
09:48:08 <Javier> Piero: P3P has legal entity, kind of vcard data...
09:48:22 <AxelPolleres> Rigo: we can use vcard to describe entities.
09:48:46 <AxelPolleres> Axel: but I mean categories of data controllers… do we need them?
09:49:06 <Javier> Fajar: It could be nice to have a top level category
09:49:07 <AxelPolleres> … e.g. NGOs, NPOs, private, public, etc.
09:50:00 <AxelPolleres> ACTION: Harsh to look into classifications of organisations that could serve as a basis for clsssifying data controllers
09:50:01 <trackbot> Created ACTION-48 - Look into classifications of organisations that could serve as a basis for clsssifying data controllers [on Harshvardhan Pandit - due 2018-12-11].
09:51:00 <Javier> Eva: In the agenda there are data subjects... do you mean different categories of data subjects?
09:51:14 <Javier> Axel: Only a list of stakeholders involved
09:51:32 <Javier> Eva: I tried to list the rights of the data subjects
09:51:48 <Javier> Harsh: As a taxonomy, it could have a value
09:51:52 <AxelPolleres> Eva: in the context of talking about data subjects, we should talk about data subject rights.
09:52:16 <AxelPolleres> … eva showing an image (can someone add the link please?)
09:52:18 <Javier> Eva: some of the rigths can be specified automatically
09:52:28 <Javier> ... e.g. notification in case of data breach
09:53:03 <Javier> Fajar: Is it like the addition of the leg. interest in MCM?
09:53:07 <Javier> Eva: is complementary
09:53:27 <harsh> Fajar: Are rights the counterpart of legal interest as in the MCM?
09:53:38 <simonstey> https://www.mhc.ie/uploads/Data_Protection_Update_-_New_Registartion_Requirements_by_Robert_McDonagh_07.pdf lists some example categories of data controllers
09:53:52 <harsh> harsh: thanks simon
09:54:41 <Javier> Rigo: you need to consider first the rights of the controller, otherwise maybe the process does not start
09:54:44 <harsh> rigo: Rights give a power balance for data subjects and controllers
09:55:22 <harsh> Fajar: this allows the data subject to exercise their right and the controller to justify their processng using legal basis and then it can be inferred which is more applicable or comparable
09:55:36 <Javier> Fajar: it coudl be nice to have a vocabulary to express request/reject according to rights
09:55:42 <Javier> ... Interesting for Expedite
09:56:11 <Javier> Axel: It is interesting but it extends the scope of the group
09:56:35 <Javier> Rigo: It would be treated somehow in SPECIAL for our dashboard
09:56:45 <AxelPolleres> ISSUE: Shall we extend the scope of the group to machinge-readable requests to execute rights accroding to Eva’s classification of rights
09:56:45 <trackbot> Created ISSUE-5 - Shall we extend the scope of the group to machinge-readable requests to execute rights accroding to eva’s classification of rights.  Please complete additional details at <https://www.w3.org/community/dpvcg/track/issues/5/edit>.
09:56:46 <simonstey> https://easygdpr.eu/gdpr-article/40/ -> "Associations and other bodies representing categories of controller s or processor s may prepare codes of conduct, or amend or extend such codes, for the purpose of specifying the application of this Regulation, such as with regard to:"
09:56:52 <Javier> Axel: But we won't have a vocabulary for this
09:57:35 <AxelPolleres> https://lists.w3.org/Archives/Public/public-dpvcg/2018Nov/att-0030/Data_subjects_rights_V1.png
09:58:37 <AxelPolleres> Bud: thoughts about a taxonomy of data subjects
09:58:51 <Javier> Bud: Adults/Children
09:59:03 <Javier> ... maybe other people who needs protection
09:59:12 <AxelPolleres> … we should think about children, protection-worthy people, dependents
09:59:32 <Javier> ... also I provide the data personally / or collected without  my knowledge
09:59:51 <AxelPolleres> … collection directly, or collection through another data subject
09:59:59 <Javier> Eva: personal data is always a natural person.... not always the case e.g. companies can refer to privacy laws
10:00:32 <Javier> Rigo: In Italy, companies were covered by data protection laws
10:01:04 <Javier> Rigo: GDPR always apply to citizens in EU soil
10:01:19 <Javier> ... and also EU citizens outside of Europe
10:02:03 <Javier> Dave: so maybe having a category of people who don't apply to
10:02:15 <simonstey> "The Italian DPA, referring to the relevant WP29 guidelines, has provided some guidance on the categories of data controllers that more likely fall under the obligation to appoint a DPO (e.g. financial institutions, insurance companies, financial information systems, credit collection companies, surveillance companies, etc)."
10:02:20 <simonstey> https://www.twobirds.com/en/in-focus/general-data-protection-regulation/gdpr-tracker/italy
10:02:27 <AxelPolleres> i.e., shall we define data subjects that GDPR does and doesn’t apply to?
10:03:20 <simonstey> https://www.hipaajournal.com/gdpr-exemptions-who-is-exempt-from-gdpr/
10:04:02 <Javier> Harsh: Should we include this distinction of location in the model?
10:04:16 <Javier> Rigo: We have it in any case, but it is low priority now
10:04:34 <Bud> Bud has joined #dpvcg
10:04:38 <simonstey> https://www.gdpr.associates/gdpr-exemptions/
10:04:42 <Javier> Eva: We have the storage and location.... and we can just use country codes
10:04:55 <rigo> eva suggests using country codes
10:05:08 <simonstey> https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2
10:05:24 <rigo> in this case the decision of equivalence is avoided in the taxonomy
10:05:57 <Javier> ... and the coverage of EU can change in time, but if you use country codes then you can always have external info to check the EU boundaries at any point
10:06:03 <AxelPolleres> ISSUE: should our taxonomy include a distinction/modeling of data subjects to whom GDPR applies (EU citizens and/or locatedIn EU)
10:06:03 <trackbot> Created ISSUE-6 - Should our taxonomy include a distinction/modeling of data subjects to whom gdpr applies (eu citizens and/or locatedin eu).  Please complete additional details at <https://www.w3.org/community/dpvcg/track/issues/6/edit>.
10:07:40 <AxelPolleres> Axel: in the context of ISSUE-6 is “non-applicable citizens only” a “legal ground”?
10:08:42 <Javier> ... being ¨non-applicable citizens only” non-european citizens outside of EU
10:10:12 <simonstey> http://dbpedia.org/ontology/iso31661Code
10:10:55 <rigo> Action: Eva to put MS Visio picture of usage policy on the wiki
10:10:56 <trackbot> Created ACTION-49 - Put ms visio picture of usage policy on the wiki [on Eva Schlehahn - due 2018-12-11].
10:11:53 <rigo> Action: Bud to suggest a new hierarchy of the usage policy diagram and integrate into the presentation of Tuesday 11
10:11:53 <trackbot> Error finding 'Bud'. You can review and register nicknames at <https://www.w3.org/community/dpvcg/track/users>.
10:12:31 <AxelPolleres> Axel: Do we need in our vocabulary to discuss/model e.g. which Purpose REQUIRES which Data ?
10:13:09 <AxelPolleres> i.e. inter-component relationships within the conceptual model of a policy
10:13:55 <rigo> Action: Bud to suggest a new hierarchy of the usage policy diagram and integrate into the presentation of Tuesday 11
10:13:55 <trackbot> Created ACTION-50 - Suggest a new hierarchy of the usage policy diagram and integrate into the presentation of tuesday 11 [on Bud P. Bruegger - due 2018-12-11].
10:14:48 <rigo> ACTION: Bud to prepare a presentation for next DPVCG telco on 11 December
10:14:48 <trackbot> Created ACTION-51 - Prepare a presentation for next dpvcg telco on 11 december [on Bud P. Bruegger - due 2018-12-11].
10:15:02 <Javier> Axel: could we define the purpose and for it which data we need for this purpose?
10:15:22 <Javier> Eva: on the one hand it could be very useful and easy to use... but controllers would hate it, as they want as more data as possible
10:15:27 <AxelPolleres> Eva: DPA would appreaciate the definition of which data is required for each purpose, but for the data controllers this would not be difficult.
10:16:24 <AxelPolleres> David: it’s a matter of whether we define concormance criteria
10:16:41 <Javier> Bud: The tool cannot decide if the data is not needed for a purpose
10:17:22 <Javier> Eva: let's look at our use case, and see if we can find data categories for each purpose such that it is reusable
10:17:39 <rigo> RRSAgent, please draft minutes
10:17:39 <RRSAgent> I have made the request to generate https://www.w3.org/2018/12/04-dpvcg-minutes.html rigo
10:17:40 <Javier> ... purpose-data relations to be reusable and general enough
10:17:45 <Javier> ... not sure if this is possible
10:18:07 <AxelPolleres> Axel: we could model. e.g. in OWL, that all data required is from cetain categories.
10:18:21 <AxelPolleres> … as optional axioms
10:20:11 <rigo> harsh: create informational document, and create the OWL as one way to do it
10:23:31 <simonstey> action-3
10:23:31 <trackbot> action-3 -- Bert Bos to Clarify which github space we can use W3C's github space or if we need something else -- due 2018-08-13 -- CLOSED
10:23:31 <trackbot> https://www.w3.org/community/dpvcg/track/actions/3
10:23:41 <stefano> stefano has joined #dpvcg
10:24:09 <simonstey> +q
10:27:20 <simonstey> ack simonstey
10:28:22 <rigo> Action: rigo to ask Bert about w3c github repository action from August and create a github under W3C for dpvcg
10:28:23 <trackbot> Created ACTION-52 - Ask bert about w3c github repository action from august and create a github under w3c for dpvcg [on Rigo Wenning - due 2018-12-11].
10:29:44 <rigo> rrsagent, please draft minutes
10:29:44 <RRSAgent> I have made the request to generate https://www.w3.org/2018/12/04-dpvcg-minutes.html rigo
10:31:59 <Javier> Dave: Should Article 10 be included in Eva's figure?
10:32:39 <Javier> s/Dave/Bud
10:32:43 <Javier> Eva: not sure, Article 10 mentions data (e.g. criminal) but refers to Art. 9
10:33:31 <AxelPolleres> topic: plan ahead
10:33:52 <AxelPolleres> next Telco 11.12. 16:00 CET
10:34:15 <AxelPolleres> report about the ACTIONS agreed in the meeting.
10:35:44 <AxelPolleres> ACTION: HArsh, Axel, Fajar, Javier start on a base ontology, suggest a namespace, etc. and start populate the sub-taxonomies, agree on language to model it.
10:35:44 <trackbot> Error finding 'HArsh,'. You can review and register nicknames at <https://www.w3.org/community/dpvcg/track/users>.
10:35:55 <Eva> Eva: Art. 10 is not a legal ground on its own but rather specifies clarification and conditions on the processing operation
10:36:35 <AxelPolleres> ACTION: Axel to together with Harsh, Fajar, Javier start on a base ontology, suggest a namespace, etc. and start populate the sub-taxonomies, agree on language to model it.
10:36:36 <trackbot> Created ACTION-53 - Together with harsh, fajar, javier start on a base ontology, suggest a namespace, etc. and start populate the sub-taxonomies, agree on language to model it. [on Axel Polleres - due 2018-12-11].
10:37:51 <AxelPolleres> topic: storage details, location duration
10:38:02 <AxelPolleres> rigo: that’s just a detail.
10:38:59 <AxelPolleres> eva: suggested to us country codes (Axel: or continent odentifiers?) for modeling storage location
10:39:49 <AxelPolleres> axel: we need a way how to model storage duration, either as a fixed datetimestamp or as a relative duration (e.g. “for two weeks”)
10:40:58 <AxelPolleres> eva: on location, we need also conditions, e.g. “not COUNTRY-XYZ”, “outside-of-Europe”, “not outside-of-Europe” etc.
10:44:04 <AxelPolleres> ACTION: Javier to look into how to align SPECIAL duration vocab with “deletion-ideas” from eva’s slide (e.g. include no-retention, deleted-by, etc.) in our vocabulary
10:44:04 <trackbot> Error finding 'Javier'. You can review and register nicknames at <https://www.w3.org/community/dpvcg/track/users>.
10:44:08 <Javier> ACTION: Eva to send a compiled version of the slides shown (as for storage)
10:44:09 <trackbot> Created ACTION-54 - Send a compiled version of the slides shown (as for storage) [on Eva Schlehahn - due 2018-12-11].
10:44:33 <AxelPolleres> ACTION: Javier to look into how to align SPECIAL duration vocab with “deletion-ideas” from eva’s slide (e.g. include no-retention, deleted-by, etc.) in our vocabulary
10:44:34 <trackbot> Created ACTION-55 - Look into how to align special duration vocab with “deletion-ideas” from eva’s slide (e.g. include no-retention, deleted-by, etc.) in our vocabulary [on Javier D. Fernández - due 2018-12-11].
10:48:33 <Javier> Axel: I would like to have a first version of the vocabularies by january
10:49:05 <Javier> ... We need to think how to get more use cases
10:49:28 <Javier> Rigo: once we have the first taxonomy, we can have interested companies
10:51:14 <Javier> Axel: what is the overlap with the work of Consent Receipt?
10:52:04 <Javier> https://kantarainitiative.org/confluence/display/infosharing/Home
10:53:08 <Javier> Rigo: They are looking into our taxonomy to use it in Kantara
10:53:31 <Javier> ... we should look into it
10:54:12 <harsh> https://developers.digi.me/consent-access consent receipt implementation
10:55:56 <AxelPolleres> https://kantarainitiative.org/confluence/display/infosharing/Home
10:56:18 <AxelPolleres> https://kantarainitiative.org/file-downloads/consent-receipt-specification-v1-1-0/
10:58:02 <Javier> ... it seems that they use arbitrary strings for purposes
10:58:30 <Javier> Axel: we should look more into it and think how we can align with it
10:59:11 <harsh> purpose categories: https://kantarainitiative.org/confluence/display/infosharing/Appendix+CR+-+V.9.3+-+Example+Purpose+Categories
11:00:07 <Javier> Axel: e.g. 12 - Legally Required Data Retention mixes purposes and legal ground
11:07:04 <rigo> trackbot, end meeting
11:07:04 <trackbot> Zakim, list attendees
11:07:04 <Zakim> As of this point the attendees have been (no one)
11:07:05 <Javier> end of meeting
11:07:12 <trackbot> RRSAgent, please draft minutes
11:07:12 <RRSAgent> I have made the request to generate https://www.w3.org/2018/12/04-dpvcg-minutes.html trackbot
11:07:13 <trackbot> RRSAgent, bye
11:07:13 <RRSAgent> I see 15 open action items saved in https://www.w3.org/2018/12/04-dpvcg-actions.rdf :
11:07:13 <RRSAgent> ACTION: Bud to prepare a presentation for next DPVCG telco next week. [1]
11:07:13 <RRSAgent>   recorded in https://www.w3.org/2018/12/04-dpvcg-irc#T09-45-21
11:07:13 <RRSAgent> ACTION: Axel to prepare an agenda for next week. [2]
11:07:13 <RRSAgent>   recorded in https://www.w3.org/2018/12/04-dpvcg-irc#T09-45-50
11:07:13 <RRSAgent> ACTION: Bud to prepare a presentation for “elements of processing” next DPVCG telco next week. [4]
11:07:13 <RRSAgent>   recorded in https://www.w3.org/2018/12/04-dpvcg-irc#T09-46-49
11:07:13 <RRSAgent> ACTION: Axel to invite, set Agenda for a DPVCG teleconference on 11 December [5]
11:07:13 <RRSAgent>   recorded in https://www.w3.org/2018/12/04-dpvcg-irc#T09-47-02
11:07:13 <RRSAgent> ACTION: Harsh to look into classifications of organisations that could serve as a basis for clsssifying data controllers [6]
11:07:13 <RRSAgent>   recorded in https://www.w3.org/2018/12/04-dpvcg-irc#T09-50-00
11:07:13 <RRSAgent> ACTION: Eva to put MS Visio picture of usage policy on the wiki [7]
11:07:13 <RRSAgent>   recorded in https://www.w3.org/2018/12/04-dpvcg-irc#T10-10-55
11:07:13 <RRSAgent> ACTION: Bud to suggest a new hierarchy of the usage policy diagram and integrate into the presentation of Tuesday 11 [8]
11:07:13 <RRSAgent>   recorded in https://www.w3.org/2018/12/04-dpvcg-irc#T10-11-53
11:07:13 <RRSAgent> ACTION: Bud to suggest a new hierarchy of the usage policy diagram and integrate into the presentation of Tuesday 11 [9]
11:07:13 <RRSAgent>   recorded in https://www.w3.org/2018/12/04-dpvcg-irc#T10-13-55
11:07:13 <RRSAgent> ACTION: Bud to prepare a presentation for next DPVCG telco on 11 December [10]
11:07:13 <RRSAgent>   recorded in https://www.w3.org/2018/12/04-dpvcg-irc#T10-14-48
11:07:13 <RRSAgent> ACTION: rigo to ask Bert about w3c github repository action from August and create a github under W3C for dpvcg [11]
11:07:13 <RRSAgent>   recorded in https://www.w3.org/2018/12/04-dpvcg-irc#T10-28-22
11:07:13 <RRSAgent> ACTION: HArsh, Axel, Fajar, Javier start on a base ontology, suggest a namespace, etc. and start populate the sub-taxonomies, agree on language to model it. [12]
11:07:13 <RRSAgent>   recorded in https://www.w3.org/2018/12/04-dpvcg-irc#T10-35-44
11:07:13 <RRSAgent> ACTION: Axel to together with Harsh, Fajar, Javier start on a base ontology, suggest a namespace, etc. and start populate the sub-taxonomies, agree on language to model it. [13]
11:07:13 <RRSAgent>   recorded in https://www.w3.org/2018/12/04-dpvcg-irc#T10-36-35
11:07:13 <RRSAgent> ACTION: Javier to look into how to align SPECIAL duration vocab with “deletion-ideas” from eva’s slide (e.g. include no-retention, deleted-by, etc.) in our vocabulary [14]
11:07:13 <RRSAgent>   recorded in https://www.w3.org/2018/12/04-dpvcg-irc#T10-44-04
11:07:13 <RRSAgent> ACTION: Eva to send a compiled version of the slides shown (as for storage) [15]
11:07:13 <RRSAgent>   recorded in https://www.w3.org/2018/12/04-dpvcg-irc#T10-44-08
11:07:13 <RRSAgent> ACTION: Javier to look into how to align SPECIAL duration vocab with “deletion-ideas” from eva’s slide (e.g. include no-retention, deleted-by, etc.) in our vocabulary [16]
11:07:13 <RRSAgent>   recorded in https://www.w3.org/2018/12/04-dpvcg-irc#T10-44-33