15:03:23 RRSAgent has joined #dpvcg 15:03:23 logging to https://www.w3.org/2019/01/22-dpvcg-irc 15:03:25 RRSAgent, make logs public 15:03:25 Zakim has joined #dpvcg 15:03:27 Meeting: Data Privacy Vocabularies and Controls Community Group Teleconference 15:03:27 Date: 22 January 2019 15:03:47 agendabot has joined #dpvcg 15:05:30 Eva we can hear you on the call. 15:06:02 ok you can still hear us but we cannot hear you, working on it, sigh 15:07:08 Agenda for today: https://lists.w3.org/Archives/Public/public-dpvcg/2019Jan/0008.html 15:07:20 agenda: https://www.w3.org/mid/36891304.CWuKmcZnDW@nyx 15:07:21 clear agenda 15:07:21 agenda+ Roll call, select scribe, agenda 15:07:21 agenda+ Approval of last telcon's minutes: 15:07:21 agenda+ Action items 15:07:21 agenda+ Issues 15:07:23 agenda+ Status of vocabularies/taxonomies 15:07:26 agenda+ AOB 15:08:00 present+ 15:08:01 Javier has joined #dpvcg 15:08:29 scribe: harsh 15:09:53 Bert: any concerns about previous minutes of meeting? (no replies) 15:10:04 previous meeting: https://www.w3.org/2019/01/08-dpvcg-minutes.html 15:10:07 Bert: Axel proposed (via email) to move the next meeting by -/+ 1 hour. We'll talk about that at the end of the meeting. 15:10:32 -> https://www.w3.org/community/dpvcg/track/actions/open actions 15:10:42 Bert: looking for any actions we can close 15:10:52 action-13? 15:10:52 action-13 -- Stefano Bocconi to Propose use case(s) for the decode project -- due 2018-08-14 -- CLOSED 15:10:52 https://www.w3.org/community/dpvcg/track/actions/13 15:10:55 action-33? 15:10:55 action-33 -- Harshvardhan Pandit to Summarize elements of consent from the mails and align with mark lizar on "concent receipt" definition (e.g. on delegation) -- due 2018-11-13 -- OPEN 15:10:55 https://www.w3.org/community/dpvcg/track/actions/33 15:11:57 action-42? 15:11:57 action-42 -- Eva Schlehahn to Look into requirements of data protection assessment, and whether it would make sense to formalize that in terms of what we standardize -- due 2018-12-10 -- OPEN 15:11:57 https://www.w3.org/community/dpvcg/track/actions/42 15:12:11 harsh: regarding consent, we (me and Mark) are talking about a minimum version of consent receipt which can incorporate DPVCG vocabularies 15:12:50 Eva: I'm looking(-ed) at the opinion of Article 29 WP, for cases such as impact assessment which can assist us in understanding which data can be considered sensitive 15:13:44 Mark_Lizar has joined #dpvcg 15:14:02 simonstey has joined #dpvcg 15:14:18 Hello 15:14:59 Eva: it is difficult to assess whether data is sensitive because they are context sensitive and this makes it difficult to capture it in a vocabulary 15:15:01 present+ 15:15:47 Eva: I would consider this action point as done since the information cannot be categorised based on the opinion 15:17:15 close action-42 15:17:15 Closed action-42. 15:17:26 harsh: would it be helpful to list the criteria / concepts about the assessment and have them as the ontology? 15:17:58 Eva: I can share the points of assessment (from my research) with the mailing list and we can discuss if it is useful to use them 15:18:10 Mark: is this the difference between high risk and risk? 15:18:18 action: Eva to send mail to list with the criteria for data protection assessment from EDPB 15:18:19 Created ACTION-59 - Send mail to list with the criteria for data protection assessment from edpb [on Eva Schlehahn - due 2019-01-29]. 15:19:06 Eva: In the opinion (A29 WP) they have described if such a high risk exists or can exist and controllers are expected to carry out the assessment to see if this is possible 15:19:40 Mark: In Canada, there was a call for comments, and resulted in update to privacy laws, where risk must be provided for meaningul consent. So this is a similar activity on risk. 15:20:18 Eva: Let's discuss these criteria on the mailing list (after I share them), as they are highly context dependant which are evolving constantly. 15:22:16 Mark: (regarding consent) Kantara is working with/for a working group for ISO 29184 for consent/privacy notices, and this work is going in an annex in that report. The idea is to create a minimal viable consent report which can be extended by different organisations. 15:22:32 Mark: so there can be an extension submitted by this work group and reviewed in that context. 15:24:15 action-48? 15:24:15 action-48 -- Harshvardhan Pandit to Look into classifications of organisations that could serve as a basis for clsssifying data controllers -- due 2018-12-11 -- OPEN 15:24:15 https://www.w3.org/community/dpvcg/track/actions/48 15:25:49 shared email for categories of organisations https://lists.w3.org/Archives/Public/public-dpvcg/2018Dec/0021.html 15:27:14 Mark: There are SIC codes (different ones for North America, EU, UN (UK?). So we can use that as a company classification. And a company can have a service which can be different from the company classification. In GDPR, it refers to categories from SIC codes. 15:27:45 Eva: what might be relevant is that there could be different purposes or could mix into each other (for big corps) 15:28:20 Mark: the primary purpose or the core purpose has been brought up a few times - too much flexibility can increase confusion 15:30:04 harsh: should we summarise this as using SIC (or compatible) codes to define categories of organisations? 15:30:17 Mark: GDPR specifically mentions terms/categories defined by trade bodies 15:33:48 Eva: it is useful to revisit the question of "why" we need categories of controllers 15:34:15 harsh: GDPR code of conduct mentions categories 15:34:28 Bert: so it may be that there are far lesser categories than SIC codes specify 15:35:05 Bert: we can close this action and have another look at where this categories are useful? 15:36:57 close action-48 15:36:57 Closed action-48. 15:37:51 issue: where are categories of data controllers used, where are they useful? (cf. recital 98, 99, 100) 15:37:52 Created ISSUE-9 - Where are categories of data controllers used, where are they useful? (cf. recital 98, 99, 100). Please complete additional details at . 15:37:52 Mark: R98, R99, R100 are relevant for categories of controllers 15:38:15 action-57? 15:38:15 action-57 -- Harshvardhan Pandit to Start definitionsions of the high-level purposes at https://www.w3.org/community/dpvcg/wiki/purposes_for_handling_personal_data#high-level_categories_.28to-be-discussed.29 and map them to purposes collected from use cases -- due 2018-12-18 -- OPEN 15:38:16 https://www.w3.org/community/dpvcg/track/actions/57 15:38:22 page in wiki: https://www.w3.org/community/dpvcg/wiki/Purposes_for_handling_Personal_Data 15:39:18 harsh: I have added brief descriptions to the wiki page (link above) 15:39:53 action-58? 15:39:53 action-58 -- Eva Schlehahn to Look at iab europe consent framework -- due 2019-01-15 -- OPEN 15:39:53 https://www.w3.org/community/dpvcg/track/actions/58 15:41:22 Eva: there are only 5 purposes which are generic, and there's no information on how they envision changes to the policy or consent (withdraw, updates, changes), or if data subject wants to have something rectified 15:41:52 agenda+ next telcon (Axel asks for one-time time change) 15:42:24 Eva: I don't understand vendor as a concept, and some of the terms are generic . I'm sceptical of its use to the community. 15:43:07 sorry we can also discuss action-55 15:43:14 Eva: what would be useful is where the vendors are located, how they share data - these are all missing. 15:43:30 harsh: vendors in this sense refers to anyone who wants to sell ads and thereby collect consent 15:43:56 close action-58 15:43:56 Closed action-58. 15:44:13 action-55? 15:44:14 action-55 -- Javier D. Fernández to Look into how to align special duration vocab with “deletion-ideas” from eva’s slide (e.g. include no-retention, deleted-by, etc.) in our vocabulary -- due 2018-12-11 -- OPEN 15:44:14 https://www.w3.org/community/dpvcg/track/actions/55 15:44:36 - no-retention: no storage beyond using once 15:44:38 close action-55 15:44:38 Closed action-55. 15:44:40 - stated purpose: until purpose has been fulfilled 15:44:46 - legal-requirement: storage period defined by a law requiring it 15:45:14 - business practices: requires a deletion concept of controller 15:45:29 - Indefinitely: e.g. for really anonymized data, public archives... 15:45:37 - delete-by_ or delete-x-date_month_after 15:46:19 javier: for action-55, I spoke with Eva for our SPECIAL use-cases and these are the options for retention. 15:46:40 Javier: (to Eva) do you have any specific events for the last point? 15:46:57 Eva: this was for example for controllers that have legal obligations to keep the data after a certain time e.g. billing dat 15:47:26 Javier: if it is a time then its fine, but if it's event-based then can we know what these events are? 15:47:48 Eva: these are context-dependant, e.g. purpose fulfilling in a contract 15:49:25 Eva: I can look at the use-cases to see if it matches with the deletion rules ideas 15:50:01 Mark: (to Eva) are these the exceptions to the specified purpose (as in retention for one purpose but deletion for some other purpose) 15:50:30 Eva: there can be differentiation between usage data and billing data, then these datasets can be handled according to different storing periods 15:50:38 action: eva to look at use cases in the wiki to see if one matches the deletion rules ideas Eva posted (especially deletion depending on an event or purpose rather than a fixed period) 15:50:38 Created ACTION-60 - Look at use cases in the wiki to see if one matches the deletion rules ideas eva posted (especially deletion depending on an event or purpose rather than a fixed period) [on Eva Schlehahn - due 2019-01-29]. 15:52:47 harsh: in this case, the law overrides the GDPR rather than the GDPR having an exception? 15:53:07 Javier: we have a term legal / law (?) that can be a URI to a law 15:53:35 Bert: about the next call, there was an request from Axel if we can have the call +/-1 hour 15:55:24 proposed: next telco on 12th (rather than 5th) February and holding it at 2 rather than 4 15:55:35 no objections 15:55:45 Next call confirmed on 12th Feb 14:00 15:56:40 action: bert to schedule webex for 12 Feb 14:00 15:56:40 'bert' is an ambiguous username. Please try a different identifier, such as family name or username (e.g., bbos, bertv). 15:57:42 action: bbos to schedule webex for 12 Feb 14:00 15:57:43 Created ACTION-61 - Schedule webex for 12 feb 14:00 [on Bert Bos - due 2019-01-29]. 15:59:08 harsh has left #dpvcg 16:06:35 Bert has joined #dpvcg