W3C

– DRAFT –
Data Privacy Vocabularies and Controls Community Group Teleconference

15 October 2019

Attendees

Present
Axel, Bert, Bud, Harsh
Regrets
-
Chair
Bert
Scribe
Axel

Meeting minutes

<harsh> ACTION-123

<trackbot> ACTION-123: Elmar Kiesling to Advertise dpvcg at mydata: place in Community Call (starting Oct, contact Sille) -- due 2019-10-01 -- OPEN

<harsh> ACTION-126

<trackbot> ACTION-126: Axel Polleres to Ask bert to update the cgwebpage to advertise the drafts more prominently. -- due 2019-09-10 -- OPEN

dialing

moment, connection problem

<harsh> @axelpolleres okay, we're clearing up some actions

great, will join in some mins

<Bert> trackbot, close action-126

<trackbot> Closed action-126.

<Bert> trackbot, close action-123

<trackbot> Closed action-123.

<harsh> Hi Mitzi, did you get the login details for call?

PROPOSED: accept minutes from last time

<harsh> +1

<Bert> action-129?

<trackbot> action-129: Axel Polleres to Check in the next telcos, whethrer we're on track for that timplan. -- due 2019-09-10 -- OPEN

Resolved: accept minutes from last time

Axel: in these minutes we should have a timeplan: https://‌www.w3.org/‌2019/‌09/‌03-dpvcg-minutes.html

Plan/time schedule from a month ago: by today we wanted to vote for resolutions of all open issues (unless new issues/comments we could then have them incorporated) , start internal reviewing mid october, internal reviews by end october in, incorporated/voted to publish by mid Nov?

Bert: not that many ACTIONs open.

ISSUES?

<Bert> issues

<harsh> quite a few actions pending review https://‌www.w3.org/‌community/‌dpvcg/‌track/‌actions/‌pendingreview

Axel: shall we just move issues we know we won't resolve to POSTPONED issues which we list e.g. as an appendix to the document?

PROPOSED: move issue-2 to postponed issues under the following text: "The group did not concsidr definint any notion of (legal) compliance with respect to a particular legislation in scope of the current specification. While we assume that certain violations of compliance could be recorded with the current vocabulary, but compliance guarantees or compliance checking algorithms are not part of this specification."

<harsh> +1

+1 modulo typo fixing

<bud> +1

Resolved: move issue-2 to postponed issues under the following text: "The group did not concsider defining any notion of (legal) compliance with respect to a particular legislation in scope of the current specification. While we assume that certain violations of compliance could be recorded with the current vocabulary, compliance guarantees or compliance checking algorithms are not part of this specification."

<Bert> +1

ISSUE-3: we assume this is about data subject rights in the current discussion.
… e.g. right for rectification, right to be forgotten, etc.

<trackbot> Notes added to ISSUE-3 Do we want to revisit a definition of "gdpr rights" in our definitions and taxonomies?.

Axel: Where would that fit in the vocabulary?

Axel: Are certain rights tied to the legal basis? to the kind of processing?

Harsh: could be either

Bud: not every right is applicable to all kinds of data handling.
… I wanted to do a transition diagram on the rights and how they connect.

Axel: we should finihs things up by end of the year to a stable state, but I personally cannot guarantee I can continue to chair beyond.

<harsh> 1) Will Bert continue as chair? 2) Can ask for volunteers to continue the WG?

Action: Bud to try with Eva to come up with a proposal to represent GDPR rights by the end of November.

<trackbot> Created ACTION-132 - Try with eva to come up with a proposal to represent gdpr rights by the end of november. [on Bud P. Bruegger - due 2019-10-22].

Action-132: this action is tied to ISSUE-3

<trackbot> Notes added to Action-132 Try with eva to come up with a proposal to represent gdpr rights by the end of november..

<bud> Bud and Eva will try to come up with partial state-transition diagrams to illustrate the interdependencies of data subject rights

<Bert> issue-6?

<trackbot> issue-6: Should our taxonomy include a distinction/modeling of data subjects to whom gdpr applies (eu citizens and/or locatedin eu) -- open

<harsh> If someone does want to specify a subset or specialisation of data subjects, e.g. those based in EU, these could be represented by subclassing the DataSubject class and annotating/describing it with required conditions.

<harsh> If we wish to model "EU citizen", then it needs specifying data subect --> citizen of --> nation --> member state --> EU/EEA

<harsh> Additionally, the GDPR also applies to services 'operating in EU/EEA'

PROPOSED: We leave the further specification of specific subclasses of DataSubjects out of scope of the current CG, the spec provides just one example,
… dpv:Child that could serve as an illustration for other subclasses affecting certain groups of DataSubjects (e.g. Citizens of certain states to which a particular legislation applies, etc.) with this rationale we postpone ISSUE-6.

<harsh> +1

+1

<Bert> +1

<bud> +1

Resolved: We leave the further specification of specific subclasses of DataSubjects out of scope of the current CG, the spec provides just one example, dpv:Child that could serve as an illustration for other subclasses affecting certain groups of DataSubjects (e.g. Citizens of certain states to which a particular legislation applies, etc.) with this rationale we postpone ISSUE-6.

<Bert> issue-9?

<trackbot> issue-9: Where are categories of data controllers used, where are they useful? (cf. recital 98, 99, 100) -- open

PROPOSED: With the same rationale as not defining any particular subclasses or categories of dataSubjects, we leave the concrete definition of particular subcategories of dpv:DataController as an extension point. With this rationale we postpone ISSUE-9

<harsh> +1

+1

<bud> +1

<Bert> +1

Resolved: With the same rationale as not defining any particular subclasses or categories of dataSubjects, we leave the concrete definition of particular subcategories of dpv:DataController as an extension point. With this rationale we postpone ISSUE-9

<Bert> issue-10?

<trackbot> issue-10: Are there mappings to gics from other coding systems naics/nace/isic ... -- open

<harsh> https://‌github.com/‌dpvcg/‌dpv-nace

<harsh> https://‌www.w3.org/‌ns/‌dpv#vocab-purposes

<harsh> Example of NACE and DPV-NACE

"dpv-nace: NACE-CODE" in Section 5 looks weird

Action: harsh to fix the extra space in "dpv-nace: NACE-CODE." in Section 5

<trackbot> Error creating an ACTION: could not connect to Tracker. Please mail <sysreq@w3.org> with details about what happened.

Since ACTION-87 is long overdue, I would prefer to close it as undone and leave GICS as an extension point for the future.

PROPOSED: to close ACTION-87 and also postpone ISSUE-10 with the following rationale: at the moment the spec only defines a schemafor business sector codes in NACE, we leave the definition of (mappings to) other business sector code standards such as eg. GICS to future extensions.

+1

<Bert> +1

<bud> +1

<harsh> +1

Resolved: to close ACTION-87 and also postpone ISSUE-10 with the following rationale: at the moment the spec only defines a schemafor business sector codes in NACE, we leave the definition of (mappings to) other business sector code standards such as eg. GICS to future extensions.

<harsh> FYI: EU RAMON provides conversion tables in case someone wants to take up this work - https://‌ec.europa.eu/‌eurostat/‌ramon/‌relations/‌index.cfm?TargetUrl=LST_REL&StrLanguageCode=EN&IntCurrentPage=11

next telco 29th october. Note: we are probably a bit behind the timeplan, but still can make it to publish until the end of the year.

Adjourned

Summary of action items

  1. Bud to try with Eva to come up with a proposal to represent GDPR rights by the end of November.
  2. harsh to fix the extra space in "dpv-nace: NACE-CODE." in Section 5

Summary of resolutions

  1. accept minutes from last time
  2. move issue-2 to postponed issues under the following text: "The group did not concsider defining any notion of (legal) compliance with respect to a particular legislation in scope of the current specification. While we assume that certain violations of compliance could be recorded with the current vocabulary, compliance guarantees or compliance checking algorithms are not part of this specification."
  3. We leave the further specification of specific subclasses of DataSubjects out of scope of the current CG, the spec provides just one example, dpv:Child that could serve as an illustration for other subclasses affecting certain groups of DataSubjects (e.g. Citizens of certain states to which a particular legislation applies, etc.) with this rationale we postpone ISSUE-6.
  4. With the same rationale as not defining any particular subclasses or categories of dataSubjects, we leave the concrete definition of particular subcategories of dpv:DataController as an extension point. With this rationale we postpone ISSUE-9
  5. to close ACTION-87 and also postpone ISSUE-10 with the following rationale: at the moment the spec only defines a schemafor business sector codes in NACE, we leave the definition of (mappings to) other business sector code standards such as eg. GICS to future extensions.
Minutes manually created (not a transcript), formatted by Bert Bos's scribe.perl version 88 (Tue Oct 15 18:13:07 2019 UTC), a reimplementation of David Booth's scribe.perl. See history.