09:57:35 RRSAgent has joined #dpvcg 09:57:35 logging to https://www.w3.org/2020/11/18-dpvcg-irc 10:00:09 Zakim has joined #dpvcg 10:01:45 Scribe: harsh 10:01:50 ScribeNick: harsh 10:02:05 Meeting: DPVCG Meeting Call NOV-18 10:02:09 Chair: harsh 10:06:35 Present: harsh, PaulRyan, GeorgKrogg, BeatrizEsteves 10:07:37 We will be resolving the proposed terms in continuation of the NOV-4 workshop 10:07:42 Topic: Rights 10:07:57 Q: Whose Rights? Controllers, Processors, Data Subject? 10:08:35 Discussion: we have a top-level class called 'Rights' and sub-class it as 'DataSubjectRights' and add the GDPR rights to this 10:13:19 Topic: 'Sell' in CCPA / CCRA 10:14:06 This is specific to a law, and the common use of 'term' differs from this definition. Therefore, it would be better to have a separate profile (e.g. dpv-ccpa) and define the term 'sell' in it, along with equivalence relations to DPV processing categories. 10:14:18 Topic: Proposed Terms 10:14:27 Discussing: ThirdCountry 10:22:19 How to specify that a Processing is taking place in a third country, or that a recipient is in third country 10:22:37 There is a Location class in PersonalData, does it makes sense to have ThirdCountry as a subset of that? 10:24:04 There is also the class Country in PersonalData 10:24:22 How will defining third country as sub-classes of these impact / have consequences? 10:24:24 TBD 10:24:26 Topic: Risk 10:24:50 Risk is a high-level concept, that can be associated with different things/concepts 10:30:21 We have RiskManagementProcedure as an organisational measure 10:33:01 Risk as a top-level concept, with generic property to enable associating it with any concept 10:34:39 Discussing: RiskMitigationMeasure 10:35:54 Associate RiskMitigationMeasure with Risk using property mitigatesRisk 10:36:00 Topic: Data Breach 10:38:15 Is Data Breach a type of Risk? (yes, but more complex) 10:38:47 Data Breach also is referred to a process 10:39:51 Data Breach is given high importance in organisational processes, governance, and documents 10:45:20 Data breach as a category of Risk 10:45:32 Make note of how to specify a Data Breach (or Risk) has taken place 10:46:06 This can be done by creating an instance of the risk or breach and considering that as the risk having consequences 10:47:07 Topic: Consultation with DPIA 10:48:14 s/DPIA/DPA/ 10:49:05 Consultations as an OrganisationalMeasure and Consultation with DPA as a specific sub-class 10:53:11 Topic: Register of Processing Activities 10:53:23 ROPA is related to compliance and compliance related processes and documents 10:53:33 We need to discuss how to specify these in DPV, and then define ROPA under those 10:58:00 Topic: Data Protection Impact Assessment 10:58:21 DPIA is a type of impact assessment, so there should be a top-level class called Impact Assessment, with DPIA a sub-class of it 10:58:53 Topic: DataProcessingAgreement 11:00:25 This is a type of contract, so needs more discussion 11:00:59 DPV currently does not specify categories of Legal Basis, maybe in next version we can have generic categories of legal basis and define this as a contract within it 11:01:12 This will allow specifying legal basis for transferring data from Controller to Processor 11:04:10 Topic: Safeguard for Data Transfer 11:06:40 Complicated because are safeguards same as technical and organisational measures 11:06:42 TBD 11:07:54 Topic: Next meeting 11:08:07 25 NOV 13:00 Dublin, 14:00 CET 11:09:36 zakim, bye 11:09:36 leaving. As of this point the attendees have been harsh, PaulRyan, GeorgKrogg, BeatrizEsteves 11:09:36 Zakim has left #dpvcg 11:09:41 rrsagent, make log public 11:10:06 rrsagent, draft minutes 11:10:06 I have made the request to generate https://www.w3.org/2020/11/18-dpvcg-minutes.html harsh 11:10:14 rrsagent, bye 11:10:14 I see no action items