13:02:36 RRSAgent has joined #dpvcg 13:02:36 logging to https://www.w3.org/2020/11/25-dpvcg-irc 13:02:40 Zakim has joined #dpvcg 13:03:09 ScribeNick: harsh 13:03:18 Meeting: DPVCG Meeting Call Nov-25 13:05:03 Chair: harsh 13:05:32 Present: harsh, georg, paul, beatriz, rana 13:06:55 Topic: Risk 13:08:04 We have Risk and hasRisk as generic concepts to associate risk, and RiskMitigationMeasure to indicate mitigation 13:08:36 Agreed to have that as top-level concept, and later think about expanding via taxonomy based on use-cases and legal requirements 13:11:10 paul: how does DPV relate to compliance? 13:11:30 harsh: compliance can be determining or evaluating obligations and compliance, demonstrating compliance, and documenting compliance 13:11:49 DPV provides a (semi-) standardised or an extendable vocabulary for representing information towards this 13:12:05 present+ mark 13:12:17 mark: there is also the notion of conformance which relates to compliance (processes) 13:14:59 Topic: Entities 13:18:35 Data Protection Authority: should this be supervisory authority, as defined in GDPR? 13:19:02 The global norm seems to be 'data protection authority', e.g. see https://en.wikipedia.org/wiki/National_data_protection_authority 13:20:22 Also the EU seems to prefer DPA as data protection authority: https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-are-data-protection-authorities-dpas_en 13:21:54 Sub-Processor: do we need to distinguish between Processor and Sub-Processor 13:23:38 mark: in some cases there are restrictions or obligations associated with sub-processors, so it would be helpful to have this concept 13:24:01 georg: a sub-processor is still a processor, and in GDPR, there is no distinction (in the term itself), so we can do with just one term (processor) 13:27:10 The term itself seems to be used in the real-world to indicate the relationship and third-parties involved. E.g. https://www.atlassian.com/legal/sub-processors 13:28:08 georg: The primary relationship is between a controller and processors vis. purpose. Is there any other relationship? 13:28:23 mark: The controller will need to know if the list of sub-processors will change, so this is an use-case 13:41:54 Agreed to have sub-processor as a term 13:43:29 Minor vs Child: Child is definitely a related term, but we decide about 'minor' later based on legal definitions and common usage 13:43:37 We accept Child as a concept for DPV 13:48:19 Third Country: how to define this? Is this related to jurisdiction(s) i.e. EU 13:49:07 If this is related to jurisdiction, how to represent that in terms of membership e.g. third country wrt EU 13:50:05 For GDPR, this relates to Recipient --> Country (Third Country) 13:51:50 georg: Since this is related to country (only), we don't need to describe Third Countries per se 13:52:03 Agreed to have this term as 'proposed' and revisit it in the next discussion 13:53:13 Aceepted: property 'has_identifier' to indicate an (external) identifier associated with an entity e.g. Company registration number 14:01:48 Topic: DPV v0.2 14:01:57 Proposed terms have been discussed and addressed 14:02:08 Next step is to formalise serialisation and create documentation 14:02:15 Harsh will be working on this over the weekend 14:02:32 Plan is to complete the documentation by 30-NOV 14:03:12 Contributors to add names, affiliations, funding acknowledgments where pertinent. Please send them on to Harsh for inclusion. 14:03:14 Next meeting 2 DEC 14:00 CET : look at documentation 14:03:59 rrsagent, please create minutes v2 14:03:59 I have made the request to generate https://www.w3.org/2020/11/25-dpvcg-minutes.html harsh 14:04:10 rrsagent, please publish minutes 14:04:10 I have made the request to generate https://www.w3.org/2020/11/25-dpvcg-minutes.html harsh 14:06:34 rrsagent, make log public 14:10:33 zakim, please part 14:10:33 leaving. As of this point the attendees have been harsh, georg, paul, beatriz, rana, mark 14:10:33 Zakim has left #dpvcg 14:10:39 rrsagent, please part 14:10:39 I see no action items