12:00:21 RRSAgent has joined #dpvcg 12:00:21 logging to https://www.w3.org/2021/07/07-dpvcg-irc 12:00:24 ScribeNick: harsh 12:00:37 Meeting: DPVCG Meeting Call 2021-07-07 12:00:41 Chair: harsh 12:00:51 Present: harsh, paulR 12:00:57 Regrets: georgK 12:01:19 Date: 07 JUL 2021 12:02:07 Agenda: https://lists.w3.org/Archives/Public/public-dpvcg/2021Jul/0001.html 12:03:06 present+ beatrizE, davidH 12:07:01 Ageda: https://lists.w3.org/Archives/Public/public-dpvcg/2021Jul/0000.html 12:07:19 Topic: Where do Safeguards, Adequacy Decisions, Transfer mechanisms, etc. fit into DPV? 12:07:34 present+ ranaS 12:08:40 present+ markL 12:10:27 paulR: as a DPO, these concepts sit aside other considerations and obligations when defining/representing information about personal data handling 12:10:54 davidH: for SCCs, they refer to data exporter and importer as concepts, which may be controllers or processors - so these have to be fit in with DPV 12:12:30 davidH: three ways to 'legitimise transfers' - derogations under 49, safeguards under 46, or adequacy decision under 45 12:13:36 davidH: EDPB uses the term 'transfer tools' instead of 'safeguards' to refer to these measures 12:15:15 https://edpb.europa.eu/our-work-tools/our-documents/recommendations/recommendations-012020-measures-supplement-transfer_en Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data 12:18:36 markL: what is the relationship between data importer/exporter and controllers/processors 12:39:39 davidH: (shared screen) items in Art. 45, 46, and 49 12:42:32 proposal - do we model something like `hasTransferTool` and let it point at organisational measures? 12:46:27 example - controller may have server in EU and outside-EU, and transferring data between the two does not need legal basis from Art.6 and 9, but only from 45, 46, and 49 12:47:53 proposal - we use 45 and 49 as legal basis, and 46 is also used as legal basis with corresponding concepts in tech & org measures 12:53:42 we need to model concepts from here regardless of concepts used as legal bases; for example code of conduct and certification mechanisms - which exist in tech & org measures; and BCRs, SCCs, adequacy decisions which don't exist as concepts 12:56:44 Topic: Consensus on today's meeting 12:57:11 markL: consensus on legal bases for transfer, not to be confused between Art. 6 and Art. 9 legal bases 12:57:54 paulR: art.45 and art.49 as legal bases, and art.46 in tech & org measures 12:58:29 davidH: cautious about art.46; legal bases must include 45, 46, and 49 13:00:11 markL: reservations about these as they are only technical measures 13:05:10 Topic: Next meeting 13:05:20 We meet next week, JUL-14 13:00 WEST / 14:00 CEST 13:05:27 We will discuss purpose vocabulary refinement 13:05:53 Refer to https://github.com/w3c/dpv/issues/22 for feedback, comments, and proposals 13:06:00 zakim, bye 13:06:00 leaving. As of this point the attendees have been harsh, paulR, beatrizE, davidH, ranaS, markL 13:06:00 Zakim has left #dpvcg 13:06:05 rrsagent, publish minutes v2 13:06:05 I have made the request to generate https://www.w3.org/2021/07/07-dpvcg-minutes.html harsh 13:20:24 rrsagent, set logs world-visible 13:21:06 rrsagent, publish minutes v2 13:21:06 I have made the request to generate https://www.w3.org/2021/07/07-dpvcg-minutes.html harsh 13:21:09 rrsagent, set logs world-visible 13:21:51 rrsagent, publish minutes v2 13:21:51 I have made the request to generate https://www.w3.org/2021/07/07-dpvcg-minutes.html harsh 13:23:30 rrsagent, bye 13:23:30 I see no action items 13:25:45 RRSAgent has joined #dpvcg 13:25:45 logging to https://www.w3.org/2021/07/07-dpvcg-irc 13:26:03 rrsagent, make log public 13:26:47 rrsagent, bye 13:26:47 I see no action items