IRC log of dpvcg on 2021-09-08
Timestamps are in UTC.
- 12:01:00 [RRSAgent]
- RRSAgent has joined #dpvcg
- 12:01:00 [RRSAgent]
- logging to https://www.w3.org/2021/09/08-dpvcg-irc
- 12:01:04 [harsh]
- ScribeNick: harsh
- 12:01:08 [harsh]
- Meeting: DPVCG Meeting Call
- 12:01:12 [harsh]
- Chair: harsh
- 12:01:22 [harsh]
- Date: 08 SEP 2021
- 12:01:36 [harsh]
- Agenda: https://lists.w3.org/Archives/Public/public-dpvcg/2021Sep/0000.html
- 12:04:45 [harsh]
- Present: harsh, paulR, beatrizE
- 12:09:13 [harsh]
- Topic: Purposes taxonomy (continued review)
- 12:09:25 [harsh]
- No glaringly obvious issues with minutes from last time
- 12:09:39 [harsh]
- No objections or additional items from participants on this topic
- 12:09:48 [harsh]
- Consensus on purpose additions/changes
- 12:10:07 [harsh]
- Topic: Proposed Concepts for Data Transfers
- 12:10:13 [harsh]
- Present+: davidH, markL
- 12:10:27 [harsh]
- David's email AUG-20 https://lists.w3.org/Archives/Public/public-dpvcg/2021Aug/0007.html with spreadsheet
- 12:11:58 [harsh]
- David: (shared screen of spreadsheet) Data Exporter/Importer is used by EDPB, and therefore these should be defined in DPV
- 12:12:46 [harsh]
- Georg: Supporting inclusion of these terms
- 12:13:00 [harsh]
- present+: Georg
- 12:14:21 [harsh]
- harsh: are these concepts global (DPV) or scoped (DPV-GDPR) ?
- 12:15:02 [harsh]
- markL: would be preferable to have this as global concepts for expressing adequacy
- 12:15:07 [harsh]
- Georg: agree that it should be in DPV
- 12:15:52 [harsh]
- (no disagreements on inclusion of these in DPV)
- 12:18:03 [harsh]
- harsh: inclusion in LegalEntities similar to 'role' as DataController
- 12:18:38 [harsh]
- harsh: How to clarify definition and scope, e.g. importer relates to extra-judicial third-country data transfer recipient
- 12:19:11 [harsh]
- davidH: agree that this has global relevance, third countries everywhere as non-jurisdictional country
- 12:22:00 [harsh]
- Georg: In Signatu, there is data transfer with a 'recipient country' classified on jurisdiction (in/out EU). If there is transfer outside EU/EEA, then there is separate legal basis and term data export/import
- 12:23:26 [harsh]
- davidH: broadening the notion of third country, there is 'recipient country' which can be any country
- 12:36:09 [harsh]
- Present+: julianFlake
- 12:36:27 [harsh]
- dicussing how closely required the constraint of imported being in a third country is to the definition
- 12:44:43 [harsh]
- consensus on removing third country, relating data importer to 'recipient country' and including DataExporter and DataImporter
- 14:08:21 [harsh]
- Next terms - A45, A46, A49 legal bases and their relation to data transfers
- 14:09:05 [harsh]
- Suggestion (prior discussions led by Georg) are to structure the DPV-GDPR legal bases as a hierarchy (e.g. legal bases related to consent), and use data transfer legal bases as a similar categorisation
- 14:09:31 [harsh]
- For this, davidH has proposed adding DataTransferLegalBasis as a category of legal basis (subclass dpv:LegalBasis) within DPV
- 14:09:44 [harsh]
- Consensus on this proposal, no objections. Term added in spreadsheet for DPV.
- 14:10:17 [harsh]
- Note on need to restructure DPV-GDPR based on new(-ish) list of legal bases.
- 14:10:46 [harsh]
- Further categorisations have been proposed along the lines of adequacy (A45), transfers (A46), derogations (A49).
- 14:11:40 [harsh]
- A discussion on how to express the 'relation' and 'applicability' of legal basis for particular contexts, such as data transfers taking place in third countries without adequacy decisions, took place regarding how to express such terms and relations in DPV
- 14:12:20 [harsh]
- Whether to include the 'rules', 'constraints', or 'applicability' as some form of taxonomy. Consensus was that at this stage it would introduce complexity, and force using a particular notion (e.g. specifying where legal bases apply)
- 14:12:51 [harsh]
- Consensus that such explorations can take place outside the DPV and DPV-GDPR documents in a separate extension which can then be merged later depending on correctness and validity.
- 14:13:09 [harsh]
- Next terms - TransferStartDate and TransferEndDate
- 14:13:48 [harsh]
- As per earlier conversation in davidH email with feedback by harsh, DPV does not provide 'minor' terms for strings, dates, times, etc. because they vary in their use and application.
- 14:14:22 [harsh]
- Instead, the 'generic properties' of hasDuration can be used (as is, or specialised) for expressing data transfer durations in terms of start and date with XSD or OWL-TIME.
- 14:14:49 [harsh]
- Topic: Next Meeting
- 14:15:06 [harsh]
- Discussion stopped due to end of meeting time. Next week discussion continues on terms related to transfer safeguards and supplementary measures.
- 14:15:33 [harsh]
- We will have a presentation by Piero Bonatti on work in TRAPEZE, which utilises DPV for expressing policies and checking legal compliance, including consent.
- 14:16:05 [harsh]
- For expressing disagreements or changes to current consensus on terms, members are welcome to submit comments by end of (this) week.
- 14:16:23 [harsh]
- Following next week's meeting, the next iteration of DPV (v0.2.x) will be finalised and published.
- 14:16:29 [harsh]
- zakim, bye
- 14:16:29 [Zakim]
- leaving. As of this point the attendees have been harsh, paulR, beatrizE, :, davidH, markL, Georg, julianFlake
- 14:16:29 [Zakim]
- Zakim has left #dpvcg
- 14:16:32 [harsh]
- rrsagent, publish minutes v2
- 14:16:32 [RRSAgent]
- I have made the request to generate https://www.w3.org/2021/09/08-dpvcg-minutes.html harsh
- 14:16:34 [harsh]
- rrsagent, set logs world-visible
- 14:17:32 [harsh]
- rrsagent, bye
- 14:17:32 [RRSAgent]
- I see no action items