12:00:30 RRSAgent has joined #dpvcg 12:00:30 logging to https://www.w3.org/2021/09/22-dpvcg-irc 12:00:32 ScribeNick: harsh 12:00:34 Meeting: DPVCG Meeting Call 12:00:41 Chair: harsh 12:00:49 Date: 22 SEP 2021 12:01:40 Agenda: https://lists.w3.org/Archives/Public/public-dpvcg/2021Sep/0004.html 12:02:53 Present: harsh, georgK, davidH 12:03:08 present+: beatriz 12:05:14 present+: ranaS 12:05:21 Topic: Concepts for Data Transfers 12:05:36 term - Art45-Adequacy ; we have 45-3 in DPV-GDPR as a legal basis 12:06:58 davidH: when working with adequacy decisions, the country of data transfer is mentioned and whether the country has adequacy 12:07:49 georgK: the specific adequacy decision is also referenced 12:10:49 harsh: so if we create instances of specific adequacy decisions (e.g. for South Korea), then use the decision itself as IRI or link to document, and use annotations to specify country either as string or ISO code 12:10:59 term - Art46 - related to transfer tools 12:12:44 david: A46 provides use of 'safeguards' which include BCR, SCCs, others 12:13:07 david: unclear whether safeguards are techorg measures 12:19:50 proposal - OrgMeasure -> Safeguard -> DataTranferSafeguard 12:22:10 We're unclear where SCCs fit in GDPR. They are a form of contract, but not clear whether they are called SCC globally 12:24:04 We can model them in DPV-GDPR, but specifying SCC as a type of DataTransferSafeguard and a Contract and an implementation A46 legal basis 12:24:27 term - A46 Binding Corporate Rules 12:25:14 davidH: they are essentially contracts, so could be modelled similar to SCC 12:25:23 georgK: BCR are defined in A4.20 12:29:57 We're unclear whether BCR, like SCC, have a global use as a concept. So we model them in the same way as SCC. 12:30:24 term - A46.2 clauses 12:31:52 A46.2a can be any legal instrument, so we leave as is 12:31:59 A46.2b is BCR 12:32:33 A46.2c and 2d are SCC approved by commission but 2d are by supervisory authority 12:34:57 Separate concepts for 2c and 2d 12:38:48 A26.2e is a code of conduct with additional requirements - complex to model. We have a CoC in techorg measure, but this is not sufficient to merely subclass. More research needed. 12:38:59 s/26/46 12:40:15 A46.2f has certification mechanism with additional requirements - also complex to model. More research needed. 12:41:55 A46.3a contractual clauses - subclass of contract 12:42:04 A46.3b - leave as is 12:47:57 term - Supplementary Measure, to be added under DPV-GDPR 12:54:58 term A49.1 are similar to legal bases, in DPV-GDPR the individual clauses are subclassed with these concepts, except e and f 12:55:16 Topic: Next Meeting 12:56:10 In 2 weeks, OCT-06 WED 13:00 CEST / 14:00 CEST 12:56:35 Harsh will share dpv v0.3 outputs for review and ready for publication 12:56:50 Harsh will share list of collected concepts/items to be considered for next steps / actions in DPV 12:56:54 zakim, bye 12:56:54 leaving. As of this point the attendees have been harsh, georgK, davidH, :, beatriz, ranaS 12:56:54 Zakim has left #dpvcg 12:57:02 rrsagent, publish minutes v2 12:57:02 I have made the request to generate https://www.w3.org/2021/09/22-dpvcg-minutes.html harsh 12:57:04 rrsagent, set logs world-visible 12:57:56 rrsagent, bye 12:57:56 I see no action items