Meeting minutes
Purpose refinements
(this is a continued topic, please refer to previous minutes for details)
The larger question we discussed asked - How do we help DPV users select the correct purpose(s). The most we can do without specifying the validity of purposes for use would be to provide better descriptions that clarify the meaning and intent behind defining that concept.
An adopter then can compare the descriptions to select one that fits their use-case the best, or in cases there are multiple - select them all.
Georg and Paul will be taking a look at the existing descriptions to identify what needs to be improved.
Exercising Rights
(this is a continued topic, please refer to previous minutes for details)
Last week we discussed the core concepts for Rights Exercise and the associated concepts.
Beatriz shared further work for implementing these for GDPR rights - see mail https://
The broader approach is to consider Rights Exercise as a process that takes some input (e.g. from Data Subject) and produces some output (e.g. from Data Controller).
We analysed specific GDPR rights (A.13-A.22, A-7) to identify these inputs and outputs, and how to represent them using DPV concepts.
When information is to be provided to the data subject, such as for A.13-A.15, this is in the form of a notice. We create specific variations for notices associated with requirements of A.13, A.14, A.15.
For data required to be provided regarding scope, `dpv:hasPersonalDataHandling` is capable of expressing specific patterns such as types of personal data, purposes, legal basis, and so on.
Similarly, for specifying what will be provided in return, the term `dpv:MakeAvailable` regarding processing and personal data is used - such as for Data Portability and copy of personal data.\
This approach enables asking for specific personal data (or specifying options) for specific purposes tied to Rights Exercise, such as Identity Verification.
For expressing metadata about the request, DCMI DCT and PROV-O vocabularies are reused. For example, timestamp is expressed using `dct:date` and activity agent is indicated using `prov:wasAssociatedWith`.
The proposed statuses associated with rights exercises have been moved to a generalised `RequestStatus` concept to allow their use in any request - making them broader than rights.
For expressing Data Portability outputs, which has a special case of providing personal data as a dataset, the DCAT vocabulary will be reused e.g. as `dcat:Dataset` with metadata such as URL it is available at using `dcat:landingPage` and format using `dct:format`.
For cases where a confirmation of processing is to be provided, this is done using `PersonalDataHandling`, and e.g. where no data is being processed, this means returning an empty list that indicates no personal data is being processed.
For indicating cases where there is a fee or complex information regarding validity or criteria or constraints, `dpv:hasPolicy` is used to provide information, which can be in machine-readable format using e.g. `odrl:Policy`. This can include cases such as a fee being charged for information (e.g. based on amount of data).
For providing information about cases where a Right Exercise could not be fulfilled, the existing `hasJustification Justification` concepts are to be reused.
However, rather than modelling them as `RightNonFulfilmentJustification`, as originally proposed, we broaden the scope for Justifications to be associated with anything e.g. compliance, conformance, risk.
We discussed on how these should be provided, and where they should be situated. We concluded that we will collect Justifications, and then group them based on usefulness. For example, some justifications would be _valid_ for Rights Exercises, some for Accountability measures, and so on.
The Justifications will be provided as part of the risk extensions, since they also relate to the organisational notion of risk management.
Next Meeting
We will meet again on NOV-09 13:00 WET / 14:00 CET.
Topics for discussion will be Purpose refinements (continued), and final comments on Right Exercise.
Paul and Georg will be leading the purpose refinement discussion.
Harsh and Beatriz will be leading the rights exercise discussion.
Harsh will update DPV based on what has been discussed today, and push the changes online.