View source for Adoption of DPVCG

= Adoption of DPVCG =

This page provides information about current adoptions, uses, and implementations of the work done by DPVCG, including DPV and DPV-GDPR. Community members should use their W3C account to edit this page. Others should communicate with an existing member or send an email to the group.

Suggested categories for classifying:
* Works that utilise DPV towards an application or goal
* Works that extend DPV
* Works that evaluate DPV e.g. for suitability, extent, feasibility of specified criteria
* Works that compare DPV with other approaches
* Works that mention DPV

Suggested categories for sources:
* Academic or peer-reviewed articles 
* Blog posts, reports, and other informal articles
* Social media communications or mentions of interest

= Application of DPV in a particular task or use case =

This section lists publications that describe use of DPV in specific applications and use-cases.

* [https://doi.org/10.5220/0009464507870795 Ryan, P., Crane, M., & Brennan, R. (2020). Design Challenges for GDPR RegTech.] [https://arxiv.org/ftp/arxiv/papers/2005/2005.12138.pdf ''open-access: arXiv''] & [https://link.springer.com/chapter/10.1007/978-3-030-75418-1_41 Ryan, P., Crane, M. and Brennan, R., 2020, May. GDPR Compliance tools: best practice from RegTech. In ''International Conference on Enterprise Information Systems'' (pp. 905-929). Cham: Springer International Publishing.] -- The authors state in both papers that DPV is going to be used ''"to describe the context using explicit semantics"'' in an open-source tool for high-level GDPR compliance evaluation which is based on a self-assessment checklist created by a data protection regulator.

* [https://link.springer.com/chapter/10.1007/978-3-030-49778-1_5 Calvaresi, D., Schumacher, M., & Calbimonte, J. P. (2020, October). Personal Data Privacy Semantics in Multi-Agent Systems Interactions. In ''International Conference on Practical Applications of Agents and Multi-Agent Systems'' (pp. 55-67). Springer, Cham.] ; [https://www.researchgate.net/profile/Davide_Calvaresi/publication/340137395_Personal_Data_Privacy_Semantics_in_Multi-Agent_Systems_Interactions/links/5e7b3e3a4585152fc0ecbc2a/Personal-Data-Privacy-Semantics-in-Multi-Agent-Systems-Interactions.pdf OA copy researchgate] -- The authors use DPV to represent personal data handling policies and information about consent.

* [http://ebooks.iospress.nl/doi/10.3233/FAIA200851, Valentina Leone, Luigi Di Caro: The Role of Vocabulary Mediation to Discover and Represent Relevant Information in Privacy Policies. ''JURIX 2020'': 73-82] -- The authors proposed a method to automatically discover the relevant information in privacy policies by means of integrating the knowledge represented in the DPV with the information modelled in BabelNet.

* [https://doi.org/10.1007/978-3-030-62522-1_32, Krasnashchok K., Mustapha M., Al Bassit A., Skhiri S. (2020) Towards Privacy Policy Conceptual Modeling. In: ''Dobbie G., Frank U., Kappel G., Liddle S.W., Mayr H.C. (eds) Conceptual Modeling. ER 2020. Lecture Notes in Computer Science'', vol 12400. Springer, Cham.] -- The authors proposed a conceptual model for the fine-grained representation of privacy policies by means of mapping concepts to DPV.

* [https://doi.org/10.1109/PST52912.2021.9647826, K. García, Z. Zihlmann, S. Mayer, A. Tamò-Larrieux and J. Hooss, "Towards Privacy-Friendly Smart Products," 2021 18th International Conference on Privacy, Security and Trust (PST), 2021, pp. 1-7] -- The authors use DPV to record processing activities and data collected by a toy robot.

* [https://ieeexplore.ieee.org/abstract/document/9583717, B. Esteves, H. J. Pandit and V. Rodríguez-Doncel, "ODRL Profile for Expressing Consent through Granular Access Control Policies in Solid," ''2021 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)'', 2021, pp. 298-306, doi: 10.1109/EuroSPW54576.2021.00038.] -- The authors use DPV and [https://www.w3.org/TR/odrl-model/, ODRL] to specify GDPR-aligned policies to determine access control to [https://solidproject.org/, Solid] Pods.

* [https://link.springer.com/chapter/10.1007/978-3-031-11609-4_3, Esteves, B., Rodríguez-Doncel, V., Pandit, H.J., Mondada, N., McBennett, P. (2022). Using the ODRL Profile for Access Control for Solid Pod Resource Governance. In: ''The Semantic Web: ESWC 2022 Satellite Events. ESWC 2022''. Lecture Notes in Computer Science, vol 13384. Springer, Cham. https://doi.org/10.1007/978-3-031-11609-4_3] [https://doi.org/10.5281/zenodo.6614165 Open Access] -- follow-up paper to the above one presenting a demo implementation

* [https://doi.org/10.1145/3487553.3524630 Debackere, L., Colpaert, P., Taelman, R. and Verborgh, R., 2022, April. A policy-oriented architecture for enforcing consent in solid. In ''Companion Proceedings of the Web Conference 2022'' (pp. 516-524).] & [https://libstore.ugent.be/fulltxt/RUG01/003/063/349/RUG01-003063349_2022_0001_AC.pdf Debackere, L., 2022. Enforcing Data Protection in Solid: A Policy-Oriented.] -- The authors use DPV and ODRL to specify policies to assist authorisation agents in enforcing consent.

* [https://www.mdpi.com/2504-2289/6/3/90 Gambarelli, G. and Gangemi, A., 2022. PRIVAFRAME: A frame-based knowledge graph for sensitive personal data. ''Big Data and Cognitive Computing'', 6(3), p.90.] -- The authors use DPV to train a model to annotate textual datasets containing personal data using the personal data extension.

* [https://ieeexplore.ieee.org/abstract/document/10031607/ Gambarelli, G., Gangemi, A. and Tripodi, R., 2023. Is your model sensitive? SPEDAC: A New resource for the automatic classification of sensitive personal data. IEEE Access, 11, pp.10864-10880.] -- The authors use DPV, and in particular the personal data extension, to create a benchmark of datasets labelled as containing personal data/categories of personal data.

* [https://link.springer.com/chapter/10.1007/978-3-031-44939-0_7 Grünewald, E., Halkenhäußer, J.M., Leschke, N., Washington, J., Paupini, C. and Pallas, F., 2023, April. Enabling versatile privacy interfaces using machine-readable transparency information. In ''Privacy Symposium: Data Protection Law International Convergence and Compliance with Innovative Technologies'' (pp. 119-137). Cham: Springer International Publishing.] -- The authors mention that DPV can be used to represent privacy-related terminology with standardised wording.

* [https://link.springer.com/chapter/10.1007/978-3-031-33455-9_33 Bailly, H., Papanna, A. and Brennan, R., 2023, May. Prototyping an End-User User Interface for the Solid Application Interoperability Specification Under GDPR. In European Semantic Web Conference (pp. 557-573). Cham: Springer Nature Switzerland.] -- The authors use DPV to extend the Solid Application Interoperability specification to define access and usage control authorisations.

* [https://content.iospress.com/articles/semantic-web/sw223220 Sun, C., Gallofré Ocaña, M., van Soest, J. and Dumontier, M., 2023. ciTIzen-centric DAta pLatform (TIDAL): Sharing distributed personal data in a privacy-preserving manner for health research. Semantic Web, 14(5), pp.977-996.] -- The authors use DPV to structure requests for health data stored in Solid Pods.

* [https://content.iospress.com/articles/semantic-web/sw243583 Pandit, H.J. and Esteves, B., 2023. Enhancing Data Use Ontology (DUO) for health-data sharing by extending it with ODRL and DPV. Semantic Web, (Preprint), pp.1-26.] -- The authors use DPV and ODRL to extend the Data Use Ontology and propose a policy matching algorithm for the sharing of health data for research purposes.

* [https://doi.org/10.3233/FAIA230228 Feiyang Tang, Bjarte M. Østvold, Magiel Bruntink. Helping Code Reviewer Prioritize: Pinpointing Personal Data and Its Processing. In ''New Trends in Intelligent Software Methodologies, Tools and Techniques: Proceedings of the 22nd International Conference on New Trends in Intelligent Software Methodologies, Tools and Techniques (SoMeT_23)'' (Vol. 371, p. 109). IOS Press.] -- The authors use DPV in a tool to identify personal data processing activities in source code repositories.

* [https://content.iospress.com/articles/semantic-web/sw212883 Ekaputra, Fajar J. et al. ‘Semantic-enabled Architecture for Auditable Privacy-preserving Data Analysis’. 1 Jan. 2021 : 1 – 34.] Authors use DPV as basis for usage policies in a semantic-enabled architecture for auditable, privacy-preserving data analysis

* [https://doi.org/10.1109/ACCESS.2024.3364533 G. B. Herwanto, G. Quirchmayr and A. M. Tjoa, "Leveraging NLP Techniques for Privacy Requirements Engineering in User Stories," in IEEE Access, vol. 12, pp. 22167-22189, 2024] -- The authors propose a machine learning-based approach for identifying privacy requirements in an agile software development environment making use of NLP techniques

* [https://doi.org/10.3390/s22145428 Becher, S.; Gerl, A. ConTra Preference Language: Privacy Preference Unification via Privacy Interfaces. Sensors 2022, 22, 5428.] -- The authors initially include DPV in their "Privacy Vocabulary Registry" that can be used in a system to align privacy preferences of data subjects and privacy policies.

* [https://doi.org/10.3233/SW-223212 Navarro-Gallinad, Albert et al. ‘Evaluating the Usability of a Semantic Environmental Health Data Framework: Approach and Study’. 1 Jan. 2023 : 787 – 810.] -- The authors use DPV to represent data protection information in a Health Data Research scenario that requires the consent of patients to share personal data.

* [https://doi.org/10.3390/info14120631 Florea M, Esteves B. Is Automated Consent in Solid GDPR-Compliant? An Approach for Obtaining Valid Consent with the Solid Protocol. Information. 2023; 14(12):631] -- The authors use DPV to express privacy and consent information in context of the Solid project.

* [https://library.oapen.org/bitstream/handle/20.500.12657/58395/1/978-3-030-98636-0.pdf#page=279 Hernandez, Julio, Lucy McKenna, and Rob Brennan. "TIKD: A Trusted Integrated Knowledge Dataspace for Sensitive Data Sharing and Collaboration." Data Spaces: Design, Deployment and Future Directions. Cham: Springer International Publishing, 2022. 265-291.] -- The authors use DPV to formalize the description of personal data handlings in a data space that aims at GDPR compliance

* [https://ceur-ws.org/Vol-3632/ISWC2023_paper_491.pdf Esteves, B., 2023. Towards an Architecture for Data Altruism in Solid.] -- The authors use DPV and ODRL to formulate policies for the altruistic sharing of data using Solid Pods.

* [https://www.mdpi.com/1424-8220/23/13/6188 Kurteva, A., Chhetri, T.R., Tauqeer, A., Hilscher, R., Fensel, A., Nagorny, K., Correia, A., Zilverberg, A., Schestakov, S., Funke, T. and Demidova, E., 2023. The smashHitCore ontology for GDPR-compliant sensor data sharing in smart cities. ''Sensors'', 23(13), p.6188.] & [https://www.researchgate.net/profile/Anelia-Kurteva/publication/367052478_Making_Sense_of_Consent_with_Knowledge_Graphs/links/63bfd0d5a99551743e60a486/Making-Sense-of-Consent-with-Knowledge-Graphs.pdf Kurteva, A., Making sense of consent with knowledge graphs.] -- The authors use DPV and other vocabularies, e.g., GConsent, FIBO, PROV-O, DCAT, to represent information related to consent records and contracts for businesses to deal with GDPR requirements, in particular related to the processing of sensor data.

* [https://doras.dcu.ie/28977/ Esteves, Beatriz, and Harshvardhan J. Pandit. "Using patterns to manage governance of solid apps." (2023).] -- The authors use DPV for expressing legal requirements in the context of a policy language to describe the entities, infrastructure, legal roles, policies, notices, and records to understand and establish responsibilities and accountability within the Solid ecosystem.

* [https://doi.org/10.3233/SSW210043 Paul Ryan, Harshvardhan J. Pandit, Rob Brennan: Building a Data Processing Activities Catalog: Representing Heterogeneous Compliance-Related Information for GDPR Using DCAT-AP and DPV. SEMANTiCS 2021: 169-182] -- The authors combine DCAT-AP (Data Catalogue vocabulary for data portals in Europe) and DPV to express the concepts necessary to complete a ROPA (Records of Processing Activities).

* [https://doi.org/10.48550/arXiv.2309.15971 Sanonda Datta Gupta, Torsten Hahmann: OPPO: An Ontology for Describing Fine-Grained Data Practices in Privacy Policies of Online Social Networks. CoRR abs/2309.15971 (2023)] -- The authors use/import DPV in their proposed OWL Ontology for Privacy Policies of OSNs (OPPO) – that aims at formalizing detailed data practices from Online Social Networks.

* [https://link.springer.com/chapter/10.1007/978-3-031-36190-6_6 Taheri, Y., Bourgne, G. and Ganascia, J.G., 2021, November. A compliance mechanism for planning in privacy domain using policies. In ''JSAI International Symposium on Artificial Intelligence'' (pp. 77-92). Cham: Springer Nature Switzerland.] -- The authors use DPV as the vocabulary to populate ASP rules for automated compliance checking.

* [http://amsdottorato.unibo.it/id/eprint/9747 Leone, V., 2021. Legal knowledge extraction in the data protection domain based on Ontology Design Patterns.] -- The author uses DPV to model machine-readable privacy policies from human-readable policies through Ontology Design Patterns (ODPs).

* [https://ceur-ws.org/Vol-2759/paper2.pdf Calbimonte, J.P., Calvaresi, D. and Schumacher, M., 2020. Decentralized management of patient profiles and trajectories through semantic web agents. In ''Proceedings of the 3rd International Workshop on Semantic Web Meets Health Data Management (SWH 2020)''. 2 November 2020.] -- The authors use DPV to negotiate access to data in decentralised settings through Web agents.

* [http://www.tara.tcd.ie/bitstream/handle/2262/102971/PhD_Thesis_ANG_ethesis_book.pdf?sequence=5 Gallinad, A.N., 2023. ''A Usable Knowledge Graph Framework for Linking Health Events with Environmental Data'' (Doctoral dissertation, Trinity College Dublin Ireland).] -- The author uses DPV to describe the use and processing of personal health data.

* [http://amsdottorato.unibo.it/10662/ Zichichi, M., 2023. Decentralized systems for the protection and portability of personal data.] -- The author uses DPV with the Media Contract Ontology (MCO) to represent access control policies used in DLTs and smart contracts.

= Use of DPV in Industry/Commercial settings =

* [https://signatu.com/ Signatu] - uses DPV to represent information in its SaaS platform for GDPR compliance and Data Governance
* DPV was involved in SPECIAL H2020 Project which contained Industry partners: World Wide Web Consortium (W3C), Unabhängiges Landeszentrum für Datenschutz (ULD, Data Protection Authority), TenForce, PROXIMUS/Belgacom, Deutsche Telekom AG, Thomson Reuters
* DPV is being used by TRAPEZE H2020 Project which contains Industry partners: TENFORCE (BE), Deutsche Telekom (DE), CaixaBank (ES), Unabhängiges Landeszentrum für Datenschutz, Schleswig-Hostein (DE), Kaspersky Lab Italia (IT)
* DPV is being used by SmashHit H2020 Project which contains Industry partners: The Open Group Limited (United Kingdom), Volkswagen Aktiengesellschaft (Germany), Lexisnexis Risk Solutions (europe)ltd (Ireland), Forum Virium Helsinki Oy (Finland), Infotripla Oy (Finland), Atos Spain Sa (Spain), Atos It Solutions And Services Iberia Sl (Spain)

= Use in Projects containing Industry/Commercial Partners =

* [https://specialprivacy.ercim.eu/ SPECIAL H2020 project] -- The SPECIAL project (Scalable Policy-aware Linked Data Architecture For Privacy, Transparency and Compliance) developed method for the acquisition of user consent at collection time and the recording of both data and metadata (consent policies, event data, context) according to legislative and user-specified policies. SPECIAL launched the W3C Data Privacy Vocabularies and Controls Community Group (DPVCG) as a follow-up action of a very successful workshop on ‘Data Privacy Controls and Vocabularies’ that SPECIAL held together with W3C in April 2018. The consortium partners are the Vienna University of Business and Economics (WU), World Wide Web Consortium (W3C), the Unabhängiges Landeszentrum für Datenschutz (ULD), the Centro Regionale Information Communication Technology (CeRICT), the Technische Universität Berlin (TU-Berlin), TenForce, PROXIMUS/Belgacom, Deutsche Telekom AG and Thomson Reuters.
* [https://trapeze-project.eu/ TRAPEZE H2020 project] -- TRAPEZE (Transparency, Privacy & Security for European Citizens) uses DPV for creating a semantic policy language that uniformly represents: Privacy policies, data subjects’consent, data protection regulations. It is developing a machine understandable vocabulary and automated compliance checking using an OWL2 profile that uses formal semantics to provide provably correct compliance (no false positives nor negatives) with high performance (real time compliance checking: ~200 μsec/check). TRAPEZE’s industrial partners test these implementations by writing their privacy policies using the developed framework. To facilitate greater adoption, TRAPEZE is creating a JSON serialisation (equivalent to OWL2 version). The project includes 13 partners from seven European countries: TENFORCE (BE), ERCIM – The European Research Consortium for Informatics and Mathematics (FR), TU Berlin (DE), Informatie Vlaanderen (BE), Deutsche Telekom (DE), CaixaBank (ES), CINI – Consorzio Interuniversitario Nazionale per l’Informatica (IT), Unabhängiges Landeszentrum für Datenschutz, Schleswig-Hostein (DE), Kaspersky Lab Italia (IT), Institute Mihajlo Pupin (RS), IPSOS (BE), Athens Technology Centre (GR) and  E-Seniors Association (FR).
* [https://smashhit.eu/ SmashHit H2020 project] -- SmashHit has developed an ontology for GDPR compliant sensor data sharing in the smart cities and insurance domains that uses DPV in its ontologies to model contracts and consent information as Knowledge Graphs. The consortium includes Universitaet Innsbruck (Austria), Gottfried Wilhelm Leibniz Universitaet Hannover (Germany), The Open Group Limited (United Kingdom), Volkswagen Aktiengesellschaft (Germany), Lexisnexis Risk Solutions (europe)ltd (Ireland), Forum Virium Helsinki Oy (Finland), Infotripla Oy (Finland), Atos Spain Sa (Spain), Atos It Solutions And Services Iberia Sl (Spain), Rheinische Friedrich-wilhelms-universitat Bonn (Germany).
* [https://mosaicrown.eu/ MOSAICrOWN H2020 project] -- TBA
* [https://fairvasc.eu/ FAIRVASC H2020 project] -- uses semantic-web technologies to link vasculitis (health condition) registries across Europe into a ‘single European dataset’, and thus open the door to new research into these challenging diseases by using FAIR principles for better data sharing. It uses DPV to annotate datasets with policies and represent consent information.

= Extensions to DPV =

* [http://www.tara.tcd.ie/bitstream/handle/2262/92446/PhD_Thesis_submitted_hardbound_print.pdf?sequence=3 Pandit, H.J., 2020. Representing activities associated with processing of personal data and consent using semantic web for GDPR compliance. ''Trinity College Dublin, School of Computer Science & Statistics''.] -- The contributions of the thesis were submitted as input to the DPVCG.

* [https://doi.org/10.1007/s10115-020-01468-x, Debruyne, C., Pandit, H.J., Lewis, D. et al. “Just-in-time” generation of datasets by considering structured representations of given consent for GDPR compliance. ''Knowl Inf Syst 62'', 3615–3640 (2020).] -- The authors extend DPV with additional predicates for annotating and interlinking data schemas and use PROV-O for the evolution of consent.

* "A Common Semantic Model of the GDPR Register of Processing Activities" by [http://doras.dcu.ie/25388/1/FAIA-334-FAIA200876.pdf, : . ''JURIX 2020'': 251-254]

* [https://link.springer.com/article/10.1007/s42979-022-01099-9 Ryan, P. and Brennan, R., 2022. Support for enhanced GDPR accountability with the common semantic model for ROPA (CSM-ROPA). SN Computer Science, 3(3), p.224.] -- The authors extend DPV with additional terms to document ROPAs.

* [https://doi.org/10.3390/info13050244 Ryan, P.; Brennan, R.; Pandit, H.J. DPCat: Specification for an Interoperable and Machine-Readable Data Processing Catalogue Based on GDPR. Information 2022, 13, 244.] Additional publication about the CSM-ROPA application/extension above.

* [https://www.researchgate.net/profile/Hassan-Raza-69/publication/372690104_The_Semantic_data_sharing_platform_using_Blockchain_A_GDPR_perspective/links/64c399610fae1319bfbdc436/The-Semantic-data-sharing-platform-using-Blockchain-A-GDPR-perspective.pdf Raza, H. and Ahmed, M., The Semantic data sharing platform using Blockchain: A GDPR perspective.] -- The authors extend DPV with concepts from the healthcare domain.

* [https://ebooks.iospress.nl/doi/10.3233/SSW230015 Beatriz Esteves, Víctor Rodríguez Doncel, Harshvardhan J. Pandit, Dave Lewis. Semantics for Implementing Data Reuse and Altruism Under EU’s Data Governance Act. In Knowledge Graphs: Semantics, Machine Learning, and Languages: Proceedings of the 19th International Conference on Semantic Systems, 20-22 September 2023, Leipzig, Germany (Vol. 56, p. 210)] -- The authors extend DPV with concepts specific to the Data Governance Act (DGA)

* [http://hdl.handle.net/2262/100126 Pandit, H. J. A semantic specification for data protection impact assessments (dpia). Towards a Knowledge-Aware AI: SEMANTiCS 2022—Proceedings of the 18th International Conference on Semantic Systems, 13-15 September 2022, Vienna, Austria. Vol. 55. IOS Press, 2022.] -- The author describes an extension to DPV for documenting DPIAs and an ontology for risk management based on ISO 31000 family of standards.

* [https://dl.acm.org/doi/abs/10.1145/3565011.3569061 Esteves, Beatriz, et al. "Fostering trust with transparency in the data economy era: An integrated ethical, legal, and knowledge engineering approach." Proceedings of the 1st International Workshop on Data Economy. 2022.] -- The authors describe the Privacy Paradigm ODRL Profile (PPOP), which extends ODRL and DPV to specify data processing requirements for personal datastores like Solid PODs

* [https://ebooks.iospress.nl/volumearticle/65578 Pandit, H.J., Ryan, P., Krog, G.P., Crane, M. and Brennan, R., 2023. Towards a Semantic Specification for GDPR Data Breach Reporting. In ''Legal Knowledge and Information Systems'' (pp. 131-136). IOS Press.] -- The authors extend DPV by introducing new concepts required for data breach relevant information.

* [https://ebooks.iospress.nl/volumearticle/58545 Hickey, D. and Brennan, R., 2021. A GDPR International Transfer Compliance Framework Based on an Extended Data Privacy Vocabulary (DPV). In ''Legal Knowledge and Information Systems'' (pp. 161-170). IOS Press.] -- The authors describe a tool that uses an extended version of DPV to audit and monitor GDPR compliance of international transfers of personal data.

= Evaluation/Comparison of DPV =
* [https://doi.org/10.1007/978-3-030-64452-9_34 Thalhath N., Nagamori M., Sakaguchi T. (2020) MetaProfiles - A Mechanism to Express Metadata Schema, Privacy, Rights and Provenance for Data Interoperability. In: ''Ishita E., Pang N.L.S., Zhou L. (eds) Digital Libraries at Times of Massive Societal Transition. ICADL 2020. Lecture Notes in Computer Science'', vol 12504. Springer, Cham.]
* [https://content.iospress.com/articles/semantic-web/sw223009 Esteves, B., Rodríguez-Doncel, V. (2022) "Analysis of Ontologies and Policy Languages to Represent Information Flows in GDPR". ''Semantic Web Journal'': 1 – 35.] -- compare DPV with other personal data protection vocabularies regarding their capacity to represent informational elements described in GDPR's Chapter III on data subject rights and in Chapter IV on the obligations of data controllers and processors.
* [https://www.mdpi.com/2078-2489/14/7/351 Asgarinia, H., Chomczyk Penedo, A., Esteves, B. and Lewis, D., 2023. “Who Should I Trust with My Data?” Ethical and Legal Challenges for Innovation in New Decentralized Data Management Technologies. ''Information'', 14(7), p.351.] -- compare DPV with other personal data protection vocabularies and policy languages regarding their machine-readability, maintenance, availability, GDPR support and existence of compliance tools.

= Mentions of DPV =

* [https://link.springer.com/article/10.1007/s10916-020-01620-8 Calvaresi, D., Schumacher, M., & Calbimonte, J. P. (2020). Agent-based modeling for ontology-driven analysis of patient trajectories. ''Journal of medical systems, 44''(9), 1-11. (open-access)]

* [https://link.springer.com/article/10.1007/s13218-020-00677-4 Bonatti, P. A., Kirrane, S., Petrova, I. M., & Sauro, L. (2020). Machine Understandable Policies and GDPR Compliance Checking. ''KI-Künstliche Intelligenz, 34''(3), 303-315.] [https://arxiv.org/abs/2001.08930 ''open-access: arXiv'']

* [https://link.springer.com/chapter/10.1007/978-3-030-58135-0_9 Matulevičius, R., Tom, J., Kala, K., & Sing, E. (2020, June). A Method for Managing GDPR Compliance in Business Processes. In ''International Conference on Advanced Information Systems Engineering'' (pp. 100-112). Springer, Cham.]

* [https://oa.upm.es/id/eprint/65829 Caiza Ñacato, J.C., 2020. ''Contribución al diseño de sistemas respetuosos con la privacidad usando patrones'' (Doctoral dissertation, Telecomunicacion).]

* [https://link.springer.com/chapter/10.1007/978-3-030-89811-3_22 Esteves, B., 2020, December. Challenges in the Digital Representation of Privacy Terms. In ''International Workshop on AI Approaches to the Complexity of Legal Systems'' (pp. 313-327). Cham: Springer International Publishing.]

* [https://doi.org/10.1109/EuroSPW54576.2021.00039 Grünewald, E., Wille, P., Pallas, F., Borges, M.C. and Ulbricht, M.R., 2021, September. TIRA: an OpenAPI extension and toolbox for GDPR transparency in RESTful architectures. In ''2021 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)'' (pp. 312-319). IEEE.]

* [https://www.mdpi.com/1660-4601/18/23/12572 McDonald, N., McKenna, L., Vining, R., Doyle, B., Liang, J., Ward, M.E., Ulfvengren, P., Geary, U., Guilfoyle, J., Shuhaiber, A. and Hernandez, J., 2021. Evaluation of an access-risk-knowledge (ARK) platform for governance of risk and change in complex socio-technical systems. ''International Journal of Environmental Research and Public Health'', 18(23), p.12572.]

* [https://www.scss.tcd.ie/publications/theses/diss/2021/TCD-SCSS-DISSERTATION-2021-046.pdf Flesch, B., 2021. ''Investigating the suitability of blockchain for managing patients consent in clinical trials'' (Master dissertation, School of Computer Science and Statistics, Trinity College Dublin).]

* [https://ieeexplore.ieee.org/abstract/document/9799369/?casa_token=72StXx_hPLIAAAAA:6YppJB3LINvP6bDh1uCJROIP25uoGh_UXgkQiQ4yqQ3naJ_GizMg5ys13gGDycPJ7JA4ERD8E_aO Human, S., Pandit, H.J., Morel, V., Santos, C., Degeling, M., Rossi, A., Botes, W., Jesus, V. and Kamara, I., 2022, June. Data protection and consenting communication mechanisms: Current open proposals and challenges. In ''2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)'' (pp. 231-239). IEEE.]

* [https://brill.com/view/journals/ejhl/30/2/article-p129_1.xml Becker, R., Chokoshvili, D., Comandé, G., Dove, E.S., Hall, A., Mitchell, C., Molnár-Gábor, F., Nicolàs, P., Tervo, S. and Thorogood, A., 2022. Secondary Use of Personal Health Data: When Is It “Further Processing” Under the GDPR, and What Are the Implications for Data Controllers?. ''European Journal of Health Law'', 30(2), pp.129-157.]

* [https://ieeexplore.ieee.org/abstract/document/9730898/ Jesus, V. and Pandit, H.J., 2022. Consent receipts for a usable and auditable web of personal data. IEEE Access, 10, pp.28545-28563.]

* [https://ui.adsabs.harvard.edu/abs/2022arXiv220909724H/abstract Human, S., 2022. Advanced data protection control (adpc): An interdisciplinary overview. arXiv e-prints, pp.arXiv-2209.]

* [https://www.mdpi.com/2078-2489/14/2/114 Pandit, H.J., 2023. Making sense of Solid for data governance and GDPR. ''Information'', 14(2), p.114.]

* [https://ieeexplore.ieee.org/abstract/document/9582331 G. B. Herwanto, G. Quirchmayr and A. M. Tjoa, "A Named Entity Recognition Based Approach for Privacy Requirements Engineering," 2021 IEEE 29th International Requirements Engineering Conference Workshops (REW), Notre Dame, IN, USA, 2021]

* [https://ieeexplore.ieee.org/abstract/document/9583722 P. A. Bonatti, L. Sauro and J. Langens, "Representing Consent and Policies for Compliance," 2021 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Vienna, Austria, 2021]

* [https://doi.org/10.1109/EuroSPW54576.2021.00044 L. Sion, D. V. Landuyt and W. Joosen, "An Overview of Runtime Data Protection Enforcement Approaches," 2021 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Vienna, Austria, 2021, pp. 351-358.]

* [https://content.iospress.com/articles/semantic-web/sw233435 Bushati, Geni et al. ‘What Is in Your Cookie Box? Explaining Ingredients of Web Cookies with Knowledge Graphs’. 1 Jan. 2023 : 1 – 17.]

* [https://books.google.com/books?hl=en&lr=&id=6VA2EAAAQBAJ&oi=fnd&pg=PA107&ots=0dF3ZFp6T7&sig=NgHpdFCjMQUoYhhLK6g0dR4MsGQ Pandit, H.J., O’Sullivan, D. and Lewis, D., 2021. A Design Pattern Describing Use of Personal Data in Privacy Policies. In ''Advances in Pattern-Based Ontology Engineering'' (pp. 107-119). IOS Press.]

* [http://www.tara.tcd.ie/bitstream/handle/2262/96722/PhDThesis-RoghaiyeGachpazHamed-15338853-final%20version.pdf?sequence=1 Hamed, R.R.G., 2021. ''Enhancing the Transparency of Personal Data Access through Semantic Web Technologies'' (Doctoral dissertation, School of Computer Science & Statistics ADAPT Research Centre Knowledge and Data Engineering Group (KDEG), Trinity College Dublin).]

* [https://ebooks.iospress.nl/volumearticle/64023 Acosta, M. "The FLINT Ontology: An Actor-Based Model of Legal Relations." Knowledge Graphs: Semantics, Machine Learning, and Languages: Proceedings of the 19th International Conference on Semantic Systems, 20-22 September 2023, Leipzig, Germany. Vol. 56. IOS Press, 2023.]

* [https://arxiv.org/abs/2112.13994 Pattaraporn Sangaroonsilp, Hoa Khanh Dam, Morakot Choetkiertikul, Chaiyong Ragkhitwetsagul, Aditya Ghose: Mining and Classifying Privacy and Data Protection Requirements in Issue Reports. CoRR abs/2112.13994 (2021)]

* [https://arxiv.org/abs/2208.05786 Pandit, H.J., 2022. Proposals for Resolving Consenting Issues with Signals and User-side Dialogues. arXiv preprint arXiv:2208.05786.]

* [https://link.springer.com/chapter/10.1007/978-3-030-59833-4_6 Lieber, S., De Meester, B., Verborgh, R. and Dimou, A., 2020. EcoDaLo: federating advertisement targeting with linked data. In ''Semantic Systems. In the Era of Knowledge Graphs: 16th International Conference on Semantic Systems, SEMANTiCS 2020, Amsterdam, The Netherlands, September 7–10, 2020, Proceedings 16'' (pp. 87-103). Springer International Publishing.]

* [https://www.researchgate.net/profile/Sven-Rasmusen/publication/367340891_Increasing_Trust_and_Engagement_in_the_Age_of_GDPR_A_Digital_Contracting_Tool_Supported_by_Knowledge_Graphs/links/63ce682ed9fb5967c2fd3ae0/Increasing-Trust-and-Engagement-in-the-Age-of-GDPR-A-Digital-Contracting-Tool-Supported-by-Knowledge-Graphs.pdf Rasmusen, S.C., 2022. ''Increasing Trust and Engagement in the Age of GDPR: A Digital Contracting Tool Supported by Knowledge Graphs'' (Doctoral dissertation, University of Innsbruck).]

* [https://doras.dcu.ie/28331/ Kurteva, A. and Pandit, H.J., 2023. Relevant research questions for decentralised (personal) data governance.]

* [https://ceur-ws.org/Vol-3235/paper17.pdf Esteves, B. and Rodríguez-Doncel, V., 2022. Semantifying the Governance of Data in Europe. In SEMANTiCS (Posters & Demos).]