Meeting minutes
Same with me.
<Mark> me too
<Mark> but is working now
<Mark> I think
start the meeting
<Mark> I have to drop from the call at 3:30
Georg is presenting demo of Signatu's use of DPV on call / shared screen
Signatu has a "Data Processing Specification" that records processing info such as data source, processing actions - and this record is helpful towards privacy policies or consent screen information.
DPV is used to populate the fields, such as processing actions
Purpose description is free text
DPV purposes have been added, and some other additional ones have also been added. The ones from DPV (?) are prefixed with W3C, with others from IAB and Signatu indicated using prefixes
There is a separate field called "benefit to the end user" which can be used to indicate benefits, usefulness
Data Security Measures implements Technical and Organisational measures from DPV
Indicating sensitive data changes legal basis specific to sensitive data (Art 9) from DPV
Processing duration uses ISO 8601 notations
Recipients are populated using "tracker detect" which detects third parties
Recipients are specified with role (join controller / processor)
And whether a DPA has been agreed on
DPV does not currently specify 'transfer legal bases' (of which there are 18-19)
Q: what format is this information saved in?
Georg: I don't know all the formats, but we do use JSON (-LD perhaps?) using the W3C format
Mark: where did the categories for transfer (?) come from
Georg: From the GDPR
Georg: Type of data is free text because it is difficult for users to understand structured data
Georg: there can be groups of data such as health
<Zakim> Bert, you wanted to ask who fills this form
Georg: we also provide a consent receipt that can be cryptographically verified
harsh: does the consent receipt also use DPV?
Georg: I think we do
Georg: we use the same information to generate privacy policies using a comprehensive questionnaire, with outputs in multiple languages
Georg: comments to DPV - some of the purpose categories are more regarding benefits rather than purposes
Georg: we can also suggest additional purpose categories and transfer legal bases
… G
Georg: we have gdprlexicon gdprlexicon.com/ which supports different language which can be used as a starting point for providing concepts in different languages
… end meeting