Meeting minutes
We will be resolving the proposed terms in continuation of the NOV-4 workshop
Rights
Q: Whose Rights? Controllers, Processors, Data Subject?
Discussion: we have a top-level class called 'Rights' and sub-class it as 'DataSubjectRights' and add the GDPR rights to this
'Sell' in CCPA / CCRA
Discussion: This is specific to a law, and the common use of 'term' differs from this definition. Therefore, it would be better to have a separate profile (e.g. dpv-ccpa) and define the term 'sell' in it, along with equivalence relations to DPV processing categories.
Proposed Terms
Discussing: ThirdCountry
… How to specify that a Processing is taking place in a third country, or that a recipient is in third country
… There is a Location class in PersonalData, does it makes sense to have ThirdCountry as a subset of that?
… There is also the class Country in PersonalData
… How will defining third country as sub-classes of these impact / have consequences?
… TBD
Risk
Discussing: Risk is a high-level concept, that can be associated with different things/concepts
… We have RiskManagementProcedure as an organisational measure
… Risk as a top-level concept, with generic property to enable associating it with any concept
Discussing: RiskMitigationMeasure
… Associate RiskMitigationMeasure with Risk using property mitigatesRisk
Data Breach
Discussing: Is Data Breach a type of Risk? (yes, but more complex)
… Data Breach also is referred to a process
… Data Breach is given high importance in organisational processes, governance, and documents
… Data breach as a category of Risk
… Make note of how to specify a Data Breach (or Risk) has taken place
… This can be done by creating an instance of the risk or breach and considering that as the risk having consequences
Consultation with DPA
Discussing: Consultations as an OrganisationalMeasure and Consultation with DPA as a specific sub-class
Register of Processing Activities
Discussing: ROPA is related to compliance and compliance related processes and documents
… We need to discuss how to specify these in DPV, and then define ROPA under those
Data Protection Impact Assessment
Discussing: DPIA is a type of impact assessment, so there should be a top-level class called Impact Assessment, with DPIA a sub-class of it
DataProcessingAgreement
Discussing: This is a type of contract, so needs more discussion
… DPV currently does not specify categories of Legal Basis, maybe in next version we can have generic categories of legal basis and define this as a contract within it
… This will allow specifying legal basis for transferring data from Controller to Processor
Safeguard for Data Transfer
Discussing: Complicated because are safeguards same as technical and organisational measures
… TBD
Next meeting
Discussing: 25 NOV 13:00 Dublin, 14:00 CET