Meeting minutes
Risk
We have Risk and hasRisk as generic concepts to associate risk, and RiskMitigationMeasure to indicate mitigation
Agreed to have that as top-level concept, and later think about expanding via taxonomy based on use-cases and legal requirements
paul: how does DPV relate to compliance?
harsh: compliance can be determining or evaluating obligations and compliance, demonstrating compliance, and documenting compliance
… DPV provides a (semi-) standardised or an extendable vocabulary for representing information towards this
mark: there is also the notion of conformance which relates to compliance (processes)
Entities
mark: Data Protection Authority: should this be supervisory authority, as defined in GDPR?
… The global norm seems to be 'data protection authority', e.g. see https://
… Also the EU seems to prefer DPA as data protection authority: https://
Sub-Processor: do we need to distinguish between Processor and Sub-Processor
mark: in some cases there are restrictions or obligations associated with sub-processors, so it would be helpful to have this concept
georg: a sub-processor is still a processor, and in GDPR, there is no distinction (in the term itself), so we can do with just one term (processor)
… The term itself seems to be used in the real-world to indicate the relationship and third-parties involved. E.g. https://
georg: The primary relationship is between a controller and processors vis. purpose. Is there any other relationship?
mark: The controller will need to know if the list of sub-processors will change, so this is an use-case
… Agreed to have sub-processor as a term
… Minor vs Child: Child is definitely a related term, but we decide about 'minor' later based on legal definitions and common usage
… We accept Child as a concept for DPV
… Third Country: how to define this? Is this related to jurisdiction(s) i.e. EU
… If this is related to jurisdiction, how to represent that in terms of membership e.g. third country wrt EU
… For GDPR, this relates to Recipient ⟶ Country (Third Country)
georg: Since this is related to country (only), we don't need to describe Third Countries per se
… Agreed to have this term as 'proposed' and revisit it in the next discussion
Aceepted: property 'has_identifier' to indicate an (external) identifier associated with an entity e.g. Company registration number
DPV v0.2
Aceepted: Proposed terms have been discussed and addressed
… Next step is to formalise serialisation and create documentation
… Harsh will be working on this over the weekend
… Plan is to complete the documentation by 30-NOV
… Contributors to add names, affiliations, funding acknowledgments where pertinent. Please send them on to Harsh for inclusion.
… Next meeting 2 DEC 14:00 CET : look at documentation