Meeting minutes
Jurisdictions
Modelling Jurisdiction / Laws as DPV extension https://
Previous minutes https://
Instead of Jurisdiction as a concept, we consider Location to be a Jurisdiction based on the view that jurisdictions are essentially locations with a government or law.
Concepts for Location accepted for addition - Location class as parent class of all concepts with hasLocation concept to associate a location.
Location is useful in places other than jurisdiction, e.g. StorageLocation to indicate where data is stored, and Controller's location to indicate where the controller is based.
Since Country is a special form of location and relevant when deciding which laws apply and subsequent investigations, we provide categorisation of Location based on countries and similar concepts.
For this we have concepts accepted - Country (e.g. France), SupraNationalUnion (e.g. European Union), EconomicUnion (e.g. EEA), and Region (e.g. California).
---
The property hasAuthority is accepted to associate the existing concept of Authority with some context, e.g. <Location> hasAuthority <Authority>.
Using the above concepts, we can create a list of countries (and EU), indicate their authorities (e.g. DPAs).
To represent Law, the concept Law is provided so that specific use-cases can refer to GDPR as a law and state it is applicable.
For this, the property hasApplicableLaw is provided to indicate that the law applies or is adhered to.
Similarly, to indicate a jurisdiction applies or is operated in, the property hasJurisdiction is provided.
---
There was a discussion on what should be the appropriate wording and interpretation of concepts related to jurisdictions and law.
Proposals were hasApplicableJurisdiction and hasRelevantJurisdiction which were not accepted due to being confusing as to applicability based on use-case and the probability of them being misused.
For now, DPV can provide the generic hasJurisdiction property and its use can specify the interpretation.
---
<Controller> hasJurisdiction <Location> can indicate the controller acknowledges some location as its jurisdiction (of preference or choice).
This is in contrast to <Controll> hasLocation <Location> which only indicates the controller is located at some place(s), and which could in theory be used to determine jurisdictional concepts such as lead DPA.
<PersonalDataHandling> hasJurisdiction <EU> similarly indicates that some processing activities or policy is operating within or applied to EU as the stated jurisdiction.
<PersonalDataHandling> hasApplicableLaw <GDPR> provides an analogous way to specify that a law applies instead of stating the jurisdiction.
<EU> hasApplicableLaw <GDPR> can be provided in an extension to support inferences of the above two statements from each other.
---
For now these concepts are considered as being accepted.
To indicate an objection or raise an issue, members are invited to email to the mailing list with their argument.
In the next meeting, we will consider such issues, if any, and finalise these concepts.
Next Meeting
We will meet next week in the usual time slot.
WED JAN-19 13:00 WET / 14:00 CET