Meeting minutes
Repository: w3c/dpv
Data Breach
Continuing from the previous discussion on data breach notifications and records.
There are distinct information groupings that should be represented separately.
1) DataBreach is information about the breach incident itself - which is separate from the investigation and what it has affected.
1a) DataBreach contains information about its temporal duration i.e. when it started and when it ended (if this is known)
1b) the type of breach to denote the definition used for a breach (DPAs suggest confidentiality, integrity, and availability as types)
1c) status - whether it is unknown, ongoing, concluded
1d) source of risk which indicates how the breach happened; this is denoted using dpv:RiskSource
1e) whose actions or inactions caused the breach; this is denoted using dpv:ThreatActor
2) DataBreachReport which reports information found during an investigation of the data breach
The types of reports are - detection, preliminary investigation investigation, ongoing investigation, final investigation
Reports can have their own temporal properties, e.g. duration or publication date, provenance e.g. who provided information or the publisher, and status - whether the report (as an ActivityStatus) is complete, ongoing, etc.
DetectionReport specifically indicates a breach has been detected, and is useful to denote the DataSource of information e.g. from a data subject, news article, etc. The question about when a Controller became aware of the breach is answered through this.
Any report can contain notifications to parties, e.g. to DPA, processor to controller, to data subjects - represented using hasNotice
Reference to data breach is using dct:subject
The contents of the report specify what it is affected by using hasConsequenceOn with specific PersonalDataHandling or Service
Affected data and data subjects similar are expressed using dpv:hasPersonalData and dpv:hasDataSubject
The processing, data, and data subject scales are indicated using dpv:hasScale variants
To specify the impact assessment, use dpv:hasImpactAssessment, within which dpv:hasRisk with RiskToFundamentalRights is used to specify whether the breach is likely (hasLikelihood) to affect fundamental rights.
3) The question about how to express member states affected, which the DPC form asks in two categories - for data subjects affected and organisation's activities.
For the data subjects, use dpv:hasDataSubject with an object that has rdf:type or rdfs:subClassOf to indicate the category of data subjects, and dpv:hasJurisdiction to specify the jurisdiction.
Similarly, for the organisation's activities, express directly using dpv:hasJurisdiction or through a PersonalDataHandling
To specify the establishments, we have a concept in main dpv as Establishment as a subtype of LegalEntity with property hasEstablishment to indicate one organisation is an establishment of another
Establishments
The concept of main establishment is dependant on a jurisdictional frame of reference. For example, CNIL fined Google France because it was the main establishment of Google LLC (USA) and Google Ireland (EU) within France and the law applied was ePrivacy directive which as a national application.
For GDPR, CNIL cannot fine Google France because the main establishment for EU would be Google Ireland. Therefore we add isMainEstablighmentFor as a relation that connects an Establishment with a Jurisdiction.
Next meeting
harsh: The next meeting will take place on 01 June at 14:00 WEST / 15:00 CEST
… Harsh will be away until 8th, someone else will chair the meetings.