DPVCG Meeting Call

Repository: w3c/dpv

Meeting minutes: https://w3id.org/dpv/meetings

purl for this meeting: https://w3id.org/dpv/meetings/meeting-2023-08-24

Risk Assessment

see #104

<ghurlbot> Issue 104 Re-evaluate Risk Assessment concepts (by coolharsh55) [concepts] [application] [help-wanted]

Concepts for risk assessment are accepted.

For indicating potential consequences arising from an incident, Risk should be used (for all potential events). So it would be the potential risk of those consequences.

Concepts for Risk Management are to be developed and proposed by incorporating accepted risk assessment concepts. See #74.

<ghurlbot> Issue 74 Add Risk Management concepts from ISO 31000 series (by coolharsh55) [concepts] [help-wanted]

Note #104 risk assessment concepts have been accepted and will be added to risk extension in the next update.

<ghurlbot> Added comment

Data Breach / Incidents

see #103

<ghurlbot> Issue 103 Guide for Data Breach (by coolharsh55) [documentation] [concepts] [todo] [application]

For the Data Breach and Incident guide, the accepted risk assessment concepts are to be used to update the content and examples.

georg and paul have given the okay for the guide and concepts (pending review item on agenda)

Note #103 the concepts in #104 have been accepted, this guide should be updated by incorporating those

<ghurlbot> Added comment

DGA extension

see #62

<ghurlbot> Issue 62 Add DGA concepts (by besteves4) [scope] [concepts] [review]

The concepts have been proposed and reviewed by beatriz, georg, and harsh and are in a stable position to be considered for acceptance

Of the concepts, some have been retained to be in the DGA extension, others have been added to various DPV extensions. These will be documented and integrated into their respective taxonomies.

For the documentation and addition of these, a separate spreadsheet has been created. See #105 for documentation.

<ghurlbot> Issue 105 Generate documentation for proposed DGA concepts (by ghurlbot) [documentation] [todo]

Note #62 concepts have been accepted in today's meeting, and are to be integrated into the DPV taxonomies

<ghurlbot> Added comment

Note #105 Concepts in #62 have been accepted in today's meeting; the documentation should be generated based on those. For reference, link to the article preprint by Beatriz et al.

<ghurlbot> Added comment

DPV v1.1

Associating rights with legal basis

See #49

<ghurlbot> Issue 49 Provide association and applicability between GDPR legal bases and rights (by coolharsh55) [documentation] [concepts] [todo] [help-wanted]

Concepts have been accepted.

Note #49 concepts have been accepted in today's meeting

<ghurlbot> Added comment

resolving DPV-PD location

See #73

<ghurlbot> Issue 73 Extend DPV-PD with missing Location concepts (by besteves4) [concepts] [review]

Discussed and agreed the proposed concepts for location (e.g. street) should be accepted, and properties for each concept are not feasible to be considered and there currently not in scope

Note #73 the location concepts in this issue (e.g. street) will be added to DPV-PD taxonomy, the group has agreed that developing properties for each PD concept is not feasible and in scope at this moment

<ghurlbot> Added comment

Scoring as Decision

See #87

<ghurlbot> Issue 87 Update concepts for Scoring and Decision to cover overlap (by coolharsh55) [concepts] [todo]

The group agrees that these concepts would be useful (for GDPR), but require careful consideration of implications as not every Scoring is a Decision, and moreso an Automated Decision Making.

Current modelling considers Scoring used in Decision to be a consideration for Automated Decision Making. Aim is to model these concepts (Scoring, Decision Making, Automated) and wait for CJEU decision before adding the implication to DPV-GDPR.

Note #87 this was discussed in today's meeting with the conclusion that concepts to represent Scoring and Decision Making should be present in DPV, but to wait for the CJEU decision before adding the implication of Automation to DPV-GDPR

<ghurlbot> Added comment

Modelling PII

See #14

<ghurlbot> Issue 14 Indicating PII i.e. Personally Identifiable data category or categories in combination (by coolharsh55) [concepts] [question] [help-wanted]

Concepts have been accepted

Note #14 concepts have been accepted in today's meeting

<ghurlbot> Added comment

Sensitivity of Data

See #11

<ghurlbot> Issue 11 Express 'sensitivity' of data (by coolharsh55) [concepts] [question] [review]

The group has discussed the modelling of sensitivity, and has agreed to add DataSensitivityLevel as a concept and its relation hasDataSensitivity to DPV since sensitivity is an industry practice.

See https://learn.microsoft.com/en-us/compliance/assurance/assurance-data-classification-and-labels example from Microsoft

See https://cloud.google.com/dlp/docs/sensitivity-risk-calculation example from Google

Note #11 concepts have been accepted in today's meeting but to be modelled as DataSensitivityLevel and hasDataSensitivity relation

<ghurlbot> Added comment

Assessment concepts

See #96

<ghurlbot> Issue 96 Add assessment relations and concepts (by coolharsh55) [concepts] [todo]

Group has accepted the assessment concepts

georg would like to review whether all required assessments from GDPR have been covered

Upon analysis by georg, relevant concepts will be added to DPV-GDPR based

Note #96 concepts have been accepted in today's meeting

<ghurlbot> Added comment

Alignment with EUVOC

The decision to continue with DPV's modelling of location and jurisdictional concepts has been accepted in the interest of continued progress. If in the future we identify a better vocabulary or how to link with EUVOC, the existing work will incorporate these.

For consideration, the proposed remodelling also affects this work by separating the locations and jurisdiction specific concepts into different extensions. Locations would be in one extension, and the legal concepts would be in their respective jurisdiction specific extension, e.g. GDPR authorities would be in GDPR, Irish authority would be in Irish extension and so on.

See #46

<ghurlbot> Issue 46 Use/Align with EU location vocabularies (by coolharsh55) [documentation] [scope] [concepts] [todo]

Note #46 the group agreed in today's meeting to continue with DPV's modelling of location

<ghurlbot> Added comment

Establishment and Lead SA

See #93

<ghurlbot> Issue 93 Representing Main Establishment and Lead SA as a concept (by coolharsh55) [concepts] [help-wanted]

concepts have been accepted to be added to DPV-GDPR

Note #93 concepts have been accepted in today's meeting and will be added to DPV-GDPR

<ghurlbot> Added comment

Information Availability

See #102

<ghurlbot> Issue 102 Add information availability concepts (by coolharsh55) [concepts] [review]

group has discussed and accepted the proposed concepts

Note #102 concepts have been accepted in today's meeting

<ghurlbot> Added comment

Extend scope to Non-Personal Data

The responses received so far (4 yes) indicate acceptance, but the number is low. No objections so far. This will likely be accepted, and will be discussed in the next meeting.

See #99

<ghurlbot> Issue 99 Proposal to change DPV scope to include Non-Personal Data (by coolharsh55) [scope] [concepts] [question]

Note #99 the group discussed the responses received so far, and will summarise the decision in the next meeting

<ghurlbot> Added comment

This will be taken up with the proposed reorganisation, see #107

<ghurlbot> Issue 107 Restructure repo layout (by coolharsh55) [documentation] [question]

Next Meeting

The next meeting will be in 1 week, on 31 AUG 14:00 WEST / 15:00 CEST

gb, bye

<ghurlbot> gb has left #dpvcg