W3C

DPVCG Meeting Call

03 APR 2024

Attendees

Present
delaram, georg, harsh, paul, tytti
Regrets
beatriz
Chair
harsh
Scribe
harsh

Meeting minutes

Meeting minutes: https://w3id.org/dpv/meetings

purl for this meeting: https://w3id.org/dpv/meetings/meeting-2024-04-03

AI Act

<ghurlbot> Issue 106 Propose concepts from the AI Act (by coolharsh55)

<ghurlbot> Issue 126 AI Extension to provide AI-specific concepts (by coolharsh55)

delaram: ready to publish the existing work as a draft while it is continued to be refined

harsh: should we continue with the tech and ai as separate extensions?

delaram: yes, I see a large set of concepts for AI so a separate extension would be better

paul: there is also merit from a 'marketing' perspectives to make this attractive and people may want to go straight to the AI concepts with this

after discussion, the group agreed to make the Tech and AI extensions separate.

Biometrics

georg: should we extend the term biometric with more specific terms? see post https://www.linkedin.com/posts/georg-philip-krog-a2a278104_ai-act-and-biometric-categorisation-systems-activity-7180921510516170752-6LZu

harsh: we have biometrics in personal data - so all extensions should go there so that if any system is using any of the sub-categories then it should be a biometric system

georg: so the specific question is whether we keep only the term 'biometric' or do we go for more specific ones?

delaram: is the objective to assist in understanding whether the system is using biometric data?

georg: it is about having a list of biometrics as the definition is not clear and there may be lots of different concepts that come under biometric

paul: GDPR biometric data’ means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data;

harsh: https://www.iso.org/obp/ui/#iso:std:iso-iec:tr:24741:ed-2:v1:en ISO standard about biometrics has broad categories we can use

harsh: The JTC1/SC37 working group has many standards on biometrics https://www.iso.org/committee/313770/x/catalogue/p/1/u/1/w/0/d/0

georg: Example of biometric categories

Facial Print
Shape: Oval
Features: Presence of dimples
Fingerprint
Pattern: Whorls on the right thumb, loops on other fingers
Hair Color
Color: Light brown with natural highlights
Height
Category: Medium (170 cm)
Weight
Category: Within healthy range for height (65 kg)
Skin Tone
Tone: Fair with a tendency to freckle
Eye Color
Color: Hazel
Voice Pattern
Pitch: Mezzo-soprano
Tone: Warm with a slight vibrato
Hand Geometry
Palm Length: 18 cm
Finger Length: Index finger 7 cm, Ring finger 7.5 cm
Gait Analysis
Type: Confident, brisk walk
Iris Pattern
Details: Unique colarette pattern in both eyes
Retina
Blood Vessel Pattern: Standard bifurcation pattern
Ear Shape
Lobe Attachment: Detached
Overall Shape: Round
Writing Style
Handwriting: Cursive with slanted letters
Keystroke Dynamics
Typing Speed: 70 words per minute
Rhythm: Consistent, with faster typing for common words

harsh: ICO on Biometrics https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/biometric-data-guidance-biometric-recognition/biometric-recognition/

delaram: AI Act Annex III has high-risk categorisation based on biometrics - see clause 1

after discussion, the group agreed to add these to personal data extension as they are useful. For starting with the work, only the broad categories (e.g. from ISO) should be considered. The rest will then be added as needed.

CJEU TOMs case

georg: georg: CJEU case on data processors to have clear documentation of TOMs https://curia.europa.eu/juris/document/document.jsf?text=&docid=280623&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1 Therefore its important for DPV to have a good list of TOMs for processors and controllers. Also we agreed to expand on these with Legal in additional to Tech/Org measures.

Next Meeting

Next meeting will be in 1 week, on WED APR-10 15:00 WEST / 16:00 CEST.

Topics for discussion are

1) Rights Justification - finalise output and produce documentation - beatriz, harsh

2) AI Act and Tech concepts by delaram - identify 'simple' subset of concepts to add, start work on AIRO and VAIR integrations

3) TOMs by harsh - to resolve the proposed concepts

4) w3id config update by harsh

5) github issues update by harsh

6) dpv marketing page by harsh

7) dpv resource paper

Minutes manually created (not a transcript), formatted by scribe.perl version 217 (Fri Apr 7 17:23:01 2023 UTC).