Meeting minutes
Repository: w3c/dpv
Agenda: https://
Meeting minutes: https://
Persistent ID for current minutes: https://
v2.2
milestone https://
release candidate published https://
changelog https://
comment period until SEP-15
Generic Places
<ghurlbot> Issue 384 Modelling Generic Locations/Places (e.g. Airport, School) (by coolharsh55)
HarshPandit: Modelling Locations e.g. to indicate high-risk AI is deployed for facial recognition at Airport, School (was previously subjective locations https://
HarshPandit: previous discusion (see #384) Current discussion: 1) is this in scope? 2) where do we put them? e.g. loc/places namespace?
JulianFlake: Agree its in scope
HarshPandit: Example CCTV using facial recognition at Airport -- how to represent "at the Airport"?
JulianFlake: What is the relevance of this? Is it a public / private space? Why specifically Airport? E.g. if they are at home or at work there are specific regulations.
PaulRyan: For legal investigations, ultimately the only things that matter are whether its a private/public place or a regulated environment like work.
TyttiRintamaki: from DPIA requirements -- school, home, work, religious places (places of worship).
HarshPandit: Can we declare School as both organisation and location since its both?
TyttiRintamaki: What about public road and public transportation?
ArthitSuriyawongkul: Public road and public transportation is included in the definition of "public realm" or "public spaces".
HarshPandit: We have the sector extension so these can go e.g. in Infrastructure
TyttiRintamaki: Where does religious institutions fit in?
JulianFlake: its not in sector or location, so we need a better name space. E.g. physically I'm at home, but contextually I'm at work
HarshPandit: Yes, that's why you declare them both together as location and both go in personal data whereas others are not tied to the person and go in the infrastructure extension.
JulianFlake: Options for discussion next time: 1) within existing LOC, 2) new extension within LOC, 3) existing PD (school, work) or SECTOR (road goes in INFRA) as applicable, 4) new extension not existing
ACTION: HarshPandit to create issue to track this discussion and add options
ServiceMaintainence (Purpose)
<ghurlbot> Issue 287 [NEW]: Add Maintenance as a `dpv:Purpose` (by besteves4)
HarshPandit: We have ServiceMaintainence proposed as a concept. In addition, Tytti's work on DPIA has also found additional Service related concepts. So in addition to the proposal, we also need to discuss how they relate to each other e.g. is ServiceMaintainence the parent concept of these others.
ACTION: TyttiRintamaki collect different ServiceXYZ concepts and add them to Issue 287
GDPR Purpose Compatibility
<ghurlbot> Issue 298 Model Purpose Compatibility statuses for GDPR (by coolharsh55)
HarshPandit: 1) do we only model compatibility concepts or 2) also mention implications e.g. incompatible purposes require assessment of legal basis or to get a different legal basis e.g. consent
HarshPandit: If 2, then do we also provide guidance on how to assess compatibility based on DPV concepts?
JulianFlake: Providing guidelines is a legal matter (of expertise)
JulianFlake: Even this list is not exhaustive
HarshPandit: Yes, so we are merely showing how DPV concepts help document the examples given by ICO
StratisKoulierakis: 1) Does DPV have the term Proportionality -- so should this be added? 2) Do we have a link with TOMs for the purpose compatibility (Art.6(4))?
HarshPandit: Should we add it as a principle? (proportionality)
StratisKoulierakis: Yes, its a principle but its not the same as say Art.5 principles
HarshPandit: ICO page (above) What is the difference between necessity which exists so that we can model it as proportionality?
StratisKoulierakis: Better to add this as a separate agenda item. Something can be necessary but be disproportionate because it affects the person too much. So there it shouldn't be done. This is called a 'stricto sensu' (latin) proportionality.
JulianFlake: isn't this what "legitimate" expresses, Whether something is "necessary", maybe depends on whom you ask
ACTION: Harsh and Stratis to organise a meeting to formualte a propose for this
ArthitSuriyawongkul: example of necessity outside GDPR / law https://
AOB
MLDCAT-AP & CRDM
HarshPandit: Attended the MLDCAT-AP webinar this morning where they shared ongoing work for v3 of their spec which will be aligned with AI Act Code of Practice for GPAI models. MLDCAT-AP already uses DPV (dpv:hasData) and I have recommended using more properties and concepts. There is a heavy emphasis on text within the specification instead of a controlled vocabulary / taxonomy approach that DPV takes.
… HarshPandit SEMICeu/
<ghurlbot> Issue 385 Align DPV with CRDM AI concepts (by coolharsh55)
HarshPandit: In the same webinar, the Publications Office also presented their ongoing work on CRDM (Corporate Reference Data Management) which is producing AI related taxonomies to represent work within the EU Commission. These taxonomies will sit in EuroVoc alongside existing taxonomies like locations. Demo: https://
HarshPandit: Currently, it contains three broad taxonomies - 1) AI Approaches which are like Capabilities in DPV's AI, but which contains applications like Chatbot and categories like GenAI and LLM which are model separately as categories of the technology itself; 2) AI Systems which are categories of AI systems of which DPV's AI only has GPAI system; and 3) ML which contains what is part of DPV's AI Techniques.
HarshPandit: The Publications Office mentioned that they curated this list with definitions and links to literature as state of the art, and that these would be formal taxonomies. Therefore I propose that we align the DPV's taxonomies to these e.g. by adding concepts that are missing.
HarshPandit: I have also mentioned the DPV work to them in the webinar, and asked about plans to model purposes or intended uses -- but it was mentioned that there are no plans because they don't know how to mention what should be part of these concepts. So we are ahead of the curve here, which is a good opportunity for us, and we should take advantage of it.
ACTION: Harsh to propose concepts based on CRDM AI Taxonomy
LEGAL-DE GDNG
HarshPandit: We received a request (proposal) from a member of German Medical Informatics Initiative (MII) to add German law -- new Gesundheitsdatennutzungsgesezt (GDNG) -- which provides legal basis for health data like the EHDS, and the extension will help in expressing data use and access restrictions. Question is how to do this as this is the first time we will be providing a law at national level.
JulianFlake: The key part here also includes link to EHDS as in implementing the same processes and principles.
HarshPandit: The suggested measure here is to put a namespace inside LEGAL-DE, much like we do for EU and GDPR or AI Act, but mentioning it here specifically as this is a national law and what we setup here will be used for other national laws as yes
ArthitSuriyawongkul: Will this concern non-DPA authorities? w3c/
HarshPandit: Yes, but we already have that question open for AI Act, NIS2, and EHDS as well.
Next Meeting
The next meeting will be on SEP-17 Thursday 13:30WEST/14:30CEST
Agenda will be continuation of today's discussion regarding generic places, service maintainence, purpose compatibility, and proportionality/necessity. In addition, the meeting will also confirm whether v2.2 should be released as final version, after which it will be submitted to W3C as our formal group report.
Proportionality (post-meeting)
post-meeting session with participants HarshPandit and StratisKoulierakis
StratisKoulierakis: Proportionality is a concept which is present in EU law outside the GDPR, so it is well established. We should model is as states containing Proportionate or Disproportionate (confirmed term occurs in case law). In addition, we will need ProportinalityAssessment and NecessityAssessment as concepts as well.
HarshPandit: How do we express the relation between these?
StratisKoulierakis: Proportionality involves steps 1) suitability assessment -- is the activity going to bring the desired effect? 2) is this activity necessary or are there alternative and better approaches? Further concept Strict Proportionality also called the balancing exercise i.e. to balance the rights of person and detriments to them with the intended activity. So proportionality assessments have three components: 1) SuitabilityAssessment 2) NecessityAssessment 3) BalancingAssessment. Proportionality comes up e.g. when the controller has legitimate interests, then its required to have a proportionality concept.
ACTION: Harsh to model concepts as per Stratis' suggestion for discussion.