IRC log of dpvcg on 2021-11-17

Timestamps are in UTC.

12:54:08 [RRSAgent]
RRSAgent has joined #dpvcg
12:54:08 [RRSAgent]
logging to https://www.w3.org/2021/11/17-dpvcg-irc
12:56:24 [harsh]
ScribeNick: harsh
12:56:27 [harsh]
Meeting: DPVCG Meeting Call
13:04:19 [harsh]
Chair: harsh
13:04:44 [harsh]
Present: harsh, georg, beatriz, julian, paul, mark
13:04:51 [harsh]
Date: 17 NOV 2021
13:05:04 [harsh]
Agenda: https://lists.w3.org/Archives/Public/public-dpvcg/2021Nov/0004.html
13:05:44 [harsh]
previous minutes - https://www.w3.org/2021/11/10-dpvcg-minutes.html
13:06:59 [harsh]
Topic: Joint Controllers
13:07:17 [harsh]
previous discussions were regarding using plural vs singular i.e. controller(s)
13:07:24 [harsh]
paul: should be plural i.e. controllers
13:09:31 [harsh]
Agreement on using plural, the concept will be JointDataControllers
13:10:50 [harsh]
previous discussions about how to refer to joint data controllers were about subclassing it from DataController and using hasDataController
14:05:29 [harsh]
Use-case for discussion - Two DataController A and B are engaged in a JointDataControllers relationship AB. One could specify multiple hasDataController [A,B] which would make them JointDataControllers or explicitly say hasDataController AB and indicate AB hasDataController [A,B]
14:05:49 [harsh]
Agreement on JointDataControllers as a concept and its use within DPV
14:06:04 [harsh]
Topic: Indicating who carries out the data processing
14:06:41 [harsh]
georg: In a personal data handling instance, how to specify who is carrying out the processing, i.e. DataController or DataProcessor
14:07:22 [harsh]
We have <x hasRecipient Recipient> as the current way to indicate data goes to some entity, and it is implied that the entity then carries out processing for specified information
14:07:56 [harsh]
However, sometimes it is important to explicitly indicate which entity is carrying out the processing and not just being a recipient for it.
14:08:38 [harsh]
Proposal for a property "isProcessedBy" with range Entity to indicate who carried out processing. Since receiving data / collecting data is a type of processing, it will fall under isProcessedBy ?
14:09:25 [harsh]
The property can be used at appropriate 'levels' as necessary e.g. directly on Processing types such as collect or use, on PersonalDataHandling instances, or for annotating Policy instances
14:09:39 [harsh]
To be revisited in later discussion for finalising
14:09:56 [harsh]
Topic: Referencing Agreement between Data Controller and Data Processor
14:10:35 [harsh]
A DataController engages a DataProcessor under a DataProcessorAgreement which outlines the instructions and obligations for carrying out processing.
14:11:19 [harsh]
How to reference this agreement within the personal data handling use e.g. hasDataController A [as DataController] ; isProcessedBy B [as DataProcessor] ; and A--B has some agreement
14:11:42 [harsh]
Current proposal puts the DataProcessorAgreement under TechnicalOrganisationalMeasure given its derivation from LegalAgreement
14:12:09 [harsh]
paul: The placement of DataProcessorAgreement under TechnicalOrganisationalMeasure does not seem correct or elegant since its not an organisational measure
14:13:13 [harsh]
harsh: we have two ways of using this, one is creating a property called "hasEntity" and using that to associate entities with agreements (and elsewhere as necessary) - which works when representing the Controller--Processor relationship from a third party perspective
14:14:18 [harsh]
harsh: The second one is from a Processor perspective the agreement is its legal basis, so using hasLegalBasis ; and for the Controller it is also the legal basis so using hasLegalBasis ; and both pointing to the DataProcessorAgreement instance
14:15:40 [harsh]
harsh: For the Controller using this in a PersonalDataHandling instance, the use could be something like hasTechnicalOrganisationalMeasure DataProcessorAgreement with the DataProcessorAgreement using hasEntity or hasDataController to connect to the entity with type and role
14:15:56 [harsh]
Topic: Entity and Data Subject Subclasses
14:16:48 [harsh]
julian: The discussion of these concepts arose from prior proposals, and it should be considered whether to include them all in an ad-hoc manner within the DPV or only those that add value - such as due to there being obligations or requirements associated with them from laws or domains
14:17:07 [harsh]
Consensus on adding only those concepts which are necessary to be modelled based on requirements
14:20:24 [harsh]
For entities and organisations, the ADMS vocabulary provided some categorisation such as National/Regional/SupraNational authorities which we propose for inclusion
14:20:42 [harsh]
ADMS itself is a mix of different concepts, so inclusion of a few here would be better
14:20:54 [harsh]
Topic: Next Meeting
14:21:28 [harsh]
We will meet next WED NOV-24 13:00 WET / 14:00 CET
14:21:44 [harsh]
Discussion will continue regarding Entity and Data Subject subclasses and other items on agenda
14:22:16 [harsh]
There may be a guest presentation by DPVCG member Fajar on use of DPV within the WELLFORT project. Details and timings TBD.
14:23:38 [harsh]
zakim, bye
14:23:38 [Zakim]
leaving. As of this point the attendees have been harsh, georg, beatriz, julian, paul, mark
14:23:38 [Zakim]
Zakim has left #dpvcg
14:23:49 [harsh]
rrsagent, publish minutes v2
14:23:49 [RRSAgent]
I have made the request to generate https://www.w3.org/2021/11/17-dpvcg-minutes.html harsh
14:23:53 [harsh]
rrsagent, set logs world-visible
14:30:20 [harsh]
rrsagent, bye
14:30:20 [RRSAgent]
I see no action items