11:54:32 RRSAgent has joined #dpvcg 11:54:32 logging to https://www.w3.org/2022/04/20-dpvcg-irc 12:01:46 ScribeNick: harsh 12:01:58 Meeting: DPVCG Meeting Call 12:02:01 Chair: harsh 12:02:12 Present: harsh,paul,georg 12:02:20 Date: 20 APR 2022 12:02:36 Agenda: https://lists.w3.org/Archives/Public/public-dpvcg/2022Apr/0010.html 12:09:13 Present+: mark,jan,beatriz 12:09:49 Topic: Fixes to Processing concepts 12:10:04 Removed concept ~MatchingCombining~ from Processing Context module, and added ~Match~ as a processing operation. ~Combine~ already exists as a processing operation. This provides consistency in processing operations, and distinction from context (e.g. automated decision making can be involved in any processing operation, whereas match/combine are types of processing operations). This is relevant for A.35 DPIA as specified by A29WP guidelines. 12:10:11 - Added concept ~Generate~ as a processing operation to distinguish when data is generated or created without deriving it from existing data or collecting it from another source. E.g. an identifier created and assigned to an individual is generated data, as it is not any of: collect, derive, etc. ~Generate~ is a subclass of ~Obtain~. 12:10:20 Added concept ~Infer~ to correspond with data categories ~InferredPersonalData~ 12:10:20 and provide distinction from Derive as in obtain from existing data, and infer 12:10:20 as in obtain without any correlation or existence from existing data. 12:10:41 Topic: Accountability and related concepts 12:10:48 Session chaired by paul and georg 12:10:59 Discussion on ICO Accountability Framework https://ico.org.uk/for-organisations/accountability-framework/ 12:14:00 paul: Recent paper investigating accountability with ROPA data. Title: "Support for Enhanced GDPR Accountability with the Common Semantic Model for ROPA (CSM-ROPA)" https://doi.org/10.1007/s42979-022-01099-9 12:14:31 ICO accountability framework is a collection of questions, some of which are related to GDPR clauses, and others related to management activities. DPV could be used for some of these. 12:17:31 jan: email (https://lists.w3.org/Archives/Public/public-dpvcg/2022Apr/0024.html) enquiring how entities are supposed to exchange and reuse ROPA data 12:18:11 harsh: It isn't advisable to directly use someone else's data, for legal and accountability reasons. Instead, the data would be integrated or copied into the organisation's ROPA. E.g. Controller takes Processor's implemented technical measures. 12:28:48 paul: Accountability concepts that have been met needs to be specified - automatically populating this information would be of value 12:30:29 georg: Julian proposed the property `isRequiredFor` to specify a concept is required for some accountability concept 12:31:38 harsh: I would suggest doing it the other way around, specifying an accountability concept is linked to a concept and specify what is the association e.g. is necessary to be carried out, to be declared, exists, etc. This is because the property `isRequiredFor` doesn't indicate what the requirement is, and whether its conditional or has obligations. This restricts the usefulness of that linking. 12:41:04 Discussion on what this work means for DPVCG. 12:41:37 harsh: We could identify concepts e.g. PolicyForDataProtectionTraining as an OrganisationalMeasure, but there will also be a gap in how the organisation implements that concept e.g. are these policies readily available. 12:42:10 georg: We could indicate what concepts are needed for another concept, such as concepts for policy in ICO Accountability Tracker, which would be of use to help organisations complete the framework. 12:59:31 Topic: Next Meeting 12:59:48 We will meet again next week WED APR-27 14:00 CEST 13:00:16 Topics for discussion will be proposed Technology concepts, association of ISO and other standards to DPV concepts, and anything else that ends up on the mailing list. 13:00:18 zakim, bye 13:00:18 leaving. As of this point the attendees have been harsh, paul, georg, :, mark, jan, beatriz 13:00:18 Zakim has left #dpvcg 13:00:26 rrsagent, publish minutes v2 13:00:26 I have made the request to generate https://www.w3.org/2022/04/20-dpvcg-minutes.html harsh 13:00:28 rrsagent, set logs world-visible 13:02:22 rrsagent, bye 13:02:22 I see no action items