Meeting minutes
SAR (Subject Access Request)
DPV provides the notion of right, and DPV-GDPR lists these rights, but there is a distinct lack of concepts related to how to exercise right, the contents of what needs to be provided, the response, data provided back in a right, etc.
There is also the need to express the scope of a right, e.g. all data or only some data, temporal period.
There was a discussion on whether this is of interest, and what should be the scope.
The group agrees that these concepts and investigations are of interest and should be provided through DPVCG.
Specific areas of investigation include - how to specify a request, how to reply to a request, what is the scope, replies and justifications, and so on
Interested participants should contact georg who is leading this work within the group.
TCF representation using DPV
Martin Kruze, who is from Deutsche Telekom and a part of the TRAPEZE project, has raised the possibility of extent and feasibility of TCF being implemented or represented using DPV.
The discussion was about how the terms differ between TCF and GDPR/DPV, and how an alignment or mapping is needed. Also that TCF is restricted in scope and values, whereas DPV is more expressive and thus complex.
Martin will be sending a more detailed email to the group regarding this, with a dedicated implementation to be investigated from October onwards.
Next meeting
We will meet again in one week, SEP 07 13:00 WEST / 14:00 CEST
Topics will be about data breach, SAR, rights, and any other item AOB or on existing agenda