22:16:28 RRSAgent has joined #dpvcg 22:16:28 logging to https://www.w3.org/2022/10/26-dpvcg-irc 22:16:33 ScribeNick: harsh 22:16:36 Meeting: DPVCG Meeting Call 22:16:39 Chair: harsh 22:16:46 Date: 26 OCT 2022 22:17:03 Agenda: https://lists.w3.org/Archives/Public/public-dpvcg/2022Oct/0007.html 22:18:42 Present: harsh, paul, georg, delaram, beatriz, julian 22:18:56 Previous minutes -> https://www.w3.org/2022/10/19-dpvcg-minutes.html 22:19:27 Topic: Clarity of Purposes 22:19:45 relevant emails - https://lists.w3.org/Archives/Public/public-dpvcg/2022Oct/0008.html and https://lists.w3.org/Archives/Public/public-dpvcg/2022Oct/0009.html 22:20:56 Piero (from TRAPEZE) raised an issue regarding how Purposes are selected. The specific example relates to a banking use-case where purposes are i) maintain bank accounts, ii) execute payments, and iii) manage portfolios 22:21:23 For these, two purposes seem to be applicable - a) RequestedServiceProvision; and b) SellProductsToDataSubject 22:21:49 The issue is to offer clarity in how purposes are applicable or should be selected, and to see if there are overlaps between concepts which should be rectified. 22:22:24 The group discussed the general practices regarding purposes, where most real-life examples are vague and abstract intentionally, and therefore are a common source of ambiguity. 22:22:52 DPV can help with this by providing specific strong concepts that reduce ambiguity and assist in expressing use-cases in as much detail as possible. 22:24:14 For this, we discussed the use-case, and concluded with the following interpretation. The purpose should be `SellProductsToDataSubject` in case where the products are being marketed or provided to the data subject, but they have not been purchased or availed of yet. This means the products are not a service currently being provided (i.e. there is distinction between current and future). `SellProductsToDataSubject` is therefore applicable here. 22:25:14 In the case where a contract has been established, and this means a service is being provided by the bank to the customer, even if this involves charging money, the purpose is `RequestedServiceProvision` because of the agreement that states such service provision and data required. 22:26:10 The legal basis for Selling Products could be A.6-1f Legitimate Interest whereas for Requested Service Provision it would be A.6-1b Contract. 22:27:03 The group discussed the need to clarify such uses within the descriptions of purposes and offer as much clarity and example as is possible. For this, a sub-group will refine the purposes (harsh, georg, paul). 22:27:47 Topic: Exercising Rights 22:27:53 (continued from previous meeting) 22:28:00 reelvant email - https://lists.w3.org/Archives/Public/public-dpvcg/2022Oct/0004.html 22:28:27 The group discussed the proposal to keep records of right exercises. The example only lists the part relevant to recording exercising activities. 22:30:26 The information for how to exercise a right, what data is needed, etc. is provided as part of the Right Exercise Point/Service concept. 22:30:46 The group discussed the examples, its practicality, and identifed aspects that are missing. 22:34:08 For cases where an action is delayed, we add the status `ActionDelayed`. For example, a Controller needs more time to fulfill the right exercised. 22:36:16 To specify duration associated with rights, we have the existing concepts. For example, information about right exercise means the duration is how long the activity will take. 22:36:29 Duration associated with action delayed means how much additional time it will take. 22:36:40 We will have to write these interpretations clearly in the spec. 22:37:14 We will also be collecting Justifications for different statuses, including those for NonFulfilment as well as Delays and other things associated with Right Exercises. 22:37:25 Our scope if limited to Right for now, and not other requests in general. 22:37:45 The framework being developed here is for generic rights, and is not specific to GDPR. 22:38:07 We will be establishing the base framework, and then creating specific extensions for GDPR's rights. 22:38:42 Georg and Paul will be creating a list of Justifications for rights related actions not being completed (in time or at all). 22:39:00 Harsh and Beatriz will be looking at creating specific GDPR rights concepts from the base concepts. 22:39:04 Topic: Next Meeting 22:40:49 We will be meeting again in 1 week, on NOV-02 13:00 WET / 14:00 CET. 22:41:04 Agenda will be continuation of discussion regarding Purpose clarification and Rights Exercise. 22:41:39 Another item of note is the SEMIC conference regarding EU vocabularies that are relevant / tangential to DPV - https://internationaldataspaces.org/events/semic-conference-2022/ 22:41:55 For us, vocabularies we have to align with include SEMIC vocabs https://github.com/w3c/dpv/issues/31 so its worthwhile to keep this link. 22:42:04 rrsagent, publish minutes v2 22:42:04 I have made the request to generate https://www.w3.org/2022/10/26-dpvcg-minutes.html harsh 22:42:10 rrsagent, set logs world-visible 22:43:23 rrsagent, bye 22:43:23 I see no action items