Express 'sensitivity' of data

[coolharsh55]

| Migrated ISSUE-20: How to express sensitivity of data?

State: OPEN
Opened on: 2019-05-07

Related Emails:

1. +Re: dpv:HouseOwned (from me@harshp.com on 2019-07-03)
2. +Re: dpv:HouseOwned (from axel.polleres@wu.ac.at on 2019-07-02)
3. +dpv:HouseOwned (from rob.brennan@dcu.ie on 2019-06-25)
4. +ISSUE-20: How to express sensity of data? (from sysbot+tracker@w3.org on 2019-05-07)

[coolharsh55]

Currently, DPV has the concept for Special Categories of Personal Data, with the inclusion of word 'sensitive' in its description. IMHO, this needs to be further refined. It should be PersonalDataCategory --has subclass-> Sensitive... --has subclass--> Special.... If there are objections to this, but sensitivity must still be defined, then we would need a class for expressing sensitivity, with subclasses representing different sensitivity levels. So an adopter can specify, for example, that some data category X is also sensitive via sub-classing.

[coolharsh55]

SensitivePersonalData has been added to DPV. This permits declaring some data is sensitive, but not how sensitive. Proposals for such information, e.g. a property hasSensitivityLevel, are welcome. Given that expressing any scale of sensitivity would be opinionated, proposals should attempt to identify general/abstract concepts to the extent that they can be useful for most/more use-cases.

[coolharsh55]

A reductionist approach might be to reuse hasSeverity Severity here since the intended meaning is convered. E.g. SensitivePersonalData hasSeverity HighSeverity makes sense without the need for additional concepts.

[coolharsh55]

We discussed in today's meeting and will discuss this further.

[coolharsh55]

I've added a note regarding sensitivity to the Primer at https://w3c.github.io/dpv/primer/#personal-data. The issue will remain open for discussion.

[ghurlbot]

Comment by @coolharsh55 via IRC channel #dpvcg on irc.w3.org

this was discussed in today's meeting as being acceptable, but further discussion will be undertaken to assess whether to accept them.

[ghurlbot]

Comment by @coolharsh55 via IRC channel #dpvcg on irc.w3.org

concepts have been accepted in today's meeting but to be modelled as DataSensitivityLevel and hasDataSensitivity relation

[coolharsh55]

Added the concept and relation in dpv in risk section. Review and close the issue.