DPV v1.0 release candiate - feedback, discussions, and actions

[coolharsh55]

This issue is a placeholder, and collective single representation of the feedback, discussions, and actions related to DPV v0.8.1 and its role as a release candidate for DPV 1.0.

(pinned edit) As per the last meeting on 19 OCT, the release date is set to (approx.) 15 NOV. The below are the list of tasks/issues to be addressed by then:

• DPV-Legal - remove duplicate concepts, move to EU vocabs, add pending concepts ;
  • NO is not part of dpv-legal:EEA #61 - not fixed in v1
  • Add legal modules for EU countries with DPAs and laws #48 - not fixed in v1
  • Use/Align with EU location vocabularies #46 - note added to this effect
• OWL - correctness of syntax ;
  • Add owl:imports to DPV-OWL extensions #59
  • OWL serialization of DPV and extensions #42
• Concepts
  • Technical Measures Adding Safeguards to DPV #23
  • Purpose Add/Expand Purpose Categories #22
  • Consent Additional concepts in Consent / Notice #21
  • Rules Specify conditions, constraints, or restrictions e.g. for purpose or data category #18
  • Data Collection Method Specify collection method of personal data #16
  • Personal Data and PII Indicating PII i.e. Personally Identifiable data category or categories in combination #14
  • Sensitivity of Data Express 'sensitivity' of data #11 - not fixed in v1
  • Data Subject category Categorisation of data subjects based on jurisdiction e.g. citizens or location for GDPR #5
• Minor fixes
  • Fix label for dpv:PhysicalCharacteristic as "Physical Characteristic" #58
  • Re-Evaluate Anonymisation and Security Measure names for Correctness #15 Anonymisation methods
  • Broken link in 1.2 Base Vocabulary #72
  • HumanResources is not a defined term #70
• Release prep/docs
  • DPV releases should contain only the vocabulary #40
  • Documentation Style Guide #39
  • List of concepts, documentation, and other things to be provided in DPV v1.0.0 #38
  • Programmatic generation of documentation diagrams #24 - not completed in v1
  • Use-Cases and Examples showing how vocab can be used #12
  • Add/Update diagrams in DPV for v1 #65
  • Provide a Guide on use of DPV for DPIA #66 - can be done after v1 publication
  • Provide for Guide using DPV for ROPA #67 - can be done after v1 publication
  • Provide Guide for using DPV to create Consent Records #68 - can be done after v1 publication
  • Create test to identify undefined terms #71 - to detect errors in concepts
• Notes on Future Work
  • Machine-readable requests to execute rights #4 Rights Exercise - will be integrated in v1
  • Provide concepts for Data Breach #64 Data Breach - not fixed in v1

[tekrajchhetri]

Figure 25 (https://w3c.github.io/dpv/primer/), EncryptionInRest and EncryptionInTransfer is confusing. What does EncryptionInRest represent? Is it TLS level encryption? I believe by EncryptionInTransfer, you mean the data encryption before transfer or?

[coolharsh55]

"At Rest" refers to data being encrypted where it 'stays' or is stored. The other one, "In Transit", relates to encrypting when data 'moves' or is transferred. I don't remember how we ended up with the form "in rest/transfer", but I do remember selecting 'Transfer' instead of 'Transit' as it aligns better with transfer as the processing verb instead of transit which is not present in DPV. The term definitions in the spec do clarfify this, e.g. https://w3id.org/dpv#EncryptionInRest.