Adding Data Transfer Tools to DPV-GDPR

Hi. While wrapping up the DPV-GDPR concepts, I realised that we did not 
consider David's proposal for representing "Data Transfer Tool" in the 
vocabulary. Outlined here is my proposal on how we can do this. If you 
agree, I will include it and publish DPV-GDPR v0.3 over the weekend. If 
not, it goes on the agenda for the next meeting.

DataTransferTool subclass of TechOrg Measure ; and containing the 
following subclasses:

- AdHocContractualClauses (subclass of dpv:Contract)
- BindingCorporateRules
- CertificationMechanismsForDataTransfers (subclass of dpv:Certification)
- CodesOfConductForDataTransfers (subclass of dpv:CodeOfConduct)
- StandardContractualClauses (subclass of dpv:Contract)

I've taken this list from EDPB recommendations on supplementary measures 
& data transfers 01/2020

If accepted, I propose these be included in a separate section within 
DPV-GDPR titled "Data Transfers".

--- Additional Thoughts ---

Tangentially, there is a strict relation between these concepts and A46 
sub-clauses by design. For example, BCRs can only be used with 
dpv-gdpr:A46-2b as the legal basis. Is there interest and/or value in 
indicating this relation within DPV-GDPR?

For example, as: BCR dpv:hasLegalBasis dpv-gdpr:A46-2b. This denotes an 
instance of BCR should be used with A46-2b as the legal basis (and does 
NOT intend to say that BCRs existence is justified in A46, which is 
actually in A47).

In my head, I can envision different ways this can be useful. Such as 
ensuring the correct legal bases are used for a processing instance (via 
constraints), or helping suggest the correct legal bases (via 
discovering the relation between concepts and legal bases).

Semantically, this can mess things up, because we're attaching a 
property to a class instead of an instance here, and we don't specify 
strictly how they are to be used - so another option is to have an 
additonal property to indicate suitable legal bases or to declare 
something like SHACL shapes to specify applicable legal bases.

This shouldn't be done hastily, and we'd need to write 
examples/use-cases to make sure this is correct. So we will revisit how 
to add this at a later time. But meanwhile it'd be good to have people's 
opinions on this and start a conversation.

--- end ---

Harshvardhan J. Pandit, Ph.D
Research Fellow
ADAPT Centre, Trinity College Dublin

Received on Friday, 24 September 2021 06:15:48 UTC