Re: Adding categories of data subjects

Addendum: these categories also apply to other entities e.g. Controllers 
--. whether the processing was intended or not, whether the Controller 
had an active involvement in the processing, and whether the Controller 
was informed about the processing.

Whether this information should be in scope (IMHO - strongly yes to 
represent facts) and whether we should model this with the same or 
different concepts is to be discussed. I am leaning towards separate 
concepts for Processing and Data Subjects.

- Harsh

On 09/10/2023 12:12, Harshvardhan J. Pandit wrote:
> Hi. To answer in order:
> 
> Art's question of whether these would be 6 categories - yes.
> - Intended / Unintended
> - Active / Passive
> - Informed / Uninformed
> 
> Beatriz's question on modelling these as statuses.
> - That's a good question. tldr; status does seem a better 'semantic 
> model', but is also used as a category in common use.
> - We use 'Status' in DPV to provide context to another concept with the 
> expectation that that context will change. In this case, only the 
> Informed/Uninformed categorisation seems likely to change. The 
> Active/Passive and Intended/Unintended are categorisation of data 
> subjects that do not seem likely to change, but can still be statuses.
> - If you want to model this information on a data subject 
> group/individual level, then status can be useful e.g. a specific 
> individual - was informed or not? Same can be achieved with a category 
> e.g. data subject is of 'type' informed.
> - One benefit of statuses over categories is to indicate within 
> processing policies whether data subjects have been informed as a way to 
> keep track of it e.g. hasDataSubjectStatus <Informed>. This is in 
> addition to using hasNotice <Notice> to indicate the information.
> - Active/Passive can similarly be statuses to depict "involvement"
> - Intended/Unintended should be categories
> 
> Mark's question on whether it is possible to represent status of notice 
> as being current - Conformant/NonConformant concepts exist which can be 
> used here with whatever criteria for conformance you want to indicate it 
> with.
> 
> Regards,
> Harsh
> 
> On 02/10/2023 20:41, Mark Lizar wrote:
>> +1, this works well for notice signalling.
>>
>> And to extend what Beatriz mentions as for as status, active and 
>> informed. To this point has the  state of  the status been considered 
>> in modelling?
>>
>> E.g. Is the state of notice current, or not current, to indicate if 
>> privacy is as expected or not.
>>
>> Best,
>>
>> Mark
>>
>>
>>> On Oct 2, 2023, at 9:46 AM, beatriz.gesteves 
>>> <beatriz.gesteves@upm.es> wrote:
>>>
>>> Dear Delaram,
>>>
>>> I support the addition of these concepts.
>>>
>>> A question: since these concepts would be useful to use with other 
>>> types of entities/data subjects (e.g., data subject of type 
>>> dpv:Citizen is uninformed), already modelled in DPV, have you 
>>> considered modelling it as a status (similarly to other statuses that 
>>> we have in DPV e.g. activity statuses)? Or would the idea be to use 
>>> as many data subject types as needed based on the use case?
>>>
>>> Best,
>>>
>>> Beatriz
>>>
>>>
>>> On 02-10-2023 13:32, Arthit Suriyawongkul wrote:
>>>
>>>>
>>>>> On 2 Oct 2023, at 09:08, Delaram Golpayegani 
>>>>> <delaram.golpayegani@adaptcentre.ie> wrote:
>>>>>
>>>>> *Active Data Subject:* The data subjects who are aware of and have 
>>>>> given consent to collection and processing of their data, e.g. an 
>>>>> examinee sitting on an online exam proctored by an AI-based system.
>>>>>
>>>>> *Passive Data Subject*: The data subjects who are not aware of 
>>>>> collection and processing of their data, e.g. a passenger, passing 
>>>>> the border control check, whose data is being processed for 
>>>>> migration monitoring.
>>>> Support the addition. Going to be very useful.
>>>>
>>>> "Not aware" may not fully cover the passiveness here. A passenger 
>>>> who has some knowledge about the border control (previous knowledge 
>>>> or reading a sign at the port) is aware of the collection.
>>>> From the example of online exam proctor and border control, one of 
>>>> the possible Active / Passive cutting points is probably whether 
>>>> during the data collection the data subject involve in the 
>>>> collection process directly. In the first example, the data subject 
>>>> can see the camera and knowingly that the camera is part of the exam 
>>>> process. They may also enter some personal data by themselves as 
>>>> well. Compare to the second example, where the data could be process 
>>>> well before the passenger enter the port (in case of an arranged 
>>>> travel that such the data is required by the regulation like air 
>>>> flight).
>>>> So I think the examples here will be more for Informed Data Subject 
>>>> and Uninformed Data Subject, as Harsh discussed the sense of #1 
>>>> earlier.
>>>> Which would make us having six categories here? :
>>>> - Intended / Unintended
>>>> - Active / Passive
>>>> - Informed / Uninformed
>>>> Cheers,
>>>> Art
>>
> 

-- 
---
Harshvardhan J. Pandit, Ph.D
Assistant Professor
ADAPT Centre, Dublin City University
https://harshp.com/

Received on Monday, 9 October 2023 11:20:30 UTC