DPV 2.0 Beta

DPV 2.0 Beta Release

The DPVCG is proud to present - a major release that significantly improves and expands the scope and usefulness as compared to DPV 1.0. This 2.0 release is complete and is now being provided in beta mode for feedback. The period for feedback is until 31 July. The completed 2.0 release will be published after this on 01 August - unless major issues are identified.

The draft article Data Privacy Vocabulary (DPV) -- Version 2 by Pandit et al. (2024) describes DPV v2 in terms of its contents, methodology, current adoptions and uses, and future potential. It also describes the relevance and role of DPV in acting as a common vocabulary to support various regulatory (e.g. EU's DGA and AI Act) and community initiatives (e.g. Solid) emerging across the globe. A Search Index of all concepts from DPV and extensions is available.

Summary of Changes

Major Changes

The following are the major changes:

1. Change in Ontology IRI: DPV 2.0 introduces versioned IRIs e.g. https://w3id.org/dpv/2.0 refers to 2.0 and https://w3id.org/dpv/1.0 refers to 1.0. The versionless IRI https://w3id.org/dpv will now always point to the latest version of DPV (which is 2.0 for this release) see more
2. Change in semantics: The 'default' DPV specification now uses RDFS+SKOS to declare its semantics. DPV using OWL2 semantics is now provided within the same folder with a -owl prefix see more
3. Change in Scope: The scope of 1.0 concerned processing of personal data and DPV concepts concerned only this scope. In 2.0, the scope has been expanded to include non-personal data and technologies so that concepts such as dpv:Purpose can be used to describe more use-cases see more
4. Change in repo structure: The folder structure of the repository has been changed to reflect the versioned IRIs. The two folders 1.0 and 2.0 contain the respective versions see more
5. Change in extension names: Various extensions have been renamed and re-organised for consistency by removing the dpv- prefix e.g. dpv-pd extension in 1.0 has been renamed to pd. New extensions have been added to DPV e.g. AI, LEGAL-US, and EU-AIAct and earlier draft extensions have been further refined e.g. RISK and TECH see more
6. Do I need to update or change something? Mostly no, except in specific cases. see more
7. Change in concepts: In total, DPV 2.0 and all its extensions contain 2662 concepts, and compared to 1.0 - 1017 concepts have been added and 805 concepts removed. The count of added and removed concepts include moving concepts between extensions see more
8. Development process: The development process for DPV has changed to reflect best practices and improvements identified. This includes changes to the way releases are generated by only using the dev branch for ongoing developments and not changing the main branch except for releases see more

Existing and New Extensions

Detailed logs are present in the changelog

1. DPV total terms: 911 ; added: 311 ; removed: 56
2. PD total terms: 227 ; added: 22 ; removed: 4
3. EU-GDPR total terms: 163 ; added: 69 ; removed: 33
4. LEGAL total terms: 84 ; added: 48 ; removed: 424
5. LOC total terms: 340 ; added: 8 ; removed: 128
6. TECH total terms: 134 ; added: 105 ; removed: 52
7. EU-RIGHTS total terms: 68 ; added: 7 ; removed: 3
8. RISK total terms: 369 ; added: 81 ; removed: 105
9. AI total terms: 17 ; added: 17 ; removed: 0 (new extension)
10. Justifications total terms: 71 ; added: 71 ; removed: 0 (new extension)
11. EU-DGA total terms: 66 ; added: 66 ; removed: 0 (new extension)
12. EU-AIAct total terms: 87 ; added: 87 ; removed: 0 (new extension)
13. EU-NIS2 total terms: 14 ; added: 14 ; removed: 0 (new extension)
14. LEGAL-IE total terms: 8 ; added: 8 ; removed: 0 (new extension)
15. LEGAL-IN total terms: 8 ; added: 8 ; removed: 0 (new extension)
16. LEGAL-DE total terms: 40 ; added: 40 ; removed: 0 (new extension)
17. LEGAL-GB total terms: 9 ; added: 9 ; removed: 0 (new extension)
18. LEGAL-US total terms: 19 ; added: 19 ; removed: 0 (new extension)
19. LEGAL-EU total terms: 27 ; added: 27 ; removed: 0 (new extension)

Release Artefacts

Unlike DPV 1.0, there is only a single dpv.zip file containing all relevant artefacts for the release. This includes both the default RDFS+SKOS serialisation as well as the OWL serialisation - which is present in the same folder with suffix -owl in the filename. The folders also contain CSV serialisations of concepts (so please do not use any other CSVs found in the repo as they are not 'production-ready').

Contributors

Thanks to the following members of the DPVCG:

• Harshvardhan J. Pandit @coolharsh55
• Beatriz Esteves @besteves4
• Georg P. Krog
• Paul Ryan @Paul-Ryan76
• Delaram Golpayegani @delaramglp
• Julian Flake @nuthub
• Arthit Suriyawongkul @bact
• Dave Lewis
• Iain Henderson
• Jan Lindquist
• Mark Lizar
• Rob Brennan
• Steve Hickman @steve-hickman-epistimis
• Ted Thibodeau Jr @TallTed
• Tytti Rintamaki

Also thanks to the following people:

• Adrian Medina @aamedina for identifying and fixing typos and lapses in documentation
• Jenni Parry @jenni0608 for missing labels in processing taxonomy
• Maya Borges @mayaborges, Damien Desfontaines @TedTed, and @derhagen for discussion in #15 regarding anonymisation and pseudonymisation
• Tek Raj Chhetri @tekrajchhetri for cloud services in TECH extension

P.S. If I have missed anyone here, sincere apologies, please contact me so I can acknowledge your contributions - @coolharsh55

DPV v1

The release announcement is available at https://www.w3.org/community/dpvcg/2022/12/05/dpv-v1-release/ along with links to the published final reports for the following vocabularies and documents:

• DPV
• DPV-GDPR
• DPV-PD
• Primer
• Guide for using DPV in OWL2

Along with these, other vocabularies and documents are provided in draft form:

• DPV-Legal
• DPV-Tech
• Risk
• Rights
• Use-Cases
• Examples

DPV v0.9

This is the last point/minor version before v1 release. It makes the following changes:

DPV

• Location: added City, PrivateLocation, PubliclyLocation
• Legal Basis: added LegitimateInterestOfDataSubject
• Organisational Measures: added ReviewImpactAssessmentAdequacy, ReviewProcedure, ReviewImpactAssessmentConformance, ConsultationWithDataSubjectRepresentative, ReviewImpactAssessment
• Personal Data: renamed PseudoAnonymisedData to PseudonymisedData
• Processing Context: added ScoringOfIndividuals and EvaluationOfIndividuals
• Processing: renamed PseudoAnonymise to Pseudonymise
• Purpose: renamed CreatePersonalizedRecommendations to CreatePersonalisedRecommendations
• Status: added hasLawfulness, Lawfulness, NonConformant, LawfulnessUnkown, ConformanceStatus, Unlawful, Conformant, Lawful
• Technical Measures: fixed pseudonymisation spelling in RNGPseudoanonymisation, MonotonicCounterPseudoanonymisation, EncryptionInRest, PseudoAnonymisation, Pseudoanonymisation. Added EncryptionInUse. Deleted duplicates of Pseudonymisation.
• Rights: new module for Rights concepts, with additions of Active and Passive rights, and RightExercise information (work in progress).

DPV-GDPR

It makes the following changes to DPIA: added DPIAConformant, DPIARecommendsProcessingNotContinue, DPIAConformity, DPIARecommendsProcessingContinue, DPIAProcessingRecommendation, DPIANonConformant.

DPV-PD

It makes the following changes: added CriminalOffense

DPV v0.8.2

DPV v0.8.2 - release candidate for v1.0

NOTE:
While this is a regular 0.x style release, it also acts as the v1.0 release candidate. This means if there are no major issues raised and unable to be resolved, including missing parts, errors or bugs, or requirements that must be added, then after 15-OCT-2022, this version will be re-released as DPV v1.0 along with any further enhancements, fixes, minor additions, or documentations that have been developed until then.

This release includes:

• Change concepts to use subtype instead of instance for Duration, Frequency, Organisation, Data Subjects, and Location.
• Change Anonymisation related terms in Technical Measures to disambiguate anonymisation and pseudonymisation, and create a cleaner hierarchy of anonymisation related terms.
• Update and fix existing terms and labels for clarity of concepts.
• Fixes #54 re. purpose label
• Fixes #52 re. describing properties with no domain/range
• Fixes #51 re. definition of Concept

For more details, see the changelog at https://w3id.org/dpv/dpv/changelog

DPV v0.8.1

DPV v0.8.1 - release candidate for v1.0

NOTE:
While this is a regular 0.x style release, it also acts as the v1.0 release candidate. This means if there are no major issues raised and unable to be resolved, including missing parts, errors or bugs, or requirements that must be added, then after 15-OCT-2022, this version will be re-released as DPV v1.0 along with any further enhancements, fixes, minor additions, or documentations that have been developed until then.

This release includes:

• risks and rights have been added to DPV
• missing OWL/Manchester syntax files have been added/fixed
• consistent author affiliations
• funding acknowledgements
• MS-Office Excel (.xlsx) export format

Changelogs:

• dpv https://w3c.github.io/dpv/dpv/changelog
• dpv-gdpr https://w3c.github.io/dpv/dpv-gdpr/changelog
• dpv-tech https://w3c.github.io/dpv/dpv-tech/changelog

DPV v0.8

v0.8: adds risk, rights extensions; introduces major changes

DPV releases are now provided as .zip files for each serialisation

Additions:

• #40 script for creating releases (see script 803)
• risk extension at /dpv/risk
• rights extension at /dpv/rights, currently only provides EU's Charter
  of Fundamental Rights at dpv/rights/eu
• DPIA concepts in DPV-GDPR
• Better modularisation of concepts, Context -> Status,
  ProcessingContext -> ProcessingScale, LegalBasis -> special category
  personal data, data transfer
• Adds OWL-Manchester syntax output for DPV-OWL

Fixes:

• Fixes #37 Fixes #41 Adds property domains/ranges in HTML
• Fixes #44 dpv-tech properties incorrect domain/range
• Fixes label consistency (dct:title -> skos:prefLabel or rdfs:label)
• Remove SKOS concepts from DPV-OWL

NOTE: The documentation (e.g. human readable introductions and explanations) will be updated in the coming days. This release only updates the RDF serialisations and auto-generated HTML pages.

DPV v0.7

v0.7 adds some concepts to the Context, Processing, Purposes, and DPV-PD modules. It fixes minor issues: missing '#' in preferred namespace URI and additional "<" in concept tables.

DPV v0.6

This version updates the DPV to v0.6, which adds the Data Subject
categories and makes minor changes to the Risk module.

It fixes inconsistencies in ontology metadata:

• DPV-SKOS ontologies utilised the wrong metadata
• SPECIAL project links have been updated to the ERCIM archive as the
  previous ones were not resolvable
• other minor fixes

DPV v0.5

This commit updates the DPV to v0.5 (see changelog for specifics)
It adds the DPV-LEGAL extension, with an initial version 0.5 to match it
with the rest of DPV documents. The other extensions have also been
bumped to v0.5 for similar reasons.

The documentation generation now includes common code/text representing
the DPV family of documents to ensure the same links and text are
replicated across all documents, and a common set of references stored
in references.json.

This commit fixes the following issues:

• Fixes #34 regarding incorrect link
• Fix missing link to non-module concepts i.e. rights and risk not
• being defined in HTML
• Ensure consistency in links and text for DPV family of
• documents
• Add links to all documents (specs, extensions, guides)
• Fix incorrect IRIs in DPV-SKOS
• Fix incorrect or missing subclasses in DPV-SKOS

fixes incorrect IRIs in dpv-pd, dpv-gdpr, dpv-nace

• incorrect link to dpv-pd in HTML documentation
• incorrect IRI for dpv-pd (/pd instead of /dpv-pd)
• incorrect IRI for dpv-gdpr (/gdpr instead of /dpv-gdpr)
• incorrect IRI for dpv-nace (/nace instead of /dpv-nace)
• fixed incorrect IRI used for TopConcept in dpv-skos, dpv-skos/dpv-gdpr