Data Privacy Vocabulary (DPV) - Version 2

Abstract

The Data Privacy Vocabulary (DPV), developed by the W3C Data Privacy Vocabularies and Controls Community Group (DPVCG), enables the creation of machine-readable, interoperable, and standards-based representations for describing the processing of personal data. The group has also published extensions to the DPV to describe specific applications to support legislative requirements such as the EU's GDPR. The DPV fills a crucial niche in the state of the art by providing a vocabulary that can be embedded and used alongside other existing standards such as W3C ODRL, and which can be customised and extended for adapting to specifics of use-cases or domains. This article describes the version 2 iteration of the DPV in terms of its contents, methodology, current adoptions and uses, and future potential. It also describes the relevance and role of DPV in acting as a common vocabulary to support various regulatory (e.g. EU's DGA and AI Act) and community initiatives (e.g. Solid) emerging across the globe.

Implementing ISO/IEC TS 27560:2023 Consent Records and Receipts for GDPR and DGA

“…It also defines an information structure providing all or some of this information to the data subject in the form of a consent receipt. To support implementations, Annex A provides examples of consent records and receipts using DPV, and Annex B provides an overview of the different states or stages in 'consent lifecycle' -which is based on DPV's consent states [14,12] and analysis of existing approaches [8,2].…”

“…Implementing ISO-27560 in a machine-readable manner using JSON-LD requires agreement on the schema or ontology to represent the fields. The Annex C JSON-LD example uses the Data Privacy Vocabulary 5 (DPV) [14,12] which is maintained by the W3C Data Privacy Vocabularies and Controls Community Group 6 (DPVCG).…”

“…It has been actively used in several projects at national and international (e.g. Horizon Europe) levels, is being used by the industry, and has been acknowledged by within standards (including ISO-27560) [12]. As such, it represents the best resource currently available for representing consent records and receipts as well as other legally relevant information in a machine-readable form that is based on open (free and non-proprietary) interoperable standards.…”

“…Following the launch of projects for using European Digital Identity wallet (EUDI) wallet 11 for travel, health, banking, education and other sectors, CEN TC224 WG20 12 , which is the EU standardisation body's technical committee for personal identification, has initiated a new standards project to provide guidance on when personal data (attributes) are shared from the wallet in compliance with eIDAS and its proposed revision.…”

“…In this article, we present an analysis of the requirements for recording consent within ISO-27560 and ISO-29184 and compare them with the requirements for valid consent under GDPR (section 3). We then present our work in implementing ISO-27560 using the Data Privacy Vocabulary (DPV) [14,12] to create a machine-readable, interoperable, and extensible specification for consent records and receipts based on open standards (section 4). Through this work we demonstrate the applicability and usefulness of ISO-27560 in assisting with the obligation for demonstrating consent under GDPR (Art.7-1), and explore how ISO-27560 and ISO-29184 can work within the legal framework of GDPR and DGA and the possibility for using this standard to inform the implementation of machine-readable common consent forms under the DGA (section 5).…”