Support for Enhanced GDPR Accountability with the Common Semantic Model for ROPA (CSM-ROPA)

Abstract

The creation and maintenance of Registers of Processing Activities (ROPA) are essential to meeting the General Data Protection Regulation (GDPR) and thus to demonstrate compliance based on the GDPR concept of accountability. To establish its effectiveness in meeting this obligation, we evaluate an ROPA semantic model, the Common Semantic Model–ROPA (CSM–ROPA). Semantic models and tools represent one solution to the compliance challenges faced by organisations: the heterogeneity of relevant data sources, and the lack of tool interoperability and agreed common standards. By surveying current practice and the literature we identify the requirements for GDPR accountability tools: digital exchange of data, automated accountability verification and privacy-aware data governance. A case study was conducted to analyse the expressivity and effectiveness of CSM–ROPA when used as an interoperable, machine-readable mediation layer to express the concepts in a comprehensive regulator-provided accountability framework used for GDPR compliance. We demonstrate that CSM–ROPA can express 98% of ROPA accountability terms and fully express nine of the ten European regulators' ROPA templates. We identify three terms for addition to CSM–ROPA, and we identify areas where CSM–ROPA relies on partial matches that indicate model limitations. These improvements to CSM–ROPA will provide comprehensive coverage of the regulator-supplied model. We show that tools based on CSM–ROPA can fully meet the requirements of compliance best practice when compared with either manual accountability approaches or a leading privacy software solution.

Data Privacy Vocabulary (DPV) - Version 2

“…Year Mention Use Extension Contributed Domain [11] 2020 X Health [53] 2020 X Media [7,54,81] 2020 X [12,47,51,71] 2020 X [10] 2020 X Health [15,60,74] 2020 X X [17,55,29] 2021 X Health [37,6,76,62,39] 2021 X [72,20,16,73,52] 2021 X [34] 2021 X Smart products [42] 2021 X X [44,46,43,75,59,66,22] 2022 X [21] 2022 X X [69,70,57,23] 2022 X X [5] 2022 X Health [25,14,13,32,50] 2022 X [4] 2022 X IoT [40] 2022 X Health [58,…”

“…When it comes to extensions performed over DPV, most were contributed back to DPV to be integrated into DPVCG's outputs. Concerning work on GDPR requirements, there were proposed extensions focusing on consent [60,15], in particular related to the processing of electronic health record data [67], as well as on building semantic models to represent records of processing activities [74,69,73], data protection impact assessments [57], data breaches' reports [64], and international data transfer notices [42]. Moreover, extensions focusing on GDPR's data subject rights and exemptions to these rights [23] and on DGA requirements [24,18] were also contributed back to DPVCG's outputs.…”

Transforming Drug Discovery and Development:The Impact of Artificial Intelligence

“…This expertise is essential to accelerating the process of regulatory approval, which in turn makes it possible to bring innovative drugs to market more quickly.In addition, AI has the potential to improve the openness and traceability of the processes involved in the development of drugs, which will make regulatory audits and inspections much simpler. AI systems can assist organisations in demonstrating their commitment to quality and safety by assisting in the maintenance of detailed records and the automation of compliance inspections [52].…”