In order to address the Data Governance Act's (DGA) new requirements, this work investigates how to apply existing Semantic Web vocabularies, such as the W3C's Data Privacy Vocabulary (DPV), Open Digital Rights Language (ODRL) or Data Catalog Vocabulary (DCAT), to (1) generate machine-readable policies for the reuse of public data, (2) specify data altruism consent terms, and (3) create uniform registries of data altruism organisations and intermediation services' providers as the usage of such technologies promotes machine readability and interoperability. Existing gaps in the representation of terms for such use cases are covered by the proposed DGAterms vocabulary.
DGAterms aims to promote existing specifications and provide a set of additional terms to express DGA-related use-cases in order to:
DGAterms provides terms based on the Data Governance Act (DGA) to represent policies, notices, records of activities, consent and permission terms and public registers related to the activities of data altruism organisations and data intermediation service providers, as well as public sector bodies and single information point providers.
The Base concepts correspond to the core concepts which currently do not have match any of the taxonomies in the Data Privacy Vocabulary (DPV), such as reuse requests or public registers. In addition, terms related to Legal Bases are provided to ground the processing of data in DGA's mandated legal bases.
The Processing and Processing sections describe new processing operations and entities introduced in the DGA. The Purposes can be provided to justify the entities data handling activities, including data altruism.
The Technical and Organisational Measures and Processing sections describe new types of technical and organisational measures and data categories introduced in the DGA. The Standard and Risk and impacts sections include general concepts to represent standards, as well as risks, impacts and consequences introduced in the DGA.
The Service and Technology sections describe data intermediation and single information point services and technologies and technology actors. The Public registers and Rights sections provide terms to represent public registers of entities, including data altruism organisations and intermediation service providers, and rights prescribed by the DGA.
DISPEUApproval: Confirmation and approval by a competent authority for the Data Intermediation Service Provider's compliance with Article 11 and Article 12 of the DGA.DataReuseRequest: Request for re-use some data.PublicRegister: A register containing information which is made publicly available.A12-e: Explicit request or approval of the data subject or data holder to utilise additional specific tools for the purposes of facilitating exchange of data.A2-6: The legal basis justfiying processing of non-personal data based on the permission of an entity.A31-2: Data Transfer International Agreement.A31-3: Data Transfer Third Country Judgement.A5-11: Model Contractual Clauses.A5-12: Adequacy Decision.A5-9: The legal basis justfiying processing of non-personal data based on the permission of an entity to transfer data.Aggregate: Join data from multiple sources.ConvertFormat: Convert data from one format to another.Display: Show data in an organised way so that it can be seen by the public.Download: Copy and receive data from one computer system to another over a network, e.g., over the internet.Export: Provide a copy of data from one system to another.Reuse: Use of data with a subsequent context i.e. different from its initial context.CharityOrganisation: An organization that supports a cause by fundraising or through donations and charity.DataAltruismAuthority: An authority tasked with overseeing the activity of data altruism organisations and maintaining a public register of said entities.DataAltruismOrganisation: An non-profit organisation whom collects and shares data for altruistic purposes.DataCooperative: An entity constituted by data subjects, one-person undertakings or SMEs who provides data intermediation services and supports its members in the exercise of their data-related rights.DataHolder: An entity who has the right to grant access to or to share certain personal data or non-personal data.DataIntermediationAuthority: An authority tasked with overseeing the activity of data intermediation service providers and maintaining a public register of said entities.DataIntermediationServiceProvider: An entity who establishes commercial relationships for the data sharing between data subjects and data holders on the one hand and data users on the other.DataIntermediationServiceProviderForDataHolder: An entity who makes data holders' data available for potential data users, including bilateral or multilateral exchanges of data and platforms and databases for the joint exploitation of data.DataIntermediationServiceProviderForDataSubject: An entity who makes data subjects' personal data available for potential data users.DataReuseCompetentBody: An entity designated by a public sector body to provide legal and technical support on the access and reuse of public sector data.DataUser: An entity who has access an the right to use personal or non-personal data for commercial or non-commercial purposes.EUSingleInformationPointProvider: An entity who is responsible for receiving and transmiting requests for the re-use of public data in the EU.EuropeanDataInnovationBoard: An authority tasked with overseeing the activities of data intermediation service providers and data altruism organisations.LocalSingleInformationPointProvider: A local entity who is responsible for receiving and transmiting requests for the re-use of public data.NationalSingleInformationPointProvider: A national entity who is responsible for receiving and transmiting requests for the re-use of public data.PrivateSectorBody: Private Sector Body.PublicSectorBody: An entity or association of entities governed by public law formed by one or more State, regional or local authorities.RegionalSingleInformationPointProvider: A regional entity who is responsible for receiving and transmiting requests for the re-use of public data.SMEOrganisation: Organisations with a low number of employees.SectorialSingleInformationPointProvider: An entity who is responsible for receiving and transmiting requests for the re-use of public data for a particular sector.SingleInformationPointProvider: An entity who is responsible for receiving and transmiting requests for the re-use of public data.StartupOrganisation: Newly established organisation.CombatClimateChange: Purposes associated with combating the causes and consequences of climate change, including reducing gas emissions and fighting emergencies such as floods or wildfires.CommercialPurpose: Purposes associated with processing activities performed in a commercial setting or with intention to commercialise.DataAltruism: Purposes associated with the voluntary sharing of data for the general interest of the public, such as healthcare or combating climate change.EnhanceDataInteroperability: Enhance the interoperability of the data.EnsureDataHarmonisationWithStandards: Ensure harmonisation of data with standards.ExchangeViewsOnDataProcessing: Supporting inviduals and entities in exchanging views on data processing purposes and relevant information.FacilitateDataExchange: Facilitate exchange of data.ImproveHealthcare: Purposes associated with improving the public healthcare systems across the Member States, including improving personalised treatments and helping cure chronic diseases.ImprovePublicServices: Purposes associated with improving the provision of public services, such as public safety, education or law enforcement.ImproveTransportMobility: Purposes associated with improving traffic, public transport systems or costs for drivers.MisusePreventionAndDetection: Prevention and Detection of Misuse or Abuse of services.NegotiateContractualAgreements: Negotiate contractual agreements regarding processing of data and other matters, including terms and conditions.NonCommercialPurpose: Purposes associated with processing activities performed in a non-commercial setting or without intention to commercialise.ProtectionOfIPR: Purposes associated with the protection of intellectual property rights.ProtectionOfNationalSecurity: Purposes associated with the protection of national security.ProtectionOfPublicSecurity: Purposes associated with the protection of public security.ProvideOfficialStatistics: Purposes associated with facilitating the development, production and dissemination of reliable official statistics.PublicPolicyMaking: Purposes associated with public policy making, such as the development of new laws.ScientificResearch: Purposes associated with scientific research.SupportInformedConsentChoices: Supporting individuals in understanding and making choices with respect to informed consent.Technical measures
ConsentManagementTool: Technical tools to manage consent.DataExchangeMethod: Methods to facilitate the exchange of data.EuropeanDataAltruismConsentForm: A form provided by the European Commission for collecting consent.PermissionManagementTool: Technical tools to manage permissions.Organisational measures
CommercialConfidentialityAgreement: Agreements that enforce commercial confidentiality including business, professional and company secrets.ConsentManagement: Methods to obtain and withdraw consent or permission to process data.DataAltruismAnnualActivityReport: Document containing the annual activities reported by a Data Altruism organisation.DataAltruismNotice: Notice providing information regarding the processing of data for data altruistic purposes.DataAssetList: Searchable asset list which contains available data resources including their data format and size and the conditions for their re-use.DataBreachNotification: Notification information a data breach or unauthorised transfer, access, use, or modification of data.DataIntermediationServiceNotification: Notification by a Data Intermediation Service Provider to a competent authority concerning changes to details regarding its Data Intermediation Service.DataReusePolicy: A Policy to govern data re-use.DataReuseRequestProcedure: Procedure to request data for reuse via single information point.DataSubjectRightsManagement: Methods to facilitate the exercising of data subjects' rights.DataTransferNotice: Notice for the legal entity for the transfer of its data.EnforceTransferControl: Purposes associated with conducting or enforcing transfer control so as to limit the transfer of data.IntellectualPropertyRightsManagement: Management of Intellectual Property Rights with a view to identify and safeguard and enforce them.LegalMeasure: Legally-recognised agreements, e.g., contracts.License: Document which states the conditions for usage of data.NationalDataAltruismPolicy: A Policy established at National level regarding Data Altruism.PermissionManagement: Methods to obtain and withdraw consent or permission to process data.PersonalDataReuseNotice: Notice for data subjects to provide consent based on information and advise regarding intended use of data, exercise of rights, and applicable terms and conditions.RegisterOfDataIAltruismActivity: Document that logs the activity of the data altruism organisation.RegisterOfDataIntermediationActivity: Document that logs the activity of the data intermediation service provider.StatisticalConfidentialityAgreement: Agreements that enforce statistical confidentiality.ThirdCountryDataRequestNotice: Notice regarding a data request for the transfer of data to a third country recipient.CommerciallyConfidentialData: Data protected through Commercial Confidentiality Agreements.ConfidentialData: Data protected through Confidentiality Agreements.IntellectualPropertyProtectedData: Data protected through Intellectual Property.SensitiveData: Sensitive data.SensitiveNonPersonalData: Sensitive non-personal data.StatisticallyConfidentialData: Data protected through Statistical Confidentiality Agreements.CommonlyUsedOpenStandard: Commonly used and openly accessible standard.CommonlyUsedStandard: Commonly used standard.InternationalStandard: Internationally recognised standard.OpenStandard: Openly accessible standard.Standard: Standard.Compensation: Compensation provided as a benefit.Fee: Fee charged by an entity to provide a service.Reward: Reward provided as a benefit.RiskOfReIdentification: Risk of Re-identification.DataCooperativeService: Service provided by a data cooperative.DataIntermediationService: Service of data intermediation which aims to facilitate the sharing of data between Data Subjects, Data Holders and Data Users.DataIntermediationServiceBetweenHoldersUsers: Data intermediation service for data shared between Data Holders and Data Users.DataIntermediationServiceBetweenSubjectsUsers: Data intermediation service for data shared between Data Subjects, Natural Persons who are Data Holders and Data Users.SingleInformationPoint: Service responsible for receiving and transmiting requests for the re-use of public data.DataIntermediationTechnology: Technology related to the provision of data intermediation services.SecureProcessingEnvironment: Physical or virtual environment to ensure compliance with EU law.TechnologyDesigner: Actor that designs Technology.TechnologyInstaller: Actor that installs Technology.TechnologyMaintainer: Actor that maintains Technology.TechnologyManufacturer: Actor that manufactures Technology.TechnologyOwner: Actor that owns Technology.TechnologyPurchaser: Actor that purchases Technology.TechnologySupplier: Actor that supplies Technology.TechnologyUser: Actor that uses Technology.EURegisterOfDataAltruismOrganisations: Register maintained by EU containing list of recognised data altruism organisations.NationalRegisterOfDataAltruismOrganisations: Register maintained at National level containing list of recognised data altruism organisations.RegisterOfDataAltruismOrganisations: Register containing list of recognised data altruism organisations.RegisterOfDataIntermediationServiceProviders: Register containing a publicly available list of data intermediation service providers.RegisterOfEntities: Register containing a publicly available list of entities that perform a certain activity within a certain location or jurisdiction.RightToDataConversionOptOut: Right of data subjects and data holders to opt-out of data conversions e.g. enhance interoperability or harmonisation with standards.RightToImpartialBodyReview: Right of data subjects and data holders to get an review by an impartial body with the appropriate expertise.RightToLodgeComplaint: Right of data subjects and data holders to lodge a complaint.In this Section, we use DGAterms as well as other W3C standards and specifications, such as W3C's ODRL, DCAT and DPV, to create Linked Data versions of policies, consent and permission terms, public registers and records of activities.
ODRL Offer policy set by the Public Sector Body X that permits the re-use of a dataset until the end of 2023 for scientific research.
ex:policy_001 a odrl:Offer, dgaterms:DataReusePolicy ;
odrl:uid ex:policy_001 ;
odrl:permission [
odrl:target ex:dataset_001 ;
odrl:action dgaterms:Reuse ;
odrl:assigner ex:publicsectorbodyX ;
odrl:constraint [
odrl:and [
odrl:leftOperand odrl:dateTime ;
odrl:operator odrl:lteq ;
odrl:rightOperand "2023-12-31"^^xsd:date
], [
odrl:leftOperand odrl:purpose ;
odrl:operator odrl:isA ;
odrl:rightOperand dgaterms:ScientificResearch
]
]
] .
ex:publicsectorbodyX a dgaterms:PublicSectorBody ;
dpv:hasName "Public Sector Body X" ;
dpv:hasContact "mailto:publicsectorbodyX@email.com" ;
dgaterms:hasCompetentBody [
a dgaterms:DataReuseCompetentBody ;
dpv:hasName "Competent Body X" ;
dpv:hasContact "mailto:competentbodyX@email.com"
] .
Data asset list maintained by the Single Information Point Provider A.
ex:SIPPA_assets a dgaterms:DataAssetList, dcat:Catalog ;
dcterms:description "Asset list maintained by SIPPA" ;
dcterms:created "2022-12-10"^^xsd:date ;
dcterms:publisher ex:SIPPA ;
dcat:dataset ex:dataset_001 .
ex:SIPPA a dgaterms:SingleInformationPointProvider .
ex:dataset_001 a dgaterms:StatisticallyConfidentialData ;
dcterms:description "Dataset with statistically confidential data" ;
dcterms:created "2022-12-04"^^xsd:date ;
dcterms:publisher ex:publicsectorbodyX ;
odrl:hasPolicy ex:policy_001 ;
dgaterms:hasFee "0€"^^xsd:string ;
dcat:mediaType <iana.org/assignments/media-types/text/csv> ;
dcterms:extent "5.6MB"^^xsd:string .
Example of a public register of data intermediation service providers.
ex:publicregistry_DI_PT a dgaterms:RegisterOfDataIntermediationServiceProviders ;
dcterms:description "Public register of intermediaries working in PT" ;
dcterms:created "2023-12-15"^^xsd:date ;
dcterms:modified "2023-12-23"^^xsd:date ;
dcterms:publisher ex:nationalauthority_PT ;
dgaterms:hasDataIntermediationServiceProvider ex:DISP_Y .
ex:nationalauthority_PT a dgaterms:DataIntermediationAuthority ;
dpv:hasName "Data Intermediation Authority of Portugal" ;
dpv:hasContact "mailto:nationalauthority_PT@email.com" ;
dpv:hasJurisdiction "PT" .
ex:DISP_Y a dgaterms:DataCooperative ;
dpv:hasName "Data Cooperative Y" ;
dpv:hasAddress "Lisboa, Portugal" ;
dcterms:description "Provider of anonymised geolocation data" ;
dcat:landingPage <http://cooperativeA.com/> ;
dcterms:date "2023-12-23"^^xsd:date .
Example of a register of data altruism activity logs.
ex:altruism_logs a dgaterms:RegisterOfDataIAltruismActivity ;
dcterms:description "Activity logs of the Data Altruism Organisation A" ;
dcterms:created "2023-11-04"^^xsd:date ;
dcterms:modified "2023-11-13"^^xsd:date ;
dcterms:publisher ex:altruism_A ;
dgaterms:hasActivityLogs ex:log_001 .
ex:altruism_A a dgaterms:DataAltruismOrganisation ;
dpv:hasName "Data Altruism Organisation A" ;
dpv:hasAddress "Lisboa, Portugal" ;
dcat:landingPage <http://example.com/altruism_A> .
ex:log_001 a dgaterms:AltruismActivityLog ;
dcterms:created "2023-11-13"^^xsd:date ;
dgaterms:hasDataUser ex:userZ ;
dgaterms:hasFee "1000€"^^xsd:string ;
dpv:hasPersonalDataHandling [
dcterms:description "Download and reuse anonymised health records to improve healthcare" ;
dpv:hasDuration 6226453 ;
dpv:hasPurpose dgaterms:DataAltruism, dgaterms:ImproveHealthcare ;
dpv:hasProcessing dgaterms:Download, dgaterms:Reuse ;
dpv:hasPersonalData pd:HealthRecord ;
dpv:hasTechnicalMeasure dpv:Anonymisation
] .
ex:userZ a dgaterms:DataUser ;
dpv:hasName "Data User Z" ;
dpv:hasContact "mailto:user_z@email.com" .
Data altruism form where data subject Anne consents to the usage of their location data for the altruistic purpose of improving mobility.
ex:consentForm_001 a dgaterms:EuropeanDataAltruismConsentForm ;
dpv:hasIdentifier <http://example.com/consentForm_001> ;
dpv:hasDataSubject ex:Anne ;
dpv:isIndicatedBy ex:Anne ;
dpv:isIndicatedAtTime "2022-12-14" ;
dpv:hasPersonalDataHandling [
dpv:hasPurpose dgaterms:DataAltruism, dgaterms:ImproveTransportMobility ;
dpv:hasLegalBasis eu-gdpr:A6-1-a ;
dpv:hasPersonalData pd:Location ;
dpv:hasProcessing dpv:Use, dpv:Store ;
dpv:hasDataController [
a dpv:DataController, dgaterms:DataAltruismOrganisation ;
dpv:hasName "Company A" ] ] .
Permission for data altruism where data holder A allows the usage of their anonymised data for the altruistic purpose of providing official statistics.
ex:permissionForm_001 a dpv:Permission ;
dpv:hasIdentifier <http://example.com/permissionForm_001> ;
dgaterms:hasDataHolder ex:dataHolderA ;
dpv:isIndicatedBy ex:dataHolderA ;
dpv:isIndicatedAtTime "2022-12-15" ;
dpv:hasPersonalDataHandling [
dpv:hasPurpose dgaterms:DataAltruism, dgaterms:ProvideOfficialStatistics ;
dpv:hasLegalBasis dgaterms:A2-6 ;
dpv:hasData dpv:AnonymisedData ;
dpv:hasProcessing dpv:Use, dpv:Store ;
dpv:hasDataController [
a dpv:DataController, dgaterms:DataAltruismOrganisation ;
dpv:hasName "Company A" ] ] .