@ -0,0 +1,40 @@
Justifications for Rights Exercising
This document outlines the identified concepts required to justify the exercising of data subject's rights,
including justifications to delay or not fulfil such rights.
Overview
The motivation for this work is derived from the need to create and maintain records of the exercising
of data subject's rights under the GDPR.
This work was developed (and is already integrated) within the context of the DPVCG and was started with
the main objectives of indicating
what rights exist
where such rights can be exercised
what information needs to be recorded and maintained when a concrete instance of a right is being/was exercise
As such, the flows of information between a data subject and a data controller for the
exercising of a right request, according to the GDPR, were analysed to extract the relevant concepts to be recorded.
Figure 1 illustrates these flows.
After sending a notice to the data subject
confirming that the request was received, the controller must be able to identify the data subject in
order to proceed with the request (Article 12.2, second sentence). If the controller cannot
identify the data subject, then the data subject must provide additional information to enable the
controller to identify them (Article 11.2). If the controller disregards the request or has
a justification for not fulfilling the right, then the data subject does not receive any information
related to the right request (Article 12.2, second sentence). In case the controller has
a justification to delay the request due to its complexity or a high number of requests, then
the controller has a 2-month extension to fulfil its duty (Article 12.3, second sentence).
Moreover, in case the request is unfounded or excessive, the controller can charge a fee and the
data subject will get the information once this fee is paid (Article 12.5, first sentence). As
it is visible by the diagram, at any point if the data controller does not fulfil its duty then a GDPR
breach occurs and the data subject does not receive their requested information.
Flow diagram of GDPR data subject rights exercising, according to Article 12.
As will be explored in the next section, from the analysis of these flows of information,
a set of high-level concepts was proposed and adopted by the
DPVCG
(general concepts on Rights are modelled in the main DPV specification at
https://w3id.org/dpv#vocab-rights
and GDPR-specific ones in the GDPR extension at
https://w3id.org/dpv/legal/eu/gdpr#vocab-rights
).
Missing from these set of initial concepts adopted by the CG were terms to justify the fulfillment, non-fulfillment and
delay in rights exercising. These shall be the main contribution presented in this document.
Concepts
This section highlights the concepts defined in DPV for the expression of information related to the exercising of data subject rights.
In particular,
Base concepts refer to the concepts already defined in DPV for associating rights with notices,
right exercise activities and records, as well as request status.
Justifications refer to a collection of generic justification concepts for the the non-fulfillment,
delay of fulfillment and exercise of rights, which can be provided in a DPV justifications extension, based on GDPR clauses.
Base concepts
Core concepts of DPV's rights taxonomy
Beyond modelling concepts for applicable Rights and DataSubjectRights, to indicate the association of concepts
with a particular right, the hasRight property is also modelled in DPV.
Additionally, to make a distinction between actionable and non-actionable rights, the ActiveRight and PassiveRight
concepts were created to distinguish between rights that require an action to be taken for them to be exercised and rights that don't require
any action and are always applicable.
The isExercisedAt property should be used to connect a right with a RightExerciseNotice.
This notice provides contextual information regarding how to exercise a right.
Specialised notice concepts for rights that can be fulfilled and those that cannot are modelled as RightFulfilmentNotice and
RightNonFulfilmentNotice, respectively.
To represent concrete records of rights being exercised, the RightExerciseRecord concept can be used to associate a particular
request, or even distinct requests from the same data subject, with corresponding rights exercising activities, modelled as
RightExerciseActivity, using the
DCMI Metadata TermshasPart property.
Additionally, to track the status of rights exercising activities, a set of request statuses are modelled in
DPV, including RequestAccepted for a request being accepted towards fulfilment,
RequestRejected for a request being rejected towards non-fulfilment or RequestRequiresAction for a request requiring
an action to be performed from another party.
Figure 3 showcases the lifecycle of the request status
defined in DPV.
Request status cycle to track the status of rights exercising activities.
While this modelling was inspired by the GDPR, the concepts are described in a jurisdiction-agnostic manner so that they can be used to tackle
data protection regulations in different jurisdictions.
Justifications
Justification concepts for the non-fulfillment, delay or exercise of rights
A collection of justifications for the non-fulfillment, delay of fulfillment and exercise of rights were modelled as subclasses of the
NonPerformanceJustification, DelayJustification and ExerciseJustification concepts.
NonPerformanceJustification: Justification to reject or not complete a process
NotRequiredJustification: JJustification to reject or not complete a process as it does not apply
RightNonFulfilmentJustification: Justification to reject or not complete a right exercising activity
DelayJustification: Justification to delay a process
RightFulfilmentDelayJustification: Justification to delay a right exercising activity
ExerciseJustification: Justification to exercise or iniciate a process
RightExerciseJustification: Justification to exercise or iniciate a right exercising activity
The modelled concepts for each type of justification are defined below and the used GDPR clause is also introduced.
The following set of concepts can be used to reject a certain process or activity (NotRequiredJustification):
JNotReq-TOMSafeguard: Justification that the process is not required as it is safeguarded by appropriate technical and organisational measures [Art.34-3-a GDPR]
JNotReq-UnlikelyRightsImpact: Justification that the process is not required as it is considered to be an unlikely impact on rights and freedoms [Art.A34-3-b GDPR]
JNotReq-DisproportionateEffort: Justification that the process is not required as it would require a disproportionate effort [Art.34-3-c GDPR]
The following set of concepts can be used to express generic justifications for the non-fulfillment of rights exercising (RightNonFulfilmentJustification):
JNonFulf-IdentityVerificationFailure: Justification that the process could not be fulfilled or was not successfull because identity verification failed [Art.12-2 GDPR]
JNonFulf-ProcessExcessive: Justification that the process could not be fulfilled or was not successfull because it was found to be excessive in nature [Art.12-5 GDPR]
JNonFulf-ProcessFrivolous: Justification that the process could not be fulfilled or was not successfull because it was found to be based on frivolous reasons [Art.12-5 GDPR]
JNonFulf-ProcessMalicious: Justification that the process could not be fulfilled or was not successfull because it was found to be malicious e.g. with intent to cause disruption or harassment [Art.12-5 GDPR]
JNonFulf-ProcessUnfounded: Justification that the process could not be fulfilled or was not successfull because it was found to be based on manifestly unfounded reasons [Art.12-5 GDPR]
JNonFulf-EntityAlreadyInformed: Justification that the process could not be fulfilled or was not successfull because the entity already has the information [Arts.13-4, 14-5-a GDPR]
JNonFulf-DisproportionateEffortRequired: Justification that the process could not be fulfilled or was not successfull because it requires a disproportionate effort [Arts.14-5-b, 19 GDPR]
JNonFulf-ImpairObjectives: Justification that the process could not be fulfilled or was not successfull because it impairs the objectives of associated context [Art.14-5-b GDPR]
JNonFulf-ImpossibleToFulfil: Justification that the process could not be fulfilled or was not successfull because it is impossible to fulfil [Arts.14-5-b, 19 GDPR]
JNonFulf-LegallyExempted: Justification that the process could not be fulfilled or was not successfull because it falls under legal exemption i.e. a law allows the non-fulfillment [Arts.14-5-c, 17-3-b, 22-2-b GDPR]
JNonFulf-ConfidentialityObligation: Justification that the process could not be fulfilled or was not successfull because it would compromise a confidentiality obligation [Art.14-5-d GDPR]
JNonFulf-FreedomOfExpression: Justification that the process could not be fulfilled or was not successfull because it would interfere with the right of freedom of expression and information of others [Art.17-3-a GDPR]
JNonFulf-SafeguardPublicInterest: Justification that the process could not be fulfilled or was not successfull because it would interfere with necessary tasks carried out for public interest [Arts.17-3-b, 20-3, 21-6, 23-1-e GDPR]
JNonFulf-ExerciseOfficialAuthority: Justification that the process could not be fulfilled or was not successfull because it would interfere with the exercise of official authorities [Arts.17-3-b, 20-3, 23-1-h GDPR]
JNonFulf-SafeguardPublicHealth: Justification that the process could not be fulfilled or was not successfull because it would interfere with necessary tasks carried out for public health reasons [Art.17-3-c GDPR]
JNonFulf-ImpairArchiving: Justification that the process could not be fulfilled or was not successfull because it impairs archiving for public interest [Art.17-3-d GDPR]
JNonFulf-ImpairScientificOrHistoricalResearch: Justification that the process could not be fulfilled or was not successfull because it impairs scientific or historical research [Art.17-3-d GDPR]
JNonFulf-ImpairStatistics: Justification that the process could not be fulfilled or was not successfull because it would interfere with official statistics [Art.17-3-d GDPR]
JNonFulf-EstablishLegalClaim: Justification that the process could not be fulfilled or was not successfull because it would interfere with the establishment of legal claims [Arts.17-3-e, A21-1 GDPR]
JNonFulf-ExerciseLegalClaim: Justification that the process could not be fulfilled or was not successfull because it would interfere with the exercise of legal claims [Arts.17-3-e, A21-1 GDPR]
JNonFulf-DefendLegalClaim: Justification that the process could not be fulfilled or was not successfull because it would interfere with the defence of legal claims [Arts.17-3-e, A21-1 GDPR]
JNonFulf-SafeguardThirdPartyRights: Justification that the process could not be fulfilled or was not successfull because it would affect the rights and freedoms of others [Arts.20-4, 23-1-i GDPR]
JNonFulf-LegitimateInterest: Justification that the process could not be fulfilled or was not successfull because it the legitimate interest of teh controller overrides the interests or rights of the data subject [Art.21-1 GDPR]
JNonFulf-NecessityContractPerformance: Justification that the process could not be fulfilled or was not successfull because it is necessary for the performance of a contract [Art.22-2-a GDPR]
JNonFulf-NecessityEnterContract: Justification that the process could not be fulfilled or was not successfull because it is necessary for entering into a contract [Art.22-2-a GDPR]
JNonFulf-ConsentBased: Justification that the process could not be fulfilled or was not successfull because it is based on explicit consent [Art.22-2-c GDPR]
JNonFulf-SafeguardNationalSecurity: Justification that the process could not be fulfilled or was not successfull because it would interfere with necessary tasks to safeguard national security [Art.23-1-a GDPR]
JNonFulf-SafeguardDefence: Justification that the process could not be fulfilled or was not successfull because it would interfere with necessary tasks to safeguard defence [Art.23-1-b GDPR]
JNonFulf-SafeguardPublicSecurity: Justification that the process could not be fulfilled or was not successfull because it would interfere with necessary tasks to safeguard public security [Art.23-1-c GDPR]
JNonFulf-PreventCriminalOffences: Justification that the process could not be fulfilled or was not successfull because it would interfere with the prevention of criminal offences [Art.23-1-d GDPR]
JNonFulf-InvestigateCriminalOffences: Justification that the process could not be fulfilled or was not successfull because it would interfere with the investigation of criminal offences [Art.23-1-d GDPR]
JNonFulf-DetectCriminalOffences: Justification that the process could not be fulfilled or was not successfull because it would interfere with the detection of criminal offences [Art.23-1-d GDPR]
JNonFulf-ProsecuteCriminalOffences: Justification that the process could not be fulfilled or was not successfull because it would interfere with the prosecution of criminal offences [Art.23-1-d GDPR]
JNonFulf-ExecuteCriminalPenalties: Justification that the process could not be fulfilled or was not successfull because it would interfere with the execution of criminal penalties [Art.23-1-d GDPR]
JNonFulf-SafeguardJudicialIndependence: Justification that the process could not be fulfilled or was not successfull because it would interfere with the protection of judicial independence and proceedings [Art.23-1-f GDPR]
JNonFulf-PreventEthicsBreach: Justification that the process could not be fulfilled or was not successfull because it would interfere with the prevention of breaches of ethics for regulated professions [Art.23-1-g GDPR]
JNonFulf-InvestigateEthicsBreach: Justification that the process could not be fulfilled or was not successfull because it would interfere with the investigation of breaches of ethics for regulated professions [Art.23-1-g GDPR]
JNonFulf-DetectEthicsBreach: Justification that the process could not be fulfilled or was not successfull because it would interfere with the detection of breaches of ethics for regulated professions [Art.23-1-g GDPR]
JNonFulf-ProsecuteEthicsBreach: Justification that the process could not be fulfilled or was not successfull because it would interfere with the prosecution of breaches of ethics for regulated professions [Art.23-1-g GDPR]
JNonFulf-SafeguardDataSubject: Justification that the process could not be fulfilled or was not successfull because it would interfere with the protection of the data subject [Art.23-1-i GDPR]
JNonFulf-EnforceCivilLawClaim: Justification that the process could not be fulfilled or was not successfull because it would interfere with the enforcement of civil law claims [Art.23-1-j GDPR]
The following set of concepts can be used to express generic delay justifications for the exercising of rights (RightFulfilmentDelayJustification):
JDelay-IdentityVerification: Justification that the process could not be fulfilled or was not successfull because identiy verification is required [Arts.12-1, 12-6 GDPR]
JDelay-Complexity: Justification that the process is delayed due to complexity in fulfilling it [Art.12-3 GDPR]
JDelay-HighVolume: Justification that the process is delayed due to high volume of similar processes required to be fulfilled [Art.12-3 GDPR]
JDelay-InformationRequirement: Justification that the process is delayed due to additional information being required [Art.12-6 GDPR]
The following set of concepts can be used to express generic justifications for the exercising of rights (RightExerciseJustification):
JExercise-NonNecessity: Justification that the process should be carried out due to non-necessity of specified context [Arts.17-1-a, 18-1-c GDPR]
JExercise-LackOfFurtherLegality: Justification that the process should be carried out due to lack of further legality of legal basis to justify continuation of specified context [Art.17-1-b GDPR]
JExercise-Objection: Justification that the process should be carried out due to specified objection(s) [Arts.17-1-c, 18-1-d GDPR]
JExercise-UnlawfulActivity: Justification that the process should be carried out due to it being an unlawful activity [Arts.17-1-d, 18-1-b GDPR]
JExercise-LegalObligation: Justification that the process should be carried out due to it being a legal obligation [Art.17-1-e GDPR]
JExercise-InformationSocietyServicesOffer: Justification that the process should be carried out due to it being related to the offer of information society services [Art.17-1-f GDPR]
JExercise-ContestAccuracy: Justification that the process should be carried out due to the accuracy of data being contested by the data subject [Art.18-1-a GDPR]
