DPV-ISO providing concepts from ISO terminology and standards

[coolharsh55]

The DPV terminology is based on that used by the GDPR (reflection of its conception). In order to make it easier to use the DPV for specific jurisdictions, tables for alignments or mappings can be provided that specify how concepts correlate between different jurisdictions. These mappings can be semantic based (e.g. subclass, SKOS matching) or simply alternate labels (where equivalent, provide labels for specific jurisdiction or notation). Extensions (e.g. DPV-GDPR) would be where the respective assertions are housed. e.g. (showing various possibilities)

# dpv.ttl
dpv:DataController a rdfs:Class ;
    rdfs:label "Data Controller"@en .

# dpv-gdpr.ttl
dpv:DataController :hasLabelForGDPR "Data Controller"@en .
:DataController skos:exactMatch dpv:DataController .
:DataController owl:equivalentClass dpv:DataController .

# dpv-iso.ttl
dpv:DataController :hasLabelForISO "PII Controller"@en .
:PIIController skos:exactMatch dpv:DataController .
:PIIController owl:equivalentClass dpv:DataController .

[coolharsh55]

The specific jurisdiction should get its own separate extension to model its concepts e.g. legal basis. This is 'best practice' to prevent potentially several complex labels from being presented with every DPV concept. This issue has been modified to instead motivate the creation of dpv-iso for providing the following:

1. ISO terms e.g. PII Controller
2. Mapping between ISO terms e.g. PII Controller skos:exactMatch dpv:DataController
3. ISO standards as concepts and where relevant indicative of tech/org measures they represent

[coolharsh55]

This can be made part of Issue #31 regarding mappings to other vocabularies. Here, ISO terminology is considered a vocabulary on its own.

[coolharsh55]

For this work, we have to distinguish between merely 'aligning' the terminology between DPV and ISO (e.g. saying dpv:DataController is same as iso:PIIController) and between representing specific ISO standards and its concepts and controls. There are two approaches here:

1. We have the mapping in the /mappings/iso folder as for other vocabs, and here we specify only the alignment between terms, ISO labels, etc.
2. We represent specific ISO standards under /<version>/standards/iso/<number> and within these represent the specific concepts, along with alignment to DPV.

Approach n.1 provides convenience as everything is in one place, but n.2 provides a better and formal mapping and also allows representing the standards and terms so folks can use that in DPV e.g. tech/org measure. Both can also be combined, where the ISO terms in n.1 mappings use the IRIs from n.2.

[TallTed]

saying dpv:DataController is same as iso:PIIController

I must caution against too-liberal use of owl:sameAs, which is usually what is meant by such statements as the above, but which should only be used between two identifiers that refer to the exact same entity, i.e., two identifiers that coreference one entity.

Far better to use things like skos:broader, skos:narrower, owl:equivalentClass, owl:disjointWith, owl:subclass, owl:subproperty, etc., which are generally less strict in their meaning.

[coolharsh55]

@TallTed agree. See example at top of thread.

[coolharsh55]

@TallTed agree. See example at top of thread.