Represents Erasure Of personal data.
Erasure Of Personal Data
Represents Dissemination Of personal data.
Dissemination Of Personal Data
Links purpose with the consent instance associated with it.
is purpose for consent
Represents Alteration Of personal data.
Alteration Of Personal Data
Represents Restriction Of personal data.
Restriction Of Personal Data
Represents the type of processing where Retrieval of data takes place.
Data Retrieval
Purpose refers to the aim or goal towards which the data is processed (or associated with any other form of action).
Purpose
Indicates that consent has not been given.
Not Given
Represents the type of processing where Use of data takes place.
Data Use
Specifies the instant at which the consent was created/given/changed.
at time
Links an action to the purpose it is associated with.
is action for purpose
Represents the type of processing where Recording of data takes place.
Data Recording
Represents the type of processing where Collection of data takes place.
Data Collection
Indicates consent is given via an implicit action or assumption.
Implicitly Given
Indicates the involvement by association of a Third Party.
involves third party
Indicates the entity or activitiy that provided the consent.
is provided by
Indicates consent has been requested but has not been given (yet).
Requested
links a context to the consent instance it describes
is context for consent
A Delegation of consent occurs when another entity, whether a data subject or their representative or an automated mechanism, provides the consent on behalf of the intended Data Subject. The delegated consent is provided through the mechanism of a _delegation_. This involves three entities - the Data Subject the delegation occurs for, the entity that acts as the delegate, and the mechanism used to verify the authority to delegate. They (first two) are provided respectively by the properties `isConsentDelegationFor`, and `hasConsentGivenByDelegate`.
Represents Structuring Of personal data.
Structuring Of Personal Data
Specifies the Person that provided this consent.
is provided by person
Links a status to the consent that uses it.
is status for consent
Indicates the consent status is unknown.
Unknown
Represents Combination Of personal data.
Combination Of Personal Data
As per Article 4(1) of the GDPR, ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’);
Personal Data
Represents a consent entity that is considered given whether implicitly, explicitly, or by delegation.
Given Consent
Links a consent instance with the data subject it is associated with.
is consent for data subject
Represents the type of processing where Organisation of data takes place.
Data Organisation
Indicates the Organisation the consent was provided to.
is provided to controller
Represents the type of processing where Restriction of data takes place.
Data Restriction
Consent is one of the legal basis for processing personal data under the General Data Protection Regulation (GDPR), which is the current Eurpoean data protection law enforced from 25th May 2018. GDPR stipulates obligations on how consent should be obtained, used, modified, and recorded. Additionally, it provides data subjects with the right to modify or withdraw their consent at any time. Demonstrating compliance to these rights and obligations requires maintaining information about the consent lifecycle. Existing work has demonstrated the feasibility of using semantic web technologies to represent and query this information. GConsent is an OWL2 ontology for representing consent for GDPR compliance. The ontology is based on an analysis of modelling metadata requirements related to the consent lifecycle for GDPR compliance. It allows modelling and representation of information related to compliance in an extensible and comprehensive manner.
GConsent provides concepts and relationships for defining consent and its associated information or metadata with a view towards GDPR compliance. It is the outcome of an analysis of consent and requirements associated with obtaining, using, and changes in consent as per the GDPR. The ontology also provides an approach to using its terms in various scenarios and use-cases (see more information in the documentation) which is intended to assist in its adoption.
GConsent - a consent ontology based on the GDPR
Represents Collection Of personal data.
Collection Of Personal Data
Represents Disclosure by Transmission Of personal data.
Disclosure by Transmission Of Personal Data
Represents the type of processing where Dissemination of data takes place.
Data Dissemination
Describes the medium through which consent was given/provided. Example: web form, recorded voice, signature on document.
Medium
Links a consent instance to the context in which it was acquired/provided/given.
has context
Represents Alignment Of personal data.
Alignment Of Personal Data
Indicates that consent has been refused (to be given).
Refused
A Data Controller is defined as "The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data."
Represents the status of consent for the data subject. This allows persisting the determination of the validatity or suitability of consent (as an entity or instance) for use in processing and other activities. Examples: consent is given, consent is requested but not given, consent was withdrawn.
Status
Links the consent to personal data it is associated with it.
for personal data
Represents Organisation Of personal data.
Organisation Of Personal Data
Indicates consent is given via delegation.
Given by Delegation
Specifies the Instant or Duration in which the consent expires.
has expiry
Represents Use Of personal data.
Use Of Personal Data
Denotes the state or status of consent.
has status
Represents the type of processing where Combination of data takes place.
Data Combination
Represents the type of processing where Storage of data takes place.
Data Storage
Specifies the medium through which the consent was given. Examples are web forms, paper documents.
in medium
Indicates the role played by specified Person or Organisation or Third Party in the specified Association.
hasRole
Represents consent states that are valid for processing
Status valid for Processing
Indicates sharing of personal data with a Third Party through the association.
Represents Recording Of personal data.
Recording Of Personal Data
Indicates an Association with another entity for a Purpose or Processing
has association
Links a consent instace to the purpose(s) it is associated with.
for purpose
Indicates consent has been withdrawn.
Withdrawn
Links the entity or activity that gave consent to the entity or activity representing the consent (or its delegation).
gave consent
Links the consent with its associated processing.
for processing
Specifies the delegation that provided this consent.
is provided by delegation
Represents Storage Of personal data.
Storage Of Personal Data
Represents an Agent that is a Person or an Organisation other than the current entity (w.r.t. data protection laws).
Third Party
Represents the type of processing where Structuring of data takes place.
Data Structuring
A Minor is a Data Subject who cannot provide their own consent (that is legally valid). Therefore, their consent must be obtained via a Guardian or Legal Representative or Parent. Minor is a subclass of Data Subject. Consent given in lieu of a Minor (by their Representative) is associated with the `ConsentInstance` class/instance using the `wasGivenBy` property. The ontology currently does not capture this relationship between the Minor and their Representative. This is due to required clarifications regarding how this role should be represented. For example, the `DataSubject` cannot be subclassed to create a `Representative` class, as this would make the `DataSubject` a permanent representative for the Minor. Instead, the role of 'acting as representative' is only for the instance of the given consent. Therefore, this could be represented with a `ConsentRepresentativeRole` class that links to the `MinorDataSubject` with `roleHadDataSubject` property, and the `DataSubject` that gave the consent via the `roleHadRepresentative` property. The relationship or reason or situation of this given consent can be captured by further annotating the `ConsentRepresentativeRole` instance. This approach can also be extended to other similar situations where one `DataSubject` gives consent in lieu of another. Note: A Minor can provide their own consent in certain cases, or conversely, a minor's consent may need to be provided by a 'parental' representative in some cases.
Minor Data Subject
Indicates the consent has been invalidated.
Invalidated
Denotes that this consent instance is the previous consent for the specified consent instance.
is previous consent for
Represents consent states that are invalid for processing.
Status invalid for Processing
Links a data subject to their consent.
has consent
Represents the type of processing where Alteration of data takes place.
Data Alteration
As per Article 4(11) of the GDPR, ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her; In the case of this ontology, 'Consent' is a concept as well as a tangible entity (something that has a provenance record). To separate this distinction with relation to the data subject, the Consent class represents the consent of the data subject in its entirely, including any history and annotations for it. To link the `Consent` instance with the `DataSubject` instance, use the `isConsentForDataSubject` and `hasConsent` properties.
Consent
Represents sharing of personal data
Sharing of Personal Data
Indicates that the specified Person or Data Controller was provided the associated consent.
was provided consent
Type of processing where sharing of data takes place with a Third Party.
Data Sharing
Represents Retrieval Of personal data.
Retrieval Of Personal Data
Data Subject is defined as an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; - according to Article 4(1) of the GDPR pertaining to the definition of Personal Data. In the case of this ontology, a Data Subject refers to the person(s) as per the definition of the GDPR. Since a Data Subject is a Person, it is defined as a subclass of foaf:Person. The Data Subject is linked to the Consent instance via the isConsentForDataSubject and hasConsent properties.
Data Subject
Indicates the Person the consent was provided to.
is provided to person
Indicates an Association is for the associated Purpose or Processing.
is association for
Links personal data with the consent it is associated with.
is personal data for consent
Specifies the consent instance which this instance is an update or revision of.
is updated consent for
Specifies the location at which the consent was given.
at location
Indicates the consent has expired.
Expired
Represents the type of processing where Alignment of data takes place.
Data Alignment
Indicates the Person or Data Controller the consent was provided to.
is provided to
Represents Adaptation Of personal data.
Adaptation Of Personal Data
Represents the type of processing where Adaptation of data takes place.
Data Adaptation
Represents Destruction Of personal data.
Destruction Of Personal Data
Represents Consultation Of personal data.
Consultation Of Personal Data
Represents the type of processing where Erasure of data takes place.
Data Erasure
Represents the type of processing where Disclosure by Transmission of data takes place.
Data Disclosure by Transmission
Indicates consent is explicitly given.
Explicitly Given
Processing is defined by the GDPR (Article 4-2) as "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;". Processing can be considered as the action, within an activity for example, that uses data in a particular or specific way. Therefore, processing specifies what is happening to/with the data. To define a type of processing (or its associated action), the Processing class should be subclassed for each type. Furthermore, each subclass should define a instance as a generic representative of that action. For example, "collect" as a type of processing (defined by the GDPR), is defined as the class DataCollection, which is a subclass of Processing, and has the individual CollectionOfPersonalData to represent a generic instance of the concept. This is to provide a ready-to-use ontology in terms of "collect" as an action, while also providing a way to specialise the action/processing. GConsent defines several such types of processing taken from the text of the GDPR.
Processing
Represents the type of processing where Consultation of data takes place.
Data Consultation
Represents the type of processing where Destruction of data takes place.
Data Destruction