Erasure Of Personal Data
type: Processing
type: Data Erasure
type: NamedIndividual
comment: Represents Erasure Of personal data.

Dissemination Of Personal Data
type: Processing
type: Data Dissemination
type: NamedIndividual
comment: Represents Dissemination Of personal data.

is purpose for consent
type: ObjectProperty
comment: Links purpose with the consent instance associated with it.
domain: Purpose
range: Consent

Alteration Of Personal Data
type: Processing
type: Data Alteration
type: NamedIndividual
comment: Represents Alteration Of personal data.

Restriction Of Personal Data
type: Processing
type: Data Restriction
type: NamedIndividual
comment: Represents Restriction Of personal data.

Data Retrieval
type: Class
comment: Represents the type of processing where Retrieval of data takes place.
subclass of: Processing

Purpose
type: Class
comment: Purpose refers to the aim or goal towards which the data is processed (or associated with any other form of action).

Not Given
type: Status invalid for Processing
type: Status
type: NamedIndividual
comment: Indicates that consent has not been given.

Data Use
type: Class
comment: Represents the type of processing where Use of data takes place.
subclass of: Processing

at time
type: ObjectProperty
comment: Specifies the instant at which the consent was created/given/changed.
domain: Consent
range: Instant
sub property of: has context

is action for purpose
type: ObjectProperty
comment: Links an action to the purpose it is associated with.
domain: Processing
range: Consent

Data Recording
type: Class
comment: Represents the type of processing where Recording of data takes place.
subclass of: Processing

Data Collection
type: Class
comment: Represents the type of processing where Collection of data takes place.
subclass of: Processing

Implicitly Given
type: Status valid for Processing
type: Status
type: NamedIndividual
comment: Indicates consent is given via an implicit action or assumption.

involves third party
type: ObjectProperty
comment: Indicates the involvement by association of a Third Party.
domain: Class
  union of: Processing
  union of: Purpose
range: Third Party
property chain axiom: has association
property chain axiom: agent

is provided by
type: IrreflexiveProperty
type: AsymmetricProperty
type: FunctionalProperty
type: ObjectProperty
comment: Indicates the entity or activitiy that provided the consent.
domain: Class
  union of: Consent
  union of: Delegation
range: Class
  union of: Person
  union of: Data Subject
  union of: Delegation
inverse of: gave consent

Requested
type: Status invalid for Processing
type: Status
type: NamedIndividual
comment: Indicates consent has been requested but has not been given (yet).

is context for consent
type: ObjectProperty
comment: links a context to the consent instance it describes
range: Consent

Delegation
type: Class
comment: A Delegation of consent occurs when another entity, whether a data subject or their representative or an automated mechanism, provides the consent on behalf of the intended Data Subject. The delegated consent is provided through the mechanism of a _delegation_. This involves three entities - the Data Subject the delegation occurs for, the entity that acts as the delegate, and the mechanism used to verify the authority to delegate. They (first two) are provided respectively by the properties `isConsentDelegationFor`, and `hasConsentGivenByDelegate`.
subclass of: Delegation

Structuring Of Personal Data
type: Processing
type: Data Structuring
type: NamedIndividual
comment: Represents Structuring Of personal data.

is provided by person
type: IrreflexiveProperty
type: AsymmetricProperty
type: FunctionalProperty
type: ObjectProperty
comment: Specifies the Person that provided this consent.
domain: Class
  union of: Consent
  union of: Delegation
range: Person
sub property of: is provided by

is status for consent
type: InverseFunctionalProperty
type: ObjectProperty
comment: Links a status to the consent that uses it.
domain: Status
range: Consent

Unknown
type: Status invalid for Processing
type: Status
type: NamedIndividual
comment: Indicates the consent status is unknown.

Combination Of Personal Data
type: Processing
type: Data Combination
type: NamedIndividual
comment: Represents Combination Of personal data.

Personal Data
type: Class
comment: As per Article 4(1) of the GDPR, ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’);
subclass of: Class
  union of: PersonalData
  union of: PersonalDataEntity

Given Consent
type: Class
comment: Represents a consent entity that is considered given whether implicitly, explicitly, or by delegation.
subclass of: Consent
subclass of: Class
  union of: Restriction
    has value: Explicitly Given
    on property: has status
  union of: Restriction
    has value: Given by Delegation
    on property: has status
  union of: Restriction
    has value: Implicitly Given
    on property: has status
equivalent class: GivenConsent

is consent for data subject
type: FunctionalProperty
type: ObjectProperty
comment: Links a consent instance with the data subject it is associated with.
domain: Consent
range: Data Subject

Data Organisation
type: Class
comment: Represents the type of processing where Organisation of data takes place.
subclass of: Processing

is provided to controller
type: IrreflexiveProperty
type: AsymmetricProperty
type: InverseFunctionalProperty
type: ObjectProperty
comment: Indicates the Organisation the consent was provided to.
domain: Consent
range: Data Controller
sub property of: is provided to

Data Restriction
type: Class
comment: Represents the type of processing where Restriction of data takes place.
subclass of: Processing

GConsent - a consent ontology based on the GDPR
type: Ontology
abstract: Consent is one of the legal basis for processing personal data under the General Data Protection Regulation (GDPR), which is the current Eurpoean data protection law enforced from 25th May 2018. GDPR stipulates obligations on how consent should be obtained, used, modified, and recorded. Additionally, it provides data subjects with the right to modify or withdraw their consent at any time. Demonstrating compliance to these rights and obligations requires maintaining information about the consent lifecycle. Existing work has demonstrated the feasibility of using semantic web technologies to represent and query this information. GConsent is an OWL2 ontology for representing consent for GDPR compliance. The ontology is based on an analysis of modelling metadata requirements related to the consent lifecycle for GDPR compliance. It allows modelling and representation of information related to compliance in an extensible and comprehensive manner.
created: 2018-08-24
creator: https://harshp.com/i/me#HJP
description: GConsent provides concepts and relationships for defining consent and its associated information or metadata with a view towards GDPR compliance. It is the outcome of an analysis of consent and requirements associated with obtaining, using, and changes in consent as per the GDPR. The ontology also provides an approach to using its terms in various scenarios and use-cases (see more information in the documentation) which is intended to assist in its adoption.
license: https://creativecommons.org/licenses/by/4.0/
modified: 2018-11-21
publisher: ADAPT Centre, Trinity College
status: draft
preferred namespace prefix: gc
incompatible with: consent
version IRI: v0.5
version info: 0.5

Collection Of Personal Data
type: Processing
type: Data Collection
type: NamedIndividual
comment: Represents Collection Of personal data.

Disclosure by Transmission Of Personal Data
type: Processing
type: Data Disclosure by Transmission
type: NamedIndividual
comment: Represents Disclosure by Transmission Of personal data.

Data Dissemination
type: Class
comment: Represents the type of processing where Dissemination of data takes place.
subclass of: Processing

Medium
type: Class
comment: Describes the medium through which consent was given/provided. Example: web form, recorded voice, signature on document.

has context
type: ObjectProperty
comment: Links a consent instance to the context in which it was acquired/provided/given.
domain: Consent
inverse of: is context for consent

Alignment Of Personal Data
type: Processing
type: Data Alignment
type: NamedIndividual
comment: Represents Alignment Of personal data.

Refused
type: Status invalid for Processing
type: Status
type: NamedIndividual
comment: Indicates that consent has been refused (to be given).

Data Controller
type: Class
comment: A Data Controller is defined as "The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data."
subclass of: Organisation
equivalent class: Controller

Status
type: Class
comment: Represents the status of consent for the data subject. This allows persisting the determination of the validatity or suitability of consent (as an entity or instance) for use in processing and other activities. Examples: consent is given, consent is requested but not given, consent was withdrawn.

for personal data
type: ObjectProperty
comment: Links the consent to personal data it is associated with it.
domain: Consent
range: Personal Data
inverse of: is personal data for consent

Organisation Of Personal Data
type: Processing
type: Data Organisation
type: NamedIndividual
comment: Represents Organisation Of personal data.

Given by Delegation
type: Status valid for Processing
type: Status
type: NamedIndividual
comment: Indicates consent is given via delegation.

has expiry
type: FunctionalProperty
type: ObjectProperty
comment: Specifies the Instant or Duration in which the consent expires.
domain: Consent
range: TemporalEntity

Use Of Personal Data
type: Processing
type: Data Use
type: NamedIndividual
comment: Represents Use Of personal data.

has status
type: FunctionalProperty
type: ObjectProperty
comment: Denotes the state or status of consent.
domain: Consent
range: Status
inverse of: is status for consent

Data Combination
type: Class
comment: Represents the type of processing where Combination of data takes place.
subclass of: Processing

Data Storage
type: Class
comment: Represents the type of processing where Storage of data takes place.
subclass of: Processing

in medium
type: ObjectProperty
comment: Specifies the medium through which the consent was given. Examples are web forms, paper documents.
domain: Consent
range: Medium
sub property of: has context

hasRole
type: ObjectProperty
comment: Indicates the role played by specified Person or Organisation or Third Party in the specified Association.
domain: Association
range: Role

Status valid for Processing
type: Class
comment: Represents consent states that are valid for processing
subclass of: Status

sharesDataWithThirdParty
type: ObjectProperty
comment: Indicates sharing of personal data with a Third Party through the association.
domain: Data Sharing
range: Third Party
sub property of: involves third party
property chain axiom: has association
property chain axiom: agent

Recording Of Personal Data
type: Processing
type: Data Recording
type: NamedIndividual
comment: Represents Recording Of personal data.

has association
type: ObjectProperty
comment: Indicates an Association with another entity for a Purpose or Processing
domain: Class
  union of: Processing
  union of: Purpose
range: Association
inverse of: is association for

for purpose
type: ObjectProperty
comment: Links a consent instace to the purpose(s) it is associated with.
domain: Consent
range: Purpose
inverse of: is purpose for consent

Withdrawn
type: Status invalid for Processing
type: Status
type: NamedIndividual
comment: Indicates consent has been withdrawn.

gave consent
type: IrreflexiveProperty
type: AsymmetricProperty
type: InverseFunctionalProperty
type: ObjectProperty
comment: Links the entity or activity that gave consent to the entity or activity representing the consent (or its delegation).
domain: Class
  union of: Person
  union of: Data Subject
  union of: Delegation
range: Class
  union of: Consent
  union of: Delegation

for processing
type: ObjectProperty
comment: Links the consent with its associated processing.
domain: Consent
range: Processing
inverse of: is action for purpose

is provided by delegation
type: IrreflexiveProperty
type: AsymmetricProperty
type: FunctionalProperty
type: ObjectProperty
comment: Specifies the delegation that provided this consent.
domain: Class
  union of: Consent
  union of: Delegation
range: Delegation
sub property of: is provided by

Storage Of Personal Data
type: Processing
type: Data Storage
type: NamedIndividual
comment: Represents Storage Of personal data.

Third Party
type: Class
comment: Represents an Agent that is a Person or an Organisation other than the current entity (w.r.t. data protection laws).
subclass of: Class
  union of: Organisation
  union of: Person
equivalent class: ThirdParty

Data Structuring
type: Class
comment: Represents the type of processing where Structuring of data takes place.
subclass of: Processing

Minor Data Subject
type: Class
comment: A Minor is a Data Subject who cannot provide their own consent (that is legally valid). Therefore, their consent must be obtained via a Guardian or Legal Representative or Parent. Minor is a subclass of Data Subject. Consent given in lieu of a Minor (by their Representative) is associated with the `ConsentInstance` class/instance using the `wasGivenBy` property. The ontology currently does not capture this relationship between the Minor and their Representative. This is due to required clarifications regarding how this role should be represented. For example, the `DataSubject` cannot be subclassed to create a `Representative` class, as this would make the `DataSubject` a permanent representative for the Minor. Instead, the role of 'acting as representative' is only for the instance of the given consent. Therefore, this could be represented with a `ConsentRepresentativeRole` class that links to the `MinorDataSubject` with `roleHadDataSubject` property, and the `DataSubject` that gave the consent via the `roleHadRepresentative` property. The relationship or reason or situation of this given consent can be captured by further annotating the `ConsentRepresentativeRole` instance. This approach can also be extended to other similar situations where one `DataSubject` gives consent in lieu of another. Note: A Minor can provide their own consent in certain cases, or conversely, a minor's consent may need to be provided by a 'parental' representative in some cases.
subclass of: DataSubject
subclass of: Data Subject

Invalidated
type: Status invalid for Processing
type: Status
type: NamedIndividual
comment: Indicates the consent has been invalidated.

is previous consent for
type: IrreflexiveProperty
type: ObjectProperty
comment: Denotes that this consent instance is the previous consent for the specified consent instance.
domain: Consent
range: Consent
sub property of: wasInfluencedBy
inverse of: is updated consent for

Status invalid for Processing
type: Class
comment: Represents consent states that are invalid for processing.
subclass of: Status
disjoint with: Status valid for Processing

has consent
type: InverseFunctionalProperty
type: ObjectProperty
comment: Links a data subject to their consent.
domain: Data Subject
range: Consent
inverse of: is consent for data subject

Data Alteration
type: Class
comment: Represents the type of processing where Alteration of data takes place.
subclass of: Processing

Consent
type: Class
comment: As per Article 4(11) of the GDPR, ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her; In the case of this ontology, 'Consent' is a concept as well as a tangible entity (something that has a provenance record). To separate this distinction with relation to the data subject, the Consent class represents the consent of the data subject in its entirely, including any history and annotations for it. To link the `Consent` instance with the `DataSubject` instance, use the `isConsentForDataSubject` and `hasConsent` properties.
subclass of: Entity
subclass of: Restriction
  on class: Data Subject
  on property: is consent for data subject
  qualified cardinality: 1
subclass of: Restriction
  on class: Status
  on property: has status
  qualified cardinality: 1

Sharing of Personal Data
type: Processing
type: Data Sharing
type: NamedIndividual
comment: Represents sharing of personal data

was provided consent
type: IrreflexiveProperty
type: AsymmetricProperty
type: ObjectProperty
comment: Indicates that the specified Person or Data Controller was provided the associated consent.
domain: Class
  union of: Person
  union of: Data Controller
range: Consent

Data Sharing
type: Class
comment: Type of processing where sharing of data takes place with a Third Party.
subclass of: Processing

Retrieval Of Personal Data
type: Processing
type: Data Retrieval
type: NamedIndividual
comment: Represents Retrieval Of personal data.

Data Subject
type: Class
comment: Data Subject is defined as an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; - according to Article 4(1) of the GDPR pertaining to the definition of Personal Data. In the case of this ontology, a Data Subject refers to the person(s) as per the definition of the GDPR. Since a Data Subject is a Person, it is defined as a subclass of foaf:Person. The Data Subject is linked to the Consent instance via the isConsentForDataSubject and hasConsent properties.
subclass of: Person
equivalent class: DataSubject

is provided to person
type: IrreflexiveProperty
type: AsymmetricProperty
type: InverseFunctionalProperty
type: ObjectProperty
comment: Indicates the Person the consent was provided to.
domain: Consent
range: Person
sub property of: is provided to

is association for
type: ObjectProperty
comment: Indicates an Association is for the associated Purpose or Processing.
domain: Association
range: Class
  union of: Processing
  union of: Purpose

is personal data for consent
type: ObjectProperty
comment: Links personal data with the consent it is associated with.
domain: Personal Data
range: Consent

is updated consent for
type: IrreflexiveProperty
type: ObjectProperty
comment: Specifies the consent instance which this instance is an update or revision of.
domain: Consent
range: Consent
sub property of: wasInfluencedBy

at location
type: ObjectProperty
comment: Specifies the location at which the consent was given.
domain: Consent
range: Location
sub property of: has context
sub property of: atLocation

Expired
type: Status invalid for Processing
type: Status
type: NamedIndividual
comment: Indicates the consent has expired.

Data Alignment
type: Class
comment: Represents the type of processing where Alignment of data takes place.
subclass of: Processing

is provided to
type: IrreflexiveProperty
type: AsymmetricProperty
type: InverseFunctionalProperty
type: ObjectProperty
comment: Indicates the Person or Data Controller the consent was provided to.
domain: Consent
range: Class
  union of: Person
  union of: Data Controller
inverse of: was provided consent

Adaptation Of Personal Data
type: Processing
type: Data Adaptation
type: NamedIndividual
comment: Represents Adaptation Of personal data.

Data Adaptation
type: Class
comment: Represents the type of processing where Adaptation of data takes place.
subclass of: Processing

Destruction Of Personal Data
type: Processing
type: Data Destruction
type: NamedIndividual
comment: Represents Destruction Of personal data.

Consultation Of Personal Data
type: Processing
type: Data Consultation
type: NamedIndividual
comment: Represents Consultation Of personal data.

Data Erasure
type: Class
comment: Represents the type of processing where Erasure of data takes place.
subclass of: Processing

Data Disclosure by Transmission
type: Class
comment: Represents the type of processing where Disclosure by Transmission of data takes place.
subclass of: Processing

Explicitly Given
type: Status valid for Processing
type: Status
type: NamedIndividual
comment: Indicates consent is explicitly given.

Processing
type: Class
comment: Processing is defined by the GDPR (Article 4-2) as "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;". Processing can be considered as the action, within an activity for example, that uses data in a particular or specific way. Therefore, processing specifies what is happening to/with the data. To define a type of processing (or its associated action), the Processing class should be subclassed for each type. Furthermore, each subclass should define a instance as a generic representative of that action. For example, "collect" as a type of processing (defined by the GDPR), is defined as the class DataCollection, which is a subclass of Processing, and has the individual CollectionOfPersonalData to represent a generic instance of the concept. This is to provide a ready-to-use ontology in terms of "collect" as an action, while also providing a way to specialise the action/processing. GConsent defines several such types of processing taken from the text of the GDPR.

Data Consultation
type: Class
comment: Represents the type of processing where Consultation of data takes place.
subclass of: Processing

Data Destruction
type: Class
comment: Represents the type of processing where Destruction of data takes place.
subclass of: Processing