Queryable Provenance Metadata For GDPR Compliance

2. Personal Data

Validity of Consent

Have you reviewed your organisation’s mechanisms for collecting consent to ensure that it is freely given, specific, informed and that it is a clear indication that an individual has chosen to agree to the processing of their data by way of statement or a clear affirmative action?

P1. consent collection

SELECT DISTINCT ?step ?terms ?template ?givenConsent {
  ?step a gdprov:ConsentAcquisitionStep .
  ?template a gdprov:ConsentAgreementTemplate .
  ?terms a gdprov:TermsAndConditions .
  ?givenConsent a gdprov:ConsentAgreement .
  ?step gdprov:usesConsentAgreementTemplate ?template .
  ?step gdprov:usesTermsAndConditions ?terms .
  ?step gdprov:generatesConsentAgreement ?givenConsent .
} ORDER BY ?step

Retrospective Consent

If personal data that you currently hold on the basis of consent does not meet the required standard under the GDPR, have you re-sought the individual’s consent to ensure compliance with the GDPR?

Demonstration of Consent

Are procedures in place to demonstrate that an individual has consented to their data being processed?

P3. show consent

SELECT DISTINCT ?step ?action ?consent where {
  ?consent a gdprov:ConsentAgreement .
  ?StepType rdfs:subClassOf gdprov:ConsentStep .
  ?step a ?StepType .
  ?step ?action ?consent.
  FILTER(regex(str(?action), "http://purl.org/adaptcentre/openscience/ontologies/gdprov#")) .
} ORDER BY ?step ?consent

Withdraw consent for processing

Are procedures in place to allow an individual to withdraw their consent to the processing of their personal data?

P4. withdraw consent

SELECT DISTINCT ?step ?process ?action ?item where {
  ?step a gdprov:ConsentWithdrawalStep .
  OPTIONAL {
    ?process a gdprov:Process .
    ?step gdprov:isPartOfProcess ?process .
  }
  OPTIONAL {
    ?step ?action ?item .
  }
  FILTER(regex(str(?action), "http://purl.org/adaptcentre/openscience/ontologies/gdprov#")) .
} ORDER BY ?step ?action

Children's Personal Data

Where online services are provided to a child, are procedures in place to verify age and get consent of a parent/ legal guardian, where required?

P5. age verification

SELECT DISTINCT ?step ?StepType where {
  ?StepType rdfs:subClassOf gdprov:ConsentAgeVerificationStep .
  ?step a ?StepType .
} ORDER BY ?step

Legitimate interest based data processing

If legitimate interest is a legal basis on which personal data is processed, has an appropriate analysis been carried out to ensure that the use of this legal basis is appropriate? That analysis must demonstrate that 1) there is a valid legitimate interest, 2) the data processing is strictly necessary in pursuit of the legitimate interest, and 3) the processing is not prejudicial to or overridden by the rights of the individual.

P6. legitimate interest for processing

SELECT DISTINCT ?step ?process ?action ?item where {
  ?data a ?data_type .
  ?data_type rdfs:subClassOf gdprov:PersonalData .
  ?step a ?step_type .
  ?step_type rdfs:subClassOf gdprov:DataStep .
  ?step gdprov:usesData ?data . 
  ?step gdprov:isPartOfProcess ?process .
  ?step ?action ?item .
  ?step gdprov:hasLegalBasis gdprtext:LegitimateInterest .
  FILTER(regex(str(?action), "http://purl.org/adaptcentre/openscience/ontologies/gdprov#")) .
} ORDER BY ?process ?actions

3. Data Subject Rights

Subject Access Requests (SARs)

Is there a documented policy/procedure for handling Subject Access Requests (SARs)?

R1. SAR

SELECT DISTINCT ?process where {
  ?process a gdprov:HandleSAR .
} ORDER BY ?process

Subject Access Requests (SARs) Response Time

Is your organisation able to respond to SARs within one month?

Data Portability

Are procedures in place to provide individuals with their personal data in a structured, commonly used and machine readable format?

R3. portable data format

SELECT DISTINCT ?data ?format where {
  ?process a gdprov:HandleRightOfDataPortability .
  ?step gdprov:isPartOfProcess ?process .
  ?step gdprov:generatesData ?data .
  ?data dct:format ?format .
} ORDER BY ?data

Deletion and Rectification

Are there controls and procedures in place to allow personal data to be deleted or rectified (where applicable)?

R4. data deletion

SELECT DISTINCT ?process where {
  {
    ?process a gdprov:HandleRightOfErasure .
  }
  UNION
  {
    ?process a gdprov:HandleRightToRectification .
  }
} ORDER BY ?process

Right to restriction of processing

Are there controls and procedures in place to halt the processing of personal data where an individual has on valid grounds sought the restriction of processing?

Right to object to processing

Are individuals told about their right to object to certain types of processing such as direct marketing or where the legal basis of the processing is legitimate interests or necessary for a task carried out in the public interest?

Halt processing after right to object

Are there controls and procedures in place to halt the processing of personal data where an individual has objected to the processing?

R7. right to object

SELECT DISTINCT ?process where {
  ?process a gdprov:HandleRightToObjectProcessing .
} ORDER BY ?process

Profiling and automated processing

If automated decision making, which has a legal or significant similar affect for an individual, is based on consent, has explicit consent been collected?

R8. automated processing

SELECT DISTINCT ?step ?process where {
  ?step a gdprov:AutomatedStep .
  ?step gdprov:isPartOfProcess ?process .
  ?process gdprov:hasLegalBasis gdprtext:GivenConsent .
} ORDER BY ?step ?process

Right to obtain human intervention

Where an automated decision is made which is necessary for entering into, or performance of, a contract, or based on the explicit consent of an individual, are procedures in place to facilitate an individual’s right to obtain human intervention and to contest the decision?

R9. automated steps

SELECT DISTINCT ?step ?process ?legal where {
  ?step a gdprov:AutomatedStep .
  ?step gdprov:isPartOfProcess ?process .
  ?process gdprov:hasLegalBasis ?legal .
  FILTER(?legal IN (gdprtext:ContractWithDataSubject, gdprtext:GivenConsent) ) .
} ORDER BY ?step

Restrictions to data subject rights

Have the circumstances been documented in which an individual’s data protection rights may be lawfully restricted? Note: the Irish Data Protection Bill will set out further details on the implementation of Article 23.

5. Transparency requirements

Transparency to customers and employees

Are service users/employees fully informed of how you use their data in a concise, transparent, intelligible and easily accessible form using clear and plain language?

Provide Information listed in Article 13

Where personal data is collected directly from the individuals, are procedures in place to provide the information listed at Article 13 of the GDPR?

T2. data collection

SELECT DISTINCT ?step ?data where {
  ?step a gdprov:DataCollectionStep .
  ?step gdprov:collectsData ?data .
} ORDER BY ?step

Provide Information listed in Article 14

If personal data is not collected from the subject but from a third party (e.g. acquired as part of a merger) are procedures in place to provide the information listed at Article 14 of the GDPR?

T3. third party collection

SELECT DISTINCT ?agent ?thirdparty ?step  where {
  ?step a gdprov:DataCollectionStep .
  ?step gdprov:collectsDataFromAgent ?agent .
  BIND(EXISTS { ?agent a gdprov:ThirdParty } as ?thirdparty ) .
} ORDER BY ?agent ?step

Provide information when engaging

Provide information on facilitating rights

Is information on how the organisation facilitates individuals exercising their GDPR rights published in an easily accessible and readable format?

7. Data Security

Risks involved in processing data

Have you assessed the risks involved in processing personal data and put measures in place to mitigate against them?

S1. processing data

SELECT DISTINCT ?data ?step where {
  ?StepType rdfs:subClassOf gdprov:DataStep .
  ?step a ?StepType .
  ?DataType rdfs:subClassOf gdprov:PersonalData .
  ?data a ?DataType .
  ?step gdprov:usesData ?data .
} ORDER BY ?data

Documented Security Program

Is there a documented security programme that specifies the technical, administrative and physical safeguards for personal data?

Resolving security related issues

Is there a documented process for resolving security related complaints and issues?

Designated individual for security

Is there a designated individual who is responsible for preventing and investigating security breaches?

Encryption

Are industry standard encryption technologies employed for transferring, storing, and receiving individuals' sensitive personal information?

Removing information

Is personal information systematically destroyed, erased, or anonymised when it is no longer legally required to be retained.

Restoring access

Can access to personal data be restored in a timely manner in the event of a physical or technical incident?

8. Data Breaches

Documented incident plans

Does the organisation have a documented privacy and security incident response plan?

B1. data breach plan

SELECT DISTINCT ?process ?step where {
  ?process a ?BreachProcess .
  FILTER(?BreachProcess IN (gdprov:HandleDataBreachProcess, gdprov:ReportDataBreach) ) .
  ?step gdprov:isPartOfProcess ?process .
} ORDER BY ?process

Regular reviews

Are plans and procedures regularly reviewed?

Notifying authorities

Are there procedures in place to notify the office of the Data Protection Commissioner of a data breach?

B3. notify DPC

SELECT DISTINCT ?process where {
  ?process a gdprov:ReportDataBreach .
} ORDER BY ?process

Notifying data subjects

Are there procedures in place to notify data subjects of a data breach (where applicable)?

B4. notify Data Subjects

SELECT DISTINCT ?process where {
  ?process a gdprov:ReportDataBreach .
} ORDER BY ?process

Documentation of data breaches

Are all data breaches fully documented?

Co-operation procedures for data breach

Co-operation procedures for data breach

9. International Data Transfers (outside EEA)

Data transfer outside EEA

Is personal data transferred outside the EEA, e.g. to the US or other countries?

I1. data transfer

SELECT DISTINCT ?step ?region ?location where {
  ?step a gdprov:DataTransferStep .
  OPTIONAL {
    ?step gdprov:transfersDataToRegion ?region .
    ?region this:location ?location .
  }
} ORDER BY ?step ?region

Special category of Personal Data in Transfer

Does this include any special categories of personal data?

I2. transfer special data

ASK {
  ?step a gdprov:DataTransferStep .
  ?step ?_ ?data .
  ?data a ?DataType .
  ?DataType rdfs:subClassOf gdprov:SensitiveData .
}

Purpose of Transfer

What is the purpose(s) of the transfer?

I3. transfer purpose

select DISTINCT ?step ?comment {
  ?step a gdprov:DataTransferStep .
  ?step rdfs:comment ?comment .
} ORDER BY ?step

Transfer Recipients

Who is the transfer to?

I4. transfer agent

SELECT DISTINCT ?step ?entity ?EntityType {
  ?step a gdprov:DataTransferStep .
  OPTIONAL {
    ?step ?action ?entity .
    ?entity a ?EntityType .
    ?EntityType rdfs:subClassOf* prov:Agent .
  }
} ORDER BY ?step ?entity