transparency-information-language/schema

The formal definition of a Transparency Information Language.

Transparency Information Language and Toolkit

With this proposed schema for transparency information with regards to data privacy, an essential step towards a sophisticated ecosystem shall be made by introducing a transparency enhancing toolkit based on a formal language model describing transparency information in the context of multi-service environments and latest legal requirements (EU General Data Protection Regulation). The desired results of the work should be suitable as ready-to-use privacy engineering solutions for developers and serve as a starting point for further research in this area. Eventually, data subjects should (be able to) understand what happens to data relating to them by using the interfaces of the toolkit.

Language definition

For the main language definition incl. an exemplary document, please see here. ⤴️
The valid exemplary document standalone.
An invalid exemplary document standalone.

Documentation

For a full documentation, please see here. ⤴️
A Markdown version is available here. ⤴️

Author

Elias Grünewald

License

MIT License

schema's Issues

Add domain as additional field for recipients

dataDisclosed.category should be an array

industry sector

e.g., as per UN classification

tiltv1 -> tiltv2 backwards compatibility possible?

Generate v2 documents out of v1 ones.

Split complete schema into separate files for better readability

joint controllership + processor role for all receivers

GitHub Action (CI pipeline) for linting and/or validating the syntax of the specification

Right to access and right to data portability

So far, we have:

• Access and data portability (both - was intended for Art. 15(2) and Art. 46, respectively; but actually I don't think it really happens in practice. It is simply covered in the third country transfers).

• Right to data portability (means Art. 20 scenario)

• Right to information (means Art. 15 scenario; should better be called right to access)

We can possibly deduplicate this.

Split right to rectification and deletion? (art. 16 + 17)

sources.sources in examples should be array

schema/tilt-schema.json

Line 150 in 0efa2f1

"url": "https://blueCompany.org",

schema/tilt-schema.json

Line 1640 in 0efa2f1

"url": "https://blueCompany.org",

schema/tilt-schema.json

Line 1692 in 0efa2f1

"url": "https://blueCompany.org",

Fixed categories for recipients

Standardize categories of recipients

Identified categories/industrial sectors: Consumer Services, Finance, Capital Goods, Energy, Health Care, Public Utilities, Technology, Consumer Durables, Consumer Non-Durables, Transport, Basic Industries, Miscellaneous

Source:
@Article{Wheatley_2016,
title={The extreme risk of personal data breaches and the erosion of privacy},
volume={89},
ISSN={1434-6036},
url={http://dx.doi.org/10.1140/epjb/e2015-60754-4},
DOI={10.1140/epjb/e2015-60754-4},
number={1},
journal={The European Physical Journal B},
publisher={Springer Science and Business Media LLC},
author={Wheatley, Spencer and Maillart, Thomas and Sornette, Didier},
year={2016},
month={Jan}
}

Add meta field

 "meta": {
    "_id": "f1424f86-ca0f-4f0c-9438-43cc00509931",
    "name": "Green Company",
    "created": "2020-04-03T15:53:05.929588",
    "modified": "2020-04-03T15:53:05.929588",
    "version": 2,
    "language": "de",
    "status": "active",
    "url": "https://green-bikes.de/privacy",
    "_hash": "be81d309088dde861ab5fc4d62d4bbfe0aeef3e3baf2f5362c1086f451f0a1e7"
  },

enhance all descriptions and quick start guide / interactive documentation / developer guide

GitHub Action (CI pipeline) for merging the specification

New validator including example fields

Finalize TILT split & reconstruct GH-Action

GH Action Doku

https://github.com/coveooss/json-schema-for-humans

Add v2-changelog to readme

Third Countries country categories?

Third country transfers only accept specifically mentioned countries.
(Problem arose at the manual transfer of a privacy policy into TIL with mentioned third country transfers where the countries weren't specified)

Unclear if this is a must-fix, but was instructed to mention it here.

Introduce domain array for controller

Example

"tilt wikimedia problem"

was machst du bei einer PP für verschiedene Service Provider?
Das ist mir bei Wikipedia aufgefallen - die Datenschutzerklärung stammt von Wikimedia und enthält eine Liste von Services (Wikipedia....) die davon betroffen sind. Ähnlich bei Google. Oder Amazon... mit .org/.com./... - da können die PPs gleich sein, müssen es aber nicht.

tilt-schema.json link needs to be updated

https://github.com/Transparency-Information-Language/schema/blob/master/documentation/markdown/tilt-schema-properties-meta.md

TILTv2 schema docu

Generate and deploy new documentation as in https://transparency-information-language.github.io/schema/index.html#meta

Data origin

Extend sources with enum of received, observed, inferred data.

(see also Syrmoudis et al. "Data Portability between Online Services")