Overview of Concepts
This section provides an introduction and overview of the concepts within the DPV-TECH extension, with the Section on Taxonomy providing a formal listing of all concepts.
The central or focal concept is `dpv:Technology` alongwith its use with the relation `dpv:hasTechnology` - as defined within [[DPV]]. This extension extends these concepts - by way of additional subtypes or subclasses or specialisations, and adds more concepts which are relevant to provide a description of technologies as they are utilised towards privacy and data protection.
Core Concepts
The concept concepts provided in DPV-TECH include subtypes of `dpv:Technology` as [=DataTechnology=], [=OperationalTechnology=] (as in relating to operations or processes), [=SecurityTechnology=], [=IdentityTechnology=], [=ManagementTechnology=], and [=SurveillanceTechnology=]. These enable expression of the role of a particular technology within the context of personal data processing.
To indicate how technology was provided or is used, the concept [=TechnologyProvisionMethod=] and relation [=hasProvisionMethod=] are useful. It enables expression of where technology is used as a Product or Subscription (e.g. from a vendor), or as a System or a Component (e.g. standalone).
The concept [=CommunicationMechanism=] and relation [=hasCommunicationMechanism=] enables expressing how the technology communicates, such as by use of Internet, Cellular Networks, GPS, etc.
To indicate entities or actors associated with the Technology and their specific roles, the concept [=TechnologyActor=] and associated relations are useful.
To represent location of technology use, the existing DPV concepts related to location can be used, i.e. `dpv:Location` and `dpv:hasLocation` along with its various types and contextually relevant concepts. To explicitly refer to location as associated with use of technology, the concept [=TechnologyUsageLocation=] is provided. For example, to indicate that some technology (whose actual location is on a server) is used in an office. Some synonyms used to indicate usage location for similar information are: application, deployment, or operation.
To indicate the maturity of a technology, the concept [=TechnologyReadinessLevel=] and relation [=hasTRL=] are useful. This information can be based on standards, such as the ISO 16290:2013, or those provided by other bodies and domains.
Types of Technologies
Data Technologies
Technologies that involve operating on data, such as to collect, store, use, share, and erase it - are defined as [=DataTechnology=]. Since their definition is based on interaction with data, their specific types and hierarchy mirror the `dpv:Processing` taxonomy. The shared name, such as with `dpv:Store` as processing operation and [=DataStorageTechnology=] as technology, indicates the correspondence between processing and the technology that performs it.
Operational Technologies
[=OperationalTechnology=] relates to the processes or operations that themselves do not relate directly to data, such as execution environments, devices, or other processes - that are necessary or relevant for processing data. This is differentiated from [=DataTechnology=] in that technology related to operations refers only to the implementation and execution whereas data technology would be focused on how it involves or processes data.
Specific types of operational technologies include [=OperationEnvironment=], [=OperationDevice=], and [=OperationManagement=]. The concept [=Application=] represents the program or application which is the operation, or contains or facilitates its execution.
Security Technologies
[=SecurityTechnology=] refers to any technology whose purpose is to provide security whether directly (e.g. securing access) or indirectly (e.g. PETs, identifying vulnerabilities). Specific types of security technologies include [=PET=] (Privacy Enhancing Technologies), and the risk-based categorisation as [=DetectionSecurityTechnology=] that detects security issues and vulnerabilities, [=PreventionSecurityTechnology=] that provides prevention or avoidance of exploitation, [=MitigationSecurityTechnology=] that provides reduction or mitigation of effects, and [=MonitoringSecurityTechnology=] that provides oversight and observations for security issues such as attacks.
Management Technologies
[=ManagementTechnology=] relates to managing or orchestrating or monitoring - such as the other technology types. It can also include purely managerial technologies such as dedicated control interfaces or dashboards or tools orchestrating processes. While there is some ambiguity regarding what management exactly means, this concept is provided for the benefit of use-cases where it needs to be explicitly shown that some management occurs or involves the use of technologies. For example, to include that access control (a security technology) is managed through use of a dedicated tool or algorithm (a management technology).
Identity Technologies
[=IdentityTechnology=] relates to technologies that are related to identity, identification, or identifiers. This includes their generation, verification, use in authentication, and management (e.g. by combining with [=ManagementTechnology=]).
Surveillance Technologies
In addition to these, a sixth additional broad concept of [=SurveillanceTechnology=] can also function as a category so as to explicitly acknowledge and represent technologies that have issues or warrant particular attention. Variants of surveillance include [=OvertSurveillanceTechnology=] and [=CovertSurveillanceTechnology=].
Provision of Technology
The provision of technology can happen via the following methods:
- [=System=], [=Component=], and [=Algorithmic=] - that indicate whether the technology is provided as a system (e.g. stand alone), is intended to be used as a component in another system, or is algorithmic (e.g. implementation of a particular method).
- [=Service=], [=Goods=], [=Product=], and [=Subscription=] - that provide an indication of whether the technology is service (e.g. implemented to function as a service), or is a product or a subscription (e.g. provided by a vendor).
- [=FixedUse=] indicates whether the technology has limitations of use e.g. specific number of application or single application, or those related to scale or scope. For example, a single use identifier or a one time scan for vulnerabilities.
Communication used by Technologies
Communication mediums or mechanism used by technology include:
- [=GPS=] or the location providing Global Positioning System or its equivalent technologies.
- [=Networking=] where any form of network based communication takes place.
- Specific networks as: [=WiFi=] for wireless, [=Bluetooth=], [=LocalNetwork=], [=CellularNetwork=].
- [=Internet=] for indication of whether internet connectivity and communications are involved.
Actors involved in Technologies
To specify the specific actors and their roles in the context of technologies, [=TechnologyActor=] is provided along with the following specific roles as its subtypes:
- [=TechnologyDeveloper=] and [=hasDeveloper=] specifies who develops or has developed the technology.
- [=TechnologyProvider=] and [=hasProvider=] specifies who provides the technology. This could be the same entity as developer, or a different one - such as when the technology is repackaged or modified before provision.
- [=TechnologyUser=] and [=hasUser=] specifies who uses or is the user for the technology. Note that while this refers to users in the technical sense of the term, such users may or may not be data subjects. For example, a technology used by an immigration officer has that officer as the user, rather than the immigrating person. To be more explicit, technology user and whom the technology is used on are two different criterias. See distinction below.
- [=TechnologySubject=] and [=hasSubject=] is the subject of the technology i.e. whom the technology is used on or subjected to. This may be directly (e.g. person within a CCTV camera's vision) or indirectly (e.g. person whose details were used as training data). What is considered a subject may be contextually dependant on the nature and scope of the technology as well as its application. In the future, we may separate this concept for further distinction between direct and indirect subjects (or use alternate terms) - if such categorisation is deemed beneficial in the description of individuals subjected to technologies.
Note, that the technology actor concepts are based on the EU's proposal for AI reguation (i.e. AI ACT) and its corresponding concepts (e.g. AI Provider, AI Developer). Rather than limiting such concepts for "AI", we have expanded upon their intended meaning to encompass any technology. The concepts from the AI ACT can thus be modelled as subtypes of these.