Specify collection method of personal data

[coolharsh55]

| Migrated ISSUE-39: How to represent collection method of personal data?

State: RAISED
Opened on: 2020-07-08

[coolharsh55]

IMO this is represented by the 'collect' processing concept, where one needs to specify what exactly that 'collect' activity means. For example, collect can mean download from a website, collect directly from data subject, etc. There is also another meaning that could be possible for 'collect', which is whether it was directly provided by data subject, indirectly obtained from elsewhere, observed from data subject, or inferred from other data. Whether all these satisfy 'collect' as a processing activity is up for discussion.

[mayaborges]

Data may also be originally created by the organisation that holds it. Examples: Doctor writing notes about treatment/health of a patient, school writing an assessment of a student, customer service rep jotting down their impression of a client.

[coolharsh55]

Good point. In this case, there may be no 'collection method', but 'generation method'. I've made note of this regarding specifying 'Data Source'. Thank you.

[coolharsh55]

DataSource is the concept that provides ability to express source of data. The collection method can be expressed through the type of processing operation. For data directly provided by the data subject, Collect with DataSubject as the data source. For data indirectly provided by data subject i.e. observed from their activities, Derive with DataSubject as the data source. For data inferred from some existing data, Infer with DataController (example) as data source.

In addition, new concepts have been proposed/added to have correlation between data sources, data categorisation, and processing operations. GeneratedPersonalData, DerivedPersonalData, and InferredPersonalData have corresponding processing operations as Generate, Derive, and Infer. This follows categorisation of data sources and operations from ISO/IEC 29184.

Although having a collection_method property might be more convenient, the model of DPV is based on legal argumentation where the processing operation, data source, and data categories are distinct. If needed in an use-case, they can be combined or obtained e.g. by considering CollectionMethod specified as Collect OR Derive OR Infer processing type with some DataSource.

[coolharsh55]

The above (using both DataSource + Processing) has been implemented. If there are no further actions on this discussions, I will mark it as resolved on OCT-15.