Notice Types In DPV #277
Description
This comment is in reference to
"Note: Distinction between Privacy Notice and Consent Notice in particular DPV interpretation of GDPR is not proportionate to context of online notice, and uses brick and mortar data protection terms to describe online data processing permissions.
"In DPV, the concepts dpv:PrivacyNotice and dpv:ConsentNotice have different intended meanings - a consent notice is a specific privacy notice associated with consent, most commonly providing information in order to request consent. Whereas, a privacy notice can also refer to other documents providing information, such as what is commonly called as 'privacy policy'. For the purposes of the consent record, both documents can be included, but dpv:ConsentNotice MUST be used when referring to the notice used for providing information for consent."
There is easily a debate to be had that all notice, notifications, disclosures. (The three general categories of notice when read by an individual is read with the consent of the person, as it is not possible to force people to read notice. This is important in an Online notice context, where it can be assumed the individual is using the legal basis of consent to interact with online software and digital identification (security, tracking and surveillance technologies). Until the GDPR, notice and consent were combined in law. Even now, new regulations still refer to consent, to include notice as this has developed from human consent, into legal policy, with data protection law, where people physically provided explicit consent to a very specific notice.
The Online notice and consent standard 29184 - and 27560, focus is not physical, yet legal terms and contexts in DPV are specified with analogue privacy terms. In addition, regardless of the legal justification for surveillance, tracking, digital identification, or AI, a notice record can be used to provide a consent receipt, which (like in banking) can be used for a secondary purpose of use, with the legal basis of consent. All signs and types of notices can be captured and the use of the surveillance can be enabled with a consent receipt.
To this point - Consent notice - is a made up new term - which appears to be invented in DPV, the term \ Consent Notice is inaccurate, and does not take into the account that in democratic society, Notice (and surveillance / legitimate interest) signs are required. (which is the original research behind notice, transparency, and eventually consent This topic was the focus of my MSC in Surveillance Research, Published in a University Text book - taught in US, Canada and UK --> Towards a Framework of Contextual Integrity legality, trust and compliance of CCTV Signage) p 295
In addition, it does not provide for innovation in legal transparency, wherein a notified record of processing activitiy (a record of Notice) is required for all data processing activities, according to the legal justification. Whether it is an audit logged, notified to the Data Controller (or delegate) for example Airport Facial Recognition, or for Age Estimation Assurance, fraud, and the like.
A very similar set of problems occurred in the banking industry, prior to the common use of transaction receipts.The same issues of transparency were in banking system, lots of people ripped off constantly, with no-recourse, until the introduction of receipts. (for which there is no law mandating them)
This democratised and decentralised the governance of currency, enabling business to scale and innovate. People could return and exchange goods.
Recommendations:
- Clarify if online notice for consent or not
- Update notice types - online (or digital notice) - referring to the first instance or record of interaction capture - which is required to be the presentation of the Controller Identification - prior to processing activities. See the newly released for comment - ANCR - Transparency Performance Report - Valid Consent now posted for comments
- Notification, can be referred to any subsequent notice in a notified record of processing activity, or a Standard Online Notice Record.
- A Privacy or Security Risk Disclosure is required when risks are not mitigated in the context, for example crossword data transfers, transfers of data under different governance instruments, that are not adequate, and it is up for debate as to wether what is consider a privacy policy online - is actually a disclosure of practices
- These Categories can be further broken down, for example Notification Types, Privacy Statement, or Digital Privacy Statement, Visual Privacy Signal (from a trustmark) and or privacy broadcast, for those contexts where the collection of data is indirect, and public notice is required.