This section provides an introduction and overview of the concepts within the DPV-TECH extension, with the Section on Taxonomy providing a formal listing of all concepts.
The central or focal concept is dpv:Technology alongwith its use with the relation dpv:hasTechnology - as defined within [DPV]. This extension extends these concepts - by way of additional subtypes or subclasses or specialisations, and adds more concepts which are relevant to provide a description of technologies as they are utilised towards privacy and data protection.
The concept concepts provided in DPV-TECH include subtypes of dpv:Technology as DataTechnology, OperationalTechnology (as in relating to operations or processes), SecurityTechnology, IdentityTechnology, ManagementTechnology, and SurveillanceTechnology. These enable expression of the role of a particular technology within the context of personal data processing.
To indicate how technology was provided or is used, the concept TechnologyProvisionMethod and relation hasProvisionMethod are useful. It enables expression of where technology is used as a Product or Subscription (e.g. from a vendor), or as a System or a Component (e.g. standalone).
The concept CommunicationMechanism and relation hasCommunicationMechanism enables expressing how the technology communicates, such as by use of Internet, Cellular Networks, GPS, etc.
To indicate entities or actors associated with the Technology and their specific roles, the concept TechnologyActor and associated relations are useful.
To represent location of technology use, the existing DPV concepts related to location can be used, i.e. dpv:Location and dpv:hasLocation along with its various types and contextually relevant concepts. To explicitly refer to location as associated with use of technology, the concept TechnologyUsageLocation is provided. For example, to indicate that some technology (whose actual location is on a server) is used in an office. Some synonyms used to indicate usage location for similar information are: application, deployment, or operation.
To indicate the maturity of a technology, the concept TechnologyReadinessLevel and relation hasTRL are useful. This information can be based on standards, such as the ISO 16290:2013, or those provided by other bodies and domains.
Technologies that involve operating on data, such as to collect, store, use, share, and erase it - are defined as DataTechnology. Since their definition is based on interaction with data, their specific types and hierarchy mirror the dpv:Processing taxonomy. The shared name, such as with dpv:Store as processing operation and DataStorageTechnology as technology, indicates the correspondence between processing and the technology that performs it.
OperationalTechnology relates to the processes or operations that themselves do not relate directly to data, such as execution environments, devices, or other processes - that are necessary or relevant for processing data. This is differentiated from DataTechnology in that technology related to operations refers only to the implementation and execution whereas data technology would be focused on how it involves or processes data.
Specific types of operational technologies include OperationEnvironment, OperationDevice, and OperationManagement. The concept Application represents the program or application which is the operation, or contains or facilitates its execution.
SecurityTechnology refers to any technology whose purpose is to provide security whether directly (e.g. securing access) or indirectly (e.g. PETs, identifying vulnerabilities). Specific types of security technologies include PET (Privacy Enhancing Technologies), and the risk-based categorisation as DetectionSecurityTechnology that detects security issues and vulnerabilities, PreventionSecurityTechnology that provides prevention or avoidance of exploitation, MitigationSecurityTechnology that provides reduction or mitigation of effects, and MonitoringSecurityTechnology that provides oversight and observations for security issues such as attacks.
ManagementTechnology relates to managing or orchestrating or monitoring - such as the other technology types. It can also include purely managerial technologies such as dedicated control interfaces or dashboards or tools orchestrating processes. While there is some ambiguity regarding what management exactly means, this concept is provided for the benefit of use-cases where it needs to be explicitly shown that some management occurs or involves the use of technologies. For example, to include that access control (a security technology) is managed through use of a dedicated tool or algorithm (a management technology).
IdentityTechnology relates to technologies that are related to identity, identification, or identifiers. This includes their generation, verification, use in authentication, and management (e.g. by combining with ManagementTechnology).
In addition to these, a sixth additional broad concept of SurveillanceTechnology can also function as a category so as to explicitly acknowledge and represent technologies that have issues or warrant particular attention. Variants of surveillance include OvertSurveillanceTechnology and CovertSurveillanceTechnology.
The provision of technology can happen via the following methods:
- System, Component, and Algorithmic - that indicate whether the technology is provided as a system (e.g. stand alone), is intended to be used as a component in another system, or is algorithmic (e.g. implementation of a particular method).
- Service, Goods, Product, and Subscription - that provide an indication of whether the technology is service (e.g. implemented to function as a service), or is a product or a subscription (e.g. provided by a vendor).
- FixedUse indicates whether the technology has limitations of use e.g. specific number of application or single application, or those related to scale or scope. For example, a single use identifier or a one time scan for vulnerabilities.
Communication mediums or mechanism used by technology include:
- GPS or the location providing Global Positioning System or its equivalent technologies.
- Networking where any form of network based communication takes place.
- Specific networks as: WiFi for wireless, Bluetooth, LocalNetwork, CellularNetwork.
- Internet for indication of whether internet connectivity and communications are involved.
To specify the specific actors and their roles in the context of technologies, TechnologyActor is provided along with the following specific roles as its subtypes:
- TechnologyDeveloper and hasDeveloper specifies who develops or has developed the technology.
- TechnologyProvider and hasProvider specifies who provides the technology. This could be the same entity as developer, or a different one - such as when the technology is repackaged or modified before provision.
- TechnologyUser and hasUser specifies who uses or is the user for the technology. Note that while this refers to users in the technical sense of the term, such users may or may not be data subjects. For example, a technology used by an immigration officer has that officer as the user, rather than the immigrating person. To be more explicit, technology user and whom the technology is used on are two different criterias. See distinction below.
- TechnologySubject and hasSubject is the subject of the technology i.e. whom the technology is used on or subjected to. This may be directly (e.g. person within a CCTV camera's vision) or indirectly (e.g. person whose details were used as training data). What is considered a subject may be contextually dependant on the nature and scope of the technology as well as its application. In the future, we may separate this concept for further distinction between direct and indirect subjects (or use alternate terms) - if such categorisation is deemed beneficial in the description of individuals subjected to technologies.
Note, that the technology actor concepts are based on the EU's proposal for AI reguation (i.e. AI ACT) and its corresponding concepts (e.g. AI Provider, AI Developer). Rather than limiting such concepts for "AI", we have expanded upon their intended meaning to encompass any technology. The concepts from the AI ACT can thus be modelled as subtypes of these.