[Concept]: Add professional secrecy/confidentiality

[daniwelter]

Specs

Personal Data (PD)

New Concept(s)

We would like to request that professionally confidential data be added to the list of types of data and personal data, either through a new terms or extended definition of an existing term.

Term: dpv:ProfessionallyConfidentialData
Label: Professionally Confidential Data
Definition: Data protected by professional secrecy or confidentiality, including but not limited to data covered by legal professional privilege, data covered by doctor-patient confidentiality and other forms of recognised professional confidentiality
Parent term: dpv:ConfidentialData
Source: /
Usage note: /

Changed Concept(s)

Existing Term: e.g., dpv:NewConcept or risk:NewConcept
Change: e.g., change label from X to Y, or add usage note stating "xyz"
Justification: optional comment giving reasons why the change should be made

[coolharsh55]

Thanks @daniwelter - No objections to this proposal. Three key questions:

1. Is this a well defined or commonly used term? I couldn't find this term in a cursory search. There does seem to be "Professionally Privileged Information" for lawyers.
2. Is this term generic for all data or only personal data? Should it be in DPV or PD (personal data) extension? From the definition, it does seem to be only personal data?
3. Professional implications can also exist for sensitive and other data categories - where 'Professionally Sensitive Information' has a different meaning than confidential (e.g. doctor-patient comms are confidential, but prescriptions are also sensitive). Can we find a parent term for data affected by profession? If not, I think we discuss both these together.

[daniwelter]

Thanks for the quick response @coolharsh55.

• Re q1: I'm not sure whether professional secrecy is a commonly used term. The use case we're trying to address is capturing different types of protected data in the context of the Luxembourg national implementation of the European Data Governance Act. In this context, the law propose 4 categories of protected data, namely personal data, statistically confidential data, intellectual property and commercially confidential data, which explicitly includes business/trade secrets, professional confidentiality and company secrets. We believe that dpv:CommerciallyConfidentialData only addresses this last category partially, and in particular does not address professional confidentiality.
• Re q2+3: This term is generic for all data. Some data covered by professional confidentiality may be personal data, other data may not be personal but indeed be sensitive. The term we propose may therefore have multiple parent terms, e.g. the proposed dpv:ConfidentialData as well as dpv:SensitiveData and/or dpv:PersonalData.

[coolharsh55]

Hi. Thanks for the context and reference to DGA and Luxembourgish law, I now understand it better.

q1) I think we also looked at the DGA for that concept, but you are correct that its definition is not sufficient to represent those categories. From your description, I think the existing definition of dpv:CommerciallyConfidentialData should be expanded as "Data that is considered confidential in a commercial setting, such as due to business/trade secrets, professional confidentiality, and company secrets".

q2-3) GDPR Art.9-3 also has relevant description for above -

data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies

Based on these, I think we should accept your proposal, and have the following taxonomy:

• dpv:ConfidentialData (new) - Data that is considered confidential; parent: dpv:Data
• dpv:CommerciallyConfidentialData (existing) - Data that is considered confidentialdue to business/trade secrets, professional confidentiality, or company secrets; current parent: dpv:Data, new parent: dpv:ConfidentialData
• ProfessionalConfidentialData (new) - Data protected by professional secrecy or confidentiality, including but not limited to data covered by professional privilege or secrecy obligations such as that covered by lawyer or doctor-patient confidentiality and other forms of recognised professional confidentiality obligations; parent: dpv:CommerciallyConfidentialData

What do you think of these? Do they suit your purposes?

Separately, if you are modelling Luxembourgish laws - especially for DGA implementations - we can provide a supporting vocabulary where you can directly use concepts from that law. E.g. https://w3id.org/dpv/legal/lu is the page for Luxembourg, and we can create within this namespace the vocabulary for the DGA implementation e.g. https://w3id.org/dpv/legal/lu/dga (or whatever the name of that law will be). This is similar to how we model DGA extension in the EU namespace https://w3id.org/dpv/legal/eu/dga