Towards Cataloguing Potential Derivations of Personal Data

Abstract

The General Data Protection Regulation (GDPR) has estab- lished transparency and accountability in the context of personal data usage and collection.While its obligations clearly apply to data explicitly obtained from data subjects, the situation is less clear for data derived from existing personal data. In this paper, we address this issue with an approach for identifying potential data derivations using a rule-based formalisation of examples documented in the literature using Semantic Web standards. Our approach is useful for identifying risks of potential data derivations from given data and provides a starting point towards an open catalogue to document known derivations for the privacy com- munity, but also for data controllers, in order to raise awareness in which sense their data collections could become problematic.