OntoROPA Deliverable 1. State of the Art and Ambition.

Abstract

OntoROPA is a project proposal to facilitate smart privacy legal compliance using technology capable of providing semantics, intelligence, and trust. This is an innovative proposal for the targeted marketplace—i.e. the legal compliance marketplace— since there are no solutions capable of simultaneously providing the three properties mentioned. OntoROPA deals with the creation and maintenance of a critical piece of legal compliance required by the GDPR, the Records of Processing Activities (ROPA). OntoROPA pursues genuine regulatory compliance, with full meaning and legal validity. To this end, the ability to certify registrations, ROPAs, and to validate them are fundamental elements. In short, to prove that the ROPAs are true and that they meet all requirements that the GDPR requires. This is also generating legal evidence. OntoROPA ambition is to innovate in legal compliance checking and monitoring, bootstrapping blockchain technology to show that it can also be used for privacy compliance in the new LawTech market. Innovation in legal compliance will be achieved by providing legal value to digital artifacts and procedures created to comply with legal data protection requirements at regional, national and European level. This is something that current tools in the legal compliance market do not provide. Blockchain technology has been put under question by privacy experts, drafters, and rulers because its distributed nature is not entirely compatible with GDPR requirements. OntoROPA will provide to blockchain technology the way to address the issues that have been raised and to remove the technical and legal obstacles. In addition, doing so, it will create a specific market niche, generating a secure and trustworthy legal ecosystem with economic value. OntoROPA proposes the creation of a knowledge graph, a RDF graph, to handle information about ROPAs. It combines building a professional ontology that will be part of this graph with the collection and management of the specific knowledge of the community of privacy and data protection experts—mainly including lawyers, legal advisors and scholars, data protection officers, and rulers who are proficient in the creation and manipulation of ROPAs. This will trigger the future implementation of other procedures capable of inferring new knowledge from the available one. Certification and trusthworthiness are included as requirements in the very first phases of its design. Blockchain based solutions will be included and headed towards this aim.

OntoROPA can benefit from the ONTOCHAIN projects providing innovative and usable methodologies for the following purposes : (i) Certification of the genesis and origins of a ROPA; (ii) validation; (iii) proof of proactivity; (iv) identity management; (v) management of semantics; (vi) and smart community support. Synergies with other ONTOCHAIN projects are detailed in section 4. There may be more projects with which such a collaboration is possible. The criteria we followed to elaborate this section is to highlight the projects with whom we started planning an effective cooperation. In section 5 we present the conclusions achieved at this time slot of project development.