[RFC] Add a "Rights" category with additional elements

[pichot]

Context

Jurisdictions around the world are passing legislation encoding individuals’ rights in relationship to data collecting technologies in public space.

Examples of such legislation include:

• The European Union’s data protection legal framework, under which the General Data Protection Regulation (GDPR) is defined, as well as Regulation (EU) 2018/1725, defining the role of the Data Protection Officer (DPO) and constituents’ rights to the support of these public officials.
• Portland, Oregon’s Surveillance Technologies Policy that requires the city to maintain a public inventory of all such technologies deployed in public space.

Problem

DTPR does not provide a structured way to document an individuals rights in relation to the described technology, nor a clear description of how one might exercise those rights. As digital transparency policies mature around the world, people’s rights will become more codified, with specific definitions, defined mechanisms to engage with regulators, and exercise ones rights to transparency, rectification, and contestation. For DTPR to continue to be relevant as a tool of public transparency of digital transparency, including a section on Rights is fundamentally necessary.

Proposal

Add a new category named Rights as well as a number of new elements within this category. These elements should be applicable to both the current use case of describing data collection in public space, as well as future use cases, including describing AI models and algorithms.

See the open, existing conversation of adapting DTPR to describe AI models here: #228

Proposed Datachain

The current DTPR datachain should be adjusted to include a Rights category. This category should come after Processing, and be represented by a square icon.

Category	Question	Icon
Accountability	Who is accountable for this technology?	hexagon
Purpose	What is the purpose of this technology?	hexagon
Technology	What type of technology is this?	hexagon
Data Type	What type of data is being collected?	circle
Processing	How will this data be processed?	circle
Rights	What rights do you have in relation to this technology?	square
Access	Who can access this data?	square
Storage	How is this data stored?	square

Proposed Elements to add to Rights category

A number of new elements should be added. Here is a list of candidates to be included in the first version. Note that icons would still need to be designed for all of these.

Element	Description
Right to Notice	The right to be informed with clear signage or other notifications in public spaces where data collection is occurring.
Right to Transparency	The right to be informed about what data is being collected, how it's being used, and for what purpose.
Right to Access	The right to request and receive ones personal data that has been collected through these technologies.
Right to Purpose Limitation	The right to ensure data collected for one purpose isn't later used for other unrelated purposes without consent.
Right to Rectification	The right to correct inaccurate personal data collected in public spaces, particularly when this data informs decisions that affect ones rights or legal interests.
Right to Opt-out	The right to opt-out to certain types of data collection and processing in public spaces, particularly when it involves automated decision-making or profiling. While complete opt-out may not always be possible in public spaces, individuals can have the right to choose whether their data is used to inform decision making.
Right to Contest	The right to contest decisions made by automated systems using data collected in public spaces.