Draft Convention 108+ DPV extension

[smartopian]

Dear DPV CG,

I have been working on a DPV extension for convention 108+ which is substantively similar to GDPR template, but with some key differences to Address

1. Scope: Convention 108+ is treaty (55+ jurisdictions), not regional regulation
2. Normative Framework: ISO/IEC 27560-1 references Convention 108+, not GDPR
3. Transparency Architecture: Article 8.2 enables bilateral notice receipts (ANCR/MVCR)
4. Public Infrastructure: Registry and logging requirements from 2018/1725 operational model
5. Cross-Border Coordination: "Commonwealth Effect" requires explicit transfer framework

I have posted a draft Convention 108+ extension on the Transparency Lab github and welcome review or guidance.

[smartopian]

Here is a first DPV Integration Report for implementing GPC, MY Terms, and GPRC. - with recommendations and suggested roadmap etc, - which we are reviewing this week.

[coolharsh55]

Hi Mark. I checked the linked document (above) and its a large text document with many concepts and covers many topics. It also notes concepts as existing but which aren't present in DPV.

1. Can you please share (in brief, short, few sentences) what exactly you are proposing here? There's a large list of things in the document, so please suggest core ideas / prioritised topics.
2. Can you please share if this document has been generated using LLMs/GenAI? This is because I found a surprisingly high number of concepts that are indicated as existing in DPV but which do not exist either in our published or proposed vocabularies.

Additional questions from the topics:

• mapping of DPV to 27560 -- we already have this in our guidance for 27560 so what is missing or what additional work is being proposed?
• GPC signal expression via DPV -- see Represent Privacy Signals like GPC, ADPC, and others #410 which has a proposal regarding this
• MyTerms -- the existing 7012 extension aims to support the MyTerms implementation; is your proposal aligned/part of the MyTerms organisation or are you proposing an alternative implementation?

Currently, I worry that the proposal represents too many uncertain or incompatible things for DPVCG due to these questions and the risk of parallel work as these other groups are also working on similar efforts. Please note that work implementing normative sources (e.g. laws, standards) but in a different way cannot be put into the same extensions. E.g. your proposals for a different implementation of notice/consent/agreements should be treated as a separate proposal, even if it builds on top of existing work such as GDPR or 27560 or MyTerms.

My recommendation here is to have the work (with clear scope, definitions, mechanisms) published elsewhere in a way that represents stakeholder consensus (e.g. an ISO or Canadian standard, or Kantara report) or shows the research that led to this that, and to then propose DPVCG to work on that published document. In ISO, this is also my suggestion for you to propose revision/extension of 29184 as you are proposing a new (and better IMO) method for use of privacy notices, which will then be beneficial to folks from MyTerms or Solid.

[smartopian]

Hi Harsh, Thanks for the thoughtful response. This is for/towards a Convention 108+ legal model, which I discussed with you in 2018 as the focus of consent receipt based work. These concepts are specified in the proposed 27560-1 unr profile. Which is a Convention 108+ code of conduct for digital transparency by default. It is expressed as normative in reference to Convention 108+ being ratified by 33 countries so far. The international privacy standard. 5 countries left until this becomes enforced and formally normative. 27560-1 covers refers to 3 vectors of data governance- data protection which refers to existing 27569 (the base), co-regulation (27560-1) and proposes another profile (27560-2) for personal data control- applied for 6 legal basis with 4 levels of assurance - covering 72 privacy rights control contexts. MyTerms is relevant to 4 of those and can be implemented easily with (27560-1). Same with GPC. This input is for Convention 108+ legal model and its extension for rights based access controls. 27984 is superseded by Convention 108+ which is authoritative. Does this clear things up? Sent from [Proton Mail](https://proton.me/mail/home) for iOS.

…

-------- Original Message --------

On Monday, 02/02/26 at 09:28 Harshvardhan Pandit ***@***.***> wrote: coolharsh55 left a comment [(w3c/dpv#414)](#414 (comment)) Hi Mark. I checked the linked document (above) and its a large text document with many concepts and covers many topics. It also notes concepts as existing but which aren't present in DPV. - Can you please share (in brief, short, few sentences) what exactly you are proposing here? There's a large list of things in the document, so please suggest core ideas / prioritised topics. - Can you please share if this document has been generated using LLMs/GenAI? This is because I found a surprisingly high number of concepts that are indicated as existing in DPV but which do not exist either in our published or proposed vocabularies. Additional questions from the topics: - mapping of DPV to 27560 -- we already have this in our [guidance for 27560](https://w3id.org/dpv/guides/consent-27560) so what is missing or what additional work is being proposed? - GPC signal expression via DPV -- see [#410](#410) which has a proposal regarding this - MyTerms -- the existing 7012 extension aims to support the MyTerms implementation; is your proposal aligned/part of the MyTerms organisation or are you proposing an alternative implementation? Currently, I worry that the proposal represents too many uncertain or incompatible things for DPVCG due to these questions and the risk of parallel work as these other groups are also working on similar efforts. Please note that work implementing normative sources (e.g. laws, standards) but in a different way cannot be put into the same extensions. E.g. your proposals for a different implementation of notice/consent/agreements should be treated as a separate proposal, even if it builds on top of existing work such as GDPR or 27560 or MyTerms. My recommendation here is to have the work (with clear scope, definitions, mechanisms) published elsewhere in a way that represents stakeholder consensus (e.g. an ISO or Canadian standard, or Kantara report) or shows the research that led to this that, and to then propose DPVCG to work on that published document. In ISO, this is also my suggestion for you to propose revision/extension of 29184 as you are proposing a new (and better IMO) method for use of privacy notices, which will then be beneficial to folks from MyTerms or Solid. — Reply to this email directly, [view it on GitHub](#414 (comment)), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/ABR6VZ6MQ4DZNAPJCAGETXT4J5NIPAVCNFSM6AAAAACQH32AS6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTQMZVGQ3DGOJQHA). You are receiving this because you authored the thread.Message ID: ***@***.***>

[smartopian]

Dear Harsh, If you provide/point me to or even, get me started with your preferred legal model format and process, i am happy to work on this. Would it be appropriate for me to provide a proposal or brief introducing th topic of normative public transparency infrastructure specified to Convention 108+ legal model, is there a perferred format or break down? In addition, we just put up our new schedule, and Machine Readable Rights & Controls + Digital Public Transparency Policy, the two github topics are the focus, If you are up for some hands on guidance, we just posted schedule to discuss and work on related policy on Tuesdays between 2:30 and 5;30 CEST most weeks this year. All W3C DPV'rs are welcome (msg me and i will sen over the details)

…

On Tuesday, 3 February 2026 at 09:26, ***@***.*** ***@***.***> wrote: Hi Harsh, Thanks for the thoughtful response. This is for/towards a Convention 108+ legal model, which I discussed with you in 2018 as the focus of consent receipt based work. These concepts are specified in the proposed 27560-1 unr profile. Which is a Convention 108+ code of conduct for digital transparency by default. It is expressed as normative in reference to Convention 108+ being ratified by 33 countries so far. The international privacy standard. 5 countries left until this becomes enforced and formally normative. 27560-1 covers refers to 3 vectors of data governance- data protection which refers to existing 27569 (the base), co-regulation (27560-1) and proposes another profile (27560-2) for personal data control- applied for 6 legal basis with 4 levels of assurance - covering 72 privacy rights control contexts. MyTerms is relevant to 4 of those and can be implemented easily with (27560-1). Same with GPC. This input is for Convention 108+ legal model and its extension for rights based access controls. 27984 is superseded by Convention 108+ which is authoritative. Does this clear things up? Sent from [Proton Mail](https://proton.me/mail/home) for iOS. -------- Original Message -------- On Monday, 02/02/26 at 09:28 Harshvardhan Pandit ***@***.***> wrote: > coolharsh55 left a comment [(w3c/dpv#414)](#414 (comment)) > > Hi Mark. I checked the linked document (above) and its a large text document with many concepts and covers many topics. It also notes concepts as existing but which aren't present in DPV. > > - Can you please share (in brief, short, few sentences) what exactly you are proposing here? There's a large list of things in the document, so please suggest core ideas / prioritised topics. > - Can you please share if this document has been generated using LLMs/GenAI? This is because I found a surprisingly high number of concepts that are indicated as existing in DPV but which do not exist either in our published or proposed vocabularies. > > Additional questions from the topics: > > - mapping of DPV to 27560 -- we already have this in our [guidance for 27560](https://w3id.org/dpv/guides/consent-27560) so what is missing or what additional work is being proposed? > - GPC signal expression via DPV -- see [#410](#410) which has a proposal regarding this > - MyTerms -- the existing 7012 extension aims to support the MyTerms implementation; is your proposal aligned/part of the MyTerms organisation or are you proposing an alternative implementation? > > Currently, I worry that the proposal represents too many uncertain or incompatible things for DPVCG due to these questions and the risk of parallel work as these other groups are also working on similar efforts. Please note that work implementing normative sources (e.g. laws, standards) but in a different way cannot be put into the same extensions. E.g. your proposals for a different implementation of notice/consent/agreements should be treated as a separate proposal, even if it builds on top of existing work such as GDPR or 27560 or MyTerms. > > My recommendation here is to have the work (with clear scope, definitions, mechanisms) published elsewhere in a way that represents stakeholder consensus (e.g. an ISO or Canadian standard, or Kantara report) or shows the research that led to this that, and to then propose DPVCG to work on that published document. In ISO, this is also my suggestion for you to propose revision/extension of 29184 as you are proposing a new (and better IMO) method for use of privacy notices, which will then be beneficial to folks from MyTerms or Solid. > > — > Reply to this email directly, [view it on GitHub](#414 (comment)), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/ABR6VZ6MQ4DZNAPJCAGETXT4J5NIPAVCNFSM6AAAAACQH32AS6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTQMZVGQ3DGOJQHA). > You are receiving this because you authored the thread.Message ID: ***@***.***>

[coolharsh55]

Thanks for the explanations Mark. IMHO, my earlier recommendation to have this work be polished and published elsewhere would be beneficial for DPVCG to discuss how to support this further. This could be the theory/framework, a list of requirements, or even an implementation. This should be able to justify why this work should be adopted by the DPVCG e.g. its a standard, a law, a best practice, is supported by stakeholders, etc.

In terms of modelling COE 108+ (as it is, without introducing new interpretations) could be in the scope of this work if members agree. I will leave this issue open for this.

Please also note that proposals made using GenAI create extra work to understand and interpret, and affect how we prioritise work items. In this case, I'm assuming you have used GenAI due to what seems to be hallucinated concepts.

[smartopian]

HI Harsh, I a not sure what you mean by AI stuff. The standard works for any digital surveillance and processing, where its AI, or Digital ID, or CCTV. etc. So the AI example is pretty important as a conformant receipt provides clean-Ai data to people. As you are very well aware, i have shared and submitted this work with you consistently over the last 7 years, with 4 versions drafted previous to this Universal notice receipt specification (aka Consent receipt v2). All in all since 2014 over 35 versions of this work has been drafted and edited via Kanata ANCR. While I appreciate you think gen AI was used, i would appreciate the courtesy of your explanation as to why, and what you think might be a hallucination, in fact, i have a test suite (any use case is welcome) for being able to identify the legal basis, rights, derogations, obligations, delegations, derivative rights, and then to verify and validate the fields and machine readable DPV that comes out. To demonstrate the capacity for consistent digital public transparency infrastructure. Note: I did use generated AI for turtle, sample, which I posted when asking for guidance. I would like to test and verify any ORDL, RDF, Turltle etc. which is what i was hoping you would assist with. Perhaps we can set up a to meet on the topic?

…

On Wednesday, 4 February 2026 at 04:26, Harshvardhan Pandit ***@***.***> wrote: coolharsh55 left a comment [(w3c/dpv#414)](#414 (comment)) Thanks for the explanations Mark. IMHO, my earlier recommendation to have this work be polished and published elsewhere would be beneficial for DPVCG to discuss how to support this further. This could be the theory/framework, a list of requirements, or even an implementation. This should be able to justify why this work should be adopted by the DPVCG e.g. its a standard, a law, a best practice, is supported by stakeholders, etc. In terms of modelling COE 108+ (as it is, without introducing new interpretations) could be in the scope of this work if members agree. I will leave this issue open for this. Please also note that proposals made using GenAI create extra work to understand and interpret, and affect how we prioritise work items. In this case, I'm assuming you have used GenAI due to what seems to be hallucinated concepts. — Reply to this email directly, [view it on GitHub](#414 (comment)), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/ABR6VZ5H7CLXMRWZWMGNH534KG3MDAVCNFSM6AAAAACQH32AS6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTQNBWGMYDKMBYHA). You are receiving this because you authored the thread.Message ID: ***@***.***>