Privacy Metadata Ontology

FLOW ALGEBRA

Ontology: Privacy Metadata Ontology
Domain: Metadata Ontologies > Security Metadata
Canonical URL: https://kirethresearch.org/booksai-core/ontologies/metadata-ontologies/security-metadata/privacy-metadata-ontology.html
Authors: Mark Anthony Higgins — Sky (Recursive AI)

flow "PrivacyMetadataOntology" v1.0

# ---------- DOMAIN ----------
domain:
  class: MetadataOntology
  category: SecurityMetadata
  subject: PrivacyMetadata
  purpose:
    - represent privacy properties, personal-data processing, purposes, restrictions, retention, disclosure, and provenance
    - preserve data-subject, controller, processor, processing activity, purpose, basis, consent, recipient, retention, and protection context
    - support privacy governance, minimisation, purpose limitation, deletion, anonymisation, pseudonymisation, auditing, and compliance reasoning
    - distinguish privacy metadata from security metadata while preserving relationships
    - enable machine-readable reasoning over privacy lifecycles

# ---------- CORE ----------
entity PrivacyMetadata:
  type: SecurityMetadata
  describes: PrivacyRelevantResource
  may_include:
    - privacy_identifier
    - resource_identifier
    - data_subject
    - personal_data_category
    - sensitivity
    - controller
    - processor
    - processing_activity
    - purpose
    - processing_basis
    - consent
    - recipients
    - disclosure
    - retention
    - deletion
    - anonymisation
    - pseudonymisation
    - transfer
    - privacy_risk
    - rights_state
    - policy
    - validity
    - confidence
    - provenance

entity PrivacyRelevantResource:
  type: DataResource

entity PrivacyIdentifier:
  type: Identifier
  identifies: PrivacyMetadata

relationships:
  PrivacyMetadata -> DESCRIBES -> PrivacyRelevantResource
  PrivacyRelevantResource -> MAY_CONCERN -> DataSubject
  ProcessingActivity -> PROCESSES -> PrivacyRelevantResource
  ProcessingActivity -> HAS_PURPOSE -> ProcessingPurpose
  ProcessingActivity -> MAY_HAVE_BASIS -> ProcessingBasis
  DataController -> DETERMINES -> ProcessingPurpose
  DataProcessor -> PROCESSES_FOR -> DataController
  PrivacyRelevantResource -> MAY_BE_DISCLOSED_TO -> DataRecipient
  PrivacyRelevantResource -> MAY_HAVE_RETENTION -> PrivacyRetentionMetadata
  PrivacyRelevantResource -> MAY_BE_PSEUDONYMISED_BY -> PseudonymisationMetadata
  PrivacyRelevantResource -> MAY_BE_ANONYMISED_BY -> AnonymisationMetadata
  PrivacyMetadata -> MAY_HAVE_PROVENANCE -> PrivacyProvenance

# ---------- PERSONAL DATA ----------
entity PersonalData:
  subtype_of: PrivacyRelevantResource

personal_data_categories:
  - identity_data
  - contact_data
  - account_data
  - financial_data
  - location_data
  - behavioural_data
  - communication_data
  - employment_data
  - education_data
  - device_data
  - online_identifier
  - biometric_data
  - health_related_data
  - other_sensitive_data

rule identifiability:
  direct identifier absence != guaranteed anonymity

# ---------- SUBJECT / CONTROLLER / PROCESSOR ----------
entity DataSubject:
  type: Agent

entity DataController:
  type: OrganizationOrAgent

entity DataProcessor:
  type: OrganizationOrAgent

rule controller:
  controller role != processor role

# ---------- PROCESSING ----------
entity ProcessingActivity:
  type: PrivacyEventOrProcess
  may_include:
    - activity_identifier
    - data_categories
    - data_subject_categories
    - purpose
    - processing_basis
    - controller
    - processor
    - recipients
    - systems
    - start_time
    - end_time
    - status

processing_operations:
  - collect
  - record
  - organise
  - structure
  - store
  - retrieve
  - consult
  - use
  - disclose
  - combine
  - analyse
  - profile
  - restrict
  - erase
  - destroy
  - anonymise
  - pseudonymise
  - transfer

rule processing:
  ProcessingActivity SHOULD preserve operation, purpose, scope, and responsible parties

# ---------- PURPOSE / BASIS ----------
entity ProcessingPurpose:
  type: PurposeMetadata
  may_include: [purpose_identifier, purpose_description, scope, valid_from, valid_until]

rule purpose_limitation:
  processing purpose SHOULD remain explicit and traceable

entity ProcessingBasis:
  type: PolicyOrLegalMetadata
  may_include: [basis_type, authority, scope, validity]

basis_types:
  - consent
  - contract
  - legal_obligation
  - vital_interest
  - public_task
  - legitimate_interest
  - organisational_policy
  - user_request
  - implementation_specific

rule basis:
  stated basis != proof processing is compliant

# ---------- CONSENT ----------
entity ConsentMetadata:
  type: PrivacyMetadata
  may_include: [consent_identifier, data_subject, purposes, data_categories, granted_time, withdrawn_time, expiry_time, method, evidence, status]

consent_status:
  - granted
  - withdrawn
  - expired
  - refused
  - pending
  - unknown

rule consent:
  consent applies only within recorded purpose, scope, and validity

rule withdrawn:
  withdrawn consent MUST NOT be treated as current consent

rule consent_basis:
  absence of consent != absence of every possible processing basis

# ---------- RETENTION / DISCLOSURE / TRANSFER ----------
entity DataRecipient:
  type: AgentOrOrganization

entity DisclosureEvent:
  type: PrivacyEvent
  may_include: [disclosure_identifier, source, recipient, data_scope, purpose, basis, disclosure_time, safeguards]

rule disclosure:
  disclosure SHOULD preserve recipient, purpose, scope, basis, and time

rule disclosure_access:
  prior disclosure != continuing access permission

entity PrivacyTransferMetadata:
  type: PrivacyMetadata
  may_include: [source_context, destination_context, recipient, data_scope, transfer_time, safeguards, policy]

entity PrivacyRetentionMetadata:
  type: LifecycleMetadata
  may_include: [retention_period, retain_until, purpose, policy, legal_hold, review_time]

rule retention:
  retention SHOULD be limited to applicable purpose and policy

# ---------- DELETION / TRANSFORMATION ----------
entity PrivacyDeletionEvent:
  type: PrivacyEvent
  may_include: [resource, deletion_scope, authority, reason, deletion_time, verification]

rule logical_deletion:
  logical deletion != verified physical erasure

entity PseudonymisationMetadata:
  type: PrivacyTransformationMetadata
  may_include: [source_resource, pseudonymised_resource, method, key_or_mapping_reference, reversibility_state, event_time]

rule pseudonymisation:
  pseudonymised data MAY remain personal data when re-identification remains reasonably possible

rule pseudonym:
  pseudonymisation != anonymisation

entity AnonymisationMetadata:
  type: PrivacyTransformationMetadata
  may_include: [source_resource, anonymised_resource, method, assessment, reidentification_risk, event_time]

rule anonymisation:
  anonymisation claim SHOULD preserve method and re-identification-risk assessment

rule anonymity:
  removal of obvious identifiers != guaranteed anonymisation

# ---------- RIGHTS / POLICY / RISK ----------
privacy_right_types:
  - access
  - rectification
  - erasure
  - restriction
  - objection
  - portability
  - consent_withdrawal

entity PrivacyPolicy:
  type: PolicyMetadata
  may_include: [policy_identifier, policy_version, scope, purposes, processing_rules, retention_rules, disclosure_rules, effective_from, effective_until]

rule policy:
  policy statement != evidence of actual compliance or enforcement

entity PrivacyRisk:
  type: RiskMetadata
  may_include: [identifiability_risk, reidentification_risk, disclosure_risk, linkage_risk, inference_risk, retention_risk, access_risk, impact, likelihood, risk_level, assessment_time]

entity PrivacyImpactAssessment:
  type: PrivacyAssessment
  may_include: [assessment_identifier, processing_activity, necessity, proportionality, risks, mitigations, residual_risk, assessment_time]

rule impact:
  privacy impact assessment != proof of compliant processing

# ---------- SECURITY RELATIONSHIP ----------
rule privacy_security:
  security controls MAY support privacy but security != privacy

rule encrypted_personal_data:
  encrypted personal data MAY remain personal data

entity PrivacyBreachMetadata:
  type: PrivacyEvent
  may_include: [breach_identifier, affected_data, affected_subjects, detection_time, breach_type, confidentiality_impact, integrity_impact, availability_impact, containment, notification_state]

rule breach:
  security incident != automatically privacy breach unless privacy-relevant data or rights are affected

# ---------- CONFIDENCE / PROVENANCE ----------
entity PrivacyConfidence:
  type: EpistemicMetadata
  range: [0.0, 1.0]

rule confidence_bounds:
  REQUIRE 0.0 <= confidence <= 1.0

entity PrivacyProvenance:
  type: ProvenanceMetadata
  may_include: [resource, data_subject_context, collection_source, processing_events, consent_events, disclosure_events, transfer_events, deletion_events, anonymisation_events, policy_versions, assessments]

rule provenance:
  PrivacyMetadata SHOULD preserve privacy-relevant lifecycle history

# ---------- VALIDATION ----------
validation:
  require:
    - identifiable_privacy_resource_or_processing_activity
  reject:
    - direct_identifier_absence_presented_as guaranteed_anonymity
    - pseudonymisation_presented_as anonymisation
    - encryption_presented_as removal_of_personal_data_status
    - withdrawn_consent_presented_as current_consent
    - consent_presented_as unlimited_processing_permission
    - policy_statement_presented_as compliance_evidence
    - logical_deletion_presented_as verified_physical_erasure
    - prior_disclosure_presented_as continuing_access_permission
    - security_presented_as complete_privacy
    - privacy_impact_assessment_presented_as proof_of_compliance

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE:
  "privacy metadata" ~= "metadata describing privacy-relevant data processing and controls"
  "consent metadata" ~= "metadata describing consent state, scope, purpose, and evidence"
  "pseudonymisation metadata" ~= "metadata describing replacement or separation of identifying information"
  "anonymisation metadata" ~= "metadata describing transformation intended to prevent identification"

  PRESERVE distinctions:
    privacy != security
    controller != processor
    purpose != processing_basis
    consent != unlimited_permission
    pseudonymisation != anonymisation
    encrypted_personal_data != non_personal_data
    logical_deletion != verified_erasure
    policy != compliance
    assessment != proof_of_compliance
    security_incident != automatically_privacy_breach

# ---------- CONFIDENCE ----------
CONFIDENCE:
  explicit_privacy_metadata:
    score: 1.00
  verified_processing_purpose_and_scope:
    score: 0.99
  explicit_current_consent_evidence:
    score: 0.99
  validated_anonymisation_assessment:
    score: 0.98
  verified_deletion_evidence:
    score: 0.98
  inferred_personal_data_classification:
    score: <= 0.85
  unknown_processing_basis:
    score: <= 0.55
  incomplete_privacy_provenance:
    score: <= 0.55
    action: preserve uncertainty

# ---------- UPDATE MODEL ----------
UPDATE_MODEL:
  on_data_collection:
    - identify PrivacyRelevantResource
    - classify personal-data categories
    - record purpose and processing basis
    - record controller and processor
    - initialise retention and provenance

  on_consent_change:
    - preserve prior consent state
    - record purpose and scope
    - record grant, withdrawal, refusal, or expiry
    - update validity and provenance

  on_processing:
    - identify ProcessingActivity
    - validate purpose and applicable basis
    - record data scope and recipients
    - enforce minimisation and restrictions where applicable
    - update provenance

  on_retention_expiry:
    - evaluate legal hold and policy
    - delete, anonymise, restrict, or review according_to policy
    - preserve resulting event evidence
    - update provenance

# ---------- FLOW HASH ----------
FLOW_HASH:
  inputs: [ontology, privacy_entities, relationships, purpose_rules, basis_rules, consent_rules, retention_rules, anonymisation_rules, validation, semantic_equivalence, confidence, update_model]
  canonicalisation:
    - preserve_privacy_identifiers
    - preserve_resource_and_subject_references
    - preserve_purpose_and_basis
    - preserve_consent_history
    - preserve_processing_event_order
    - preserve_disclosure_and_transfer_history
    - preserve_rule_order
  output: deterministic_semantic_hash

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION:
  interpret_as:
    - security-related privacy metadata ontology
    - personal-data processing and governance model
    - consent, purpose, basis, retention, disclosure, and rights structure
    - anonymisation, pseudonymisation, risk, and provenance model

  operations:
    - identify privacy-relevant resources
    - classify personal-data categories
    - resolve subjects, controllers, and processors
    - inspect processing activities
    - resolve purposes and processing bases
    - inspect consent state and scope
    - inspect recipients, disclosures, and transfers
    - evaluate retention and deletion
    - distinguish pseudonymisation and anonymisation
    - assess privacy risk
    - trace provenance
    - preserve uncertainty

  constraints:
    - do_not_equate_privacy_with security
    - do_not_equate_pseudonymisation_with anonymisation
    - do_not_equate_encryption_with removal_of_personal_data_status
    - do_not_equate_consent_with unlimited_permission
    - do_not_treat_withdrawn_consent_as current
    - do_not_equate_policy_with compliance
    - preserve_subject_purpose_basis_consent_retention_disclosure_and_provenance

# ---------- QUERY MODEL ----------
query:
  input: [privacy_identifier, resource_identifier, data_subject_identifier, personal_data_category, processing_activity_identifier, purpose_identifier, consent_identifier, retention_state, assessment_time]
  resolve:
    1. identify PrivacyRelevantResource
    2. resolve data-subject context and categories
    3. resolve controller, processor, and ProcessingActivity
    4. inspect purpose and processing basis
    5. inspect consent and validity
    6. inspect recipients, disclosure, and transfer
    7. inspect retention, deletion, pseudonymisation, and anonymisation
    8. inspect policy and risk
    9. trace provenance and confidence
    10. return privacy state

# ---------- INFERENCE ----------
inference:
  IF data can reasonably relate to an identifiable subject
  THEN classify as personal-data candidate
  subject_to context and applicable definitions

  IF consent is withdrawn or expired
  THEN do_not treat consent as current processing basis

  IF data is pseudonymised
  THEN do_not infer anonymised state automatically

  IF anonymisation evidence is incomplete
  THEN preserve re-identification uncertainty
  AND reduce confidence

# ---------- OUTPUT CONTRACT ----------
output:
  ontology_entity: PrivacyMetadata
  privacy_resource: machine_interpretable
  personal_data_categories: explicit
  data_subject_context: privacy_preserving
  controller_processor: distinguishable
  processing_purpose_basis: explicit
  consent: scope_and_validity_aware
  disclosures_and_transfers: traceable
  retention_and_deletion: policy_aware
  pseudonymisation_anonymisation: distinguishable
  privacy_risk: reportable
  provenance: preserved
  uncertainty: explicit
  privacy_reasoning: enabled

end flow