Data Retention Requirements

オープン
  • 何か問題がありますか？
#685 コメント 3 件 リアクション 1 件 担当者 0 名 GitHub で見る

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
20/100
issue の種類
機能追加
明瞭さ
説明が足りない
活発さ
停滞
領域
api, data

調査の方向性

まず Requirements API と要件仕様を確認し、次に関連する issue #608 と #646 を読んで既存のコンテキストを把握します。この作業には、示されているエージェンシーおよびオペレーターのユースケースを網羅する、確定した保持モデルが必要であり、その結果としての動作を定義するために要件ドキュメントを更新する必要があります。

索引モデルが issue の本文から書いたものです。

説明

Policy privacy Requirements
Is your feature request related to a problem? Please describe.

With MDS 1.2 and the Requirements API, it is possible for the first time for Agencies to specify which data they need, and which data should not be shared. This is a major step forward for Data Minimization by allowing for the creation of best practices and example Requirements files that describe how to make minimal data requests for common use cases.

A related step I'd love to see MDS take is to describe data retention practices. This could cover some or all of the following capabilities:

  • Allowing Agencies to specify a minimum duration for data retained on operators' systems
  • Allowing Agencies to specify a maximum duration for data retained on their own (or a chosen aggregators') systems
  • Allowing operators to specify a maximum duration that they retain data and/or
  • Allowing Agencies to specify a maximum duration for data retained on operators' systems

These requirements could be expressed at the API, endpoint and perhaps even the field level. Here are some example use cases:

  • An agency specifies that they require status events to be retained by operators (ie queryable) for at least 6 months
  • An agency specifies that they will hold onto metrics data for up to five years, but will only hold onto disaggregate trip data for 1 month.
  • An agency interested in trying Geography Driven Events specifies that they will hold onto GDE event data for up to one year, and they will hold onto full event data for one month (to allow for the verification and evaluation of GDE data).

A note on aggregate data
My intention with this issue is to allow for explicit requirements around the retention of raw (particularly sensitive) data being delivered via MDS. This seemed like a good place to draw the line for now, but aggregate data can also sometimes be sensitive. It's an open, related question whether and how MDS might someday attempt to describe the retention of data that has been aggregated, analyzed etc.

Describe the solution you'd like

I'm imagining this as an extension to the Requirements API.

Is this a breaking change

Probably, insofar as it might allow for the creation of breaking requirements on operator implementations. Possibly this could be avoided with a conditional period, as we allowed for with Requirements in 1.2.

Impacted Spec

For which spec is this feature being requested?

  • requirements
Additional context

See also the #608 and #646.

主要言語
言語のデータがありません
スター
753
フォーク
255
30日以内にマージされた PR はありません

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

openmobilityfoundation/mobility-data-specification のほかの issue

openmobilityfoundation/mobility-data-specification の issue をすべて見る

似ている issue

Backend & API Design の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。