Extending the W3C Data Privacy Vocabulary to Cover the German Health Data Use Act - Lessons Learned

semantic-webprivacydata-governancehealth-datalegal-informaticsw3cgermanyoutside

A short (9-page) "lessons learned" paper by Julian Flake (Univ. of Koblenz, corresponding author), Christian Henke and Alessandra S. Kuntz (UMG Göttingen), Matthias Löbe and Christian Draeger (IMISE, Univ. of Leipzig), and Harshvardhan J. Pandit (Trinity College Dublin). It describes building a formal extension of the W3C Data Privacy Vocabulary (DPV) to represent Germany's Health Data Use Act (Gesundheitsdatennutzungsgesetz, GDNG). The PDF's own running header identifies it as a refereed paper in the German Medical Data Sciences 2026 conference proceedings (Studies in Health Technology and Informatics series, IOS Press, DOI 10.3233/SHTI261013, CC BY-NC 4.0 Open Access) — the arXiv posting (submitted 27 Oct 2026) is the authors' self-archived copy of that published, peer-reviewed text, not an unrefereed preprint. Both the arXiv abstract page (archived, sha 4528736033237de72f37c28ffe33f7e8461bf1af2b238f4272d22ec7a93afa24) and the PDF (extracted via extract_pdf, tls:"verified", sha 530880f20edef85581dad3d81099501285591f6d6457a2e7909cdbed67ea23ae) were fetched and read in full. No addressed-to-AI language, override language, tier self-assignment, credential requests, urgency framing, or other adversarial signals fired on either page — no ## Safety flags section is needed for this capture.

Claim: The German Health Data Use Act (GDNG) was set into force in March 2024 and functions as Germany's national legal foundation anticipating the future EU-level European Health Data Space (EHDS) regulation

Claim type: historical/definitional, with an embedded quantitative date. Source: the paper itself, Tier 1 (the authors' own account of the law they are formalizing), clearing the floor for both the date and the characterization.

The paper describes the GDNG as Germany's secondary-use health-data law, built to be compatible with the EHDS once that EU regulation takes effect, and reports that the authors scoped their vocabulary work to Article 1 of the law's six-article Federal Law Gazette publication (the nine sections, §1–§9, of the GDNG proper).

source_quote: "In this work, we present the creation of a DPV extension representing the German Health Data Use Act (Gesundheitsdatennutzungsgesetz (GDNG)) that has been set into force in March 2024." source_url: https://arxiv.org/pdf/2610.37527 source_sha: 530880f20edef85581dad3d81099501285591f6d6457a2e7909cdbed67ea23ae source_tier: 1

Claim: Extending the DPV with a new national-law namespace follows a defined W3C community-group governance process: a formal request to the DPVCG mailing list, discussion at a weekly meeting, and — if accepted as in-scope — the group's own assignment of a namespace and prefix

Claim type: specific technical-mechanism (how the standardization process actually works, not merely that an extension exists). Source: the paper itself, Tier 1, clearing the floor.

The Data Privacy Vocabularies and Controls Community Group (DPVCG) is described as an open-governance body: anyone can propose a new legal-concept extension, but the DPVCG controls whether the topic is in scope and what namespace/prefix it is assigned. For GDNG this produced the namespace /dpv/legal/de/gdng and prefix de-gdng.

source_quote: "The process begins with a formal request submitted to the DPVCG, such as through the mailing list. This request is discussed in one of the weekly meetings, where it is evaluated whether the proposed topic falls within the scope of the DPV. If accepted, the DPVCG assigns a suitable namespace, in this case /dpv/legal/de/gdng, and a corresponding suggested prefix (de-gdng)." source_url: https://arxiv.org/pdf/2610.37527 source_sha: 530880f20edef85581dad3d81099501285591f6d6457a2e7909cdbed67ea23ae source_tier: 1

Claim: The DPV's existing identifier convention for citing a legal sub-unit (e.g. "A6-1-b" for GDPR Article 6(1)(b)) does not transfer cleanly to German law, because German statutes use "Paragraph" (§) as their outermost textual unit rather than "Artikel" — forcing the GDNG extension to introduce a distinct "P"-prefixed IRI scheme (e.g. de-gdng:P6-3-Consent) alongside the existing "A"-prefixed one

Claim type: specific technical-mechanism (a concrete naming-scheme design decision and the legal-structural reason for it). Source: the paper itself, Tier 1, clearing the floor.

This is presented as one of the paper's named "lessons learned": the DPVCG's established IRI convention (built around EU regulations' "Article"-based structure) assumed a direct cross-jurisdiction fit that German law's "Paragraph"-based structure broke, which "led to confusion while discussing the regulation with the DPVCG in English" and had to be resolved by introducing a new prefix pattern specific to this extension.

source_quote: "In Germany, the outermost unit of text inside a regulation is typically called "Paragraph" rather than "Artikel". Therefore, the IRIs in GDNG extension that refer to a certain paragraph start with a "P" and not with an "A" as in the example de-gdng:P6-3-Consent." source_url: https://arxiv.org/pdf/2610.37527 source_sha: 530880f20edef85581dad3d81099501285591f6d6457a2e7909cdbed67ea23ae source_tier: 1

Claim: The GDNG extension, covering 54 identified terms, was released as a draft alongside DPV version 2.3 (published 25 February 2026)

Claim type: quantitative (a specific term count, version number, and release date). Source: the paper itself, Tier 1, clearing the floor.

The 54-term count describes the GDNG extension specifically (documented in bilingual German/English HTML built from the same underlying RDF); the paper states this extension, together with a parallel EHDS extension and a shared "sector-health" extension, shipped as drafts in the same DPV 2.3 release.

source_quote: "All extensions were released as draft extensions with the latest DPV version 2.3, released 25th of February 2026." source_url: https://arxiv.org/pdf/2610.37527 source_sha: 530880f20edef85581dad3d81099501285591f6d6457a2e7909cdbed67ea23ae source_tier: 1

source_quote_2: "we decided to create two human-readable documents, one for each language, containing the same amount of information about the 54 identified terms" source_url_2: https://arxiv.org/pdf/2610.37527 source_sha_2: 530880f20edef85581dad3d81099501285591f6d6457a2e7909cdbed67ea23ae source_tier: 1

Further leads

• GDNG §8 imposes an obligation — registering health-data research projects in a WHO primary-registry network and publishing results — that the DPV extension explicitly does not yet model ("there is currently no concept that captures the exact registration or publication obligations laid down by the GDNG"); flagged by the authors as the reason the extension stays in draft. — source: arXiv:2610.37527 (PDF), §4.2.
• Three distinct "SecondaryUse" concepts deliberately coexist across the sector-health, GDNG, and EHDS DPV extensions (general health-sector, GDNG-specific, EHDS-specific), explicitly to avoid conflating what "secondary use" legally means in each separate regulation. — source: arXiv:2610.37527 (PDF), §4.1 and Figure 1.
• The authors tried the European Commission's free machine-translation tool on the German-only GDNG legal text first, found the output unsatisfying for legal use, and fell back to manual translation reviewed by native-English speakers plus DPVCG legal/technical experts — this was reportedly the first DPV extension for a law with no official English text. — source: arXiv:2610.37527 (PDF), §5 ("Lessons learned").
• Technical production pipeline: Google Sheets (concept tracking) → per-sheet CSV export → RDF (Turtle, JSON-LD) → HTML documentation via Jinja2 templating, described as automatable (e.g. via GitHub Actions). — source: arXiv:2610.37527 (PDF), §4.1.
• A worked ODRL policy example (Figure 2) expresses a permission for an X-ray-image transfer between a named university clinic and institute, citing specific GDNG paragraphs (§6(1)2, §6(3)) via the new DPV terms — illustrative of the mechanism but not independently evaluated against other ODRL/DPV use cases in this session. — source: arXiv:2610.37527 (PDF), §4.2 and Figure 2.
• DPV itself originated in 2018 and was formalized in a 2019 OTM Conferences paper by Pandit et al., "Creating a Vocabulary for Data Privacy" (doi:10.1007/978-3-030-33246-4_44); existing DPV extensions already cover GDPR, the EU Data Governance Act, and the EU AI Act. — source: arXiv:2610.37527 (PDF), §1.1–2.1 and reference [4] (not independently read this session).

Entity candidates

• Harshvardhan J. Pandit — person — the FOUNDATIONAL figure this whole paper measures itself against: original creator of the Data Privacy Vocabulary (Pandit et al. 2019, "Creating a Vocabulary for Data Privacy," OTM 2019 Conferences), the standard this GDNG work extends; he is also a co-author of this specific paper, which is the known blind spot — his deeper, earlier priority claim (creating DPV itself) is easy to miss if he's read only as "one of six co-authors here."
• Julian Flake — person — corresponding author; Institute for Software Technology, University of Koblenz.
• Christian Draeger — person — co-author; concept lead on GDNG term extraction, IMISE, University of Leipzig.
• Christian Henke — person — co-author; UMG Göttingen, led ODRL application work.
• Alessandra S. Kuntz — person — co-author; UMG Göttingen.
• Matthias Löbe — person — co-author; IMISE, University of Leipzig.
• Data Privacy Vocabularies and Controls Community Group (DPVCG) — concept/organization — the W3C community group governing DPV's open-standardization process; its weekly-meeting/mailing-list request process is the mechanism this capture's second claim rests on.
• Data Privacy Vocabulary (DPV) — concept/term — the semantic-web vocabulary standard being extended; candidate for its own concept note given how load-bearing it is as the common infrastructure across GDPR, AI Act, EHDS, and now GDNG extensions.
• GDNG (Gesundheitsdatennutzungsgesetz / German Health Data Use Act) — concept/term — the German law being formalized.
• EHDS (European Health Data Space) — concept/term — the EU-level regulation GDNG is designed to anticipate and align with.
• ODRL (Open Digital Rights Language) — concept/term — W3C Recommendation used alongside DPV to express machine-readable data-use permissions; the paper's worked example.