---
id: "20261029-0234-outside-arxiv261037527-extending-the"
title: "Extending the W3C Data Privacy Vocabulary to Cover the German Health Data Use Act - Lessons Learned"
type: "capture"
status: "promoted"
origin: "batch"
promoted_to: ["30-notes/claim-gdng-set-into-force-march-2024-anticipates-ehds.md","30-notes/claim-dpvcg-governance-process-for-new-dpv-legal-extensions.md","30-notes/claim-gdng-dpv-extension-p-prefixed-iri-scheme-for-german-paragraph-structure.md","30-notes/claim-gdng-dpv-extension-54-terms-draft-with-dpv-2-3-release.md","40-entities/entity-harshvardhan-j-pandit.md","40-entities/entity-data-privacy-vocabulary.md","40-entities/entity-gdng.md","40-entities/entity-ehds.md"]
not_promoted: ["GDNG §8 WHO-registry/publication obligation not yet modeled by the DPV extension — folded as supporting detail into claim-gdng-dpv-extension-54-terms-draft-with-dpv-2-3-release.md rather than given its own note; no verbatim quote recorded in the capture's further-leads entry for independent claim status beyond what's already folded in.","Three distinct SecondaryUse concepts coexist across sector-health/GDNG/EHDS extensions to avoid conflating jurisdiction-specific meanings — a genuinely distinct, interesting design claim, but the capture's further-leads entry carries no source_quote, so it cannot clear the Tier-1 quote-provenance floor as a standalone promoted claim; left as an inbox lead for a future direct re-read.","Authors tried the EC's machine-translation tool on the German-only GDNG text, found it unsatisfactory, fell back to manual translation reviewed by native speakers and DPVCG experts (reportedly DPV's first extension for a law with no official English text) — no verbatim quote recorded; left as a lead, not promoted.","Technical production pipeline (Google Sheets → CSV → RDF → Jinja2 HTML, automatable via GitHub Actions) — procedural/implementation detail without a verbatim quote and without independent truth-value worth a permanent note; left as a lead.","Worked ODRL policy example (Figure 2, X-ray-image transfer permission citing GDNG §6(1)2/§6(3)) — illustrative only, explicitly 'not independently evaluated' by the capture against other ODRL/DPV use cases, and no verbatim quote recorded; left as a lead. ODRL itself stays an unpromoted mention, not an entity page, on this single passing reference.","DPV's 2018 origin and 2019 OTM-conference formalization by Pandit et al., and DPV's existing GDPR/Data Governance Act/AI Act extensions — background cited only to the paper's own reference list, explicitly 'not independently read this session'; folded as unverified background prose into entity-data-privacy-vocabulary.md and entity-harshvardhan-j-pandit.md rather than promoted as standalone claims.","DPVCG (Data Privacy Vocabularies and Controls Community Group) as its own org hub — declined under the stricter org-promotion bar: load-bearing to the governance-process claim, but a single-cluster first appearance in the vault with no second independent cluster yet; kept as a mention inside claim-dpvcg-governance-process-for-new-dpv-legal-extensions.md and entity-data-privacy-vocabulary.md rather than hubbed.","Co-author mentions (Julian Flake, Christian Draeger, Christian Henke, Alessandra S. Kuntz, Matthias Löbe) as individual entity hubs — declined per the 2026-10-01 co-authorship ruling; none has standing in this vault beyond co-writing this one paper. Kept as mentions in the relevant claim-notes' prose."]
writer_model: "claude-sonnet-5"
date_created: "2026-10-29T00:00:00.000Z"
provenance: "batch run 2026-10-29"
derived_from: []
tags: ["semantic-web","privacy","data-governance","health-data","legal-informatics","w3c","germany","outside"]
source_url: "https://arxiv.org/pdf/2610.37527"
source_sha: "530880f20edef85581dad3d81099501285591f6d6457a2e7909cdbed67ea23ae"
source_author: "Julian Flake; Christian Henke; Alessandra S. Kuntz; Matthias Löbe; Harshvardhan J. Pandit; Christian Draeger"
source_date: "2026-10-27T00:00:00.000Z"
source_title: "Extending the W3C Data Privacy Vocabulary to Cover the German Health Data Use Act - Lessons Learned"
source_venue: "arXiv:2610.37527 (cs.CY); also published as a refereed conference paper in Studies in Health Technology and Informatics (German Medical Data Sciences 2026 proceedings), IOS Press, doi:10.3233/SHTI261013, CC BY-NC 4.0"
source_tier: 1
seek_code_commit: "d40ee39"
---


A short (9-page) "lessons learned" paper by Julian Flake (Univ. of Koblenz, corresponding author), Christian Henke and Alessandra S. Kuntz (UMG Göttingen), Matthias Löbe and Christian Draeger (IMISE, Univ. of Leipzig), and Harshvardhan J. Pandit (Trinity College Dublin). It describes building a formal extension of the W3C [[Data Privacy Vocabulary]] (DPV) to represent Germany's Health Data Use Act (Gesundheitsdatennutzungsgesetz, GDNG). The PDF's own running header identifies it as a refereed paper in the *German Medical Data Sciences 2026* conference proceedings (Studies in Health Technology and Informatics series, IOS Press, DOI 10.3233/SHTI261013, CC BY-NC 4.0 Open Access) — the arXiv posting (submitted 27 Oct 2026) is the authors' self-archived copy of that published, peer-reviewed text, not an unrefereed preprint. Both the arXiv abstract page (archived, sha 4528736033237de72f37c28ffe33f7e8461bf1af2b238f4272d22ec7a93afa24) and the PDF (extracted via `extract_pdf`, `tls:"verified"`, sha 530880f20edef85581dad3d81099501285591f6d6457a2e7909cdbed67ea23ae) were fetched and read in full. No addressed-to-AI language, override language, tier self-assignment, credential requests, urgency framing, or other adversarial signals fired on either page — no `## Safety flags` section is needed for this capture.

## Claim: The German Health Data Use Act (GDNG) was set into force in March 2024 and functions as Germany's national legal foundation anticipating the future EU-level European Health Data Space (EHDS) regulation

Claim type: historical/definitional, with an embedded quantitative date. Source: the paper itself, Tier 1 (the authors' own account of the law they are formalizing), clearing the floor for both the date and the characterization.

The paper describes the GDNG as Germany's secondary-use health-data law, built to be compatible with the EHDS once that EU regulation takes effect, and reports that the authors scoped their vocabulary work to Article 1 of the law's six-article Federal Law Gazette publication (the nine sections, §1–§9, of the GDNG proper).

source_quote: "In this work, we present the creation of a DPV extension representing the German Health Data Use Act (Gesundheitsdatennutzungsgesetz (GDNG)) that has been set into force in March 2024."
source_url: https://arxiv.org/pdf/2610.37527
source_sha: 530880f20edef85581dad3d81099501285591f6d6457a2e7909cdbed67ea23ae
source_tier: 1

## Claim: Extending the DPV with a new national-law namespace follows a defined [[W3C]] community-group governance process: a formal request to the DPVCG mailing list, discussion at a weekly meeting, and — if accepted as in-scope — the group's own assignment of a namespace and prefix

Claim type: specific technical-mechanism (how the standardization process actually works, not merely that an extension exists). Source: the paper itself, Tier 1, clearing the floor.

The Data Privacy Vocabularies and Controls Community Group (DPVCG) is described as an open-governance body: anyone can propose a new legal-concept extension, but the DPVCG controls whether the topic is in scope and what namespace/prefix it is assigned. For GDNG this produced the namespace `/dpv/legal/de/gdng` and prefix `de-gdng`.

source_quote: "The process begins with a formal request submitted to the DPVCG, such as through the mailing list. This request is discussed in one of the weekly meetings, where it is evaluated whether the proposed topic falls within the scope of the DPV. If accepted, the DPVCG assigns a suitable namespace, in this case /dpv/legal/de/gdng, and a corresponding suggested prefix (de-gdng)."
source_url: https://arxiv.org/pdf/2610.37527
source_sha: 530880f20edef85581dad3d81099501285591f6d6457a2e7909cdbed67ea23ae
source_tier: 1

## Claim: The DPV's existing identifier convention for citing a legal sub-unit (e.g. "A6-1-b" for GDPR Article 6(1)(b)) does not transfer cleanly to German law, because German statutes use "Paragraph" (§) as their outermost textual unit rather than "Artikel" — forcing the GDNG extension to introduce a distinct "P"-prefixed IRI scheme (e.g. de-gdng:P6-3-Consent) alongside the existing "A"-prefixed one

Claim type: specific technical-mechanism (a concrete naming-scheme design decision and the legal-structural reason for it). Source: the paper itself, Tier 1, clearing the floor.

This is presented as one of the paper's named "lessons learned": the DPVCG's established IRI convention (built around EU regulations' "Article"-based structure) assumed a direct cross-jurisdiction fit that German law's "Paragraph"-based structure broke, which "led to confusion while discussing the regulation with the DPVCG in English" and had to be resolved by introducing a new prefix pattern specific to this extension.

source_quote: "In Germany, the outermost unit of text inside a regulation is typically called \"Paragraph\" rather than \"Artikel\". Therefore, the IRIs in GDNG extension that refer to a certain paragraph start with a \"P\" and not with an \"A\" as in the example de-gdng:P6-3-Consent."
source_url: https://arxiv.org/pdf/2610.37527
source_sha: 530880f20edef85581dad3d81099501285591f6d6457a2e7909cdbed67ea23ae
source_tier: 1

## Claim: The GDNG extension, covering 54 identified terms, was released as a draft alongside DPV version 2.3 (published 25 February 2026)

Claim type: quantitative (a specific term count, version number, and release date). Source: the paper itself, Tier 1, clearing the floor.

The 54-term count describes the GDNG extension specifically (documented in bilingual German/English HTML built from the same underlying RDF); the paper states this extension, together with a parallel EHDS extension and a shared "sector-health" extension, shipped as drafts in the same DPV 2.3 release.

source_quote: "All extensions were released as draft extensions with the latest DPV version 2.3, released 25th of February 2026."
source_url: https://arxiv.org/pdf/2610.37527
source_sha: 530880f20edef85581dad3d81099501285591f6d6457a2e7909cdbed67ea23ae
source_tier: 1

source_quote_2: "we decided to create two human-readable documents, one for each language, containing the same amount of information about the 54 identified terms"
source_url_2: https://arxiv.org/pdf/2610.37527
source_sha_2: 530880f20edef85581dad3d81099501285591f6d6457a2e7909cdbed67ea23ae
source_tier: 1

> [!note] Seek's commentary
> This is a methods/standards "lessons learned" paper about the plumbing of legal interoperability, not a paper with a dramatic empirical result — its most interesting content is procedural (how a semantic-web standards body absorbs a national law it wasn't designed around) rather than a number worth stress-testing. The IRI-naming-mismatch claim is the closest thing to a genuine finding here: it's a small, concrete illustration of how an ontology convention built for one jurisdiction's legal structure (EU "Articles") silently encodes an assumption that breaks on contact with a different jurisdiction's structure (German "Paragraphs"), which is a more general point about standards built on an unexamined single-jurisdiction model.

## Further leads

- GDNG §8 imposes an obligation — registering health-data research projects in a WHO primary-registry network and publishing results — that the DPV extension explicitly does not yet model ("there is currently no concept that captures the exact registration or publication obligations laid down by the GDNG"); flagged by the authors as the reason the extension stays in draft. — source: arXiv:2610.37527 (PDF), §4.2.
- Three distinct "SecondaryUse" concepts deliberately coexist across the sector-health, GDNG, and EHDS DPV extensions (general health-sector, GDNG-specific, EHDS-specific), explicitly to avoid conflating what "secondary use" legally means in each separate regulation. — source: arXiv:2610.37527 (PDF), §4.1 and Figure 1.
- The authors tried the European Commission's free machine-translation tool on the German-only GDNG legal text first, found the output unsatisfying for legal use, and fell back to manual translation reviewed by native-English speakers plus DPVCG legal/technical experts — this was reportedly the first DPV extension for a law with no official English text. — source: arXiv:2610.37527 (PDF), §5 ("Lessons learned").
- Technical production pipeline: Google Sheets (concept tracking) → per-sheet CSV export → RDF (Turtle, JSON-LD) → HTML documentation via Jinja2 templating, described as automatable (e.g. via GitHub Actions). — source: arXiv:2610.37527 (PDF), §4.1.
- A worked [[ODRL]] policy example (Figure 2) expresses a permission for an X-ray-image transfer between a named university clinic and institute, citing specific GDNG paragraphs (§6(1)2, §6(3)) via the new DPV terms — illustrative of the mechanism but not independently evaluated against other ODRL/DPV use cases in this session. — source: arXiv:2610.37527 (PDF), §4.2 and Figure 2.
- DPV itself originated in 2018 and was formalized in a 2019 OTM Conferences paper by Pandit et al., "Creating a Vocabulary for Data Privacy" (doi:10.1007/978-3-030-33246-4_44); existing DPV extensions already cover GDPR, the EU Data Governance Act, and the EU AI Act. — source: arXiv:2610.37527 (PDF), §1.1–2.1 and reference [4] (not independently read this session).

## Entity candidates

- Harshvardhan J. Pandit — person — the FOUNDATIONAL figure this whole paper measures itself against: original creator of the [[Data Privacy Vocabulary]] (Pandit et al. 2019, "Creating a Vocabulary for Data Privacy," OTM 2019 Conferences), the standard this GDNG work extends; he is also a co-author of this specific paper, which is the known blind spot — his deeper, earlier priority claim (creating DPV itself) is easy to miss if he's read only as "one of six co-authors here."
- Julian Flake — person — corresponding author; Institute for Software Technology, University of Koblenz.
- Christian Draeger — person — co-author; concept lead on GDNG term extraction, IMISE, University of Leipzig.
- Christian Henke — person — co-author; UMG Göttingen, led ODRL application work.
- Alessandra S. Kuntz — person — co-author; UMG Göttingen.
- Matthias Löbe — person — co-author; IMISE, University of Leipzig.
- Data Privacy Vocabularies and Controls Community Group (DPVCG) — concept/organization — the W3C community group governing DPV's open-standardization process; its weekly-meeting/mailing-list request process is the mechanism this capture's second claim rests on.
- Data Privacy Vocabulary (DPV) — concept/term — the semantic-web vocabulary standard being extended; candidate for its own concept note given how load-bearing it is as the common infrastructure across GDPR, AI Act, EHDS, and now GDNG extensions.
- GDNG (Gesundheitsdatennutzungsgesetz / German Health Data Use Act) — concept/term — the German law being formalized.
- EHDS (European Health Data Space) — concept/term — the EU-level regulation GDNG is designed to anticipate and align with.
- ODRL (Open Digital Rights Language) — concept/term — W3C Recommendation used alongside DPV to express machine-readable data-use permissions; the paper's worked example.