Software systems that share potentially sensitive data are subjected to laws, regulations, policies and/or contracts. The monitoring, control and enforcement processes applied to these systems are currently to a large extent manual, which we rather automate by embedding the processes as dedicated and adaptable software services in order to improve efficiency and effectiveness. This approach requires such regulatory services to be closely aligned with a formal description of the relevant norms.This paper presents eflint, a domain-specific language developed for formalizing norms. The theoretical foundations of the language are found in transition systems and in Hohfeld's framework of legal fundamental conceptions. The language can be used to formalize norms from a large variety of sources. The resulting specifications are executable and support several forms of reasoning such as automatic case assessment, manual exploration and simulation. Moreover, the specifications can be used to develop regulatory services for several types of monitoring, control and enforcement. The language is evaluated through a case study formalizing articles 6(1)(a) and 16 of the General Data Protection Regulation (GDPR). A prototype implementation of eflint is discussed and is available online.

No abstract

The combination of smart contracts with blockchain technology enables the authentication of the contract and limits the risks of non-compliance. In principle, smart contracts can be processed more efficiently compared to traditional paper-based contracts. However, current smart contracts have very limited capabilities with respect to normative representations, making them too distant from actual contracts. In order to reduce this gap, the paper presents an architectural analysis to see the role of computational artifacts in terms of various ex-ante and ex-post enforcement mechanisms. The proposed framework is assessed using scenarios concerning data-sharing operations bound by legal requirements from the General Data Protection Regulation (GDPR) and data-sharing agreements.