A GDPR International Transfer Compliance Framework Based on an Extended Data Privacy Vocabulary (DPV)

Abstract

This paper describes a tool using an extended Data Privacy Vocabulary (the DPV) to audit and monitor GDPR compliance of international transfers of personal data. New terms were identified which have been proposed as extensions to the DPV W3C Working Group. A prototype software tool was built based on the model plus a set of validation rules, and synthetic use-cases created to test the capabilities of the model and tool (together a compliance framework). This framework was created because the rules around international transfer compliance are complex and changing, there is an absence of a common approach to ensuring compliance, few tools exist to assist, and those that do lack interoperability. Evaluation results demonstrate that the proposed model improves compliance identification and standardisation. The tool received positive feedback from the data protection practitioners who participated in the evaluation, and an initial version of is now in use in one financial services organisation. While currently the tool only addresses international transfers, in theory the framework can be extended through further work to the broader area of compliance of other aspects of the GPDR.

Data Privacy Vocabulary (DPV) - Version 2

“…Year Mention Use Extension Contributed Domain [11] 2020 X Health [53] 2020 X Media [7,54,81] 2020 X [12,47,51,71] 2020 X [10] 2020 X Health [15,60,74] 2020 X X [17,55,29] 2021 X Health [37,6,76,62,39] 2021 X [72,20,16,73,52] 2021 X [34] 2021 X Smart products [42] 2021 X X [44,46,43,75,59,66,22] 2022 X [21] 2022 X X [69,70,57,23] 2022 X X [5] 2022 X Health [25,14,13,32,50] 2022 X [4] 2022 X IoT [40] 2022 X Health [58,…”

“…When it comes to extensions performed over DPV, most were contributed back to DPV to be integrated into DPVCG's outputs. Concerning work on GDPR requirements, there were proposed extensions focusing on consent [60,15], in particular related to the processing of electronic health record data [67], as well as on building semantic models to represent records of processing activities [74,69,73], data protection impact assessments [57], data breaches' reports [64], and international data transfer notices [42]. Moreover, extensions focusing on GDPR's data subject rights and exemptions to these rights [23] and on DGA requirements [24,18] were also contributed back to DPVCG's outputs.…”

An End-to-End Pipeline from Law Text to Logical Formulas

“…The PDPA is Singapore's primary data protection statute and Part 6A governs data breach notifications. While the PDPA has not been examined in AI & Law literature, its subject matter connects it to prior work on the General Data Protection Regulation [8,2]. Part 6A is also complex enough to demonstrate the utility of a computational law approach.…”

“…Expressing laws computably is a classic objective of AI & Law [1] and a prerequisite to automating downstream tasks such as compliance checking [2], policy support [3], legislative simulation [4], and formal verification [3]. But faithfully translating law to logic is challenging [5], often requiring expertise in both legal and formal methods.…”