Claudette Meets GDPR: Automating the Evaluation of Privacy Policies Using Artificial Intelligence

Contissa, Giuseppe; Docter, Koen; Lagioia, Francesca; Lippi, Marco; Micklitz, Hans‐W.; Pałka, Przemysław; Sartor, Giovanni; Torroni, Paolo

doi:10.2139/ssrn.3208596

Cited by 40 publications

(21 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Researchers have recently started looking into this question by evaluating companies' behavior in light of the GDPR. Their approaches, however, are limited to a small number of websites (at most 14) [5,23]. Concurrent to our work, Degeling et al [6], performed the first largescale study focused on the evolution of the cookie consent notices, which have been hugely reshaped by the GDPR (with 6,579 EU websites).…”

Section: Research Questionmentioning

confidence: 82%

The Privacy Policy Landscape After the GDPR

Lindén¹,

Khandelwal²,

Harkous

et al. 2020

Proceedings on Privacy Enhancing Technologies

118

View full text Add to dashboard Cite

The EU General Data Protection Regulation (GDPR) is one of the most demanding and comprehensive privacy regulations of all time. A year after it went into effect, we study its impact on the landscape of privacy policies online. We conduct the first longitudinal, in-depth, and at-scale assessment of privacy policies before and after the GDPR. We gauge the complete consumption cycle of these policies, from the first user impressions until the compliance assessment. We create a diverse corpus of two sets of 6,278 unique English-language privacy policies from inside and outside the EU, covering their pre-GDPR and the post-GDPR versions. The results of our tests and analyses suggest that the GDPR has been a catalyst for a major overhaul of the privacy policies inside and outside the EU. This overhaul of the policies, manifesting in extensive textual changes, especially for the EU-based websites, comes at mixed benefits to the users. While the privacy policies have become considerably longer, our user study with 470 participants on Amazon MTurk indicates a significant improvement in the visual representation of privacy policies from the users' perspective for the EU websites. We further develop a new workflow for the automated assessment of requirements in privacy policies. Using this workflow, we show that privacy policies cover more data practices and are more consistent with seven compliance requirements post the GDPR. We also assess how transparent the organizations are with their privacy practices by performing specificity analysis. In this analysis, we find evidence for positive changes triggered by the GDPR, with the specificity level improving on average. Still, we find the landscape of privacy policies to be in a transitional phase; many policies still do not meet several key GDPR requirements or their improved coverage comes with reduced specificity.

show abstract

Section: Research Questionmentioning

confidence: 82%

The Privacy Policy Landscape After the GDPR

Lindén¹,

Khandelwal²,

Harkous

et al. 2020

Proceedings on Privacy Enhancing Technologies

118

View full text Add to dashboard Cite

show abstract

“…The identified codes were then structured to identify the relevant dimensions and attributes, taking into account definitions and concepts from the GDPR. The second cycle took into account the categorisations used in literature on the topic, specifically: Wilson et al [12,11], Morel and Pardo [14], Bhatia et al [28] and Contissa et al [10]. These papers were selected for their relevance.…”

Section: Sample Selectionmentioning

confidence: 99%

“…One stream of research focuses on negotiation protocols such as the P3P [7], or the creation of privacy assistants [8], analogous to the idea of a 'butler' [9]. Others investigate the automatic annotation or evaluation of privacy policies [10,11,12,13]. A third stream focuses on the development of 'Personal Data Stores' (PDSs), 2 , which are systems that provide an architecture allowing users retain and manage their own data.…”

Section: Introductionmentioning

confidence: 99%

A Taxonomy for the Representation of Privacy and Data Control Signals

Chawla

Hulstijn

2020

Frontiers in Artificial Intelligence and Applications

View full text Add to dashboard Cite

In interacting with digital apps and services, users create digital identities and generate massive amounts of associated personal data. The relationship between the user and the service provider in such cases is, inter alia, a principal-agent relationship governed by a ‘contract’. This contract is provided mostly in natural language text, however, and remains opaque to users. The need of the hour is multi-faceted documentation represented in machine-readable, natural language and graphical formats, to enable tools such as smart contracts and privacy assistants which could assist users in negotiating and monitoring agreements. In this paper, we develop a Taxonomy for the Representation of Privacy and Data Control Signals. We focus on ‘signals’ because they play a crucial role in communicating how a service provider distinguishes itself in a market. We follow the methodology for developing taxonomies proposed by Nickerson et al. We start with a grounded analysis of the documentation of four smartphone-based fitness activity trackers, and compare these to insights from literature. We present the results of the first two iterations of the design cycle. Validation shows that the Taxonomy answers (10/14) relevant questions from Perera et al.’s requirements for the knowledge-modelling of privacy policies fully, (2/14) partially, and fails to answer (2/14). It also covers signals not identified by the checklist. We also validate the Taxonomy by applying it to extracts from documentation, and argue that it shows potential for the annotation and evaluation of privacy policies as well.

show abstract

“…As we have mentioned before, within the CLAUDETTE research there was developed an automated detector of potentially unfair clauses in online terms of service -where machine learning is employed to automatically detect such potentially unfair clauses.‖[39]. Moreover, using CLAUDETTE could be performed automated evaluations of privacy policies using artificial intelligence [40].…”

Section: Governments Data Innovationmentioning

confidence: 99%

Some Reflections on 'Datafication': Data Governance and Legal Challenges

Stanescu

Onufreiciuc

2020

EJLPA

View full text Add to dashboard Cite

Data is considered to be the new fuel for a business growth. By the Data Strategy, the EU made a big step in designing a vision of how data governance can be integrated in organizations ' management and activity, in governments' systems and, ultimately, in people's (digital) life. Translating data into competitive business outcomes through digital innovation while ensuring the protection and security of individuals' (non-) personal information raises ethical and legal questions that we need to prepare to answer.

show abstract

Claudette Meets GDPR: Automating the Evaluation of Privacy Policies Using Artificial Intelligence

Cited by 40 publications

References 12 publications

The Privacy Policy Landscape After the GDPR

The Privacy Policy Landscape After the GDPR

A Taxonomy for the Representation of Privacy and Data Control Signals

Some Reflections on 'Datafication': Data Governance and Legal Challenges

Contact Info

Product

Resources

About