Critical Analysis of LPL according to Articles 12 - 14 of the GDPR

Abstract

On the 25th May 2018 the General Data Protection Regulation (GDPR) will enter into force implying new challenges to both legal and computer sciences.e Layered Privacy Language (LPL) is intended to model privacy policies to enforce policy-based, privacypreserving processing. In this paper, we identify requirements for privacy policies based on Art. 12 -14 of the GDPR, analyze LPL according to the derived requirements, and propose improvements for LPL accordingly. CCS CONCEPTS•Security and privacy → Domain-speci c security and privacy architectures; Privacy protections; •Social and professional topics → Privacy policies;

TIRA: An OpenAPI Extension and Toolbox for GDPR Transparency in RESTful Architectures

“…First and foremost, TIRA is based on an exhaustive analysis of legal transparency requirements and explicitly tailored to these from ground up. Insofar, it significantly distinguishes from other approaches (e.g., [29,30]) which often lack the explicit alignment to legally mandatory transparency requirements [31,32]. Second, we consciously follow an annotationbased approach instead of employing, for instance, information flow control [33] or static code analysis [34] for determining what personal data a service consumes or exposes, how long it is stored, etc.…”

Analysis of ontologies and policy languages to represent information flows in GDPR

“…LPL [43], implemented by Gerl et al, is a human and machine-readable privacy language which aims to promote the expression and enforcement of GDPR's legal requirements related to data subject's consent, personal data provenance and retention and also to implement privacy-preserving processing activities based on the application of state-of-the-art anonymization techniques. Further work by Gerl and Pohl [45] focused on improving LPL to be able to fully represent the requirements derived from Articles 12 to 14 of the GDPR, the so-called data subject's 'Right to be informed'. LPL's policy structure is purpose-based, i.e., its core architecture is composed by a set of purposes and each purpose has associated a set of data types being processed and also the recipients of said data.…”