Formal analysis of privacy requirements specifications for multi-tier applications

Abstract

Companies require data from multiple sources to develop new information systems, such as social networking, e-commerce, and location-based services. Systems rely on complex, multi-stakeholder data supply-chains to deliver value. These data supply-chains have complex privacy requirements: Privacy policies affecting multiple stakeholders (e.g., user, developer, company, government) regulate the collection, use, and sharing of data over multiple jurisdictions (e.g. California, United States, Europe). Increasingly, regulators expect companies to ensure consistency between company privacy policies and company data practices. To address this problem, we propose a methodology to map policy requirements in natural language to a formal representation in Description Logic. Using the formal representation, we reason about conflicting requirements within a single policy and among multiple policies in a data supply chain. Further, we enable tracing data flows within the supply-chain. We derive our methodology from an exploratory case study of the Facebook platform policy. We demonstrate the feasibility of our approach in an evaluation involving Facebook, Zynga and AOL-Advertising policies. Our results identify three conflicts that exist between Facebook and Zynga policies, and one conflict within the AOL Advertising policy.

Us and them: a study of privacy requirements across north america, asia, and europe

“…There have been some recent papers on extracting privacy requirements from privacy regulations and laws [9,10]. These could be part of the privacy framework as well and help in reducing the impact due to cultural differences for privacy.…”

PPChecker: Towards Accessing the Trustworthiness of Android Apps’ Privacy Policies

“…AppSent * a sentence in app's privacy policy whose main verb ∈ V P * Res AppP P * resources that the app will * according to an app's privacy policy Res AppP P * resources that app will not * according to an app's privacy policy LibSent * a sentence in lib's privacy policy whose main verb ∈ V P * Res LibP P * resources to the lib will * according to the lib's privacy policy Table I lists the symbols related to privacy policy. We summarize four types of main verbs, which are commonly used in privacy policies, as suggested by [27], [28], including:…”

Mind the gap: assessing the conformance of software traceability to relevant guidelines

“…Maxwell and Antón [40] formalized legal texts of the Health Insurance Portability and Accountability Act as production rule models to support regulatory compliance analysis. Breaux et al performed extensive research on formalizing legal text for supporting compliance verification of software requirements with regulations in order to establish traceability between requirements and regulations [6,8,7].…”