Machine Understandable Policies and GDPR Compliance Checking

Bonatti, Piero A.; Kirrane, Sabrina; Petrova, Iliana M.; Sauro, Luigi

doi:10.1007/s13218-020-00677-4

Cited by 31 publications

(19 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Ryan et al [12] look at how the DPV might be used to model compliance with the GDPR requirement for Records of Processing Activities (ROPA), and proposes extensions to the vocabulary. Research on OWL2/DPV in the context of privacy policy language by Bonati et al [13] shows how it can encode consent, business processes, and regulatory obligations. It also highlights the need for automated compliance checking.…”

Section: Related Workmentioning

confidence: 99%

A GDPR International Transfer Compliance Framework Based on an Extended Data Privacy Vocabulary (DPV)

Hickey

Brennan

2021

Frontiers in Artificial Intelligence and Applications

View full text Add to dashboard Cite

This paper describes a tool using an extended Data Privacy Vocabulary (the DPV) to audit and monitor GDPR compliance of international transfers of personal data. New terms were identified which have been proposed as extensions to the DPV W3C Working Group. A prototype software tool was built based on the model plus a set of validation rules, and synthetic use-cases created to test the capabilities of the model and tool (together a compliance framework). This framework was created because the rules around international transfer compliance are complex and changing, there is an absence of a common approach to ensuring compliance, few tools exist to assist, and those that do lack interoperability. Evaluation results demonstrate that the proposed model improves compliance identification and standardisation. The tool received positive feedback from the data protection practitioners who participated in the evaluation, and an initial version of is now in use in one financial services organisation. While currently the tool only addresses international transfers, in theory the framework can be extended through further work to the broader area of compliance of other aspects of the GPDR.

show abstract

Section: Related Workmentioning

confidence: 99%

A GDPR International Transfer Compliance Framework Based on an Extended Data Privacy Vocabulary (DPV)

Hickey

Brennan

2021

Frontiers in Artificial Intelligence and Applications

View full text Add to dashboard Cite

show abstract

“…Similarly, the data protection smart contract verifies whether or not personal data records are encrypted, a technique that in and of itself ensures 'integrity and confidentiality'. Existing efforts have focused on developing a semantic model (encodedb b with OWL/OWL2) for representing GDPR rules, using a policy language [16]. This can be used to express consent, business policies, and regulatory obligations, primarily as a step towards the automated compliance verification of GDPR obligations.…”

Section: A Prior Workmentioning

confidence: 99%

Privacy & Cloud Services: Are We There Yet?

Marikyan

Llanos

Barati

et al. 2021

2021 IEEE International Conference on Service-Oriented System Engineering (SOSE)

View full text Add to dashboard Cite

The General Data Protection Regulation (GDPR) remains an important requirement for many electronic services which utilise user data. GDPR compliance verification for a cloud provider is aimed to confirm that personal data provided by a user is shared in-line with the requirements of this legislation, so that any subsequent audit carried out on the provider does not lead to a financial penalty. This verification involves two aspects: (i) ensuring that user consent has been obtained; (ii) sharing of data with external cloud providers is undertaken in a transparent way, so that the user is aware of which providers the information was shared with and for what purpose. Using a survey we describe why users are still ambivalent about the use of GDPRand how its adoption can be improved using a Blockchain-based architecture that can provide greater transparency on how GDPR compliance is supported by cloud providers.

show abstract

“…The Lynx 3 project aims, in one of its use cases, to create a knowledge graph for the data protection field interlinking domain-related legal texts and providing algorithms able to automatically enlarge the knowledge base when new relevant documents are issued [13]. The SPECIAL 4 project [3] focused on the development of machine-readable policy languages and the DPV was proposed in the context of this project. The MIREL 5 project included the PrOnto ontology among its outcomes, proposing a technique based on Open Information Extraction to map the information extracted from privacy policies on the classes modelled by the ontology [14].…”

Section: Related Workmentioning

confidence: 99%

“…User online activities Behavioral [2], Social Media Communication [3] User profile Identifying [2], Preference [2] Social media data Social Network [2] IP address & device ids Device Based [2] Computer information Device Based [2] Cookies & traking elements, Survey data, Generic personal information, Other, Unspecified V. Leone and L. Di Caro / The Role of Vocabulary Mediation to Discover Relevant Information Table 6. Correspondences between the values of the Purpose attribute in the OPP-115 corpus and the classes in the Purpose DPV module.…”

Section: Attribute Valuesmentioning

confidence: 99%

“…Among the most recent semantic resources that were proposed to model the data protection domain, the Data Privacy Vocabulary (DPV) [2] organises its concepts in a lightweight taxonomic structure. This vocabulary has drawn the attention of many projects that declared their interest in its adoption [3,4,5]. However, to the best of our knowledge, no effort has been yet made to automatically extract, from privacy policies, the information that is relevant with respect to the concepts modelled by this vocabulary.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

The Role of Vocabulary Mediation to Discover and Represent Relevant Information in Privacy Policies

Leone

2020

Frontiers in Artificial Intelligence and Applications

View full text Add to dashboard Cite

To date, the effort made by existing vocabularies to provide a shared representation of the data protection domain is not fully exploited. Different natural language processing (NLP) techniques have been applied to the text of privacy policies without, however, taking advantage of existing vocabularies to provide those documents with a shared semantic superstructure. In this paper we show how a recently released domain-specific vocabulary, i.e. the Data Privacy Vocabulary (DPV), can be used to discover, in privacy policies, the information that is relevant with respect to the concepts modelled in the vocabulary itself. We also provide a machine-readable representation of this information to bridge the unstructured textual information to the formal taxonomy modelled in it. This is the first approach to the automatic processing of privacy policies that relies on the DPV, fuelling further investigation on the applicability of existing semantic resources to promote the reuse of information and the interoperability between systems in the data protection domain.

show abstract

Machine Understandable Policies and GDPR Compliance Checking

Cited by 31 publications

References 27 publications

A GDPR International Transfer Compliance Framework Based on an Extended Data Privacy Vocabulary (DPV)

A GDPR International Transfer Compliance Framework Based on an Extended Data Privacy Vocabulary (DPV)

Privacy & Cloud Services: Are We There Yet?

The Role of Vocabulary Mediation to Discover and Represent Relevant Information in Privacy Policies

Contact Info

Product

Resources

About