Measuring Semantic Similarity across EU GDPR Regulation and Cloud Privacy Policies

Abstract

Data protection authorities formulate policies and rules which the service providers have to comply with to ensure security and privacy when they perform Big Data analytics using users Personally Identifiable Information (PII). The knowledge contained in the data regulations and organizational privacy policies are typically maintained as short unstructured text in HTML or PDF formats. Hence it is an open challenge to determine the specific regulation rules that are being addressed by a provider's privacy policies. We have developed a semantically rich framework, using techniques from Semantic Web and Natural Language Processing, to extract and compare the context of a short text in real-time. This framework allows automated incremental text comparison and identifying context from short text policy documents by determining the semantic similarity score and extracting semantically similar key terms. Additionally, we also created a knowledge graph to store the semantically similar comparison results while evaluating our framework across EU GDPR and privacy policies of 20 organizations complying with this regulation associated with various categories apply to Big Data stored in the cloud. Our approach can be utilized by Big Data practitioners to update their referential documents regularly based on the authority documents.

A Policy-Driven Approach to Secure Extraction of COVID-19 Data From Research Papers

“…Along with HIPAA key terms, the semantic similarity between the organizational privacy policy and HIPAA regulation is indicative of compliance ( Elluri et al, 2020 ). In our framework, we evaluated the semantic similarity between organizational privacy policies and HIPAA regulation.…”

Automated Compliance of Mobile Wallet Payments for Cloud Services

“…Now that in mobile wallets, payment can also be made through a debit card; hence, the EFTA act applies to mobile wallets too. Some of the key obligations for this act is that the rule establishes the consumer rights to several disclosures and error resolution procedures for unauthorized or otherwise erroneous transactions [15]. The disclosures include upfront disclosures regarding, among other things, the terms and conditions of the EFT service and how error resolution procedures will work.…”

“…TILA is meant to apply to creditors that offer credit products such as credit cards but may apply to mobile payment systems when mobile payment is funded by a credit card or other TILA covered credit account. It applies to mobile wallets compliance policy when the underlying payment source is a credit card (or other credit account covered by TILA and Regulation Z) [15]. Some of the key obligations that are part of the TILA act are that the Creditors or any organizations are required to provide disclosures to consumers describing costs, including interest rate, billing rights, and dispute procedures.…”

“…2) Deontic Expressions: Modal logic is considered as a broad term that is used to cover various other forms of logic, such as temporal logic and deontic logic [8] [19] [15]. Deontic logic further consists of four types of modalities that helps in classifying statement rules as Permissions, Obligations, Dispensations, or Prohibitions.…”

Trusted Compliance Enforcement Framework for Sharing Health Big Data

“…Most of the semantically similar key terms associated with regulation must be referred in an organization's privacy policy. Therefore, the occurrence of these terms or words associated with them is a significant indication of an organization policy's agreement with the HIPAA regulations [22]. We assessed the occurrence of HIPAA key terms and associated terms in a privacy policy document.…”