GDPR-oriented intelligent checking method of privacy policies compliance

Xin LI; Peng TANG; Xiheng ZHANG; Weidong QIU; Hong HUI

doi:10.11959/j.issn.2096-109x.2023088

您当前的位置：

首页 >

文章列表页 >

GDPR-oriented intelligent checking method of privacy policies compliance

Papers | 更新时间：2024-06-03

- GDPR-oriented intelligent checking method of privacy policies compliance
- Chinese Journal of Network and Information Security Vol. 9, Issue 6, Pages: 127-139(2023)
- 作者机构：
  
  1. 上海交通大学网络空间安全学院，上海 200240
  2. 上海交通大学网络安全技术研究院，上海 200240
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2023088
  CLC： TP393
- Online First：2023-12，
  
  Published：25 December 2023
- 稿件说明：
移动端阅览
Xin LI, Peng TANG, Xiheng ZHANG, et al. GDPR-oriented intelligent checking method of privacy policies compliance[J]. Chinese Journal of Network and Information Security, 2023, 9(6): 127-139.
DOI：

Xin LI, Peng TANG, Xiheng ZHANG, et al. GDPR-oriented intelligent checking method of privacy policies compliance[J]. Chinese Journal of Network and Information Security, 2023, 9(6): 127-139. DOI： 10.11959/j.issn.2096-109x.2023088.

摘要

欧盟《通用数据保护条例（GDPR，general data protection regulation）》自2018年施行以来，已开出罚单300多起，其中不乏谷歌这类知名企业未能提供透明易懂的隐私政策而遭受巨额处罚。这项严格的数据保护法律使得各国企业在提供跨境服务特别是向欧盟地区提供服务时变得尤为谨慎。同时其管辖范围规定，GDPR适用于任何为欧盟公民提供服务的企业，无论其是否在欧盟境内注册，这意味着世界各地涉及海外业务的企业都要考虑其隐私政策面向 GDPR 的合规性，国内企业也不例外。面向这一需求，构建了一套智能化检测方法，自动提取各在线服务企业的隐私政策，并采用机器学习和自动化技术，将其转化为具有结构层次的标准格式。之后进行基于自然语言处理的文本分类，识别其中涵盖的相应的 GDPR 概念，并以搭建的GDPR知识图谱为依据，检验隐私政策是否缺少部分GDPR要求披露的概念，从而实现面向GDPR的隐私政策合规性智能化检测，为国内企业向欧盟用户提供跨境服务提供支撑。对语料库中样本的分析结果进一步揭示了主流在线服务企业普遍未达到GDPR合规要求的现状。

Abstract

The implementation of the EU’s General Data Protection Regulation (GDPR) has resulted in the imposition of over 300 fines since its inception in 2018.These fines include significant penalties for prominent companies like Google

which were penalized for their failure to provide transparent and comprehensible privacy policies.The GDPR

known as the strictest data protection laws in history

has made companies worldwide more cautious when offering cross-border services

particularly to the European Union.The regulation's territorial scope stipulates that it applies to any company providing services to EU citizens

irrespective of their location.This implies that companies worldwide

including domestic enterprises

are required to ensure compliance with GDPR in their privacy policies

especially those involved in international operations.To meet this requirement

an intelligent detection method was introduced.Machine learning and automation technologies were utilized to automatically extract privacy policies from online service companies.The policies were converted into a standardized format with a hierarchical structure.Through natural language processing

the privacy policies were classified

allowing for the identification of relevant GDPR concepts.In addition

a constructed GDPR taxonomy was used in the detection mechanism to identify any missing concepts as required by GDPR.This approach facilitated intelligent detection of GDPR-oriented privacy policy compliance

providing support to domestic enterprises while they provided cross-border services to EU users.Analysis of the corpus samples reveals the current situation that mainstream online service companies generally fail to meet GDPR compliance requirements.

关键词

Keywords

references

MCDONALD A , CRANOR L . The cost of reading privacy policies [J ] . Journal of Law and Policy for the Information Society , 2008 , 4 : 543 - 568 .

LI H X , ZHU H J , DU S G , et al . Privacy leakage of location sharing in mobile social networks:attacks and defense [J ] . IEEE Transactions on Dependable and Secure Computing , 2016 , 15 ( 4 ): 646 - 660 .

TUCKER S . Google fined $57m by data protection watchdog over GDPR violations [EB ] .

TOM J , SING E , MATULEVICIUS R . Conceptual representation of the GDPR:model and application directions [C ] // Proceedings of 17th International Conference on Perspectives in Business Informatics Research(BIR) . 2018 : 18 - 28 .

LIPPI M , PALKA P , CONTISSA G , et al . CLAUDETTE:an automated detector of potentially unfair clauses in online terms of service [J ] . Artificial Intelligence and Law , 2019 , 27 ( 2 ): 117 - 139 .

TORRE D , ABUALHAIJA S , SABETZADEH M , et al . An AI-assisted approach for checking the completeness of privacy policies against GDPR [C ] // Proceedings of the 2020 IEEE 28th International Requirements Engineering Conference . 2020 : 136 - 146 .

AMARAL O , ABUALHAIJA O , ABUALHAIJA S , et al . AI-enabled automation for completeness checking of privacy policies [J ] . IEEE Transactions on Software Engineering , 2021 ,( N/A ): 1 - 21 .

WILSON S , SCHAUB F , DARA A , et al . The creation and analysis of a website privacy policy corpus [C ] // Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics(ACL) . 2016 : 1330 - 1340 .

SATHYENDRA K , WILSON S , SCHAUB F , et al . Identifying the provision of choices in privacy policy text [C ] // Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing . 2017 : 2774 - 2779 .

ZIMMECK S , STORY P , SMULLEN D , et al . MAPS:scaling privacy compliance analysis to a million apps [C ] // Proceedings of the Conference on Privacy Enhancing Technologies . 2019 : 66 - 86 .

SRINATH M , WILSON S , GILES C . Privacy at scale:introducing the PrivaSeer corpus of Web privacy policies [J ] . arXiv preprint arXiv:2020.11131 .

KUZNETSOV M , NOVIKOVA E , KOTENKO I , et al . Privacy policies of IoT devices:collection and analysis [J ] . Sensors , 2022 , 22 ( 5 ): 1 - 23 .

TESFAY W , HOFMANN P , NAKAMURA T , et al . Privacy guide:towards an implementation of the EU GDPR on internet privacy policy evaluation [C ] // Proceedings of the 4th ACM International Workshop on Security and Privacy Analytics . 2018 : 15 - 21 .

NEJAD N , SCERRI S , LEHMANN J . KnIGHT:mapping privacy policies to GDPR [C ] // Proceedings of 21st International Conference on Knowledge Engineering and Knowledge Management(EKAW 2018) . 2018 : 258 - 272 .

TORRE D , SOLTANA G , SABETZADEH M , et al . Using models to enable compliance checking against the GDPR:an experience report [C ] // Proceedings of the 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems . 2019 : 10 - 20 .

HAMDANI R , MUSTAPHA M , AMARILES D , et al . A combined rule-based and machine learning approach for automated GDPR compliance checking [C ] // Proceedings of the 18th International Conference on Artificial Intelligence and Law . 2021 : 40 - 49 .

ZIMMECK S , BELLOVIN S . Privee:an architecture for automatically analyzing web privacy policies [C ] // Proceedings of the 23rd USENIX Security Symposium . 2014 : 1 - 16 .

HARKOUS H , FAWAZ K , LEBRET R , et al . Automated analysis and presentation of privacy policies using deep learning [C ] // Proceedings of the 27th USENIX Security Symposium . 2018 : 531 - 548 .

AYALA-RIVERA V , PASQUALE L . The grace period has ended:An approach to operationalize GDPR requirements [C ] // Proceedings of the 2018 IEEE 26th International Requirements Engineering Conference . 2018 : 136 - 146 .

DEGELING M , UTZ C , LENTZSCH C , et al . We value your privacy now take some cookies:measuring the GDPR’s impact on web privacy [C ] // Proceedings of the 2019 Network and Distributed Systems Security Symposium . 2018 : 1 - 14 .

LINDEN T , KHANDELWAL R , HARKOUS H , et al . The privacy policy landscape after the GDPR [C ] // Proceedings on Privacy Enhancing Technologies , 2020 ( 1 ): 47 - 64 .

ABHIJITHG , SHOMIR W , NORMAN S . Supervised and unsupervised methods for robust separation of section titles and prose text in web documents [C ] // Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing . 2018 : 850 - 855 .

WILLIAMS B , HALLOIN C , LOBEL W , et al . Data-driven model development for cardiomyocyte production experimental failure prediction [C ] // Proceedings of 30th European Symposium on Computer Aided Process Engineering . 2020 : 1639 - 1644 .

MOFUERZA J , MUNOZ A . Support vector machines with applications [J ] . Statistical Science , 2006 , 21 ( 3 ): 322 - 336 .

GEURTS P , ERNST D , WEHENKEL L . Extremely randomized trees [J ] . Machine Learning , 2006 , 63 : 3 - 42 .

CHEN T , GUESTRIN C . XGBoost:a scalable tree boosting system [R ] . 2016 .

COHEN J . A coefficient of agreement for nominal scales [J ] . Educational and Psychological Measurement , 1960 , 20 ( 1 ): 37 - 46 .

SALTON G , BUCKLEY C . Term weighting approaches in automatic text retrieval [J ] . Information Processing ＆ Management , 1988 , 24 ( 5 ): 513 - 523 .

PENNINGTON J , SOCHER R , MANNING C . GloVe:global vectors for word representation [C ] // Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing . 2014 : 1532 - 1543 .

BOJANOWSKI P , GRAVE E , JOULIN A , et al . Enriching word vectors with subword information [J ] . Transactions of the Association for Computational Linguistics , 2017 , 5 : 135 - 146 .

MIKOLOV T , CHEN K , CORRADO G , et al . Efficient estimation of word representations in vector space [J ] . Computer Science , 2013 , 5 : 324 - 352 .

JACOB D , CHANG M W , KENTON L , et al . BERT:pre-training of deep bidirectional transformers for language understanding [R ] . 2018 .

Views

196

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Detecting privacy compliance of mobile applications from the perspective of the "minimum necessary" principle

Related Author

YU Peihou

XU Tianchen

SUN Wenqian

CHEN Yunfang

YU Le

ZHANG Wei

ZHANG Xiheng

LI Xin

Related Institution

School of Computer Science, Nanjing University of Posts and Telecommunications

School of Cyber Science and Engineering, Shanghai Jiao Tong University

⁰