Privacy policy compliance detection and analysis based on knowledge graph

ZHANG Xiheng; LI Xin; TANG Peng; HUANG Ruiqi; HE Yuan; QIU Weidong

doi:10.11959/j.issn.2096-109x.2024087

您当前的位置：

首页 >

文章列表页 >

Papers | 更新时间：2025-02-06

- Privacy policy compliance detection and analysis based on knowledge graph
- Chinese Journal of Network and Information Security Vol. 10, Issue 6, Pages: 151-163(2024)
- 作者机构：
  
  上海交通大学网络空间安全学院，上海 200210
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2024087
  CLC： TP309.2
- Received：19 January 2024，
  
  Revised：2024-03-11，
  
  Published：25 December 2024
- 稿件说明：
移动端阅览
张西珩, 李昕, 唐鹏, 等. 基于知识图谱的隐私政策合规性检测与分析[J]. 网络与信息安全学报, 2024, 10(6): 151-163.

ZHANG X H, LI X, TANG P, et al. Privacy policy compliance detection and analysis based on knowledge graph[J]. Chinese Journal of Network and Information Security, 2024, 10(6): 151-163.
张西珩, 李昕, 唐鹏, 等. 基于知识图谱的隐私政策合规性检测与分析[J]. 网络与信息安全学报, 2024, 10(6): 151-163. DOI： 10.11959/j.issn.2096-109x.2024087.

ZHANG X H, LI X, TANG P, et al. Privacy policy compliance detection and analysis based on knowledge graph[J]. Chinese Journal of Network and Information Security, 2024, 10(6): 151-163. DOI： 10.11959/j.issn.2096-109x.2024087.

摘要

《中华人民共和国个人信息保护法》（以下简称“个保法”）作为保护个人信息权益的重要法律，对个人信息处理者收集、存储、使用、分享等信息处理活动提出明确规范，并要求个人信息处理者在所提供服务的隐私政策中予以说明。这意味着任何公司在国内提供服务时，需首先提供符合“个保法”要求的隐私政策。为了实现自动分析面向“个保法”的隐私政策合规性，提出了基于知识图谱构建隐私政策合规性智能检测方法。首先，对“个保法”进行全面分析并构建相应的多级隐私政策知识图谱，涵盖需要在隐私政策中予以说明的信息保护相关概念。然后，构建半自动化的隐私政策收集方法并收集400份中文App的隐私政策，对其中100份基于知识图谱进行交叉标注后形成首个面向“个保法”的中文隐私政策语料库APPCP-100，使用剩余300份隐私政策构建中文概念分类器模型CPP-BERT，实现高效的隐私政策合规性智能检测。最后，应用知识图谱对隐私政策进行全面的合规性分析，结果显示当前中文App隐私政策对“个保法”中细粒度概念的合规性仍有待提高。

Abstract

The personal information protection law (PIPL) of the People’s Republic of China served as an important legal framework for safeguarding personal information rights. It established clear regulations for personal information controllers in their activities involving the collecting

storing

using

and sharing of personal information. It also required that these controllers provide explanations within their privacy policies for the services they offered. This meant that any company providing services in China must first offer a privacy policy that complied with the requirements of the PIPL. Therefore

in order to analyze the compliance of privacy policies with respect to the PIPL

an intelligent method was presented for assessing privacy policy compliance based on a knowledge graph. First

a comprehensive analysis of the PIPL was conducted

and a multi-level privacy policy knowledge graph was proposed that covered concepts related to information protection that needed to be explained in privacy policies. Next

a semi-automated method was built for collecting privacy policies and collected the privacy policies of 400 Chinese Apps. 100 policies were cross-annotated based on the knowledge graph

resulting in the creation of the first Chinese privacy policy corpus tailored to the PIPL called APPCP-100 (APP-privacy-policy-corpus-for-PIPL-100). Using this corpus

a Chinese concept classifier model CPP-BERT was constructed to achieve efficient detection of privacy policy compliance. Finally

the knowledge graph was applied to conduct a comprehensive compliance analysis of privacy policies

and the results indicate that the current compliance of Chinese App privacy policies with the fine-grained concepts of the PIPL still needs improvement.

关键词

Keywords

references

DETERMANN L , RUAN Z J , GAO T , et al . China’s draft personal information protection law [J ] . Journal of Data Protection & Privacy , 2021 , 4 ( 3 ): 235 - 259 .

CALZADA I . Citizens’ data privacy in China: the state of the art of the personal information protection law (PIPL) [J ] . Smart Cities , 2022 , 5 ( 3 ): 1129 - 1150 .

LIU Y L , HUANG L , YAN W , et al . Privacy in AI and the IoT: the privacy concerns of smart speaker users and the personal information protection law in China [J ] . Telecommunications Policy , 2022 , 46 ( 7 ): 102334 .

TAN Z , ZHANG C . China’s PIPL and DSL: is China following the EU’s approach to data protection [J ] . Journal of Data Protection & Privacy , 2021 , 5 ( 1 ): 7 - 25 .

李永红 , 窦文珠 . 试论《个人信息保护法》对企业合规的影响及建议 [J ] . 中外企业文化 , 2022 ( 8 ): 96 - 98 .

LI Y H , DOU W Z . On the impact and suggestions of the personal information protection law on enterprise compliance [J ] Chinese & Foreign Corporate Culture , 2022 ( 8 ): 96 - 98

SKINNER G , HAN S , CHANG E . An information privacy taxonomy for collaborative environments [J ] . Information Management & Computer Security , 2006 , 14 ( 4 ): 382 - 394 .

LEONE V , DI-CARO L . The role of vocabulary mediation to discover and represent relevant information in privacy policies [J ] . Legal Knowledge and Information Systems , 2020 : 73 - 82 .

CHAWLA K , HULSTIJN J . A taxonomy for the representation of privacy and data control signals [J ] . Legal Knowledge and Information Systems , 2020 : 23 - 32 .

BENJUMEA J , ROPERO J , RIVERA-ROMERO O , et al . Privacy assessment in mobile health Apps: scoping review [J ] . JMIR mHealth and uHealth , 2020 , 8 ( 7 ): e18868 .

TORRE D , ABUALHAIJA S , SABETZADEH M , et al . An AI-assisted approach for checking the completeness of privacy policies against GDPR [C ] // 2020 IEEE 28th International Requirements Engineering Conference (RE) . 2020 : 136 - 146 .

AMARAL O , ABUALHAIJA S , SABETZADEH M , et al . A model-based conceptualization of requirements for compliance checking of data processing against GDPR [C ] // 2021 IEEE 29th International Requirements Engineering Conference Workshops . 2021 : 16 - 20 .

SANGAROONSILP P , DAM H K , CHOETKIERTIKUL M , et al . A taxonomy for mining and classifying privacy requirements in issue reports [J ] . Information and Software Technology , 2023 , 157 : 107162 .

WILSON S , SCHAUB F , DARA A , et al . The creation and analysis of a website privacy policy corpus [C ] // Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics . 016 : 1330 – 1340 .

SATHYENDRA K , WILSON S , SCHAUB F , et al . Identifying the provision of choices in privacy policy text [C ] // Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing . 2017 : 2774 – 2779 .

ARORA S , HOSSEINI H , UTZ C , et al . A tale of two regulatory regimes: creation and analysis of a bilingual privacy policy corpus [C ] // Proceedings of the Thirteenth Language Resources and Evaluation Conference . 2022 : 5460 - 5472 .

ZIMMECK S , STORY P , SMULLEN D , et al . MAPS: scaling privacy compliance analysis to a million Apps [C ] // Proceedings on Privacy Enhancing Technologies , 2019 : 66 - 86 .

RAVICHANDER A . Question answering for privacy policies: combining computational and legal [C ] // Proceedings of the 2019 Conference on Empirical Methods in Natural . Association for Computational Linguistics , 2019 : 4947 - 4958 .

唐家渝 , 刘知远 , 孙茂松 . 文本可视化研究综述 [J ] . 计算机辅助设计与图形学学报 , 2013 , 25 ( 3 ): 273 - 285 .

TANG J Y , LIU Z Y , SUN M S . A survey of text visualization [J ] . Journal of Computer-Aided Design & Computer , 2013 , 25 ( 3 ): 273 - 285 .

KUCKARTZ U . Qualitative text analysis: a guide to methods, practice and using software [J ] . Qualitative Text Analysis , 2013 : 1 - 192 .

CARAMUJO J , DA SILVA A M R . Analyzing privacy policies based on a privacy-aware profile: the Facebook and LinkedIn case studies [C ] // 2015 IEEE 17th Conference on Business Informatics . 2015 : 77 - 84 .

WINKLER S , ZEADALLY S . Privacy policy analysis of popular web platforms [J ] . IEEE Technology and Society Magazine , 2016 , 35 ( 2 ): 75 - 85 .

PEREZ A J , ZEADALLY S , COCHRAN J . A review and an empirical analysis of privacy policy and notices for consumer internet of things [J ] . Security and Privacy , 2018 , 1 ( 3 ): e15 .

PARKER L , HALTER V , KARLIYCHUK T , et al . How private is your mental health app data? an empirical study of mental health app privacy policies and practices [J ] . International Journal of Law and Psychiatry , 2019 , 64 : 198 - 204 .

ZIMMECK S , BELLOVIN S M . Privee: an architecture for automatically analyzing web privacy policies [C ] // 23rd USENIX Security Symposium (USENIX Security 14). 2014 : 1 - 16 .

HAMDANI R E , MUSTAPHA M , AMARILES D R , et al . A combined rule-based and machine learning approach for automated GDPR compliance checking [C ] // Proceedings of the Eighteenth International Conference on Artificial Intelligence and Law . 2021 : 40 - 49 .

AMARAL O , ABUALHAIJA S , TORRE D , et al . AI-enabled automation for completeness checking of privacy policies [J ] . IEEE Transactions on Software Engineering , 2022 , 48 ( 11 ): 4647 - 4674 .

RAMOS J . Using TF-IDF to determine word relevance in document queries [C ] // Proceedings of the First Instructional Conference on Machine Learning : 2003 : 29 - 48 .

DEVLIN J , CHANG M W , LEE K , et al . BERT: pre-training of deep bidirectional transformers for language understanding [J ] . arXiv Preprint arXiv: 1810.04805 , 2018 .

VASWANI A , SHAZEER N , PARMAR N , et al . Attention is all you need [C ] // Advances in Neural Information Processing Systems . 2017 .

KINGMA D P , BA J . Adam: a method for stochastic optimization [J ] . arXiv Preprint arXiv: 1412.6980 , 2014 .

HO T K . Random decision forests [C ] // Proceedings of 3rd International Conference on Document Analysis and recognition . 1995 : 278 - 282 .

GEURTS P , ERNST D , WEHENKEL L . Extremely randomized trees [J ] . Machine Learning , 2006 , 63 : 3 – 42 .

CHEN T , GUESTRIN C . XGBoost: a scalable tree boosting system [J ] . Proceedings of the 22nd International Conference on Knowledge Discovery and Data Mining . 2016 , 11 : 785 - 794 .

DREISEITL S , OHNO-MACHADO L . Logistic regression and artificial neural network classification models: a methodology review [J ] . Journal of Biomedical Informatics , 2002 , 35 ( 5-6 ): 352 - 359 .

WEBB G I , KEOGH E , MIIKKULAINEN R . Naïve Bayes .[J ] . Encyclopedia of Machine Learning , 2010 , 15 ( 1 ): 713 - 714 .

FIX E , HODGES J L . Discriminatory analysis. nonparametric discrimination: consistency properties [J ] . International Statistical Review/Revue Internationale de Statistique , 1989 , 57 ( 3 ): 238 - 247 .

MOFUERZA J , MUNOZ A . Support vector machines with applications [J ] . Statistical Science , 2006 , 21 ( 3 ): 322 – 336 .

QUINLAN J R . Induction of decision trees [J ] . Machine Learning , 1986 , 1 ( 1 ): 81 - 106 .

KRIZHEVSKY A , SUTSKEVER I , HINTON G E . ImageNet classification with deep convolutional neural networks [J ] . Communications of the ACM , 2017 , 60 ( 6 ): 84 - 90 .

GREFF K , SRIVASTAVA R K , KOUTNÍK J , et al . LSTM: a search space odyssey [J ] . IEEE Transactions on Neural Networks and Learning Systems , 2016 , 28 ( 10 ): 2222 - 2232 .

PEDREGOSA F , VAROQUAUX G , GRAMFORT A , et al . Scikit-learn: machine learning in Python [C ] // The Journal of Machine Learning Research . 2011 : 2825 - 2830 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Bidirectional privacy authorization for large models based on private set intersection

Research on searchable encryption scheme based on enhanced PIR

Differential privacy protection method for localization of ADS-B message positioning data oriented to LBS

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Secure aggregation for semi-decentralized federated learning under heterogeneous data

Related Author

YANG Shuai

HAN Yiliang

WU Xuguang

FENG Haokang

WANG Yuanyuan

TANG Liang

MA Limin

YANG Hongyu

Related Institution

Key Laboratory of Counter-Terrorism Command Information Engineering of the Ministry of Education, Engineering University of PAP

College of Cryptography Engineering, Engineering University of PAP

College of Computer Science，Beijing Information Science and Technology University

Beijing Academy of Educational Science

School of Computer Science and Technology, Jilin University

⁰