Is Your Policy Compliant?: A Deep Learning-based Empirical Study of Privacy Policies' Compliance with GDPR
Is Your Policy Compliant?: A Deep Learning-based Empirical Study of Privacy Policies' Compliance with GDPR
复制标题
DOI：
10.1145/3559613.3563195
复制
发表时间：
2022-11
期刊：
影响因子：
--
通讯作者：
Tamjid Al Rahat;Minjun Long;Yuan Tian
中科院分区：
文献类型：
--
作者：
Tamjid Al Rahat;Minjun Long;Yuan Tian
自《通用数据保护条例》（GDPR）于2018年5月生效以来，公司一直致力于其数据实践，以遵守GDPR的要求。特别是，由于隐私政策是用户在使用公司服务时了解和控制其隐私的重要沟通渠道，许多公司在GDPR实施后更新了隐私政策。然而，大多数隐私政策都是冗长的，充满了行话，模糊地描述了公司的数据实践和用户的权利。此外，我们的研究表明，超过32%的最终用户发现很难理解解释GDPR要求的隐私政策。因此，对于最终用户和执法机构来说，手动检查公司的隐私政策是否符合GDPR强制执行的要求是一项挑战。在本文中，我们创建了一个包含1,080个网站的隐私政策数据集，由专家根据18项GDPR要求进行注释，并开发了一个基于卷积神经网络（CNN）的模型，该模型可以将隐私政策分类为GDPR要求，准确率为89.2%。我们应用我们的模型自动衡量9761个访问量最大的网站的隐私政策是否符合GDPR。我们的研究结果表明，即使在GDPR生效四年后，68%的网站仍然不符合GDPR的至少一项要求。
Since the General Data Protection Regulation (GDPR) came into force in May 2018, companies have worked on their data practices to comply with the requirements of GDPR. In particular, since the privacy policy is the essential communication channel for users to understand and control their privacy when using companies' services, many companies updated their privacy policies after GDPR was enforced. However, most privacy policies are verbose, full of jargon, and vaguely describe companies' data practices and users' rights. In addition, our study shows that more than 32% of end users find it difficult to understand the privacy policies explaining GDPR requirements. Therefore, it is challenging for the end users and law enforcement authorities to manually check if companies' privacy policies comply with the requirements enforced by GDPR. In this paper, we create a privacy policy dataset of 1,080 websites annotated by experts with 18 GDPR requirements and develop a Convolutional Neural Network (CNN) based model that can classify the privacy policies into GDPR requirements with an accuracy of 89.2%. We apply our model to automatically measure GDPR compliance in the privacy policies of 9,761 most visited websites. Our results show that, even after four years since GDPR went into effect, 68% of websites still fail to comply with at least one requirement of GDPR.