SaTC: CORE: Medium: Collaborative: Automatically Answering People's Privacy Questions

SaTC：核心：媒介：协作：自动回答人们的隐私问题

• 批准号: 1914446
• 负责人: Thomas Norton
• 金额: $ 15.01万
• 依托单位: Fordham University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2019
• 资助国家: 美国
• 起止时间: 2019-07-15 至 2023-12-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1914446&HistoricalAwards=false
• 关键词: SaTC; CORE; Medium; Collaborative; Automatically

As novel technologies collect increasingly large and diverse amounts of data about us, people are unable to keep up and retain control over what happens to their data. The current legal approach to privacy concentrates on the concept of "Notice and Choice", namely the expectation that people are provided enough information about the collection and use of their data and are offered meaningful choices about these practices (e.g., opt out, opt in). A primary element of this approach relies on privacy policies to communicate this information to people. In practice, these policies tend to be long, vague and ambiguous. Not too surprisingly, few people find the time to read them and those who do often struggle to understand what they say. This multi-disciplinary project aims to develop novel technology that will enable people to regain a sense of control by enabling them to simply ask questions about the privacy issues that matter to them rather than requiring them to read long, one-size-fits all privacy policies. In addition to producing new knowledge and technologies and contributing to improving the state of privacy in the United States, this project will also create education and research opportunities for both undergraduate and graduate students at participating universities, including activities to broaden participation of women and under-represented minorities in this important area of computer science, and contribute to the development of technologies with the potential to help the visually impaired take advantage of information found in the text of privacy policies. This multi-disciplinary project builds on recent advances in natural language processing, machine learning, code analysis and user modeling to re-invent notice and choice, moving from long and hard-to-understand notices to interactive privacy dialogues with users. An important part of this research involves the development of question answering functionality that enables users to ask questions about those issues that truly matter to them rather than presenting them with one-size-fits-all privacy notices. Another involves supplementing disclosures found in privacy policies with additional sources of information such as background knowledge (e.g. knowledge about common data practices and relevant laws) and code analysis to disambiguate statements and provide additional details to users when it matters (e.g., with whom their data is shared). This research will be guided by user-centered design methodologies where the design of novel technologies is informed by findings from human subject studies, and where technologies are deployed and evaluated in increasingly rich and realistic scenarios. Products of this research will include prototype privacy Question Answering functionality, as well as technology to automatically extract information about data collection and use practices from both the text of privacy policies and from code.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

随着新技术收集越来越多关于我们的数据，人们无法跟上并控制他们的数据发生了什么。目前的法律的隐私方法集中在“通知和选择”的概念上，即期望人们获得关于收集和使用其数据的足够信息，并获得关于这些做法的有意义的选择（例如，选择退出，选择加入）。这种方法的一个主要要素是依靠隐私政策将这些信息传达给人们。在实践中，这些政策往往冗长、模糊和模棱两可。不足为奇的是，很少有人有时间去读它们，而那些读过的人往往很难理解它们所说的内容。这个多学科项目旨在开发新技术，使人们能够通过简单地询问有关他们关心的隐私问题而不是要求他们阅读冗长的，一刀切的隐私政策来重新获得控制感。除了产生新的知识和技术并有助于改善美国的隐私状况外，该项目还将为参与大学的本科生和研究生创造教育和研究机会，包括开展活动，扩大妇女和代表人数不足的少数群体在计算机科学这一重要领域的参与，并促进技术的发展，以帮助视障人士利用隐私政策文本中的信息。这个多学科项目建立在自然语言处理、机器学习、代码分析和用户建模的最新进展基础上，重新发明通知和选择，从冗长难懂的通知转变为与用户的交互式隐私对话。这项研究的一个重要部分涉及开发问答功能，使用户能够就真正重要的问题提出问题，而不是向他们提供一刀切的隐私通知。另一种方法涉及用背景知识（例如，有关常见数据实践和相关法律的知识）和代码分析等额外信息来源补充隐私政策中的披露，以消除陈述的歧义，并在重要时向用户提供额外的详细信息（例如，与谁共享数据）。这项研究将以以用户为中心的设计方法为指导，其中新技术的设计是由人类受试者研究的结果提供信息，并且在日益丰富和现实的场景中部署和评估技术。这项研究的产品将包括原型隐私问题查询功能，以及从隐私政策文本和代码中自动提取有关数据收集和使用实践的信息的技术。该奖项反映了NSF的法定使命，并被认为值得通过使用基金会的知识价值和更广泛的影响审查标准进行评估来支持。

项目成果

Fighting the Fog: Evaluating the Clarity of Privacy Disclosures in the Age of CCPA

对抗迷雾：评估 CCPA 时代隐私披露的清晰度

• DOI: 10.1145/3463676.3485601
• 发表时间: 2021
• 期刊: WPES '21: Proceedings of the 20th Workshop on Workshop on Privacy in the Electronic Society
• 作者: Chen, Rex;Fang, Fei;Norton, Thomas;McDonald, Aleecia M.;Sadeh, Norman
• 通讯作者: Sadeh, Norman

“Did you know this camera tracks your mood?”: Understanding Privacy Expectations and Preferences in the Age of Video Analytics

– 您知道这款摄像头会追踪您的心情吗？ – 了解视频分析时代的隐私期望和偏好

• DOI: 10.2478/popets-2021-0028
• 发表时间: 2021
• 期刊: Proceedings on Privacy Enhancing Technologies
• 作者: Zhang, Shikun;Feng, Yuanyuan;Bauer, Lujo;Cranor, Lorrie Faith;Das, Anupam;Sadeh, Norman
• 通讯作者: Sadeh, Norman

From Prescription to Description: Mapping the GDPR to a Privacy Policy Corpus Annotation Scheme

从规定到描述：将 GDPR 映射到隐私政策语料库注释方案

• 发表时间: 2020
• 期刊: Frontiers in artificial intelligence and applications
• 作者: Poplavska, Ellen;Norton, Thomas B.;Wilson, Shomir;Sadeh, Norman
• 通讯作者: Sadeh, Norman

A Tale of Two Regulatory Regimes: Creation and Analysis of a Bilingual Privacy Policy Corpus

两种监管制度的故事：双语隐私政策语料库的创建和分析

• 发表时间: 2022
• 期刊: LREC proceedings
• 作者: Arora, Siddhant;Hosseini, Henry;Utz, Christine;Bannihatti, Vinayshekhar K.;Dhellemmes, Tristan;Ravichander, Abhilasha;Story, Peter;Mangat, Jasmine;Chen, Rex;Degeling, Martin
• 通讯作者: Degeling, Martin

Finding a Choice in a Haystack: Automatic Extraction of Opt-Out Statements from Privacy Policy Text

• DOI: 10.1145/3366423.3380262
• 发表时间: 2020-04
• 期刊: Proceedings of The Web Conference 2020
• 作者: Vinayshekhar Bannihatti Kumar;Roger Iyengar;N. Nisal;Yuanyuan Feng;Hana Habib;Peter Story;Sushain Cherivirala;Margaret Hagan;L. Cranor;Shomir Wilson;F. Schaub;N. Sadeh