SaTC: CORE: Medium: Collaborative: Automatically Answering People's Privacy Questions

SaTC：核心：媒介：协作：自动回答人们的隐私问题

• 批准号: 1914444
• 负责人: Shomir Wilson
• 金额: $ 43.74万
• 依托单位: Pennsylvania State Univ University Park
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2019
• 资助国家: 美国
• 起止时间: 2019-07-15 至 2024-12-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1914444&HistoricalAwards=false
• 关键词: SaTC; CORE; Medium; Collaborative; Automatically

As novel technologies collect increasingly large and diverse amounts of data about us, people are unable to keep up and retain control over what happens to their data. The current legal approach to privacy concentrates on the concept of "Notice and Choice", namely the expectation that people are provided sufficient information about the collection and use of their data, and are offered meaningful choices about these practices (e.g., opt out, opt in). A primary element of this approach relies on privacy policies to communicate this information to people. In practice, these policies tend to be long, vague and ambiguous. Not too surprisingly, few people find the time to read them and those who do often struggle to understand what they say. This multi-disciplinary project aims to develop novel technology that will enable people to regain a sense of control by enabling them to simply ask questions about the privacy issues that matter to them rather than requiring them to read long, one-size-fits all privacy policies. In addition to producing new knowledge and technologies and contributing to improving the state of privacy in the United States, this project will also create education and research opportunities for both undergraduate and graduate students at participating universities, including activities to broaden participation of women and under-represented minorities in this important area of computer science, and contribute to the development of technologies with the potential to help the visually impaired take advantage of information found in the text of privacy policies.This multi-disciplinary project builds on recent advances in natural language processing, machine learning, code analysis and user modeling to re-invent notice and choice, moving from long and hard-to-understand notices to interactive privacy dialogues with users. An important part of this research involves the development of question answering functionality that enables users to ask questions about those issues that truly matter to them rather than presenting them with one-size-fits-all privacy notices. Another involves supplementing disclosures found in privacy policies with additional sources of information such as background knowledge (e.g. knowledge about common data practices and relevant laws) and code analysis to disambiguate statements and provide additional details to users when it matters (e.g., with whom their data is actually shared). This research will be guided by user-centered design methodologies where the design of novel technologies is informed by findings from human subject studies, and where technologies are deployed and evaluated in increasingly rich and realistic scenarios. Products of this research will include prototype privacy Question Answering functionality, as well as technology to automatically extract information about data collection and use practices from both the text of privacy policies and from code.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

随着新技术收集关于我们的越来越大量和多样化的数据，人们无法跟上和保持对他们的数据发生的事情的控制。目前对隐私的法律做法集中在“通知和选择”的概念上，即期望向人们提供关于收集和使用其数据的足够信息，并就这些做法提供有意义的选择(例如，选择退出或选择加入)。这种方法的一个主要元素依赖于隐私策略来将这些信息传达给人们。在实践中，这些政策往往冗长、模糊和模棱两可。不出所料，很少有人会抽出时间去阅读它们，而那些有时间阅读的人往往很难理解它们所说的话。这个跨学科的项目旨在开发新的技术，使人们能够通过简单地询问与他们有关的隐私问题来重新获得控制感，而不是要求他们阅读长篇、一刀切的隐私政策。除了产生新的知识和技术并有助于改善美国的隐私状况外，该项目还将为参与的大学的本科生和研究生创造教育和研究机会，包括扩大女性和未被充分代表的少数群体在这一重要计算机科学领域的参与，并有助于开发有潜力的技术，帮助视障人士利用隐私政策文本中的信息。这个多学科项目建立在自然语言处理、机器学习、代码分析和用户建模的最新进展基础上，以重新发明注意和选择，从冗长难懂的通知转向与用户的互动隐私对话。这项研究的一个重要部分是开发问答功能，使用户能够就那些对他们真正重要的问题提出问题，而不是向他们提供一刀切的隐私通知。另一项涉及用额外的信息来源补充隐私政策中的披露，如背景知识(例如，关于常见数据做法和相关法律的知识)和代码分析，以消除陈述的歧义，并在重要时(例如，他们的数据实际上与谁共享)向用户提供更多细节。这项研究将以以用户为中心的设计方法为指导，其中新技术的设计以人类主题研究的结果为依据，并在日益丰富和现实的情况下部署和评估技术。这项研究的产品将包括原型隐私问题回答功能，以及从隐私政策文本和代码中自动提取有关数据收集和使用实践的信息的技术。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

项目成果

Question Answering for Privacy Policies: Combining Computational and Legal Perspectives

• DOI: 10.18653/v1/d19-1500
• 发表时间: 2019-11
• 期刊: ArXiv
• 作者: Abhilasha Ravichander;A. Black;Shomir Wilson;Thomas B. Norton;N. Sadeh

Finding a Choice in a Haystack: Automatic Extraction of Opt-Out Statements from Privacy Policy Text

• DOI: 10.1145/3366423.3380262
• 发表时间: 2020-04
• 期刊: Proceedings of The Web Conference 2020
• 作者: Vinayshekhar Bannihatti Kumar;Roger Iyengar;N. Nisal;Yuanyuan Feng;Hana Habib;Peter Story;Sushain Cherivirala;Margaret Hagan;L. Cranor;Shomir Wilson;F. Schaub;N. Sadeh

From Prescription to Description: Mapping the GDPR to a Privacy Policy Corpus Annotation Scheme

从规定到描述：将 GDPR 映射到隐私政策语料库注释方案

• 发表时间: 2020
• 期刊: Frontiers in artificial intelligence and applications
• 作者: Poplavska, Ellen;Norton, Thomas B.;Wilson, Shomir;Sadeh, Norman
• 通讯作者: Sadeh, Norman