Collaborative Research: DASS: Assessing the Relationship Between Privacy Regulations and Software Development to Improve Rulemaking and Compliance

现代互联网中监控经济的出现，极大地改变了人们对隐私的理解。世界各国政府提出了各种立法解决方案，以鼓励处理个人身份信息的公司采取负责任的行为。然而，监管和软件设计之间的关系，以及执法模式在促进普遍遵守数据保护标准方面的最终效力，是很难衡量的。这项研究利用法律和工程专家的联合团队，提供了第一个工具来系统地评估隐私法如何影响软件开发中处理个人身份信息的方法，为基于主动而不是被动的执法模式的新监管范式奠定了基础，这种执法模式依赖于大规模自动通知，而不是劳动密集型的个人执法行动。该研究首先对隐私立法进行了全面研究，包括对比执法方法。然后，调查人员将开发一个基于机器学习和程序分析的自动框架，以评估隐私法规对现实世界软件的影响。最后，调查人员将利用前两项活动的数据，得出结论，说明如何改进监管和执行模式，以便在软件开发人员中建立更有效的合规模式。除了为提高隐私立法的效率和效力提供具体经验教训外，这项研究还将推进程序分析和自然语言处理技术，以提取复杂的软件信息并验证隐私法规的遵从性。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The advent of the surveillance economy in the modern Internet has significantly transformed understandings of privacy. Governments worldwide have proposed various legislative solutions to encourage responsible behavior by companies handling personally identifiable information. However, the relationship between regulation and software design, and the ultimate efficacy of enforcement paradigms at promoting widespread compliance with data protection standards, are difficult to measure. This research leverages a combined team of legal and engineering experts to provide the first tool to systematically evaluate how privacy laws impact approaches to personally identifiable information in software development, laying the foundation for a new regulatory paradigm based on proactive, rather than reactive, models of enforcement, which rely on mass automated notifications rather than labor-intensive individual enforcement actions.The research begins with a comprehensive study of privacy legislation, including contrasting approaches to enforcement. The investigators will then develop an automatic framework based on machine learning and program analysis to assess the impact of privacy regulations on real-world software. Lastly, the investigators will utilize the data from the previous two activities to develop conclusions on how regulatory and enforcement paradigms can be improved to develop more effective models of compliance among software developers. In addition to generating concrete lessons for improving the efficiency and efficacy of privacy legislation, the research will advance program analysis and natural language processing techniques for extracting complex software information and verifying compliance with privacy regulationsThis award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.