A combined rule-based and machine learning approach for automated GDPR compliance checking
A combined rule-based and machine learning approach for automated GDPR compliance checking
复制标题
基于规则和机器学习相结合的方法，用于自动化 GDPR 合规性检查
DOI：
10.1145/3462757.3466081
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Katsiaryna Krasnashchok
中科院分区：
文献类型：
--
作者：
Rajaa El Hamdani;M. Mustapha;David Restrepo Amariles;A. Troussel;Sébastien Meeùs;Katsiaryna Krasnashchok
通用数据保护条例（GDPR）要求数据控制器实现端到端合规性。因此，控制者必须确保从数据主体到控制者、处理者和子处理者（即数据供应链）的数据流中遵守与数据主体商定的条款以及他们自己在GDPR下的义务。本文旨在通过双管齐下的研究，为合规检查的两端做出贡献。首先，我们概念化一个框架，以实现以文档为中心的方法，在数据供应链中进行遵从性检查。其次，我们开发了特定的方法来自动检查隐私政策的合规性。我们测试了一个双模块系统，其中第一个模块依赖于NLP从隐私策略中提取数据实践。第二个模块对GDPR规则进行编码，以检查是否存在强制性信息。结果表明，文本到文本方法优于局部分类器，并且仅使用一个模型即可提取粗粒度和细粒度信息。我们在法律专家注释的30个隐私政策数据集上对我们的系统进行了全面评估。我们得出结论，这种方法可以推广到数据供应中的其他文档，作为改进端到端遵从性的一种手段。
The General Data Protection Regulation (GDPR) requires data controllers to implement end-to-end compliance. Controllers must therefore ensure that the terms agreed with the data subject and their own obligations under GDPR are respected in the data flows from data subject to controllers, processors and sub processors (i.e. data supply chain). This paper seeks to contribute to bridge both ends of compliance checking through a two-pronged study. First, we conceptualize a framework to implement a document-centric approach to compliance checking in the data supply chain. Second, we develop specific methods to automate compliance checking of privacy policies. We test a two-modules system, where the first module relies on NLP to extract data practices from privacy policies. The second module encodes GDPR rules to check the presence of mandatory information. The results show that the text-to-text approach outperforms local classifiers and enables the extraction of both coarse-grained and fine-grained information with only one model. We implement full evaluation of our system on a dataset of 30 privacy policies annotated by legal experts. We conclude that this approach could be generalized to other documents in the data supply as a means to improve end-to-end compliance.
DOI：
10.3115/v1/p14-1146
发表时间：
2014-06
期刊：
--
影响因子：
--
作者：
Duyu Tang;Furu Wei;Nan Yang;M. Zhou;Ting Liu;Bing Qin
通讯作者：
Duyu Tang;Furu Wei;Nan Yang;M. Zhou;Ting Liu;Bing Qin