Collaborative Research: DASS: Assessing the Relationship Between Privacy Regulations and Software Development to Improve Rulemaking and Compliance

现代互联网中监控经济的出现极大地改变了人们对隐私的理解。世界各国政府提出了各种立法解决方案，以鼓励公司在处理个人身份信息时采取负责任的行为。然而，监管与软件设计之间的关系，以及执法范式在促进广泛遵守数据保护标准方面的最终效果，都很难衡量。这项研究利用法律和工程专家的联合团队，提供了第一个工具来系统地评估隐私法如何影响软件开发中个人可识别信息的方法，为基于主动而不是被动的执行模型的新监管范式奠定基础，这种模型依赖于大量自动通知，而不是劳动密集型的个人执行行动。这项研究从对隐私立法的全面研究开始，包括对执法方法的对比。然后，调查人员将开发一个基于机器学习和程序分析的自动框架，以评估隐私法规对现实世界软件的影响。最后，调查人员将利用前两项活动的数据得出结论，说明如何改进监管和执行范例，从而在软件开发人员中开发更有效的合规模型。除了为提高隐私立法的效率和效力提供具体的经验教训外，该研究还将推进程序分析和自然语言处理技术，以提取复杂的软件信息并验证是否符合隐私法规。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的智力价值和更广泛的影响审查标准进行评估，被认为值得支持。

The advent of the surveillance economy in the modern Internet has significantly transformed understandings of privacy. Governments worldwide have proposed various legislative solutions to encourage responsible behavior by companies handling personally identifiable information. However, the relationship between regulation and software design, and the ultimate efficacy of enforcement paradigms at promoting widespread compliance with data protection standards, are difficult to measure. This research leverages a combined team of legal and engineering experts to provide the first tool to systematically evaluate how privacy laws impact approaches to personally identifiable information in software development, laying the foundation for a new regulatory paradigm based on proactive, rather than reactive, models of enforcement, which rely on mass automated notifications rather than labor-intensive individual enforcement actions.The research begins with a comprehensive study of privacy legislation, including contrasting approaches to enforcement. The investigators will then develop an automatic framework based on machine learning and program analysis to assess the impact of privacy regulations on real-world software. Lastly, the investigators will utilize the data from the previous two activities to develop conclusions on how regulatory and enforcement paradigms can be improved to develop more effective models of compliance among software developers. In addition to generating concrete lessons for improving the efficiency and efficacy of privacy legislation, the research will advance program analysis and natural language processing techniques for extracting complex software information and verifying compliance with privacy regulationsThis award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.