A Model-based Conceptualization of Requirements for Compliance Checking of Data Processing against GDPR

Abstract

The General Data Protection Regulation (GDPR) has been recently introduced to harmonize the different data privacy laws across Europe. Whether inside the EU or outside, organizations have to comply with the GDPR as long as they handle personal data of EU residents. The organizations with whom personal data is shared are referred to as data controllers. When controllers subcontract certain services that involve processing personal data to service providers (also known as data processors), then a data processing agreement (DPA) has to be issued. This agreement regulates the relationship between the controllers and processors and also ensures the protection of individuals' personal data. Compliance with the GDPR is challenging for organizations since it is large and relies on complex legal concepts. In this paper, we draw on model-driven engineering to build a machine-analyzable conceptual model that characterizes DPA-related requirements in the GDPR. Further, we create a set of criteria for checking the compliance of a given DPA against the GDPR and discuss how our work in this paper can be adapted to develop an automated compliance checking solution.

Analyzing and Debugging Normative Requirements via Satisfiability Checking

“…The case studies were as follows. ( 1) ALMI [17]: a system assisting elderly and disabled users in a monitoring or advisory role and with physical tasks; (2) ASPEN [10]: an autonomous agent dedicated to forest protection, providing both diagnosis and treatment of various tree pests and diseases; (3) AutoCar [3]: a system that implements emergency-vehicle priority awareness for autonomous vehicles; (4) BSN [15]: a healthcare system detecting emergencies by continuously monitoring the patient's health status; (5) Dres-sAssist [20,36]: an assistive and supportive system used to dress and provide basic care for the elderly, children, and those with disabilities; (6) CSI-Cobot [35]: a system ensuring the safe integration of industrial collaborative robot manipulators; (7) DAISY [8]: a sociotechnical AI-supported system that directs patients through an A&E triage pathway; (8) DPA [1]: a system to check the compliance of data processing agreements against the General Data Protection Regulation; (9) SafeSCAD [7]: a driver attentiveness management system to support safe shared control of autonomous vehicles. Case studies were chosen (i) to test whether our approach scales with case studies involving complex N-NFRs with numerous defeaters and time constraints (AutoCar, DAISY, DressAssist); (ii) to examine the benefits of our approach on early-stage case studies (e.g., ASPEN and AutoCar), as compared to those at a more advanced stage (e.g., ALMI, DPA, BSN); (iii) to compare case studies involving many stakeholders (DressAssist, and DAISY) with those having fewer ones (DPA and AutoCar), and (iv) to consider different domains including the environment, healthcare, and transport.…”

“…The rule 𝑟 1 is situational conflicting in the situation (𝜎 1 , *) where 𝜎 1 = (𝑟 1 , 𝑟 2 , 𝑟 3 , 𝑟 4 , M 1 , 1) because, according to 𝑟 1 and 𝑟 2 , 𝑒 2 must occur within the interval (4,5]. Additionally, based on 𝑟 3 and 𝑟 4 , the event 𝑒 3 must occur at a time 𝑡 ∈ (1,3]. For all possible values of 𝑡, according to 𝑟 2 , 𝑒 2 cannot occur within the interval (𝑡, 𝑡 + 4], which covers the interval (4, 5] and thus conflicts with 𝑟 1 .…”

“…𝑟 5 is normalized as "when OpenCurtainRequest and not underDressed then OpenCurtain within 30 minutes". 1 A translation from SLEEC DSL to the normalized form is provided in Appendix A and implemented in LEGOS-SLEEC.…”

ML-Based Compliance Verification of Data Processing Agreements against GDPR

“…For instance, software must include stronger authentication mechanisms to ensure data protection. In a recent paper, Amaral et al [29] propose eliciting DPA-related requirements from GDPR and documenting them in NL as "shall" requirements. The authors further develop a rule-based automation (referred to as DERECHA) that verifies whether DPAs satisfy GDPR requirements based on the semantics of the DPAs' textual content.…”

“…(1) We create, building on existing work in RE [29], [37], a holistic representation of DPA-related GDPR requirements in the form of a conceptual model that contains a total of 63 information types capturing any content to be expected in a GDPR-compliant DPA. We describe our model in Section IV.…”