A Scalable Consent, Transparency and Compliance Architecture

Kirrane, Sabrina; Fernández, Javier D.; Dullaert, W.E.H. (Wout); Milošević, Uroš; Polleres, Axel; Bonatti, Piero A.; Wenning, Rigo; Drozd, Olha; Raschke, Philip

doi:10.1007/978-3-319-98192-5_25

Cited by 30 publications

(24 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…SPIRIT [7], SPECIAL [8], and the work presented in [19] have concepts related to data subjects, purposes, and data processing activities that are relevant. Those vocabularies were, however, mostly developed for a posteriori compliance analysis of logs or assessing operations before their execution.…”

Section: Consent Ontology: Related and Prior Workmentioning

confidence: 99%

“…a dictionary). Notice on line 17, we rely on strSplit function offered by Apache Jena's SPARQL processor 8 to split a string into a list. Such a function was, unfortunately, not available in SPARQL.…”

Section: Step 2: Generation Of An R2rml Mappingmentioning

confidence: 99%

“…Our prior [2,[4][5][6] and related [7,8] work addressed problems of representing aspects of GDPR [2,4,6], the various interactions between stakeholders [2,6] and representing (informed) consent [2,5,9]. Only a few studies, including ours, demonstrate how this information can be rendered actionable, namely: [5] maps consent information to eXtensible Access Control Markup Language (XACML) for managing access to data; and SPECIAL [8] analyses the compliance of a process before execution. Rather than analysing the processes (before or after execution), we want to investigate whether an organization can also use this information for the creation of a compliant dataset, therefore, guaranteeing a compliant execution of a process.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

“Just-in-time” generation of datasets by considering structured representations of given consent for GDPR compliance

et al. 2020

View full text Add to dashboard Cite

Data processing is increasingly becoming the subject of various policies and regulations, such as the European General Data Protection Regulation (GDPR) that came into effect in May 2018. One important aspect of GDPR is informed consent, which captures one's permission for using one's personal information for specific data processing purposes. Organizations must demonstrate that they comply with these policies. The fines that come with non-compliance are of such importance that it has driven research in facilitating compliance verification. The state-of-the-art primarily focuses on, for instance, the analysis of prescriptive models and posthoc analysis on logs to check whether data processing is compliant to GDPR. We argue that GDPR compliance can be facilitated by ensuring datasets used in processing activities are compliant with consent from the very start. The problem addressed in this paper is how we can generate datasets that comply with given consent "just-in-time". We propose RDF and OWL ontologies to represent the consent that an organization has collected and its relationship with data processing purposes. We use this ontology to annotate schemas, allowing us to generate declarative mappings that transform (relational) data into RDF driven by the annotations. We furthermore demonstrate how we can create compliant datasets by altering the results of the mapping. The use of RDF and OWL allows us to implement the entire process in a declarative manner using SPARQL. We have integrated all components in a service that furthermore captures provenance information for each step, further contributing to the transparency that is needed towards facilitating compliance verification. We demonstrate the approach with a synthetic dataset simulating users (re-)giving, withdrawing, and rejecting their consent on data processing purposes of systems. In summary, it is argued that B Christophe Debruyne debruync@tcd.ie Harshvardhan J. Pandit 123 3616 C. Debruyne et al.the approach facilitates transparency and compliance verification from the start, reducing the need for posthoc compliance analysis common in the state-of-the-art.

show abstract

Section: Consent Ontology: Related and Prior Workmentioning

confidence: 99%

Section: Step 2: Generation Of An R2rml Mappingmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

“Just-in-time” generation of datasets by considering structured representations of given consent for GDPR compliance

et al. 2020

View full text Add to dashboard Cite

show abstract

“…Their work encodes the consent collected in the past and has a representation for purposes. In [14], the authors demonstrated the SPECIAL consent, transparency and compliance system. They also used RDF for representing concepts such as purpose.…”

Section: Related Workmentioning

confidence: 99%

“…They then avail of "OWL reasoning to verify whether the authorized operations specified by a data subject through their given consent, subsume the specific data processing records in the transparency log." [14] Both studies have models for similar concept (data subject --or the person, purpose, etc.). And both studies aim to analyze compliance based on logs (thus a posteriori) and to present the results of that analysis in a dashboard.…”

Section: Related Workmentioning

confidence: 99%

Towards Generating Policy-Compliant Datasets

Debruyne

Pandit

Lewis

et al. 2019

2019 IEEE 13th International Conference on Semantic Computing (ICSC)

View full text Add to dashboard Cite

The development of intelligent (e.g., AI-based) applications increasingly requires governance models and processes, as financial legal sanctions are more and more being associated with violation of policies. We propose an ontology representing the informed consent that was collected by an organization and argue how it can be used to assess a dataset prior its use in any type of data processing activities. We demonstrate the utility of our ontology using a particular scenario, where datasets are generated "just in time" for a particular purpose such as sending newsletters. This scenario shows how data processing activities can be managed to in such a way as to support compliance verification. This paper furthermore compares the contributions to related work and positions it into prior work concerned with the broader problem of prescribing and analyzing compliance.

show abstract