An empirical study of natural language parsing of privacy policy rules using the SPARCLE policy workbench

Abstract

Today organizations do not have good ways of linking their written privacy policies with the implementation of those policies. To assist organizations in addressing this issue, our humancentered research has focused on understanding organizational privacy management needs, and, based on those needs, creating a usable and effective policy workbench called SPARCLE. SPARCLE will enable organizational users to enter policies in natural language, parse the policies to identify policy elements and then generate a machine readable (XML) version of the policy. In the future, SPARCLE will then enable mapping of policies to the organization's configuration and provide audit and compliance tools to ensure that the policy implementation operates as intended.In this paper, we present the strategies employed in the design and implementation of the natural language parsing capabilities that are part of the functional version of the SPARCLE authoring utility. We have created a set of grammars which execute on a shallow parser that are designed to identify the rule elements in privacy policy rules. We present empirical usability evaluation data from target organizational users of the SPARCLE system and highlight the parsing accuracy of the system with the organizations' privacy policies. The successful implementation of the parsing capabilities is an important step towards our goal of providing a usable and effective method for organizations to link the natural language version of privacy policies to their implementation, and subsequent verification through compliance auditing of the enforcement logs.

From Regulatory Texts to BRMS: How to Guide the Acquisition of Business Rules?

“…They allow to reformulate rules in a way that is still readable for the user and is easier to formalize than NL. In the Business Rules domain, CLs are used in Oracle Policy Modeling Suite 3 , in IBM SPARCLE policy workbench [4]. Other in use controlled languages have been described by RuleSpeak [16], by Atempto Controlled English (http://attempto.ifi.uzh.ch/site/docs/).…”

“…SBVR (Semantics of Business Vocabulary and Rules) can be seen as a synthesis of several efforts and a standard independent of English or any natural language. It has been accepted by the OMG (Object Management Group) 4 . We refer to the English version of SBVR CL, namely SBVR Structured English (SBVR-SE).…”

A Formal Privacy Management Framework

“…The parameters of external events take values in the following domains: The main domains are defined as follows 8 :…”

“…However our main target is the definition of privacy policies (by subjects as well as controllers) and their correct implementation (as opposed to the analysis or translation of regulations in [6], [7] and [26]). We also share with the Sparcle project ( [8] and [17]) the objective of assisting users to edit privacy policies expressed in a natural language but the user interface issues have been left outside the scope of this paper.…”

Unsupervised Alignment of Privacy Policies using Hidden Markov Models

“…Past applications of NLP have sought to parse privacy policies into machine-readable representations (Brodie et al, 2006) or extract subpolicies from larger documents (Xiao et al, 2012). Machine learning has been applied to assess certain attributes of policies (Costante et al, 2012;Ammar et al, 2012;Costante et al, 2013;Zimmeck and Bellovin, 2013).…”