Challenges in the Digital Representation of Privacy Terms

Abstract

This paper aims to describe a research project focused on the digital representation of information related to the privacy and data protection domain. Currently, privacy policies are used by data controllers as a tool to achieve compliance with data protection regulations such as the EU GDPR, instead of being a privacy instrument at the disposal of both controllers and data subjects. On the other hand, data subjects lack the tools to effectively establish preferences when it comes to the processing and disclosure of their personal data, as well as to easily exercise their rights. In this regard, this paper discusses the challenges of the implementation of a service based on decentralised Web technologies and Semantic Web standards and specifications to facilitate the communication between data subjects and data controllers in the light of the GDPR. The main challenges that this service intends to address are linked to the exercising of GDPR-related rights and obligations, the negotiation of privacy terms and the governance of access to personal data stores. A case study in the healthcare and genomics domain will be explored to experiment with the developed tools. Early-stage results related to the implementation of semantic policies for the representation of GDPR rights and obligations are presented.

A Systematic Review on Privacy-Aware IoT Personal Data Stores

“…Perspective Technology Domain P1 [34] User control x General personal data P5 [38] User control My Data Store Personal data from apps and sensors P32 [65] Regulation x General personal data P34 [6] Regulation x General personal data P48 [80] User control Solid Health personal data P1 [34] proposed a new user-centric model for Personal Data (PD) management, addressing the dilemma of balancing the exploitation of PD and the development of more personalized applications while protecting individual privacy. The concept revolves around empowering individuals with control over the entire PD lifecycle, encompassing data acquisition, storage, processing, and sharing.…”

“…P34 [6] concentrated on digitizing privacy and data protection details, exploring the intricacies of implementing a service utilizing decentralized web technologies and semantic web standards and specifications. The primary aim was to streamline communication between data subjects and data controllers while ensuring compliance with GDPR regulations.…”

“…He states that privacy is "the right to select what personal information about me is known to what people", emphasizing the user's right to control [5]. As such, users have been claiming their privacy protection and looking for ways to control their data and ensure its protection [6].…”

Data Privacy Vocabulary (DPV) - Version 2

“…Year Mention Use Extension Contributed Domain [11] 2020 X Health [53] 2020 X Media [7,54,81] 2020 X [12,47,51,71] 2020 X [10] 2020 X Health [15,60,74] 2020 X X [17,55,29] 2021 X Health [37,6,76,62,39] 2021 X [72,20,16,73,52] 2021 X [34] 2021 X Smart products [42] 2021 X X [44,46,43,75,59,66,22] 2022 X [21] 2022 X X [69,70,57,23] 2022 X X [5] 2022 X Health [25,14,13,32,50] 2022 X [4] 2022 X IoT [40] 2022 X Health [58,…”