Data Protection by Design Tool for Automated GDPR Compliance Verification Based on Semantically Modeled Informed Consent

Abstract

The enforcement of the GDPR in May 2018 has led to a paradigm shift in data protection. Organizations face significant challenges, such as demonstrating compliance (or auditability) and automated compliance verification due to the complex and dynamic nature of consent, as well as the scale at which compliance verification must be performed. Furthermore, the GDPR’s promotion of data protection by design and industrial interoperability requirements has created new technical challenges, as they require significant changes in the design and implementation of systems that handle personal data. We present a scalable data protection by design tool for automated compliance verification and auditability based on informed consent that is modeled with a knowledge graph. Automated compliance verification is made possible by implementing a regulation-to-code process that translates GDPR regulations into well-defined technical and organizational measures and, ultimately, software code. We demonstrate the effectiveness of the tool in the insurance and smart cities domains. We highlight ways in which our tool can be adapted to other domains.

Advancing accountability in AI

“…a complex but fully accessible deep learning model with billions of parameters). 9 Hupont et al (2022) provide an overview of documentation obligations to satisfy transparency requirements included in the proposed EU AI Act. 10 Some research argues that the explainability vs. performance trade-off is not so relevant in cases where the objective function is explainable.…”

Automated GDPR Contract Compliance Verification Using Knowledge Graphs

“…The smashHitCore ontology [45] is developed to perform GDPR compliance verification checks based on consent and contracts. In this paper, we only describe and present the semanticbased contract model, while the semantic representation of consent is presented in [24].…”

“…Furthermore, in comparison to the diverse consent ontologies that are available, as shown in [8], there are few ontologies that model contracts based on GDPR. Following this and our previous work in [24], we present a KG-based solution for digital contracting, which has the following functionalities: (i) binding GDPR with data sharing contracts and (ii) performing CCV checks on contracts.…”

“…In UC1 and UC2 as discussed above, the usage of web technologies in combination with semantic technologies ensures information reusability, reliability, and inference to support the end users on the web [23]. The use of KGs for consent-based GDPR compliance has already proven to be beneficial in our previous work presented in [24]. In our earlier work [24], we proposed and developed a scalable data protection by design tools for automated compliance verification and auditability based on informed consent using KGs.…”

“…The use of KGs for consent-based GDPR compliance has already proven to be beneficial in our previous work presented in [24]. In our earlier work [24], we proposed and developed a scalable data protection by design tools for automated compliance verification and auditability based on informed consent using KGs. This research focuses on performing GDPR contract compliance verification, where consent is not enough, for example, in online services [6].…”