PrivOnto: A semantic framework for the analysis of privacy policies

Abstract

Privacy policies are intended to inform users about the collection and use of their data by websites, mobile apps and other services or appliances they interact with. This also includes informing users about any choices they might have regarding such data practices. However, few users read these often long privacy policies; and those who do have difficulty understanding them, because they are written in convoluted and ambiguous language. A promising approach to help overcome this situation revolves around semi-automatically annotating policies, using combinations of crowdsourcing, machine learning and natural language processing. In this article, we introduce PrivOnto, a semantic framework to represent annotated privacy policies. PrivOnto relies on an ontology developed to represent issues identified as critical to users and/or legal experts. PrivOnto has been used to analyze a corpus of over 23,000 annotated data practices, extracted from 115 privacy policies of US-based companies. We introduce a collection of 57 SPARQL queries to extract information from the PrivOnto knowledge base, with the dual objective of (1) answering privacy questions of interest to users and (2) supporting researchers and regulators in the analysis of privacy policies at scale. We present an interactive online tool using PrivOnto to help users explore our corpus of 23,000 annotated data practices. Finally, we outline future research and open challenges in using semantic technologies for privacy policy analysis.

Question Answering for Privacy Policies: Combining Computational and Legal Perspectives

“…Prescriptive approaches towards communicating privacy information (Kelley et al, 2009;Micheti et al, 2010;Cranor, 2003) have not been widely adopted by industry. Recently, there have been significant research effort devoted to understanding privacy policies by leveraging NLP techniques Oltramari et al, 2017;Mysore Sathyendra et al, 2017;, especially by identifying specific data practices within a privacy policy. We adopt a personalized approach to understanding privacy policies, that allows users to query a document and selectively explore content salient to them.…”

Privacy, security and policies: A review of problems and solutions with semantic web technologies

“…Those works strongly relate to the idea of making policies understandable to the consumers of data and information services, with Semantic Web technologies having a role to play in the task of Policy Interpretation. Works such as [32] and [6] specifically address this task in the context of privacy policies, while for IP policies, current works remain limited to usage monitoring. In addition to the challenging issue of Usage Monitoring, the problem of Compatibility testing has been addressed by combining deontic logic and Semantic Web technologies and languages [21].…”

“…To do that, we create a corpus of papers and articles that directly address one or more of those aspects. We start with the works published in the Special Issue of the Semantic Web Journal on Security, Privacy and Policies (for which this article acts as editorial), namely: -PrivOnto: a Semantic Framework for the Analysis of Privacy Policies [32], which presents an ontology for annotating privacy policies for the purpose of supporting users in understanding and interpreting them. -Reasoning with Data Flows and Policy Propagation Rules [11], which proposes a framework for reasoning upon the propagation of data reuse and redistribution policies (especially data licences) across the workflows that manipulate them.…”

“…Besides the aforementioned groups, several works including [32] or [6] look at privacy from a broader perspective, especially connecting privacy issues around Information Dissemination-Increased accessibility with the communication or interpretation of privacy policies and privacy preferences.…”

Composite Service-Oriented Minimum Privacy Disclosure Method

“…Oltramari A et al [20] introduce PrivOnto, a semantic framework to represent annotated privacy policies, represent issues identified as critical to users and/or legal experts. Wei She et al [21] focused on access control validation at composition time, which may be used to control the service providers accessing the user's private data.…”