Towards Legal Compliance by Correlating Standards and Laws with a Semi-automated Methodology

Abstract

Abstract. Since generally legal regulations do not provide clear parameters to determine when their requirements are met, achieving legal compliance is not trivial. The adoption of standards could help create an argument of compliance in favour of the implementing party, provided there is a clear correspondence between the provisions of a specific standard and the regulation's requirements. However, identifying such correspondences is a complex process which is complicated further by the fact that the established correlations may be overridden in time e.g., because newer court decisions change the interpretation of certain legal provisions. To help solve these problems, we present a framework that supports legal experts in recognizing correlations between provisions in a standard and requirements in a given law. The framework relies on state-of-the-art Natural Language Semantics techniques to process the linguistic terms of the two documents, and maintains a knowledge base of the logic representations of the terms, together with their defeasible correlations, both formal and substantive. An application of the framework is shown by comparing a provision of the European General Data Protection Regulation with the ISO/IEC 27018:2014 standard.

Standardisation, Data Interoperability, and GDPR

“…To this end, there have been several critical studies that provide an overview of legal ontologies to date (Leone, Di Caro, & Villata, 2019;Rodrigues, Freitas, Barreiros, Azevedo, & de Almeida Filho, 2019) that present the state of legal ontologies and their usage in the community. At the same time, there are efforts to automate the association of legal requirements with applicable standards -specifically those regarding GDPR and ISO (Bartolini, Giurgiu, Lenzini, & Robaldo, 2017). This provides an important step in the automation of legal compliance by enabling machine-readable and queryable information regarding applicable standards for a specific legal clause.…”

Formalizing GDPR Provisions in Reified I/O Logic: The DAPRECO Knowledge Base

“…∃ ee [(RexistAtT ime e e t) ∧ (elegant e e x)] ) ∈ C A more complex example, taken from the DAPRECO knowledge base, is the representation in reified Input/Output logic of the provision in Article 12, paragraph 7, of the GDPR, shown in (13). Other examples are provided in (Bartolini et al, 2016;).…”

“…Within the DAPRECO project we provide some possible, early legal interpretations of GDPR provisions in terms of correlations between them and the controls in some ISO security standards (see (Bartolini et al, 2016)).…”

The DAta Protection REgulation COmpliance Model

“…The second requirement can easily be satisfied when definitions are available (such is the case in the GDPR and in ISO 27018), so that matching definitions can correspond to equivalent concepts. For example, the definition of "personally identifiable information (PII)" in ISO 27018 (Article 3.2) is nearly identical to that of "personal data" in the GDPR [Article 4(a)], so it is safe to assume that the PII in the ISO 27018 conceptual model corresponds to the concept of personal data in privacy ontology (PrOnto) (see Palmirani et al 1 for more concrete application examples).…”

“…Using defeasibility, which is one of the features of RIO logic, the DAPRECO knowledge base can be extended by incorporating additional legal interpretations (possibly incompatible with each other) of the GDPR provisions. 1 Defeasibility is not supported in PrOnto, as it is not a feature of the OWL language.…”