ASE 2024
Sun 27 October - Fri 1 November 2024 Sacramento, California, United States
Tue 29 Oct 2024 16:00 - 16:15 at Gardenia - GDPR and privacy Chair(s): Lina Marsso

Software systems involving personal data processing must adhere to the legal obligations stipulated both at a general level in the General Data Protection Regulation (GDPR) as well as the obligations outlined in data processing agreements (DPAs) that highlight specific business needs. DPAs are regulated documents laying out data processing requirements to ensure that personal data remains protected. In other words, a DPA is yet another source from which requirements engineers can elicit legal requirements. Eliciting requirements that would cover the complete set of obligations requires that the DPA is complete according to GDPR. In this paper, we propose multiple automated solutions for checking the completeness of DPAs against GDPR provisions. Specifically, we pursue ten alternative solutions enabled by different technologies, namely traditional machine learning, deep learning, language modeling, and few-shot learning. The goal of our work is to empirically assess how these technologies fare in the legal domain. We computed F2 score on a set of 30 real DPAs. Our evaluation shows that best-performing solutions yield F2 score of 86.7% and 89.7% are based on pre-trained BERT and RoBERTa language models. Our analysis further shows that other alternative solutions based on deep learning (e.g., BiLSTM) and few-shot learning (e.g., SetFit) can achieve comparable accuracy, yet are more efficient to develop.

Tue 29 Oct

Displayed time zone: Pacific Time (US & Canada) change

15:30 - 16:30
GDPR and privacyTool Demonstrations / Research Papers / Journal-first Papers at Gardenia
Chair(s): Lina Marsso University of Toronto
15:30
15m
Talk
Giving without Notifying: Assessing Compliance of Data Transmission in Android Apps
Research Papers
Ming Fan Xi'an Jiaotong University, Jifei Shi Xi'an Jiaotong University, Yin Wang Xi'an Jiaotong University, Le Yu Nanjing University of Posts and Telecommunications, Xicheng Zhang Xi'an Jiaotong University, Haijun Wang Xi’an Jiaotong University, Wuxia Jin Xi'an Jiaotong University, Ting Liu Xi'an Jiaotong University
15:45
15m
Talk
MiniChecker: Detecting Data Privacy Risk of Abusive Permission Request Behavior in Mini-ProgramsACM SigSoft Distinguished Paper Award
Research Papers
Yin Wang Xi'an Jiaotong University, Ming Fan Xi'an Jiaotong University, Hao Zhou Pattern, Recognition Center, WeChat, Tencent, Haijun Wang Xi’an Jiaotong University, Wuxia Jin Xi'an Jiaotong University, Jiajia Li Ant Group, Wenbo Chen Ant Group, Shijie Li Ant Group, Yu Zhang Ant Group, Deqiang Han Xi'an Jiaotong University, Ting Liu Xi'an Jiaotong University
16:00
15m
Talk
A Multi-solution Study on GDPR AI-enabled Completeness Checking of DPAs
Journal-first Papers
Muhammad Ilyas Azeem Institute of Software Chinese Academy of Sciences, Sallam Abualhaija University of Luxembourg
16:15
10m
Talk
CompAi: A Tool for GDPR Completeness Checking of Privacy Policies using Artificial Intelligence
Tool Demonstrations
Orlando Amaral University of Luxembourg, Sallam Abualhaija University of Luxembourg, Lionel Briand University of Ottawa, Canada; Lero centre, University of Limerick, Ireland