A Multi-solution Study on GDPR AI-enabled Completeness Checking of DPAs
Software systems involving personal data processing must adhere to the legal obligations stipulated both at a general level in the General Data Protection Regulation (GDPR) as well as the obligations outlined in data processing agreements (DPAs) that highlight specific business needs. DPAs are regulated documents laying out data processing requirements to ensure that personal data remains protected. In other words, a DPA is yet another source from which requirements engineers can elicit legal requirements. Eliciting requirements that would cover the complete set of obligations requires that the DPA is complete according to GDPR. In this paper, we propose multiple automated solutions for checking the completeness of DPAs against GDPR provisions. Specifically, we pursue ten alternative solutions enabled by different technologies, namely traditional machine learning, deep learning, language modeling, and few-shot learning. The goal of our work is to empirically assess how these technologies fare in the legal domain. We computed F2 score on a set of 30 real DPAs. Our evaluation shows that best-performing solutions yield F2 score of 86.7% and 89.7% are based on pre-trained BERT and RoBERTa language models. Our analysis further shows that other alternative solutions based on deep learning (e.g., BiLSTM) and few-shot learning (e.g., SetFit) can achieve comparable accuracy, yet are more efficient to develop.
Tue 29 OctDisplayed time zone: Pacific Time (US & Canada) change
15:30 - 16:30 | GDPR and privacyTool Demonstrations / Research Papers / Journal-first Papers at Gardenia Chair(s): Lina Marsso University of Toronto | ||
15:30 15mTalk | Giving without Notifying: Assessing Compliance of Data Transmission in Android Apps Research Papers Ming Fan Xi'an Jiaotong University, Jifei Shi Xi'an Jiaotong University, Yin Wang Xi'an Jiaotong University, Le Yu Nanjing University of Posts and Telecommunications, Xicheng Zhang Xi'an Jiaotong University, Haijun Wang Xi’an Jiaotong University, Wuxia Jin Xi'an Jiaotong University, Ting Liu Xi'an Jiaotong University | ||
15:45 15mTalk | MiniChecker: Detecting Data Privacy Risk of Abusive Permission Request Behavior in Mini-Programs Research Papers Yin Wang Xi'an Jiaotong University, Ming Fan Xi'an Jiaotong University, Hao Zhou Pattern, Recognition Center, WeChat, Tencent, Haijun Wang Xi’an Jiaotong University, Wuxia Jin Xi'an Jiaotong University, Jiajia Li Ant Group, Wenbo Chen Ant Group, Shijie Li Ant Group, Yu Zhang Ant Group, Deqiang Han Xi'an Jiaotong University, Ting Liu Xi'an Jiaotong University | ||
16:00 15mTalk | A Multi-solution Study on GDPR AI-enabled Completeness Checking of DPAs Journal-first Papers Muhammad Ilyas Azeem Institute of Software Chinese Academy of Sciences, Sallam Abualhaija University of Luxembourg | ||
16:15 10mTalk | CompAi: A Tool for GDPR Completeness Checking of Privacy Policies using Artificial Intelligence Tool Demonstrations Orlando Amaral University of Luxembourg, Sallam Abualhaija University of Luxembourg, Lionel Briand University of Ottawa, Canada; Lero centre, University of Limerick, Ireland |