GDPR-oriented privacy policy compliance detection method

Abstract

A GDPR-oriented privacy policy compliance detection method, the requirements for privacy policy in GDPR are abstracted to form a three-level structure of GDPR knowledge graph, and the collected hierarchical privacy policy is labeled through the knowledge graph to form a GDPR-oriented privacy policy corpus; again through the GDPR-oriented privacy policy compliance detection model, whether the text in the privacy policy belongs to a certain clause in GDPR can be predicted. The present application realizes intelligent analysis and compliance detection of privacy policy covering GDPR comprehensively, and provides GDPR-oriented privacy policy compliance suggestion and detection support for online services, app and other internet services.

Description

Technical Field

[0001] This invention relates to a technology in the field of machine learning applications, specifically a method for detecting compliance with the General Data Protection Regulation (GDPR) based on knowledge graphs and machine learning. Background Technology

[0002] Existing privacy policy compliance detection methods typically perform compliance checks on individual sentences or paragraphs within the privacy policy. They utilize word embedding methods to convert sentences into vectors, and then employ machine learning or deep learning methods for compliance classification. However, current methods do not consider the contextual features of sentences or paragraphs within the privacy policy, and their compliance detection does not fully cover GDPR-related requirements. Summary of the Invention

[0003] This invention addresses the shortcomings of existing technologies in detecting the categories of items in GDPR-compliant privacy policies by proposing a method for GDPR-compliant privacy policy compliance detection. This method achieves comprehensive intelligent analysis and compliance detection of GDPR-compliant privacy policies, providing compliance suggestions and detection support for online services, apps, and other internet services.

[0004] This invention is achieved through the following technical solution:

[0005] This invention relates to a method for detecting GDPR-compliant privacy policies, comprising the following steps:

[0006] Step 1) Knowledge Graph Construction: The requirements for privacy policies in GDPR are abstracted into a three-level GDPR knowledge graph, and the collected hierarchical privacy policies are labeled through this knowledge graph to form a GDPR-oriented privacy policy corpus.

[0007] The knowledge graph consists of a graph with three levels of nodes, including 18 first-level nodes, 39 second-level nodes, and 38 third-level nodes. Each node corresponds to a requirement clause in the GDPR, and the knowledge graph summarizes the general requirements of the GDPR for privacy policies.

[0008] The corpus includes 150 privacy policies collected from online service websites. The privacy policies in this corpus have a hierarchical structure, that is, they contain multi-level headings and paragraph text information.

[0009] Step 2) Construct a compliance detection classifier. For each requirement in the GDPR knowledge graph, use relevant data from the corpus to construct a dataset, extract features containing contextual information as input to train the corresponding classifier, complete the detection classifier for each requirement in the GDPR knowledge graph, and finally form a privacy policy compliance detection model for GDPR, which can predict whether the text in the privacy policy belongs to a certain clause in GDPR.

[0010] The compliance detection classifier is a random forest model, which includes a title classifier and a paragraph classifier, which perform compliance detection on the title and prose paragraphs of the privacy policy, respectively.

[0011] Technical effect

[0012] This invention provides a compliance analysis of privacy policies in response to GDPR, covering all GDPR requirements for privacy policies, and achieves good and stable results using a machine learning-based classifier. Attached Figure Description

[0013] Figure 1 This is a diagram illustrating the overall architecture of the present invention;

[0014] Figure 2 The knowledge graph constructed for this invention;

[0015] Figure 3 The process for constructing the compliance detection classifier of this invention. Detailed Implementation

[0016] like Figure 1 As shown, this example illustrates a GDPR-oriented intelligent detection method for privacy policy compliance, comprising: knowledge graph construction and compliance detection classifier construction. Specifically, the knowledge graph construction summarizes and abstracts the general requirements of GDPR for privacy policies, constructing a three-level knowledge graph containing 95 GDPR topic tags. This knowledge graph is then used to annotate 150 hierarchical privacy policies, forming a GDPR-oriented privacy policy corpus. The compliance detection classifier trains a title classifier and a paragraph classifier for each node in the knowledge graph based on the title and paragraph text contained in each privacy policy in the corpus, ultimately forming a privacy policy compliance detection model.

[0017] The method specifically includes the following steps:

[0018] Step 1: Knowledge Graph Construction; Based on the general requirements of GDPR, a three-level knowledge graph structure is abstracted, and the collected privacy policy data is manually annotated according to the knowledge graph to form a privacy policy corpus, specifically including:

[0019] Step 1.1) Knowledge graph first-level node extraction; GDPR contains 99 chapters, which clearly require data jurisdiction, data subject rights, and data cross-border transmission. According to these requirements, 18 first-level nodes are extracted, including data controller, data subject rights, data category, data source, etc.

[0020] Step 1.2) Knowledge graph second-level node extraction; under the above first-level nodes, according to the further requirements of GDPR for some first-level nodes, such as the need to include the right to know, the right to forget, and the right to delete in data subject rights, these requirements are extracted and abstracted into second-level nodes and linked to the corresponding first-level nodes in the knowledge graph. Second-level nodes include: INFORMATION, ACCESS, WITHDRAWCONSENT under DATASUBJECT RIGHT.

[0021] Step 1.3) Knowledge graph third-level node extraction; under the above second-level nodes, according to the further requirements of GDPR for some second-level nodes, such as the telephone number of the data controller's contact information and the registration number of the data controller's identity, these requirements are extracted and abstracted into third-level nodes and linked to the corresponding second-level nodes in the knowledge graph. Third-level nodes include: REGISTERNUMBER under CONTROLER.IDENTITY.

[0022] Step 1.4) Corpus construction; the above steps construct a knowledge graph with a three-level structure as shown in Figure 2 According to the node labels in the knowledge graph, the collected 150 online service privacy policies are labeled, including the titles and paragraph texts in the privacy policies, and finally a GDPR-oriented privacy policy corpus is formed.

[0023] Step two, compliance detection classifier construction: use the privacy policy corpus constructed in step one to train the privacy policy compliance detection model, which includes a text classifier and a paragraph classifier, which can provide one or more GDPR topic labels in the knowledge graph for the title or paragraph text in the privacy policy, thereby completing the compliance detection of the privacy policy.

[0024] Step 2.1) Title classifier; according to each node in the knowledge graph, train the corresponding title binary classifier, the input of the classifier is the corresponding features of the title, and the output is whether the title is the requirement of the node in the knowledge graph.

[0025] The input features of the title classifier include the parent node label matrix of the title, the sibling node label matrix of the title, and the sentence vector of the title. The parent node label matrix of the title is the label of the parent node of the node where the current title is located in the privacy policy webpage. The sibling node label matrix of the title is the label of the sibling node of the node where the current title is located in the privacy policy webpage. Generally, when the parent node relates to a certain GDPR clause, and its sibling node also relates to the GDPR clause or a sub-clause, the current node is likely to be the corresponding GDPR clause. For example, the label of the parent node of the current node is the data subject right, the label of the sibling node is the right to delete under the data subject right, and the current node is likely to belong to the data subject right. Therefore, the parent node label and the sibling node label of the title are used as two features of the title, and each node can have multiple labels, so the parent node label and the sibling node label are input in the form of a matrix. The sentence vector feature is obtained by converting the title text into a vector using the word embedding method. In the present application, the pre-trained Glove model is used to calculate the word embedding of each word in the title. The average value of all word embeddings is taken to obtain the embedding representation of the title sentence, which is used as the sentence vector feature of the title.

[0026] The title classifier adopts the random forest (Random Forest) algorithm to construct the classifier. The input of the classifier includes the parent node label matrix of the title, the sibling node label matrix of the title, and the sentence vector of the title. The parameters of the classifier include: the random seed number is 50, and the tree depth is 5. For each node in the knowledge graph, a title classifier is constructed. The titles in the privacy policy with the label of the node and the titles with randomly selected labels of other nodes are used to construct the data set of the node. The training set and the test set are divided according to the ratio of 4:1. The 5-fold cross-validation method is used for the training of the classifier. Finally, the title classifier results of some nodes in the knowledge graph are shown in the following table.

[0027] GDPR Article P R F1 CONTROLLER.CONTACT 0.99 0.95 0.97 DATA_SUBJECT_RIGHT 0.98 0.85 0.91 DATA_SUBJECT_RIGHT.ACCESS 0.99 0.84 0.91 DATA_SUBJECT_RIGHT.RECTIFICATION 0.94 0.89 0.91 DATA_SUBJECT_RIGHT.RESTRICTION 0.99 0.83 0.90 DATA_SUBJECT_RIGHT.ERASURE 0.99 0.88 0.93 DATA_SUBJECT_RIGHT.OBJECT 1 1 1 UNKNOWN 0.91 0.79 0.84

[0028] In the table, the precision (precision) represents the probability of actual positive samples in all predicted positive samples. The recall (recall) represents the probability of predicted positive samples in actual positive samples.

[0029] Step 2.2) paragraph classifier; according to each node in the knowledge graph, a corresponding paragraph binary classifier is trained. The input of the classifier is the corresponding feature of the paragraph, and the output is whether the paragraph is the requirement of the node in the knowledge graph.

[0030] The input of the paragraph classifier is the corresponding features of the paragraph, including the parent node label matrix of the paragraph, the sibling node label matrix of the paragraph, the sentence vector of the paragraph, and the keyword label matrix of the paragraph. The parent node label matrix of the paragraph, the sibling node label matrix of the paragraph, and the sentence vector feature of the paragraph are calculated in the same way as the title feature. The parent node label matrix of the paragraph is the label of the parent node of the node where the current paragraph in the privacy policy webpage is located. The sibling node label matrix of the paragraph is the label of the sibling node of the node where the current paragraph in the privacy policy webpage is located. The sentence vector is calculated by using the pre-trained Glove model to calculate the word embedding of each word in the paragraph, and the embedding representation of the paragraph sentence is obtained by averaging all word embeddings, which is used as the sentence vector feature of the paragraph. Compared with the title, the paragraph is usually a long text containing more redundant information. Therefore, in order to reduce the influence of redundant information in the paragraph on the classifier, the keyword label matrix feature of the paragraph is added to the input features of the paragraph classifier. A keyword list containing all nodes in the knowledge graph is constructed, which is used as the search basis for the keywords in the paragraph text. If the paragraph text contains the corresponding keywords, the paragraph is labeled with the corresponding label, and finally a keyword label matrix of the paragraph is formed.

[0031] The paragraph classifier adopts a random forest algorithm to construct the classifier. The input of the classifier is the parent node label matrix of the paragraph, the sibling node label matrix of the paragraph, the sentence vector of the paragraph, and the keyword label matrix of the paragraph. The parameters of the classifier include: the random seed number is 50, and the tree depth is 5. For each node in the knowledge graph, a paragraph classifier is constructed. The paragraphs in the privacy policy with the label of the node and the paragraphs with the label of other nodes randomly selected from the corpus are used to construct the data set of the node. The training set and the test set are divided according to the ratio of 4:1. The 5-fold cross-validation method is used for the training of the classifier. Finally, the paragraph classifier results of some nodes in the knowledge graph are shown in the following table.

[0032] GDPR Article P R F1 CONTROLLER 0.99 0.80 0.87 CONTROLLER.IDENTITY 0.99 0.76 0.84 CONTROLLER.CONTACT 0.95 0.82 0.87 DPO.CONTACT 0.99 0.83 0.90 DATA_SUBJECT_RIGHT 0.99 0.76 0.84 DATA_SUBJECT_RIGHT.INFORMATION 0.95 0.79 0.85 DATA_SUBJECT_RIGHT.ACCESS 0.99 0.77 0.84 DATA_SUBJECT_RIGHT.RECTIFICATION 0.98 0.80 0.87 UNKNOW 0.98 0.79 0.86

[0033] In this embodiment, the privacy policies of the top 150 online service websites are automatically crawled from the Alexa ranking website, and the hierarchical structure of the privacy policies is reconstructed and restored. The 150 privacy policies are given to the labeling personnel for labeling.

[0034] Three professional annotators are recruited to annotate the title and paragraph of the 150 privacy policies collected in this embodiment. In order to control the quality of annotation, first of all, the annotators are trained by professional personnel with legal background, and the corresponding examples are provided, after the training, three annotators independently annotate, after all the annotators complete the annotation of all privacy policies, all the annotation results are combined, if two or more of the three annotators give the same label to the same title or paragraph, then the label is the final label of the sentence, otherwise, the title or sentence is discussed until a consensus is reached, finally, all the annotation results are accepted by professional personnel with legal background.

[0035] From the results of the title classifier and the paragraph classifier, it can be seen that the privacy policy compliance detection model proposed by the present application has good effect on the compliance detection of GDPR, and the accuracy rate of most classifiers can reach more than 90%.

[0036] Compared with the prior art, the present method uses the context features in the privacy policy text to construct the classifier, improves the accuracy of the privacy policy compliance detection model, and overall solves the problem of privacy policy compliance detection for GDPR. Compared with the prior art, the present application proposes a more perfect multi-level structure of GDPR knowledge graph, and marks the collected privacy policies with hierarchical structure through the knowledge graph to form a privacy policy corpus for GDPR, and uses the corpus to complete the training of the privacy policy compliance detection model, which provides support for the privacy policy compliance detection of online services, apps and other internet services for GDPR, and provides suggestions for users to choose legal and compliant internet services, and has strong practical value. At the same time, the method of the present application can be extended to the privacy policy compliance detection for the laws and regulations formulated by other countries, and has strong flexibility.

[0037] The above specific embodiments can be adjusted in different ways by those skilled in the art without departing from the principles and purposes of the present application, the protection scope of the present application is subject to the claims and is not limited by the above specific embodiments, and each implementation scheme within the scope is subject to the constraints of the present application.

Claims

1. A method for intelligent detection of GDPR-compliant privacy policies, characterized in that, Includes the following steps: Step 1) Knowledge Graph Construction: Abstract the requirements for privacy policies in GDPR into a three-level GDPR knowledge graph, and use this knowledge graph to annotate the collected hierarchical privacy policies, forming a GDPR-oriented privacy policy corpus. Step 1 specifically includes: Step 1.1) Extraction of primary nodes of the knowledge graph; The GDPR contains 99 chapters, which make clear requirements on data jurisdiction, data subject rights, and cross-border data transfer. Based on these requirements, 18 primary nodes are extracted, including data controller, data subject rights, data category, and data source; Step 1.2) Knowledge Graph Second-Level Node Extraction; Under the above-mentioned first-level nodes, according to the GDPR's further requirements for some first-level nodes, including the explicit requirement that data subject rights should include the right to know, the right to be forgotten, and the right to deletion, these requirements are extracted and abstracted into second-level nodes, and linked to the corresponding first-level nodes in the knowledge graph; the second-level nodes include: INFORMATION, ACCESS, and WITHDRAW CONSENT under DATA SUBJECTRIGHT; Step 1.3) Knowledge Graph Level 3 Node Extraction; Under the above Level 2 nodes, based on the GDPR's further requirements for some Level 2 nodes, including the data controller's contact phone number and the data controller's identity verification registration number, these requirements are extracted and abstracted into Level 3 nodes, and linked to the corresponding Level 2 nodes in the knowledge graph; Level 3 nodes include: REGISTER NUMBER under CONTROLER.IDENTITY; Step 1.4) Corpus Construction: The above steps construct a three-level knowledge graph. Based on the node labels in the knowledge graph, the privacy policies of 150 collected online services are labeled. The labeled content includes the title and paragraph text of the privacy policy, and finally a privacy policy corpus oriented towards GDPR is formed. Step 2) Construct a compliance detection classifier: For each requirement in the GDPR knowledge graph, construct a dataset using relevant data from the corpus, extract features containing contextual information as input to train the corresponding classifier, complete the detection classifier for each requirement in the GDPR knowledge graph, and finally form a privacy policy compliance detection model for GDPR, which can predict whether the text in the privacy policy belongs to a certain clause in GDPR.

2. The intelligent detection method for GDPR-oriented privacy policy compliance according to claim 1, characterized in that, The knowledge graph consists of a graph with three levels of nodes, including 18 first-level nodes, 39 second-level nodes, and 38 third-level nodes. Each node corresponds to a requirement clause in the GDPR. The knowledge graph summarizes the general requirements of the GDPR for privacy policies. The corpus in step 1) includes 150 privacy policies collected from online service websites. The privacy policies in this corpus have a hierarchical structure, that is, they contain multi-level headings and paragraph text information.

3. The intelligent detection method for GDPR-oriented privacy policy compliance according to claim 1, characterized in that, The classifier is a Random Forest model, which includes a title classifier and a paragraph classifier. The title and paragraph of the privacy policy are respectively used to detect compliance. The input of the classifier is the relevant features of the title and paragraph. The title features include: the parent node label matrix of the title, the sibling node label matrix of the title, and the sentence vector of the title. The paragraph features include: the parent node label matrix of the paragraph, the sibling node label matrix of the paragraph, the sentence vector of the paragraph, and the keyword label matrix of the paragraph.

4. The intelligent detection method for GDPR-oriented privacy policy compliance according to any one of claims 1 to 3, characterized in that, Step 2 specifically includes: Step 2.1) Title Classifier: For each node in the knowledge graph, train the corresponding title binary classifier. The input of the classifier is the feature of the title, and the output is whether the title meets the requirements of the node in the knowledge graph. Step 2.2) Paragraph Classifier: For each node in the knowledge graph, train the corresponding paragraph binary classifier. The input of the classifier is the corresponding feature of the paragraph, and the output is whether the paragraph meets the requirements of the node in the knowledge graph. The input to the title classifier consists of the title's corresponding features, including the title's parent node label matrix, sibling node label matrix, and sentence vector. The parent node label matrix features the labels of the parent nodes of the current title node on the privacy policy webpage, and the sibling node label matrix features the labels of the sibling nodes of the current title node on the privacy policy webpage. Typically, when a parent node relates to a GDPR clause, and its sibling nodes also relate to that GDPR clause or sub-clause, then the current node is highly likely to be associated with that GDPR clause. For example, if the current node's parent node label is "data subject rights" and its sibling node label is "deletion rights" under "data subject rights," then the current node is highly likely to also belong to "data subject rights." Therefore, the parent node label and sibling node label are used as the two features of the title. Each node may have multiple labels, so both parent and sibling node labels are input in matrix form. The sentence vector features are obtained by converting the title text into a vector using word embedding. A pre-trained GloVe model is used to calculate the word embedding of each word in the title, and the average of all word embeddings is taken to obtain the embedding representation of the title sentence, which serves as the title's sentence vector feature. The input to the paragraph classifier consists of the paragraph's corresponding features, including the paragraph's parent node label matrix, sibling node label matrix, sentence vector, and keyword label matrix. The parent node label matrix, sibling node label matrix, and sentence vector features are calculated using the same method as the title features. The parent node label matrix is ​​the label of the parent node of the current paragraph in the privacy policy webpage, and the sibling node label matrix is ​​the label of the sibling nodes of the current paragraph in the privacy policy webpage. The sentence vector uses a pre-trained GloVe model to calculate the word embedding of each word in the paragraph. The average of all word embeddings is used to obtain the sentence embedding representation of the paragraph, which serves as the paragraph's sentence vector feature. Compared to the title, a paragraph is usually a long text containing more redundant information. Therefore, to reduce the impact of redundant information on the classifier, a keyword label matrix feature is added to the paragraph classifier's input features. A keyword list containing all nodes in the knowledge graph is constructed and used as the search criterion for paragraph text keywords. The search is performed within the paragraph text; if the paragraph text contains the corresponding keywords, the paragraph is tagged accordingly, ultimately forming a paragraph keyword label matrix.

5. The intelligent detection method for GDPR compliance of privacy policies according to claim 4, characterized in that, The title classifier uses a random forest algorithm to construct the classifier. The input of the classifier is three features: the parent node label matrix of the title, the sibling node label matrix of the title, and the sentence vector of the title. The parameters of the classifier include: 50 random seeds and a tree depth of 5. For each node in the knowledge graph, a title classifier is constructed. The dataset for the node is constructed using the titles labeled with the privacy policy of the node in the corpus and the titles of other nodes randomly selected. The training set and the test set are divided in a 4:1 ratio, and the classifier is trained using a 5-fold cross-validation method. The paragraph classifier uses a random forest algorithm to construct the classifier. The input to the classifier consists of four features: the parent node label matrix, the sibling node label matrix, the sentence vector, and the keyword label matrix. The parameters of the classifier include: 50 random seeds and a tree depth of 5. For each node in the knowledge graph, a paragraph classifier is constructed. The dataset for that node is constructed using paragraphs labeled with the privacy policy of that node in the corpus and paragraphs randomly selected with labels of other nodes. The training set and test set are divided in a 4:1 ratio, and the classifier is trained using a 5-fold cross-validation method.

Images