Personal information compliance detection method and device, equipment, storage medium and program product

Abstract

The invention discloses a personal information compliance detection method and device, equipment, a storage medium and a program product. The method comprises the following steps: extracting a plurality of first entities for constructing a first compliance knowledge graph and relationships among the first entities from a target rule text; constructing a first compliance knowledge graph based on the plurality of extracted first entities and the relationship among the first entities; from the target privacy right declaration text, extracting a plurality of second entities used for constructing a second compliance knowledge graph related to the target application program and a relationship between the second entities; constructing a second compliance knowledge graph based on the plurality of extracted second entities and the relationship between the second entities; and based on the first compliance knowledge graph and the second compliance knowledge graph, performing compliance detection on the personal information collected and processed by the target application program to obtain a compliance detection result for the personal information. In this way, the efficiency and accuracy of personal information compliance detection can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a personal information compliance detection method, device, equipment, storage medium and program product. Background Art

[0002] With the rapid development of information technology and the widespread deployment of mobile applications, personal information protection has become a focus of social attention. While providing convenient services, mobile applications also collect a large amount of user personal information. In order to ensure the compliance of the collected user personal information, personal information compliance testing is required.

[0003] At present, personal information compliance detection mainly relies on manual review of mobile application privacy statements, which is inefficient and error-prone. In order to improve the efficiency and accuracy of personal information compliance detection, researchers have proposed a variety of automated detection methods, such as rule engine-based detection methods, text mining-based detection methods, and machine learning-based detection methods. However, all of the above methods have certain limitations. For example, the rule engine-based method needs to continuously update the rules to adapt to changes in laws and regulations, and the maintenance cost is high; the text mining-based method has limited semantic understanding of the text and is difficult to accurately grasp the complex requirements of laws and regulations, resulting in low detection accuracy; the machine learning-based method requires a large amount of labeled data for training, resulting in low detection efficiency.

[0004] Therefore, how to improve the efficiency and accuracy of personal information compliance testing has become an urgent issue to be addressed. Summary of the invention

[0005] The embodiments of the present application provide a personal information compliance detection method, apparatus, device, storage medium and program product, which can improve the efficiency and accuracy of personal information compliance detection.

[0006] In a first aspect, an embodiment of the present application provides a method for detecting compliance of personal information, the method comprising:

[0007] Extracting multiple first entities and the relationships between the first entities for constructing a first compliance knowledge graph from the target rule text; the target rule text includes one or more of multiple legal and regulatory texts related to personal information after data preprocessing;

[0008] Constructing a first compliance knowledge graph based on the extracted multiple first entities and the relationships between the first entities;

[0009] Extracting, from the target privacy statement text, a plurality of second entities and the relationships between the second entities for constructing a second compliance knowledge graph related to the target application; the target privacy statement text is obtained by performing data preprocessing on the privacy statement text of the target application;

[0010] Constructing a second compliance knowledge graph based on the extracted multiple second entities and the relationships between the second entities;

[0011] Based on the first compliance knowledge graph and the second compliance knowledge graph, compliance detection is performed on the personal information collected and processed by the target application to obtain compliance detection results for the personal information;

[0012] Among them, multiple first entities and multiple second entities all include information collection subjects / information processing subjects, data subjects and personal information types; the relationship between each first entity and the relationship between each second entity include information purpose and information collection method.

[0013] In one of the embodiments, based on the first compliance knowledge graph and the second compliance knowledge graph, compliance detection is performed on personal information collected and processed by the target application to obtain compliance detection results for the personal information, including: matching the personal information collected and processed by the target application with the first compliance knowledge graph to obtain a first compliance detection result; matching the personal information with the second compliance knowledge graph to obtain a second compliance detection result; and obtaining a compliance detection result for the personal information based on the first compliance detection result and the second compliance detection result.

[0014] In one embodiment, a plurality of first entities and the relationships between the first entities for constructing a first compliance knowledge graph are extracted from a target rule text, and a plurality of second entities and the relationships between the second entities for constructing a second compliance knowledge graph related to a target application are extracted from a target privacy statement text, including: inputting the target rule text into a predetermined information extraction model to obtain a plurality of first entities and the relationships between the first entities for constructing the first compliance knowledge graph; and inputting the target privacy statement text into the information extraction model to obtain a plurality of second entities and the relationships between the second entities for constructing a second compliance knowledge graph related to the target application.

[0015] In one of the embodiments, a first compliance knowledge graph is constructed based on multiple extracted first entities and the relationships between each first entity, including: determining a first large language model for constructing the first compliance knowledge graph based on a target rule text, and determining a first entity type and a first relationship type for constructing the first knowledge graph; constructing the first knowledge graph based on the first entity type and the first relationship type; and mapping the extracted multiple first entities and the relationships between each first entity to the first knowledge graph using the first large language model to obtain the first compliance knowledge graph.

[0016] In one of the embodiments, a second compliance knowledge graph is constructed based on multiple extracted second entities and the relationships between each second entity, including: determining a second largest language model for constructing the second compliance knowledge graph based on the target privacy statement text, and determining second entity types and second relationship types for constructing the second knowledge graph; constructing the second knowledge graph based on the second entity types and the second relationship types; and mapping the extracted multiple second entities and the relationships between each second entity to the second knowledge graph using the second largest language model to obtain the second compliance knowledge graph.

[0017] In one of the embodiments, the method further includes: generating a compliance detection report for personal information based on the compliance detection results; the compliance detection report includes detection results of multiple compliance detections on the personal information.

[0018] In one embodiment, the method further includes: if it is determined that any one of the compliance detection results is non-compliant, prohibiting the target application from using personal information.

[0019] In a second aspect, the present application provides a personal information compliance detection device, the device comprising:

[0020] An extraction unit, used to extract multiple first entities and the relationship between each first entity for constructing a first compliance knowledge graph from a target rule text; the target rule text includes one or more of multiple legal and regulatory texts related to personal information after data preprocessing;

[0021] A construction unit, configured to construct a first compliance knowledge graph based on the extracted multiple first entities and the relationship between the first entities;

[0022] The extraction unit is further used to extract, from the target privacy statement text, a plurality of second entities and the relationships between the second entities for constructing a second compliance knowledge graph related to the target application; the target privacy statement text is obtained by performing data preprocessing on the privacy statement text of the target application;

[0023] The construction unit is further used to construct a second compliance knowledge graph based on the extracted multiple second entities and the relationship between each second entity;

[0024] A detection unit, configured to perform compliance detection on personal information collected and processed by a target application based on the first compliance knowledge graph and the second compliance knowledge graph, and obtain a compliance detection result for the personal information;

[0025] Among them, multiple first entities and multiple second entities all include information collection or processing subjects, data subjects and personal information types; the relationship between each first entity and the relationship between each second entity include information purpose and information collection method.

[0026] In a third aspect, the present application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0027] Extracting multiple first entities and the relationships between the first entities for constructing a first compliance knowledge graph from the target rule text; the target rule text includes one or more of multiple legal and regulatory texts related to personal information after data preprocessing;

[0028] Constructing a first compliance knowledge graph based on the extracted multiple first entities and the relationships between the first entities;

[0029] Extracting, from the target privacy statement text, a plurality of second entities and the relationships between the second entities for constructing a second compliance knowledge graph related to the target application; the target privacy statement text is obtained by performing data preprocessing on the privacy statement text of the target application;

[0030] Constructing a second compliance knowledge graph based on the extracted multiple second entities and the relationships between the second entities;

[0031] Based on the first compliance knowledge graph and the second compliance knowledge graph, compliance detection is performed on the personal information collected and processed by the target application to obtain compliance detection results for the personal information;

[0032] Among them, multiple first entities and multiple second entities all include information collection or processing subjects, data subjects and personal information types; the relationship between each first entity and the relationship between each second entity include information purpose and information collection method.

[0033] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0034] Extracting multiple first entities and the relationships between the first entities for constructing a first compliance knowledge graph from the target rule text; the target rule text includes one or more of multiple legal and regulatory texts related to personal information after data preprocessing;

[0035] Constructing a first compliance knowledge graph based on the extracted multiple first entities and the relationships between the first entities;

[0036] Extracting, from the target privacy statement text, a plurality of second entities and the relationships between the second entities for constructing a second compliance knowledge graph related to the target application; the target privacy statement text is obtained by performing data preprocessing on the privacy statement text of the target application;

[0037] Constructing a second compliance knowledge graph based on the extracted multiple second entities and the relationships between the second entities;

[0038] Based on the first compliance knowledge graph and the second compliance knowledge graph, compliance detection is performed on the personal information collected and processed by the target application to obtain compliance detection results for the personal information;

[0039] Among them, multiple first entities and multiple second entities all include information collection or processing subjects, data subjects and personal information types; the relationship between each first entity and the relationship between each second entity include information purpose and information collection method.

[0040] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0041] Extracting multiple first entities and the relationships between the first entities for constructing a first compliance knowledge graph from the target rule text; the target rule text includes one or more of multiple legal and regulatory texts related to personal information after data preprocessing;

[0042] Constructing a first compliance knowledge graph based on the extracted multiple first entities and the relationships between the first entities;

[0043] Extracting, from the target privacy statement text, a plurality of second entities and the relationships between the second entities for constructing a second compliance knowledge graph related to the target application; the target privacy statement text is obtained by performing data preprocessing on the privacy statement text of the target application;

[0044] Constructing a second compliance knowledge graph based on the extracted multiple second entities and the relationships between the second entities;

[0045] Based on the first compliance knowledge graph and the second compliance knowledge graph, compliance detection is performed on the personal information collected and processed by the target application to obtain compliance detection results for the personal information;

[0046] Among them, multiple first entities and multiple second entities all include information collection or processing subjects, data subjects and personal information types; the relationship between each first entity and the relationship between each second entity include information purpose and information collection method.

[0047] The above-mentioned personal information compliance detection method, device, equipment, storage medium and program product, the computer device can extract multiple first entities and the relationship between each first entity for constructing a first compliance knowledge graph from the target rule text; the target rule text includes one or more of the multiple legal and regulatory texts related to personal information after data preprocessing; based on the extracted multiple first entities and the relationship between each first entity, a first compliance knowledge graph is constructed; from the target privacy statement text, multiple second entities and the relationship between each second entity for constructing a second compliance knowledge graph related to the target application are extracted; the target privacy statement text is obtained by preprocessing the privacy statement text of the target application; based on the extracted multiple second entities and the relationship between each second entity, a second compliance knowledge graph is constructed; based on the first compliance knowledge graph and the second compliance knowledge graph, compliance detection is performed on the personal information collected and processed by the target application to obtain compliance detection results for the personal information; wherein, the multiple first entities and the multiple second entities both include the information collection or processing subject, the data subject and the personal information type; the relationship between each first entity and the relationship between each second entity include the information purpose and the information collection method. By adopting this method, a computer device extracts multiple first entities and the relationships between each first entity from a target rule text, and extracts multiple second entities and the relationships between each second entity from a target privacy statement text. In this way, the efficiency of subsequently constructing a first compliance knowledge graph and a second compliance knowledge graph can be improved, thereby improving the efficiency of constructing a first compliance knowledge graph related to laws and regulations and a second compliance knowledge graph related to a target application. Furthermore, based on the first compliance knowledge graph and the second compliance knowledge graph, compliance detection of personal information collected and processed by the target application is performed, which not only improves the efficiency of personal information compliance detection, but also enables more accurate understanding and matching of personal information with the privacy statements of mobile applications and the requirements of laws and regulations, that is, improves the accuracy of personal information compliance detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 This is a schematic diagram of an application scenario of a personal information compliance detection method provided in an embodiment of the present application;

[0050] Figure 2 This is a flowchart of a personal information compliance detection method provided in an embodiment of the present application;

[0051] Figure 3 This is a flowchart of another personal information compliance detection method provided in an embodiment of the present application;

[0052] Figure 4 It is a structural schematic diagram of a personal information compliance detection device provided in an embodiment of the present application;

[0053] Figure 5 It is a structural diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0055] The following introduces the application scenarios of the personal information compliance detection method provided in the embodiments of the present application.

[0056] See also Figure 1 , Figure 1 Schematic diagram of an application scenario of a personal information compliance detection method provided in an embodiment of the present application. Figure 1 As shown, the computer device 101 ( Figure 1 In the figure, the computer device 101 is drawn as an example of a terminal device) and a database server 102, wherein data can be transmitted between the computer device 101 and the database server 102 via a network.

[0057] The computer device 101 can obtain multiple legal and regulatory texts related to personal information from the database server 102, and perform text data preprocessing on one or more of the multiple legal and regulatory texts related to personal information to obtain a target rule text; and obtain the privacy statement text of the target application from the database server 102, and perform text data preprocessing on the privacy statement text of the target application to obtain a target privacy statement text. Afterwards, the computer device 101 can extract multiple first entities and the relationship between each first entity used to construct a first compliance knowledge graph from the target rule text, and construct a first compliance knowledge graph based on the extracted multiple first entities and the relationship between each first entity; extract multiple second entities and the relationship between each second entity used to construct a second compliance knowledge graph related to the target application from the target privacy statement text, and construct a second compliance knowledge graph based on the extracted multiple second entities and the relationship between each second entity. Finally, the computer device 101 can perform compliance detection on the personal information collected and processed by the target application based on the first compliance knowledge graph and the second compliance knowledge graph to obtain a compliance detection result for the personal information.

[0058] Among them, multiple first entities and multiple second entities all include information collection or processing subjects, data subjects and personal information types; the relationship between each first entity and the relationship between each second entity include information purpose and information collection method.

[0059] Optionally, the computer device 101 may be a terminal device, wherein the terminal device mentioned here may include but is not limited to: a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart watch, a smart TV, a smart car terminal, etc.

[0060] See also Figure 2 , Figure 2 1 is a flowchart of a personal information compliance detection method provided in an embodiment of the present application. The method can be executed by a computer device (for example, the above-mentioned computer device 101). Figure 2 As shown, the personal information compliance detection method may include but is not limited to the following steps:

[0061] S201. Extract multiple first entities and the relationships between the first entities for constructing a first compliance knowledge graph from the target rule text; the target rule text includes one or more of a plurality of legal and regulatory texts related to personal information after data preprocessing.

[0062] Among them, multiple first entities include information collection or processing entities, data subject entities and personal information types; the relationship between each first entity includes information purpose and information collection method.

[0063] Optionally, the first compliance knowledge graph may also be referred to as the top-level compliance knowledge graph.

[0064] Optionally, multiple first entities include but are not limited to personal information processors, data subjects, personal information types, etc.; the relationships between each first entity include but are not limited to collection, use, sharing, etc.

[0065] Optionally, the texts of laws and regulations related to personal information may include, but are not limited to, the text of the Personal Information Protection Law, the text of the Cybersecurity Law, the text of the Information Security Technology-Personal Information Security Specification, etc., which are not limited here.

[0066] Among them, the Personal Information Protection Law stipulates the basic principles and requirements for the processing of personal information, including the collection, use, storage and transmission of personal information. The Cybersecurity Law involves the protection of personal information in the network environment, including the network operator's responsibility for the security protection of personal information. The Information Security Technology-Personal Information Security Specification provides detailed technical requirements and operational guidelines for personal information security, see Table 1.

[0067] Table 1 Legal provisions for personal information security

[0068]

[0069] Table 1 Legal provisions for personal information security (continued)

[0070]

[0071] In the legal provisions in Table 1 above, G stands for the Personal Information Protection Law; A stands for Information Security Technology-Personal Information Security Specification (GB / T 35273-2020); Z stands for Self-Assessment Guidelines for Illegal and Irregular Collection and Use of Personal Information by Apps; R stands for Methods for Identifying Illegal and Irregular Collection and Use of Personal Information by Apps; / stands for no corresponding provision.

[0072] S202: Construct a first compliance knowledge graph based on the extracted multiple first entities and the relationships between the first entities.

[0073] In an optional implementation, before step S202, the computer device may determine a first large language model for constructing the first compliance knowledge graph. Then, the first large language model is used to construct the first compliance knowledge graph based on the extracted multiple first entities and the relationships between the first entities.

[0074] S203. Extract multiple second entities and the relationships between the second entities for constructing a second compliance knowledge graph related to the target application from the target privacy statement text; the target privacy statement text is obtained by preprocessing the privacy statement text of the target application.

[0075] Among them, multiple second entities include information collection or processing entities, data subject entities and personal information types; the relationship between each second entity includes information purpose and information collection method.

[0076] Optionally, the second compliance knowledge graph may also be referred to as an application layer compliance knowledge graph.

[0077] Optionally, multiple second entities include but are not limited to personal information processors, data subjects, personal information types, etc.; the relationships between each second entity include but are not limited to collection, use, sharing, etc.

[0078] In an optional implementation, the privacy statement text of the target application can be the "Self-Assessment Guide for Illegal and Irregular Collection and Use of Personal Information by APPs". Among them, the text clarifies how to determine the illegality of APP's collection and use of personal information, providing a basis for supervision and compliance testing.

[0079] S204: Construct a second compliance knowledge graph based on the extracted multiple second entities and the relationships between the second entities.

[0080] In an optional implementation, before step S204, the computer device may also determine a second largest language model for constructing a second compliance knowledge graph. Then, the second largest language model is used to construct a second compliance knowledge graph based on the extracted multiple second entities and the relationships between the second entities.

[0081] S205. Based on the first compliance knowledge graph and the second compliance knowledge graph, perform compliance testing on the personal information collected and processed by the target application to obtain compliance testing results for the personal information.

[0082] Among them, personal information collected and processed by the target application is, for example, location data, network behavior data, etc. In this case, the target application is usually required to clearly inform the user in the privacy statement and proceed after the user's authorization and consent.

[0083] In an optional implementation, the personal information may also be uploaded by the user. For example, when the user uses the target application or service, he / she will be asked to fill in personal information, such as account name, user gender, etc., or the user will participate in a questionnaire survey, use a specific service function, etc.

[0084] In another optional implementation, personal information can also be obtained from a third party through the target application. For example, in some cases, the target application will obtain user personal information from a third party (such as a social media platform, data service provider, etc.). In this case, it is necessary to ensure that the third party is a legitimate data controller and that the user has agreed that their personal information can be shared.

[0085] In an embodiment of the present application, a computer device may extract multiple first entities and the relationships between each first entity for constructing a first compliance knowledge graph from a target rule text; the target rule text includes one or more of a plurality of legal and regulatory texts related to personal information after data preprocessing; based on the extracted multiple first entities and the relationships between each first entity, a first compliance knowledge graph is constructed; from a target privacy statement text, multiple second entities and the relationships between each second entity for constructing a second compliance knowledge graph related to a target application are extracted; the target privacy statement text is obtained by performing data preprocessing on the privacy statement text of the target application; based on the extracted multiple second entities and the relationships between each second entity, a second compliance knowledge graph is constructed; based on the first compliance knowledge graph and the second compliance knowledge graph, the obtained personal information is subjected to compliance testing to obtain compliance testing results for the personal information. By adopting this method, a computer device extracts multiple first entities and the relationships between each first entity from a target rule text, and extracts multiple second entities and the relationships between each second entity from a target privacy statement text. In this way, the efficiency of subsequently constructing a first compliance knowledge graph and a second compliance knowledge graph can be improved, thereby improving the efficiency of constructing a first compliance knowledge graph related to laws and regulations and a second compliance knowledge graph related to a target application. Furthermore, based on the first compliance knowledge graph and the second compliance knowledge graph, compliance detection of personal information collected and processed by the target application is performed, which not only improves the efficiency of personal information compliance detection, but also enables more accurate understanding and matching of personal information with the privacy statements of mobile applications and the requirements of laws and regulations, that is, improves the accuracy of personal information compliance detection.

[0086] See also Figure 3 , Figure 3 Schematic diagram of another personal information compliance detection method provided in the embodiment of the present application. Figure 2 Compared with the personal information compliance detection methods shown, Figure 3The method described above specifically elaborates on how a computer device obtains a target rule text and a target privacy statement text, and how to perform compliance detection on personal information collected and processed by a target application based on a first compliance knowledge graph and a second compliance knowledge graph to obtain a compliance detection result for the personal information. As Figure 3 shown, the personal information compliance detection method may include but is not limited to the following steps:

[0087] S301. Obtain multiple laws and regulations texts related to personal information collected in advance from a database.

[0088] In an optional implementation manner, the relevant description of the multiple laws and regulations texts related to personal information can be referred to the description in the foregoing step S201, and will not be elaborated here.

[0089] S302. Perform text data preprocessing on one or more of the multiple laws and regulations texts related to personal information to obtain a target rule text.

[0090] In an optional implementation manner, when a computer device performs text data preprocessing on one or more of the multiple laws and regulations texts related to personal information to obtain a target rule text, it may include: performing non-text content removal processing and text content denoising processing on one or more of the multiple laws and regulations texts related to personal information respectively to obtain one or more preliminarily processed laws and regulations texts; using a word segmentation tool to perform word segmentation processing on one or more preliminarily processed laws and regulations texts respectively to obtain one or more word-segmented laws and regulations texts; performing stop word removal processing on one or more word-segmented laws and regulations texts respectively to obtain one or more processed laws and regulations texts; and using one or more processed laws and regulations texts as the target rule text. In this way, key entities and relationships can be efficiently and accurately extracted from the laws and regulations documents, thereby improving the efficiency and accuracy of extracting multiple first entities and the relationships between each first entity from the target rule text subsequently, and further improving the efficiency and accuracy of the compliance detection of personal information processing.

[0091] Optionally, the non-text content may include but is not limited to headers, footers, page numbers, charts, footnotes, etc.

[0092] Optionally, the word segmentation tool is, for example, the jieba word segmentation tool, the SnowNLP word segmentation tool, etc., and is not limited here.

[0093] Among them, the stop word removal processing refers to deleting common but insignificant words in the text, such as "de", "he", "shi", etc.

[0094] Optionally, the computer device may also perform part-of-speech tagging on the words in one or more segmented legal and regulatory texts to determine the part-of-speech of each word; based on the part-of-speech of each word, perform grammatical analysis on the sentences in the text to construct a grammatical tree associated with the sentences. In this way, the efficiency of extracting multiple first entities and the relationships between each first entity from the target rule text can be further improved, thereby further improving the efficiency of compliance detection of personal information processing.

[0095] Optionally, after obtaining the target rule text, the computer device may also store the target rule text in a structured manner to build or update the legal knowledge base, thereby providing a basis for the subsequent construction of the first compliance knowledge graph and compliance detection.

[0096] S303. Extract multiple first entities and the relationships between the first entities for constructing a first compliance knowledge graph from the target rule text.

[0097] In an optional embodiment, a computer device extracts multiple first entities and the relationships between each first entity for constructing a first compliance knowledge graph from a target rule text, which may include: inputting the target rule text into a predetermined information extraction model to obtain multiple first entities and the relationships between each first entity for constructing a first compliance knowledge graph.

[0098] In another optional implementation, the computer device extracts multiple first entities and the relationships between the first entities for constructing the first compliance knowledge graph from the target rule text, which may include but is not limited to the following steps:

[0099] Step 1: Use entity recognition technology to identify multiple entities from the target rule text, and use relationship recognition technology to identify the relationship between each entity from the target rule text.

[0100] Optionally, multiple entities may include but are not limited to personal information processors, data subjects, personal information types, etc.; the relationship between various entities may include but are not limited to collection, use, sharing, etc.

[0101] Step 2: Use syntactic analysis and event extraction technology to identify multiple legal events in the target rule text and determine the relationship between each legal event and each entity. This helps to understand the meaning of the relationship between entities in a specific legal context, making the relationship richer and more accurate.

[0102] Step 3: Associate each entity with the standardized terms in the target rule text to obtain multiple entities associated with standardized terms. In this way, by determining the exact meaning of the entity in the legal context and linking the identified entity with the standardized terms in the laws and regulations, the consistency and accuracy of the entity can be ensured, thereby helping to improve the accuracy of the extracted entity. Optionally, this step can also be called entity disambiguation and linking.

[0103] Step 4: Extract attribute-value pairs of each entity associated with the standardized term.

[0104] Optionally, the attribute-value pairs of an entity can be the entity's characteristics, status, or relationship with other entities, such as the purpose of the personal information processor, the rights of the data subject, etc. By utilizing predefined patterns or rules, standard legal expressions and common legal clauses in the text can be identified, thereby enriching the description of the entity.

[0105] Step 5: Clean, remove duplicates and integrate the extraction results, multiple entities associated with standardized terms and the relationships between the entities to obtain multiple first entities and the relationships between the first entities for constructing the first compliance knowledge graph. In this way, the accuracy and consistency of the extraction results can be further ensured.

[0106] In this implementation, after step five, the computer device may also output the extracted multiple first entities and the relationships between the first entities, so that relevant staff can perform quality inspection on the extraction results. Thus, when the first compliance knowledge graph is subsequently constructed based on the multiple first entities and the relationships between the first entities, the quality of the first compliance knowledge graph can be improved.

[0107] Optionally, the computer device may also convert the extracted multiple first entities and the relationships between the first entities into a JSON structured data format to prepare for the subsequent construction of the first compliance knowledge graph.

[0108] S304: Construct a first compliance knowledge graph based on the extracted multiple first entities and the relationships between the first entities.

[0109] In an optional embodiment, a computer device constructs a first compliance knowledge graph based on multiple extracted first entities and the relationships between each first entity, which may include: determining a first large language model for constructing the first compliance knowledge graph based on a target rule text, and determining a first entity type and a first relationship type for constructing the first knowledge graph; constructing the first knowledge graph based on the first entity type and the first relationship type; and mapping the extracted multiple first entities and the relationships between each first entity to the first knowledge graph using the first large language model to obtain the first compliance knowledge graph.

[0110] In this implementation, the computer device determines the first language model for constructing the first compliance knowledge graph based on the target rule text, which may include: selecting a large model suitable for legal and regulatory text analysis based on the target rule text to analyze and process complex legal and regulatory terms and structures; using a corpus in the legal field to perform adaptive training on the large model to enhance the large model's ability to understand and extract legal and regulatory texts, and obtain the first language model for constructing the first compliance knowledge graph. The first language model is, for example, a BERT model.

[0111] In this implementation, the first entity type determined by the computer device for constructing the first knowledge graph may include but is not limited to legal provisions, personal information processing behaviors, etc.; the first relationship type may include but is not limited to regulations, prohibitions, requirements, etc.

[0112] In this embodiment, the computer device maps the extracted multiple first entities and the relationship between each first entity into the first knowledge graph to obtain a first compliance knowledge graph, which may include: using a first large language model to map the extracted multiple first entities into nodes in the first knowledge graph, and mapping the relationship between each first entity into edges in the first knowledge graph to obtain a first compliance knowledge graph.

[0113] In an optional implementation, the computer device can also monitor changes in laws and regulations and update the first compliance knowledge graph in real time. In this way, the first compliance knowledge graph can adapt to the updates and changes in laws and regulations, and has good real-time and dynamic adaptability, thereby improving the level of personal information protection and the practical application value of compliance management.

[0114] In this implementation, the computer device may also use version control and change log recording to track the change history of the first compliance knowledge graph.

[0115] S305: Obtain the privacy statement text of the target application from the database.

[0116] S306: Perform text data preprocessing on the privacy statement text of the target application to obtain a target privacy statement text.

[0117] In an optional implementation, the computer device performs text data preprocessing on the privacy statement text of the target application to obtain relevant explanations of the target privacy statement text. The relevant explanations of the target privacy statement text can refer to the aforementioned step S301 in which the computer device performs text data preprocessing on one or more of the multiple legal and regulatory texts related to personal information to obtain a description of the target rule text, which will not be repeated here.

[0118] S307. Extract, from the target privacy statement text, multiple second entities and the relationships between the second entities used to construct a second compliance knowledge graph related to the target application.

[0119] In an optional embodiment, a computer device extracts multiple second entities and the relationships between each second entity for constructing a second compliance knowledge graph related to a target application from a target privacy statement text, which may include: inputting the target privacy statement text into an information extraction model to obtain multiple second entities and the relationships between each second entity for constructing a second compliance knowledge graph related to the target application.

[0120] In another optional embodiment, the computer device extracts multiple second entities used to construct a second compliance knowledge graph related to the target application from the target privacy statement text, and the specific description of the relationship between the second entities can be found in the description of the aforementioned step S303, which will not be repeated here.

[0121] S308. Construct a second compliance knowledge graph based on the extracted multiple second entities and the relationships between the second entities.

[0122] In an optional embodiment, a computer device constructs a second compliance knowledge graph based on multiple extracted second entities and the relationships between each second entity, which may include: determining a second largest language model for constructing the second compliance knowledge graph based on the target privacy statement text, and determining second entity types and second relationship types for constructing the second knowledge graph; constructing the second knowledge graph based on the second entity types and the second relationship types; and mapping the extracted multiple second entities and the relationships between each second entity into the second knowledge graph using the second largest language model to obtain the second compliance knowledge graph.

[0123] The specific description of this implementation method can refer to the description of constructing the first compliance knowledge graph in the aforementioned step S303, which will not be repeated here.

[0124] In an optional implementation, the computer device can also monitor changes in the privacy statement text of the target application and update the second compliance knowledge graph in real time. In this way, the second compliance knowledge graph can update changes in the privacy statement of the application layer, with good real-time and dynamic adaptability, thereby improving the level of personal information protection and the practical application value of compliance management.

[0125] In this implementation, the computer device may also use version control and change log recording to track the change history of the second compliance knowledge graph.

[0126] S309: Match the personal information collected and processed by the target application with the first compliance knowledge graph to obtain a first compliance detection result.

[0127] S310: Match the personal information with the second compliance knowledge graph to obtain a second compliance detection result.

[0128] S311. Obtain a compliance test result for personal information based on the first compliance test result and the second compliance test result.

[0129] In an optional implementation, the computer device may also prohibit the target application from using the personal information if it is determined that any one of the compliance detection results for the personal information is a non-compliant item.

[0130] In an embodiment of the present application, the computer device extracts multiple first entities and the relationship between each first entity from the target rule text, and extracts multiple second entities and the relationship between each second entity from the target privacy statement text. In this way, the efficiency of subsequent construction of the first compliance knowledge graph and the second compliance knowledge graph can be improved, thereby improving the efficiency of constructing the first compliance knowledge graph related to laws and regulations and the second compliance knowledge graph related to the target application. Furthermore, by adopting a two-level matching mechanism, that is, by accurately matching personal information with the first compliance knowledge graph (i.e., legal and regulatory compliance requirements) and the second compliance knowledge graph (i.e., application layer compliance requirements), not only the efficiency of personal information compliance detection can be improved, but also the personal information can be more accurately understood and matched with the privacy statement of the mobile application and the requirements of laws and regulations, that is, the accuracy of personal information compliance detection can be improved.

[0131] In an optional embodiment, Figure 2 After step S205 in the method shown, and Figure 3 After step S311 in the method shown, the computer device may also generate a compliance detection report for the personal information based on the compliance detection results; the compliance detection report includes the detection results of multiple compliance detections on the personal information.

[0132] Optionally, the compliance detection report may include, but is not limited to, compliance detection results regarding data collection, storage, use, and sharing.

[0133] Optionally, the compliance test report may also include a specific analysis of the non-compliance items, including but not limited to the causes and impacts of the non-compliance and possible corrective measures.

[0134] Optionally, the compliance testing report may also include recommendations on personal information protection measures to help users improve the compliance of personal information processing.

[0135] Optionally, the compliance test report may also include a summary of compliance with personal information protection laws and regulations, as well as an assessment of the privacy statement of the target application.

[0136] In this implementation, after generating the compliance detection report for personal information, the computer device may also output the compliance detection report for personal information for relevant personnel (such as relevant regulatory agencies, developers and users of target applications) to take necessary compliance improvement measures.

[0137] It should be understood that, although the steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indications of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. For example, the computer device may first execute steps S301 to S304, and then execute steps S305 to S308; it may also execute steps S305 to S308 while executing steps S301 to S304. Unless otherwise clearly stated in this document, there is no strict order restriction for the execution of these steps, and these steps may be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but may be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0138] Based on the same inventive concept, the embodiment of the present application also provides a personal information compliance detection device for implementing the personal information compliance detection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more personal information compliance detection device embodiments provided below can refer to the limitations on the personal information compliance detection method above, and will not be repeated here.

[0139] See also Figure 4 , Figure 4 Schematic diagram of a personal information compliance detection device provided in an embodiment of the present application. Figure 4 As shown, the personal information compliance detection device may include but is not limited to:

[0140] An extraction unit 401 is used to extract multiple first entities and the relationship between each first entity for constructing a first compliance knowledge graph from a target rule text; the target rule text includes one or more of multiple legal and regulatory texts related to personal information after data preprocessing;

[0141] A construction unit 402, configured to construct a first compliance knowledge graph based on the extracted multiple first entities and the relationships between the first entities;

[0142] The extraction unit 401 is further used to extract, from the target privacy statement text, a plurality of second entities and the relationship between the second entities for constructing a second compliance knowledge graph related to the target application; the target privacy statement text is obtained by performing data preprocessing on the privacy statement text of the target application;

[0143] The construction unit 402 is further used to construct a second compliance knowledge graph based on the extracted multiple second entities and the relationship between each second entity;

[0144] A detection unit 403 is used to perform compliance detection on personal information collected and processed by the target application based on the first compliance knowledge graph and the second compliance knowledge graph to obtain a compliance detection result for the personal information;

[0145] Among them, multiple first entities and multiple second entities all include information collection or processing subjects, data subjects and personal information types; the relationship between each first entity and the relationship between each second entity include information purpose and information collection method.

[0146] In one embodiment, when the detection unit 403 is used to perform compliance detection on personal information collected and processed by the target application based on the first compliance knowledge graph and the second compliance knowledge graph to obtain a compliance detection result for the personal information, it is specifically used to: match the personal information collected and processed by the target application with the first compliance knowledge graph to obtain a first compliance detection result; match the personal information with the second compliance knowledge graph to obtain a second compliance detection result; and obtain a compliance detection result for the personal information based on the first compliance detection result and the second compliance detection result.

[0147] In one embodiment, when the extraction unit 401 is used to extract multiple first entities and the relationships between each first entity for constructing a first compliance knowledge graph from a target rule text, and to extract multiple second entities and the relationships between each second entity for constructing a second compliance knowledge graph related to a target application from a target privacy statement text, it is specifically used to: input the target rule text into a predetermined information extraction model to obtain multiple first entities and the relationships between each first entity for constructing the first compliance knowledge graph; and input the target privacy statement text into the information extraction model to obtain multiple second entities and the relationships between each second entity for constructing a second compliance knowledge graph related to the target application.

[0148] In one embodiment, when the construction unit 402 is used to construct a first compliance knowledge graph based on the extracted multiple first entities and the relationships between the first entities, it is specifically used to: determine a first large language model for constructing the first compliance knowledge graph based on the target rule text, and determine a first entity type and a first relationship type for constructing the first knowledge graph; construct the first knowledge graph based on the first entity type and the first relationship type; and map the extracted multiple first entities and the relationships between the first entities into the first knowledge graph using the first large language model to obtain the first compliance knowledge graph.

[0149] In one embodiment, when the construction unit 402 is used to construct a second compliance knowledge graph based on the extracted multiple second entities and the relationships between each second entity, it is specifically used to: determine the second largest language model for constructing the second compliance knowledge graph based on the target privacy statement text, and determine the second entity type and the second relationship type for constructing the second knowledge graph; construct the second knowledge graph based on the second entity type and the second relationship type; and map the extracted multiple second entities and the relationships between each second entity into the second knowledge graph using the second largest language model to obtain the second compliance knowledge graph.

[0150] In one embodiment, the device further includes a generating unit, which is used to generate a compliance detection report for personal information based on the compliance detection result; the compliance detection report includes detection results of multiple compliance detections on the personal information.

[0151] In one embodiment, the device further includes a processing unit, which is used to prohibit the target application from using personal information when it is determined that any one of the compliance detection results is non-compliant.

[0152] Each module in the above-mentioned personal information compliance detection device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the terminal device in the form of hardware, or can be stored in the memory in the terminal device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0153] In an exemplary embodiment, the present application provides a computer device, which may be a terminal, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface, the display unit and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a personal information compliance detection method is implemented.

[0154] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0155] In an exemplary embodiment, the present application provides a computer device, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0156] Extracting multiple first entities and the relationships between the first entities for constructing a first compliance knowledge graph from the target rule text; the target rule text includes one or more of multiple legal and regulatory texts related to personal information after data preprocessing;

[0157] Constructing a first compliance knowledge graph based on the extracted multiple first entities and the relationships between the first entities;

[0158] Extracting, from the target privacy statement text, a plurality of second entities and the relationships between the second entities for constructing a second compliance knowledge graph related to the target application; the target privacy statement text is obtained by performing data preprocessing on the privacy statement text of the target application;

[0159] Constructing a second compliance knowledge graph based on the extracted multiple second entities and the relationships between the second entities;

[0160] Based on the first compliance knowledge graph and the second compliance knowledge graph, compliance detection is performed on the personal information collected and processed by the target application to obtain compliance detection results for the personal information;

[0161] Among them, multiple first entities and multiple second entities all include information collection or processing subjects, data subjects and personal information types; the relationship between each first entity and the relationship between each second entity include information purpose and information collection method.

[0162] In one embodiment, when a processor executes a computer program to implement compliance testing of personal information collected and processed by a target application based on a first compliance knowledge graph and a second compliance knowledge graph, and obtains a compliance testing result for the personal information, the following steps are specifically implemented: matching the personal information collected and processed by the target application with the first compliance knowledge graph to obtain a first compliance testing result; matching the personal information with the second compliance knowledge graph to obtain a second compliance testing result; and obtaining a compliance testing result for the personal information based on the first compliance testing result and the second compliance testing result.

[0163] In one embodiment, when a processor executes a computer program to extract multiple first entities and the relationships between each first entity for constructing a first compliance knowledge graph from a target rule text, and to extract multiple second entities and the relationships between each second entity for constructing a second compliance knowledge graph related to a target application from a target privacy statement text, the following steps are specifically implemented: inputting the target rule text into a predetermined information extraction model to obtain multiple first entities and the relationships between each first entity for constructing a first compliance knowledge graph; and inputting the target privacy statement text into the information extraction model to obtain multiple second entities and the relationships between each second entity for constructing a second compliance knowledge graph related to the target application.

[0164] In one embodiment, when a processor executes a computer program to construct a first compliance knowledge graph based on multiple extracted first entities and the relationships between each first entity, the following steps are specifically implemented: based on the target rule text, a first large language model is determined for constructing the first compliance knowledge graph, and a first entity type and a first relationship type are determined for constructing the first knowledge graph; based on the first entity type and the first relationship type, the first knowledge graph is constructed; using the first large language model, the extracted multiple first entities and the relationships between each first entity are mapped to the first knowledge graph to obtain the first compliance knowledge graph.

[0165] In one embodiment, when a processor executes a computer program to construct a second compliance knowledge graph based on multiple extracted second entities and the relationships between each second entity, the following steps are specifically implemented: based on the target privacy statement text, a second largest language model is determined for constructing the second compliance knowledge graph, and second entity types and second relationship types are determined for constructing the second knowledge graph; based on the second entity types and the second relationship types, a second knowledge graph is constructed; and using the second largest language model, the extracted multiple second entities and the relationships between each second entity are mapped to the second knowledge graph to obtain a second compliance knowledge graph.

[0166] In one embodiment, when the processor executes the computer program, the following steps are also implemented: based on the compliance detection results, a compliance detection report for personal information is generated; the compliance detection report includes the detection results of multiple compliance detections on the personal information.

[0167] In one embodiment, when the processor executes the computer program, the following steps are also implemented: when it is determined that any one of the compliance detection results is non-compliant, prohibiting the target application from using personal information.

[0168] In an exemplary embodiment, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0169] Extracting multiple first entities and the relationships between the first entities for constructing a first compliance knowledge graph from the target rule text; the target rule text includes one or more of multiple legal and regulatory texts related to personal information after data preprocessing;

[0170] Constructing a first compliance knowledge graph based on the extracted multiple first entities and the relationships between the first entities;

[0171] Extracting, from the target privacy statement text, a plurality of second entities and the relationships between the second entities for constructing a second compliance knowledge graph related to the target application; the target privacy statement text is obtained by performing data preprocessing on the privacy statement text of the target application;

[0172] Constructing a second compliance knowledge graph based on the extracted multiple second entities and the relationships between the second entities;

[0173] Based on the first compliance knowledge graph and the second compliance knowledge graph, compliance detection is performed on the personal information collected and processed by the target application to obtain compliance detection results for the personal information;

[0174] Among them, multiple first entities and multiple second entities all include information collection or processing subjects, data subjects and personal information types; the relationship between each first entity and the relationship between each second entity include information purpose and information collection method.

[0175] In one embodiment, a computer program is executed by a processor to implement compliance testing of personal information collected and processed by a target application based on a first compliance knowledge graph and a second compliance knowledge graph. When obtaining a compliance testing result for the personal information, the following steps are specifically implemented: matching the personal information collected and processed by the target application with the first compliance knowledge graph to obtain a first compliance testing result; matching the personal information with the second compliance knowledge graph to obtain a second compliance testing result; and obtaining a compliance testing result for the personal information based on the first compliance testing result and the second compliance testing result.

[0176] In one embodiment, when a computer program is executed by a processor to extract multiple first entities and the relationships between each first entity for constructing a first compliance knowledge graph from a target rule text, and to extract multiple second entities and the relationships between each second entity for constructing a second compliance knowledge graph related to a target application from a target privacy statement text, the following steps are specifically implemented: inputting the target rule text into a predetermined information extraction model to obtain multiple first entities and the relationships between each first entity for constructing the first compliance knowledge graph; and inputting the target privacy statement text into the information extraction model to obtain multiple second entities and the relationships between each second entity for constructing a second compliance knowledge graph related to the target application.

[0177] In one embodiment, when a computer program is executed by a processor to construct a first compliance knowledge graph based on multiple extracted first entities and the relationships between each first entity, the following steps are specifically implemented: based on the target rule text, a first large language model is determined for constructing the first compliance knowledge graph, and a first entity type and a first relationship type are determined for constructing the first knowledge graph; based on the first entity type and the first relationship type, a first knowledge graph is constructed; using the first large language model, the extracted multiple first entities and the relationships between each first entity are mapped to the first knowledge graph to obtain the first compliance knowledge graph.

[0178] In one embodiment, when a computer program is executed by a processor to construct a second compliance knowledge graph based on multiple extracted second entities and the relationships between each second entity, the following steps are specifically implemented: based on the target privacy statement text, a second largest language model is determined for constructing the second compliance knowledge graph, and second entity types and second relationship types are determined for constructing the second knowledge graph; based on the second entity types and the second relationship types, a second knowledge graph is constructed; using the second largest language model, the extracted multiple second entities and the relationships between each second entity are mapped to the second knowledge graph to obtain a second compliance knowledge graph.

[0179] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: based on the compliance detection results, a compliance detection report for personal information is generated; the compliance detection report includes the detection results of multiple compliance detections for personal information.

[0180] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when it is determined that any one of the compliance detection results is non-compliant, prohibiting the target application from using personal information.

[0181] In an exemplary embodiment, the present application provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0182] Extracting multiple first entities and the relationships between the first entities for constructing a first compliance knowledge graph from the target rule text; the target rule text includes one or more of multiple legal and regulatory texts related to personal information after data preprocessing;

[0183] Constructing a first compliance knowledge graph based on the extracted multiple first entities and the relationships between the first entities;

[0184] Extracting, from the target privacy statement text, a plurality of second entities and the relationships between the second entities for constructing a second compliance knowledge graph related to the target application; the target privacy statement text is obtained by performing data preprocessing on the privacy statement text of the target application;

[0185] Constructing a second compliance knowledge graph based on the extracted multiple second entities and the relationships between the second entities;

[0186] Based on the first compliance knowledge graph and the second compliance knowledge graph, compliance detection is performed on the personal information collected and processed by the target application to obtain compliance detection results for the personal information;

[0187] Among them, multiple first entities and multiple second entities all include information collection or processing subjects, data subjects and personal information types; the relationship between each first entity and the relationship between each second entity include information purpose and information collection method.

[0188] In one embodiment, a computer program is executed by a processor to implement compliance testing of personal information collected and processed by a target application based on a first compliance knowledge graph and a second compliance knowledge graph. When obtaining a compliance testing result for the personal information, the following steps are specifically implemented: matching the personal information collected and processed by the target application with the first compliance knowledge graph to obtain a first compliance testing result; matching the personal information with the second compliance knowledge graph to obtain a second compliance testing result; and obtaining a compliance testing result for the personal information based on the first compliance testing result and the second compliance testing result.

[0189] In one embodiment, when a computer program is executed by a processor to extract multiple first entities and the relationships between each first entity for constructing a first compliance knowledge graph from a target rule text, and to extract multiple second entities and the relationships between each second entity for constructing a second compliance knowledge graph related to a target application from a target privacy statement text, the following steps are specifically implemented: inputting the target rule text into a predetermined information extraction model to obtain multiple first entities and the relationships between each first entity for constructing the first compliance knowledge graph; and inputting the target privacy statement text into the information extraction model to obtain multiple second entities and the relationships between each second entity for constructing a second compliance knowledge graph related to the target application.

[0190] In one embodiment, when a computer program is executed by a processor to construct a first compliance knowledge graph based on multiple extracted first entities and the relationships between each first entity, the following steps are specifically implemented: based on the target rule text, a first large language model is determined for constructing the first compliance knowledge graph, and a first entity type and a first relationship type are determined for constructing the first knowledge graph; based on the first entity type and the first relationship type, a first knowledge graph is constructed; using the first large language model, the extracted multiple first entities and the relationships between each first entity are mapped to the first knowledge graph to obtain the first compliance knowledge graph.

[0191] In one embodiment, when a computer program is executed by a processor to construct a second compliance knowledge graph based on multiple extracted second entities and the relationships between each second entity, the following steps are specifically implemented: based on the target privacy statement text, a second largest language model is determined for constructing the second compliance knowledge graph, and second entity types and second relationship types are determined for constructing the second knowledge graph; based on the second entity types and the second relationship types, a second knowledge graph is constructed; using the second largest language model, the extracted multiple second entities and the relationships between each second entity are mapped to the second knowledge graph to obtain a second compliance knowledge graph.

[0192] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: based on the compliance detection results, a compliance detection report for personal information is generated; the compliance detection report includes the detection results of multiple compliance detections for personal information.

[0193] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when it is determined that any one of the compliance detection results is non-compliant, prohibiting the target application from using personal information.

[0194] It should be noted that the data involved in this application (including but not limited to personal information, the text of China's Personal Information Protection Law, the text of the Cybersecurity Law, the text of the Information Security Technology-Personal Information Security Specification, the text of the Target Privacy Statement, etc.) are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0195] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0196] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0197] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A personal information compliance detection method, characterized in that: The method comprises: Extracting multiple first entities and the relationships between the first entities for constructing a first compliance knowledge graph from a target rule text; the target rule text includes one or more of multiple legal and regulatory texts related to personal information after data preprocessing; Constructing the first compliance knowledge graph based on the extracted multiple first entities and the relationship between each of the first entities; Extracting, from the target privacy statement text, a plurality of second entities and the relationship between each of the second entities for constructing a second compliance knowledge graph related to the target application; the target privacy statement text is obtained by performing data preprocessing on the privacy statement text of the target application; Constructing the second compliance knowledge graph based on the extracted multiple second entities and the relationship between each of the second entities; Based on the first compliance knowledge graph and the second compliance knowledge graph, perform compliance detection on the personal information collected and processed by the target application to obtain a compliance detection result for the personal information; Among them, multiple first entities and multiple second entities all include information collection or processing subjects, data subjects and personal information types; the relationship between each first entity and the relationship between each second entity include information purpose and information collection method.

2. The method according to claim 1, characterized in that The step of performing compliance detection on the personal information collected and processed by the target application based on the first compliance knowledge graph and the second compliance knowledge graph to obtain compliance detection results for the personal information includes: Matching the personal information collected and processed by the target application with the first compliance knowledge graph to obtain a first compliance detection result; Matching the personal information with the second compliance knowledge graph to obtain a second compliance detection result; Based on the first compliance test result and the second compliance test result, a compliance test result for the personal information is obtained.

3. The method according to claim 1, characterized in that: Extracting multiple first entities and the relationship between each of the first entities for constructing a first compliance knowledge graph from the target rule text, and extracting multiple second entities and the relationship between each of the second entities for constructing a second compliance knowledge graph related to the target application from the target privacy statement text, including: Inputting the target rule text into a predetermined information extraction model to obtain a plurality of first entities and the relationship between the first entities for constructing a first compliance knowledge graph; and, The target privacy statement text is input into the information extraction model to obtain multiple second entities and the relationship between each second entity for constructing a second compliance knowledge graph related to the target application.

4. The method according to claim 1, characterized in that: The constructing the first compliance knowledge graph based on the extracted multiple first entities and the relationship between each of the first entities includes: Based on the target rule text, determining a first language model for constructing the first compliance knowledge graph, and determining a first entity type and a first relationship type for constructing the first knowledge graph; Based on the first entity type and the first relationship type, construct a first knowledge graph; Using the first large language model, the extracted multiple first entities and the relationship between each of the first entities are mapped to the first knowledge graph to obtain the first compliance knowledge graph.

5. The method according to claim 1, characterized in that The constructing the second compliance knowledge graph based on the extracted plurality of second entities and the relationship between each of the second entities includes: Based on the target privacy statement text, determining a second language model for constructing the second compliance knowledge graph, and determining a second entity type and a second relationship type for constructing the second knowledge graph; Based on the second entity type and the second relationship type, construct the second knowledge graph; Using the second large language model, the extracted multiple second entities and the relationship between each second entity are mapped to the second knowledge graph to obtain the second compliance knowledge graph.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Based on the compliance test result, a compliance test report for the personal information is generated; the compliance test report includes test results of multiple compliance tests on the personal information.

7. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: When it is determined that any one of the compliance detection results is non-compliant, the target application is prohibited from using the personal information.

8. A personal information compliance detection device, characterized in that: The device comprises: An extraction unit, configured to extract a plurality of first entities and the relationship between the first entities for constructing a first compliance knowledge graph from a target rule text; the target rule text includes one or more of a plurality of legal and regulatory texts related to personal information after data preprocessing; A construction unit, configured to construct the first compliance knowledge graph based on the extracted plurality of first entities and the relationship between each of the first entities; The extraction unit is further used to extract, from the target privacy declaration text, a plurality of second entities and the relationship between each of the second entities for constructing a second compliance knowledge graph related to the target application; the target privacy declaration text is obtained by performing data preprocessing on the privacy declaration text of the target application; The construction unit is further used to construct the second compliance knowledge graph based on the extracted second entities and the relationship between each of the second entities; A detection unit, configured to perform compliance detection on the personal information collected and processed by the target application based on the first compliance knowledge graph and the second compliance knowledge graph, and obtain a compliance detection result for the personal information; Among them, multiple first entities and multiple second entities all include information collection or processing subjects, data subjects and personal information types; the relationship between each first entity and the relationship between each second entity include information purpose and information collection method.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images