In this paper we argue that policies are an increasing concern for organizations that are operating a web site. Examples of policies that are relevant in the domain of the web address issues such as privacy of personal data, accessibility for the disabled, user conduct, e-commerce, and intellectual property. Web site policies--and the overarching concept of web site governance--are cross-cutting concerns that have to be addressed and implemented at different levels (e.g., policy documents, legal statements, business processes, contracts, auditing, and software systems). For web sites, policies are also reflected in the legal statements that the web site posts, and in the behavior and features that the web site offers to its users. Both policies and software tend to evolve independently, but at the same time they both have to be kept in sync. This is a practical challenge for operators of web sites that is poorly addressed right now and is, we believe, a promising avenue for future research. In this paper, we discuss various challenges that policy poses for web sites with an emphasis on privacy and data protection and identify open issues for future research.
Extracting ODRL Policies from Business Process Models: A Graph Traversal Approach to Compliance-by-Extraction
Ontology Engineering Group, Departamento de Inteligencia Artificial, Universidad Politécnica de Madrid（马德里理工大学）；Dipartimento di Informatica – Scienza e Ingegneria (DISI), Alma Mater Studiorum – Università di Bologna（博洛尼亚大学）；Dipartimento di Informatica, Università degli Studi di Torino（都灵大学）
Case Study: Disclosure of Indirect Device Fingerprinting in Privacy Policies
在线跟踪的最新发展使个人更难检测和阻止跟踪器。一些网站已经部署了间接跟踪方法，试图通过要求浏览器执行与安全无关的任务来唯一识别设备。一种类型的间接跟踪，Canvas指纹识别，使浏览器渲染图形记录渲染统计作为唯一标识符。在这项工作中，我们观察如何在隐私政策中披露间接设备指纹识别方法，并考虑披露是否足以使网站访问者阻止跟踪方法。我们将这些披露与相同网站上直接指纹识别方法的披露进行比较。我们的案例研究分析了一种间接指纹技术，画布指纹。我们使用现有的指纹识别技术的自动检测器来保守地检测其在Alexa Top 500网站上的使用，这些网站迎合了美国消费者，我们检查了由此产生的28个网站的隐私政策。间接指纹识别的披露在具体性上各不相同。没有人描述了足够粒度的具体方法来了解网站使用Canvas指纹识别。相反，许多网站确实提供了有关直接指纹识别方法使用的足够详细信息，以允许网站访问者可靠地检测和阻止这些技术。我们的结论是，间接指纹识别方法往往难以检测，并没有确定与隐私政策的特异性。这使得间接指纹更难阻止，因此有可能破坏目前个人和网站之间的暂时停战，以直接指纹。本文阐述了指纹识别方法的差异，并解释了为什么技术专家，技术律师和政策制定者需要理解间接指纹识别的挑战。
