We address the problem of complying with the GDPR while processing and transferring personal data on the web. For this purpose we introduce an extensible profile of OWL2 for representing data protection policies. With this language, a company's data usage policy can be checked for compliance with data subjects' consent and with a formalized fragment of the GDPR by means of subsumption queries. The outer structure of the policies is restricted in order to make compliance checking highly scalable, as required when processing high-frequency data streams or large data volumes. However, the vocabularies for specifying policy properties can be chosen rather freely from expressive Horn fragments of OWL2. We exploit IBQ reasoning to integrate specialized reasoners for the policy language and the vocabulary's language. Our experiments show that this approach significantly improves performance.
Legal Innovation Lab Wales（威尔士法律创新实验室）；Dublin City University（都柏林城市大学）
Reified Input/Output (I/O) logic[21] has been recently proposed to model real-world norms in terms of the logic in [11]. This is massively grounded on the notion of reification, and it has specifically designed to model meaning of natural language sentences, such as the ones occurring in existing legislation. This paper presents a methodology to carry out compliance checking on reified I/O logic formulae. These are translated in SHACL (Shapes Constraint Language) shapes, a recent W3C recommendation to validate and reason with RDF triplestores. Compliance checking is then enforced by validating…
One of the main issues of every business process is to be compliant with legal rules. This work presents a methodology to check in a semi-automated way the regulatory compliance of a business process. We analyse an e-Health hospital service in particular: the Hospital at Home (HaH) service. The paper shows, at first, the analysis of the hospital business using the Business Process Management and Notation (BPMN) standard language, then, the formalization in Defeasible Deontic Logic (DDL) of some rules of the European General Data Protection Regulation (GDPR). The aim is to show how to combine a…
Sharif University of Technology（谢里夫理工大学）；University of California, Berkeley（加州大学伯克利分校）；Volkswagen Group Data:Lab（大众汽车集团数据实验室）
Underlying computational model has an important role in any computation. The state and transition (such as in automata) and rule and value (such as in Lisp and logic programming) are two comparable and counterpart computational models. Both of deductive and model checking verification techniques are relying on a notion of state and as a result, their underlying computational models are state dependent. Some verification problems (such as compliance checking by which an under compliance system is verified against some regulations and rules) have not a strong notion of state nor transition. Beha…
We propose Dr.Aid, a logic-based AI framework for automated compliance checking of data governance rules over data-flow graphs. The rules are modelled using a formal language based on situation calculus and are suitable for decentralized contexts with multi-input-multi-output (MIMO) processes. Dr.Aid models data rules and flow rules and checks compliance by reasoning about the propagation, combination, modification and application of data rules over the data flow graphs. Our approach is driven and evaluated by real-world datasets using provenance graphs from data-intensive research.
Automating Geometry-Intensive Compliance Checking in BIM: Graph-Based Semantic Reasoning Framework
Department of Urban Planning and Design, The University of Hong Kong（香港大学城市规划与设计系）；Department of Civil and Environmental Engineering, The Hong Kong University of Science and Technology（香港科学与技术大学土木与环境工程系）
ARCEAK: An Automated Rule Checking Framework Enhanced with Architectural Knowledge
Shanghai Jiao Tong University（上海交通大学）；Beijing University of Civil Engineering and Architecture（北京建筑大学）；East China Architectural Design & Research Institute（华东建筑设计研究院）
Vienna University of Economics and Business（维也纳经济大学）；Universita di Napoli Federico II（那不勒斯费德里科二世大学）；Tenforce（Tenforce公司）；W3C（万维网联盟）
The European General Data Protection Regulation (GDPR) brings new challenges for companies who must ensure they have an appropriate legal basis for processing personal data and must provide transparency with respect to personal data processing and sharing within and between organisations. Additionally, when it comes to consent as a legal basis, companies need to ensure that they comply with usage constraints specified by data subjects. This paper presents the policy language and supporting ontologies and vocabularies, developed within the SPECIAL EU H2020 project, which can be used to represen…
Multi-Agent Legal Verifier Systems for Data Transfer Planning
Center of Juris-Informatics, Joint Support-Center for Data Science Research, ROIS, Tokyo, Japan（司法信息中心、数据科学研究联合支持中心、ROIS、东京、日本）；Research and Development Center for Large Language Models, NII, ROIS, Tokyo, Japan（大语言模型研究与开发中心、日本信息机构、ROIS、东京、日本）
Transparency as Architecture: Structural Compliance Gaps in EU AI Act Article 50 II
Technichal University Berlin XpaliNLP Group（柏林工业大学 XpaliNLP 组）；Research Center for Artificial Intelligence (DFKI)（人工智能研究中心（DFKI））；Center for European Research on Trusted AI (CERTAIN)（欧洲可信人工智能研究中心（CERTAIN））
SnT Centre for Security, Reliability, and Trust, University of Luxembourg（卢森堡大学SnT安全、可靠性与信任中心）；University of Ottawa（渥太华大学）；Texas A&M University – Central Texas（得克萨斯农工大学中央得克萨斯分校）
Technological advances in information sharing have raised concerns about data protection. Privacy policies contain privacy-related requirements about how the personal data of individuals will be handled by an organization or a software system (e.g., a web service or an app). In Europe, privacy policies are subject to compliance with the General Data Protection Regulation (GDPR). A prerequisite for GDPR compliance checking is to verify whether the content of a privacy policy is complete according to the provisions of GDPR. Incomplete privacy policies might result in large fines on violating org…
Translating Regulatory Clauses into Executable Codes for Building Design Checking via Large Language Model Driven Function Matching and Composing
Tsinghua University（清华大学）；Wuliangye Yibin Co., Ltd.（五粮液宜宾有限公司）；Yantai University（烟台大学）；Key Laboratory of Digital Construction and Digital Twin, Ministry of Housing and Urban-Rural Development（住房和城乡建设部数字建造与数字孪生重点实验室）
The General Data Protection Regulation (GDPR) aims to ensure that all personal data processing activities are fair and transparent for the European Union (EU) citizens, regardless of whether these are carried out within the EU or anywhere else. To this end, it sets strict requirements to transfer personal data outside the EU. However, checking these requirements is a daunting task for supervisory authorities, particularly in the mobile app domain due to the huge number of apps available and their dynamic nature. In this paper, we propose a fully automated method to assess the compliance of mob…
