GDPR-Compliant Use of Blockchain for Secure Usage Logs
Valentin Zieglmeier, Gabriel Loyola Daiqui
备注：
Peer-reviewed version accepted for publication in the proceedings of the 2021 International Conference on Evaluation and Assessment in Software Engineering (EASE'21)
The unique properties of blockchain enable central requirements of distributed secure logging: Immutability, integrity, and availability. Especially when providing transparency about data usages, a blockchain-based secure log can be beneficial, as no trusted third party is required. Yet, with data governed by privacy legislation such as the GDPR or CCPA, the core advantage of immutability becomes a liability. After a rightful request, an individual's personal data need to be rectified or deleted, which is impossible in an immutable blockchain. To solve this issue, we exploit a legal property of pseudonymized data: They are only regarded personal data if they can be associated with an individual's identity. We make use of this fact by presenting P3, a pseudonym provisioning system for secure usage logs including a protocol for recording new usages. For each new block, a one-time transaction pseudonym is generated. The pseudonym generation algorithm guarantees unlinkability and enables proof of ownership. These properties enable GDPR-compliant use of blockchain, as data subjects can exercise their legal rights with regards to their personal data. The new-usage protocol ensures non-repudiation, and therefore accountability and liability. Most importantly, our approach does not require a trusted third party and is independent of the utilized blockchain software.
NL2GDPR: Automatically Develop GDPR Compliant Android Application Features from Natural Language
Baidu Research（百度研究院）
最近的隐私泄露事件和更严格的政策法规要求公司和移动应用程序的合规标准要高得多。然而，这些义务也给应用程序开发人员带来了重大挑战，他们需要遵守这些包含各种观点、活动和角色的法规，特别是对于在这方面经验较少或资源有限的小公司和开发人员。为了解决这些障碍，我们开发了一个自动工具NL2GDPR，它可以从开发人员的自然语言描述中生成策略，同时还确保应用程序的功能符合通用数据保护条例（GDPR）。NL2 GDPR是利用百度认知计算实验室开发的信息抽取工具OIA（Open Information Annotation）开发的。NL2GDPR的核心是一个以隐私为中心的信息抽取模型，并附加了GDPR策略查找器和策略生成器。我们进行了全面的研究，以掌握在提取以隐私为中心的信息和生成隐私政策的挑战，同时利用优化这一特定的任务。借助NL2GDPR，我们可以分别实现92.9%、95.2%和98.4%的准确率，正确识别与个人数据存储、处理和共享类型相关的GDPR政策。据我们所知，NL2GDPR是第一个允许开发人员自动生成GDPR合规策略的工具，只需要输入自然语言来描述应用程序功能。请注意，其他非GDPR相关功能可能与生成的功能集成，以构建复杂的应用程序。
Policy-Driven AI in Dataspaces: Taxonomy, Explainability, and Pathways for Compliant Innovation
Department of CST Tsinghua University Beijing, China（计算机科学与技术系 清华大学 北京中国）；Department of CSE Chandigarh University Mohali, India（计算机科学与工程系 印度昌迪加尔大学 摩哈利）
