Legal properties involve reasoning about data values and time. Metric first-order temporal logic (MFOTL) provides a rich formalism for specifying legal properties. While MFOTL has been successfully used for verifying legal properties over operational systems via runtime monitoring, no solution exists for MFOTL-based verification in early-stage system development captured by requirements. Given a legal property and system requirements, both formalized in MFOTL, the compliance of the property can be verified on the requirements via satisfiability checking. In this paper, we propose a practical, sound, and complete (within a given bound) satisfiability checking approach for MFOTL. The approach, based on satisfiability modulo theories (SMT), employs a counterexample-guided strategy to incrementally search for a satisfying solution. We implemented our approach using the Z3 SMT solver and evaluated it on five case studies spanning the healthcare, business administration, banking and aviation domains. Our results indicate that our approach can efficiently determine whether legal properties of interest are met, or generate counterexamples that lead to compliance violations.
We introduce COREQQA, a tool for assisting requirements engineers in acquiring a better understanding of compliance requirements by means of automated Question Answering. Extracting compliance-related requirements by manually navigating through a legal document is both time-consuming and error-prone. COREQQA enables requirements engineers to pose questions in natural language about a compliance-related topic given some legal document, e.g., asking about data breach. The tool then automatically navigates through the legal document and returns to the requirements engineer a list of text passages…
Modern privacy regulations, such as the General Data Protection Regulation (GDPR), address privacy in software systems in a technologically agnostic way by mentioning general "technical measures" for data privacy compliance rather than dictating how these should be implemented. An understanding of the concept of technical measures and how exactly these can be handled in practice, however, is not trivial due to its interdisciplinary nature and the necessary technical-legal interactions. We aim to investigate how the concept of technical measures for data privacy compliance is understood in prac…
Comparing and Conceptualizing Data Protection Requirements Worldwide for Privacy Regulatory Compliance
University of Luxembourg（卢森堡大学）；University of Twente（特温特大学）；FINATRAX, SnT, University of Luxembourg（卢森堡大学科学和技术学院 FINATRAX）；Polytechnic University of Valencia（瓦伦西亚理工大学）；Escuela de Ingeniería Informática, Universidad de Valparaíso（瓦尔帕莱索大学计算机工程学院）
Classifier or Prompt: A Case Study on Legal Requirements Traceability
University of Ottawa（渥太华大学）；University of Luxembourg（卢森堡大学）；Monash University（蒙纳士大学）；Lero Research Ireland centre for Software Research（Lero爱尔兰软件研究中心）；University of Limerick（利默里克大学）
