From Prescription to Description: Mapping the GDPR to a Privacy Policy Corpus Annotation Scheme

Citations Over TimeTop 10% of 2020 papers

Abstract

The European Union’s General Data Protection Regulation (GDPR) has compelled businesses and other organizations to update their privacy policies to state specific information about their data practices. Simultaneously, researchers in natural language processing (NLP) have developed corpora and annotation schemes for extracting salient information from privacy policies, often independently of specific laws. To connect existing NLP research on privacy policies with the GDPR, we introduce a mapping from GDPR provisions to the OPP-115 annotation scheme, which serves as the basis for a growing number of projects to automatically classify privacy policy text. We show that assumptions made in the annotation scheme about the essential topics for a privacy policy reflect many of the same topics that the GDPR requires in these documents. This suggests that OPP-115 continues to be representative of the anatomy of a legally compliant privacy policy, and that the legal assumptions behind it represent the elements of data processing that ought to be disclosed within a policy for transparency. The correspondences we show between OPP-115 and the GDPR suggest the feasibility of bridging existing computational and legal research on privacy policies, benefiting both areas.

Related Papers

• → The impact of the General Data Protection Regulation on health research(2018)99 cited
• → The General Data Protection Regulation (GDPR) Era: Ten Steps for Compliance of Data Processors and Data Controllers(2018)20 cited
• → Research on Personal Data Protection of EU General Data Protection Regulation(2020)4 cited
• → The Protection of Genetic Data under the General Data Protection regulation(2019)
• → A Comparison Between Enforcement of the European Union General Data Protection Regulation (GDPR) and the United States Privacy Regulations(2024)