AI-enabled Automation for Completeness Checking of Privacy Policies
Orlando Amaral, Sallam Abualhaija, Damiano Torre, Mehrdad Sabetzadeh,, Lionel C. Briand

TL;DR
This paper presents an AI-based automated method to verify the completeness of privacy policies in accordance with GDPR, improving accuracy and efficiency over manual checks and keyword-based approaches.
Contribution
It introduces a novel AI-driven approach combining NLP and machine learning to systematically check privacy policies against GDPR completeness criteria.
Findings
Achieved 92.9% precision and 89.8% recall in detecting violations.
Improved over keyword search baseline by 24.5% in precision and 38% in recall.
Validated on 234 real privacy policies with effective violation detection.
Abstract
Technological advances in information sharing have raised concerns about data protection. Privacy policies contain privacy-related requirements about how the personal data of individuals will be handled by an organization or a software system (e.g., a web service or an app). In Europe, privacy policies are subject to compliance with the General Data Protection Regulation (GDPR). A prerequisite for GDPR compliance checking is to verify whether the content of a privacy policy is complete according to the provisions of GDPR. Incomplete privacy policies might result in large fines on violating organization as well as incomplete privacy-related software specifications. Manual completeness checking is both time-consuming and error-prone. In this paper, we propose AI-based automation for the completeness checking of privacy policies. Through systematic qualitative methods, we first build two…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
Methodstravel james
