Authors:
Alberto Rodrigues da Silva
1
;
João Caramujo
1
;
Shaghayegh Monfared
1
;
Pavel Calado
1
and
Travis Breaux
2
Affiliations:
1
Universidade de Lisboa, Portugal
;
2
Carnegie Mellon University, United States
Keyword(s):
Privacy Policy, Privacy-aware Specific Language, Requirements Specification, Quality of Requirements.
Related
Ontology
Subjects/Areas/Topics:
Computer-Supported Education
;
Enterprise Information Systems
;
Information Systems Analysis and Specification
;
Information Technologies Supporting Learning
;
Requirements Analysis And Management
;
Security
;
Security and Privacy
;
Tools, Techniques and Methodologies for System Development
Abstract:
The common operation of popular web and mobile information systems involves the collection and retention of personal information and sensitive information about their users. This information needs to remain private and each system should show a privacy policy that describes in-depth how the users' information is managed and disclosed. However, the lack of a clear understanding and of a precise mechanism to enforce the statements described in the policy can constraint the development and adoption of these requirements. RSLingo4Privacy is a multi-language approach that intends to improve the specification and analysis of such policies, and which includes several processes with respective tools, namely: (P1) automatic classification and extraction of statements and text snippets from original policies into equivalent and logically consistent specifications (based on a privacy-aware specific language); (P2) visualization and authoring these statements in a consistent and rigorous way bas
ed on that privacy-aware specific language; (P3) automatic analysis and validation of the quality of these specifications; and finally (P4) policies (re)publishing. This paper presents and discusses the first two processes (P1 and P2). Despite having been evaluated against the policies of the most popular systems, for the sake of briefness, we just consider the Facebook policy for supporting the presentation and discussion of current results of the proposed approach.
(More)