![](bg8.png)
purpose(p24 ,(‘‘ MailAdvertisements ’’, true , false ,
1668495600,[...],[...],[ dt01, dt04, dt34, dt48, dt58,
dt74 ],[ ],[ ],[ dr2 ],[ lb4 ],[ ], r )).
Listing 1: Excerpt of the P-LPL representation of the pri-
vacy policy sentence from Listing 2 (Ekundayo, 2022).
for software that operates automatically. A software
regularly aggregating statistics about some data con-
cerning customers, for example, could be assigned
with a specific purpose. Data subjects could then deny
consent for this purpose to prohibit the software from
performing this statistical analysis on their personal
data.
In contrast to our access purpose identification
based on role and software, Byun and Li base their
access purpose identification on roles and attributes
(Byun and Li, 2008).
4.4 P-LPL Privacy Policy
The decision process for granting or denying access
to data is based on the content of P-LPL privacy poli-
cies. Listing 1 shows the purpose MailAdvertise-
ments, which is part of a translation of ebay.com’s
privacy policy. Listing 2 shows an excerpt of the orig-
inal textual privacy policy, which was translated to the
MailAdvertisements purpose.
The purpose shown in Listing 1 has the inter-
nal ID p24 and is externally known by the unique
name MailAdvertisements. The two Boolean values
true, false state that this purpose can be opted out
of, and that the data subject is not required to ac-
cept this purpose for a successful interaction with
the data controller. The number 1668495600 is the
Unix timestamp of the point in time when the data
subject accepted this purpose. Due to space con-
straints, we removed the verbose textual headers and
descriptions ([...],[...]) from the purpose. The list
[dt01,dt04,dt34,dt48,dt58,dt74] references six data
elements, which are defined in the P-LPL policy, stat-
ing what data may be processed for this purpose. The
two empty lists ([ ], [ ]) state that no privacy models
(e.g., k-anonymity) or pseudonymization methods are
applied to the data. A data processor is assigned to
this purpose, expressed by dr2, the ID of the proces-
sor receiving the data for this purpose. The legal basis
for this purpose is referenced by [lb4]. This informa-
tion is followed by another empty list [ ] which states
that the purpose is not using automated decision mak-
‘‘ Advertisements by mail ( according to your
communication preferences in your eBay account ).’’
Listing 2: Excerpt from ebay.com’s privacy policy (eBay
GmbH, 2021): Purpose Mail Advertisements.
1accessibleData (D,LPP,P,R) :−
2LPP = ( , , , , , , , , PP,PH, , , , , ),
3getDataAndConsentPH(P,PP,PH,DT),
4DT \= [],
5mapDataNames(DT,DTN),
6accessibleDataPurpose (D,DTN,R).
Listing 3: Main rule of the P2BAC decision point (Prolog).
ing. Finally, r is a reference to the part of the policy
describing for how long the data for this purpose may
be stored (retention).
4.5 P2BAC Decision Point
We implement a P2BAC decision point in Prolog,
working directly on the P-LPL privacy policy. This
decision point can be used efficiently for access re-
quests concerning a single data subject’s data. For re-
quests covering the data of multiple data subjects we
propose to adapt the allowed intended purpose con-
cept of Byun and Li (Byun and Li, 2008), which we
describe in further detail in Section 4.6.
Listing 3 shows the main Prolog rule, which is
used to evaluate an access request. The head of the
rule in line 1 contains four variables. The first three
variables are used as inputs, where D is the list of data
elements that the decision point needs to consider.
In Listing 4 we show an exemplary access request
encoded in Prolog. The list [“address”,“name”] cor-
responds to the variable D in Listing 3. The variable
LPP, in Listing 3, needs to be initialized with the root
tuple of the privacy policy, from which we then ex-
tract the list of purposes PP and the purpose hierar-
chy PH in line 2 of Listing 3. The third variable P
takes the purpose for which the data is requested as
input; in our example in Listing 4 we use the purpose
MailAdvertisements.
Line 3 of Listing 3 extracts all allowed data el-
ements for the given purpose P from either the pur-
poses PP or the purpose hierarchy PH and returns
the list of data elements in DT. If P is one of the
purpose categories, e.g., marketing, getDataAndCon-
sentPH calculates the intersection of the sets of data
elements of each sub-purpose, returning a list of data
elements that may be processed for any of the sub-
purposes of the requested purpose category. Because
of the use of the intersection, which is a restrictive
way of deciding the access request, we suggest for-
mulating precise access requests, providing the most
specific purpose possible.
accessibleData ([‘‘ address ’ ’ ,‘‘ name’’], LPP,
‘‘ MailAdvertisements’’ , R).
Listing 4: Access request in Prolog for the purpose MailAd-
vertisements with data address and name.
P2BAC: Privacy Policy Based Access Control Using P-LPL
693