The Privacy Policy Permission Model: A Unified View of Privacy Policies

TL;DR

A modeling methodology is proposed, called the Privacy Policy Permission Model (PPPM), that provides a uniform, easy-to-understand representation of privacy policies, which can accurately and clearly show how data is used within an organization's practice.

Abstract

Organizations use privacy policies to communicate their data collection practices to their clients. A privacy policy is a set of statements that specifies how an organization gathers, uses, discloses, and maintains a client's data. However, most privacy policies lack a clear, complete explanation of how data providers' information is used. We propose a modeling methodology, called the Privacy Policy Permission Model (PPPM), that provides a uniform, easy-to-understand representation of privacy policies, which can accurately and clearly show how data is used within an organization's practice. Using this methodology, a privacy policy is captured as a diagram. The diagram is capable of highlighting inconsistencies and inaccuracies in the privacy policy. The methodology supports privacy officers in properly and clearly articulating an organization's privacy policy.

Figures (18)

• Figure 1: PPPM as a modeling methodology
• Figure 2: Role layer diagram
• Figure 3: Purpose layer diagram
• Figure 4: Attribute layer diagram
• Figure 5: Role-purpose diagram

Theorems & Definitions (3)

• Example 1
• Example 2
• Example 3