Lawful and Accountable Personal Data Processing with GDPR-based Access and Usage Control in Distributed Systems
L. Thomas van Binsbergen, Marten C. Steketee, Milen G. Kebede, Heleen L. Janssen, Tom M. van Engers
TL;DR
This work tackles the GDPR compliance burden in distributed data processing by introducing a case‑generic, human‑in‑the‑loop normative reasoning framework. It defines an ontology and formal semantics implemented in the eFLINT domain‑specific language and extends XACML to support GDPR‑based access and usage control in distributed systems. Through a detailed example of purpose graphs and multiple processing scenarios, it demonstrates how lawfulness arguments are constructed and how authorisations are generated or denied, enabling both ex‑ante control and ex‑post auditing for transparency and accountability. The approach emphasizes modularity, adaptability to evolving interpretations of GDPR, and clear separation between normative interpretation and system implementation, with integration patterns and governance roles laid out for real‑world data sharing ecosystems.
Abstract
Compliance with the GDPR privacy regulation places a significant burden on organisations regarding the handling of personal data. The perceived efforts and risks of complying with the GDPR further increase when data processing activities span across organisational boundaries, as is the case in both small-scale data sharing settings and in large-scale international data spaces. This paper addresses these concerns by proposing a case-generic method for automated normative reasoning that establishes legal arguments for the lawfulness of data processing activities. The arguments are established on the basis of case-specific legal qualifications made by privacy experts, bringing the human in the loop. The obtained expert system promotes transparency and accountability, remains adaptable to extended or altered interpretations of the GDPR, and integrates into novel or existing distributed data processing systems. This result is achieved by defining a formal ontology and semantics for automated normative reasoning based on an analysis of the purpose-limitation principle of the GDPR. The ontology and semantics are implemented in eFLINT, a domain-specific language for specifying and reasoning with norms. The XACML architecture standard, applicable to both access and usage control, is extended, demonstrating how GDPR-based normative reasoning can integrate into (existing, distributed) systems for data processing. The resulting system is designed and critically assessed in reference to requirements extracted from the GPDR.