Data-Purpose Algebra: Modeling Data Usage Policies

Lalana Kagal

Overview

Privacy protection in large scale decentralized systems
Privacy policies
- Not just about preventing access to certain information
- Also regulates what you can do with the information - statistical analysis, research, civil case, criminal investigations, etc.
Must take usage restrictions into consideration while reasoning about privacy
Possible Enforcement Mechanisms
- Specific tools that enforce usage restrictions E.g. Provenance Aware Documents: http://dig.csail.mit.edu/TAMI/harveyj/provenance-final/thesis-presentation.html
- Reason over annotated transaction logs and audit trails to check if any violations occured

Open systems
- information about individuals is easily obtained - web, public records, etc.
- difficult to prevent information leakage
- tools can be bypassed
Facilitate compliance of usage policies by reasoning over audit trails
Aimed at environments where audit trails are usually stored such as government organizations and scientific analysis

Case Study: Privacy Act(5 USC § 552a)

Part of the Privacy Act
"Data collected about US citizens can be used only for the purposes for which it was collected"

A model for realizing privacy policies in terms of allowable uses of information
Subclass of privacy policies that restrict how data can be used in terms of the path by which the data was obtained
- Examples: Privacy Act, digital rights management

What does DPA do ?

Describes the ways that the use of data may be restricted
Describes how restrictions are transformed as data is processed and passed from one agent to another

How does it work?

Restrictions over how and what data can be mined, used, and shared
Data can be sent from one entity to another. The use of this data is further restricted by sender
Restrictions on the uses of data can be formulated as algebraic expressions
Expressions describe how restrictions can be computed from provenance (history) of data

Agent: a''
Two data item: i and j
Content: Q_d(i) and Q_d(j)
Category: K_d(i) and K_d(j)
Purpose/Use: P_d(i) and P_d(j)
New purpose/use: function of (P_d(i), P_d(j), A_d(i), A_d(j), a'', K_d(i), K_d(j))

"Data collected about US citizens can be used only for the purposes for which it was collected"
When an agency collects information (stored in Systems of Records (SOR)) about US citizens, the agency must provide a System of Records Notice (SORN)
SORN describes what kind of information was collected, for what purpose, what it can be used for

When information is put into a SOR (collected), or moved from one SOR to another (shared), its uses can be computed as

Related Work

Future Work

Conflicting usage restrictions
Issues related to combining anonymized data
Modeling privacy policies that are not dependent on the path by which information is obtained

Algebraic approach for modeling allowable uses of information
Suitable when restrictions on data use are determined by path by which information is obtained
Not suitable when usage restrictions are independent of path - time or content dependent

More information