aitrainingdatabroker/privacy-law-classifier

Privacy Law Classifier

Reads one sentence about company records and names the rule it most likely points to, out of 21: HIPAA, 42 CFR Part 2, CCPA and CPRA, other US state privacy laws, GDPR, UK GDPR, PIPEDA and Quebec Law 25, GLBA and the FTC Safeguards Rule, FCRA, COPPA, PCI DSS, CAN-SPAM, the Fair Housing Act, the Driver's Privacy Protection Act, ITAR and EAR, CUI and DFARS, GINA, 21 CFR Part 11, attorney-client privilege, contractual confidentiality and NDAs, and trade secret protection.

Every name, number and address it was trained on is made up. Nothing comes from a real person, patient, customer or business.

Why it exists

When a company prepares records for an AI data license, the first question is which rules the data falls under, and that depends on what the records mention: patient charts, card numbers, EU customers, tenant screening, export-controlled drawings. This model sorts notes, tickets and review comments by the rule they raise, so the right checklist and the right counsel see them. It is a router for review, not a legal answer.

Use it

from transformers import pipeline

classify = pipeline("text-classification", model="aitrainingdatabroker/privacy-law-classifier", top_k=3)
print(classify("We found cardholder data and CVV codes in free-text notes during the scan."))

How it was trained

Fine-tuned from distilroberta-base for 6 epochs on one RTX 3070. Training data: data-compliance-frameworks (1256 rows), all invented. The scripts that built the data, trained the model and scored it are in source/; the full scores are in scores.json.

Test scores

On 471 held-out rows: accuracy 0.93, macro F1 0.936.

Label	F1	Count
21 CFR Part 11	1.0	24
42 CFR Part 2	1.0	24
Attorney-client privilege and professional conduct rules	0.95	21
CAN-SPAM	0.865	21
CCPA and CPRA	0.8	21
COPPA	1.0	21
CUI and DFARS	0.913	21
Contractual confidentiality and NDAs	0.95	21
Driver's Privacy Protection Act	1.0	21
FCRA	1.0	24
Fair Housing Act	1.0	21
GDPR	0.685	27
GINA	1.0	21
GLBA and the FTC Safeguards Rule	0.976	21
HIPAA	0.966	30
ITAR and EAR	0.906	24
Other US state privacy laws	0.941	18
PCI DSS	0.957	24
PIPEDA and Quebec Law 25	0.909	21
Trade secret protection	0.909	24
UK GDPR	0.923	21

Limits

• One label per sentence. Real records often fall under several rules at once (an EU patient's card number); use the top few scores, not only the first.
• Trained on invented sentences built from each rule's key terms, so it reacts to vocabulary. A sentence that describes health data without health words can be missed.
• GDPR and UK GDPR, and CCPA and other US state laws, share most of their vocabulary and are the classes it confuses most.
• This model is not legal advice and not a certification. Whether a de-identification method meets HIPAA Safe Harbor or Expert Determination, CCPA and CPRA, GDPR or UK GDPR anonymisation, PIPEDA, Quebec Law 25 or another rule is a question for your counsel and, where a rule requires one, a qualified expert. A person should review its output before any data is shared.

Read more

• Privacy rules by region before you sell company data to AI
• De-identified data under CCPA vs anonymous data under GDPR

License and credit

Apache 2.0. Please credit AI Training Data Broker and link to https://aitrainingdatabroker.com/ when you share or build on it.

About

AI Training Data Broker is a broker and technical advisor for companies that sell or license their data to AI labs. It guides the technical side, including export, format, de-identification and compliance, and publishes free checklists on de-identifying data and keeping it within the privacy rules that apply.