Server application and method for checking the plausibility of privacy statements

A server application, in particular an electronic marketplace for access by a user to information, data, and/or services that are provided by at least one provider as an offering in the server application. The server application is configured for checking the plausibility of the privacy statements based on a comparison of privacy statements for the information, the data, and/or the service to data protection-relevant metainformation of the associated offering.

CROSS REFERENCE

The present application claims the benefit under 35 U.S.C. § 119 of German Patent Application No. DE 102017218547.3 filed on Oct. 18, 2017, which is expressly incorporated herein by reference in its entirety.

FIELD

The present invention relates to a server application, in particular an electronic marketplace for access to information, data, and/or services, that is configured for checking the plausibility of privacy statements. Moreover, the present invention relates to a method for checking the plausibility of privacy statements for the information, data, and/or services. Furthermore, the present invention relates to a computer program that carries out each step of the method when the method runs on a computer, and a non-transitory machine-readable memory medium that stores the computer program.

BACKGROUND INFORMATION

Information, data, and/or services are offered on an electronic marketplace. The information, data, and/or services are provided by at least one provider as an offering on the electronic marketplace. A user or the user's service registers on the electronic marketplace, via which they may then find a suitable provider for their needed information, data, and/or services. A typical user is a developer of an application, who develops the application from the information, data, and/or services. Optionally, a payment may also be processed via the electronic marketplace. In order for the application to be ultimately passed on to the end user, he/she needs data protection characteristics concerning the used information, data, and/or services. The end user obtains these primarily from the privacy statements that are provided by the provider. However, these privacy statements may be erroneous. Erroneous privacy statements may, for example, also be the result of a service accessing other information, data, and/or services and disregarding their privacy statements. Regardless of whether the privacy statements are erroneous due to intentional or unintentional actions, independent plausibility checking of the privacy statements is advantageous.

SUMMARY

A server application for access to information, data, and/or services by a user is provided. The server application may be provided on a server which at least the user and a provider may access, for example with the aid of a communication network. The server application is in particular an electronic marketplace on which the information, data, and/or services are offered, traded, exchanged, and/or sold. The information, data, and/or services are provided by at least one provider as an offering in the server application. For example, information from sensors, or processed data or services that process and/or transform the information, are offered in the server application. The provider indicates privacy statements concerning the information, data, and/or services or for the associated offering. The user is, for example, a developer of an application. The user may obtain the needed information, data, and/or services from the provider directly via the server application, and on this basis may develop his/her application. To learn data protection characteristics concerning the obtained information, data, and/or services, the developer may access at least the privacy statements of the provider. The data protection characteristics are relevant in particular when the developer ultimately passes on this application to the end user. The application itself and/or some other service that accesses the information, the data, and/or the service on the server application may also be regarded as users. In addition, an end customer him/herself may be a user.

The offering is a formalized description of the information, the data, and/or the service in a standardized format. The offering may be regarded as a model for the information, the data, and/or the service with regard to the following aspects; not all of the following aspects have to be contained in the offering, and other aspects may be additionally incorporated:information, data, and/or services are offered;the source of the data;the quality of the data; andthe format in which the data are offered.

Altogether, the offering provides comprehensive information concerning the offered information, data, and/or services, in particular technical information and other characteristics.

The offering includes metainformation, i.e., information related to the offering, such as:the address;authentication mechanisms; andwhich data are provided.

Also included are data protection-relevant pieces of metainformation that provide information concerning data protection characteristics of the offered information, data, and/or services, such as:which data are collected;for what purpose are the data collected;are more data collected than necessary;are the data passed on; andare the data resold.

The server application is configured for checking the plausibility of the privacy statements based on a comparison of the privacy statements for the information, the data, and/or the service provided by the provider to the data protection-relevant metainformation of the associated offering. In other words, a comparison is made of what is asserted in the privacy statements, which data are needed for a service, for example, and how they are used, to which data are actually needed for the service and how they are actually used, the latter being learned from the data protection-relevant metainformation of the associated offering. If the privacy statements match the metainformation, the privacy statements are checked for plausibility and therefore regarded as correct.

The metainformation is preferably stored in annotations. According to one aspect, the annotations may be stored in the server application as part of the offering. According to another aspect, the annotations may be directly stored and retrieved in the server application for the provided service. According to yet another aspect, the annotations may be transmitted together with data that are transferred in the communication network, for example from the provider to the user, with the aid of the server application. These aspects all offer the advantage that the metainformation is accessible and may be easily retrieved.

The data protection characteristics may be output as a display signal and displayed to the user. For displaying the display signal, any display element that is linked to the communication network, but preferably a combined input and display device such as a PC or a mobile terminal, may be used. Privacy icons, which are a type of display in the form of symbols (icons), are particularly suited for depicting the data protection characteristics. The privacy icons may be emphasized in different colors and/or shapes in order to evaluate the data protection characteristics. Privacy icons may on the one hand be applied to the offering in the server application in order to directly inform a user about the data protection characteristics. On the other hand, the privacy icons may be used in an application that accesses the information, data, and/or services provided in the server application in order to display to an end user of this application the data protection characteristics, in particular also the information, data, and/or services, i.e., the data sources, that are reverted to.

The privacy icons include in particular the following data protection aspects:minimum necessary data;how long are data stored;are data processed only for the purpose for which they have been collected;are no personal data passed on;are no personal data resold;encryption;previous services and/or data sources that were considered are likewise checked and taken into account.

Moreover, a method for checking the plausibility of the privacy statements for the information, data, and/or services that are provided by at least one provider as an offering in the server application is provided. The method includes the following steps: At the start, the privacy statements for the information, data, and/or services are collected. The privacy statements are usually indicated by the provider. In addition, the data protection-relevant metainformation of the offering is determined. For this purpose, additional metainformation of all providers that provide the information, the data, and/or the service is preferably included when determining the data protection-relevant metainformation.

The privacy statements for the information, the data, and/or the service provided by the provider are compared to the associated metainformation of the offering. In other words, what is asserted in the privacy statements, which data are needed for a service, for example, and how these data are used are compared to which data are actually needed for the service and how the data are actually used, the latter being learned from the data protection-relevant metainformation of the associated offering. It may be determined, among other things, whether data are further transmitted, whether payment is made for the further transmission, and/or whether a service collects unnecessary data; for this purpose, the information that is reasonable and necessary for the intended uses may be determined with the aid of a database.

If the privacy statements match the metainformation, the privacy statements are plausibility-checked and therefore regarded as correct.

However, if the privacy statements differ from the metainformation, one or more of the following countermeasures (or others) may be taken by the server application:The metainformation of the offering may be adapted.The privacy statements may be adapted.Access to the information, data, and/or services that have not been plausibility-checked may be blocked, as the result of which they are no longer available to users.A warning signal may be output and displayed to the users, preferably when they attempt to access the information, data, and/or services not checked for plausibility.

The stated countermeasures may be selected based on selection criteria. Several selection criteria are listed below as an example; not all of the stated selection criteria have to be checked, and on the other hand, further selection criteria may be added:Will an additional test (audit) of the information, data, and/or services with regard to further standards (not described in greater detail here) be carried out?Is there other data protection information that has not previously been used in this method and that may be reverted to?Who are the providers of the information, data, and/or services in question, and how are they configured? Are the providers certified or otherwise particularly trustworthy?Is there an option to display the warning signal to the user, for example via a user terminal and/or an interface?

As described above, the metainformation may preferably be stored in annotations, and according to one aspect the annotations may be stored in the server application as part of the offering, and according to another aspect may be stored in the server application for the provided service, and according to yet another aspect may be transferred with data that are transmitted via the communication network, with the aid of the server application.

Other metainformation from previous information, data, and/or services reverted to by the current information, data, and/or services may advantageously be taken into account in the comparison. This sequence may be continued recursively until all information, data, and/or services reverted to in this sequence are taken into account. In this way, data protection characteristics of the previous information, data, and/or services are also checked. As an example case, it is to be assumed that an offered first service reverts to a second service that does not encrypt the data that it uses. The provider indicates in the privacy statements of the first service that the data are encrypted. Even if the first service encrypts the data, the privacy statements are not checked for plausibility, since the data have not been thoroughly encrypted.

The computer program is configured for carrying out each step of the method, in particular when it is executed on a computer. For implementation, the computer program is stored on the machine-readable memory medium.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

FIG. 1shows a communication network between a server10on which one specific embodiment of the server application according to the present invention is provided, a provider2, and a user3. Provider2uses a provider terminal20that is in contact with server10via a provider router21in order to access the communication network and to interact with server10. Provider2may at least make inputs to server10with the aid of provider terminal20. Similarly, user3uses a user terminal30that is in contact with server10via a user router31in order to access the communication network and to interact with server10. User3may at least make inputs to server10via user terminal30and display signals that are emitted by server10. In particular, a warning signal may also be displayed to user3. Provider terminal20and user terminal30are input devices and optionally display devices such as a PC or a mobile terminal. In another exemplary embodiment, provider2and user3may additionally be directly connected to one another within the communication network via their routers21,31. In addition, a blocking device13is provided which partially or completely prevents access by user3to information, data, and/or services of server10. Blocking device13may also be part of server10.

FIG. 2illustrates a diagram of a system architecture of the communication network fromFIG. 1. The server application according to the present invention is provided on server10in the form of an electronic marketplace1. In addition,FIG. 2shows a flow chart for access to information, data, and/or services by user3. Provider2provides100information, data, and/or services as an offering4on electronic marketplace1. In addition, provider2provides101privacy statements DA to offering4. In this example and in the exemplary embodiments of the present invention described below, user3is a developer of an application that registers110on electronic marketplace1in order to obtain access to information, data, and/or services from which the developer may develop his/her application. A payment may also be processed (not illustrated here) via electronic marketplace1. With the aid of electronic marketplace1, user3finds111a provider2for the desired information, data, and/or services. User3subsequently accesses120the information, data, and/or services offered by provider2, and based on same develops121the application. When the developer (user3) subsequently passes on this application to an end user (not shown), the developer indicates privacy statements DA, stated by provider2, as data protection characteristics of the application.

FIG. 3shows a diagram of a system architecture of the communication network fromFIG. 1, in which user3is accessing120the information, data, and/or services offered by provider2. For the sake of simplicity, the description in this exemplary embodiment is limited to data5. However, the procedure may generally also be carried out in the same way using information and/or services. Data5are transmitted by provider2to user3.

FIG. 3also illustrates three different variants of annotations Aa, Ab, and Ac, in which metainformation MI concerning offering4is stored. This metainformation MI also includes data protection-relevant metainformation, which provides information concerning data protection characteristics of offered data5, such as:which data are collected;for what purpose the data are collected;are more data collected than necessary;are the data passed on; andare the data resold.

Various types of annotations are provided: Offering annotations Aa are stored as part of offering4on electronic marketplace1. Provider annotations Ab are retrievable on the service of provider2provided on electronic marketplace1. Data annotations together with transmitted data5are transferred to user3. Metainformation MI is easily accessible via annotations Aa, Ab, and Ac.

Electronic marketplace1is configured for checking the plausibility of privacy statements DA, based on a comparison of privacy statements DA for data5provided101by provider2to metainformation MI of associated offering4stored in annotations Aa, Ab, and Ac. For this purpose, electronic marketplace1may carry out one specific embodiment of the method according to the present invention for checking the plausibility of privacy statements DA, as shown by way of example inFIG. 3.

FIG. 4shows one specific embodiment of the method according to the present invention for checking the plausibility of privacy statements DA. At the start, as illustrated inFIG. 2, provider2provides100the information, data, and/or services as offering4on electronic marketplace1. In addition, provider2provides101privacy statements DA, which are to be checked for plausibility by the method according to the present invention, for offering4. Privacy statements DA are then collected200with the aid of the method according to the present invention. At least one of annotations Aa, Ab, Ac that includes metainformation MI is stored201in at least one variant described above in conjunction withFIG. 2.

Data protection-relevant pieces of metainformation MI are determined202at least from one of annotations Aa, Ab, and Ac in a further step. Furthermore, additional pieces of metainformation MIz from other providers (not illustrated), preferably from all providers, that provide the information, the data, and/or the service on electronic marketplace1are included in determining202data protection-relevant metainformation MI. In addition, further metainformation MIv from previous information, data, and/or services to which the current information, data, and/or services revert is included in determining202data protection-relevant metainformation MI. This sequence is continued recursively until all information, data, and/or services that have been reverted to in this sequence have been included in determining202data protection-relevant metainformation MI.

Privacy statements DA provided101by provider2are subsequently compared203to associated metainformation MI. In comparison203, based on data protection-relevant metainformation MI it is determined in particular by electronic marketplace1, among other things, whether data are further transmitted, whether payment is made for the further transmission, and/or whether a service collects unnecessary data; for this purpose, the information that is reasonable and necessary for the intended uses is determined with the aid of a database (not shown).

If privacy statements DA match metainformation MI, privacy statements DA are checked for plausibility210and consequently regarded as correct.

If privacy statements DA differ from metainformation MI, electronic marketplace1checks the following selection criteria220:Will an additional test (audit) of the information, data, and/or services with regard to further standards (not described in greater detail here) be carried out?Are there other privacy statements that have not previously been used in this method and that may be reverted to?Who is provider2of the information, data, and/or services in question, and how is it configured?Is provider2certified or otherwise particularly trustworthy?Is there an option to display a warning signal to user3, for example via user terminal30and/or an interface?

Based on these selection criteria220, one or more of the following countermeasures is/are selected:Metainformation MI of offering4is adapted221.Privacy statements DA are adapted222.Access by user3to the information, data, and/or services that have not been checked for plausibility is blocked223by blocking device13, as the result of which they are no longer available to user3.A warning signal is output224to user3when he/she attempts to access the information, data, and/or services not checked for plausibility.

For example, metainformation MI of offering4of a less trustworthy provider is adapted221, and/or privacy statements DA thereof are adapted222. In addition, the access to the information, data, and/or services is then suitably blocked223by blocking device13when a violation of one or more of the further standards is determined in the additional test (audit) of the information, data, and/or services. In addition, the warning signal at user terminal30and/or at an interface (not illustrated) is output224and displayed to user3on user terminal30and/or via the interface when the user attempts to access the information, data, and/or services not checked for plausibility.

Lastly, the data protection characteristics are output230as a display signal and displayed to user3. Here as well, user terminal30and/or the interface (not illustrated) may be used for the display. The display signal may be displayed in the form of privacy icons. The privacy icons are used at least on electronic marketplace1for stating the data protection characteristics of the information, the data, and/or the services for user3, but may also be provided for stating the data protection characteristics for the end user. For the display, for example different colors, such as green for good data protection, yellow/orange for (partially) problematic data protection, and red for critical data protection, and/or symbols such as an unlocked or locked padlock, or special symbols concerning the various aspects of data protection, are used.