# The Need for Machine-Processable Agreements in Health Data Management +
## 5 A Policy Language for Multi-Privilege Consent
### Conflict Detection
By employing an ontology-based approach in this paper we hope to achieve the best of both worlds. XACL [31] is XML-based and supports security policies and access policies for XML documents. **XACML** is also XML-based and is designed for access control. It supports two-way communication by implementing a request/response language [32]. There have been many extensions to XACML, such as developing profiles for usage control [33], for privacy/purpose policies [34], or some of the languages we study here. With minor effort XACML and its major extensions could capture sharing dependencies required in health data sharing but they do not capture complex classes of individuals, or the interplay of sharing and anonymising data. Moreover access control languages are closest to supporting what we here define that multi-ownership privileges. The Enterprise Privacy Authorization Language **EPAL**[35] provides machinery to write enterprise-wide privacy policies on data and used within an enterprise. It allows positive and negative authorization privileges. To perform authorisation EPAL considers categories of purposes and of privacy actions, conditions or obligations. As such one would have to use the pre-conceived vocabulary of categories to perform some of our health data sharing requirements. **Rei**[36] is a semantic web language focusing on annotating web entities with policies and on the use of distributed policy management. The policy language allows policies that contain obligations and requirements and the dynamic modification of existing policies. So Rei can express data sharing requirements such as dependencies and instigations, and as a semantic web language it can also capture complex classes of individuals. However the interplay of data sharing and anonymization and the multiple privileges on data is not captured. Another semantic web language featuring similar features and limitations is **AIR**[37] (Accountability In RDF). This policy language performs policy compliance via ontology reasoning, and provides explanations for its compliance results. **Sticky policies**[38] are policies that accompany data and describe purposes, retention periods, and obligations to notify user when data is shared further. The language is able to express complex sharing dependencies, and possibly classes of individuals. It was mostly developed to allow comparing of user's privacy preferences to an organisation privacy policies, similar to P3P [39] and APPEL [40]. The now deprecated W3C standard of the **P3P** language [39] would be used by web servers to specify their data handling practices and web clients to use a language such as APPEL-P3P [40], or the XPath-based XPref [41], to state their own privacy preferences, based on an automatic match/mismatch between the two parts a webpage would be visited or not. There are several criticism points for P3P and similar \"two-party\" languages, such as EPAL [35], and Prime-DHP [42]. First, similar to \"Terms and Conditions\", often the policy is an \"all-or-nothing agreement\" and does not offer partial access. Second, even when users get options these are coarse-grained and limited to a set of predefined purposes and operations. Third, much criticism has focused on the security expectations that users had from these languages since most of them mix traditional adversary-oriented privacy requirements with the ability to express a bilateral agreement. Fourth, these are custom languages often with no formal, universal semantics and with ad-hoc (if any) implementations. Fifth, many of these languages have tried to model, future and open-world potential uses of the data by a-priori exhaustively listing purposes for the user to choose from. Lastly, these ad-hoc languages many times are overly complicated, counter-intuitive and hard to use. Another platform for enterprise wide data sharing is the Platform for Enterprise Privacy Practices **E-P3P**[43], which builds upon the P3P language discussed below. This language develops a fine-grained model for expressing privacy policies.