Beyond The Text: Analysis of Privacy Statements through Syntactic and Semantic Role Labeling (2023)

Abstract: This paper formulates a new task of extracting privacy parameters from a privacy policy, through the lens of Contextual Integrity (CI), an established social theory framework for reasoning about privacy norms. Through extensive experiments, we further show that incorporating CI-based domain-specific knowledge into a BERT-based SRL model results in the highest precision and recall, achieving an F1 score of 84%. With our work, we would like to motivate new research in building NLP applications for the privacy domain.

## introduction a privacy policy informs users about a company's information handling practices. however, privacy policies are lengthy documents, full of incomplete and vague statements that impose a significant cognitive burden on the reader to infer whether a given service respects their privacy @xcite @xcite . this challenge has inspired many recent works in applying natural language processing and machine learning techniques to automatically process privacy policies and retrieve the relevant information @xcite . while these efforts help in identifying paragraphs in the privacy policy that mention sensitive information @xcite , opt-out clauses @xcite or description of data collection practice @xcite , they focus on the policy as a whole rather than on the privacy implication of the individual privacy statements that it contains. in particular, they do not aim to identify relevant and often missing contextual information that is critical for unambiguously understanding the scope of individual statements. this paper focuses on a new nlp * currently at google task that aids the analysis of privacy policies at this more fine-grained level. to illustrate the problem, consider a typical example of an ambiguous privacy statement: "yahoo collects information about your transactions with us and with some of our business partners, including information about your use of financial products and services that we offer." at first glance, the statement may seem to provide all the relevant information about a first-party collection of transactional data. however, it in fact misses some crucial contextual information. to understand what is missing, we use the contextual integrity (ci) framework @xcite . ci defines privacy as an appropriate flow of information which is expressed in terms of five essential ci parameters: sender, recipient, subject, information type, and transmission principle. the latter is a constraint on the information flow expressing the condition under which information is being transferred. the statement in our example specifies only 3 out of the 5 necessary parameters (highlighted in bold) -subject, recipient, and information type. this leaves the sender of the information and transmission principle to the reader's interpretation. in some cases, the relevant missing information appears in different places in the policy, for example, under different sections such as "when do we collect your information" or "our partners". these, however, do not help in contextually positioning the above statement so that the reader can determine whether their expectations have been met. in this paper, we show that existing nlp models and techniques can assist a human annotator in identifying relevant privacy parameters in the policy text. the proposed novel nlp task can support the following applications: automate comparative analysis of privacy policies using the theory of contextual integrity @xcite ; extraction and enforcement of prescribed ci-based policy from legal and co-operate document @xcite , an enhanced auditing of existing privacy policies for correctness and consistency @xcite . ## contextual integrity primer the theory of contextual integrity (ci) defines privacy as appropriate information flow in accordance with governing privacy norms. as mentioned in the introduction, ci provides a framework to capture and compare information flows against established norms. to perform an analysis of the privacy implications of a given information flow, ci requires identifying five essential parameters: actors (sender, receiver, subject), the type of information (attribute), and the condition or purpose of the information exchange (transmission principle). it is critical to state all five parameters to ensure a non-ambiguous privacy implication analysis. a misalignment of parameter values-i.e., an information flow that deviates from the established normconstitutes a potential privacy violation. for example, consider a medical context, an established norm states that a patient (sender) could share their (subject) medical information (information type) with their doctor (receiver) confidentially (transmission principle). an information flow (e.g., generated by an app or a system) that deviates from this norm (e.g., by changing the value of tp to public and/or sending the medical information to a different receiver) potentially violates the patient's privacy and requires further investigation. ci provides a heuristic to examine violating information flows in terms of how they contribute to values, functions, and purposes of a particular context @xcite . ## related work several recent efforts have focused on identifying important and relevant privacy statements using constituency parsing @xcite @xcite , logistic regression @xcite and crowdsourcing @xcite techniques. these works focus on other aspects of privacy policy analysis such as opt-out disclosure, right to information access, etc. as we discuss in section 4, our work explicitly looks to map the privacy statement to a fixed set of parameters. we also show that question answering (qa) models do not perform satisfactorily when applied to our task. similar limitations of the reading comprehension models were observed by @xcite , who composed the privacyqa dataset, an annotated corpus consisting of 1750 questions about the contents of privacy policies such as "what data does this game collect?" and "will my data be sold to advertisers?". in prior work on automatic privacy statement analysis, @xcite extracted privacy statements on information handling practices such as "collecting your e-mail address" or "sharing your location" using a typed dependency parser and crowdworker annotations. more relevant to our efforts, @xcite applied semantic roles theory to manually annotate five privacy statements and identify action verbs (action data) such as "collection", "retain", "use", "transfer" and associated semantic roles that capture who performs the action, how the action is carried out, etc. andow et al. (2019 ) developed policylint to analyze privacy policy using sentence-level nlp techniques to capture statements in a four-element tuple (actor, action, data object, entity) to identify contradictory statements. andow et al. (2020) used a simplified 3-tuple statement abstraction (actor, data object, entity), and identify incorrect and ambiguous statements. trimananda et al. (2022) build on this effort to audit the traffic and privacy policies in oculus vr systems. per ci theory, both ovrseen and policheck capture insufficient information to perform a privacy implication analysis, which requires five ci parameters. nevertheless, we can use policylint and policheck libraries to help process privacy policies to generate statements that we can feed into our annotation pipeline. shvartzshnaider et al. (2019a) crowdsourced privacy policies annotation to compare policy versions, identifying missing contextual information and overloading of parameters that contribute to users' inability to understand the prescribed information practices. our work automates the task of annotating privacy policies with the ci parameters. ## task formulation the ci parameter extraction task is as follows. given a privacy statement stmt, apply a mapping function m to extract the ci parameters: sender, receiver (r), subject (s), attribute (att), transmission principle (tp): m (stmt) = (s, r, sub, att, tp) the main challenge behind the task is identifying the lexical items in the statement that correspond to the contextually relevant values to help downstream nlp tasks perform the privacy analysis. this is not a trivial task as privacy policies are not written with ci in mind. often, policies are written by legal and policy teams whose primary concern is not readability. many privacy statements are missing essential ci parameters and often comprise syntactically complex sentences @xcite . in the absence of an automatic way to extract ci parameters, researchers have employed crowdsourcing and manual annotation to perform the analysis @xcite . however, these methods do not scale due to the high cost of annotation by experts and hence we propose an ml-based approach by training or mapping existing models trained on nlp tasks to extract ci parameters. further, we expand on a growing body of research in human-in-the-loop ml-assisted validations (section 5.3) to evaluate the precision and recall of the model annotations. ## methods in this section, we describe our method to perform the ci parameter extraction task by incorporating the contextual semantics of ci parameters to modify two conventional nlp techniques: syntactic dependency parser (dp) and bert-based semantic role labeling (srl). we then describe how these individual techniques can be integrated into an end-to-end model to extract ci parameters from privacy policies. in addition, in our evaluation (section 6), we also compare our method to three baseline models tailored to address the ci parameter extraction task: question-answering, bert, and hidden markov model. ## evaluation we now compare the performance of the different models on the ci annotation task using the dataset in section 5.2 with some common baseline models repurposed for ci. ## discussion in this paper, we describe an nlp-based method to perform automatic ci annotation of privacy statements. this work has several implications for different stakeholders, some of which were discussed in @xcite . for consumers, who often find privacy policies too lengthy and complex to read, the ci annotation provides the ability to query the privacy policies for specific flows it prescribes. these can involve asking about mentions of specific "senders" and "recipients" in the privacy policies, the type of information being collected or shared, and listing the conditions and purposes. beyond enumerating the prescribed ci parameters, the method enables contextual queries that reflect up to five ci parameters. for example, instead of asking about mentions of "location information," the query can include the senders, and recipients of interest, such as third parties, and contractors. the query can be further refined to include specific constraints under which location data is transferred, e.g., when the user is using the app. the ci abstraction also allows for querying different privacy policies, potentially, from different sectors. moreover, it can serve as a way to compare different versions of the same privacy policy to examine the new changes that were introduced in the latest version. we can identify which new flows were added or removed and, consequently, what data types, senders, recipients, subjects, and conditions were changed. finally, combining with existing crowdsourcing methodologies of learning users' privacy expectations @xcite @xcite , we can perform a large-scale analysis of what privacy policies align with users' expectations and existing societal norms. for relevant agencies like the federal trade commission, the ci-based analysis of privacy policies can serve as a robust auditing technique for prescribed data handling practices. using the ci framework, the resulting information flows can be automatically compared with existing regulation @xcite and users' privacy ex-pectations @xcite . furthermore, the analysis can help detect privacy statements with missing contextual information that results in ambiguous flows. ultimately, we envision our work used as part of the overall evaluation framework for performing dynamic and static analysis of digital services, similar to @xcite . specifically, the ci annotated policy fed into an automatic test suite for possible violation of privacy policy, regulation, or societal expectations. ## conclusion in this paper, we formulate the new ci parameter extraction nlp task for the analysis of privacy statements. we adapt several conventional nlp models (qa, hmm, bert, dp and srl) to perform the task and demonstrate that it cannot be solved trivially. in our evaluation of privacy statements of 50 real-world privacy policies, we show that a method combining clues from ci with syntactic dp coupled with type-specific srl obtains the highest f1 score. we build on this insight to devise an algorithm that incorporates ci-based domain-specific knowledge to achieve higher precision and recall. the proposed algorithm post-processes ml outputs and increases automation of a tedious task that has so far been performed manually. further improvements of this task, leveraging domain knowledge for complex scenarios will directly benefit downstream applications ranging from aiding the design and analysis of privacy policies to building systems that meet users' privacy expectations by construction.