A Tale of Two Regulatory Regimes: Creation and Analysis of a Bilingual Privacy Policy Corpus

Proceedings of the 13th Conference on Language Resources and Evaluation (LREC 2022), pages 5460–5472 Marseille, 20-25 June 2022 © European Language Resources Association (ELRA), licensed under CC-BY-NC-4.0 5460 A Tale of Two Regulatory Regimes: Creation and Analysis of a Bilingual Privacy Policy Corpus Siddhant Arora∗⋄, Henry Hosseini†, Christine Utz‡, Vinayshekhar Bannihatti Kumar‡‡∗∗, Tristan Dhellemmes∗∗, Abhilasha Ravichander∗, Peter Story∥∗∗, Jasmine Mangat¶∗∗, Rex Chen∗, Martin Degeling‡, Tom Norton§, Thomas Hupperich†, Shomir Wilson††, and Norman Sadeh∗⋄ ∗Carnegie Mellon University, Pittsburgh, PA, USA, {siddhana, aravicha}@andrew.cmu.edu, {sadeh, rexc}@cs.cmu.edu, tristan.dhellemmes@laposte.net †University of M¨unster, M¨unster, Germany, {henry.hosseini, thomas.hupperich}@wi.uni-muenster.de ‡Ruhr University Bochum, Bochum, Germany, {christine.utz, martin.degeling}@rub.de ‡‡AWS AI, Santa Clara, CA, USA, vinayshk@amazon.com ∥Clark University, Worcester, MA, USA, peter.garth.story@gmail.com ¶University of Massachusetts Amherst, Amherst, MA, USA, jmangat@umass.edu §Fordham University School of Law, New York, NY, USA, tnorton1@fordham.edu ††Pennsylvania State University, University Park, PA, USA, shomir@psu.edu Abstract Over the past decade, researchers have started to explore the use of NLP to develop tools aimed at helping the public, vendors, and regulators analyze disclosures made in privacy policies. With the introduction of new privacy regulations, the language of privacy policies is also evolving, and disclosures made by the same organization are not always the same in different languages, especially when used to communicate with users who fall under different jurisdictions. This work explores the use of language technologies to capture and analyze these differences at scale. We introduce an annotation scheme designed to capture the nuances of two new landmark privacy regulations, namely the EU’s GDPR and California’s CCPA/CPRA. We then introduce the first bilingual corpus of mobile app privacy policies consisting of 64 privacy policies in English (292K words) and 91 privacy policies in German (478K words), respectively with manual annotations for 8K and 19K fine-grained data practices. The annotations are used to develop computational methods that can automatically extract “disclosures” from privacy policies. Analysis of a subset of 59 “semi-parallel” policies reveals differences that can be attributed to different regulatory regimes, suggesting that systematic analysis of policies using automated language technologies is indeed a worthwhile endeavor. Keywords: privacy policy, privacy policy corpus, text corpus, bilingual, GDPR, CCPA, CPRA 1. Introduction Privacy policies are the primary mechanism by which organizations disclose their data practices. These dis- closures are intended to inform consumers about how their data will be handled and about their rights in relation to this data, such as the right to review or delete data or to restrict its collection and use (by, e.g., an “opt-in” or “opt-out”). However, privacy poli- cies are often long, vague, ambiguous, and difficult to read (Reidenberg et al., 2015). Legislative bodies have responded by imposing new requirements about the in- formation privacy policies must disclose and by en- shrining the privacy rights of consumers from whom data is collected. Because of the sheer number of privacy policies available on the Internet, the impact of these new regulations on data collection and use practices, particularly including specific protections af- forded to consumers, has eluded systematic analysis. This work explores the use of …

Content truncated to 500 words