A Fine-grained Chinese Software Privacy Policy Dataset for Sequence Labeling and Regulation Compliant Identification

Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 10266 - 10277 December 7-11, 2022 ©2022 Association for Computational Linguistics A Fine-grained Chinese Software Privacy Policy Dataset for Sequence Labeling and Regulation Compliant Identification Kaifa Zhao1, Le Yu1, Shiyao Zhou1, Jing Li1, Xiapu Luo1, Yat Fei Aemon Chiu2, Yutong Liu2 1Department of Computing, The Hong Kong Polytechnic University, HKSAR, China 2Department of Electronic and Information Engineering, The Hong Kong Polytechnic University, HKSAR, China 1kaifa.zhao@connect.polyu.hk, lele08.yu@polyu.edu.hk, shiyao.zhou@connect.polyu.hk 1{jing-amelia.li, daniel.xiapu.luo}@polyu.edu.hk 2{yat-fei-dylan.zhao,yitang.liu}@connect.polyu.hk Abstract Privacy protection raises great attention on both legal levels and user awareness. To protect user privacy, countries enact laws and regulations requiring software privacy policies to regulate their behavior. However, privacy policies are written in natural languages with many legal terms and software jargon that prevent users from understanding and even reading them. It is desirable to use NLP techniques to analyze privacy policies for helping users understand them. Furthermore, existing datasets ignore law requirements and are limited to English. In this paper, we construct the first Chinese privacy policy dataset, namely CA4P-483, to facili- tate the sequence labeling tasks and regulation compliance identification between privacy poli- cies and software. Our dataset includes 483 Chinese Android application privacy policies, over 11K sentences, and 52K fine-grained an- notations. We evaluate families of robust and representative baseline models on our dataset. Based on baseline performance, we provide findings and potential research directions on our dataset. Finally, we investigate the poten- tial applications of CA4P-4831 combing reg- ulation requirements and program analysis. 1 Introduction A privacy policy is a legal document written in natural language that discloses how and why a controller collects, shares, uses, and stores user data (GDPR, 2016; PISS, 2020; NISSTC, 2020). Privacy policies help users understand whether their privacy will be abused and decide whether to use the product. However, privacy policies are tedious, making it hard for users to read and under- stand them (Staff, 2011). Natural language process- ing techniques achieve big success on understand- ing document semantics (Yang et al., 2021; Wen et al., 2021; Ding et al., 2020). Thus, it is neces- 1Our dataset and code are publicly available in https:// github.com/zacharykzhao/CA4P-483 sary to apply natural language processing to ana- lyze the privacy policies (Yu et al., 2016; Andow et al., 2020; Yu et al., 2015; Fan et al., 2020) and help users be aware of apps’ privacy access behav- ior (Zhou et al., 2021). Chinese software privacy policy processing (CSP3) task is a sequence labeling problem that recognizes privacy-related components in the sen- tences. CSP3 has two main unique features. First, privacy policies contain an amount of information inside (Yu et al., 2018), such as how the app stores user data, and how to contact app developer. In our dataset, we concentrate on data access-related sentences as the sentences directly related to user privacy. Second, privacy policies are written in a legally binding professional language and con- tain software jargon. Thus, it requires strong back- ground (Zhou et al., 2022a,b) …

Content truncated to 500 words