System & Method for Analyzing Privacy Policies
A natural language processing system is adapted to locate, extract and analyze content and meaning of provisions in user data management agreements employed by digital service providers (DSPs) and related entities. The resulting analysis can be used to inform (and as part of a) data privacy protection systems that utilize personal/corporate privacy policies to engage with DSPs according to a desired set of protection parameters.
1 . A method of analyzing and classifying data processing agreements (DPAs) from digital service providers (DSP) applicable to user data to generate a policy analysis model with a computing system comprising:
a. creating a first aggregated set of electronic DSP data policies from a corpus of text extracted from a plurality of separate DSPs with associated separate DPAs;
b. generating a set of tokens corresponding to individual constituent text snippets of each policy in such policies with a natural language engine associated with the computing system;
c. mapping each token in said set of tokens to a corresponding representative vector having a vector value with said natural language engine;
d. processing said set of tokens to form a set of reference clusters for an initial policy analysis model characterized by respective similar vector values;
e. processing said reference clusters to assign an associated user privacy data related category for each cluster in the initial policy analysis model;
wherein said user privacy data related category in the policy analysis model includes at least two options, including a privacy-benign or a privacy-violative designation.
2 . The method of claim 1 further including a step: calculating an overall weighted average score for an individual DPA based on an individual user privacy data charter, which includes user-defined weightings for different categories of data and/or different DSPs.
3 . The method of claim 1 further including a step: evaluating the initial policy analysis model for predictive performance.
4 . The method of claim 1 further including a step: evaluating the initial policy analysis model for computational requirements.
5 . The method of claim 1 further including a step: fitting the initial policy analysis model based on a second additional set of electronic DSP data policies from a second corpus of text.
6 . The method of claim 5 further including a step: altering the initial policy analysis model based on results of said fitting.
7 . A method of analyzing and classifying a data processing agreement (DPA) from a digital service provider (DSP) site applicable to user data comprising the steps:
a. collecting and aggregating a set of DSP data policies for a set of DSP sites;
b. separately generating a corresponding set of topics and clauses for said set of DPAs with a machine learning engine by processing text documents associated with said of DPAs;
c. labeling said set of topics and clauses with an impact rating on a user data privacy protection scale;
d. using said set of labeled topics and clauses to train a machine learning algorithm to derive a set of classification models for said set of DPAs.
8 . The method of claim 1 wherein said DPA specifies a set of allowable uses of said user data.
9 . The method of claim 1 wherein said machine learning engine uses a supervised algorithm.
10 . The method of claim 1 wherein said impact rating is specified as a binary value of benign or harmful.
11 . A system for analyzing and classifying data processing agreements (DPAs) from digital service providers (DSP) applicable to user data to generate a policy analysis model comprising:
a computing system including one or more executable software modules adapted to:
a. create a first aggregated set of electronic DSP data policies from a corpus of text extracted from a plurality of separate DSPs with associated separate DPAs;
b. generating a set of tokens corresponding to individual constituent text snippets of each policy in such policies with a natural language engine associated with the computing system;
c. mapping each token in said set of tokens to a corresponding representative vector having a vector value with said natural language engine;
d. processing said set of tokens to form a set of reference clusters for an initial policy analysis model characterized by respective similar vector values;
e. processing said reference clusters to assign an associated user privacy data related category for each cluster in the initial policy analysis model;
wherein said user privacy data related category in the policy analysis model includes at least two options, including a privacy-benign or a privacy-violative designation.