RDF and its subset Linked Data are great technologies to support ad hoc and distributed information structures. Data can be annotated, point to other data and thus create a rich and computer-readable tapestry of information. The challenge starts, when personal and private data becomes part of that information tapestry. The common approaches for access and privacy controls still stick to the traditional folders-and-files structure. This makes it hard for humans to effectively control and understand -how to select what is available to whom -how to tag different privacy spheres -how to identify data There are a few options to approach this, but few, if none of them are human-centric. They can be hard to understand, lead to click-fatigue and thus are prone to the implementation of dark patterns. The talk will introduce a more human-centric approach to these challenges, by establishing common sets of UX and nomenclature. These are derived from core concepts to add connotations, circumstances and relationships to Linked Data, so humans can identify which spheres of life a data point belongs to, and which facet of their identity is used in conjunction with this data. As a result, the system will be much more human-centric, by mimicking real-life understanding and behaviours to digital systems.

1. A more human-centric
privacy managing approach
for RDF and Linked Data

2. About the Speaker:
Lars Eilebrecht
● Working on Open Source software since 1995
● Co-founder & member of the Apache Software Foundation
● Chief Information Security Officer at polypoly

3. Today I’m talking about:
● Linked Data and RDF (Resource Description Framework)
● Semantic metadata
● Personal data and data privacy
○ Storage and processing
○ Management and control

4. What's the
challenge?
Linked Data containing personal data
● Data privacy
● Access control
Users should manage their own personal data
● But data can be complex and difficult to understand
for normal users.
● Risk of user errors (e.g., sharing of wrong data).

5. How are we tackling
this challenge?
Definition of common nomenclature that mimics
real-life behaviour
● facets
● spheres
This helps a person to identify which spheres of life
data belongs to, and which facet of their whole
person is used in conjunction with that data.
Enriching user data with semantic metadata

6. What are
"Facets"?
A facet represents aspects of a person to the
outside world.
● Example: a single person can be a family member,
an employee, a club member, and a political activist
– all at the same time
Facets are the basis for external communication
of a person.
● Each facet of a person contains different data
(some data may be shared across facets).
● Facets may have additional properties
(e.g., trust level requirements).
● Each data entry is linked to one or more facets.

7. Examples of Facets
Passport
Control
Check-in
Flight
Taxi to
Hotel
Dinner
with a
friend
Check-in
Hotel
Facet: Bob's Friend Facet: polypoly Employee Facet: German Citizen

8. What are
"Spheres"?
A sphere is created through things a person does
(actions) or things that happen to them (activities).
● Examples: business trips, payroll & expenses, family
or personal events
Each data entry is linked to one or more spheres.
● A sphere may contain additional properties
(e.g., context information).
● A sphere may be linked to one or more other
spheres.
● A sphere may contain sub-spheres.

9. Examples of Spheres
Sphere:
Personal
Events
Passport
Control
Check-in
Flight
Taxi to
Hotel
Dinner
with a
friend
Check-in
Hotel
Facet: Bob’s Friend Facet: polypoly Employee Facet: German Citizen
Sphere:
Payroll &
Expenses
Sphere:
Immigration
Sphere:
Business Trip

10. Where does additional
facet & sphere data
come from?
Majority of the data has to be generated
automatically.
● Based on which feature of the software is being
used.
● Based on communication partner/entity.
● Based on any other external information/input.
Users must still be able to define details manually.
● Every person has different facets and spheres.

11. How does
this improve
privacy?
Technical benefits:
● Writing queries for specific data becomes easier
and more concise.
● Fine-grained access control becomes possible.
● Enforcing privacy preferences becomes easier.
● Programmatically understanding data semantics
becomes easier.
User experience improvements:
● It's easier to make a user understand what data
they are dealing with.
● Users are less likely to make wrong decisions
regarding data sharing.

12. The polyPod Open Source repository:
https://github.com/polypoly-eu/polyPod
Feedback or questions? Contact us!
community@polypoly.coop