Using Models to Enable Compliance Checking against the GDPR: An Experience Report

.lusoftware veriﬁcation & validation
VVS
Using Models to Enable Compliance Checking
against the GDPR: An Experience Report
Damiano Torre, Ghanem Soltana, Mehrdad Sabetzadeh,
and Lionel Briand*
SnT - University of Luxembourg
*also with University of Ottawa, Canada
Yuri Auffinger and Peter Goes
Linklaters Luxembourg
September 18th, 2019

General Data Protection Regulation
(GDPR)
2
European regulations for data protection
and privacy enforced since May 2018
Organizations must comply with
requirements set out in the GDPR
Failure to comply with the GDPR may result in fines of up
to 20M € or 4% of an organization’s global turnover

Context
3
is a global law firm, headquartered in
London with a base in Luxembourg
• Exploit the potential of compliance knowhow in the area
of GDPR
• Most of GDPR compliance checking procedures are
carried out manually
• Make GDPR compliance checking more cost-effective

Main Goal
4
To develop industrially applicable automated
support for GDPR compliance assessment
Checking Compliance Analysis ReportLegal Artifacts

Research Questions
5
RQ1:Can we model the GDPR in a generic and adaptable way?
Building the Generic Model
RQ2: Can we adapt the generic model according to the specific needs of
a given context?
Tailoring the Generic Model for a given context
RQ3:What are the challenges associated with modelling the GDPR?
Challenges in modelling the GDR

Project Overview
6
Build the Generic
GDPR Conceptual Model
¨
ÆGenerate Instance
of the Domain Model
EU Members’
Laws
Case
Law
Tailor the GDPR
Conceptual Model
≠
Domain and
Organization
Constraints
Generic Model
Compliance Report Legal Documents
Domain ModelGeneric Rules
OCL
GDPR
DB
Model Instance
Check GDPR
Compliance
Ø
OCL
Specific and
Generic
Rules

Project Overview
7
Build the Generic
¨
ÆGenerate Instance
of the Domain Model
EU Members’
Laws
Case
Law
Tailor the GDPR
Conceptual Model
≠
Domain and
Organization
Constraints
Generic Model
OCL
GDPR
DB
Model Instance
Check GDPR
Compliance
Ø
OCL
Specific and
Generic
Rules

Project Overview
8
Build the Generic
¨
ÆGenerate Instance
of the Domain Model
EU Members’
Laws
Case
Law
Tailor the GDPR
Conceptual Model
≠
Domain and
Organization
Constraints
Generic Model
OCL
GDPR
DB
Model Instance
Check GDPR
Compliance
Ø
OCL
Specific and
Generic
Rules

Project Overview
9
Build the Generic
¨
ÆGenerate Instance
of the Domain Model
EU Members’
Laws
Case
Law
Tailor the GDPR
Conceptual Model
≠
Domain and
Organization
Constraints
Generic Model
OCL
GDPR
DB
Model Instance
Check GDPR
Compliance
Ø
OCL
Specific and
Generic
Rules

Focus of the Paper
10
Build the Generic
¨
ÆGenerate Instance
of the Domain Model
EU Members’
Laws
Case
Law
Tailor the GDPR
Conceptual Model
≠
Domain and
Organization
Constraints
Generic Model
OCL
GDPR
DB
Model Instance
Check GDPR
Compliance
Ø
OCL
Specific and
Generic
Rules

Building the Generic Model (RQ1)
11
Build the Generic
¨
ÆGenerate Instance
of the Domain Model
EU Members’
Laws
Case
Law
Tailor the GDPR
Conceptual Model
≠
Domain and
Organization
Constraints
Generic Model
OCL
GDPR
DB
Model Instance
Check GDPR
Compliance
Ø
OCL
Specific and
Generic
Rules

Building Model Artifacts
12
• UML Class Diagrams
• Set of OCL Constraints
• Glossary
• Mapping Table
• Variability Table
1. Reading the GDPR
2. Creating/Reﬁning
Artifacts
3. Validating Artifacts
with Legal Experts
Iterative
Incremental
Process

Modelling the GDPR
13
UML class diagrams that capture the GDPR’s key concepts,
their relationships and variability
9 Packages
103 Classes
48 Generalizations
122 Associations
21 Enumerations
213 Attributes
Data TransferEnumerations
GDPR Principles Data Processing Data Subject Rights
Actors
Data Subject
AdministrationCompliance Evidence

1 context Data_Processing inv consentProvider:
2 self.isLawfulnessOnlyByConsent() implies
3 let identifiableSubjects: Set(Data_Subject) = self.personalData.
4 identifiableSubjects->flatten()->asSet() in
5 self.purposes->forAll(p: Purpose|
6 identifiableSubjects->forAll(ds: Data_Subject|
7 let eligibleToGiveConsent: Natural_Person =
8 if(ds.oclIsTypeOf(Data_Subject)) then ds
9 else ds.getResponsibleParent() endif in
10 p.getConsents()->exists(c: Consent|
11 c.provider = eligibleToGiveConsent
12 and c.target = ds)))
13 context Data_Subject inv VAR_DSAge:
14 let minDSAge: Integer = Variability.V_getMinimumAgeForDS(self) in
15 if(self.oclIsTypeOf(Child_Data_Subject)) then
Developing Constraints
14
Rule (constraint)
Art. 8 - 1.[…] Where the child is below the age of 16 years, such processing shall be lawful only if and to the
extent that consent is given or authorised by the holder of parental responsibility over the child. Member States
may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.
2. The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the
holder of parental responsibility over the child, taking into consideration available technology.

16 self.getAge() < minDSAge else self.getAge() >= minDSAge endif
17 context Natural_Person inv VAR_isLegalParent:
18 self.children->forAll(c: Child_Data_Subject| self.
V_checkParentDocuments(c))<latexit sha1_base64="euKLzgbLk5sU6pMZbb2+hdH3fCk=">AAAOOnicjVdbb9xEFN62AdqFQAuPvFiNKmUr191NKUQRrhoSAZEKCc2llXZXq7F97J1mPDYz42y27vwDXuHX8Ed45Q3xyjucsb0be5OgHSmq98x37nMu9VJGpep2/7hx89bKe+9/cPtO+8OPVj/+5O69T09kkgkfjv2EJeK1RyQwyuFYUcXgdSqAxB6DV97pjrl/dQZC0oQfqWkKw5hEnIbUJwpJo3u3/h14EFGeM6mMOsoj3Q8FicHlCQfbyJ3QQI3d3hNn04/tLP05SxS4SmRgWx7qOjUYWRLQFOpLNWXgDpQKSUzZdOCFEgQFOWz7CVdwrqxdosjoQCQ+SIkaLcrPLLyTwBVSz2gAYquNToUOlS/IJMwYapD7nE2/me6UuPWORWOMEEirzUBZyMMVOkbQ88PMewO+klvWIaj1QllF6liuVchNMSYJJ8xcOu2rmB89CxlRCvh659EzIo0kVMmt0q40E2kiwaASsc3YerplHZS0d1bbwnONzBIdoG11uyoec4wzmM6IIt9R8h09g8rjLetHojJB2OigMB5dueCiIcp0Ep/tySNM837YdLtjqTFwK5AXHMAkIMGJQL0EmaIOo/GAiDK4wAMaFv7OGFIDrWyRJihwjg9GrvtbVkWteWGO76RVMtHUK11q4gkPkEcRgXqQI5CdTqf5ZCp3ivdysv1ytHu4HcFWkf+Y8vKXtYcMUaHzhAgMP2VUTZ2TEUr9gXIaZzHCvk3E7uG6SaVJahvDV6S1HsCdMWXB6Kowtss3hAJREsbq67n2MqrN22du7bqI6typhYTO3MJHDxFhZS6qQvCNNfh7/oRM2C9Z+K7UfTLyx+CflgJ2Ez+Li5z5GM8BmlAv9tHdta7TLY51+aNXfay1qnMwunfn/iCoRPqMSNnvdVM1zIlQ1Geg24NMQkr8UxJBHz859hI5zItWpa0HSAksdAH/MP8FtV1nyc9LZINGYimnsWfjv4ZNmo+YqLEtMy+kUSbAzgRr8kwESfGuSQSexVRB3KQqiiY2SVV4kNoeBBBihyvMyuNpJAC4zkXk6bxrd50v7a6+jCHTGcR5ald/l2Axyc7gArdpG3mbG6jTnAFmqcQzwqPMWLW/80K383acCDiF6SQRgXTzBHtZ0c2xHSfB1DYdxMa3pG18OVjVCuvNDQk+TLvg9JPY5M7ts2H++LFeIGKqHj/U+cPZhVQC4+D2veF9u60bqeof9Ya5yQdwXxfmSlA5lrSH95FIMh4UnrqD0uHJGEOv7aJrFYODqIIkUd7MwnkzmGFqw8VaOAjxSWo8x7brenZJqk2spzivauAAMDK1wDmOo+2GOJAoECgGLQA3HzwwgejohlFYtlhBEPhjIuSi0SWkNj4XTS4BpwBp4fQ1jlWwWdpdTLtd0Zqpv0j1/LKWyH4Vd49loIc5dgadhwhdBgm+zpW2rWXk0rc6h6VMwPaq8/1Q1735X/SePMZghzrHpAZ6MdD/z04Y2+NSEe5jjcll/IZzn2UBhjOPloGX+4HO+TJgs0GUIV3SjOWNxla1JLYYHTpnJRZ7oYeDx2UQqjJ7FQVSdzNVVzzLC8g1K95cHXYAbCCWJTIGjSZQXdVFynEyqcrhcj3VIEUnuhJYIRTxrm8VUkFaGu/2rqu4SkXlHJa6Fw6azdqeVXBZgiVywXuzG+IgNO5XqahwVMkx9pfLsNmuOA9sM1aIMK7Rt+AWw6Ex0TKR4Gxsjt00CNH6YY5zKB1T/7w521JqmvbChBU4suw4Y4qKZGKT4E0mlZecL6pjCY+UWWl1XZ/puYFNWJSYfAf2zO0y3kgouvjFLxSCTdTmZr6A8nFSmAXCsFM1jjdgYTxjIlBiWtiCzR34GRrJjYaCSfd7w/5YeUOMUz7AlQcmxgBcJ/PBXKgfmkVE59sscrRZO6v/98wBur/WMxJ0XqxIF/TFFSAg4rSxBDhPbOcLHN7OxsbTanbjVtVb3KEuf5xsOD38/mlj7flutV/dbn3eut9ab/VaX7Wet75vHbSOW/5KuPLLyq8rv63+vvrn6l+rf5fQmzcqns9ajbP6z38BI9CX</latexit><latexit sha1_base64="euKLzgbLk5sU6pMZbb2+hdH3fCk=">AAAOOnicjVdbb9xEFN62AdqFQAuPvFiNKmUr191NKUQRrhoSAZEKCc2llXZXq7F97J1mPDYz42y27vwDXuHX8Ed45Q3xyjucsb0be5OgHSmq98x37nMu9VJGpep2/7hx89bKe+9/cPtO+8OPVj/+5O69T09kkgkfjv2EJeK1RyQwyuFYUcXgdSqAxB6DV97pjrl/dQZC0oQfqWkKw5hEnIbUJwpJo3u3/h14EFGeM6mMOsoj3Q8FicHlCQfbyJ3QQI3d3hNn04/tLP05SxS4SmRgWx7qOjUYWRLQFOpLNWXgDpQKSUzZdOCFEgQFOWz7CVdwrqxdosjoQCQ+SIkaLcrPLLyTwBVSz2gAYquNToUOlS/IJMwYapD7nE2/me6UuPWORWOMEEirzUBZyMMVOkbQ88PMewO+klvWIaj1QllF6liuVchNMSYJJ8xcOu2rmB89CxlRCvh659EzIo0kVMmt0q40E2kiwaASsc3YerplHZS0d1bbwnONzBIdoG11uyoec4wzmM6IIt9R8h09g8rjLetHojJB2OigMB5dueCiIcp0Ep/tySNM837YdLtjqTFwK5AXHMAkIMGJQL0EmaIOo/GAiDK4wAMaFv7OGFIDrWyRJihwjg9GrvtbVkWteWGO76RVMtHUK11q4gkPkEcRgXqQI5CdTqf5ZCp3ivdysv1ytHu4HcFWkf+Y8vKXtYcMUaHzhAgMP2VUTZ2TEUr9gXIaZzHCvk3E7uG6SaVJahvDV6S1HsCdMWXB6Kowtss3hAJREsbq67n2MqrN22du7bqI6typhYTO3MJHDxFhZS6qQvCNNfh7/oRM2C9Z+K7UfTLyx+CflgJ2Ez+Li5z5GM8BmlAv9tHdta7TLY51+aNXfay1qnMwunfn/iCoRPqMSNnvdVM1zIlQ1Geg24NMQkr8UxJBHz859hI5zItWpa0HSAksdAH/MP8FtV1nyc9LZINGYimnsWfjv4ZNmo+YqLEtMy+kUSbAzgRr8kwESfGuSQSexVRB3KQqiiY2SVV4kNoeBBBihyvMyuNpJAC4zkXk6bxrd50v7a6+jCHTGcR5ald/l2Axyc7gArdpG3mbG6jTnAFmqcQzwqPMWLW/80K383acCDiF6SQRgXTzBHtZ0c2xHSfB1DYdxMa3pG18OVjVCuvNDQk+TLvg9JPY5M7ts2H++LFeIGKqHj/U+cPZhVQC4+D2veF9u60bqeof9Ya5yQdwXxfmSlA5lrSH95FIMh4UnrqD0uHJGEOv7aJrFYODqIIkUd7MwnkzmGFqw8VaOAjxSWo8x7brenZJqk2spzivauAAMDK1wDmOo+2GOJAoECgGLQA3HzwwgejohlFYtlhBEPhjIuSi0SWkNj4XTS4BpwBp4fQ1jlWwWdpdTLtd0Zqpv0j1/LKWyH4Vd49loIc5dgadhwhdBgm+zpW2rWXk0rc6h6VMwPaq8/1Q1735X/SePMZghzrHpAZ6MdD/z04Y2+NSEe5jjcll/IZzn2UBhjOPloGX+4HO+TJgs0GUIV3SjOWNxla1JLYYHTpnJRZ7oYeDx2UQqjJ7FQVSdzNVVzzLC8g1K95cHXYAbCCWJTIGjSZQXdVFynEyqcrhcj3VIEUnuhJYIRTxrm8VUkFaGu/2rqu4SkXlHJa6Fw6azdqeVXBZgiVywXuzG+IgNO5XqahwVMkx9pfLsNmuOA9sM1aIMK7Rt+AWw6Ex0TKR4Gxsjt00CNH6YY5zKB1T/7w521JqmvbChBU4suw4Y4qKZGKT4E0mlZecL6pjCY+UWWl1XZ/puYFNWJSYfAf2zO0y3kgouvjFLxSCTdTmZr6A8nFSmAXCsFM1jjdgYTxjIlBiWtiCzR34GRrJjYaCSfd7w/5YeUOMUz7AlQcmxgBcJ/PBXKgfmkVE59sscrRZO6v/98wBur/WMxJ0XqxIF/TFFSAg4rSxBDhPbOcLHN7OxsbTanbjVtVb3KEuf5xsOD38/mlj7flutV/dbn3eut9ab/VaX7Wet75vHbSOW/5KuPLLyq8rv63+vvrn6l+rf5fQmzcqns9ajbP6z38BI9CX</latexit><latexit sha1_base64="euKLzgbLk5sU6pMZbb2+hdH3fCk=">AAAOOnicjVdbb9xEFN62AdqFQAuPvFiNKmUr191NKUQRrhoSAZEKCc2llXZXq7F97J1mPDYz42y27vwDXuHX8Ed45Q3xyjucsb0be5OgHSmq98x37nMu9VJGpep2/7hx89bKe+9/cPtO+8OPVj/+5O69T09kkgkfjv2EJeK1RyQwyuFYUcXgdSqAxB6DV97pjrl/dQZC0oQfqWkKw5hEnIbUJwpJo3u3/h14EFGeM6mMOsoj3Q8FicHlCQfbyJ3QQI3d3hNn04/tLP05SxS4SmRgWx7qOjUYWRLQFOpLNWXgDpQKSUzZdOCFEgQFOWz7CVdwrqxdosjoQCQ+SIkaLcrPLLyTwBVSz2gAYquNToUOlS/IJMwYapD7nE2/me6UuPWORWOMEEirzUBZyMMVOkbQ88PMewO+klvWIaj1QllF6liuVchNMSYJJ8xcOu2rmB89CxlRCvh659EzIo0kVMmt0q40E2kiwaASsc3YerplHZS0d1bbwnONzBIdoG11uyoec4wzmM6IIt9R8h09g8rjLetHojJB2OigMB5dueCiIcp0Ep/tySNM837YdLtjqTFwK5AXHMAkIMGJQL0EmaIOo/GAiDK4wAMaFv7OGFIDrWyRJihwjg9GrvtbVkWteWGO76RVMtHUK11q4gkPkEcRgXqQI5CdTqf5ZCp3ivdysv1ytHu4HcFWkf+Y8vKXtYcMUaHzhAgMP2VUTZ2TEUr9gXIaZzHCvk3E7uG6SaVJahvDV6S1HsCdMWXB6Kowtss3hAJREsbq67n2MqrN22du7bqI6typhYTO3MJHDxFhZS6qQvCNNfh7/oRM2C9Z+K7UfTLyx+CflgJ2Ez+Li5z5GM8BmlAv9tHdta7TLY51+aNXfay1qnMwunfn/iCoRPqMSNnvdVM1zIlQ1Geg24NMQkr8UxJBHz859hI5zItWpa0HSAksdAH/MP8FtV1nyc9LZINGYimnsWfjv4ZNmo+YqLEtMy+kUSbAzgRr8kwESfGuSQSexVRB3KQqiiY2SVV4kNoeBBBihyvMyuNpJAC4zkXk6bxrd50v7a6+jCHTGcR5ald/l2Axyc7gArdpG3mbG6jTnAFmqcQzwqPMWLW/80K383acCDiF6SQRgXTzBHtZ0c2xHSfB1DYdxMa3pG18OVjVCuvNDQk+TLvg9JPY5M7ts2H++LFeIGKqHj/U+cPZhVQC4+D2veF9u60bqeof9Ya5yQdwXxfmSlA5lrSH95FIMh4UnrqD0uHJGEOv7aJrFYODqIIkUd7MwnkzmGFqw8VaOAjxSWo8x7brenZJqk2spzivauAAMDK1wDmOo+2GOJAoECgGLQA3HzwwgejohlFYtlhBEPhjIuSi0SWkNj4XTS4BpwBp4fQ1jlWwWdpdTLtd0Zqpv0j1/LKWyH4Vd49loIc5dgadhwhdBgm+zpW2rWXk0rc6h6VMwPaq8/1Q1735X/SePMZghzrHpAZ6MdD/z04Y2+NSEe5jjcll/IZzn2UBhjOPloGX+4HO+TJgs0GUIV3SjOWNxla1JLYYHTpnJRZ7oYeDx2UQqjJ7FQVSdzNVVzzLC8g1K95cHXYAbCCWJTIGjSZQXdVFynEyqcrhcj3VIEUnuhJYIRTxrm8VUkFaGu/2rqu4SkXlHJa6Fw6azdqeVXBZgiVywXuzG+IgNO5XqahwVMkx9pfLsNmuOA9sM1aIMK7Rt+AWw6Ex0TKR4Gxsjt00CNH6YY5zKB1T/7w521JqmvbChBU4suw4Y4qKZGKT4E0mlZecL6pjCY+UWWl1XZ/puYFNWJSYfAf2zO0y3kgouvjFLxSCTdTmZr6A8nFSmAXCsFM1jjdgYTxjIlBiWtiCzR34GRrJjYaCSfd7w/5YeUOMUz7AlQcmxgBcJ/PBXKgfmkVE59sscrRZO6v/98wBur/WMxJ0XqxIF/TFFSAg4rSxBDhPbOcLHN7OxsbTanbjVtVb3KEuf5xsOD38/mlj7flutV/dbn3eut9ab/VaX7Wet75vHbSOW/5KuPLLyq8rv63+vvrn6l+rf5fQmzcqns9ajbP6z38BI9CX</latexit><latexit sha1_base64="euKLzgbLk5sU6pMZbb2+hdH3fCk=">AAAOOnicjVdbb9xEFN62AdqFQAuPvFiNKmUr191NKUQRrhoSAZEKCc2llXZXq7F97J1mPDYz42y27vwDXuHX8Ed45Q3xyjucsb0be5OgHSmq98x37nMu9VJGpep2/7hx89bKe+9/cPtO+8OPVj/+5O69T09kkgkfjv2EJeK1RyQwyuFYUcXgdSqAxB6DV97pjrl/dQZC0oQfqWkKw5hEnIbUJwpJo3u3/h14EFGeM6mMOsoj3Q8FicHlCQfbyJ3QQI3d3hNn04/tLP05SxS4SmRgWx7qOjUYWRLQFOpLNWXgDpQKSUzZdOCFEgQFOWz7CVdwrqxdosjoQCQ+SIkaLcrPLLyTwBVSz2gAYquNToUOlS/IJMwYapD7nE2/me6UuPWORWOMEEirzUBZyMMVOkbQ88PMewO+klvWIaj1QllF6liuVchNMSYJJ8xcOu2rmB89CxlRCvh659EzIo0kVMmt0q40E2kiwaASsc3YerplHZS0d1bbwnONzBIdoG11uyoec4wzmM6IIt9R8h09g8rjLetHojJB2OigMB5dueCiIcp0Ep/tySNM837YdLtjqTFwK5AXHMAkIMGJQL0EmaIOo/GAiDK4wAMaFv7OGFIDrWyRJihwjg9GrvtbVkWteWGO76RVMtHUK11q4gkPkEcRgXqQI5CdTqf5ZCp3ivdysv1ytHu4HcFWkf+Y8vKXtYcMUaHzhAgMP2VUTZ2TEUr9gXIaZzHCvk3E7uG6SaVJahvDV6S1HsCdMWXB6Kowtss3hAJREsbq67n2MqrN22du7bqI6typhYTO3MJHDxFhZS6qQvCNNfh7/oRM2C9Z+K7UfTLyx+CflgJ2Ez+Li5z5GM8BmlAv9tHdta7TLY51+aNXfay1qnMwunfn/iCoRPqMSNnvdVM1zIlQ1Geg24NMQkr8UxJBHz859hI5zItWpa0HSAksdAH/MP8FtV1nyc9LZINGYimnsWfjv4ZNmo+YqLEtMy+kUSbAzgRr8kwESfGuSQSexVRB3KQqiiY2SVV4kNoeBBBihyvMyuNpJAC4zkXk6bxrd50v7a6+jCHTGcR5ald/l2Axyc7gArdpG3mbG6jTnAFmqcQzwqPMWLW/80K383acCDiF6SQRgXTzBHtZ0c2xHSfB1DYdxMa3pG18OVjVCuvNDQk+TLvg9JPY5M7ts2H++LFeIGKqHj/U+cPZhVQC4+D2veF9u60bqeof9Ya5yQdwXxfmSlA5lrSH95FIMh4UnrqD0uHJGEOv7aJrFYODqIIkUd7MwnkzmGFqw8VaOAjxSWo8x7brenZJqk2spzivauAAMDK1wDmOo+2GOJAoECgGLQA3HzwwgejohlFYtlhBEPhjIuSi0SWkNj4XTS4BpwBp4fQ1jlWwWdpdTLtd0Zqpv0j1/LKWyH4Vd49loIc5dgadhwhdBgm+zpW2rWXk0rc6h6VMwPaq8/1Q1735X/SePMZghzrHpAZ6MdD/z04Y2+NSEe5jjcll/IZzn2UBhjOPloGX+4HO+TJgs0GUIV3SjOWNxla1JLYYHTpnJRZ7oYeDx2UQqjJ7FQVSdzNVVzzLC8g1K95cHXYAbCCWJTIGjSZQXdVFynEyqcrhcj3VIEUnuhJYIRTxrm8VUkFaGu/2rqu4SkXlHJa6Fw6azdqeVXBZgiVywXuzG+IgNO5XqahwVMkx9pfLsNmuOA9sM1aIMK7Rt+AWw6Ex0TKR4Gxsjt00CNH6YY5zKB1T/7w521JqmvbChBU4suw4Y4qKZGKT4E0mlZecL6pjCY+UWWl1XZ/puYFNWJSYfAf2zO0y3kgouvjFLxSCTdTmZr6A8nFSmAXCsFM1jjdgYTxjIlBiWtiCzR34GRrJjYaCSfd7w/5YeUOMUz7AlQcmxgBcJ/PBXKgfmkVE59sscrRZO6v/98wBur/WMxJ0XqxIF/TFFSAg4rSxBDhPbOcLHN7OxsbTanbjVtVb3KEuf5xsOD38/mlj7flutV/dbn3eut9ab/VaX7Wet75vHbSOW/5KuPLLyq8rv63+vvrn6l+rf5fQmzcqns9ajbP6z38BI9CX</latexit>
Developing Constraints
15
Art. 8 - 1.[…] Member States may provide by law for a lower age for those purposes provided that such lower
age is not below 13 years.
Variation Point (constraint)

Variability
16
ID Traceability Actor Description When & How to resolve
V1
Art. 8(1)
O1
EMS
The EMS law may provide for
a lower age from which
parental consent is no longer
required, provided that such
lower age is not below 13
years.
[When?] If there is at least one
processing involving child data subject.
[How?] Override
V_getMinimumAgeForDS
based on the EMS law.
… … … … …
Variability table

Variability
17
Variability table
ID Traceability Actor Description When & How to resolve
V1
Art. 8(1)
O1
EMS
The EMS law may provide for
a lower age from which
parental consent is no longer
required, provided that such
lower age is not below 13
years.
[When?] If there is at least one
processing involving child data subject.
[How?] Override
… … … … …

Variability
18
Excerpt of the Data Processing Package with Variation Points
describes
*
Consent
Data Subject::
Natural Person
Purpose
- motivation: Processing context [1]
- Description: String [1]…
Data Processing
- Type: Processing Type [1]
- Description: String [1]
- isCrossBorders: Boolean [1]…
Personal Data
- category: Data Category [1]
- belongsToSpecialCategory: boolean [1]
- collectedFromDataSubject: boolean [1]…
realizes
1..*
1..*
manipulates
1..* 1..*
Data Subject:: Data
subject
identifies
1..*
*
authorizes
- isEasyToAcess: boolean [1]
- isDistinguishable: boolean [1]
- date: Date [1]…
Data Subject
Rights:: Right
*
*
*
Processing Type
- Storing
- Profiling
- Archiving …
«enumeration»
Data Category
- Biometric
- Genetic
- Judicial …
«enumeration»
Processing context
- Public interest
- Public Health
- Research …
«enumeration»
concerns
1 1
«Optional»
Document (Abstract)
- purpose: String [1]…
«Variation»
provides
*
*
Legal Adjudication
«Variant»
Household Composition
«Variant»
Residence Certificate
«Variant»
Child Custody
«Variant»

Glossary
19
Glossary table
Textual description of each OCL constraint and classes
Concept Traceability Description
Data Subject Art. 4
A natural person whose personal
data is processed.
VAR_DSAge
(OCL constraint)
Art. 8
Ensures that data subjects under a
certain age (default = 16) are
classified as child
… … …

Glossary
20
Glossary table
Concept Traceability Description
Data Subject Art. 4
A natural person whose personal
data is processed.
VAR_DSAge
(OCL constraint)
Art. 8
Ensures that data subjects under a
certain age (default = 16) are
classified as child
… … …
Data Subject::
Natural Person
Purpose
- motivation: Processing context [1]
- Description: String [1]…
Data Processing
- Type: Processing Type [1]
- isCrossBorders: Boolean [1]…
realizes
1..*
1..*
authorizes
*
*
Processing Type
- Storing
- Proﬁling
- Archiving …
«enumeration»
Processing context
- Public interest
- Public Health
- Research …
«enumeration»

ID Art. Obligation & Rules Constraints & Variability
O1 8
When the data subject age is below a certain
threshold, the controller must ensure that
consent is given or authorized by the holder of
parental responsibility over the child.
Constraints
ConsentProvider
Var_DSAge
Variability in the Class Model
Consent class
… … … …
Mappings of obligations and rules
21
Variation Point
Rule
Obligation and rules table

22
Variation Point
Rule
O1 8
Constraints
ConsentProvider
Var_DSAge
Consent class
… … … …

23
describes
*
Consent
Personal Data
- category: Data Category [1]
- belongsToSpecialCategory: boolean [1]
- collectedFromDataSubject: boolean [1]…
Data Subject:: Data
subject
identiﬁes
1..*
*
- isEasyToAcess: boolean [1]
- isDistinguishable: boolean [1]
- date: Date [1]…
Data Subject
Rights:: Right
* concerns
1 1
O1 8
Constraints
ConsentProvider
Var_DSAge
Consent class
… … … …

Tailor the Generic Model (RQ2)
24
Build the Generic
¨
ÆGenerate Instance
of the Domain Model
EU Members’
Laws
Case
Law
Tailor the GDPR
Conceptual Model
≠
Domain and
Organization
Constraints
Generic Model
OCL
GDPR
DB
Model Instance
Check GDPR
Compliance
Ø
OCL
Specific and
Generic
Rules

Variability Points
25
12 paragraphs belonging to 8 articles
delegate some legislative power to the
European Commission (EC)
24 paragraphs spread over 20 articles
delegate some legislative power to
European Member States (EMS)

Tailoring the Generic Model
26
Example: Organization located in Europe that transfers personal
data outside the EU
Variability table
ID Trac. Actor Description When & How to resolve
V1
Art. 8(1)
O1
EMS
The EMS law may
provide for a lower
age from which
parental consent is
no longer required,
provided that such
lower age is not
below 13 years.
[When?] If there is at
least one processing
involving child data
subject.
[How?] Override
… … … … …
V16
Art. 45(3)
O41
EC
The EC may decide
that a third country,
a territory or a
specific sector
within a third
country ensures an
adequate level of
protection for data
transfer
[When?] If data needs
to be transferred outside
the EU
[How?] Update the
class model and
VAR_checkLegalTransfer
constraint based on the
EC’s adequacy decision.

27
data outside the EU
Variability table
V1
Art. 8(1)
O1
EMS
The EMS law may
provide for a lower
age from which
parental consent is
no longer required,
provided that such
lower age is not
below 13 years.
[When?] If there is at
least one processing
involving child data
subject.
[How?] Override
… … … … …
V16
Art. 45(3)
O41
EC
The EC may decide
a territory or a
specific sector
within a third
country ensures an
adequate level of
protection for data
transfer
the EU
[How?] Update the
class model and

28
V16
Art. 45(3)
O41
EC
The EC may decide
a territory or a
specific sector
within a third
country ensures an
adequate level of
protection for data
transfer
the EU
[How?] Update the
class model and
data outside the EU
Variability table

29
V16
Art. 45(3)
O41
EC
The EC may decide
a territory or a
specific sector
within a third
country ensures an
adequate level of
protection for data
transfer
the EU
[How?] Update the
class model and
data outside the EU
Ref. Artifact Summary of actions
… … …
V16 Obligation table
A new obligation ON1 was added: when a cross-
border data transfer is based on an adequacy
decision from the EC, a Data Privacy Impact
Assessment must be conducted.
V16
Specialized
model
The enumerations covering the territories and
specific sectors that can receive personal data
based on the EC adequacy decision was updated
according to the EC website.
V16 OCL constraints
One constraint was overridden to state that only
cross-border data transfer to Canada is allowed:
1) under PIPEDA and 2) when conducting a
commerce activity.
One constraint was added to encode the new
obligation ON1.
V16 Glossary
The description of the overridden constraints
were updated.
Resolution tableVariability table

Lessons Learned (1/3)
30
Streamline the validation process
• Describe each OCL constraint via an intuitive but precise
textual description
• Manage complexity when reviewing models with legal
experts

31
Maintain traceability
Ensure all modelling artifacts are traceable to their
corresponding legal provisions

32
Make the tailoring step as systematic as possible
• Select the variation points that are relevant to the context
• Resolve the variations systematically
• Keep track of all the tailoring actions carried out

33
Challenges (RQ3)
We do not systematically express the rationale
behind the decisions we made
Rationale

34
Challenges (RQ3)
Legal experts cannot be expected to define
formal constraints
Rationale
Compliance
Rule
Language

35
Challenges (RQ3)
Legal experts cannot be expected to build
instances’ models entirely manually
Legal experts cannot be expected to define
formal constraints
Rationale
Compliance
Rule
Language
Instance
Model
Builder

Future Directions
36
Challenges to address
Rationale
Compliance
Rule
Language
Instance
Model
Builder

Future Directions
37
Goal Models to deal with capturing and reasoning
about the rationale for model specialization
37
Rationale
Compliance
Rule
Language
Instance
Model
Builder

Future Directions
38
DSL for the precise specification of GDPR
compliance checking rules
38
Rationale
Compliance
Rule
Language
Instance
Model
Builder

Future Directions
39
DSL for the precise specification of GDPR
compliance checking rules
AI-enabled tool to identify specific content from
legal artifacts that enable model instantiation
Rationale
Compliance
Rule
Language
Instance
Model
Builder

Current Work
40
• Developing an AI-enabled tool
• Building a DSL to check privacy policy compliance
Example: Check that a privacy policy is GDPR compliant
Checking Compliance Analysis ReportPrivacy Policies

Automated Instance Creation
41
PRIVACY POLICY
Personal Data (PD)
Categories
PD Origins

Automated Compliance Checking
42
Question to the legal expert
Besides to directly collect personal
data from the data subject, will
personal data also be collected
indirectly? Yes/No
START
END
Is
PD ORIGIN
PUBLICLY and
or THIRD
PARTY?
Q?
PD CATEGORY
Identiﬁed?
Yes
Yes
PD
CATEGORY
not needed
PD
CATEGORY
missing
PD
CATEGORY
Complete PD
CATEGORY
Yes
No
No
No
Is PD
CATEGORY
THIRD PARTY
speciﬁed?
Only PD
CATEGORY
No
Yes

Summary
43
Experience modelling the GDPR using UML class diagrams and OCL

Summary
44
Generic Model of the GDPR

Summary
45
Generic Model of the GDPR Specialization of the Generic Model

Summary
46
Three Lessons Learned

Summary
47
Three Lessons Learned Future Directions to address
the Challenges

.lusoftware veriﬁcation & validation
VVS
Using Models to Enable Compliance Checking
against the GDPR: An Experience Report
Damiano Torre, Ghanem Soltana, Mehrdad Sabetzadeh,
and Lionel Briand*
SnT - University of Luxembourg
*also with University of Ottawa, Canada
Yuri Auffinger and Peter Goes
Linklaters Luxembourg
September 18th, 2019
torre@svv.lu

Using Models to Enable Compliance Checking against the GDPR: An Experience Report

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Using Models to Enable Compliance Checking against the GDPR: An Experience Report

Similar to Using Models to Enable Compliance Checking against the GDPR: An Experience Report (20)

More from Lionel Briand

More from Lionel Briand (20)

Recently uploaded

Recently uploaded (20)

Using Models to Enable Compliance Checking against the GDPR: An Experience Report