Formalizing Privacy Laws for License Generation and Data Repository Decision Automation
This addresses the bottleneck of legal expertise in data transfers for repositories, but is incremental as it builds on existing expert system approaches.
The paper tackles the problem of automating data repository decisions and license generation by formalizing privacy laws and regulations into a logic programming language, enabling automated reasoning and custom data use agreements to reduce lawyer effort per transfer.
In this paper, we summarize work-in-progress on expert system support to automate some data deposit and release decisions within a data repository, and to generate custom license agreements for those data transfers. Our approach formalizes via a logic programming language the privacy-relevant aspects of laws, regulations, and best practices, supported by legal analysis documented in legal memoranda. This formalization enables automated reasoning about the conditions under which a repository can transfer data, through interrogation of users, and the application of formal rules to the facts obtained from users. The proposed system takes the specific conditions for a given data release and produces a custom data use agreement that accurately captures the relevant restrictions on data use. This enables appropriate decisions and accurate licenses, while removing the bottleneck of lawyer effort per data transfer. The operation of the system aims to be transparent, in the sense that administrators, lawyers, institutional review boards, and other interested parties can evaluate the legal reasoning and interpretation embodied in the formalization, and the specific rationale for a decision to accept or release a particular dataset.