There is an evidently growing legal, cultural and technological need for tools and models that allow users to express their own intentions and consent over the usage of their personal data and information. Service providers and institutions that manage personal data rely on specifying monolithic \Terms and Conditions" written in natural language and enforced in an ad-hoc manner, by presenting users with topdown, coarse-grained, opt-in/out options. We advocate the need for users to describe their personal contract of data usage in a formal, machineprocessable language. Semantic Web technologies can have a central role in this approach by providing the formal tools and languages required. Expressing data sharing intentions, consent and data usage agreements in a technical way enables the development of algorithms that automatically respect a user's policy. This helps organisations increase technological capabilities, abide by legal requirements, and avoid ad-hoc processes, thus saving engineering resources.
In this paper we advocate the need for machine processable data sharing agreements which we believe will prove particularly valuable to the health data management domain.
Traditional data privacy approaches such as privacy[
All these technologies consider protection against a non-trusted party and as such they aim to directly limit access to data, or hide the identity of the Copyright c 2019 for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0). individual, rather than provide a contract of access that can be used also for later or indirect use by a relatively trusted party.
The latter idea has been limitedly studied in the context of privacy languages for the World Wide Web, with most notable the now deprecated example of the P3P language [13]. P3P alloweded website owners to specify coarsegrained policies, using predened options, regarding usage of the clients' data; web clients/browsers would also specify their preferences in a similar way and automatically accept or reject visiting a page depending on a match between the policies. Such coarse-grained predened options, and the fact that these languages mostly provide \accept/reject" policies and don't oer exibility for partial access has led almost to an abandonment of machine processable eorts to specify access and usage contracts, leaving data owners and service providers to rely exclusively on legal, natural language, \Terms of Use" agreements.
We claim the need to develop the theory, algorithms and implementations
of expressing, supporting and managing ne-grained intentions, or contracts of
data access and data usage, as well as personal user consent. To achieve that,
we believe that systems need to pursue the following objectives:
1. Create a bottom-up setting where individuals and organisations can create
data sharing policies backed-up by a formal machine-processable technical
language. This is in contrast to the classic service-client data sharing model
where clients commit their data to a service provider after being presented
with coarse-grained \Terms and Conditions" written in natural language,
and on which the clients get only a few and simple opt-in/opt-out options.
2. Enable rich and more dynamic expressions of access and usage policies.
Current access control systems are based on a predened set of static rules in order
to prohibit access to certain elds of a data repository; these access control
rules cannot express sharing contracts such as a policy that prohibits a data
item to be shared depending on its history of sharing, or on the amount of
data already given to the data requester.
3. Develop algorithms that will allow data requesters to obtain the maximal
result set of the query that still abides by the contracts of the data owners.
4. Support the goal of data auditing [
We believe that semantic web technologies are inherently suitable to serve the role of providing the common shared vocabularies for data sharing intentions and agreements, together with the algorithmic machinery that is needed to process these agreements.
Building on top of more general schemas such as FOAF, and schema.org that
can be used to describe persons and personal data, or DICOM [
These knowledge graphs are great steps towards a vision where users or
parties encode their preferences and intentions of data usage in a machine
processable way and data processing algorithms automatically respect these preferences.
In order to achieve this, the developed vocabularies have to be backed by the
development of generic and re-applicable algorithms; possibly borrowing from
data integration [