Policy-compliant Data Processing: RDF-based Restrictions for Data-protection

Abstract

Data processing can be restricted by policies (constraints), to, among others, protect the individual's privacy, a fundamental human right. Software used to process data may utilize ontologies to represent knowledge as concepts, relationships and restrictions, to solve the task at hand. In knowledge representations, restrictions are typically expressed as axioms, whereas policy-related restrictions have more application speci c focus, and are usually expressed as constraints. Thus, various purposes demand di erently modeled restrictions. However, existing methodologies do not provide guidelines on how to model restrictions, nor do they distinguish between axioms and constraints. This PhD research aims to investigate the systematic creation of RDF-based restrictions, and their use in policy-compliant data processing. In this paper, I outline my PhD research to (i) analyze the current use of restrictions in ontologies, (ii) provide methodological guidelines to model restrictions, and (iii) apply RDF-based restrictions on data processing to assess policy compliance both before and after the fact. RDF-based restrictions can be modeled by various recommended languages, including OWL, ODRL, SHACL or ShEx. Methodological guidelines to choose the appropriate language or language combinations for an application scenario are bene cial for the knowledge engineering community. Additionally, systematically created restrictions can be used for privacy-compliance assessments.

Keywords

• Policy
• Privacy
• Ontology Engineering
• Restrictions
• Provenance

-

Processing data might be subject to certain policies, i.e., encoded constraints that should be met. A recent example is the General Data Protection Regulation (GDPR) of the European Union1, which demands the lawful processing of personal data. Such lawful processing comprises that data processing can only happen based on clearly stated purposes a user gave consent for.

Semantic Web technologies provide meaningful data processing, using ontologies to formally represent real world domains [32]. Besides concepts and their ? Co-Promotor dr. Anastasia Dimou and Promotor prof. dr. ir. Ruben Verborgh 1 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679 Copyright © 2019 for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0). relationships, an ontology is characterized by a set of axioms [ 9 ], which encodes the implicit rules constraining the structure of a piece of reality [ 11 ]. Axioms are true statements used to represent knowledge by following the Open World Assumption [26], whereas constraints express conditions on data that should be met, and causes an exception if not met [39]. Both axioms and constraints typically play an important role when modeling personal data processing. On the one hand, axioms on ontological concepts encode, for instance, the personal data processing domain in a machine-understandable way. On the other hand, use-case speci c constraints encode conditions regarding, for instance, the lawful processing of personal data which should be met. I identify the following three problems: Problem 1 So far it is not known which restrictions are used in practice, to which extent, or for what rationale. However, such insights can be used to provide guidelines for restriction modeling, e.g. which restriction type should be used for a given application scenario. Di erent types of restrictions (axioms) exist, such as subclass relationships or disjointness between concepts. Each restriction type serves di erent purposes: subclass relationships can, for instance, describe taxonomic structures, and disjoint classes express mutual exclusiveness in a machine-readable way.

Problem 2 So far di erent methodologies exist to de ne ontologies in a systematic way. However, these Ontology Engineering methodologies do not provide concrete guidelines regarding how to encode restrictions, nor do they distinguish restrictions between axioms and constraints. The modeling of restrictions needs to be guided, i.a., to make informed decisions if a restriction should be encoded as axiom or constraint.

Problem 3 In the use case of lawful processing of personal data, it is unclear which RDF-based constraint language (or language combinations) can be used to express relevant policies, while checking compliance in an automated fashion to improve privacy-compliant data processing. Di erent languages to express constraints exist in the Semantic Web: common languages are ODRL [38] to describe policies, SHACL [ 15 ] to describe general shape-based constraints, and ShEx [30] to describe a schema. 2

Related Work

Related work concerns each of the aforementioned problems: Restrictions in the Semantic Web (Section 2.1), Ontology Engineering Methodologies (Section 2.2) and policy compliance (Section 2.3). 2.1

Restrictions

Ontologies are usually more complex and possibly formal vocabularies containing restrictions2 and aim to represent knowledge machine-understandably. OWL2 is a knowledge representation language which uses di erent restriction types in the form of axioms, e.g. disjoint classes or re exive properties.

While restrictions in the form of axioms are used to represent knowledge, and enable reasoning based on the Open World Assumption (OWA), restrictions in the form of constraints are used, for example, to validate data which should adhere to such a knowledge representation [ 17 ]. Tao et al. [35] described integrity constraints semantics for OWL. Their work can be used for data validation under a Closed World Assumption (CWA), using OWL without the need of another language. More recent, two generic constraint languages on top of RDF were proposed: ShEx [30] to describe a schema, and the W3C recommended SHACL [ 15 ] to express constraints. Both languages follow the Closed World Assumption and can be used to describe constraints and automatically validate data.

So far constraints were investigated mostly in the context of data quality. RDFUnit [ 16 ] is a test-driven evaluation framework for Linked Data which uses a set of SPARQL templates to assess data quality issues. Several Data Quality Test Patterns cover aspects, such as cardinality, disjointness, or literal value restrictions. Hartmann [ 12 ] published a set of 81 restriction types. Not all of the presented restriction types can be modeled with each investigated language, e.g. some literal-value related restrictions cannot be expressed with OWL. Arndt et al. [ 4 ] provided an alignment between RDFUnit's Data Quality Test Patterns and corresponding restriction types identi ed by Hartmann [ 12 ]. This alignment represents restriction types which minimally cover common validation requirements.

Di erent languages to express restrictions exist, following either the Closed or the Open World Assumption. Therefore I can conclude that a variety of restriction types and languages exist which raises the need for guidance on how to use them i.a. for data-protection policies. 2.2

Ontology Engineering Methodologies

Knowledge in the form of ontologies is built since decades. Sequential [ 10, 36 ], iterative [ 20, 5 ] and even agile [28, 21, 29] Ontology Engineering methodologies were proposed, all aiming to transform the art of building ontologies into an engineering activity [34].

One common methodology is NeOn [34], a scenario-based methodology with the aim to modularize Ontology Engineering activities. Therefore, NeOn relied on state-of-the-art methodologies and its authors also published a list with common activities to push standardization e orts further [33]. This NeOn glossary of processes and activities [33] provides a comprehensive list of ontology engineering

2 https://www.w3.org/standards/semanticweb/ontology

processes and activities. This glossary covers also activities related to Ontology Design Patterns [ 13 ], which aim to serve as building blocks to approach common modeling and publishing challenges.

Ontology Engineering activities collected from the mentioned methodologies and the glossary, as well as Ontology Design Patterns are the state-of-the-art, and serve as basis for my research, investigating the modeling of restrictions. 2.3

Policy Compliance

Agarwal et al. [ 3 ] created a compliance assessment framework, where the GDPR is described using an extension of ODRL [38]. Their work comprises a description of the GDPR using ODRL, yet the assessment is manual and based on yes/no questions associated with the related ODRL duties.

Pandit et al. [25] proposed a proof-of-concept using SPARQL and SHACL for compliance checks. This approach is similar to the previous mentioned approach with the di erence that SHACL is used instead of ODRL.

PrOnto [24] includes semantic representations with deontic operators. Based on PrOnto, the authors created a proof-of-concept, to perform legal reasoning on BPMN [22], which allows compliance checking before and after the fact [23]. Their work is di erent compared to the previous two, as it uses deontic logic models.

The SPECIAL consent, transparency and compliance system [ 14 ] performs GDPR compliance checks using OWL reasoning. Compared to the other approaches using ODRL or SHACL, this system relies on restrictions expressed as axioms rather than constraints.

Di erent approaches and languages exist to perform a compliance assessment. My goal is to de ne methodological guidelines regarding the modeling of restrictions, which then also a ects compliance assessment. 3

Research Questions

Given the three stated problem areas, the main question this PhD thesis aims to answer is how can we systematically model RDF-based restrictions to improve privacy-compliant data processing? Therefore, the following concrete research questions arise, according to the previously de ned problem statements.

Research Question 1 Di erent restriction types exist, but little is known regarding their use which represents a gap in best-practices and guidelines. How can we measure restriction usage in ontologies? Research Question 2 A plethora of Ontology Engineering methodologies, Ontology Design Patterns and a glossary of ontology engineering activities were proposed in the past. No recent overview exists, comparing the di erent methodologies and activities with respect to how restrictions are modeled. How can we de ne a restriction modeling activity for knowledge engineering?

Research question 3 To what extent can constraint languages support privacy-compliant data processing?

4

Hypothesis

Based on the stated problems and raised research questions, I de ne the following hypotheses: 1. Using de nitions of restriction types and restriction type expressions, we can detect used restriction types from axioms used by current ontologies in an automated fashion, to obtain quanti able statistics about, i.a., the distribution of restriction type usage. 2. Comparing existing ontology engineering activities and tasks using IEEE Std 24774-2012 [ 2 ] to derive a list of factors in uencing the encoding of restrictions, allows us to de ne a restriction modeling activity. 3. We can express ODRL concepts as SHACL constraints to validate data processing expressed as provenance work ows described by the P-PLAN ontology3, faster than a manual assessment. 5

Approach

My approach consists of three parts, each related to a problem statement. The rst part contributes insights in the current use of restrictions. Part two concerns a review of existing ontology engineering literature, which together with results from part one can be used to propose methodological guidelines on how to model restrictions. Such methodological guidelines support the user in the modeling of restrictions, i.e. which restrictions should be formulated as axioms and which as constraints, which can then be used to improve privacy-compliant data processing, as it is known which closed-world constraints exists on data adhering to which open-world axioms of the modeled domain.

Restrictions use analysis An analysis regarding the use of restrictions in existing ontologies needs to take into account, that restriction types can be expressed using di erent vocabularies and terms. Therefore, based on restriction types described in related work, I distinguish between abstract restriction types and concrete restriction type expressions because a restriction type like disjoint classes can be expressed using for instance the expression owl:disjointWith or alternatively the expression owl:AllClassesDisjoint. The use of the described restriction types can then be measured relying on the RDF Data Cube [ 8 ] ontology, and, due to the distinction between abstract types and concrete expressions, the statistics can be extended if necessary, e.g. if new restriction type expressions are identi ed by the community. The results can lead to concrete questions regarding the rationale of why certain restriction types were used, respectively not used, and thus lead to further research.

3 http://purl.org/net/p-plan

Restriction modeling Several ontology engineering methodologies exist and thus it is possible that activities to model restrictions either exist which I can reuse, or related ontology engineering activities can be extended to cover the modeling of restrictions. Therefore, I conduct a systematic literature review to compare activities of existing Ontology Engineering methodologies, covering e.g. Ontology Design Patterns, with respect to their in uence on restriction modeling. Activities performed early in the engineering process cover the collection of di erent requirements regarding the knowledge to be represented, but also regarding the application using it. I identi ed these activities to be crucial for the decision of how restrictions could be expressed. However, other activities might also in uence the encoding of restrictions. Both, the NeOn methodology and Corcho et al. [ 6 ] compared Ontology Engineering methodologies based on the IEEE Std 10742006 [ 1 ], Therefore I will compare the NeOn glossary activities and activities of identi ed ontology engineering methodologies based on IEEE Std 24774-2012 [ 2 ] (the successor of the previous mentioned standard). Depending on the outcome of the systematic literature review, research regarding new Ontology Engineering activities or extensions of existing activities can be conducted, to propose methodological guidelines for restriction modeling.

Restrictions for policy compliant data processing Both, planned data processing work ows (prospective provenance) and executed data processing work ows (retrospective provenance) can be described using the P-PLAN ontology. Thus, compliance to a policy can be checked ex ante, i.e. before data processing happens, and ex post, i.e. after the fact. ODRL is the W3C recommended language to describe permitted and prohibited actions, and thus a reasonable choice to express data-protection related policies. However, SHACL as the W3C recommended general constraint language additionally de nes a validation process resulting in a ne-grained validation report, and, thus, is a reasonable choice for automatic compliance assessment. My approach to combine the bene ts of both languages, is to express ODRL concepts in SHACL, such that a SHACL validation process can perform ODRL-related compliance checks on provenance work ows described using P-PLAN. This approach seems feasible, as the working group publishing ODRL also mentioned a possible use of SHACL4. 6

Evaluation Plan

The presented approach will be evaluated as follows.

Hypothesis 1 To evaluate the rst hypothesis, the approach to represent restriction types and restriction type expressions is applied to existing ontologies listed in LOV [37]. The obtained statistical results are then analyzed regarding the distribution of di erent restriction types and di erent restriction type expressions. Furthermore, statistical results obtained by applying our approach on ontologies, can be compared with a manual created ground truth, stating which restrictions are present in the ontologies. 4 https://w3c.github.io/poe/ucr/#x2-26-poe-uc-26-data-quality-policy Hypothesis 2 A systematic literature review, covering Ontology Engineering methodologies, will comparatively evaluate this hypothesis. Proposed Ontology Engineering activities can be compared with IEEE Std 24774-2012 [ 2 ] and based on di erent activity de nitions, factors in uencing restrictions can be derived, which can lead to the de nition of a restriction modeling activity. Further research stating new hypothesis is needed to evaluate the feasibility of the de ned restriction modeling activity, e.g. by performing user evaluations. Hypothesis 3 To evaluate the third hypothesis, GDPR-related obligations are expressed using ODRL, as described by Agarwal et al. [ 3 ], and then transformed to corresponding SHACL constraints. This approach can be functionally evaluated by executing a SHACL validation process on a data-protection-related P-PLAN work ow, and verify the correctness of the validation report by comparing it to the expected outcome for the given P-PLAN work ow. Additionally, to evaluate if the proposed approach is faster than a manual assessment, a proof-of-concept implementing the approach can be compared to a manual assessment by users for a given scenario. 7

Preliminary Results

Di erently obtained results contributed considerably to draft my research plan. Current use of restrictions I described abstract restriction types and their di erent concrete expressions with a vocabulary and applied it to 98% of LOV ontologies, to create comprehensive statistics of restriction type use. First results show that RDFS-based restriction types are used in more than 94% of the analyzed ontologies, and that OWL-based restriction types are used in only 49% of the analyzed ontologies. This motivates new research to identify the rationales behind the use (or non-use) of certain restriction types.

Ontology Engineering An initial analysis of literature relevant to ontology engineering revealed lack of activities supporting the modeling of restrictions, and, thus, motivating a systematic literature review regarding restrictions modeling. Although diverse in the approach and execution, early activities of existing methodologies describe the knowledge representation requirements to be built. These requirements set the course of further modeling activities, in uence design decisions, and, thus, are crucial to the decision of how to encode restrictions. Processing of personal data A proof-of-concept using semantically enhanced graphical work ows to depict planned data processing, demonstrated the use of prospective provenance to generate privacy-related documentation regarding personal data processing [ 19 ]. The process of creating such a plan, can pro t from policies expressed as constraints, as policy compliance can be automatically assessed ex ante i.e. before data processing happens. Policies expressed as constraints are also a useful annotation for data to check compliance ex post i.e. after the fact. Another proof-of-concept which transforms structured learning activity data of educational applications to Linked Data, demonstrated the use of privacy-related annotations expressing policies which can be considered by applications consuming the data [ 18 ]. These proof-of-concepts can be equipped with the presented approach, to perform a compliance assessment in an automated fashion. This allows then also to perform a user-study to evaluate hypothesis 3. 8

Relevancy

The proposed research is relevant to (i) identify a trade-o between lightweight and highly axiomatized knowledge representation, (i) the systematic modeling of constraints, and (iii) data-protection.

Level of formality Di erent works already pointed out that lightweight, less axiomatized ontologies gained popularity in the Semantic Web [ 7, 27 ]. However, certain application scenarios demand semantics in the form of stated axioms [31]. Considering the fact that di erent restriction types exist, there certainly exists a trade-o between providing lightweight ontologies, and providing axioms of certain types necessary for a given application scenario. My research provides insights in the use of di erent restriction types and thus contributes also to this issue.

Constraints Engineering SHACL, the W3C recommendation to express constraints in the form of shapes was just published recently. Thus not much research regarding the use of constraints was conducted yet. The community just began to experiment with shapes and to nd use-cases. Although engineering methodologies for ontologies exist, other RDF-based resources like shapes are not yet taken into account. Methodological activities for the creation of restrictions including such constraints, and a knowledge engineering methodology equipped with such an activity is bene cial for the community.

Data-protection Data protection is a fundamental human right and also recognized within the UN as potential risk for sustainable development5. Knowledge representation-based applications provide transparency, an often stated need and also part of the GDPR. Additionally, I claim that not all users who process personal data want to harm data-protection on purpose. Knowledge representation-based compliance assessment supports users in planning privacyaware data processing, or perform a privacy-related assessment on retrospective provenance data. Thus, my research can be used to support data-controllers or data-processors (users performing personal data processing) in their tasks, while adhering to data-protection. 5 https://www.un.org/en/sections/issues-depth/big-data-sustainable-development.

html

Re ections

I re ect on knowledge engineering for the RDF ecosystem, and data-protection related policy compliance assessment.

Knowledge engineering Modeling restrictions as axioms, and as constraints is both important, however not yet considered when systematically building knowledge. Expressing restrictions is fundamental when representing knowledge which should be processable by machines. Clearly de ned semantics and the Open World Assumption for ontology languages are important for machine understandability, reasoning tasks, and are part of languages such as OWL and RDFS. An often stated need when practically using ontologies concerns quality and data validation. Di erent approaches in the past proposed to use OWL in a Closed World setting, to perform data validation tasks. It is possible, but newly proposed languages such as SHACL and ShEx are explicitly designed for a closed world context, and thus complement ontology languages. There is a clear separation of concerns between these two approaches. However, existing ontology engineering methodologies were designed in a time without W3C recommendations for constraint languages at hand, and additionally only focus on ontologies. Real life projects often do not de ne a clear separation between applications using ontologies and an ontology itself. Thus the engineering process might have to deal with requirements not concerning which knowledge needs to be represented, but how to express and how to use it in a concrete application scenario.

Policy compliance assessment Several existing works investigated policy compliance assessment using RDF-based technologies. However, they are either focused on ODRL but then on manual assessment [ 3 ], deontic logical models [23], or are SPARQL and SHACL-based [25]. To the best of my knowledge, the proposed research is the rst combining two of the mentioned approaches to apply it on provenance work ows. This thesis also aims to provide insights regarding the use of axioms and constraints, therefore future work might also investigate in a di erent combination of the three mentioned compliance assessment approaches, e.g. deontic logical models and ODRL or SHACL. [34] Suarez-Figueroa, M.C., Gomez-Perez, A., Fernandez-Lopez, M.: The neon methodology framework: A scenario-based methodology for ontology development. vol. 10, pp. 107{145, IOS Press (2015) [35] Tao, J., Sirin, E., Bao, J., McGuinness, D.L.: Integrity constraints in owl.

In: Twenty-Fourth AAAI Conference on Arti cial Intelligence (2010) [36] Uschold, M.: Building ontologies: Towards a uni ed methodology. In: In 16th Annual Conf. of the British Computer Society Specialist Group on Expert Systems, pp. 16{18 (1996) [37] Vandenbussche, P.Y., Atemezing, G.A., Poveda-Villalon, M., Vatant, B.: Linked Open Vocabularies (LOV): a gateway to reusable semantic vocabularies on the Web. Semantic Web 8(3), 437{452 (2017) [38] Villata, S., Iannella, R.: ODRL information model 2.2. W3C recommendation, W3C (Feb 2018), https://www.w3.org/TR/2018/REC-odrl-model20180215/ [39] WfMC: Work ow management coalition terminology & glossary document number wfmc-tc-1011 (1999)

References

[1] IEEE standard for developing a software project life cycle process . IEEE Std 1074-2006 (Revision of IEEE Std 1074-1997 ) pp. 1 { 110 ( July 2006 ), doi:10.1109/IEEESTD. 2006 .219190

[2] IEEE guide{adoption of iso/iec tr 24474:2010 systems and software engineering{ life cycle management{guidelines for process description . IEEE Std 24774-2012 pp. 1 { 34 (April 2012 ), doi:10.1109/IEEESTD. 2012 .6190704

[3] Agarwal , S. , Steyskal , S. , Antunovic , F. , Kirrane , S. : Legislative compliance assessment: Framework, model and gdpr instantiation . In: Annual Privacy Forum , pp. 131 { 149 , Springer ( 2018 )

[4] Arndt , D. , De Meester , B. , Dimou , A. , Verborgh , R. , Mannens , E. : Using rule based reasoning for RDF validation . In: RuleML+RR ( 2017 )

[5] Benjamin , P.C. , Menzel , C.P. , Mayer , R.J. , Fillion , F. , Futrell , M.T., deWitte, P.S. , Lingineni , M.: Idef5 method report . Knowledge Based Systems , Inc ( 1994 )

[6] Corcho , O. , Fernandez-Lopez , M. , Gomez-Perez , A. : Methodologies, tools and languages for building ontologies: Where is their meeting point? Data Knowl . Eng . 46 , 41 { 64 ( 2003 )

[7] Corcho , O. , Poveda-Villalon , M. , Gomez-Perez , A. : Ontology engineering in the era of linked data . Bulletin of the Association for Information Science and Technology 41 ( 4 ), 13 { 17 ( 2015 )

[8] Cyganiak , R. , Reynolds , D. : The RDF Data Cube Vocabulary. W3C recommendation ( 2014 ), http://www.w3.org/TR/2014/REC-vocab -data-cube20140116/

[9] De Nicola , A. , Missiko , M. , Navigli , R.: A software engineering approach to ontology building . Information systems 34(2) , 258 { 275 ( 2009 )

[10] Gruninger, M. , Fox , M.S. : Methodology for the design and evaluation of ontologies ( 1995 ), URL http://citeseerx.ist.psu.edu/viewdoc/summary? doi =10.1.1.44.8723

[11] Guarino , N. , Giaretta , P. : Ontologies and knowledge bases: Towards a terminological clari cation . In: Towards very Large Knowledge bases: Knowledge Building and Knowledge sharing , pp. 25 { 32 , IOS Press ( 1995 )

[12] Hartmann , T. : Validation Framework for RDF-based Constraint Languages . Ph.D. thesis, Karlsruher Institut fur Technologie (KIT) ( 2016 )

[13] Hitzler , P. , Gangemi , A. , Janowicz , K. : Ontology engineering with ontology design patterns: Foundations and applications , vol. 25 . IOS Press ( 2016 )

[14] Kirrane , S. , Fernandez , J.D. , Dullaert , W. , Milosevic , U. , Polleres , A. , Bonatti , P.A. , Wenning , R. , Drozd , O. , Raschke , P.: A scalable consent, transparency and compliance architecture . In: European Semantic Web Conference , pp. 131 { 136 , Springer ( 2018 )

[15] Knublauch , H. , Kontokostas , D. : Shapes constraint language (SHACL) . Tech. rep., W3C (Jul 2017 ), URL https://www.w3.org/TR/shacl/

[16] Kontokostas , D. , Westphal , P. , Auer , S. , Hellmann , S. , Lehmann , J. , Cornelissen , R. , Zaveri , A. : Test-driven evaluation of linked data quality . In: Proceedings of the 23rd international conference on World Wide Web , pp. 747 { 757 , ACM (Mar 2014 )

[17] Labra Gayo , J.E. , Prud'hommeaux, E., Boneva , I. , Kontokostas , D. : Validating RDF Data , vol. 7 . Morgan & Claypool Publishers LLC ( Sep 2017 ), doi: 10.2200/s00786ed1v01y201707wbe016, URL http://book.validatingrdf. com/

[18] Lieber , S. , De Meester , B. , Dimou , A. , Verborgh , R.: Linked data generation for adaptive learning analytics systems . In: LILE workshop, part of the WebScience conference, pp. 1 { 4 ( 2018 )

[19] Lieber , S. , Dimou , A. , Verborgh , R.: Sego ow: A semantic governance work ow tool . In: European Semantic Web Conference, pp. 95 { 99 , Springer ( 2018 )