CAREER: SaTC: Law-Aware Methodologies for Privacy Regulatory Compliance Audits

Comprehensive consumer privacy protection regulations are now gaining traction in the United States and globally. These regulations require many organizations to comply with mandates that require disclosure of data gathering and usage practices and allow consumers to control their personally identifiable information by enabling data access, deletion, and usage restrictions. Unfortunately, it is challenging to verify organizations' compliance with these regulations at scale due to limited resources at enforcement agencies. The project team is addressing this challenge by developing a variety of innovative computational techniques to improve the ability of enforcement agencies to conduct large-scale compliance audits. The project is identifying low-cost mechanisms for improving organizations' rates of compliance with these regulations. In addition to advancing the state-of-the-art in Internet measurement and privacy research, the outcome of the project facilitates stronger consumer protections by developing tools that empower privacy regulation enforcement. The integrated education plan is increasing students' awareness and interest in privacy regulatory mechanisms and research. The overarching goal of this project is to facilitate more efficient privacy regulation compliance verification by developing automated audit methodologies. The methods developed use a law-first (i.e., regulation-aware) approach to the construction of a disclosure and data rights auditing framework. This contrasts with the current norm of performing general measurements (i.e., regulation-unaware) and then attempting to make observations about the state of regulatory compliance within an ecosystem. The project team investigates law-aware approaches to automate policy analysis for verifying compliance with common disclosure mandates in privacy regulations, construct methodologies for verifying compliance with common data rights mandates in privacy regulations, and develop low-cost notification-based mechanisms for improving organizations' rate of compliance with privacy regulations. This project is jointly funded by SaTC and the Established Program to Stimulate Competitive Research (EPSCoR). This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.