NLPT: Bridging the Gap Between Legal English and Automated Privacy Enforcement

TL;DR

Privacy policies protect our digital lives, yet their natural language format makes them "invisible" to automated security systems. This paper presents NLPT, a tool that uses NLP and Ontologies to translate standard social network policies (like Facebook's) into CNL4DSA, a formal controlled language that machines can actually "understand" and enforce.

Context: Why Readable Policies are a Technical Bottleneck

In the world of Online Social Networks (OSNs), data management is governed by lengthy terms of service. While these are (mostly) readable by humans, they are fundamentally incompatible with Policy Enforcement Points (PEP). Current software infrastructures require machine-readable inputs (like XACML) to verify that a data request doesn't violate a user's privacy settings.

The "Holy Grail" of privacy research is to take a sentence like "We collect the content you provide" and automatically turn it into an enforceable rule without human intervention.

Methodology: The NLP-to-Ontology Pipeline

The authors propose a "Natural Language Policy Translator" (NLPT). The workflow is divided into three critical technical phases:

1. Syntactic Deconstruction (NLP)

Using the SpaCy dependency parser, the system breaks a policy into a tree structure. This is crucial for distinguishing between the Action (the main verb, like "collect") and the Predicate (verbs in subordinate clauses that define the "when" or "how").

2. Semantic Mapping (Ontologies)

A key innovation is the use of OWL Ontologies. The system maps extracted words (like "user" or "content") to specific classes (Subject, Object) and relationships (hasRole, hasCategory). This allows the tool to handle synonyms and resolve ambiguity—for instance, mapping "we" to "social networking service provider."

3. Translation to CNL4DSA

The final output is a formal fragment in CNL4DSA. The syntax follows a logical structure: IF [Context] THEN [Modality] [Fragment]

Where:

• Context: Conditions (e.g., subject hasRole user).
• Modality: CAN (Authorization), CANNOT (Prohibition), or MUST (Obligation).
• Fragment: The core tuple of 〈subject, action, object〉.

Case Study: Facebook Data Policies

The authors tested NLPT on three types of Facebook policies:

1. Authorization (P1): Collecting user content.
2. Prohibition (P2): Preventing others from seeing accounts of deactivated users.
3. Obligation (P3): The requirement to notify users of policy changes.

The results showed that by leveraging a Unigram Tagger trained on privacy terminology, the system correctly identified subjects and objects, leading to high-quality translations that are ready for secondary mapping into low-level enforcement languages like UPOL.

Critical Insight & Future Outlook

While the current prototype requires some manual intervention (like defining a training dictionary for the tagger and handling coreferences), it marks a significant step toward automated privacy compliance.

The transition from "Passive Transparency" (users reading policies) to "Active Enforcement" (systems blocking illegal data usage) necessitates this kind of formalization. As future work, the integration of Large Language Models (LLMs) could potentially automate the "manual dictionary" phase of this pipeline, making the system even more robust across different OSN platforms.

Conclusion

NLPT provides a middle ground: it preserves the natural language that humans need for trust while generating the formal logic that machines need for security. By turning "Legalese" into "Code," we move closer to a web where privacy policies are not just promises, but mathematical guarantees.