PPCA: Privacy Policy Compliance Analysis for Personal Information Protection Law

PIPL (Personal Information Protection Law of the People’s Republic of China), as the legal provision for the protection of personal information in China, puts forward clear requirements for personal information controllers in the collection, storage, use, sharing, transfer, public disclosure and other information processing processes, and some of them need to be stated in the privacy policies of the services provided by personal information controllers. In order to provide a more concise interpretation of the PIPL and provide a basis for PIPL-compliance analysis of privacy policies, we built a PIPL taxonomy, covering concepts need to be declared in the privacy policy that related to PIPL. Based on this taxonomy, we collected and constructed a small privacy policy dataset and trained machine learning models for automated compliance detection. The taxonomy and classifier are applied in a small-sample analysis by means of manual annotation, providing a reference for the subsequent PIPL-oriented analysis of privacy policies. We also learn some new findings of PIPL’s influence on personal information controllers.