Enhancing Machine Comprehension of GDPR Privacy Policies Using Recent Advancements in NLP: Leveraging Question Answering, Transformers and Deep Learning in Post-GDPR Regulatory Landscape

Abstract

GDPR has shifted the privacy policy regulatory landscape providing EU citizens more control over their data. Yet, it has also resulted in lengthier, more vague and legally sophisticated policies, making them rather incomprehensible by a general audience. That is contradicting the GDPR requirement to pertain transparent and easily understandable privacy policies, questioning their legitimacy under the “notice and choice” principle, when users consent to provide their data without full awareness of privacy practices employed by the organisations. On the other hand, the increased details and structure of privacy policies under GDPR can arguably make them more comprehensible by machines. To address the unrealistic expectation of reading large volumes of privacy policies and equip the stakeholders with a tool to comprehend policies at scale, the thesis is taking a Transformer-based approach to instantiate machine comprehension of GDPR privacy policies. A scalable GDPR QA system has been introduced which can enable the users to selectively explore relevant privacy issues and answer their inquires in a modern regulatory post-GDPR landscape with an average F1 of ⇠71%. Moreover, the first GDPRQA SQuAD-formatted dataset has been introduced. Transfer learning and data augmentation has been utilized to learn the nuances of the GDPR privacy domain lexicon. The thesis also improved the current state-of-the-art of pre-GDPR PolicyQA model by 7.6%. A production environment prototype with accompanying ElasticSearch information retrieval architecture was implemented and evaluated. Furthermore, the thesis has suggested potential business deployment scenario use cases for a GDPRQA Assistant. Such a user-friendly complimentary solution could be deployed internally to assist organisations with GDPR compliance or externally as a personal data management tool.