Specification of Fair Data Practice Principles Using Privacy Policy Languages

During the last decades, multiple initiatives have formulated various fair data practice principles. Today, privacy policies are used to define how personal data can be created, disclosed, stored, used, shared, and destroyed by entities other than the data subject. However, there was a lack of comprehensive framework to reason about the fundamentals of privacy policy-based private data protection schemes. This paper presents a comprehensive yet generic set of fair data practice requirements. Next, the requirements are used as a consistent framework to reason about the capabilities, limitations and challenges of privacy policy-based private data protection in general and privacy policy languages in particular. More specifically, the paper discusses which fair data practice principles can be expressed by P3P.