Elamur Research⌕
☰
home / papers / 2019 / Question Answering for Privacy Policies: Combining Computational and Legal Perspectives

Question Answering for Privacy Policies: Combining Computational and Legal Perspectives

Paper · 2019 · Abhilasha Ravichander, Alan W Black, Shomir Wilson et al.

Summary

Privacy policies legally govern how apps handle personal data, but almost nobody reads them. This paper addresses that gap by framing policy comprehension as a question answering task. The authors build PrivacyQA, a corpus containing 1750 questions that ask about what 35 mobile apps state in their privacy policies, along with over 3500 answer annotations made by people with legal training. To avoid questions that simply echo policy wording, crowdworkers never saw the policy text. They saw only the app's public Play Store page and imagined asking a trusted privacy assistant. Experts then marked which policy sentences serve as evidence for each answer, or judged that no answer exists. A strong neural baseline reaches only 39.8 F1, about 0.3 F1 below human performance, so the task has plenty of headroom. The paper also analyses why questions go unanswered and proposes a set of unanswerability factors. A comparison with Natural Questions suggests these issues apply to any QA system that serves real users.

Key points

  • Policy selection:
    • PrivacyQA covers English policies from 35 Google Play apps in many categories, collected before April 1, 2018, so before most GDPR-driven revisions.
    • Each category includes apps on both sides of a 5-million-install threshold.
  • Question collection:
    • Questions came from US-based Amazon Mechanical Turk "master" workers, each writing five questions per app for $2 per assignment.
    • The questions are diverse: about 49.94 unique questions per policy, 35 distinct first words, and an average length of 8.4 words.
  • Document and evidence size: Policies average roughly 3000 words, while the evidence behind an answer is typically around 100 words.
  • Annotation:
    • Questions are labelled with the nine OPP-115 categories, such as First Party Collection/Use, Data Retention and Data Security.
    • Every test-set question received answers from at least two additional experts.
  • Unanswerable questions: Of the 573 unanswerable questions, 4.18% were incomprehensible. Among relevant, well-formed questions, 95.7% concerned topics a policy could reasonably cover but this particular policy omitted.

Interesting ideas

  • I1. Hide the source document from question writers. Askers wrote questions without seeing the text, which yields genuine information needs and less lexical overlap. This kind of design makes a QA benchmark harder to game and more realistic for any domain.
  • I2. Treat unanswerability as several distinct types. The paper separates incomprehensible, out-of-scope, ill-formed, silent and atypical questions instead of using one "no answer" label. A deployed assistant could then respond differently to each, for example by asking for clarification or flagging a gap in the policy.
  • I3. Use "silence" as a signal about the document. A question that other policies answer but this one does not reveals an omission in the document. Comparing documents this way could help audit coverage in contracts, terms of service or regulations.
  • I4. Check a taxonomy against an outside dataset. The authors applied their unanswerability analysis to a sample of Natural Questions. Testing a domain-specific error taxonomy on a general dataset is a cheap way to see whether it generalises.
  • I5. Sample sources by popularity on both sides of a threshold. Including both widely installed and niche apps captures both polished and sloppy documents. This is a useful sampling strategy whenever document quality varies with the size of the publisher.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Carnegie Mellon UniversityPittsburgh · United States365 works · 158,048 citations🎓Pennsylvania State UniversityState College · United States22 works · 4,878 citations🎓Fordham UniversityNew York · United States3 works · 737 citations

📚 Shelves 6 Computer Science · 9,086 works Artificial Intelligence · 8,889 works Arts and Humanities · 9,296 works Language and Linguistics · 9,206 works Social Sciences · 744 works Political Science and International Relations · 72 works

🧭 Topics 2 Question answering · 242 works Legal AI · 55 works

Cite

Cite as Abhilasha Ravichander, Alan W Black, Shomir Wilson, Thomas Norton and Norman Sadeh. 2019. Question Answering for Privacy Policies: Combining Computational and Legal Perspectives. Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/d19-1500

@inproceedings{ravichander2019question,
  title = {{Question Answering for Privacy Policies: Combining Computational and Legal Perspectives}},
  author = {Abhilasha Ravichander, Alan W Black, Shomir Wilson, Thomas Norton and Norman Sadeh},
  booktitle = {Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)},
  year = {2019},
  doi = {10.18653/v1/d19-1500},
  url = {https://doi.org/10.18653/v1/d19-1500}
}

References

55 references, 17 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Carole Cadwalladr and Emma Graham-Harrison. 2018. Revealed: 50 million facebook profiles harvested for cambridge analytica in major data breach. The Guardian, 17. find
  2. Fred H Cate. 2010. The limits of notice and choice. IEEE Security & Privacy, 8(2). ↗
  3. Eunsol Choi, He He, Mohit Iyyer, Mark Yatskar, Wen-tau Yih, Yejin Choi, Percy Liang, and Luke Zettlemoyer. 2018. QuAC: Question answering in context. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pages 2174–2184, Brussels, Belgium. Association for Computational Linguistics. ↗ our card
  4. Lorrie Faith Cranor. 2003. P3p: Making privacy policies more useful. IEEE Security & Privacy, 99(6):50–55. ↗
  5. Lorrie Faith Cranor. 2012. Necessary but not sufficient: Standardized mechanisms for privacy notice and choice. J. on Telecomm. & High Tech. L., 10:273. find
  6. SS Deeb. 2005. The molecular basis of variation in human color vision. Clinical genetics, 67(5):369– 377. ↗
  7. Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), pages 4171–4186, Minneapolis, Minnesota. Association for Computational Linguistics. ↗ our card
  8. Phong-Khac Do, Huy-Tien Nguyen, Chien-Xuan Tran, Minh-Tien Nguyen, and Minh-Le Nguyen. 2017. Legal question answering using ranking svm and deep convolutional neural network. arXiv preprint arXiv:1703.05320. ↗
  9. Federal Trade Commission. 1998. Privacy online: A report to congress. Washington, DC, June, pages 10–11. find
  10. Minwei Feng, Bing Xiang, Michael R Glass, Lidan Wang, and Bowen Zhou. 2015. Applying deep learning to answer selection: A study and an open task. 2015 IEEE Workshop on Automatic Speech Recognition and Understanding (ASRU). find
  11. Anette Frank, Hans-Ulrich Krieger, Feiyu Xu, Hans Uszkoreit, Berthold Crysmann, Brigitte Jörg, and Ulrich Schäfer. 2007. Question answering from structured knowledge sources. Journal of Applied Logic, 5(1):20–48. ↗
  12. Matthias Gallé, Athena Christofi, and Hady Elsahar. 2019. The case for a gdpr-specific annotated dataset of privacy policies. AAAI Symposium on Privacy-Enhancing AI and HLT Technologies. find
  13. Joshua Gluck, Florian Schaub, Amy Friedman, Hana Habib, Norman Sadeh, Lorrie Faith Cranor, and Yuvraj Agarwal. 2016. How short is too short? implications of length and framing on the effectiveness of privacy notices. In 12th Symposium on Usable Privacy and Security (SOUPS), pages 321–340. find
  14. Suchin Gururangan, Swabha Swayamdipta, Omer Levy, Roy Schwartz, Samuel Bowman, and Noah A. Smith. 2018. Annotation artifacts in natural language inference data. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 2 (Short Papers), pages 107–112, New Orleans, Louisiana. Association for Computational Linguistics. ↗
  15. Hamza Harkous, Kassem Fawaz, Rémi Lebret, Florian Schaub, Kang G Shin, and Karl Aberer. 2018. Poli-sis: Automated analysis and presentation of privacy policies using deep learning. arXiv preprint arXiv:1802.02561. ↗
  16. Karl Moritz Hermann, Tomas Kocisky, Edward Grefenstette, Lasse Espeholt, Will Kay, Mustafa Suleyman, and Phil Blunsom. 2015. Teaching machines to read and comprehend. In Advances in Neural Information Processing Systems, pages 1693–1701. ↗ our card
  17. Priyank Jain, Manasi Gyanchandani, and Nilay Khare. 2016. Big data privacy: a technological perspective and review. Journal of Big Data, 3(1):25. ↗
  18. Mandar Joshi, Eunsol Choi, Daniel Weld, and Luke Zettlemoyer. 2017. TriviaQA: A large scale distantly supervised challenge dataset for reading comprehension. In Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1601– 1611, Vancouver, Canada. Association for Computational Linguistics. ↗ our card
  19. Divyansh Kaushik and Zachary C. Lipton. 2018. How much reading does reading comprehension require? a critical investigation of popular benchmarks. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pages 5010–5015, Brussels, Belgium. Association for Computational Linguistics. our card
  20. Patrick Gage Kelley, Joanna Bresee, Lorrie Faith Cranor, and Robert W Reeder. 2009. A nutrition label for privacy. In Proceedings of the 5th Symposium on Usable Privacy and Security, page 4. ACM. find
  21. Mi-Young Kim, Ying Xu, and Randy Goebel. 2015. Applying a convolutional neural network to legal question answering. In JSAI International Symposium on Artificial Intelligence, pages 282–294. Springer. find
  22. Tomáš Kočiskỳ, Jonathan Schwarz, Phil Blunsom, Chris Dyer, Karl Moritz Hermann, Gáabor Melis, and Edward Grefenstette. 2018. The narrativeqa reading comprehension challenge. Transactions of the Association of Computational Linguistics, 6:317–328. ↗ our card
  23. Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, Kristina Toutanova, Llion Jones, Matthew Kelcey, Ming-Wei Chang, Andrew M. Dai, Jakob Uszkoreit, Quoc Le, and Slav Petrov. 2019. Natural questions: A benchmark for question answering research. Transactions of the Association for Computational Linguistics, 7:453–466. ↗ our card
  24. Pedro Giovanni Leon, Ashwini Rao, Florian Schaub, Abigail Marsh, Lorrie Faith Cranor, and Norman Sadeh. 2015. Privacy and behavioral advertising: Towards meeting users’ preferences. In Symposium on usable privacy and security (SOUPS). find
  25. Frederick Liu, Shomir Wilson, Florian Schaub, and Norman Sadeh. 2016. Analyzing vocabulary intersections of expert annotations and topic models for data practices in privacy policies. In 2016 AAAI Fall Symposium Series. find
  26. Yi-Hung Liu, Yen-Liang Chen, and Wu-Liang Ho. 2015. Predicting associated statutes for legal problems. Information Processing & Management, 51(1):194–211. ↗
  27. Aleecia M McDonald and Lorrie Faith Cranor. 2008. The cost of reading privacy policies. ISJLP, 4:543. find
  28. Anca Micheti, Jacquelyn Burkell, and Valerie Steeves. 2010. Fixing broken doors: Strategies for drafting privacy policies young people can understand. Bulletin of Science, Technology & Society, 30(2):130–143. ↗
  29. Diego Mollá and José Luis Vicedo. 2007. Question answering in restricted domains: An overview. Computational Linguistics, 33(1):41–61. ↗
  30. Alfredo Monroy, Hiram Calvo, and Alexander Gelbukh. 2009. Nlp for shallow question answering of legal documents using graphs. Computational Linguistics and Intelligent Text Processing, pages 498–508. find
  31. Kanthashree Mysore Sathyendra, Shomir Wilson, Florian Schaub, Sebastian Zimmeck, and Norman Sadeh. 2017. Identifying the provision of choices in privacy policy text. In Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing, pages 2774–2779, Copenhagen, Denmark. Association for Computational Linguistics. find
  32. Aakanksha Naik, Abhilasha Ravichander, Norman Sadeh, Carolyn Rose, and Graham Neubig. 2018. Stress test evaluation for natural language inference. In Proceedings of the 27th International Conference on Computational Linguistics, pages 2340– 2353, Santa Fe, New Mexico, USA. Association for Computational Linguistics. ↗
  33. Tri Nguyen, Mir Rosenberg, Xia Song, Jianfeng Gao, Saurabh Tiwary, Rangan Majumder, and Li Deng. 2016. Ms marco: A human generated machine reading comprehension dataset. arXiv preprint arXiv:1611.09268. ↗ our card
  34. OCDE OECD. 2004. The oecd principles of corporate governance. Contaduría y Administración, (216). ↗
  35. Alessandro Oltramari, Dhivya Piraviperumal, Florian Schaub, Shomir Wilson, Sushain Cherivirala, Thomas B Norton, N Cameron Russell, Peter Story, Joel Reidenberg, and Norman Sadeh. 2017. Privonto: A semantic framework for the analysis of privacy policies. Semantic Web, (Preprint):1–19. ↗
  36. Takeshi Onishi, Hai Wang, Mohit Bansal, Kevin Gimpel, and David McAllester. 2016. Who did what: A large-scale person-centered cloze dataset. In Proceedings of the 2016 Conference on Empirical Methods in Natural Language Processing, pages 2230– 2235, Austin, Texas. Association for Computational Linguistics. ↗ our card
  37. P Howard Patrick. 1980. Privacy restrictions on transnational data flows: A comparison of the council of europe draft convention and oecd guidelines. Jurimetrics J., 21:405. find
  38. Jeffrey Pennington, Richard Socher, and Christopher D Manning. 2014. Glove: Global vectors for word representation. In EMNLP, volume 14, pages 1532–1543. our card
  39. Adam Poliak, Jason Naradowsky, Aparajita Haldar, Rachel Rudinger, and Benjamin Van Durme. 2018. Hypothesis only baselines in natural language inference. In Proceedings of the Seventh Joint Conference on Lexical and Computational Semantics, pages 180–191, New Orleans, Louisiana. Association for Computational Linguistics. ↗
  40. Paulo Quaresma and Irene Pimenta Rodrigues. 2005. A question answer system for legal information retrieval. In JURIX, pages 91–100. find
  41. Pranav Rajpurkar, Robin Jia, and Percy Liang. 2018. Know what you don’t know: Unanswerable questions for SQuAD. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pages 784– 789, Melbourne, Australia. Association for Computational Linguistics. ↗ our card
  42. Pranav Rajpurkar, Jian Zhang, Konstantin Lopyrev, and Percy Liang. 2016. SQuAD: 100,000+ questions for machine comprehension of text. In Proceedings of the 2016 Conference on Empirical Methods in Natural Language Processing, pages 2383–2392, Austin, Texas. Association for Computational Linguistics. ↗ our card
  43. Joel R Reidenberg, Travis Breaux, Lorrie Faith Cranor, Brian French, Amanda Grannis, James T Graves, Fei Liu, Aleecia McDonald, Thomas B Norton, and Rohan Ramanath. 2015. Disagreeable privacy policies: Mismatches between meaning and users’ understanding. Berkeley Tech. LJ, 30:39. find
  44. Matthew Richardson, Christopher JC Burges, and Erin Renshaw. 2013. Mctest: A challenge dataset for the open-domain machine comprehension of text. In Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, pages 193–203. our card
  45. Florian Schaub, Rebecca Balebako, Adam L Durity, and Lorrie Faith Cranor. 2015. A design space for effective privacy notices. In Eleventh Symposium On Usable Privacy and Security (SOUPS 2015), pages 1–17. find
  46. Peter Story, Sebastian Zimmeck, and Norman Sadeh. 2018. Which apps have privacy policies? In Annual Privacy Forum, pages 3–23. Springer. find
  47. Ming Tan, Cicero dos Santos, Bing Xiang, and Bowen Zhou. 2016. Improved representation learning for question answer matching. In Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 464–473, Berlin, Germany. Association for Computational Linguistics. find
  48. Adam Trischler, Tong Wang, Xingdi Yuan, Justin Harris, Alessandro Sordoni, Philip Bachman, and Kaheer Suleman. 2017. NewsQA: A machine comprehension dataset. In Proceedings of the 2nd Workshop on Representation Learning for NLP, pages 191–200, Vancouver, Canada. Association for Computational Linguistics. ↗ our card
  49. FTC US Federal Trade Commission et al. 2012. Protecting consumer privacy in an era of rapid change: Recommendations for businesses and policymakers. FTC Report. find
  50. Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. In Advances in Neural Information Processing Systems, pages 5998–6008. our card
  51. Paul Voigt and Axel Von dem Bussche. 2017. The eu general data protection regulation (gdpr). A Practical Guide, 1st Ed., Cham: Springer International Publishing. find
  52. Dirk Weissenborn, Georg Wiese, and Laura Seiffe. 2017. Making neural QA as simple as possible but not simpler. In Proceedings of the 21st Conference on Computational Natural Language Learning (CoNLL 2017), pages 271–280, Vancouver, Canada. Association for Computational Linguistics. ↗
  53. S. Wilson, F. Schaub, F. Liu, K.M. Sathyendra, S. Zimmeck, R. Ramanath, F. Liu, N. Sadeh, and N.A. Smith. 2017. Analyzing privacy policies at scale: From crowdsourcing to automated annotations. ACM Transactions on the Web. ↗
  54. Shomir Wilson, Florian Schaub, Aswarth Abhilash Dara, Frederick Liu, Sushain Cherivirala, Pedro Giovanni Leon, Mads Schaarup Andersen, Sebastian Zimmeck, Kanthashree Mysore Sathyendra, N Cameron Russell, et al. 2016. The creation and analysis of a website privacy policy corpus. In Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), volume 1, pages 1330–1340. our card
  55. Yi Yang, Wen-tau Yih, and Christopher Meek. 2015. Wikiqa: A challenge dataset for open-domain question answering. In Proceedings of the 2015 Conference on Empirical Methods in Natural Language Processing, pages 2013–2018. our card

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/ravichander-2019-question-answering-privacy-policies-combining/