Specifying privacy policies with P3P and EPAL: lessons learned

As computing becomes more ubiquitous and Internet use continues to rise, it is increasingly important for organizations to construct accurate and effective privacy policies that document their information handling and usage practices. Most privacy policies are derived and specified in a somewhat ad-hoc manner, leading to policies that are of limited use to the consumers they are intended to serve. To make privacy policies more readable and enforceable, two privacy policy specification languages have emerged, P3P and EPAL. This paper discusses the effectiveness of these languages within the context of a case study that entailed the expression of common online privacy statements for a healthcare website, employing requirements engineering quality factors as a framework for our discussion. 

• Type: Conference
• Year: 2004
• Where: WPES
• Authors: William H. Stufflebeam, Annie I. Antón, Qingfeng He, Neha Jain
• Keywords: Effective Privacy Policies, Most Privacy Policies, Privacy Policies, WPES 2004