PrivDev: Mapping Static-Analysis Data Types to DPV
PrivDev maps 122 Bearer CLI static-analysis data types to DPV personal-data categories and GDPR provisions via deterministic matching plus an LLM.
PrivDev connects static-analysis scanner findings to the Data Privacy Vocabulary (DPV-PD) and potentially relevant GDPR provisions by mapping 122 Bearer CLI data types. It combines deterministic mapping for 43 exact-label matches with a retrieval-grounded LLM resolving the remaining 79 non-trivial mappings. The resulting RDF knowledge graph contains 118 ODRL policy resources validated with SHACL, and human evaluation by nine annotators produced 711 judgments with Gwet's AC2 of 0.88. The work also reveals ambiguities in scanner-defined data-type labels and coverage gaps in DPV-PD.
- 43 deterministic exact-label mappings plus 79 LLM-resolved mappings to DPV-PD
- RDF knowledge graph holds 118 SHACL-validated ODRL policy resources
- Nine annotators produced 711 judgments; Gwet's AC2 reached 0.88
- Highlights scanner label ambiguities and DPV-PD coverage gaps
- Organizations
- PrivDevBearer CLI
From the original article
1 min read at arxiv.orgStatic-analysis scanners can identify personal-data types in source code, but they lack mechanisms to connect these findings to standardized privacy vocabularies. PrivDev maps 122 Bearer CLI data types to Data Privacy Vocabulary Personal Data (DPV-PD) categories and links them to potentially relevant GDPR provisions.
By Simon Bernbeck · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.