Semantic Parsing of Data Practice Statements in Privacy Policies Using BERT Models

Privacy policies delineate how web or mobile applications manage user data and are pivotal in deriving privacy requirements and ensuring compliance during software development. The extensive and complex nature of privacy policy documents renders the analysis of data practice statements by stakeholders, e.g., developers and regulators, both time-consuming and cost-ineffective. In this study, we introduce an automated method to extract semantic information from data practice statements using text classification and semantic role labeling techniques. Our approach begins by identifying data practice statements within privacy policies using a domain-specific BERT-based text classification model. Subsequently, a cross-lingual BERT-based sequence labeling model extracts the semantic role instances within these statements. We empirically evaluate our approach using two benchmark privacy policy datasets across various website and mobile application domains. For data practice classification, our domain-specific BERT-based model surpasses recent state-of-the-art (SOTA) methods in all three important data practice categories. For semantic role instances extraction, our cross-lingual BERT-based model achieves an \(F_1\) -score of 92% in a few-shot setting and an \(F_1\) -score of 82% in a zero-shot setting, significantly outperforming a rule-based method that achieves an F1-score of 40%.