Enhancing AI System Privacy: An Automatic Tool for Achieving GDPR Compliance in NoSQL Databases
Source abstract
Abstract
The EU’s Artificial Intelligence Act (AI Act) imposes requirements for the privacy compliance of AI systems. AI systems must comply with privacy laws such as the GDPR when providing services. These laws provide users with the right to issue a Data Subject Access Request (DSAR). Responding to such requests requires database administrators to identify information related to an individual accurately. However, manual compliance poses significant challenges and is error-prone. Database administrators need to write queries through time-consuming labor. The demand for large amounts of data by AI systems has driven the development of NoSQL databases. Due to the flexible schema of NoSQL databases, identifying personal information becomes even more challenging. This paper develops an automated tool to identify personal information that can help organizations respond to DSAR. Our tool employs a combination of various technologies, including schema extraction of NoSQL databases and relationship identification from query logs. We describe the algorithm used by our tool, detailing how it discovers and extracts implicit relationships from NoSQL databases and generates relationship graphs to help developers accurately identify personal data. We evaluate our tool on three datasets, covering different database designs, achieving an F1 score of 0.77 to 1. Experimental results demonstrate that our tool successfully identifies information relevant to the data subject. Our tool reduces manual effort and simplifies GDPR compliance, showing practical application value in enhancing the privacy performance of NOSQL databases and AI systems.
Source: openalex_inverted_index · Quality: baseline
Research context
OpenAlex topics: Privacy-Preserving Technologies in Data · Ethics and Social Impacts of AI · Blockchain Technology Applications and Security
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
References (36)
Show source-provided references
1. Proposal for a Regulation of the European Parliament and of the Council Laying Down Harmonized Rules on Artificial Intelligence (Artificial Intelligence Act), COM/2021/206 Final · 2021
2. General Data Protection Regulation (GDPR), Regulation (EU) 2016/679 · 2016
3. Retrofitting GDPR compliance onto legacy databases10.14778/3503585.3503603 ↗
4. “MongoDB documents,” Accessed: May 18, 2024. [Online]. Available: https://www.mongodb.com/docs/manual/
5. The Digital Personal Data Protection Act · 2023
6. Thailand Personal Data Protection Act 2019, B.E. 2562 · 2019
7. Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais), Law No. 13,709/2018 · 2018
8. California Consumer Privacy Act of 2018 (Assembly Bill No. 375), AB-375 · 2018
9. “Administrative fee against spotify,” Accessed: May 18, 2024. [Online]. Available: https://www.imy.se/en/news/administrative-fee-against-spotify/
10. Schwarzkopf · Heterogeneous Data Management, Polystores, and Analytics for Healthcare · 2019 · 5 · 3910.1007/978-3-030-33752-0_3 ↗
11. Kraska · Heterogeneous Data Management, Polystores, and Analytics for Healthcare · 2019 · 5 · 2410.1007/978-3-030-33752-0_2 ↗
12. K. D. Albab et al., “K9db: Privacy-compliant storage for web applications by construction,” presented at the 17th USENIX Symp. Oper. Syst. Des. Implement. (OSDI 23), Boston, MA, USA, 2023, pp. 99–116.
13. A. Shah, V. Banakar, S. Shastri, M. Wasserman, and V. Chidambaram, “Analyzing the impact of GDPR on storage systems,” presented at the 11th USENIX Workshop Hot Topics Storage and File Syst. (HotStorage 19), Renton, WA, USA, 2019, pp. 4.
14. Understanding and benchmarking the impact of GDPR on database systems10.14778/3384345.3384354 ↗
15. Software-defined data protection: Low overhead policy compliance at the storage layer is within reach!10.14778/3450980.3450986 ↗
16. M. Degeling, C. Utz, C. Lentzsch, H. Hosseini, F. Schaub and T. Holz, “We value your privacy ... now take some cookies: Measuring the GDPR’s impact on web privacy,” presented at the 2019 Network Distrib. Syst. Secur. Symp. (NDSS), San Diego, CA, USA, Feb. 2019, pp. 24–27.10.14722/ndss.2019.23378 ↗
17. “GDPR compliance & cookie consent,” Accessed: May 18, 2024. [Online]. Available: https://wordpress.org/plugins/gdpr-compliance-cookie-consent/
18. “The GDPR framework by data443,” Accessed: May 18, 2024. [Online]. Available: https://wordpress.org/plugins/gdpr-framework/
19. “WP GDPR compliance,” Accessed: May 18, 2024. [Online]. Available: https://wordpress.org/plugins/wp-gdpr-compliance/
20. C. Luckett, A. Crotty, A. Galakatos, and U. Cetintemel, “Odlaw: A tool for retroactive GDPR compliance,” present at the 2021 IEEE 37th Int. Conf. Data Eng. (ICDE), Chania, Greece, 2021, pp. 2709–2712.10.1109/ICDE51399.2021.00310 ↗
21. W. Hariri, “Unlocking the potential of ChatGPT: A comprehensive exploration of its applications, advantages, limitations, and future directions in natural language processing,” arXiv preprint arXiv:2304.02017, 2023.
22. Do ChatGPT and other AI Chatbots pose a cybersecurity risk?: An exploratory study
23. Privacy and data protection in ChatGPT and other AI chatbots: Strategies for securing user information
24. P. Gómez, R. Casallas, and C. Roncancio, “Data schema does matter, even in NoSQL systems!,” presented at the 2016 IEEE Tenth Int. Conf. Res. Chall. Inf. Sci. (RCIS), Grenoble, France, 2016, pp. 1–6.10.1109/RCIS.2016.7549340 ↗
25. M. J. Mior and K. Salem, “Renormalization of NoSQL database schemas,” presented at the Concept. Model.: 37th Int. Conf. ER 2018, Xi'an, China, Springer, Oct. 22–25, 2018, pp. 479–487.10.1007/978-3-030-00847-5_34 ↗
26. M. J. Mior, “Fast discovery of nested dependencies on JSON data,” arXiv preprint arXiv:2111.10398, 2021.
27. Discovering interesting inclusion dependencies: Application to logical database tuning10.1016/S0306-4379(01)00027-8 ↗
28. D. Sevilla Ruiz, S. F. Morales, and J. García Molina, “Inferring versioned schemas from NoSQL databases and its applications,” presented at the Concept. Model.: 34th Int. Conf. ER 2015, Stockholm, Sweden, Springer, Oct. 19–22, 2015, pp. 467–480.10.1007/978-3-319-25264-3_35 ↗
29. Parametric schema inference for massive JSON datasets10.1007/s00778-018-0532-7 ↗
30. J. Bauckmann, U. Leser, F. Naumann, and V. Tietz, “Efficiently detecting inclusion dependencies,” presented at the 2007 IEEE 23rd Int. Conf. Data Eng., Istanbul, Turkey, 2007, pp. 1448–1450.10.1109/ICDE.2007.369032 ↗
31. Functional dependency discovery: An experimental evaluation of seven algorithms10.14778/2794367.2794377 ↗
32. Divide & conquer-based inclusion dependency discovery10.14778/2752939.2752946 ↗
33. A machine learning approach to foreign key discovery
34. On multi-column foreign key discovery10.14778/1920841.1920944 ↗
35. “MongoDB atlas,” Accessed: May 18, 2024. [Online]. Available: https://www.mongodb.com/docs/atlas/sample-data/
36. “Studio 3T,” Accessed: May 18, 2024. [Online]. Available: https://studio3t.com/