Interoperable Interpretation and Evaluation of ODRL Policies

Abstract

On the Web, consent banners (cookies) are the prevailing response to legislation such as GDPR for handling protected data. These banners are meant to inform users about how their personal data will be managed by services and third parties. Unfortunately, there is no room for negotiation over these privacy preferences; users either accept the terms to use the Web services or deny them and likely end up with limited or no access. For negotiation to arise, parties must share a common language that is able to describe rights, duties and constraints over digital assets. Given the technical, societal and legal requirements for dealing with privacy preferences, this language must be sufficiently expressive in order to guarantee accuracy. The Open Digital Rights Language (ODRL) standard meets such requirements. However, the lack of a formalism regarding enforcement hinders its adoption. To this end, we propose a systemic approach to interpret and evaluate ODRL Policies, facilitating the creation of interoperable policy engines for enforcing expressive policies. In this paper, we introduce i) the Compliance Report Model to denote the result of an ODRL evaluation in an interoperable manner, ii) test cases comprised of policies, context and the aforementioned model to ensure correctness of policy engines, iii) and the ODRL Evaluator, an implementation that systematically evaluates ODRL policies. We show the expressiveness of our model and the effectiveness of our implementation through an evaluation of the test suite. Addressing the lack of formalisation of ODRL paves the road for negotiation over privacy preferences and establishes the foundations for interoperable policy exchange and evaluations over the Web. Future work includes the further formalisation of the context of policy evaluation and the need for inter-policy strategies for conflict resolution.