Using Case-based Reasoning for Privacy Decisions

Abstract

SINTEF ICT has developed a prototype Privacy Enhancing Technology calledPrivacy Advisor that uses Case-based Reasoning to give advice to users on ifthey should accept or reject the privacy policies of a service provider in a given context.The purpose of this PET is to learn the privacy preferences of a user and giveadvice according to the previous decisions the user has made. The goal of this thesis is to propose, implement and test new CBR logic forPrivacy Advisor so that the advice given to the user is more trustworthy. Thesegoals have been reached by studying the various technologies and methodologiesPrivacy Advisor is based on, as well as the current implementation of PrivacyAdvisor itself. The results of the thesis are three algorithms that improve uponthe existing CBR logic in Privacy Advisor to a certain degree, as well as afuzzy control system that uses fuzzy logic to determine the similarity between elements in a privacypolicy.The results from the thesis have shown that even though the approach of usingfuzzy logic for similarity calculations is reasonable, several design flaws inthe implementation of Privacy Advisor limits the amount of testing possible,and the degree the CBR logic can be improved. The results from testing the newimplementations did not reveal any definite proof that the new implementation isany better.