Compliance with the GDPR privacy regulation places a significant burden on organisations regarding the handling of personal data. The perceived efforts and risks of complying with the GDPR further increase when data processing activities span across organisational boundaries, as is the case in both small-scale data sharing settings and in large-scale international data spaces. This paper addresses these concerns by proposing a case-generic method for automated normative reasoning that establishes legal arguments for the lawfulness of data processing activities. The arguments are established on the basis of case-specific legal qualifications made by privacy experts, bringing the human in the loop. The obtained expert system promotes transparency and accountability, remains adaptable to extended or altered interpretations of the GDPR, and integrates into novel or existing distributed data processing systems. This result is achieved by defining a formal ontology and semantics for automated normative reasoning based on an analysis of the purpose-limitation principle of the GDPR. The ontology and semantics are implemented in eFLINT, a domain-specific language for specifying and reasoning with norms. The XACML architecture standard, applicable to both access and usage control, is extended, demonstrating how GDPR-based normative reasoning can integrate into (existing, distributed) systems for data processing. The resulting system is designed and critically assessed in reference to requirements extracted from the GPDR.

本研究解决了组织在处理个人数据时遵守GDPR的法律合规性问题，尤其是在跨组织的数据处理活动中。本文提出了一种案例通用的方法，通过自动化规范推理建立数据处理活动合法性的法律论据，并引入隐私专家的专业资格。研究结果表明，该系统确保透明度和问责制，并能够适应GDPR的扩展或改变的解释，从而对数据处理系统产生积极的影响。

基于GDPR的访问和使用控制的合法且可问责的个人数据处理在分布式系统中的应用