Modern software has been an integral part of everyday activities in many
disciplines and application contexts. Introducing intelligent automation by
leveraging artificial intelligence (AI) led to break-throughs in many fields.
The effectiveness of AI can be attributed to several factors, among which is
the increasing availability of data. Regulations such as the general data
protection regulation (GDPR) in the European Union (EU) are introduced to
ensure the protection of personal data. Software systems that collect, process,
or share personal data are subject to compliance with such regulations.
Developing compliant software depends heavily on addressing legal requirements
stipulated in applicable regulations, a central activity in the requirements
engineering (RE) phase of the software development process. RE is concerned
with specifying and maintaining requirements of a system-to-be, including legal
requirements. Legal agreements which describe the policies organizations
implement for processing personal data can provide an additional source to
regulations for eliciting legal requirements. In this chapter, we explore a
variety of methods for analyzing legal requirements and exemplify them on GDPR.
Specifically, we describe possible alternatives for creating machine-analyzable
representations from regulations, survey the existing automated means for
enabling compliance verification against regulations, and further reflect on
the current challenges of legal requirements analysis.

现代软件是许多学科和应用环境中日常活动的重要组成部分。通过利用人工智能引入智能自动化在许多领域取得了突破。人工智能的有效性可以归因于诸多因素，其中之一是数据的不断增加。监管框架（如欧洲联盟的常规数据保护条例）出台以确保个人数据的保护。收集、处理或共享个人数据的软件系统必须符合这些法规。开发符合要求的软件在很大程度上取决于满足适用法规中规定的法律要求，这是软件开发流程中需求工程（RE）阶段的核心活动。RE 主要涉及对系统需求（包括法律要求）进行规定和维护。描述组织为处理个人数据而实施的政策的法律协议可以作为除法规外获取法律要求的另一信息来源。在本章中，我们探讨了分析法律要求的各种方法，并以 GDPR 为例进行了说明。具体来说，我们描述了从法规中创建机器可分析表示的可能替代方法，调查了现有的自动化手段以便对法规进行合规验证，并进一步反思了法律要求分析的当前挑战。

法律要求分析

Legal Requirements Analysis

Specifying legal requirements for software systems to ensure their compliance
with the applicable regulations is a major concern to requirements engineering
(RE). Personal data which is collected by an organization is often shared with
other organizations to perform certain processing activities. In such cases,
the General Data Protection Regulation (GDPR) requires issuing a data
processing agreement (DPA) which regulates the processing and further ensures
that personal data remains protected. Violating GDPR can lead to huge fines
reaching to billions of Euros. Software systems involving personal data
processing must adhere to the legal obligations stipulated in GDPR and outlined
in DPAs. Requirements engineers can elicit from DPAs legal requirements for
regulating the data processing activities in software systems. Checking the
completeness of a DPA according to the GDPR provisions is therefore an
essential prerequisite to ensure that the elicited requirements are complete.
Analyzing DPAs entirely manually is time consuming and requires adequate legal
expertise. In this paper, we propose an automation strategy to address the
completeness checking of DPAs against GDPR. Specifically, we pursue ten
alternative solutions which are enabled by different technologies, namely
traditional machine learning, deep learning, language modeling, and few-shot
learning. The goal of our work is to empirically examine how these different
technologies fare in the legal domain. We computed F2 score on a set of 30 real
DPAs. Our evaluation shows that best-performing solutions yield F2 score of
86.7% and 89.7% are based on pre-trained BERT and RoBERTa language models. Our
analysis further shows that other alternative solutions based on deep learning
(e.g., BiLSTM) and few-shot learning (e.g., SetFit) can achieve comparable
accuracy, yet are more efficient to develop.

在本论文中，我们提出了一种自动化策略，用于对一般数据保护条例（GDPR）下的数据处理协议（DPAs）进行完整性检查。我们使用了以预训练的 BERT 和 RoBERTa 语言模型为基础的十种替代解决方案，并通过对 30 个真实 DPAs 进行 F2 分数计算。结果显示，表现最佳的解决方案分别基于预训练的 BERT 和 RoBERTa 语言模型，其 F2 分数分别为 86.7% 和 89.7%。我们的分析进一步显示，其他基于深度学习（如 BiLSTM）和少样本学习（如 SetFit）的替代解决方案可以实现可比较的准确性，但开发效率更高。

关于 GDPR AI 启用的数据保护机构完整性检查的多解决方案研究

A Multi-solution Study on GDPR AI-enabled Completeness Checking of DPAs

Despite the presence of the classification task in many different benchmark
datasets for perception in the automotive domain, few efforts have been
undertaken to define consistent classification requirements. This work
addresses the topic by proposing a structured method to generate a
classification structure. First, legal categories are identified based on
behavioral requirements for the vehicle. This structure is further
substantiated by considering the two aspects of collision safety for objects as
well as perceptual categories. A classification hierarchy is obtained by
applying the method to an exemplary legal text. A comparison of the results
with benchmark dataset categories shows limited agreement. This indicates the
necessity for explicit consideration of legal requirements regarding
perception.

提出了一种结构化的方法来生成分类结构，通过考虑车辆的行为需求来确定合法类别，进而通过考虑对象的碰撞安全和感知类别的两个方面来进一步验证该结构。将该方法应用于一个示例性的法律文本，获取到了一个分类层次结构；将结果与基准数据集的类别进行比较，结果显示一致性有限。这表明有必要明确考虑感知方面的法律要求。