Wirtschaftsuniversität Wien Magisterarbeit - SemanticLab

Element Value
ruling allow
user category sales department
action store
data category customer-record
purpose order-processing
condition the customer is older than 13 years of age
obligation delete the data 3 years from now
Table 3.4.: An example EPAL privacy rule (Source: [IBM03])
Element Value
user category sales department
action store
data category customer-record
purpose order-processing
Table 3.5.: An example EPAL request (Source: [IBM03])
would be translated into the formal EPAL privacy rule as shown in Table 3.4. Such
rules are used to determine whether a request is allowed or not. Not surprisingly, a
request contains a user category, an action, a data category, and a purpose. Assume the
following informal request:
A person acting as a sales agent and an employee requests to collect a customer’s
email for order entry. (Source: [IBM03])
This informal request would be translated into the formal EPAL request as shown in
Table 3.5, based on the elements predefined by EPAL and used by the above created
privacy rule. This request matches the rule defined above and therefore it would be
allowed.
As EPAL was especially designed for enterprises, it offers vocabularies that enables
businesses to express sector-specific privacy policies. Although usually one enterprise will
create a policy, the aim is also that companies agree on a set of vocabularies, exchange
these policies and hence use them in their business transactions. The following section
is going to highlight these EPAL vocabularies.
3.2.4. EPAL vocabularies
By using the epal-vocabulary element, industry-specific vocabularies can be defined
using the following subelements:
34
• vocabulary-information: This element provides information about the vocabulary
- the name (id), the issuer of the vocabulary (issuer) and the version
(version-info).